2cb6df997e3007fe250fa7739aa1c688_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2cb6df997e3007fe250fa7739aa1c688_JaffaCakes118
Size

28.4MB
MD5

2cb6df997e3007fe250fa7739aa1c688
SHA1

f05a2a13895b8d0189bd1347233fc017295c86ce
SHA256

7882e839fc528d5a8d81f85c12abde672e99e8fcb2fb3a1c9d5956a605aebdb7
SHA512

b281ecf8f3daafe042ea63febbb3581ebe2ffd7a320fa8d9883f243d9c2dd0476735d7986fbfa2ec47e48adb3dcd43c555763209a13aa04a346e875e0c355aef
SSDEEP

786432:8SGfA6Mza0JO8f32OcrzEMni6U29VRNDcyqBtFvjWa1q3d:ufEYPtnidGJDcyqBLx83d

Score

1^/10

Malware Config

Signatures

Files

2cb6df997e3007fe250fa7739aa1c688_JaffaCakes118
.7z
360Base.dll
.dll windows:5 windows x86 arch:x86

547cc532c034220469554e1b00fd2d3c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ce:7d:be:c6:68:f3:70:8e:bc:49:63:3e:46:66:60:63:4c:f6:64:81:bd:ef:0d:d0:01:7f:96:28:e8:77:e7:c5
Signer

Actual PE Digest

ce:7d:be:c6:68:f3:70:8e:bc:49:63:3e:46:66:60:63:4c:f6:64:81:bd:ef:0d:d0:01:7f:96:28:e8:77:e7:c5

Digest Algorithm

sha256

PE Digest Matches

true

81:25:b9:c3:ef:09:0d:a9:93:a6:bf:28:69:a4:65:93:a2:32:72:e8
Signer

Actual PE Digest

81:25:b9:c3:ef:09:0d:a9:93:a6:bf:28:69:a4:65:93:a2:32:72:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\281530\out\Release\360Base.pdb

Imports

kernel32

FlushFileBuffers
SystemTimeToFileTime
FindFirstFileW
FindNextFileW
FindClose
DeleteFileW
ReadFile
WideCharToMultiByte
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileAttributesExW
MoveFileExW
QueryPerformanceCounter
LockFileEx
UnlockFileEx
GetFileAttributesW
SetErrorMode
MapViewOfFile
GetFileType
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetACP
lstrlenA
LocalFileTimeToFileTime
GetCurrentThreadId
lstrcmpiA
FindResourceExW
GetLocalTime
SetFilePointer
WriteFile
GetFileSize
GetProcessHeap
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
HeapFree
SetLastError
LocalFree
lstrcmpA
Sleep
InterlockedCompareExchange
GetSystemDirectoryW
LoadLibraryW
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW
GetSystemInfo
GetFileSizeEx
SetFilePointerEx
FreeResource
LockResource
GetVersionExW
GetSystemWindowsDirectoryW
GetCurrentProcess
GetCurrentProcessId
CloseHandle
WriteConsoleW
FreeEnvironmentStringsW
EnterCriticalSection
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetStdHandle
GetConsoleCP
GetConsoleMode
GetStringTypeW
LCMapStringW
DeviceIoControl
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
GetLastError
RaiseException
lstrcmpiW
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
CreateFileW
MultiByteToWideChar
LeaveCriticalSection
InterlockedExchange
IsDebuggerPresent
OutputDebugStringW
GetStdHandle
GetModuleHandleA
lstrcatA
GetSystemDirectoryA
LoadLibraryA
GlobalMemoryStatus
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
CreateFileA
TlsSetValue
HeapLock
HeapWalk
TlsAlloc
TlsGetValue
TlsFree
HeapUnlock
OpenThread
RtlUnwind
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetModuleFileNameA

user32

MessageBoxA
CharNextW
GetUserObjectInformationW
GetProcessWindowStation

advapi32

RegQueryValueExA
ReportEventA
RegisterEventSourceA
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegQueryValueExW
OpenProcessToken
GetTokenInformation
DeregisterEventSource

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateGuid

oleaut32

VarUI4FromStr
SysAllocString

shlwapi

StrCmpNIW
StrTrimA
SHSetValueA
SHGetValueA
PathFileExistsW
PathFindFileNameW
StrRChrW
PathAppendW
PathCombineW
StrStrIW
StrCmpIW
StrStrIA

version

VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CryptDecodeObject
CertGetCertificateChain
CryptMsgControl
CertFindCertificateInStore
CryptMsgOpenToDecode
CryptMsgUpdate
CryptMsgClose
CryptMsgGetParam
CertOpenSystemStoreW
CertCloseStore
CertOpenStore
CertAddStoreToCollection
CryptQueryObject
CertFreeCertificateChain
CryptDecodeObjectEx
CertGetNameStringW
CertGetCertificateContextProperty
CertFreeCertificateContext

iphlpapi

GetAdaptersInfo

Exports

Exports

CreateObject
InitLibs

Sections

.text
Size: 563KB - Virtual size: 562KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360Conf.dll
.dll windows:5 windows x86 arch:x86

290860d1d2acdafd613e1b77faec6c5f

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a5:80:d7:ae:37:96:67:80:08:24:37:b6:21:ed:04:f8:34:ba:e9:c8:9d:5c:2f:d4:c3:b4:94:a6:67:ef:aa:c5
Signer

Actual PE Digest

a5:80:d7:ae:37:96:67:80:08:24:37:b6:21:ed:04:f8:34:ba:e9:c8:9d:5c:2f:d4:c3:b4:94:a6:67:ef:aa:c5

Digest Algorithm

sha256

PE Digest Matches

true

8e:c3:68:52:32:89:36:85:31:1a:2c:70:83:04:f0:4e:81:94:b8:61
Signer

Actual PE Digest

8e:c3:68:52:32:89:36:85:31:1a:2c:70:83:04:f0:4e:81:94:b8:61

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\225155\out\Release\360Conf.pdb

Imports

kernel32

SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
InitializeCriticalSection
InterlockedCompareExchange
Sleep
GetCurrentDirectoryW
WideCharToMultiByte
CreateFileW
GetFileSize
ReadFile
CloseHandle
MultiByteToWideChar
LockFile
UnlockFile
LockResource
FindResourceExW
SetLastError
CreateEventW
SetEvent
WaitForSingleObject
CreateThread
SetThreadPriority
WaitForMultipleObjects
GetLastError
RaiseException
lstrcmpiW
GetModuleHandleW
GetProcAddress
lstrlenW
FreeLibrary
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetStringTypeA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale

user32

CharNextW

advapi32

RegCreateKeyW
RegQueryValueExW
IsTextUnicode
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegNotifyChangeKeyValue

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

SysAllocStringByteLen
SysAllocString
VarUI4FromStr
SysAllocStringLen

shlwapi

SHCreateStreamOnFileW
PathMatchSpecA
PathAppendW

Exports

Exports

CreateObject

Sections

.text
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360FileGuard.dat
360NetBase.dll
.dll windows:5 windows x86 arch:x86

c007d40cfaa17f2934101627f1ad0394

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:7f:58:e8:a0:55:01:a8:89:fc:bc:f5
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

28-02-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 002-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b4:51:6e:28:75:ca:80:d7:1c:1d:69:c2:d2:75:d8:f1:a9:bc:95:ce:23:64:71:06:d1:37:8e:44:8b:3d:87:61
Signer

Actual PE Digest

b4:51:6e:28:75:ca:80:d7:1c:1d:69:c2:d2:75:d8:f1:a9:bc:95:ce:23:64:71:06:d1:37:8e:44:8b:3d:87:61

Digest Algorithm

sha256

PE Digest Matches

true

19:4b:6e:17:2f:3c:d9:47:30:b7:a6:ee:37:4d:9a:df:bf:1a:a2:c5
Signer

Actual PE Digest

19:4b:6e:17:2f:3c:d9:47:30:b7:a6:ee:37:4d:9a:df:bf:1a:a2:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\vmagent_new\bin\joblist\273780\out\Release\360NetBase.pdb

Imports

ws2_32

htons
getsockopt
recv
closesocket
socket
connect
WSASetLastError
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
ioctlsocket
__WSAFDIsSet
select
send
getpeername
bind
ntohs
getsockname
setsockopt
WSAGetLastError
shutdown

user32

MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

kernel32

WriteConsoleW
TlsFree
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
SleepEx
CloseHandle
WaitForSingleObject
ReleaseMutex
CreateMutexA
ExpandEnvironmentStringsA
Sleep
FormatMessageA
GetTickCount
MultiByteToWideChar
FreeLibrary
DeviceIoControl
CreateFileA
GetCurrentProcessId
WideCharToMultiByte
GetModuleFileNameW
GetModuleHandleW
InterlockedCompareExchange
GetProcAddress
LoadLibraryA
lstrlenA
LoadLibraryW
lstrlenW
FindClose
lstrcmpW
GetLongPathNameW
FindFirstFileW
ReadDirectoryChangesW
CreateFileW
CreateEventA
GetPrivateProfileStringW
lstrcmpiW
GetOverlappedResult
lstrcatW
lstrcpyW
GetSystemDirectoryW
WriteFile
SetEvent
GetCurrentProcess
GetModuleHandleA
GetVersionExA
GetSystemDirectoryA
InterlockedExchange
GetModuleFileNameA
WaitForMultipleObjects
FreeLibraryAndExitThread
CreateThread
GetModuleHandleExA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetEndOfFile
SetFilePointerEx
ReadFile
GetFileSizeEx
CreateMutexW
TlsGetValue
HeapAlloc
HeapFree
OutputDebugStringW
GetProcessHeap
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
GetCurrentThreadId
TlsAlloc
GetVersion
GetFileType
GetStdHandle
QueryPerformanceCounter
GlobalMemoryStatus
FlushConsoleInputBuffer
GetSystemTime
ExitThread
HeapReAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
RaiseException
RtlUnwind
GetCommandLineA
ExitProcess
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
InterlockedIncrement
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryA
LCMapStringA
LCMapStringW
GetConsoleCP
FlushFileBuffers
SetFilePointer
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

advapi32

RegQueryValueExW
RegOpenKeyExW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumKeyExW
RegQueryValueExA
RegNotifyChangeKeyValue
RegEnumKeyExA
RegCloseKey

oleaut32

SysFreeString
VarBstrCmp
VariantClear
SysAllocStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen

shlwapi

PathCombineA
StrStrIW
SHGetValueW
PathFileExistsW
PathAppendW
StrCmpIW
PathFileExistsA
PathFindFileNameA
PathRemoveFileSpecW

crypt32

CertEnumCertificatesInStore
CertOpenSystemStoreA
CertCloseStore

Exports

Exports

InitLibs

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360P2SP.dll
.dll windows:5 windows x86 arch:x86

f9fd18523418848564e74a7e085299d0

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

93:85:d3:e3:39:90:f9:c7:d1:b7:1d:03:dd:18:c1:c7:94:44:53:24:65:f0:76:44:87:59:45:a0:bf:37:a7:c1
Signer

Actual PE Digest

93:85:d3:e3:39:90:f9:c7:d1:b7:1d:03:dd:18:c1:c7:94:44:53:24:65:f0:76:44:87:59:45:a0:bf:37:a7:c1

Digest Algorithm

sha256

PE Digest Matches

true

9c:81:e8:c5:ef:8a:8d:90:a7:ba:b5:dd:64:e1:06:47:8c:ad:2d:32
Signer

Actual PE Digest

9c:81:e8:c5:ef:8a:8d:90:a7:ba:b5:dd:64:e1:06:47:8c:ad:2d:32

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\330290\out\Release\360P2SP.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

gethostname
gethostbyname
inet_addr
accept
WSAAsyncSelect
WSACancelAsyncRequest
WSAAsyncGetHostByName
listen
shutdown
getpeername
bind
WSASetLastError
sendto
recvfrom
ioctlsocket
select
__WSAFDIsSet
WSAGetLastError
WSAStartup
WSACleanup
htonl
WSCEnumProtocols
ntohs
ntohl
inet_ntoa
socket
htons
connect
closesocket
setsockopt
send
recv

kernel32

GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
SetStdHandle
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTickCount
ReadFile
GetLastError
SetFilePointer
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcess
ReleaseMutex
ReleaseSemaphore
WaitForMultipleObjects
WaitForSingleObject
SetEndOfFile
GetFileSizeEx
WriteFile
CreateFileW
CreateEventW
CreateSemaphoreW
CreateMutexW
SetWaitableTimer
CreateWaitableTimerW
DeleteFileW
MoveFileW
GlobalFree
GlobalAlloc
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
GetModuleHandleExW
FreeLibraryAndExitThread
InterlockedDecrement
InterlockedIncrement
GetFileSize
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
RaiseException
GetFileAttributesW
DeviceIoControl
GetCurrentProcessId
GetModuleFileNameW
lstrlenA
lstrlenW
GetLocaleInfoA
GetUserDefaultLangID
SetEvent
ResetEvent
LoadLibraryExW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetTempPathW
QueryPerformanceFrequency
GetModuleHandleA
GetSystemDirectoryA
GetLocalTime
InterlockedExchangeAdd
GetModuleFileNameA
CreateThread
GetStartupInfoA
SetHandleCount
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
GetCurrentDirectoryA
GetFileType
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
GetStdHandle
ExitProcess
HeapDestroy
HeapCreate
VirtualAlloc
VirtualFree
HeapReAlloc
GetCommandLineA
ExitThread
FindFirstFileW
GetDriveTypeW
FileTimeToLocalFileTime
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetLastError
GetSystemDirectoryW
lstrcmpA
SetFilePointerEx
LocalFileTimeToFileTime
FileTimeToSystemTime
FindClose
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
HeapUnlock
OpenThread
HeapLock
HeapWalk
lstrcmpiA
TlsGetValue
HeapAlloc
HeapFree
TlsAlloc
TlsFree
TerminateProcess
OutputDebugStringW
GetProcessHeap
GetModuleHandleW
TlsSetValue

user32

SetForegroundWindow
ShowWindow
CheckDlgButton
SetDlgItemTextW
UnregisterClassW
PostMessageW
CallNextHookEx
IsDialogMessageW
PostQuitMessage
SetWindowLongW
GetWindowLongW
RegisterClassExW
CreateWindowExW
DefWindowProcW
SendMessageW
SetTimer
CreateDialogParamW
SetWindowPos
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
GetDlgItemTextW
wsprintfW
IsDlgButtonChecked
SetWindowsHookExW
SetWindowTextW
UnhookWindowsHookEx

advapi32

RegCreateKeyExW
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegEnumKeyExA
RegNotifyChangeKeyValue
RegDeleteValueW
RegSetValueExW
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExW
AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathW

ole32

CoInitialize
CoUninitialize
OleRun
CLSIDFromProgID
CoCreateInstance

oleaut32

GetErrorInfo
SysFreeString
SysAllocString
VariantInit
VariantChangeType
VariantClear
SafeArrayDestroy
SafeArrayCreate
SafeArrayPutElement

shlwapi

PathRemoveFileSpecW
StrStrIW
UrlCanonicalizeA
UrlCanonicalizeW
PathFileExistsW
PathCombineW
PathAppendW
SHSetValueA
PathFindFileNameA
wvnsprintfW
SHGetValueA
PathCombineA

iphlpapi

GetNetworkParams
GetAdaptersInfo

secur32

AcquireCredentialsHandleA
InitializeSecurityContextA
FreeCredentialsHandle

rasapi32

RasGetConnectStatusW
RasEnumConnectionsW

Exports

Exports

CancelCheckProxy
CheckProxy
CheckProxyEx
CreateP2SPTask
GetFinishMessage
GetServerInfo
GetUploadInfo
Init
Login
QueryTask
QueryTask2
QueryTaskPeer
RemoveTask
SetConfigInfo
SetP2spOption
StartTask
StopSeed
StopTask
Uninit
UpdateRegInfo

Sections

.text
Size: 502KB - Virtual size: 502KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360QMachine.exe
.exe windows:5 windows x86 arch:x86

f34820a4c5512a20c2fd704f0b09bf54

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:69:e5:32:32:67:47:08:fd:e5:35:a7:52:fc:d2:a2:fe:b5:df:2f
Signer

Actual PE Digest

3a:69:e5:32:32:67:47:08:fd:e5:35:a7:52:fc:d2:a2:fe:b5:df:2f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\building\360project\360sd\branches\360QMachine\360QMachine\Release\360QMachine.pdb

Imports

kernel32

SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrcmpiW
CreateThread
GetVersion
GetVersionExW
GetModuleHandleA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcmpW
QueryDosDeviceW
GetLogicalDriveStringsW
LoadLibraryA
GetLongPathNameW
WideCharToMultiByte
AreFileApisANSI
GetACP
ProcessIdToSessionId
GetCurrentProcessId
GetTickCount
FindClose
FindFirstFileW
FindNextFileW
Thread32Next
SuspendThread
OpenThread
Thread32First
ResumeThread
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
CopyFileW
GetTempPathW
ReadProcessMemory
MultiByteToWideChar
ReadFile
CreateFileW
CreateDirectoryW
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
TlsSetValue
TlsGetValue
InterlockedCompareExchange
TlsFree
GetFileAttributesExW
CreateMutexW
SystemTimeToFileTime
FileTimeToSystemTime
GetPrivateProfileSectionW
GetFileSize
WritePrivateProfileStringW
GetWindowsDirectoryW
GetTimeZoneInformation
GetFileAttributesW
MoveFileExW
SetEnvironmentVariableW
WritePrivateProfileSectionW
GetPrivateProfileStringW
InitializeCriticalSection
Module32NextW
Module32FirstW
lstrlenA
DebugBreak
OutputDebugStringW
SetFilePointer
DeviceIoControl
SetCurrentDirectoryW
GetPrivateProfileIntW
LeaveCriticalSection
FreeLibrary
GlobalMemoryStatus
EnterCriticalSection
DeleteAtom
FindAtomW
AddAtomW
GetAtomNameW
GetSystemTime
LocalFree
GetLocalTime
FormatMessageW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
ExitProcess
HeapSize
HeapReAlloc
FatalAppExitA
HeapDestroy
HeapCreate
GetModuleFileNameA
GetStdHandle
HeapFree
InterlockedDecrement
lstrlenW
InterlockedIncrement
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
RaiseException
GetCurrentThreadId
SetLastError
LoadLibraryW
GetProcAddress
GetModuleHandleW
ReleaseMutex
CreateMutexA
CloseHandle
Sleep
GetModuleFileNameW
GetLastError
OpenProcess
GetDriveTypeW
WriteFile
GetCurrentThread
TlsAlloc
IsValidCodePage
GetOEMCP
GetCPInfo
GetStartupInfoW
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
VirtualAlloc
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
TerminateProcess

user32

GetClassInfoW
UnregisterClassA
CreateDialogParamW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
DestroyWindow
ShowWindow
IsDialogMessageW
RegisterClassW
FindWindowW
GetWindowThreadProcessId
SendMessageTimeoutW
DefWindowProcW
IsWindowVisible
IsIconic
LoadIconW
LoadImageW
SendMessageW
KillTimer
SetTimer
SetWindowTextW
MessageBoxW
PostQuitMessage
PtInRect
CopyRect
GetCursorPos
ScreenToClient
LoadCursorW
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
EndDialog
DialogBoxParamW
ExitWindowsEx
GetWindowLongW
GetParent
wvsprintfW
CharLowerW
BringWindowToTop
SwitchToThisWindow
SetWindowPos
EnumThreadWindows
SystemParametersInfoW
GetSystemMetrics
WindowFromPoint
SetForegroundWindow
WaitForInputIdle
CharLowerBuffW
PostMessageW
CharNextW
SetWindowLongW
LoadStringW

advapi32

LookupPrivilegeValueW
GetTokenInformation
AllocateAndInitializeSid
IsValidSid
EqualSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
AdjustTokenPrivileges
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueExA

shell32

ShellExecuteExW
SHChangeNotify
SHGetSpecialFolderPathW
ShellExecuteW

ole32

IIDFromString
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SysAllocString
SysAllocStringByteLen
SysStringByteLen
SafeArrayCopy
SafeArrayGetVartype
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayRedim
SafeArrayCreate
SafeArrayUnlock
SafeArrayLock
SysAllocStringLen
VariantCopy
VarUI4FromStr
VariantClear
VariantInit
DispCallFunc
CreateErrorInfo
GetErrorInfo
VariantChangeType
SetErrorInfo
SysFreeString

shlwapi

PathAppendW
PathCombineW
StrCmpNW
SHDeleteValueW
StrStrIW
PathFileExistsW
SHGetValueW
SHSetValueW
PathRemoveFileSpecW
PathAddBackslashW
StrCmpNIW
SHDeleteKeyW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

Sections

.text
Size: 516KB - Virtual size: 515KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360Restore.exe
.exe windows:5 windows x86 arch:x86

e8b4c92ee491130edef61ce98e8b9cb4

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:69:1a:ba:4b:3a:b8:fc:98:8e:83:c7:a0:11:25:28:ae:36:dd:3b:e5:40:7c:90:61:ff:61:a4:83:90:36:14
Signer

Actual PE Digest

1c:69:1a:ba:4b:3a:b8:fc:98:8e:83:c7:a0:11:25:28:ae:36:dd:3b:e5:40:7c:90:61:ff:61:a4:83:90:36:14

Digest Algorithm

sha256

PE Digest Matches

true

0a:b4:7e:d8:21:52:91:09:c7:72:24:c0:9d:5b:8e:40:90:8a:79:05
Signer

Actual PE Digest

0a:b4:7e:d8:21:52:91:09:c7:72:24:c0:9d:5b:8e:40:90:8a:79:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\281272\out\Release\360Restore.pdb

Imports

kernel32

GetVersionExW
FlushInstructionCache
GetCurrentThreadId
InterlockedCompareExchange
CreateProcessW
lstrlenW
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
SetLastError
Sleep
MultiByteToWideChar
OpenProcess
GetCommandLineW
SetCurrentDirectoryW
CreateMutexW
GetTickCount
LocalFree
InterlockedExchange
FreeResource
WriteFile
SetFileAttributesW
DeleteFileW
RemoveDirectoryW
CreateDirectoryW
ReadFile
SetFilePointer
GetFileSize
GetSystemDirectoryW
GetCurrentThread
GetSystemWindowsDirectoryW
GetLongPathNameW
OutputDebugStringW
IsDebuggerPresent
WaitForSingleObject
TerminateProcess
SetUnhandledExceptionFilter
SetEvent
CreateThread
CreateEventW
WideCharToMultiByte
GetPrivateProfileStringW
FileTimeToSystemTime
GetExitCodeProcess
WritePrivateProfileStringW
GetShortPathNameW
MulDiv
LeaveCriticalSection
FreeLibrary
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
EnterCriticalSection
SetStdHandle
GetConsoleMode
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleHandleA
LCMapStringW
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoW
UnhandledExceptionFilter
RtlUnwind
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
TlsGetValue
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
GetLocalTime
SystemTimeToFileTime
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
IsWow64Process
GetCurrentProcess
RaiseException
GetModuleFileNameW
LoadLibraryExW
GetLastError
LoadLibraryW
GetProcAddress
GetCurrentProcessId
CreateFileW
DeviceIoControl
CloseHandle
GetSystemTimeAsFileTime
CreateFileA
lstrlenA
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
GetConsoleCP
InitializeCriticalSection
GetModuleHandleW
WriteConsoleA

user32

PeekMessageW
GetMessageW
TranslateMessage
LoadCursorW
GetClassInfoExW
ShowWindow
UnregisterClassA
SetWindowLongW
DispatchMessageW
EndPaint
BeginPaint
IsWindow
InvalidateRect
GetCursor
SetCursor
DrawTextW
EqualRect
PtInRect
GetTopWindow
EnableWindow
GetWindowTextLengthW
GetWindowTextW
GetSystemMetrics
LoadImageW
DisableProcessWindowsGhosting
CallWindowProcW
GetActiveWindow
GetCursorPos
IsWindowVisible
PostQuitMessage
ScreenToClient
SetWindowTextW
PostMessageW
TrackMouseEvent
DialogBoxParamW
OffsetRect
CopyRect
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
KillTimer
SetTimer
SendMessageW
GetWindowLongW
EndDialog
GetDC
ReleaseDC
FindWindowW
SetForegroundWindow
MessageBoxW
DefWindowProcW
CreateWindowExW
RegisterClassExW
DestroyWindow
CharNextW

gdi32

CreateFontIndirectW
SetBkColor
SetTextColor
SetBkMode
SelectObject
DeleteDC
GetTextExtentPoint32W
GetDeviceCaps

advapi32

RegCreateKeyExW
RegCloseKey
OpenProcessToken
GetTokenInformation
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA

shell32

ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetMalloc
ShellExecuteW

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal

oleaut32

VarUI4FromStr
SysAllocString
SysFreeString
VariantInit
VariantClear
DispCallFunc
SysAllocStringByteLen
SysStringByteLen
SysStringLen

shlwapi

StrStrW
StrRChrW
PathFindFileNameW
StrStrIW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathCombineW
SHSetValueW
StrChrW
StrCmpNIW
StrCmpIW
PathIsRelativeW
SHGetValueW
PathIsDirectoryW

comctl32

InitCommonControlsEx

version

VerQueryValueW

psapi

GetModuleFileNameExW

ntdll

NtDelayExecution
ZwProtectVirtualMemory
RtlReAllocateHeap
ZwAllocateVirtualMemory
RtlAllocateHeap
ZwFreeVirtualMemory
ZwQueryVirtualMemory
RtlCreateHeap
ZwQuerySystemInformation

Sections

.text
Size: 335KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360SkinMgr.exe
.exe windows:5 windows x86 arch:x86

c52e6a1135a0ec5910b8e7b6d62c2ffd

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:a8:64:31:31:c4:ba:3c:5d:f4:20:7e:a8:81:ba:3c:ad:44:d3:1a:da:39:60:33:c7:62:a7:17:4c:f8:5c:60
Signer

Actual PE Digest

46:a8:64:31:31:c4:ba:3c:5d:f4:20:7e:a8:81:ba:3c:ad:44:d3:1a:da:39:60:33:c7:62:a7:17:4c:f8:5c:60

Digest Algorithm

sha256

PE Digest Matches

true

e1:60:d2:54:a8:41:63:43:f7:b3:bf:16:4d:f5:af:c7:fe:cd:8a:67
Signer

Actual PE Digest

e1:60:d2:54:a8:41:63:43:f7:b3:bf:16:4d:f5:af:c7:fe:cd:8a:67

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\310412\out\Release\360SkinMgr.pdb

Imports

kernel32

Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
QueryDosDeviceW
GetLogicalDriveStringsW
LoadLibraryA
WideCharToMultiByte
AreFileApisANSI
GetACP
ProcessIdToSessionId
GetCurrentProcessId
GetTickCount
Thread32Next
SuspendThread
OpenThread
Thread32First
ResumeThread
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
CopyFileW
ReadProcessMemory
GlobalMemoryStatus
SetFileAttributesW
TlsSetValue
TlsGetValue
Sleep
InterlockedCompareExchange
TlsFree
GetFileAttributesExW
CreateMutexW
SystemTimeToFileTime
FileTimeToSystemTime
GetTimeZoneInformation
GetFileAttributesW
TerminateProcess
MoveFileW
MoveFileExW
SetEnvironmentVariableW
WritePrivateProfileSectionW
GetDriveTypeW
Module32NextW
Module32FirstW
ExpandEnvironmentStringsW
GetLongPathNameW
GetTempPathW
GetCommandLineW
GetDiskFreeSpaceExW
GetVersionExW
GetVersion
GetPrivateProfileSectionW
lstrcpynW
SetFilePointer
DeviceIoControl
SetCurrentDirectoryW
IsBadReadPtr
CompareFileTime
CreateEventW
CreateThread
CreateSemaphoreA
ReleaseSemaphore
WaitForMultipleObjects
CreateFileA
GetModuleHandleA
InterlockedExchange
HeapLock
HeapUnlock
OutputDebugStringW
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
SetConsoleCtrlHandler
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
ExitProcess
HeapCreate
FatalAppExitA
GetCurrentThread
TlsAlloc
GetModuleFileNameA
GetStdHandle
GetStringTypeW
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoW
GetSystemTimeAsFileTime
ExitThread
VirtualQuery
GetSystemInfo
VirtualProtect
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
lstrlenA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetPrivateProfileIntW
LocalAlloc
WriteFile
GlobalFree
lstrcmpiW
LoadLibraryExW
FreeLibrary
GetModuleHandleW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
MulDiv
lstrcmpW
MultiByteToWideChar
CreateDirectoryW
InterlockedDecrement
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleFileNameW
lstrlenW
GetCurrentProcess
FlushInstructionCache
GetWindowsDirectoryW
DeleteCriticalSection
GetCurrentThreadId
SetLastError
GetPrivateProfileStringW
CreateMutexA
LoadLibraryW
GetProcAddress
ReleaseMutex
GetFileSize
ReadFile
GetLastError
CreateFileW
CloseHandle
GetShortPathNameW
WritePrivateProfileStringW
FindResourceExW
RaiseException
LoadResource
LockResource
SizeofResource
FindResourceW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
HeapWalk

user32

PostMessageW
DialogBoxParamW
CopyRect
SetTimer
KillTimer
SendDlgItemMessageW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
RegisterClassW
UnregisterClassA
GetClassInfoW
SetWindowLongW
DestroyWindow
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CallWindowProcW
CreateDialogParamW
FindWindowW
PostQuitMessage
EndDialog
GetActiveWindow
IsIconic
IsWindowVisible
DefWindowProcW
GetWindowLongW
ShowWindow
IsDialogMessageW
RegisterClassExW
LoadCursorW
GetClassInfoExW
RegisterWindowMessageW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
SendMessageW
DestroyAcceleratorTable
GetSysColor
GetWindow
GetFocus
SetFocus
IsChild
EndPaint
FillRect
BeginPaint
GetClientRect
IsWindow
RedrawWindow
SetWindowPos
GetClassNameW
GetParent
CharNextW
GetDesktopWindow
ReleaseDC
GetDC
SendMessageTimeoutW
GetWindowRect
CreateAcceleratorTableW
MoveWindow
BringWindowToTop
SwitchToThisWindow
EnumThreadWindows
SystemParametersInfoW
GetSystemMetrics
WindowFromPoint
SetForegroundWindow
WaitForInputIdle
CharLowerBuffW
SetRect
PtInRect
GetCursorPos
SetCursor
TrackMouseEvent
MessageBoxW
LoadImageW
CreateWindowExW
GetDlgItem
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
ScreenToClient
ClientToScreen

gdi32

CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
DeleteObject
CreatePen
Rectangle
CreateCompatibleBitmap
SetStretchBltMode
SetPixel
GetPixel
CreateDIBSection
SetDIBColorTable
SetViewportOrgEx
CreateSolidBrush
CreateDCW
GetStockObject
GetDIBits
RealizePalette
StretchBlt
SelectPalette
GetDeviceCaps
GetObjectW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
LookupPrivilegeValueW
GetTokenInformation
AllocateAndInitializeSid
IsValidSid
EqualSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
AdjustTokenPrivileges
GetUserNameW
RegQueryInfoKeyW
RegQueryValueExA

shell32

ShellExecuteExW
ShellExecuteW
SHChangeNotify
CommandLineToArgvW
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc
CoTaskMemFree
OleLockRunning
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
CoInitialize
CoUninitialize

oleaut32

SysStringByteLen
SysAllocStringByteLen
VariantChangeType
SafeArrayCreate
VarUI4FromStr
OleCreateFontIndirect
SysAllocString
SysAllocStringLen
SysStringLen
LoadTypeLi
LoadRegTypeLi
SysFreeString
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SetErrorInfo
GetErrorInfo
VariantClear
VariantInit
DispCallFunc
CreateErrorInfo

shlwapi

SHSetValueW
StrCmpNIW
StrCmpNW
PathFindExtensionW
StrCmpIW
SHDeleteValueW
SHDeleteKeyW
PathAddBackslashW
PathRemoveFileSpecW
PathAppendW
StrStrW
SHGetValueW
StrStrIW
PathCombineW
PathFileExistsW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend
TransparentBlt

gdiplus

GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipFree
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdiplusShutdown
GdipCreateBitmapFromScan0

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

ws2_32

select

Sections

.text
Size: 681KB - Virtual size: 681KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360Util.dll
.dll windows:5 windows x86 arch:x86

ba8c2f9e7ecd75d996b85299e9206537

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d7:c6:cb:b4:88:81:7b:15:26:77:58:ac:20:44:82:3f:79:02:62:25:f0:15:4e:b1:8a:38:13:ff:13:d5:aa:27
Signer

Actual PE Digest

d7:c6:cb:b4:88:81:7b:15:26:77:58:ac:20:44:82:3f:79:02:62:25:f0:15:4e:b1:8a:38:13:ff:13:d5:aa:27

Digest Algorithm

sha256

PE Digest Matches

true

b6:5b:95:d3:d7:8f:9b:7b:a4:72:90:63:74:41:0a:b5:fe:b6:ea:fd
Signer

Actual PE Digest

b6:5b:95:d3:d7:8f:9b:7b:a4:72:90:63:74:41:0a:b5:fe:b6:ea:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\287231\out\Release\360Util.pdb

Imports

kernel32

GetFileTime
GlobalLock
GlobalSize
GlobalUnlock
GetFileAttributesExW
GetTickCount
DeviceIoControl
GetCurrentProcessId
GetLongPathNameW
GetWindowsDirectoryW
SearchPathW
CreateThread
WaitForSingleObject
GetSystemDefaultUILanguage
GetFileSize
GetLocalTime
lstrcmpiA
VirtualProtect
GetModuleHandleExW
IsBadStringPtrW
OpenProcess
CreateProcessW
WTSGetActiveConsoleSessionId
LocalAlloc
LocalFree
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GlobalAlloc
GlobalFree
CreateToolhelp32Snapshot
Process32FirstW
ProcessIdToSessionId
WriteFile
GetModuleHandleA
ResumeThread
GetExitCodeProcess
CreateMutexW
ReleaseMutex
GetProcessTimes
GetSystemTime
WideCharToMultiByte
SetFileAttributesW
DeleteFileW
OpenThread
CreateEventW
GetCommandLineW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
CreateFileA
OutputDebugStringW
GetFileSizeEx
Process32NextW
SetFilePointerEx
HeapLock
HeapUnlock
HeapWalk
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LocalFileTimeToFileTime
InterlockedExchange
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
FindResourceExW
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetModuleFileNameW
RaiseException
InitializeCriticalSection
lstrcmpiW
SetLastError
CloseHandle
GetSystemDirectoryW
SetFilePointer
GetFileInformationByHandle
CreateFileW
ReadFile
MultiByteToWideChar
ExpandEnvironmentStringsW
LoadLibraryW
Sleep
GetVersionExW
GetSystemWindowsDirectoryW
GetProcAddress
GetModuleHandleW
GetCurrentProcess
LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
InitializeCriticalSectionAndSpinCount
GetLastError
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetFileAttributesW
SystemTimeToFileTime
DeleteCriticalSection

user32

SendMessageTimeoutW
EnumDisplayDevicesW
IsZoomed
GetLastInputInfo
GetAncestor
GetClassNameW
GetShellWindow
GetWindowInfo
GetWindowRect
WindowFromPoint
CharNextW
LoadStringW
FindWindowW
GetWindowThreadProcessId
GetSystemMetrics
SetForegroundWindow
wsprintfW
MonitorFromWindow
GetForegroundWindow
IsWindow
IsWindowVisible
GetWindow
GetDesktopWindow

advapi32

CloseServiceHandle
StartServiceW
ChangeServiceConfigW
OpenServiceW
OpenSCManagerW
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
FreeSid
GetLengthSid
SetTokenInformation
AllocateAndInitializeSid
CreateRestrictedToken
DuplicateTokenEx
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegEnumKeyW
RegOpenKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CreateProcessAsUserW
LookupAccountSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExA
QueryServiceStatus

shell32

SHGetDesktopFolder
ord25
ord18
SHGetSpecialFolderPathW
ShellExecuteExW
ord152
ord190
ord155
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteW
ord165
SHGetFileInfoW

ole32

CreateStreamOnHGlobal
CoInitialize
StringFromGUID2
IIDFromString
GetHGlobalFromStream
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VariantChangeType
SysStringLen
VariantClear
SysStringByteLen
SysAllocStringByteLen
SafeArrayGetElement
SafeArrayPutElement
VariantInit
SafeArrayCreate
SysFreeString
SysAllocString
VarUI4FromStr

shlwapi

SHEnumValueW
StrCmpIW
ord176
PathFindExtensionW
PathCombineW
PathIsDirectoryW
PathRemoveFileSpecW
PathAppendW
SHSetValueW
SHGetValueW
PathFileExistsW
StrChrW
PathAddBackslashW
PathIsRelativeW
PathFindFileNameW
StrCpyNW
StrCmpNIW
StrRetToBufW
StrPBrkA
StrPBrkW
StrStrIA
StrStrIW

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
ntohs
ntohl
WSCUnInstallNameSpace
WSCDeinstallProvider
htonl
htons

version

VerQueryValueW

msvcrt

wcscspn
_mbsstr
_mbsrchr
_mktime64
calloc
_localtime64
_lseeki64
_lock
_unlock
_amsg_exit
memcpy
memmove
memset
_iob
abort
??2@YAPAXI@Z
iswspace
_errno
??_U@YAPAXI@Z
wcsstr
wcschr
wcsncmp
malloc
__CxxFrameHandler
_mbslwr
free
wcsspn
mbtowc
_CIsqrt
_CxxThrowException
memcmp
swscanf
_vsnprintf
?terminate@@YAXXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
?what@exception@@UBEPBDXZ
??1type_info@@UAE@XZ
__dllonexit
_onexit
_XcptFilter
_initterm
??0exception@@QAE@ABQBD@Z
??_V@YAXPAX@Z
__mb_cur_max
isleadbyte
_snprintf
_itoa
ferror
??3@YAXPAX@Z
__badioinfo
__pioinfo
_fileno
_write
_isatty
wcspbrk
_wcsupr
wcstol
realloc
rand
_wcslwr
_strlwr
strchr
srand
_wcsnicmp
atoi
_wtoi
_wtoi64
_vscwprintf
_vsnwprintf
_wcsicmp
wcsrchr
memchr

iphlpapi

GetIpAddrTable

imagehlp

ImageDirectoryEntryToData

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

psapi

GetModuleFileNameExW

rpcrt4

RpcAsyncInitializeHandle
RpcAsyncCompleteCall
RpcAsyncCancelCall
NdrAsyncClientCall
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree

Exports

Exports

CreateObject
InitLibs
RegisterInstallTime

Sections

.text
Size: 405KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360ave_ex.def
360ave_ex2.def
360ave_ex3.def
360compro.dll
.dll windows:5 windows x86 arch:x86

1ac29f864384f420575653874815f2a5

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fb:0f:7e:0f:c8:fe:e8:a1:d6:14:39:52:81:cc:3c:56:1c:1a:3e:68:08:5e:73:93:26:f1:58:60:61:cc:ce:9b
Signer

Actual PE Digest

fb:0f:7e:0f:c8:fe:e8:a1:d6:14:39:52:81:cc:3c:56:1c:1a:3e:68:08:5e:73:93:26:f1:58:60:61:cc:ce:9b

Digest Algorithm

sha256

PE Digest Matches

true

ce:1d:08:e6:61:d7:09:d4:0a:92:88:76:7b:93:4d:1b:97:2a:93:34
Signer

Actual PE Digest

ce:1d:08:e6:61:d7:09:d4:0a:92:88:76:7b:93:4d:1b:97:2a:93:34

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\286430\out\Release\360compro.pdb

Imports

kernel32

RaiseException
HeapFree
GetProcessHeap
GetDiskFreeSpaceW
FlushInstructionCache
GlobalFree
SystemTimeToFileTime
GetSystemTime
GlobalAlloc
ReleaseMutex
ResetEvent
SetEvent
GetCurrentDirectoryW
GetCurrentThreadId
GlobalUnlock
GlobalLock
GlobalSize
SetLastError
Sleep
InterlockedCompareExchange
GetTempFileNameW
GetTempPathW
SetCurrentDirectoryW
GetCommandLineW
SetFileAttributesW
GetTickCount
CreateSemaphoreW
ReleaseSemaphore
GetDriveTypeW
IsBadReadPtr
WriteFile
CreateDirectoryW
CreateEventW
FindResourceW
SizeofResource
FreeResource
lstrcmpiW
SetFilePointer
GetCurrentProcessId
HeapAlloc
GetPrivateProfileStructW
LoadLibraryA
GetSystemInfo
GetModuleHandleA
SetEndOfFile
GetFileSizeEx
CreateMutexW
WaitForMultipleObjects
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
CreateFileW
DeleteAtom
FindAtomW
LoadResource
OpenThread
GetAtomNameW
LocalFree
FormatMessageW
SetFilePointerEx
LocalFileTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetDateFormatA
GetTimeFormatA
GetStartupInfoA
SetHandleCount
GetFileType
SetStdHandle
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
HeapReAlloc
HeapDestroy
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
InitializeCriticalSectionAndSpinCount
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetSystemTimeAsFileTime
ExitThread
ExitProcess
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetPrivateProfileStringW
MultiByteToWideChar
OutputDebugStringW
DebugBreak
lstrlenA
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFileEx
ReadFile
GetVolumeInformationW
GetLongPathNameW
LoadLibraryExW
InterlockedExchange
CreateThread
DeleteFileW
GetSystemDirectoryW
CopyFileW
GetLastError
WideCharToMultiByte
WaitForSingleObject
DeviceIoControl
GetFileAttributesExW
InterlockedIncrement
GetStartupInfoW
CreateProcessW
lstrlenW
FindNextFileW
GetPrivateProfileIntW
FindFirstFileW
FindClose
GetCurrentProcess
GetVersionExW
OpenProcess
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
FreeLibrary
LoadLibraryW
InterlockedDecrement
AddAtomW

user32

CheckMenuItem
MapWindowPoints
DrawTextW
LoadCursorW
GetWindowDC
TrackMouseEvent
CreateWindowExW
ReleaseCapture
OffsetRect
PtInRect
SetCapture
ScreenToClient
RegisterWindowMessageW
ClientToScreen
GetDlgItem
WindowFromPoint
EnumDisplaySettingsW
GetMonitorInfoW
MonitorFromPoint
GetWindowInfo
CopyRect
UnregisterClassA
GetWindow
GetDesktopWindow
GetShellWindow
GetSystemMetrics
GetAncestor
EqualRect
GetWindowRect
GetForegroundWindow
SetWindowPos
SystemParametersInfoW
GetClientRect
SetWindowRgn
WaitForInputIdle
CharUpperW
CharLowerW
PostMessageW
SendMessageTimeoutW
IsWindow
ShowWindow
MonitorFromWindow
SetCursor
GetWindowThreadProcessId
FindWindowW
GetActiveWindow
MessageBoxW
SendMessageW
LoadStringW
InvalidateRect
GetDC
UpdateLayeredWindow
ReleaseDC
IsDialogMessageW
KillTimer
SetTimer
GetWindowLongW
DestroyWindow
DefDlgProcW
CreateDialogParamW
IsWindowVisible
SetWindowLongW
SetDlgItemTextW
CharNextW
GetCursorPos
TrackPopupMenu
GetParent
CreatePopupMenu
GetSubMenu
LoadMenuW
RedrawWindow
DestroyMenu
GetClassInfoW
RegisterClassW

advapi32

RegQueryValueExW
ChangeServiceConfigW
GetUserNameW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumValueW
RegFlushKey
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
CloseServiceHandle
StartServiceW
CreateServiceW
RegCreateKeyExW
RegDeleteValueW
OpenProcessToken
GetTokenInformation
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExA

ole32

CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
GetHGlobalFromStream

shell32

ord680
SHGetSpecialFolderPathW
SHParseDisplayName
ShellExecuteExW
SHGetFolderPathW
ExtractIconExW
SHBindToParent
ShellExecuteW
ord155

oleaut32

VariantCopy
SysStringByteLen
SysAllocStringByteLen
SysFreeString
VariantInit
VariantClear
SysAllocString
DispCallFunc
VariantChangeType
VarUI4FromStr
SysStringLen

shlwapi

SHDeleteValueW
StrCmpIW
PathFindFileNameW
StrCmpW
PathFindExtensionW
wnsprintfW
PathIsDirectoryW
PathIsRelativeW
StrStrIA
StrStrIW
PathIsRootW
StrChrW
PathCombineW
SHGetValueW
SHSetValueW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW

gdi32

CreateDIBSection
DeleteDC
SelectObject
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
BitBlt
CreateRectRgn
SetBkMode
TextOutW
ExtTextOutW
SetBkColor
SetViewportOrgEx
SetTextColor
EnumFontFamiliesW
CreateFontW
DeleteObject
CombineRgn

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

GetModuleFileNameExW

gdiplus

GdipGetImageHeight
GdipGetImageWidth
GdipDeleteGraphics
GdipCreateBitmapFromStreamICM
GdipCreateFromHDC
GdipCloneImage
GdiplusStartup
GdipAlloc
GdipFree
GdipSetInterpolationMode
GdipDrawImageRectRectI
GdiplusShutdown
GdipCreateBitmapFromStream
GdipDisposeImage

netapi32

NetApiBufferFree
NetUserGetInfo

setupapi

SetupDiDestroyDeviceInfoList
CM_Get_Device_IDW
CM_Get_Parent
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW

Exports

Exports

CalcV3Param_RunOnce
CreateFireWallState
CreateFireWallState2
CreateFireWallState3
CreateFireWallState4
CreateFireWallStateQuick
CreateFireWallStateQuick2
CreateFireWallStateQuick3
CreatePluginFactory
CreateTrayClient
DeleteV3ParamItem
GetV3ParamInfo
NewCreatePlugin
SetAntiVirusCheckFlag

Sections

.text
Size: 348KB - Virtual size: 348KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360net.dll
.dll windows:5 windows x86 arch:x86

5094205f2f08eecf1d4225fab91190e5

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

13:b7:74:ee:59:e3:5e:c6:06:26:16:89
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

28-02-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 002-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bf:04:28:ed:71:11:78:c4:11:43:be:64:72:90:fb:d7:2f:4e:ed:1d:4b:2f:e6:71:84:bf:ba:02:ea:46:b0:04
Signer

Actual PE Digest

bf:04:28:ed:71:11:78:c4:11:43:be:64:72:90:fb:d7:2f:4e:ed:1d:4b:2f:e6:71:84:bf:ba:02:ea:46:b0:04

Digest Algorithm

sha256

PE Digest Matches

true

78:19:71:19:02:df:43:58:d3:c8:6e:a2:c2:d4:7e:51:9b:d7:89:30
Signer

Actual PE Digest

78:19:71:19:02:df:43:58:d3:c8:6e:a2:c2:d4:7e:51:9b:d7:89:30

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\262929\out\Release\bin\360net.pdb

Imports

kernel32

CreateEventW
WriteFile
SetEndOfFile
SetFilePointerEx
GetSystemTime
GetCurrentProcess
ReleaseSemaphore
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
ReadFile
lstrlenW
SystemTimeToFileTime
GetFileAttributesExW
CreateMutexW
CreateSemaphoreW
SetFilePointer
GetFileSizeEx
GetSystemTimeAsFileTime
lstrcatW
GetFileSize
MoveFileW
CreateThread
GlobalAlloc
GlobalFree
GetLocalTime
GetCurrentProcessId
GetCurrentThreadId
GetOEMCP
GetUserDefaultLangID
GetModuleHandleExW
FreeLibraryAndExitThread
InterlockedDecrement
OutputDebugStringA
ResetEvent
DeviceIoControl
GetModuleHandleW
RtlUnwind
SleepEx
Sleep
CloseHandle
GetLastError
DeleteFileW
WaitForSingleObject
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
ReleaseMutex
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
CreateFileW
GetConsoleCP
lstrlenA
GetFileAttributesW
GetPrivateProfileStringW
WideCharToMultiByte
GetVersionExW
GetModuleFileNameW
GetProcAddress
FreeLibrary
MultiByteToWideChar
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetFullPathNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetVersionExA
ExpandEnvironmentStringsA
FormatMessageA
GetSystemDirectoryW
GetSystemDirectoryA
LoadLibraryA
GetModuleHandleA
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
GetStartupInfoA
SetHandleCount
GetFileType
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
TlsFree
IsValidCodePage
GetACP
GetCPInfo
InterlockedIncrement
GetModuleFileNameA
GetStdHandle
ExitProcess
VirtualAlloc
VirtualFree
HeapCreate
ExitThread
FindFirstFileA
GetDriveTypeA
GetCommandLineA
FindFirstFileW
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
GetConsoleMode
SetEvent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetLocaleInfoA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
CreateFileA
LocalFileTimeToFileTime
OutputDebugStringW
FormatMessageW
SetLastError
LocalFree
TlsGetValue
TlsSetValue
GetAtomNameW
OpenThread
AddAtomW
TlsAlloc
FindAtomW
DeleteAtom
TerminateProcess

user32

SetForegroundWindow
SetFocus
CheckDlgButton
SendMessageW
GetDlgItem
SetDlgItemTextW
SetWindowTextW
SetWindowsHookExW
GetDlgItemTextW
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowLongW
GetWindowLongW
ShowWindow
UnhookWindowsHookEx
IsDialogMessageW
CallNextHookEx
GetDesktopWindow
PostMessageW
PostThreadMessageW
wsprintfW
wsprintfA
CreateDialogParamW
DestroyWindow

advapi32

RegQueryValueExA
RegNotifyChangeKeyValue
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW

shell32

SHGetSpecialFolderPathW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
OleRun

oleaut32

SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
VariantClear
VariantChangeType
VariantInit
SysAllocString
SysFreeString
GetErrorInfo

shlwapi

PathRemoveFileSpecW
PathCombineW
StrStrIW
PathIsDirectoryW
PathFileExistsW

rasapi32

RasGetConnectStatusW
RasEnumConnectionsW

ws2_32

ntohs
ioctlsocket
getaddrinfo
freeaddrinfo
select
inet_ntoa
gethostbyname
WSACleanup
WSAStartup
WSAGetLastError
recv
send
setsockopt
getsockname
gethostname
bind
htons
getsockopt
getpeername
closesocket
socket
connect
WSASetLastError
__WSAFDIsSet

iphlpapi

GetNetworkParams

Exports

Exports

HttpCancel
HttpCreateDownloadObj
HttpDeleteDownloadObj
HttpDownload
HttpDownloadExA
HttpDownloadExW
HttpGetAllPeer
HttpGetConnectState
HttpGetContentLength
HttpGetCurrentSpeed
HttpGetLastError
HttpGetLastErrorA
HttpGetLastErrorW
HttpGetMD5
HttpGetReceivedLength
HttpGetResumedLength
HttpGetState
HttpGetStateA
HttpGetStateW
HttpInitDownPara
HttpResetAll
HttpSetOption
HttpWait
InitHttp
UnInitHttp

Sections

.text
Size: 372KB - Virtual size: 372KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360sd.dat
360sdbho.dll
.dll regsvr32 windows:5 windows x86 arch:x86

23b318d4058ac79450d7d5723c72fa69

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:4e:97:17:6f:f1:65:60:a2:2d:7e:f0:0c:82:3d:b0:61:51:d2:26
Signer

Actual PE Digest

0b:4e:97:17:6f:f1:65:60:a2:2d:7e:f0:0c:82:3d:b0:61:51:d2:26

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\building\360project\360sd\branches\360QMachine\build\x86\360sdbho.pdb

Imports

kernel32

MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
SetThreadLocale
GetThreadLocale
LockResource
FindResourceExW
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
InterlockedDecrement
CloseHandle
GetSystemTime
GetProcessTimes
OpenProcess
GetCurrentProcessId
CreateRemoteThread
WaitForSingleObject
SetEvent
CreateThread
CreateEventW
FlushFileBuffers
CreateFileA
GetModuleFileNameW
lstrcmpiW
GetModuleHandleW
GetProcAddress
GetLastError
LeaveCriticalSection
EnterCriticalSection
RaiseException
InterlockedIncrement
lstrlenW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
GetCurrentThreadId
GetCommandLineA
VirtualFree
VirtualAlloc
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA

user32

SendMessageTimeoutW
FindWindowW
CharNextW

advapi32

RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW

ole32

CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc

oleaut32

SysStringLen
LoadRegTypeLi
DispCallFunc
VariantClear
VariantInit
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString

shlwapi

StrStrW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sharedda
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360sdrun.exe
.exe windows:5 windows x86 arch:x86

bac90a3f3efddc76362f1918d3534b0c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

95:8b:85:fb:31:79:85:43:45:7f:83:30:bf:99:74:a9:0a:cd:00:2e:8d:39:b4:84:32:14:a3:4f:af:70:c8:16
Signer

Actual PE Digest

95:8b:85:fb:31:79:85:43:45:7f:83:30:bf:99:74:a9:0a:cd:00:2e:8d:39:b4:84:32:14:a3:4f:af:70:c8:16

Digest Algorithm

sha256

PE Digest Matches

true

3b:1a:40:74:f4:b2:48:2a:4c:2c:07:55:df:20:0c:8b:45:37:a0:9b
Signer

Actual PE Digest

3b:1a:40:74:f4:b2:48:2a:4c:2c:07:55:df:20:0c:8b:45:37:a0:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\292047\out\Release\360sdrun.pdb

Imports

kernel32

WritePrivateProfileStringW
GetPrivateProfileStringW
GetCurrentThreadId
InterlockedIncrement
GetProcAddress
GetModuleHandleW
lstrcmpiW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
GetCurrentProcessId
GetTickCount
GetDriveTypeW
LoadLibraryW
GetWindowsDirectoryW
GetVersionExW
GetFileSize
TlsFree
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
ProcessIdToSessionId
FindClose
FindFirstFileW
Thread32Next
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
ResumeThread
GlobalMemoryStatus
SystemTimeToFileTime
FileTimeToSystemTime
SetEnvironmentVariableW
OpenProcess
WritePrivateProfileSectionW
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
QueryDosDeviceW
WideCharToMultiByte
AreFileApisANSI
ReadProcessMemory
Module32NextW
Module32FirstW
Process32NextW
Process32FirstW
GetPrivateProfileIntW
FindNextFileW
InterlockedCompareExchange
CreateDirectoryW
lstrlenA
DebugBreak
OutputDebugStringW
TlsSetValue
TlsGetValue
GetLongPathNameW
GetTempPathW
GetACP
GetExitCodeProcess
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
ExpandEnvironmentStringsW
GetCommandLineW
lstrcmpW
CreateMutexW
TerminateProcess
MoveFileExW
GetPrivateProfileSectionW
CreateProcessW
SetFilePointer
DeviceIoControl
IsBadReadPtr
InterlockedExchange
GetHandleInformation
CreateEventA
HeapWalk
HeapLock
HeapUnlock
GetProcessHeap
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
SetConsoleCtrlHandler
GetStringTypeA
DeleteCriticalSection
GetLocaleInfoA
QueryPerformanceCounter
lstrlenW
InterlockedDecrement
GetFileAttributesExW
DeleteFileW
MoveFileW
CopyFileW
CreateMutexA
GetLastError
ReleaseMutex
RaiseException
CreateThread
CreateNamedPipeW
ConnectNamedPipe
EnterCriticalSection
LeaveCriticalSection
WriteFile
SetEvent
Sleep
WaitNamedPipeW
CreateFileW
ReadFile
InitializeCriticalSection
OutputDebugStringA
CloseHandle
DisconnectNamedPipe
WaitForSingleObject
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetModuleFileNameA
GetStdHandle
ExitProcess
VirtualAlloc
FatalAppExitA
VirtualFree
HeapDestroy
HeapCreate
IsValidCodePage
GetOEMCP
GetCurrentThread
SetLastError
TlsAlloc
GetStringTypeW
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoA
GetCommandLineA
HeapReAlloc
ExitThread
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateThread
GetTimeZoneInformation

user32

FindWindowW
LoadStringW
PostQuitMessage
DefWindowProcW
PeekMessageW
TranslateMessage
EnumThreadWindows
DispatchMessageW
CharNextW
RegisterClassExW
CreateWindowExW
LoadIconW
DestroyWindow
SetTimer
MessageBoxW
SendMessageTimeoutW
CharLowerBuffW
CharLowerW
ShowWindow
GetWindowRect
BringWindowToTop
SetForegroundWindow
SwitchToThisWindow
SetWindowPos
SystemParametersInfoW
GetSystemMetrics
WindowFromPoint
WaitForInputIdle
wvsprintfW
FindWindowExW

advapi32

RegQueryValueExA
SetSecurityDescriptorDacl
LookupPrivilegeValueW
AdjustTokenPrivileges
GetUserNameW
OpenProcessToken
GetTokenInformation
IsValidSid
EqualSid
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
CloseServiceHandle
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
FreeSid

ole32

CoTaskMemFree
CoInitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize

shell32

SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW
SHChangeNotify
Shell_NotifyIconW

oleaut32

SysFreeString
VarUI4FromStr
SysAllocString

shlwapi

StrCmpNIW
SHDeleteKeyW
SHDeleteValueW
StrCmpNW
SHSetValueW
PathAddBackslashW
PathAppendW
StrStrIA
SHGetValueW
PathFileExistsW
PathRemoveFileSpecW
StrStrIW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

ws2_32

select

Sections

.text
Size: 445KB - Virtual size: 444KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 283KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360sdupd.exe
.exe windows:5 windows x86 arch:x86

60173d1714eb822790af84b3b0fd2dbe

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

df:33:73:17:fc:5c:ab:f2:f7:b6:56:14:99:9b:2a:6d:37:98:91:72:c3:ac:77:59:09:51:c4:85:c8:c3:fc:e1
Signer

Actual PE Digest

df:33:73:17:fc:5c:ab:f2:f7:b6:56:14:99:9b:2a:6d:37:98:91:72:c3:ac:77:59:09:51:c4:85:c8:c3:fc:e1

Digest Algorithm

sha256

PE Digest Matches

true

45:31:34:14:11:0a:cb:fb:0a:40:cb:bc:67:ff:24:de:d1:73:50:51
Signer

Actual PE Digest

45:31:34:14:11:0a:cb:fb:0a:40:cb:bc:67:ff:24:de:d1:73:50:51

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\291891\out\Release\360sdupd.pdb

Imports

kernel32

InterlockedIncrement
GetCurrentDirectoryW
GlobalFlags
GlobalGetAtomNameW
GetAtomNameW
GetThreadLocale
GetStringTypeExW
lstrcmpiW
LockFile
UnlockFile
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SetFileTime
GetFileTime
GetStartupInfoW
GetSystemTimeAsFileTime
RtlUnwind
ExitThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapFree
HeapAlloc
ExitProcess
HeapReAlloc
HeapSize
GetSystemInfo
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
LocalReAlloc
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
FatalAppExitA
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
LCMapStringA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GlobalHandle
GlobalReAlloc
LocalAlloc
SetThreadPriority
FreeResource
GlobalAddAtomW
GlobalFindAtomW
CompareStringW
GetVersionExA
GlobalDeleteAtom
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
GlobalFree
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
MulDiv
GetThreadContext
SetThreadContext
GetFullPathNameA
GetDriveTypeA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetDiskFreeSpaceW
LocalLock
LocalUnlock
HeapWalk
HeapLock
HeapUnlock
GetProcessHeap
SetFilePointerEx
FlushInstructionCache
GetCurrentThreadId
VirtualAlloc
VirtualQuery
CreateProcessA
VirtualProtectEx
WriteProcessMemory
VirtualAllocEx
VirtualQueryEx
OutputDebugStringW
SetErrorMode
OpenMutexW
VirtualProtect
GetShortPathNameW
GetFileSizeEx
SetFilePointer
SetEndOfFile
lstrlenA
GetTimeZoneInformation
GetFileAttributesW
SetFileAttributesW
GetACP
lstrcmpW
GetTempPathW
GetLongPathNameW
ExpandEnvironmentStringsW
GetFileAttributesExW
GetCommandLineW
GetExitCodeProcess
InterlockedCompareExchange
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
ReadProcessMemory
AreFileApisANSI
WideCharToMultiByte
QueryDosDeviceW
GetLogicalDriveStringsW
GetDriveTypeW
lstrlenW
OpenProcess
SetEnvironmentVariableW
GlobalMemoryStatusEx
ResumeThread
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
Thread32Next
ProcessIdToSessionId
LoadLibraryA
GetModuleHandleA
FileTimeToSystemTime
SystemTimeToFileTime
MultiByteToWideChar
ResetEvent
SetLastError
WaitForMultipleObjects
MoveFileW
GetDiskFreeSpaceExW
MoveFileExW
RemoveDirectoryW
CreateThread
GetSystemDefaultUILanguage
GetSystemDirectoryW
CopyFileW
GetPrivateProfileSectionNamesW
SetEvent
GetVersion
CreateMutexA
CreateEventW
GetLocalTime
FindFirstFileW
FindNextFileW
FindClose
CreateProcessW
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleW
LoadLibraryExW
GetCurrentProcessId
DeviceIoControl
WriteFile
GetCurrentThread
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
LoadLibraryW
Sleep
GetCurrentProcess
TerminateProcess
WritePrivateProfileSectionW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetTempFileNameW
DeleteFileW
GetWindowsDirectoryW
CreateDirectoryW
GetTickCount
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetProcAddress
FreeLibrary
WaitForSingleObject
FlushFileBuffers
ReleaseMutex
GetModuleFileNameW
lstrcpynW
CreateMutexW
GetLastError
GetVersionExW
CreateFileW
GetFileSize
ReadFile
CloseHandle
FindResourceW
LoadResource
LockResource
HeapDestroy
SizeofResource

user32

CharUpperW
DestroyIcon
UnregisterClassW
DestroyMenu
GetMenuItemInfoW
InflateRect
WaitMessage
ReleaseCapture
SetCapture
GetDesktopWindow
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
DeleteMenu
LoadCursorW
GetDC
ReleaseDC
GetSysColorBrush
SetWindowContextHelpId
MapDialogRect
GetWindowThreadProcessId
ShowOwnedPopups
SetCursor
DestroyWindow
SetTimer
EnableWindow
CharNextW
GetMessageW
TranslateMessage
GetActiveWindow
CopyAcceleratorTableW
ValidateRect
ScrollWindowEx
IsWindowEnabled
MoveWindow
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
IsWindow
SetFocus
IsRectEmpty
SetRect
InvalidateRect
InvalidateRgn
GetNextDlgGroupItem
GetNextDlgTabItem
MessageBeep
TranslateAcceleratorW
SetRectEmpty
CreatePopupMenu
InsertMenuItemW
LoadAcceleratorsW
GetMenuBarInfo
LoadMenuW
ReuseDDElParam
UnpackDDElParam
EndDialog
CreateDialogIndirectParamW
RegisterClipboardFormatW
GetKeyNameTextW
MapVirtualKeyW
GetSystemMenu
SetParent
UnionRect
KillTimer
GetDialogBaseUnits
PostThreadMessageW
GetDCEx
LockWindowUpdate
GetCursorPos
PostMessageW
FindWindowW
WaitForInputIdle
WindowFromPoint
GetSystemMetrics
SystemParametersInfoW
SetWindowPos
SwitchToThisWindow
SetForegroundWindow
EndPaint
BringWindowToTop
GetWindowRect
SendMessageTimeoutW
ShowWindow
CharLowerBuffW
EnumThreadWindows
RemoveMenu
GetSubMenu
GetMenuItemCount
InsertMenuW
GetMenuItemID
AppendMenuW
GetMenuStringW
GetMenuState
GetTabbedTextExtentW
GetUpdateRgn
DrawIconEx
DrawIcon
LoadImageW
FrameRect
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
IsClipboardFormatAvailable
CopyImage
EnumWindows
PostQuitMessage
GetWindow
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
IsWindowVisible
UpdateWindow
GetClientRect
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
GetParent
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
SendMessageW
GetWindowPlacement
IsIconic
SystemParametersInfoA
IntersectRect
OffsetRect
SetWindowLongW
GetWindowLongW
DefWindowProcW
CallWindowProcW
GetMenu
PtInRect
CopyRect

gdi32

StretchDIBits
CreateFontW
GetCharWidthW
CreateCompatibleBitmap
DPtoLP
PatBlt
GetMapMode
CombineRgn
SetRectRgn
GetRgnBox
CreateRectRgnIndirect
GetTextColor
GetBkColor
GetTextExtentPoint32W
OffsetWindowOrgEx
CreateFontIndirectW
CreateHatchBrush
CreateSolidBrush
ExtCreatePen
CreatePen
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
GetStockObject
CreateCompatibleDC
CreatePatternBrush
CreateDIBPatternBrushPt
DeleteDC
ExtSelectClipRgn
PolyBezierTo
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetTextMetricsW
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
StartDocW
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetDeviceCaps
CopyMetaFileW
CreateDCW
GetDCOrgEx
GetClipBox
SetTextColor
SetBkColor
GetObjectW
CreateBitmap
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
SetTextJustification
SelectObject
StretchBlt
CreateDIBSection
SetPixel
GetDIBits
ExtCreateRegion
GetBitmapBits
SetDIBits
GetBkMode
GetCurrentObject
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
SetTextCharacterExtra
SetMapperFlags
SetArcDirection
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
GetClipRgn
SetColorAdjustment
DeleteObject
SelectClipRgn
SetWindowExtEx

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW
GetJobW

advapi32

RegEnumKeyExA
RegOpenKeyExW
GetFileSecurityW
SetFileSecurityW
RegEnumKeyExW
RegQueryValueExA
RegCreateKeyW
RegQueryValueW
RegDeleteKeyW
RegSetValueW
RegDeleteKeyA
RegQueryValueExW
RegSetValueExA
RegOpenKeyExA
RegCreateKeyA
CreateServiceW
ChangeServiceConfigW
QueryServiceStatus
RegOpenKeyW
RegEnumKeyW
OpenSCManagerW
OpenServiceW
ControlService
CloseServiceHandle
QueryServiceStatusEx
StartServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
GetUserNameW
RegDeleteValueW
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
FreeSid
IsValidSid
EqualSid
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
InitializeSecurityDescriptor
RegCloseKey
SetSecurityDescriptorDacl

shell32

SHGetSpecialFolderPathW
ShellExecuteExW
SHChangeNotify
CommandLineToArgvW
SHGetFolderPathW
ExtractIconW
SHGetFileInfoW
DragFinish
DragQueryFileW
ShellExecuteW

shlwapi

StrCmpNIW
PathRemoveFileSpecW
PathCombineW
PathFindExtensionW
PathAppendW
StrCmpIW
PathFileExistsW
StrStrIW
PathAddBackslashW
SHSetValueW
StrCmpNW
SHDeleteValueW
SHDeleteKeyW
wnsprintfW
PathFindFileNameW
PathRemoveExtensionW
PathStripToRootW
SHGetValueW
PathIsUNCW
PathIsDirectoryW

oledlg

OleUIBusyW

ole32

OleSetClipboard
CoRevokeClassObject
CoRegisterClassObject
CoFreeUnusedLibraries
OleRun
CoInitializeEx
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
OleIsCurrentClipboard
StringFromGUID2
CoDisconnectObject
CLSIDFromString
CLSIDFromProgID
OleDuplicateData
CoTreatAsClass
StringFromCLSID
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
CoTaskMemFree
OleInitialize
OleUninitialize
OleFlushClipboard
CoInitializeSecurity
CoInitialize
CoCreateInstance
CoUninitialize
CoRegisterMessageFilter
CreateStreamOnHGlobal
CoGetClassObject
SetConvertStg

oleaut32

VariantClear
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayGetLBound
VarBstrCat
SysAllocStringLen
VariantInit
VariantChangeType
SysStringLen
SysAllocStringByteLen
SysStringByteLen
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
SafeArrayGetElement
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
VarDateFromStr
SysReAllocStringLen
VarCyFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarBstrFromDate
OleCreateFontIndirect
SysFreeString
SysAllocString
VariantCopy
GetErrorInfo
SetErrorInfo
CreateErrorInfo
OleLoadPicture

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

ws2_32

gethostbyname
WSAStartup
WSACleanup
inet_ntoa
gethostname

msimg32

TransparentBlt
AlphaBlend

comctl32

_TrackMouseEvent

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360verify.dll
.dll windows:5 windows x86 arch:x86

f02e002dda3eab3ae54bd29c9911a7e8

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f1:4f:16:56:e9:1b:77:cc:60:ef:8d:41:bc:e0:85:61:b5:09:f9:37
Signer

Actual PE Digest

f1:4f:16:56:e9:1b:77:cc:60:ef:8d:41:bc:e0:85:61:b5:09:f9:37

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\34630\out\Release\360verify.pdb

Imports

kernel32

SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
DeviceIoControl
CreateFileW
CloseHandle
WideCharToMultiByte
lstrcmpA
lstrcmpiA
GetLastError
EnterCriticalSection
RaiseException
LeaveCriticalSection
lstrcmpiW
GetModuleHandleW
GetProcAddress
lstrlenW
lstrlenA
FreeLibrary
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LoadLibraryA
HeapAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
HeapSize
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
InitializeCriticalSectionAndSpinCount

user32

CharNextW

advapi32

RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegQueryValueExW

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

VarUI4FromStr

shlwapi

SHGetValueA
SHSetValueA

netapi32

Netbios

Exports

Exports

GetCIDA
GetCIDW

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AVCheck.dll
.dll windows:5 windows x86 arch:x86

f7798d87638cdf2cd1404b275346a20c

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bf:c3:fe:05:fe:a5:b4:2c:71:ab:f6:1f:89:71:86:9a:96:79:17:e6
Signer

Actual PE Digest

bf:c3:fe:05:fe:a5:b4:2c:71:ab:f6:1f:89:71:86:9a:96:79:17:e6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
SystemTimeToFileTime
lstrcpyW
FindNextFileW
lstrlenA
SetLastError
GetFullPathNameW
GetPrivateProfileStringW
GetFileAttributesExA
GetWindowsDirectoryA
GetPrivateProfileStringA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileAttributesExW
DebugBreak
CloseHandle
ReadFile
GetFileSize
LoadLibraryW
GetSystemDirectoryW
GetWindowsDirectoryW
GetModuleFileNameW
GetPrivateProfileIntW
WaitForSingleObject
CreateThread
TlsFree
GetCurrentProcess
GetModuleHandleA
TlsAlloc
TlsSetValue
TlsGetValue
CompareStringW
CompareStringA
GetProcessHeap
SetEndOfFile
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
RaiseException
InterlockedIncrement
SearchPathW
GetFileAttributesW
LocalFree
LocalAlloc
lstrlenW
InterlockedDecrement
FindFirstFileW
FindClose
GetVersionExW
CreateFileW
OutputDebugStringW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
CreateFileA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
GetConsoleMode
GetConsoleCP
WriteFile
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
SetFilePointer
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
RtlUnwind
GetLastError
HeapFree
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
HeapAlloc
GetModuleHandleW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
HeapSize
GetTimeZoneInformation
Sleep

user32

LoadStringW
CharNextW
wvsprintfW

advapi32

RegOpenKeyExW
RegOpenKeyExA
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
RegQueryValueExA
RegEnumKeyW
RegCloseKey
RegQueryValueExW

shell32

SHGetSpecialFolderPathA
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitializeSecurity
CoInitialize
CoCreateInstance

oleaut32

SysAllocString
VariantClear
VariantCopy
VariantChangeType
SysAllocStringByteLen
SysStringByteLen
SysFreeString

shlwapi

SHQueryInfoKeyA
SHEnumKeyExA
PathAppendA
PathFindFileNameW
StrChrW
StrToIntW
StrCmpIW
PathFileExistsW
PathIsDirectoryW
StrCmpNIW
PathStripToRootW
StrDupW
StrCpyNW
PathAppendW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Exports

Exports

InitAntiVirusScanEng

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AVLib.dat
AVUninst.dll
.dll windows:5 windows x86 arch:x86

6deab85b6916489a26843a84ab82a1e7

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3e:70:01:9e:e6:55:9a:4b:eb:de:cf:2d:6f:6d:7f:db:3f:77:e3:c5
Signer

Actual PE Digest

3e:70:01:9e:e6:55:9a:4b:eb:de:cf:2d:6f:6d:7f:db:3f:77:e3:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TlsSetValue
TlsGetValue
TlsAlloc
LoadLibraryW
SetLastError
GetTickCount
WriteFile
CreateFileW
DeleteFileW
GetFileAttributesExW
CreateProcessW
ReadFile
MultiByteToWideChar
ReleaseMutex
GetLastError
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
GetCurrentProcessId
OpenThread
SystemTimeToFileTime
WideCharToMultiByte
WaitForSingleObject
GetACP
SetFileAttributesW
CreateMutexW
TerminateProcess
SetFilePointer
DeviceIoControl
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
SetFileTime
GetModuleHandleW
FindAtomW
AddAtomW
GetAtomNameW
GetSystemTime
LocalFree
FormatMessageW
OutputDebugStringW
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
GetTempPathW
CreateDirectoryW
OpenProcess
VirtualAllocEx
GetModuleFileNameW
GetPrivateProfileStringW
WriteProcessMemory
VirtualFreeEx
CloseHandle
FreeLibrary
TlsFree
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetVersionExW
GetVersion
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
VirtualAlloc
VirtualFree
HeapCreate
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
ExitProcess
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
DeleteAtom
Sleep
RaiseException
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentThreadId
GetProcAddress

user32

SendMessageW
GetClassNameW
GetWindowTextW
EnumChildWindows
GetWindowThreadProcessId
LoadStringW
FindWindowW

advapi32

RegQueryValueExA
RegEnumKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

shell32

ShellExecuteW

ole32

CoInitialize
PropVariantClear
CoCreateInstance
CoUninitialize

shlwapi

StrStrIW
PathFileExistsW
PathRemoveFileSpecW
PathCombineW
SHGetValueW
PathIsDirectoryW

Exports

Exports

UninstAV

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AntiDel.ico
DataDriv.dat
DumpUper.exe
.exe windows:5 windows x86 arch:x86

eda723ae7724c9bee3ec53a52ae078a9

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:94:ed:94:b8:a4:f5:67:2b:9e:11:c9:d4:3b:71:71:b7:52:65:9f
Signer

Actual PE Digest

3c:94:ed:94:b8:a4:f5:67:2b:9e:11:c9:d4:3b:71:71:b7:52:65:9f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

shlwapi

PathFileExistsW
PathFindFileNameW
SHSetValueW
PathFileExistsA
PathIsRootW
PathRemoveFileSpecW
PathAppendW
SHGetValueW
StrStrIW

setupapi

SetupIterateCabinetW

kernel32

LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CloseHandle
ReadFile
GetFileSize
CreateFileW
GetVersionExW
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
GetWindowsDirectoryW
GetEnvironmentVariableW
lstrlenW
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
SetLastError
FreeLibrary
MultiByteToWideChar
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
CreateDirectoryW
WritePrivateProfileStringW
GetTickCount
GetPrivateProfileSectionW
LocalFree
CreateMutexW
GetCommandLineW
GetProcAddress
LoadLibraryW
WaitForSingleObject
CreateThread
WritePrivateProfileSectionW
CreateProcessW
GetFileSizeEx
CopyFileA
GetPrivateProfileIntA
DeleteFileA
WriteFile
SetFilePointer
CreateFileA
GetNativeSystemInfo
DeleteFileW
EnterCriticalSection
GetSystemDirectoryW
GetPrivateProfileStringA
WideCharToMultiByte
GetACP
GetModuleFileNameA
DeviceIoControl
GetCurrentProcessId
GetModuleHandleA
GetExitCodeProcess
GetCurrentThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
lstrlenA
MoveFileW
GetTempFileNameW
GetPrivateProfileSectionNamesW
InterlockedExchange
InterlockedCompareExchange
Sleep
GetConsoleCP
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
TlsFree
TlsSetValue
TlsAlloc
GetStringTypeA
TlsGetValue
GetStdHandle
ExitProcess
HeapCreate
GetStringTypeW
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoW
ResumeThread
ExitThread
SetEndOfFile
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
GetSystemTimeAsFileTime
HeapSize
HeapReAlloc
RaiseException
GetConsoleMode
GetTimeFormatA
GetTempPathW
GetDateFormatA
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetLocaleInfoA
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
IsValidLocale
HeapAlloc
GetProcessHeap
HeapFree
GetVersion
EnumSystemLocalesA
GetUserDefaultLCID

user32

IsDlgButtonChecked
GetDlgItemTextW
UnregisterClassA
EnableWindow
GetDlgItem
SetTimer
ShowWindow
SetWindowTextW
GetWindowLongW
EndDialog
DefWindowProcW
GetActiveWindow
DialogBoxParamW
DestroyWindow
CharNextW
SetWindowLongW
SetWindowPos
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
GetParent
FindWindowW
wsprintfW
KillTimer
SendMessageW
CheckDlgButton

gdi32

GetStockObject
DeleteObject
CreateFontW
SetBkMode

advapi32

RegSetValueExW
GetUserNameW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW

shell32

ExtractIconW
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

ws2_32

select

Sections

.text
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DumpUper.ini
GetSvcName.exe
.exe windows:5 windows x86 arch:x86

b5e023dae9f816b10656134e615e9888

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

aa:a4:cf:dc:2d:5d:2a:91:45:7a:06:f4:b7:cd:2b:71:c5:1a:d8:9a
Signer

Actual PE Digest

aa:a4:cf:dc:2d:5d:2a:91:45:7a:06:f4:b7:cd:2b:71:c5:1a:d8:9a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\building\360project\360sd\branches\360QMachine\build\x86\GetSvcName.pdb

Imports

kernel32

GetNativeSystemInfo
GetModuleHandleW
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetFilePointer
GetCommandLineW
LocalFree
CloseHandle
OpenThread
OpenProcess
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetStringTypeA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
MultiByteToWideChar
Sleep
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA

advapi32

AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegSetValueExW
RegCreateKeyExW
LookupPrivilegeValueW

shell32

CommandLineToArgvW

shlwapi

PathAppendA

Sections

.text
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KitTip.dll
.dll windows:5 windows x86 arch:x86

4df3d2f4586ba8c874580ec7379fe1ad

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:a9:5b:1f:5e:98:be:5c:4f:71:b9:bd:73:a2:d4:33:ed:40:bd:07:df:93:48:e3:a4:00:2b:0f:e7:49:99:a1
Signer

Actual PE Digest

4d:a9:5b:1f:5e:98:be:5c:4f:71:b9:bd:73:a2:d4:33:ed:40:bd:07:df:93:48:e3:a4:00:2b:0f:e7:49:99:a1

Digest Algorithm

sha256

PE Digest Matches

true

c7:0f:76:25:a9:d9:bc:9d:aa:6f:e6:2b:6e:74:b6:0e:43:82:4a:fd
Signer

Actual PE Digest

c7:0f:76:25:a9:d9:bc:9d:aa:6f:e6:2b:6e:74:b6:0e:43:82:4a:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\310463\out\Release\KitTip.pdb

Imports

kernel32

CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
MultiByteToWideChar
FindFirstFileW
FindNextFileW
FindClose
FindFirstFileA
FindNextFileA
SetFilePointer
FreeLibrary
LoadLibraryExW
LoadLibraryW
TerminateThread
ReadFile
GetModuleFileNameW
CreateFileW
GetTempPathW
DeviceIoControl
GetCurrentThreadId
GetCurrentProcessId
GetPrivateProfileIntW
WideCharToMultiByte
GetPrivateProfileStringA
GetPrivateProfileStringW
lstrlenW
DeleteFileW
GetSystemInfo
GetSystemDirectoryW
CreateProcessW
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetExitCodeProcess
TerminateProcess
GetWindowsDirectoryW
GetVersionExW
WriteFile
Module32FirstW
Module32NextW
SystemTimeToFileTime
GetCommandLineW
LocalFree
MoveFileW
CopyFileW
MoveFileExW
GetFileSize
FlushInstructionCache
SetLastError
CreateDirectoryW
InterlockedDecrement
FindResourceExW
FlushFileBuffers
OpenMutexW
CreateMutexW
ReleaseMutex
HeapDestroy
HeapAlloc
InitializeCriticalSection
RaiseException
CreateThread
SetEnvironmentVariableA
CompareStringW
CompareStringA
WaitForSingleObject
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
SetStdHandle
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
LCMapStringA
GetCurrentDirectoryA
GetFileType
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
InitializeCriticalSectionAndSpinCount
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FindResourceW
LoadResource
LockResource
SizeofResource
lstrlenA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ExitProcess
ResumeThread
LoadLibraryA
CreateFileA
CloseHandle
OpenProcess
CheckRemoteDebuggerPresent
Sleep
GetTickCount
GetSystemTime
GetCurrentProcess
GetModuleHandleW
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetModuleFileNameA
GetStdHandle
HeapCreate
lstrcmpA
lstrcmpiA
GetSystemWindowsDirectoryW
FreeResource
GetLastError
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetEndOfFile
SetFilePointerEx
GetFileSizeEx
TlsGetValue
OutputDebugStringW
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
TlsAlloc
TlsFree
UnhandledExceptionFilter
InterlockedCompareExchange
GetDriveTypeA
InterlockedIncrement
SetUnhandledExceptionFilter
FileTimeToSystemTime
RtlUnwind
GetCommandLineA
GetDriveTypeW
FileTimeToLocalFileTime

user32

IsWindowVisible
GetWindow
GetSystemMetrics
UnregisterClassA
GetDesktopWindow
GetWindowRect
GetMonitorInfoW
GetWindowThreadProcessId
GetWindowInfo
GetShellWindow
WindowFromPoint
GetAncestor
BlockInput
FindWindowW
GetClientRect
GetParent
GetDC
ReleaseDC
SetWindowPos
SetWindowLongW
GetWindowLongW
SetLayeredWindowAttributes
SetForegroundWindow
TrackMouseEvent
InvalidateRect
BeginPaint
EndPaint
EndDialog
DestroyWindow
PtInRect
SetCapture
ReleaseCapture
LoadImageW
SystemParametersInfoW
MoveWindow
MapWindowPoints
SetTimer
DrawIconEx
UpdateLayeredWindow
PostMessageW
SendMessageW
DialogBoxParamW
GetForegroundWindow
MonitorFromWindow
GetActiveWindow
IsWindow

gdi32

CreateCompatibleDC
BitBlt
DeleteObject
SelectObject
CreateCompatibleBitmap
DeleteDC

advapi32

RegOpenKeyExW
GetTokenInformation
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegEnumKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken

shell32

CommandLineToArgvW
SHGetSpecialFolderPathA
ShellExecuteExW
ShellExecuteW
ord165
SHGetSpecialFolderPathW

ole32

CoCreateGuid
CoInitializeEx
CoCreateInstance
CoUninitialize

shlwapi

StrCmpIW
PathFindFileNameW
PathFileExistsW
SHGetValueA
SHSetValueW
StrCmpW
PathFileExistsA
SHGetValueW
PathAppendW
PathCombineW
PathCombineA
PathAppendA
StrStrIW
StrStrA
PathRemoveFileSpecW
PathFindExtensionW
SHSetValueA
StrTrimA
PathIsDirectoryW
StrCmpNIW

crypt32

CryptStringToBinaryW

setupapi

SetupIterateCabinetW

wininet

HttpQueryInfoW
HttpSendRequestW
DeleteUrlCacheEntryW
HttpOpenRequestW
InternetConnectW
InternetSetOptionW
InternetReadFile
InternetCloseHandle
InternetCrackUrlW
InternetOpenW

psapi

GetModuleFileNameExW
GetModuleFileNameExA

version

VerQueryValueW

ws2_32

WSAStartup
WSACleanup
gethostbyname
send
recv
socket
htons
connect
closesocket

gdiplus

GdiplusStartup
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipSetImageAttributesWrapMode
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipGraphicsClear
GdipDrawImagePointRectI
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRectI
GdipCreateBitmapFromFile
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipDrawString
GdipSetTextRenderingHint
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawImageRectRect
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipFillRectangle
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipLoadImageFromFile

urlmon

URLDownloadToFileW

msimg32

AlphaBlend

Exports

Exports

GetDllVersion
RunTip

Sections

.text
Size: 286KB - Virtual size: 286KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LiveUpd360.dll
.dll windows:5 windows x86 arch:x86

1d846d13397150c08cf17a1b3523002e

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:c9:77:0a:64:0c:ab:a6:a0:2f:b6:43:26:b5:67:4f:61:a8:29:22:fd:93:33:8c:e1:56:f8:f8:ba:b6:89:c0
Signer

Actual PE Digest

4f:c9:77:0a:64:0c:ab:a6:a0:2f:b6:43:26:b5:67:4f:61:a8:29:22:fd:93:33:8c:e1:56:f8:f8:ba:b6:89:c0

Digest Algorithm

sha256

PE Digest Matches

true

e9:e2:64:30:7d:ef:45:1d:36:12:61:5b:33:e3:00:52:86:2e:d5:85
Signer

Actual PE Digest

e9:e2:64:30:7d:ef:45:1d:36:12:61:5b:33:e3:00:52:86:2e:d5:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\303835\out\Release\release\LiveUpd360.pdb

Imports

kernel32

GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
EnterCriticalSection
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetProcAddress
GetModuleHandleW
LoadLibraryExW
FindFirstFileA
LeaveCriticalSection
GetLastError
DeleteCriticalSection
FreeLibrary
InitializeCriticalSection
LoadLibraryW
GetCurrentProcessId
CreateFileW
DeviceIoControl
CloseHandle
GetFullPathNameA
GetModuleFileNameW
lstrcmpiA
lstrcmpA
SleepEx
GetVersionExA
ExpandEnvironmentStringsA
FormatMessageA
GetSystemDirectoryW
lstrlenA
Sleep
WaitForSingleObject
GetFileAttributesW
RaiseException
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetTickCount
SetEvent
CreateEventW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetModuleHandleExW
FreeLibraryAndExitThread
ReleaseMutex
ReleaseSemaphore
WaitForMultipleObjects
CreateSemaphoreW
CreateMutexW
SetWaitableTimer
CreateWaitableTimerW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetLocalTime
CreateThread
SetFilePointer
SetEndOfFile
WriteFile
GetFileSizeEx
FindClose
FindFirstFileW
MoveFileW
DeleteFileW
MoveFileExW
ReadFile
InterlockedIncrement
InterlockedDecrement
CopyFileW
GetLongPathNameW
GetVersionExW
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
GetFileSize
FlushFileBuffers
GetFileAttributesExW
MulDiv
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
SetLastError
TlsGetValue
OutputDebugStringW
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
TlsAlloc
TlsFree
RtlUnwind
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
LCMapStringW
VirtualAlloc
GetModuleHandleA
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetSystemDirectoryA

user32

DefWindowProcW
MessageBoxW
RegisterClassW
TranslateMessage
GetMessageW
DispatchMessageW
IsWindow
FindWindowExW
SendMessageTimeoutW
DestroyWindow
PostThreadMessageW
CreateWindowExW
UnregisterClassW

shlwapi

SHSetValueA
SHGetValueA
PathCombineW
PathRemoveFileSpecW
SHGetValueW
wvnsprintfW
PathFileExistsW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

WSAEventSelect
bind
gethostbyname
WSAGetLastError
gethostname
inet_addr
WSACleanup
WSAStartup
sendto
htons
htonl
setsockopt
WSAIoctl
socket
ntohs
recvfrom
WSAWaitForMultipleEvents
closesocket
recv
send
getsockname
getsockopt
getpeername
connect
WSASetLastError
__WSAFDIsSet
select
freeaddrinfo
getaddrinfo
ioctlsocket

advapi32

RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
RegEnumKeyExW
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExW

shell32

SHGetSpecialFolderPathW

ole32

CLSIDFromString
CoUninitialize
CLSIDFromProgID
CoCreateInstance
CoInitialize

oleaut32

SysAllocString
SysFreeString

Exports

Exports

PPClose
PPCloseHandle
PPDownload
PPGetConfig
PPInit
PPQueryTask
PPQueryTaskEx
PPRemoveTask
PPRestart
PPSetConfig
PPStartTask
PPStartTaskEx
PPStopSeed
PPStopTask
StartLan
StopLan
_EnableP2P
_GetLanupTasks
_GetProductLst
_GetTasks
_IsStopped
_P2SPCancelCheckProxy
_P2SPCheckProxy
_P2SPCheckProxyEx
_P2SPSetOption
_P2SPUpdateRegInfo
_PPQueryIPPort
_PPQueryProduct
_PPQueryTask2
_PPQueryTask3
_PPSetLocalLog
_Run
_SetKeep
_SetKeepEx
_SetLocalLog
_StartRun
_StopRun
__PPSetModulePath2

Sections

.text
Size: 470KB - Virtual size: 470KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MacroDef.enc
MedalWall/SiteUIProxy.dll
.dll windows:5 windows x86 arch:x86

cb9e752dd96d051b310a5119da30b6f5

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:87:c3:11:53:0e:f1:46:31:1c:a0:3b:ef:82:68:b1:ed:ec:ba:be
Signer

Actual PE Digest

20:87:c3:11:53:0e:f1:46:31:1c:a0:3b:ef:82:68:b1:ed:ec:ba:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\build\SiteUIProxy\Release\SiteUIProxy.pdb

Imports

kernel32

GetCurrentProcess
FlushInstructionCache
SetCurrentDirectoryW
GetLongPathNameW
GetFileSizeEx
MulDiv
GetVersionExW
DeleteFileW
GetTempFileNameW
GetTempPathW
VirtualFree
IsProcessorFeaturePresent
GetModuleFileNameW
LeaveCriticalSection
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
SetFilePointer
GetLocaleInfoA
SetLastError
GetStringTypeW
GetStringTypeA
LCMapStringA
SizeofResource
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
LCMapStringW
HeapSize
GetModuleFileNameA
GetStdHandle
HeapDestroy
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
lstrlenA
OutputDebugStringW
DebugBreak
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
DeleteCriticalSection
lstrcmpiW
DeviceIoControl
EnterCriticalSection
GetProcAddress
GetLastError
RaiseException
lstrlenW
MultiByteToWideChar
CreateFileW
LoadLibraryW
InitializeCriticalSection
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
LoadResource
FreeLibrary
RtlUnwind
GetCommandLineA
ExitProcess
Sleep
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetModuleHandleA
FindResourceW
WideCharToMultiByte
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
TerminateProcess
TlsFree
DeleteAtom
FindAtomW
TlsAlloc
ReleaseMutex
AddAtomW
OpenThread
GetAtomNameW
TlsSetValue
WaitForSingleObject
TlsGetValue
CreateMutexW
GetSystemTime
LocalFree
FormatMessageW
ReadFile
WriteFile
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
VirtualAlloc

user32

DefWindowProcW
ReleaseDC
GetDC
GetClientRect
EndPaint
BeginPaint
GetWindowRect
IsWindow
UnregisterClassA
SetWindowPos
RegisterClassExW
CharNextW
CopyRect
CharUpperW
SetCursor
GetCursor
EqualRect
SendMessageW
InvalidateRect
PtInRect
DrawTextW
OffsetRect
DestroyWindow
PostMessageW
MessageBoxW
LoadStringW
DialogBoxParamW
EndDialog
SetWindowTextW
GetActiveWindow
BringWindowToTop
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetParent
MapWindowPoints
RegisterClassW
GetClassInfoW
CallWindowProcW
GetWindowLongW
SetWindowLongW
CreateWindowExW
LoadCursorW
GetClassInfoExW

gdi32

GetDeviceCaps
CreateFontIndirectW
SetTextColor
SetBkColor
SetBkMode
GetTextExtentPoint32W
SelectObject

advapi32

RegDeleteValueW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegQueryValueExA

shell32

ShellExecuteW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance

oleaut32

SysStringLen
VariantChangeType
DispCallFunc
VariantInit
SysFreeString
SysStringByteLen
VarUI4FromStr
SysAllocStringByteLen
VariantClear
SysAllocString

shlwapi

SHGetValueW
PathFindFileNameW
PathAppendW
PathFileExistsW
PathCombineW
PathRemoveFileSpecW
PathFindExtensionW
SHSetValueW
PathIsRelativeW

Exports

Exports

Get360Customizine
GetChangeSkinManager
GetMiniUICompatible
GetSiteUIProxy

Sections

.text
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

shared
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MsgCenter32.dll
.dll windows:5 windows x86 arch:x86

3a75fd34622f4d8844a6be7e289d4efa

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:b9:45:60:84:83:f7:22:85:0d:87:8e:3b:d1:a3:fa:1d:d8:20:58
Signer

Actual PE Digest

1c:b9:45:60:84:83:f7:22:85:0d:87:8e:3b:d1:a3:fa:1d:d8:20:58

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\building\360project\360sd\branches\beta\Build\x86\MsgCenter32.pdb

Imports

kernel32

MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
WriteConsoleW
GetConsoleOutputCP
RtlUnwind
GetSystemTimeAsFileTime
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetLastError
HeapFree
DebugBreak
lstrlenA
GetProcAddress
LoadLibraryA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
HeapAlloc
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
VirtualAlloc
HeapReAlloc
FreeLibrary
GetProcessHeap
GetModuleFileNameW
VirtualQuery
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
SetConsoleCtrlHandler
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetLocaleInfoW
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
ReadFile
SetFilePointer
CloseHandle
GetModuleHandleA
CreateFileA
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetEndOfFile
WriteConsoleA
InitializeCriticalSection

oleaut32

SysFreeString

Exports

Exports

<
MC_Add
MC_Clear
MC_Combine
MC_DelById
MC_DelViceFile
MC_GetByIndex
MC_GetMainFilename
MC_GetViceFilename
MC_Load
MC_Save
MC_SetMainFilename
MC_SetViceFilename
MC_Size

Sections

.textbss
Size: - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 317KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PDown.dll
.dll windows:5 windows x86 arch:x86

ab0475b929e498d90e150a6509f310e9

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:ae:16:18:08:74:ae:65:7c:98:9e:8d:6d:6d:25:43:82:70:ea:bd:cc:2a:d8:25:b8:37:23:6a:ab:22:56:c2
Signer

Actual PE Digest

48:ae:16:18:08:74:ae:65:7c:98:9e:8d:6d:6d:25:43:82:70:ea:bd:cc:2a:d8:25:b8:37:23:6a:ab:22:56:c2

Digest Algorithm

sha256

PE Digest Matches

true

65:eb:2f:d5:c4:83:be:62:6d:f2:88:bd:b7:a9:c7:ff:1f:50:94:d3
Signer

Actual PE Digest

65:eb:2f:d5:c4:83:be:62:6d:f2:88:bd:b7:a9:c7:ff:1f:50:94:d3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\295688\out\Release\Release\PDown.pdb

Imports

kernel32

Sleep
CreateFileW
GetLastError
SetEvent
GetModuleFileNameW
MoveFileW
DeleteFileW
WriteFile
MoveFileExW
ReadFile
GetTickCount
GetPrivateProfileIntW
GetSystemInfo
GlobalMemoryStatusEx
GetModuleHandleExW
FreeLibraryAndExitThread
WaitForSingleObject
LoadLibraryW
GetCurrentProcessId
GetProcAddress
FreeLibrary
CreateProcessW
GetStartupInfoW
TerminateProcess
GetCurrentProcess
OpenProcess
InterlockedDecrement
InterlockedIncrement
SetFilePointer
SetEndOfFile
ReleaseMutex
CreateMutexW
GetLocalTime
CopyFileW
DeviceIoControl
LoadLibraryExW
GetModuleHandleW
GetFileSizeEx
FlushFileBuffers
WriteConsoleW
CloseHandle
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
CreateEventW
FindFirstFileW
FindClose
GetFileAttributesW
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
LoadLibraryA
VirtualAlloc
QueryPerformanceCounter
VirtualFree
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
InitializeCriticalSection
ExitProcess
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleHandleA
GetModuleFileNameA
GetStdHandle
HeapReAlloc
GetCommandLineA
DeleteCriticalSection
GetConsoleOutputCP
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
SetLastError
TlsGetValue
HeapAlloc
HeapFree
OutputDebugStringW
GetProcessHeap
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
GetCurrentThreadId
TlsAlloc
TlsFree
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
ExitThread
CreateThread

user32

MessageBoxW
GetWindowThreadProcessId
SendMessageTimeoutW
PostThreadMessageW
DestroyWindow
DispatchMessageW
WaitForInputIdle
GetMessageW
CreateWindowExW
DefWindowProcW
UnregisterClassW
RegisterClassW
FindWindowW
IsWindow
TranslateMessage

advapi32

RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegQueryValueExA

shell32

SHGetSpecialFolderPathW

ole32

CoInitialize
CoCreateInstance
CLSIDFromProgID
CoUninitialize

oleaut32

SysAllocString
SysFreeString

shlwapi

PathCombineW
PathRemoveFileSpecW
wvnsprintfW
PathFileExistsW

ws2_32

sendto
WSAStartup
ntohs
WSACleanup
gethostbyname
WSAGetLastError
recvfrom
WSAWaitForMultipleEvents
closesocket
WSAEventSelect
WSAIoctl
bind
htons
htonl
setsockopt
socket

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Exports

Exports

PPClose
PPCloseHandle
PPDownload
PPGetConfig
PPInit
PPInit2
PPQueryTask
PPQueryTaskEx
PPRemoveTask
PPRestart
PPSetConfig
PPSetOption
PPStartTask
PPStartTaskEx
PPStopSeed
PPStopTask
StartLan
StopLan

Sections

.text
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PopWndLog.exe
.exe windows:5 windows x86 arch:x86

b33a21cb6d379b9e2a66134bad89a73e

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

42:2f:9c:f0:24:4b:bb:ce:5e:ef:20:c4:c4:80:77:20
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

14-04-2017 05:58

Not After

14-06-2020 05:58

Subject

CN=北京欣和智成科技有限公司,O=北京欣和智成科技有限公司,L=北京市,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-11-2014 00:58

Not After

08-11-2029 00:58

Subject

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ad:81:de:89:4f:14:e3:6b:68:fe:dc:57:18:de:a5:b1:72:93:de:e6
Signer

Actual PE Digest

ad:81:de:89:4f:14:e3:6b:68:fe:dc:57:18:de:a5:b1:72:93:de:e6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\304899\out\Release\PopWndLog.pdb

Imports

kernel32

CloseHandle
WaitForSingleObject
CreateEventW
ResetEvent
SetEvent
WriteFile
CreateFileW
GetTickCount
OpenProcess
GetCurrentProcessId
GetCommandLineW
GetModuleHandleA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
QueryDosDeviceW
GetLogicalDriveStringsW
LoadLibraryA
GetLongPathNameW
WideCharToMultiByte
AreFileApisANSI
GetACP
ProcessIdToSessionId
Thread32Next
SuspendThread
OpenThread
Thread32First
ResumeThread
CreateProcessW
GetExitCodeProcess
CopyFileW
GetTempPathW
ReadProcessMemory
GlobalMemoryStatus
ReadFile
RemoveDirectoryW
SetFileAttributesW
TlsSetValue
TlsGetValue
Sleep
InterlockedCompareExchange
TlsFree
GetFileAttributesExW
GetPrivateProfileSectionW
GetFileSize
GetTimeZoneInformation
GetFileAttributesW
TerminateProcess
MoveFileW
MoveFileExW
SetEnvironmentVariableW
WritePrivateProfileSectionW
CreateMutexA
ReleaseMutex
GetDriveTypeW
Module32NextW
Module32FirstW
ExpandEnvironmentStringsW
GetDiskFreeSpaceExW
DeviceIoControl
OutputDebugStringW
InterlockedExchange
GetPrivateProfileStringW
HeapWalk
HeapLock
FindNextFileW
SetCurrentDirectoryW
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
InitializeCriticalSectionAndSpinCount
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
SetConsoleCtrlHandler
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetModuleFileNameA
GetStdHandle
FatalAppExitA
HeapCreate
ExitProcess
GetCurrentThread
TlsAlloc
GetStringTypeW
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoW
VirtualQuery
GetSystemInfo
VirtualProtect
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
CreateThread
ExitThread
lstrlenA
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
FindClose
MulDiv
GetFileSizeEx
FindFirstFileW
lstrcmpW
GlobalAlloc
GlobalLock
GlobalUnlock
GetWindowsDirectoryW
CreateDirectoryW
DeleteFileW
GetSystemDirectoryW
SystemTimeToFileTime
FileTimeToSystemTime
GetLocalTime
GetVersionExW
GetVersion
WritePrivateProfileStringW
GetPrivateProfileIntW
lstrcmpiW
LoadLibraryExW
MultiByteToWideChar
FreeLibrary
InitializeCriticalSection
lstrlenW
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
FindResourceExW
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
FindResourceW
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
RaiseException
SetLastError
GetCurrentThreadId
LoadLibraryW
GetProcAddress
GetModuleHandleW
CreateMutexW
GetLastError
HeapUnlock

user32

GetShellWindow
CharLowerBuffW
GetWindowThreadProcessId
GetCursorPos
LoadMenuW
FindWindowW
UnregisterClassA
DefWindowProcW
CreateWindowExW
RegisterClassExW
LoadCursorW
GetClassInfoExW
ShowWindow
SetWindowLongW
DestroyWindow
PeekMessageW
GetMessageW
TranslateMessage
GetSubMenu
TrackPopupMenu
CharNextW
GetParent
GetWindowLongW
GetActiveWindow
SetWindowRgn
DialogBoxParamW
EndDialog
GetClientRect
SetWindowPos
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
CopyRect
DrawIconEx
PostMessageW
LoadIconW
SetWindowsHookExW
CallNextHookEx
PostQuitMessage
CallWindowProcW
SendMessageW
DestroyMenu
SendMessageTimeoutW
IsDialogMessageW
RegisterWindowMessageW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
DestroyAcceleratorTable
WaitForInputIdle
WindowFromPoint
GetSystemMetrics
EnumThreadWindows
SwitchToThisWindow
DispatchMessageW
GetSysColor
GetFocus
SetFocus
IsIconic
KillTimer
IsChild
EndPaint
SetTimer
IsWindowVisible
SystemParametersInfoW
BringWindowToTop
SetForegroundWindow
SetLayeredWindowAttributes
GetDlgItem
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
ScreenToClient
ClientToScreen
MoveWindow
CreateAcceleratorTableW
GetDC
ReleaseDC
GetDesktopWindow
GetClassNameW
RedrawWindow
IsWindow
BeginPaint
FillRect

gdi32

SelectObject
CreateCompatibleBitmap
CreateSolidBrush
GetDeviceCaps
GetObjectW
CreateRoundRectRgn
SetBrushOrgEx
SetStretchBltMode
SetDIBColorTable
StretchBlt
DeleteObject
DeleteDC
GetStockObject
BitBlt
CreateDIBSection
CreateCompatibleDC

advapi32

ImpersonateLoggedOnUser
RevertToSelf
OpenProcessToken
DuplicateTokenEx
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetUserNameW
LookupPrivilegeValueW
GetTokenInformation
AllocateAndInitializeSid
IsValidSid
EqualSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExA
AdjustTokenPrivileges

shell32

SHGetFileInfoW
Shell_NotifyIconW
ExtractIconExW
ShellExecuteW
ShellExecuteExW
SHChangeNotify
CommandLineToArgvW
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoInitializeEx
CoInitializeSecurity
OleLockRunning
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

CreateErrorInfo
VarUI4FromStr
DispCallFunc
VariantInit
GetErrorInfo
VariantChangeType
SetErrorInfo
OleCreateFontIndirect
SysAllocStringLen
SysStringLen
LoadTypeLi
LoadRegTypeLi
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear
SysFreeString

shlwapi

PathAppendW
wnsprintfW
PathFindFileNameW
SHGetValueW
StrCmpNIW
PathAddBackslashW
SHSetValueW
StrCmpNW
StrStrIW
PathFileExistsW
SHDeleteKeyW
PathRemoveExtensionW
SHDeleteValueW
StrStrW
PathRemoveFileSpecW
PathCombineW

comctl32

InitCommonControlsEx

gdiplus

GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageI
GdipDeleteGraphics
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipFree
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdiplusShutdown
GdipGetImageGraphicsContext

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

imm32

ImmDisableIME

wininet

HttpQueryInfoW
InternetOpenW
InternetReadFile
InternetCloseHandle
InternetOpenUrlW

rpcrt4

NdrAsyncClientCall
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcAsyncInitializeHandle
NdrClientCall2

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

ws2_32

select

Sections

.text
Size: 700KB - Virtual size: 699KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PopwndTracker.exe
.exe windows:5 windows x86 arch:x86

c6e0a35f321d9fee1b1633149156ee71

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

42:2f:9c:f0:24:4b:bb:ce:5e:ef:20:c4:c4:80:77:20
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

14-04-2017 05:58

Not After

14-06-2020 05:58

Subject

CN=北京欣和智成科技有限公司,O=北京欣和智成科技有限公司,L=北京市,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-11-2014 00:58

Not After

08-11-2029 00:58

Subject

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:bf:47:a3:ab:b6:5c:fc:60:df:96:b8:7a:be:f5:6f:e5:3e:16:42
Signer

Actual PE Digest

41:bf:47:a3:ab:b6:5c:fc:60:df:96:b8:7a:be:f5:6f:e5:3e:16:42

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\292253\out\Release\PopwndTracker.pdb

Imports

kernel32

FindClose
FindFirstFileW
FindNextFileW
Thread32Next
SuspendThread
OpenThread
Thread32First
ResumeThread
GetExitCodeProcess
WaitForSingleObject
CopyFileW
GetTempPathW
ReadProcessMemory
GlobalMemoryStatus
RemoveDirectoryW
SetFileAttributesW
TlsSetValue
TlsGetValue
Sleep
InterlockedCompareExchange
TlsFree
GetFileAttributesExW
SystemTimeToFileTime
FileTimeToSystemTime
GetTimeZoneInformation
GetFileAttributesW
TerminateProcess
MoveFileW
MoveFileExW
SetEnvironmentVariableW
CreateMutexA
ReleaseMutex
GetDriveTypeW
Module32NextW
Module32FirstW
ExpandEnvironmentStringsW
GetCommandLineW
GetDiskFreeSpaceExW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
DeviceIoControl
OutputDebugStringW
InterlockedExchange
GetSystemDirectoryW
LocalFree
CompareFileTime
GetPrivateProfileSectionNamesW
MulDiv
GetCurrentThread
SetCurrentDirectoryW
SetEvent
CreateEventW
ResetEvent
OpenMutexW
OutputDebugStringA
TerminateThread
DisconnectNamedPipe
WaitNamedPipeW
ConnectNamedPipe
CreateNamedPipeW
CreateThread
GetLocalTime
HeapFree
InterlockedIncrement
GetProcessHeap
ProcessIdToSessionId
EnterCriticalSection
AreFileApisANSI
FindResourceExW
HeapWalk
HeapLock
HeapUnlock
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GetModuleFileNameA
GetStdHandle
FatalAppExitA
HeapCreate
TlsAlloc
IsValidCodePage
GetOEMCP
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
GetStartupInfoW
ExitProcess
VirtualQuery
GetSystemInfo
VirtualProtect
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
GetSystemTimeAsFileTime
lstrlenA
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
WideCharToMultiByte
LoadLibraryA
LeaveCriticalSection
GetACP
GetLogicalDriveStringsW
QueryDosDeviceW
LoadResource
LockResource
SizeofResource
FindResourceW
GetCurrentProcess
FlushInstructionCache
lstrcmpW
GetModuleHandleA
GetPrivateProfileStringW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetVersion
CreateProcessW
WriteFile
SetFilePointer
lstrcmpiW
LoadLibraryExW
MultiByteToWideChar
FreeLibrary
InitializeCriticalSection
lstrlenW
GetModuleFileNameW
InterlockedDecrement
SetLastError
DeleteCriticalSection
GetCurrentThreadId
RaiseException
LoadLibraryW
GetProcAddress
GetModuleHandleW
CreateMutexW
GetLastError
GetPrivateProfileIntW
GetCurrentProcessId
WritePrivateProfileSectionW
GetWindowsDirectoryW
CreateDirectoryW
WritePrivateProfileStringW
DeleteFileW
CreateFileW
GetFileSize
ReadFile
CloseHandle
GetPrivateProfileSectionW
GetTickCount
GetVersionExW
GetLongPathNameW
HeapAlloc

user32

ChildWindowFromPoint
EqualRect
IsIconic
DispatchMessageW
DefWindowProcW
UnregisterClassA
PostMessageW
SendMessageW
FindWindowW
SendMessageTimeoutW
GetWindowRgn
SetParent
MonitorFromPoint
TranslateMessage
GetMessageW
PeekMessageW
DestroyWindow
EnumDisplaySettingsW
MessageBoxW
SetWindowLongW
CreateWindowExW
ShowWindow
GetClassInfoExW
LoadCursorW
RegisterClassExW
CharNextW
CharLowerBuffW
WaitForInputIdle
SetForegroundWindow
WindowFromPoint
GetSystemMetrics
SystemParametersInfoW
EnumThreadWindows
SetWindowPos
SwitchToThisWindow
BringWindowToTop
GetWindowRect
GetParent
GetWindowLongW
SetWindowRgn
DialogBoxParamW
EndDialog
GetWindowThreadProcessId
CallNextHookEx
GetDC
GetClientRect
ClientToScreen
SetCapture
SetCursor
mouse_event
GetActiveWindow
UnhookWindowsHookEx
PostQuitMessage
LoadIconW
SetWindowsHookExW
DrawIconEx
SetFocus
GetCursorPos
ScreenToClient
SetWindowTextW
CallWindowProcW
GetDesktopWindow
GetWindowDC
ReleaseDC
PtInRect
KillTimer
InvalidateRect
IsWindow
IsWindowVisible
GetWindowTextW
GetClassNameW
MoveWindow
SetTimer
SetLayeredWindowAttributes
CopyRect
GetWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints

gdi32

StretchBlt
SetBrushOrgEx
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetDIBColorTable
GetObjectW
GetDIBits
DeleteDC
DeleteObject
CreateRoundRectRgn
SetStretchBltMode
StretchDIBits
GetDeviceCaps
CreateRectRgn
BitBlt
GetRgnBox

advapi32

IsValidSid
EqualSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AdjustTokenPrivileges
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
DuplicateTokenEx
AllocateAndInitializeSid
GetLengthSid
SetTokenInformation
CreateProcessAsUserW
FreeSid
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetUserNameW
OpenThreadToken
ControlService
QueryServiceStatus
CloseServiceHandle
OpenServiceW
RegQueryValueExA
OpenSCManagerW
SetEntriesInAclW
LookupPrivilegeValueW

shell32

SHGetFolderPathW
ExtractIconExW
ShellExecuteExW
ShellExecuteW
SHChangeNotify
CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemRealloc

oleaut32

VariantClear
SysAllocStringByteLen
SysStringByteLen
CreateErrorInfo
SysAllocStringLen
VariantChangeType
SetErrorInfo
GetErrorInfo
VariantInit
DispCallFunc
SysAllocString
SysFreeString
VarUI4FromStr

shlwapi

PathAppendW
PathFindFileNameW
wnsprintfW
PathUnquoteSpacesW
PathRemoveBackslashW
SHDeleteKeyW
SHDeleteValueW
StrCmpNW
PathAddBackslashW
StrCmpNIW
PathRemoveFileSpecW
PathFileExistsW
SHGetValueW
StrStrIW
SHSetValueW
PathCombineW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

imm32

ImmDisableIME

gdiplus

GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipAlloc
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipFree
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdiplusShutdown
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdipCloneImage

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

ws2_32

select

Sections

.text
Size: 914KB - Virtual size: 913KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ProcTree.exe
.exe windows:5 windows x86 arch:x86

c272ff1bc10e751144e28170dc929e2a

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b7:ac:66:6b:ce:95:5c:29:24:e1:dc:8d:f2:4d:a9:90:f5:98:eb:ad
Signer

Actual PE Digest

b7:ac:66:6b:ce:95:5c:29:24:e1:dc:8d:f2:4d:a9:90:f5:98:eb:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\building\360project\360sd\branches\beta\Build\x86\ProcTree.pdb

Imports

kernel32

LocalUnlock
LocalLock
GetCurrentDirectoryA
SetCurrentDirectoryA
GetDriveTypeA
GetFullPathNameA
GlobalDeleteAtom
GlobalAddAtomA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DeviceIoControl
SetFilePointer
GetTimeZoneInformation
MoveFileExW
MoveFileW
TerminateProcess
CreateMutexW
GetFileAttributesW
RemoveDirectoryW
GetACP
GetTempPathW
GetLongPathNameW
ExpandEnvironmentStringsW
GetFileAttributesExW
GetExitCodeProcess
CreateProcessW
TlsGetValue
TlsSetValue
GetCommandLineW
CopyFileW
InterlockedCompareExchange
GetPrivateProfileIntW
WriteFile
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
ReadProcessMemory
AreFileApisANSI
QueryDosDeviceW
GetLogicalDriveStringsW
GetDriveTypeW
GetDiskFreeSpaceExW
lstrlenW
WritePrivateProfileSectionW
OpenProcess
SetEnvironmentVariableW
GlobalMemoryStatus
ResumeThread
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
Thread32Next
GetCurrentProcessId
ProcessIdToSessionId
LoadLibraryA
GetModuleHandleA
GetCurrentProcess
FreeLibrary
TlsFree
InterlockedDecrement
InterlockedIncrement
GetVersion
FreeResource
Sleep
FindFirstFileW
SetFileAttributesW
DeleteFileW
FindNextFileW
FindClose
GetPrivateProfileStringW
FileTimeToSystemTime
CreateThread
SetEvent
GetLocalTime
CreateEventW
GetPrivateProfileSectionW
GetTickCount
WritePrivateProfileStringW
GetWindowsDirectoryW
CreateDirectoryW
GetVersionExW
CreateFileW
GetFileSize
ReadFile
GetModuleFileNameW
CreateMutexA
ReleaseMutex
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcmpW
GetLastError
SetLastError
GetProcAddress
GetModuleHandleW
LoadLibraryW
SystemTimeToFileTime
WaitForSingleObject
FindResourceW
LoadResource
MulDiv
GlobalFree
LocalFree
FormatMessageW
GlobalSize
GetVersionExA
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
GetCurrentThreadId
GlobalGetAtomNameW
lstrcmpA
lstrlenA
InterlockedExchange
CompareStringA
GetLocaleInfoW
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
SetThreadPriority
GetStringTypeExW
GetThreadLocale
lstrcmpiW
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
GetShortPathNameW
GlobalFlags
LocalAlloc
GlobalReAlloc
GlobalHandle
TlsAlloc
LocalReAlloc
GetAtomNameW
SetFileTime
GetFileTime
GetTempFileNameW
GetDiskFreeSpaceW
GetCurrentDirectoryW
SetErrorMode
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetFileSizeEx
GetStartupInfoW
RtlUnwind
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
HeapReAlloc
ExitProcess
ExitThread
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
FatalAppExitA
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GetProcessHeap
lstrcpynW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SetFilePointerEx
OutputDebugStringW
GetSystemTime
AddAtomW
FindAtomW
DeleteAtom
LockResource
SizeofResource

user32

IsDialogMessageW
SetWindowTextW
MoveWindow
ScrollWindowEx
TranslateAcceleratorW
SetRectEmpty
CreatePopupMenu
InsertMenuItemW
LoadAcceleratorsW
SetCursor
GetWindowThreadProcessId
GetMenuBarInfo
DestroyMenu
LoadMenuW
ReuseDDElParam
UnpackDDElParam
IsRectEmpty
SetWindowRgn
LoadCursorW
GetCursorPos
GetKeyNameTextW
MapVirtualKeyW
InflateRect
PostQuitMessage
ValidateRect
TranslateMessage
GetMessageW
ShowOwnedPopups
MapDialogRect
SetWindowContextHelpId
CharUpperW
GetDialogBaseUnits
GetSysColorBrush
GetMenuItemInfoW
DeleteMenu
GetSystemMenu
SetParent
UnionRect
UnregisterClassW
DestroyIcon
CharNextW
SetRect
CopyAcceleratorTableW
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
GetDCEx
LockWindowUpdate
RegisterClipboardFormatW
PostThreadMessageW
IsZoomed
GetUpdateRgn
EnumChildWindows
GetMonitorInfoW
MonitorFromWindow
EnumWindows
CopyImage
IsClipboardFormatAvailable
GetClipboardData
FrameRect
DrawIconEx
DrawTextExW
TabbedTextOutW
GetClientRect
IsDlgButtonChecked
SetTimer
FillRect
CopyRect
GetTabbedTextExtentW
DrawTextW
SendMessageW
InvalidateRect
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GrayStringW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
GetParent
SetWindowLongW
GetWindowLongW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetPropA
SetPropA
CallWindowProcW
UpdateLayeredWindow
SetLayeredWindowAttributes
EnumThreadWindows
CharLowerBuffW
SendMessageTimeoutW
BringWindowToTop
SwitchToThisWindow
SystemParametersInfoW
WindowFromPoint
WaitForInputIdle
RegisterClassW
SetScrollPos
GetScrollPos
DefWindowProcW
IsWindowEnabled
GetActiveWindow
SetActiveWindow
SetWindowPos
GetWindow
IsWindowVisible
ReleaseDC
GetDC
LoadIconW
PostMessageW
DrawIcon
FindWindowW
IsIconic
ShowWindow
SetForegroundWindow
ReleaseCapture
GetSysColor
GetSystemMetrics
SetScrollRange
GetScrollRange
SetCapture
GetLastActivePopup
PtInRect
LoadImageW
DispatchMessageW
KillTimer
UpdateWindow
ClientToScreen
GetWindowRect
DrawFocusRect
GetAsyncKeyState
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IntersectRect
GetDlgCtrlID
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetMenu
ShowScrollBar
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetMenu
OffsetRect
SystemParametersInfoA
GetWindowPlacement
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
GetDesktopWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
EndPaint
BeginPaint
GetWindowDC
ScreenToClient
EnableWindow

gdi32

Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
RectVisible
PtVisible
StartDocW
GetPixel
BitBlt
GetWindowExtEx
SelectClipPath
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
DeleteDC
EnumFontsW
GetViewportExtEx
SetBkMode
SaveDC
CreateCompatibleDC
SelectObject
SetStretchBltMode
StretchBlt
GetBkColor
GetObjectW
CreateRectRgn
ExtTextOutW
DeleteObject
GetTextExtentPoint32W
CreateRectRgnIndirect
GetStockObject
CreateSolidBrush
CreatePen
PolylineTo
PolyBezierTo
ExtSelectClipRgn
CreateDIBPatternBrushPt
CreatePatternBrush
CreateBitmap
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
GetDeviceCaps
ExtCreatePen
CreateHatchBrush
CopyMetaFileW
CreateDCW
GetDCOrgEx
CreateCompatibleBitmap
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
CreateEllipticRgn
DPtoLP
LPtoDP
Ellipse
PatBlt
SetRectRgn
ExcludeClipRect
GetClipBox
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetTextColor
SetROP2
SetPolyFillMode
SetBkColor
CombineRgn
TextOutW
RestoreDC
CreateFontIndirectW
SetDIBits
GetBitmapBits
ExtCreateRegion
GetCurrentObject
GetBkMode
GetDIBits
SetPixel
CreateDIBSection
GetRgnBox
GetTextColor
StretchDIBits
CreateFontW
GetCharWidthW
GetTextMetricsW
GetMapMode

advapi32

RegQueryValueExW
InitializeSecurityDescriptor
RegSetValueW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegQueryValueW
RegCreateKeyW
SetFileSecurityW
GetFileSecurityW
RegQueryValueExA
RegEnumKeyExW
SetSecurityDescriptorDacl
LookupPrivilegeValueW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
EqualSid
IsValidSid
FreeSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegDeleteValueW
GetUserNameW

shell32

SHGetSpecialFolderPathW
ShellExecuteExW
SHChangeNotify
ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW
ExtractIconW
DragFinish
DragQueryFileW
SHGetFileInfoW

ole32

CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
StringFromGUID2
CoDisconnectObject
CLSIDFromString
CLSIDFromProgID
OleDuplicateData
CoTreatAsClass
StringFromCLSID
CoTaskMemAlloc
CoInitializeEx
CreateBindCtx
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
OleRun
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoUninitialize
CoCreateInstance
CoInitialize
CoRegisterClassObject
CoRevokeClassObject
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
ReleaseStgMedium
CreateStreamOnHGlobal

oleaut32

LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysStringByteLen
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayUnaccessData
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
VarDateFromStr
SysReAllocStringLen
VarCyFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarBstrFromDate
OleCreateFontIndirect
GetErrorInfo
SetErrorInfo
CreateErrorInfo
OleLoadPicture
SafeArrayAccessData
SafeArrayPutElement
SysAllocStringByteLen
SysFreeString
SysStringLen
SysAllocString
SafeArrayGetUBound

shlwapi

PathIsDirectoryW
StrCmpIW
StrStrIW
SHGetValueW
StrCmpW
PathAppendW
SHSetValueW
StrCmpNW
SHDeleteValueW
SHDeleteKeyW
StrCmpNIW
PathAddBackslashW
PathRemoveFileSpecW
PathFindExtensionW
PathRemoveExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFileExistsW

oledlg

OleUIBusyW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

winspool.drv

GetJobW
OpenPrinterW
ClosePrinter
DocumentPropertiesW

comdlg32

GetFileTitleW

msimg32

AlphaBlend
TransparentBlt

comctl32

_TrackMouseEvent

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
QMPlugin/QMBHO.dll
.dll windows:5 windows x86 arch:x86

1ceb4d12c03fe870cc6c320cee10350e

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c8:0c:2a:b8:95:fc:ab:7d:8a:8b:c3:b2:ba:67:c5:a1:f9:c7:ce:c5
Signer

Actual PE Digest

c8:0c:2a:b8:95:fc:ab:7d:8a:8b:c3:b2:ba:67:c5:a1:f9:c7:ce:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\intermoutput\S_capital\ScanQM_BHO_capital\Release\QMBHO.pdb

Imports

kernel32

GetCommandLineW
SetLastError
GetLocalTime
GetSystemTime
CreateEventW
SetEvent
CreateThread
DeviceIoControl
SetFilePointer
TerminateProcess
FileTimeToSystemTime
SystemTimeToFileTime
CreateMutexW
CreateProcessW
WaitForSingleObject
OpenThread
GetCurrentProcessId
GetACP
WideCharToMultiByte
LoadLibraryA
OpenProcess
lstrcmpW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcess
GetModuleHandleA
GetVersion
ReleaseMutex
GetTickCount
CreateDirectoryW
GetVersionExW
GetWindowsDirectoryW
WritePrivateProfileStringW
GetPrivateProfileStringW
ReadFile
GetFileSize
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
LoadLibraryExW
RaiseException
lstrcmpiW
GetModuleHandleW
lstrlenW
LeaveCriticalSection
EnterCriticalSection
DeleteFileW
WriteFile
InterlockedDecrement
LocalFree
FormatMessageW
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
LocalAlloc
GlobalReAlloc
GlobalHandle
TlsAlloc
LocalReAlloc
GetCurrentThreadId
SetErrorMode
GetAtomNameW
lstrcmpA
lstrlenA
GlobalDeleteAtom
GetVersionExA
GlobalFindAtomW
GlobalAddAtomW
GlobalFlags
FlushFileBuffers
LocalFileTimeToFileTime
GetFileSizeEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
HeapReAlloc
HeapSize
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CreateFileA
SetFilePointerEx
OutputDebugStringW
AddAtomW
FindAtomW
DeleteAtom
GetModuleFileNameW
CloseHandle
CreateFileW
GetPrivateProfileIntW
MultiByteToWideChar
GetLastError
Sleep
InterlockedCompareExchange
TlsSetValue
TlsGetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryW
FindResourceW
LoadResource
LockResource
SizeofResource

user32

GetForegroundWindow
RemovePropW
GetPropW
SetPropW
GetClassNameW
GetClassLongW
GetCapture
WinHelpW
LoadIconW
RegisterWindowMessageW
ClientToScreen
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
DestroyMenu
DefWindowProcW
UnregisterClassW
SetWindowsHookExW
CallNextHookEx
SendMessageW
GetKeyState
GetClassInfoExW
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
CallWindowProcW
CopyRect
PtInRect
GetMenu
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
SetMenuItemBitmaps
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
GetClientRect
CreateWindowExW
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetFocus
SetWindowLongW
GetDlgCtrlID
IsWindow
SetWindowTextW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
LoadStringW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
EnumWindows
PostMessageW
GetWindowThreadProcessId
IsWindowVisible
SetWindowPos
GetDlgItem
GetWindow
GetSystemMetrics
SetForegroundWindow
CharNextW
ValidateRect
PostQuitMessage
GetWindowTextW
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
LoadCursorW
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush

advapi32

RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW

shell32

SHGetSpecialFolderPathW

ole32

CoInitialize
CoUninitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
OleRun
CoTaskMemFree

oleaut32

VariantChangeType
SysAllocStringLen
SysAllocString
SysFreeString
SysStringByteLen
SysAllocStringByteLen
VariantClear
VarUI4FromStr
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantInit
GetErrorInfo

shlwapi

PathIsDirectoryW
PathFileExistsW
StrStrW
SHGetValueW
StrStrIW
PathFindFileNameW
PathFindExtensionW
PathAppendW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

oleacc

CreateStdAccessibleObject
LresultFromObject

gdi32

PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
GetDeviceCaps
DeleteDC
GetStockObject
SetMapMode
RestoreDC
SaveDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
ScaleWindowExtEx

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

Exports

Exports

QueryInterface

Sections

.text
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
QMPlugin/QMDNS.dll
.dll windows:5 windows x86 arch:x86

3a74f187eefd6385d87978b49bcf1a22

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ba:90:4a:c6:76:f2:1f:e9:6f:4c:a0:a2:90:06:51:ff:4b:4a:40:53
Signer

Actual PE Digest

ba:90:4a:c6:76:f2:1f:e9:6f:4c:a0:a2:90:06:51:ff:4b:4a:40:53

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\building\360project\360sd\branches\360QMachine\build\x86\QMPlugin\QMDNS.pdb

Imports

kernel32

GetFileSizeEx
LockResource
LoadResource
FindResourceW
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
CreateEventW
SetEvent
WaitForSingleObject
GetModuleFileNameW
CreateFileW
GetFileSize
ReadFile
GetPrivateProfileStringW
WritePrivateProfileStringW
GetWindowsDirectoryW
GetVersionExW
CreateDirectoryW
GetTickCount
TlsFree
TlsGetValue
TlsSetValue
InterlockedCompareExchange
Sleep
ReleaseMutex
GetLastError
InterlockedIncrement
ReleaseSemaphore
CreateSemaphoreW
GetLocalTime
GetCommandLineW
WaitForMultipleObjects
ResetEvent
DeviceIoControl
SetFilePointer
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
HeapFree
GetProcessHeap
HeapAlloc
GetPrivateProfileIntW
GetSystemDirectoryA
InterlockedDecrement
lstrlenW
GetModuleHandleW
TerminateProcess
FileTimeToSystemTime
SystemTimeToFileTime
CreateMutexW
GetVersion
GetModuleHandleA
GetCurrentProcess
LocalFree
FormatMessageW
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
SetLastError
LocalAlloc
GlobalReAlloc
GlobalHandle
TlsAlloc
LocalReAlloc
GetCurrentThreadId
SetErrorMode
GetAtomNameW
lstrcmpA
lstrlenA
GetVersionExA
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GlobalFlags
WriteFile
FlushFileBuffers
LocalFileTimeToFileTime
SizeofResource
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
ExitThread
CreateThread
GetCommandLineA
RtlUnwind
RaiseException
HeapReAlloc
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
VirtualFree
VirtualAlloc
HeapCreate
HeapDestroy
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetFilePointerEx
OutputDebugStringW
GetSystemTime
AddAtomW
FindAtomW
DeleteAtom
CreateProcessW
OpenThread
GetCurrentProcessId
GetACP
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
lstrcmpW

user32

WinHelpW
LoadIconW
RegisterWindowMessageW
SetWindowTextW
ClientToScreen
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
DestroyMenu
PostQuitMessage
GetClientRect
PostMessageW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetCapture
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
GetMenu
SetWindowLongW
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetWindowTextW
GetWindowThreadProcessId
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
LoadCursorW
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassW
SetWindowsHookExW
CallNextHookEx
DispatchMessageW
SendMessageW
GetKeyState
PeekMessageW
ValidateRect
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
SetForegroundWindow
GetSystemMetrics
SetWindowPos
LoadStringW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
UnhookWindowsHookEx

advapi32

RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegEnumKeyExW
RegQueryValueExA
RegQueryValueExW

shell32

SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket

oleaut32

SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
VariantInit
SysFreeString
SysAllocString
VariantChangeType

shlwapi

PathFindFileNameW
PathFindExtensionW
StrStrIW
SHGetValueW
PathFileExistsW
StrCmpW
StrChrW
PathAppendA

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ws2_32

WSACleanup
inet_ntoa
WSAStartup
socket
gethostbyname
connect
setsockopt
htons
inet_addr
sendto
closesocket
recvfrom
ntohs
WSAGetLastError

oleacc

LresultFromObject
CreateStdAccessibleObject

gdi32

PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
GetDeviceCaps
SetMapMode
RestoreDC
SaveDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

Exports

Exports

QueryInterface

Sections

.text
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
QMPlugin/QM_BHO.dat
QMPlugin/QM_DNS.dat
QMPlugin/QM_HD.dat
QMPlugin/QM_HD.dll
.dll windows:5 windows x86 arch:x86

d92864cbf6b2d8aedb6fbe30688bbe4f

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:db:9f:e3:4f:91:af:7a:c1:51:ea:d4:73:05:15:64:02:0a:31:e9
Signer

Actual PE Digest

8d:db:9f:e3:4f:91:af:7a:c1:51:ea:d4:73:05:15:64:02:0a:31:e9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\intermoutput\S_capital\ScanQM_HD_capital\Release\QM_HD.pdb

Imports

kernel32

OutputDebugStringA
InterlockedDecrement
GetPrivateProfileIntW
CreateEventW
lstrlenW
GetModuleHandleW
TerminateProcess
GlobalMemoryStatus
GetCurrentProcessId
GetACP
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
lstrcmpW
GetCurrentProcess
FormatMessageW
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
SetLastError
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
LocalReAlloc
DeleteCriticalSection
GetCurrentThreadId
SetErrorMode
InterlockedIncrement
lstrcmpA
lstrlenA
GetVersionExA
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GlobalFlags
WriteFile
SetFilePointer
FlushFileBuffers
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RtlUnwind
RaiseException
HeapReAlloc
HeapSize
ExitProcess
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
VirtualFree
VirtualAlloc
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetProcessHeap
GetModuleHandleA
GetLastError
Sleep
TlsSetValue
TlsGetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryW
GetTickCount
GetPrivateProfileStringW
CloseHandle
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleFileNameW
LocalFree

user32

TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
DestroyMenu
PostQuitMessage
RemovePropW
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
GetClientRect
PostMessageW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
GetMenu
SetWindowLongW
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetWindowTextW
GetWindowThreadProcessId
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
LoadCursorW
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassW
SetWindowsHookExW
CallNextHookEx
DispatchMessageW
SendMessageW
GetKeyState
PeekMessageW
ValidateRect
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
SetForegroundWindow
ShowWindow
GetMenuItemCount
GetSubMenu
GetSystemMetrics
ClientToScreen
SetWindowTextW
SetWindowPos
LoadStringW
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
MessageBoxW

shell32

ShellExecuteW

ole32

CoUninitialize
CoCreateInstance
CoInitialize
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString
VariantChangeType

shlwapi

SHGetValueW
PathFindExtensionW
PathFindFileNameW
SHSetValueW

oleacc

LresultFromObject
CreateStdAccessibleObject

gdi32

SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
ScaleViewportExtEx
RectVisible
PtVisible
SetMapMode
GetStockObject
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
DeleteObject
SaveDC
RestoreDC
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
TextOutW
GetDeviceCaps

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

Exports

Exports

QueryInterface

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
QMPlugin/QM_SP.dat
QMPlugin/QM_SP.dll
.dll windows:5 windows x86 arch:x86

f0344f7b069b059364aedf6d37932d27

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

37:73:c3:c6:00:ef:d3:7a:63:4f:1e:bf:66:31:94:71:ae:3e:ee:50:82:36:8c:95:06:aa:76:45:c1:76:04:af
Signer

Actual PE Digest

37:73:c3:c6:00:ef:d3:7a:63:4f:1e:bf:66:31:94:71:ae:3e:ee:50:82:36:8c:95:06:aa:76:45:c1:76:04:af

Digest Algorithm

sha256

PE Digest Matches

true

c5:66:b9:70:fa:ac:0c:ce:96:3d:f7:cc:d9:af:ed:c7:e0:b8:a5:84
Signer

Actual PE Digest

c5:66:b9:70:fa:ac:0c:ce:96:3d:f7:cc:d9:af:ed:c7:e0:b8:a5:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\192667\out\Release\QM_SP.pdb

Imports

kernel32

GetWindowsDirectoryW
GetVersionExW
CreateDirectoryW
GetPrivateProfileSectionW
FreeLibrary
TlsFree
TlsGetValue
TlsSetValue
Sleep
GetVersion
GetModuleHandleA
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetLogicalDriveStringsW
QueryDosDeviceW
LoadLibraryA
WideCharToMultiByte
GetACP
Thread32First
OpenThread
Thread32Next
ResumeThread
ReadProcessMemory
GlobalMemoryStatus
CreateMutexW
SystemTimeToFileTime
TerminateProcess
Module32FirstW
SetFilePointer
DeviceIoControl
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetPrivateProfileSectionNamesW
SetLastError
GetSystemInfo
GetNativeSystemInfo
GetProcessTimes
GetThreadTimes
GetPriorityClass
GetCommandLineW
SetPriorityClass
GetSystemTimes
GetPrivateProfileIntW
GetProcessIoCounters
GlobalMemoryStatusEx
ExpandEnvironmentStringsW
InterlockedIncrement
WaitForMultipleObjects
FlushInstructionCache
RaiseException
DeleteAtom
FindAtomW
AddAtomW
GetAtomNameW
GetSystemTime
LocalFree
FormatMessageW
OutputDebugStringW
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
GetLocaleInfoW
GetStringTypeA
IsValidLocale
GetPrivateProfileStringW
ReadFile
GetFileSize
CreateFileW
SizeofResource
InterlockedDecrement
CreateProcessW
GetCurrentProcessId
CreateEventW
InterlockedCompareExchange
WaitForSingleObject
InterlockedExchange
ResetEvent
GetTickCount
GetLastError
CreateMutexA
ReleaseMutex
CloseHandle
WritePrivateProfileStringW
MultiByteToWideChar
SetEvent
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapCreate
ExitProcess
IsValidCodePage
GetOEMCP
TlsAlloc
GetModuleFileNameA
GetStdHandle
WriteFile
GetStringTypeW
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetCommandLineA
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetProcessHeap
HeapSize
LockResource
GetCurrentThreadId
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy

user32

DestroyWindow
FindWindowW
SendMessageTimeoutW
UnregisterClassA
MonitorFromWindow
GetWindowRect
GetWindowThreadProcessId
EnumWindows
CallWindowProcW
DispatchMessageW
TranslateMessage
PeekMessageW
RegisterClassExW
LoadCursorW
GetClassInfoExW
DefWindowProcW
IsWindowVisible
CreateWindowExW
GetWindowLongW
SetWindowLongW

advapi32

GetTokenInformation
RegQueryValueExA
EnumServicesStatusExW
QueryServiceConfigW
QueryServiceConfig2W
RegDeleteKeyW
RegDeleteValueW
CreateProcessAsUserW
GetLengthSid
SetTokenInformation
DuplicateTokenEx
GetSidSubAuthority
GetSidSubAuthorityCount
ControlService
CloseServiceHandle
OpenServiceW
OpenSCManagerW
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW

shell32

SHGetFolderPathW
CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

CoInitialize

oleaut32

SysAllocStringLen
SysFreeString
SysAllocString
VariantClear

shlwapi

PathAppendW
PathRemoveFileSpecW
PathFileExistsW
PathFindFileNameW
PathCanonicalizeW
StrCmpNIW
SHGetValueW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW
EmptyWorkingSet
GetProcessMemoryInfo
GetProcessImageFileNameW

Exports

Exports

QueryInterface

Sections

.text
Size: 422KB - Virtual size: 421KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
QMPlugin/QM_WhiteList.dat
QTQuart.dll
.dll windows:5 windows x86 arch:x86

48986af59ad605a952e8e89d26b599ff

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c6:7f:15:b1:1e:4d:25:47:80:9e:8a:cb:dd:b0:bb:4f:c4:69:b8:fe:be:a9:36:37:40:cc:9d:65:4c:aa:fb:c5
Signer

Actual PE Digest

c6:7f:15:b1:1e:4d:25:47:80:9e:8a:cb:dd:b0:bb:4f:c4:69:b8:fe:be:a9:36:37:40:cc:9d:65:4c:aa:fb:c5

Digest Algorithm

sha256

PE Digest Matches

true

e7:b7:51:3f:82:b8:e7:c3:68:dc:63:1f:51:67:a1:ca:0f:b0:17:1d
Signer

Actual PE Digest

e7:b7:51:3f:82:b8:e7:c3:68:dc:63:1f:51:67:a1:ca:0f:b0:17:1d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\104086\out\Release\QTQuart.pdb

Imports

kernel32

GetFullPathNameW
GetShortPathNameW
FileTimeToLocalFileTime
CompareStringA
LoadLibraryExW
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThreadId
GetCurrentThread
GlobalDeleteAtom
SetThreadPriority
SetEvent
CreateEventW
GlobalAddAtomW
LocalAlloc
GlobalReAlloc
GlobalHandle
LocalReAlloc
SetErrorMode
InterlockedIncrement
CompareStringW
GlobalGetAtomNameW
GetAtomNameW
lstrlenA
LocalFileTimeToFileTime
GetFileSizeEx
GetFileTime
GetCurrentDirectoryW
GlobalFlags
GetVersionExA
GlobalFindAtomW
FreeResource
HeapFree
HeapAlloc
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetCommandLineA
HeapReAlloc
ExitProcess
HeapSize
GetVolumeInformationW
HeapDestroy
VirtualFree
FatalAppExitA
VirtualAlloc
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
GetFileInformationByHandle
PeekNamedPipe
GetFileType
GetCurrentDirectoryA
SetCurrentDirectoryA
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
GetProcessHeap
GetFullPathNameA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
DuplicateHandle
UnlockFile
LockFile
FlushFileBuffers
DeleteAtom
FindAtomW
AddAtomW
GetSystemTime
OutputDebugStringW
SetFilePointerEx
lstrcmpiW
GetThreadLocale
GetStringTypeExW
GlobalFree
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
MulDiv
InterlockedExchange
OutputDebugStringA
InterlockedDecrement
GetLocalTime
GetTempFileNameW
SetFileTime
SetEndOfFile
GetSystemWindowsDirectoryW
SetLastError
TlsAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetFilePointer
GetTimeZoneInformation
GetPrivateProfileSectionW
MoveFileExW
MoveFileW
TerminateProcess
CreateMutexW
SetFileAttributesW
RemoveDirectoryW
GetACP
lstrcmpW
GetModuleFileNameW
GetTempPathW
GetLongPathNameW
ExpandEnvironmentStringsW
GetFileAttributesExW
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
DeleteFileW
TlsGetValue
TlsSetValue
GetCommandLineW
CopyFileW
CreateDirectoryW
InterlockedCompareExchange
FindNextFileW
GetPrivateProfileIntW
WriteFile
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
ReadProcessMemory
AreFileApisANSI
WideCharToMultiByte
QueryDosDeviceW
GetDriveTypeW
GetDiskFreeSpaceExW
GetPrivateProfileStringW
WritePrivateProfileSectionW
WritePrivateProfileStringW
OpenProcess
SetEnvironmentVariableW
FileTimeToSystemTime
SystemTimeToFileTime
GlobalMemoryStatus
ResumeThread
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
Thread32Next
FindFirstFileW
FindClose
GetTickCount
GetCurrentProcessId
ProcessIdToSessionId
LoadLibraryA
GetModuleHandleA
GetCurrentProcess
CreateMutexA
ReleaseMutex
FreeLibrary
TlsFree
GetFileSize
ReadFile
GetWindowsDirectoryW
GetVersionExW
GetVersion
GetLogicalDriveStringsW
lstrlenW
GetFileAttributesW
GetModuleHandleW
GetProcAddress
GetSystemDirectoryW
LoadLibraryW
MultiByteToWideChar
CreateFileA
GetLastError
GetDriveTypeA
QueryDosDeviceA
Sleep
CreateFileW
DeviceIoControl
CloseHandle
FindResourceW
LoadResource
LockResource
HeapCreate
SizeofResource

user32

SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
SetPropW
GetPropW
RemovePropW
IsWindow
SetFocus
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
UpdateWindow
GetClientRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
IsDlgButtonChecked
EqualRect
DeferWindowPos
GetScrollInfo
GetSystemMenu
SetWindowPlacement
DefWindowProcW
CallWindowProcW
CopyRect
GetMenu
SetWindowLongW
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
WaitForInputIdle
WindowFromPoint
GetSystemMetrics
SystemParametersInfoW
GetDesktopWindow
GetWindow
GetDlgCtrlID
GetClassNameW
PtInRect
SetWindowTextW
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
ScreenToClient
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
DeleteMenu
GetWindowTextLengthW
GetWindowTextW
LoadCursorW
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassW
IsDialogMessageW
MoveWindow
ScrollWindowEx
DestroyIcon
InflateRect
GetMenuItemInfoW
DestroyMenu
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamW
SetRectEmpty
InvalidateRect
GetDialogBaseUnits
TranslateAcceleratorW
CreatePopupMenu
InsertMenuItemW
LoadAcceleratorsW
ReleaseCapture
GetMenuBarInfo
LoadMenuW
ReuseDDElParam
UnpackDDElParam
SetRect
SetTimer
KillTimer
GetKeyNameTextW
MapVirtualKeyW
AdjustWindowRectEx
IsRectEmpty
SetWindowPos
SwitchToThisWindow
SetForegroundWindow
BringWindowToTop
GetWindowRect
SendMessageTimeoutW
FindWindowW
ShowWindow
SetParent
UnionRect
SetCapture
LockWindowUpdate
SetScrollInfo
GetDCEx
CharLowerBuffW
EnumThreadWindows
SendMessageW
RemoveMenu
GetSubMenu
GetMenuItemCount
UnhookWindowsHookEx
GetWindowThreadProcessId
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
ShowOwnedPopups
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
ModifyMenuW
EnableMenuItem
CheckMenuItem
PostMessageW
PostQuitMessage
CharUpperW
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
ShowScrollBar

gdi32

CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
GetCharWidthW
CreateFontW
StretchDIBits
CreateCompatibleBitmap
GetTextMetricsW
GetBkColor
GetTextExtentPoint32W
CreateFontIndirectW
CreateSolidBrush
ExtCreatePen
CreatePen
SetViewportOrgEx
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
GetStockObject
CreateCompatibleDC
CreatePatternBrush
CreateDIBPatternBrushPt
DeleteDC
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
GetDCOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
StartDocW
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
GetObjectW
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetTextColor
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateBitmap
ScaleViewportExtEx
CreateHatchBrush
SetViewportExtEx
GetDeviceCaps
CreateDCW
CopyMetaFileW
OffsetViewportOrgEx

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegDeleteValueW
RegQueryValueExA
RegCreateKeyW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyW
RegSetValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupPrivilegeValueW
AdjustTokenPrivileges
GetUserNameW
RegEnumKeyExW
RegQueryValueExW
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
FreeSid
IsValidSid
EqualSid
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey

shell32

ShellExecuteW
SHChangeNotify
CommandLineToArgvW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetFileInfoW
ExtractIconW
DragFinish
DragQueryFileW
ShellExecuteExW

shlwapi

SHDeleteValueW
StrCmpNW
SHDeleteKeyW
StrStrIW
PathAppendW
SHGetValueW
StrCmpNIW
PathAddBackslashW
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
SHSetValueW
PathRemoveExtensionW

ole32

ReadFmtUserTypeStg
CoDisconnectObject
StringFromGUID2
CLSIDFromString
CoInitializeEx
CreateBindCtx
ReleaseStgMedium
OleDuplicateData
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
StringFromCLSID
CoTreatAsClass
ReadClassStg

oleaut32

SysFreeString
SysAllocString
SysStringLen
SysAllocStringByteLen
SysStringByteLen
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
VariantClear
SafeArrayRedim
VariantChangeType
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocStringLen
VarDateFromStr
SysReAllocStringLen
VarCyFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarBstrFromDate
VariantInit
GetErrorInfo
SetErrorInfo
CreateErrorInfo

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
CM_Request_Device_EjectW
CM_Get_Parent
SetupDiGetDeviceInterfaceDetailW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

Exports

Exports

QT_AddRecord
QT_CloseFindItemHandle
QT_CreateFind
QT_FindNextItem
QT_FindNextItemForCount
QT_GetItemCount
QT_GetQuartFileInfo
QT_QuartFile
QT_QuartFile_New
QT_QuartFile_New2
QT_RemoveAllItems
QT_RemoveItem
QT_RestoreFile
QT_Section_Close
QT_Section_Open

Sections

.text
Size: 642KB - Virtual size: 642KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Relocate.exe
.exe windows:5 windows x86 arch:x86

4945d80fd4e62a1f14ae7570f8627f6c

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:21:76:cb:f8:13:1d:31:e5:28:23:e4:ca:0f:c2:b8:3f:e0:46:3e
Signer

Actual PE Digest

16:21:76:cb:f8:13:1d:31:e5:28:23:e4:ca:0f:c2:b8:3f:e0:46:3e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\building\360project\360sd\branches\beta\Build\x86\Relocate.pdb

Imports

kernel32

CreateNamedPipeW
ConnectNamedPipe
WaitNamedPipeW
DisconnectNamedPipe
OutputDebugStringA
DeviceIoControl
GetCommandLineW
GetPrivateProfileIntW
Module32FirstW
Module32NextW
ReleaseMutex
CreateMutexA
WritePrivateProfileSectionW
SetEnvironmentVariableW
MoveFileW
GetFileAttributesW
GetTimeZoneInformation
WritePrivateProfileStringW
GetPrivateProfileSectionW
SystemTimeToFileTime
TlsFree
TlsGetValue
TlsSetValue
GlobalMemoryStatus
ReadProcessMemory
GetTempPathW
ResumeThread
Thread32First
OpenThread
SuspendThread
Thread32Next
ProcessIdToSessionId
GetACP
AreFileApisANSI
GetLongPathNameW
LoadLibraryA
QueryDosDeviceW
lstrcmpW
GlobalAlloc
GetLogicalDriveStringsW
WideCharToMultiByte
ExpandEnvironmentStringsW
GetFileSize
ReadFile
SetFilePointer
WriteFile
SetEndOfFile
SetFileTime
CopyFileW
GetPrivateProfileStringW
SetFileAttributesW
MoveFileExW
InterlockedCompareExchange
WaitForMultipleObjects
TerminateThread
GetExitCodeThread
GetWindowsDirectoryW
GetFileAttributesExW
FileTimeToSystemTime
ResetEvent
CreateThread
Sleep
InterlockedExchange
CreateEventW
lstrcmpiW
LoadLibraryExW
InitializeCriticalSection
lstrlenW
DeleteCriticalSection
GetDriveTypeW
CreateMutexW
GetLastError
GetHandleInformation
SetEvent
GetCurrentProcessId
CreateEventA
GetVersionExW
GetVersion
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
FreeLibrary
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetModuleHandleA
GetDiskFreeSpaceExW
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryW
GetTempFileNameW
CreateFileW
DeleteFileW
RemoveDirectoryW
LeaveCriticalSection
EnterCriticalSection
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
FlushInstructionCache
RaiseException
GetCurrentThreadId
SetLastError
GetCurrentProcess
CloseHandle
GetTickCount
GetModuleFileNameW
GetProcAddress
DeleteAtom
FindAtomW
AddAtomW
GetSystemTime
GetLocalTime
OutputDebugStringW
SetFilePointerEx
IsProcessorFeaturePresent
GetProcessHeap
SetEnvironmentVariableA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualAlloc
FatalAppExitA
VirtualFree
HeapDestroy
HeapCreate
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetCPInfo
GetModuleFileNameA
GetStdHandle
SetCurrentDirectoryW
LoadLibraryW
ExitProcess
ExitThread
HeapSize
HeapReAlloc
MulDiv
GlobalUnlock
GlobalLock
LocalFree
FormatMessageW
GlobalSize
GlobalFree
GlobalFlags
CompareStringW
SetThreadPriority
LocalAlloc
GlobalReAlloc
GlobalHandle
TlsAlloc
LocalReAlloc
GlobalGetAtomNameW
GetAtomNameW
lstrcmpA
lstrlenA
GetThreadLocale
GetVersionExA
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
FreeResource
GetStringTypeExW
FlushFileBuffers
LockFile
UnlockFile
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
GetShortPathNameW
CompareStringA
GetLocaleInfoW
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
SetErrorMode
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetFileSizeEx
GetFileTime
GetCurrentDirectoryW
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetStartupInfoW

user32

GetWindowTextW
GetWindowTextLengthW
PtInRect
GetClassNameW
GetDesktopWindow
UnhookWindowsHookEx
InflateRect
IntersectRect
ValidateRect
GetCursorPos
GetKeyState
IsWindowVisible
GetActiveWindow
CallNextHookEx
SetWindowsHookExW
GetSysColorBrush
GetWindowPlacement
IsIconic
SystemParametersInfoA
OffsetRect
GetMenu
SetWindowPlacement
SetScrollInfo
GetScrollInfo
DeferWindowPos
EqualRect
AdjustWindowRectEx
RegisterClassW
GetClassInfoW
UpdateWindow
ShowScrollBar
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
SetMenu
TrackPopupMenu
TrackPopupMenuEx
ScrollWindow
GetMessagePos
GetMessageTime
GetTopWindow
EndDeferWindowPos
BeginDeferWindowPos
SetActiveWindow
GetForegroundWindow
RemovePropW
GetPropW
SetPropW
GetClassLongW
GetCapture
IsChild
WinHelpW
SendDlgItemMessageA
LoadIconW
RegisterWindowMessageW
UnregisterClassW
CheckMenuItem
EnableMenuItem
ModifyMenuW
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
DestroyIcon
CharUpperW
GetMenuItemInfoW
DestroyMenu
SetRectEmpty
InvalidateRect
ShowOwnedPopups
DeleteMenu
GetNextDlgTabItem
CreateDialogIndirectParamW
TranslateAcceleratorW
GetFocus
DrawTextExW
LoadAcceleratorsW
ReleaseCapture
GetMenuBarInfo
LoadMenuW
ReuseDDElParam
UnpackDDElParam
SetRect
GetDialogBaseUnits
GetKeyNameTextW
MapVirtualKeyW
IsRectEmpty
GetSystemMenu
SetParent
UnionRect
GetDCEx
LockWindowUpdate
SetCapture
UnregisterClassA
DrawTextW
TabbedTextOutW
FillRect
ScrollWindowEx
SetFocus
MoveWindow
GetDlgCtrlID
GrayStringW
IsWindow
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
SendDlgItemMessageW
GetDlgItemTextW
GetDlgItemInt
GetDlgItem
CheckRadioButton
CheckDlgButton
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
EnableWindow
GetSysColor
SendMessageTimeoutW
BringWindowToTop
SwitchToThisWindow
EnumThreadWindows
SystemParametersInfoW
GetSystemMetrics
WindowFromPoint
WaitForInputIdle
CharLowerBuffW
wsprintfW
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
FindWindowW
SetForegroundWindow
LoadStringW
MessageBoxW
KillTimer
SetTimer
EndDialog
CopyRect
SetCursor
GetDC
ReleaseDC
RegisterClassExW
LoadCursorW
GetClassInfoExW
CreateWindowExW
CallWindowProcW
SetWindowLongW
DestroyWindow
DefWindowProcW
DialogBoxParamW
PostMessageW
ExitWindowsEx
ShowWindow
SendMessageW
PostQuitMessage
GetParent
GetWindow
GetWindowRect
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
GetClientRect
SetWindowTextW
SetWindowPos
SetWindowRgn
ScreenToClient
CreatePopupMenu
InsertMenuItemW

gdi32

TextOutW
ExtTextOutW
RectVisible
PtVisible
StartDocW
GetPixel
GetWindowExtEx
GetViewportExtEx
SelectClipPath
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
CreateDIBSection
SetDIBits
CreateRectRgn
CreateEllipticRgn
BeginPath
MoveToEx
SetTextColor
ArcTo
CloseFigure
EndPath
PathToRegion
CombineRgn
SetArcDirection
BitBlt
GetObjectW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
CreateRoundRectRgn
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
CreateDIBPatternBrushPt
CreatePatternBrush
CreateBitmap
GetStockObject
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
GetDeviceCaps
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CopyMetaFileW
CreateDCW
CreateFontIndirectW
CreateRectRgnIndirect
SetRectRgn
GetMapMode
PatBlt
DPtoLP
GetDCOrgEx
GetTextExtentPoint32W
GetCharWidthW
CreateFontW
StretchDIBits
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
LineTo
GetDIBits
GetTextMetricsW
GetBkColor

advapi32

RegDeleteKeyW
SetEntriesInAclW
GetUserNameW
RegSetValueW
RegCreateKeyW
RegOpenKeyW
RegQueryValueW
RegEnumKeyW
RegQueryValueExA
GetTokenInformation
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
EqualSid
IsValidSid
AllocateAndInitializeSid

shell32

SHGetFileInfoW
ExtractIconW
DragFinish
DragQueryFileW
CommandLineToArgvW
SHChangeNotify
SHGetFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderLocation
ord165
SHFileOperationW
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW

ole32

OleDuplicateData
CoTreatAsClass
StringFromGUID2
ReleaseStgMedium
CreateBindCtx
CLSIDFromString
WriteFmtUserTypeStg
WriteClassStg
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree
CoDisconnectObject
StringFromCLSID
CoInitializeEx
ReadClassStg
ReadFmtUserTypeStg
SetConvertStg
OleRegGetUserType

oleaut32

LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
VarBstrFromDate
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarCyFromStr
SysReAllocStringLen
VarDateFromStr
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
GetErrorInfo
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
VariantChangeType
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocString
SysAllocStringByteLen
SysStringByteLen
DispCallFunc
VariantInit
VariantClear
SysFreeString
SysStringLen
VarUI4FromStr
SetErrorInfo
SafeArrayGetElement
CreateErrorInfo

msimg32

AlphaBlend

shlwapi

PathAppendW
StrCmpNIW
StrCmpNW
SHDeleteValueW
SHDeleteKeyW
PathRemoveExtensionW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathIsRelativeW
SHSetValueW
PathRemoveFileSpecW
PathFindFileNameW
PathCombineW
StrStrIW
PathAddBackslashW
PathFileExistsW
SHGetValueW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetReadFile

gdiplus

GdipBitmapLockBits
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipCloneImage
GdipDisposeImage
GdipFree
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipAlloc
GdipBitmapUnlockBits

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

comdlg32

GetFileTitleW

Sections

.text
Size: 695KB - Virtual size: 694KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SDPlugin/MPopWndConfig.dat
.xml
SDPlugin/PopWndConfig.dat
.xml
SDPlugin/PopWndInit.dat
SDPlugin/PopWndTracker.dat
SDPlugin/ScanExtOpt.dat
SDPlugin/SyncTime.dat
SDPlugin/VolSpace.dat
SRAgent.exe
.exe windows:5 windows x86 arch:x86

135b8e0c2930322312070e94b4b78a15

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:5a:89:9c:2f:b7:46:b6:6f:e8:dd:d4:d1:27:9f:ec:56:ed:1a:45:43:50:1b:3f:5e:4c:c2:4a:40:c8:28:17
Signer

Actual PE Digest

56:5a:89:9c:2f:b7:46:b6:6f:e8:dd:d4:d1:27:9f:ec:56:ed:1a:45:43:50:1b:3f:5e:4c:c2:4a:40:c8:28:17

Digest Algorithm

sha256

PE Digest Matches

true

d1:91:48:56:e4:95:b7:0f:41:fc:e4:80:94:51:da:e2:55:84:1e:63
Signer

Actual PE Digest

d1:91:48:56:e4:95:b7:0f:41:fc:e4:80:94:51:da:e2:55:84:1e:63

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\81257\out\Release\SRAgent.pdb

Imports

kernel32

LoadLibraryW
DeleteFileW
WriteFile
FreeLibrary
TlsFree
TlsGetValue
TlsSetValue
Sleep
ReleaseMutex
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
LoadLibraryA
WideCharToMultiByte
MultiByteToWideChar
GetACP
GetCurrentProcessId
OpenThread
ResumeThread
SystemTimeToFileTime
TerminateProcess
GetCommandLineW
SetFilePointer
DeviceIoControl
GetCurrentThreadId
SetLastError
InterlockedDecrement
WaitForMultipleObjects
InterlockedIncrement
QueryPerformanceCounter
SetNamedPipeHandleState
CreateFileA
GetExitCodeThread
ReleaseSemaphore
SetThreadPriority
ReadFileEx
OutputDebugStringA
WaitForSingleObjectEx
CreateSemaphoreW
ConnectNamedPipe
CreateNamedPipeA
GetOverlappedResult
DisconnectNamedPipe
IsBadReadPtr
GetSystemTime
DeleteAtom
FindAtomW
AddAtomW
GetAtomNameW
LocalFree
FormatMessageW
OutputDebugStringW
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
CreateMutexW
CreateThread
ResetEvent
TerminateThread
ReadFile
GetFileSize
CreateFileW
GetWindowsDirectoryW
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleHandleW
GetProcAddress
GetVersion
GetVersionExW
SetEvent
GetTickCount
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
TlsAlloc
GetModuleFileNameA
GetStdHandle
GetLastError
GetCurrentThread
RaiseException
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
ExitThread
GetStartupInfoW
RtlUnwind
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess

advapi32

RegEnumKeyExW
RegOpenKeyExW
SetEntriesInAclW
OpenThreadToken
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegQueryValueExA

shell32

SHGetSpecialFolderPathW
ShellExecuteW

shlwapi

PathAppendW
StrToIntW
PathFileExistsW
SHGetValueW
StrStrIW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Exports

Exports

?StartListen2@Communicator@@YAPAXPBD@Z
?StartListen3@Communicator@@YAPAXPBDI@Z
?StartListen@Communicator@@YAHPBD@Z
?StopListen2@Communicator@@YAXPAX@Z
?StopListen@Communicator@@YAHXZ

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Safelive.dll
.dll regsvr32 windows:5 windows x86 arch:x86

7331f77b5727e5bf8f5894625075560b

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b0:79:b5:7b:d5:8c:2e:5b:47:ec:07:6f:65:93:a9:8b:dc:8c:7a:44:8f:4d:69:38:ec:4d:32:74:d4:9a:7f:4a
Signer

Actual PE Digest

b0:79:b5:7b:d5:8c:2e:5b:47:ec:07:6f:65:93:a9:8b:dc:8c:7a:44:8f:4d:69:38:ec:4d:32:74:d4:9a:7f:4a

Digest Algorithm

sha256

PE Digest Matches

true

a1:47:ec:39:e8:3a:80:17:22:23:16:64:e2:98:02:1d:18:dd:fb:0b
Signer

Actual PE Digest

a1:47:ec:39:e8:3a:80:17:22:23:16:64:e2:98:02:1d:18:dd:fb:0b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\322847\out\Release\Safelive.pdb

Imports

kernel32

SetFilePointer
CopyFileW
MoveFileExW
SetLastError
WaitForSingleObject
CreateThread
GetVersionExW
SetFileAttributesW
GetFullPathNameW
LockFileEx
LoadLibraryExW
SetErrorMode
GetModuleHandleW
GetLongPathNameW
CreateProcessW
GetModuleFileNameW
lstrlenW
WritePrivateProfileStringW
GetPrivateProfileSectionW
GetSystemDefaultUILanguage
GetTempPathW
MapViewOfFileEx
CreateFileMappingW
UnmapViewOfFile
ResetEvent
SetEvent
LocalFree
InterlockedDecrement
InterlockedIncrement
RemoveDirectoryW
CreateEventW
lstrcmpiW
GetSystemDirectoryW
GetSystemWindowsDirectoryW
DeviceIoControl
GetCurrentProcessId
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcess
ResumeThread
SetThreadPriority
GetVolumeInformationW
GetDiskFreeSpaceExW
GetPrivateProfileIntW
CreateMutexW
ReleaseMutex
GetPrivateProfileStringW
Module32FirstW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CompareFileTime
SystemTimeToFileTime
GetSystemTime
GetProcessTimes
VirtualAlloc
VirtualFree
DeleteAtom
FindAtomW
AddAtomW
OpenThread
GetAtomNameW
CreateFileA
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
GetFileAttributesExW
InterlockedCompareExchange
Sleep
ReadFile
GetFileSize
UnlockFile
GetTempFileNameW
WriteFile
CreateFileW
CloseHandle
DeleteFileW
MultiByteToWideChar
GetLastError
WritePrivateProfileSectionW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcAddress
LoadLibraryW
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
WideCharToMultiByte
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringA
GetTimeZoneInformation
GetModuleHandleA
LCMapStringW
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetCommandLineA
ExitThread
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
EnterCriticalSection
RaiseException
SetFileAttributesA
GetTickCount
DosDateTimeToFileTime
SetFileTime
FormatMessageW

user32

GetWindowLongW
KillTimer
SetWindowLongW
SetTimer
DefWindowProcW
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjects
PostMessageW
SetForegroundWindow
ShowWindow
WaitForInputIdle
SendMessageTimeoutW
IsWindow
CharNextW
RegisterClassExW
DestroyWindow
FindWindowW
CreateWindowExW

advapi32

RegQueryValueExA
CryptGenRandom
CryptAcquireContextW
RegCloseKey
RegQueryValueExW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
GetSecurityInfo
AllocateAndInitializeSid
SetEntriesInAclW
SetSecurityInfo
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
FreeSid
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
CryptReleaseContext

shell32

SHFileOperationW
SHCreateDirectoryExW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHCreateDirectoryExA

ole32

OleUninitialize
OleInitialize
CoUninitialize
CoTaskMemFree
StringFromCLSID
CoCreateGuid
CoInitialize
CoTaskMemRealloc
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc

oleaut32

LoadRegTypeLi
VarUI4FromStr
SysAllocString
SysFreeString
SysStringLen
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi

shlwapi

SHGetValueA
PathStripToRootW
SHDeleteKeyW
SHSetValueW
StrToIntW
UrlCombineW
StrCmpNIW
StrDupW
PathFindExtensionW
PathRenameExtensionW
StrChrW
UrlEscapeW
PathAppendW
StrCmpNW
StrStrW
StrPBrkW
StrCpyNW
StrStrIW
UrlGetPartW
PathFileExistsW
PathIsDirectoryW
StrCmpIW
PathFindFileNameW
PathCombineW
PathIsPrefixW
PathRemoveFileSpecW
PathFileExistsA
SHGetValueW
PathFindFileNameA

urlmon

URLDownloadToFileW

setupapi

SetupIterateCabinetW

cabinet

ord22
ord20
ord23

ws2_32

htons
ntohl
ntohs
htonl

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

iphlpapi

GetIpAddrTable

Exports

Exports

ConnectUpdateServer
CreateUpdateServer
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InitializeBAPI
SetBaseDirectory
UnInitializeBAPI

Sections

.text
Size: 328KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.IShareO
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SiteUIProxy.dll
.dll windows:5 windows x86 arch:x86

cb9e752dd96d051b310a5119da30b6f5

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:87:c3:11:53:0e:f1:46:31:1c:a0:3b:ef:82:68:b1:ed:ec:ba:be
Signer

Actual PE Digest

20:87:c3:11:53:0e:f1:46:31:1c:a0:3b:ef:82:68:b1:ed:ec:ba:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\build\SiteUIProxy\Release\SiteUIProxy.pdb

Imports

kernel32

GetCurrentProcess
FlushInstructionCache
SetCurrentDirectoryW
GetLongPathNameW
GetFileSizeEx
MulDiv
GetVersionExW
DeleteFileW
GetTempFileNameW
GetTempPathW
VirtualFree
IsProcessorFeaturePresent
GetModuleFileNameW
LeaveCriticalSection
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
SetFilePointer
GetLocaleInfoA
SetLastError
GetStringTypeW
GetStringTypeA
LCMapStringA
SizeofResource
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
LCMapStringW
HeapSize
GetModuleFileNameA
GetStdHandle
HeapDestroy
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
lstrlenA
OutputDebugStringW
DebugBreak
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
DeleteCriticalSection
lstrcmpiW
DeviceIoControl
EnterCriticalSection
GetProcAddress
GetLastError
RaiseException
lstrlenW
MultiByteToWideChar
CreateFileW
LoadLibraryW
InitializeCriticalSection
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
LoadResource
FreeLibrary
RtlUnwind
GetCommandLineA
ExitProcess
Sleep
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetModuleHandleA
FindResourceW
WideCharToMultiByte
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
TerminateProcess
TlsFree
DeleteAtom
FindAtomW
TlsAlloc
ReleaseMutex
AddAtomW
OpenThread
GetAtomNameW
TlsSetValue
WaitForSingleObject
TlsGetValue
CreateMutexW
GetSystemTime
LocalFree
FormatMessageW
ReadFile
WriteFile
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
VirtualAlloc

user32

DefWindowProcW
ReleaseDC
GetDC
GetClientRect
EndPaint
BeginPaint
GetWindowRect
IsWindow
UnregisterClassA
SetWindowPos
RegisterClassExW
CharNextW
CopyRect
CharUpperW
SetCursor
GetCursor
EqualRect
SendMessageW
InvalidateRect
PtInRect
DrawTextW
OffsetRect
DestroyWindow
PostMessageW
MessageBoxW
LoadStringW
DialogBoxParamW
EndDialog
SetWindowTextW
GetActiveWindow
BringWindowToTop
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetParent
MapWindowPoints
RegisterClassW
GetClassInfoW
CallWindowProcW
GetWindowLongW
SetWindowLongW
CreateWindowExW
LoadCursorW
GetClassInfoExW

gdi32

GetDeviceCaps
CreateFontIndirectW
SetTextColor
SetBkColor
SetBkMode
GetTextExtentPoint32W
SelectObject

advapi32

RegDeleteValueW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegQueryValueExA

shell32

ShellExecuteW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance

oleaut32

SysStringLen
VariantChangeType
DispCallFunc
VariantInit
SysFreeString
SysStringByteLen
VarUI4FromStr
SysAllocStringByteLen
VariantClear
SysAllocString

shlwapi

SHGetValueW
PathFindFileNameW
PathAppendW
PathFileExistsW
PathCombineW
PathRemoveFileSpecW
PathFindExtensionW
SHSetValueW
PathIsRelativeW

Exports

Exports

Get360Customizine
GetChangeSkinManager
GetMiniUICompatible
GetSiteUIProxy

Sections

.text
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

shared
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SoftMgr/360AI.dat
SoftMgr/360AI.exe
.exe windows:5 windows x86 arch:x86

49ef30e870782d99eae616ed1973773a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e4:87:65:ca:88:88:d0:9b:35:4b:d9:b5:f8:ec:98:26:cb:5a:19:4d:cb:9b:c0:03:91:ad:de:f0:dd:d5:a0:05
Signer

Actual PE Digest

e4:87:65:ca:88:88:d0:9b:35:4b:d9:b5:f8:ec:98:26:cb:5a:19:4d:cb:9b:c0:03:91:ad:de:f0:dd:d5:a0:05

Digest Algorithm

sha256

PE Digest Matches

true

f6:35:e4:ad:f1:af:70:bc:5e:be:22:6a:1c:9b:59:ee:d2:03:c7:ef
Signer

Actual PE Digest

f6:35:e4:ad:f1:af:70:bc:5e:be:22:6a:1c:9b:59:ee:d2:03:c7:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\85072\out\Release\360AI.pdb

Imports

shlwapi

SHGetValueW
PathAppendW
PathCombineW
StrStrIW
PathFileExistsW

kernel32

lstrlenW
InterlockedIncrement
GetModuleHandleW
CloseHandle
GetModuleFileNameW
GetPrivateProfileStringW
GetTickCount
GetCurrentThreadId
RaiseException
lstrcmpiW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
CreateMutexW
ReleaseMutex
ExitProcess
TerminateProcess
GetCurrentProcess
FlushInstructionCache
SetLastError
InterlockedExchange
DebugBreak
OutputDebugStringW
lstrlenA
SetEvent
WaitForSingleObject
TerminateThread
CreateEventW
CreateThread
WaitForMultipleObjects
WritePrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileSectionW
SetCurrentDirectoryW
GetPrivateProfileSectionW
InterlockedCompareExchange
Sleep
FindFirstFileW
LoadLibraryA
GetVersionExW
GetVersion
SearchPathW
GetFileAttributesW
GetModuleHandleA
WideCharToMultiByte
CreateFileW
GetFileSize
ReadFile
SetFilePointer
DeviceIoControl
GetCurrentProcessId
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
InterlockedDecrement
DeleteCriticalSection
FindAtomW
AddAtomW
OpenThread
GetAtomNameW
GetSystemTime
LocalFree
FormatMessageW
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
SystemTimeToFileTime
GetStartupInfoW
CompareStringW
CompareStringA
CreateFileA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetACP
HeapFree
GetCPInfo
InitializeCriticalSection
LoadLibraryExW
GetProcAddress
LoadLibraryW
FreeLibrary
GetLastError
VirtualFree
VirtualAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetModuleFileNameA
GetStdHandle
WriteFile
HeapCreate
HeapReAlloc
HeapSize
GetSystemTimeAsFileTime
DeleteAtom
SetEnvironmentVariableA

user32

EndDialog
FindWindowW
SendMessageTimeoutW
CharNextW
LoadStringW
UnregisterClassA
ShowWindow
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
DefWindowProcW
DestroyWindow
RegisterClassExW
LoadIconW
IsWindowVisible
MessageBoxW
PostQuitMessage
DisableProcessWindowsGhosting
DrawIconEx
KillTimer
DialogBoxParamW
GetActiveWindow
SystemParametersInfoW
SetForegroundWindow
BringWindowToTop
IsWindow
OffsetRect
CopyRect
IsIconic
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
SetWindowPos
CallWindowProcW
GetWindowLongW
PostMessageW
RegisterWindowMessageW
SetTimer
SendMessageW
wvsprintfW
CharLowerW
CreateWindowExW
SetWindowLongW
LoadCursorW
GetClassInfoExW

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExA
RegQueryInfoKeyW
RegDeleteKeyW
RegCloseKey
RegQueryValueExW

shell32

ord155
SHOpenFolderAndSelectItems
ord190
ExtractIconExW
ShellExecuteW
ShellExecuteExW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

DispCallFunc
VariantClear
VariantInit
SysAllocString
SysFreeString
VarUI4FromStr

comctl32

_TrackMouseEvent
InitCommonControlsEx

Sections

.text
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SoftMgr/BlackCache.db
SoftMgr/BlackCache.dll
.dll windows:5 windows x86 arch:x86

3d87df5c338e765753b5abdca15b7ac9

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:05:c8:24:49:97:bc:7f:ea:7b:4b:87:ea:6a:93:20:ef:45:91:52
Signer

Actual PE Digest

02:05:c8:24:49:97:bc:7f:ea:7b:4b:87:ea:6a:93:20:ef:45:91:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\building\360project\Anti-Install\branches\FromTag_20140506_5.0.0.5052\Build\x86\BlackCache.pdb

Imports

sqlite3

sqlite3_close
sqlite3_finalize
sqlite3_column_text16
sqlite3_column_int
sqlite3_step
sqlite3_prepare16
sqlite3_open16
sqlite3_config

kernel32

GetProcessHeap
CreateMutexW
GetSystemTime
LocalFree
InterlockedDecrement
lstrlenW
InterlockedIncrement
DebugBreak
OutputDebugStringW
lstrlenA
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetLastError
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
LoadLibraryExW
GetFileSizeEx
ReadFile
CloseHandle
GetWindowsDirectoryW
LoadLibraryA
WaitForSingleObject
GetModuleHandleA
GetCurrentProcess
WideCharToMultiByte
GetFileSize
SetFilePointer
DeviceIoControl
GetCurrentProcessId
GetModuleHandleW
LoadLibraryW
InitializeCriticalSection
GetAtomNameW
RaiseException
FindFirstFileW
FindClose
GetSystemDirectoryW
SystemTimeToFileTime
FormatMessageW
SetFilePointerEx
LocalFileTimeToFileTime
OpenThread
AddAtomW
ReleaseMutex
FindAtomW
InitializeCriticalSectionAndSpinCount
CreateFileA
FlushFileBuffers
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
DeleteAtom
DeleteCriticalSection
HeapAlloc
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
HeapSize
SetHandleCount

user32

CharNextW
wvsprintfW
LoadStringW

advapi32

RegQueryValueExA
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW

shell32

SHGetSpecialFolderPathW

oleaut32

SysAllocStringLen
SysFreeString
SysAllocString

shlwapi

SHGetValueW
PathAppendW
StrCmpIW
StrToIntW
PathFileExistsW
StrStrIW
StrTrimW
PathCombineW
StrCmpNIW
PathFindFileNameW
StrCpyNW
PathStripToRootW
StrCmpNW
PathFindExtensionW

Exports

Exports

CreateCacheObject
FreeCacheObject
GetResouceInfoObject

Sections

.text
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SoftMgr/Module.dll
.dll windows:5 windows x86 arch:x86

5ae8d2730abc17fd0cb4f223990e769a

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cb:5a:73:fb:dd:70:67:5d:35:83:f8:2d:ae:10:6c:fe:53:af:a4:93
Signer

Actual PE Digest

cb:5a:73:fb:dd:70:67:5d:35:83:f8:2d:ae:10:6c:fe:53:af:a4:93

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\building\360project\Anti-Install\trunk\Build\x86\Module.pdb

Imports

sqlite3

sqlite3_malloc
sqlite3_last_insert_rowid
sqlite3_prepare16
sqlite3_free
sqlite3_exec
sqlite3_finalize
sqlite3_column_text16
sqlite3_column_int64
sqlite3_column_int
sqlite3_step
sqlite3_prepare
sqlite3_close
sqlite3_open16
sqlite3_config

kernel32

FlushFileBuffers
CreateFileA
GetStringTypeW
GetStringTypeA
LCMapStringW
GetModuleFileNameW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
GetFileAttributesExW
GetLocalTime
CreateFileW
SetFilePointer
WriteFile
MultiByteToWideChar
DeleteFileW
GetLongPathNameW
CloseHandle
WritePrivateProfileStringW
GetTempPathW
GetTempFileNameW
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
Thread32Next
ResumeThread
CopyFileW
SetFileTime
WaitForMultipleObjects
GetPrivateProfileStringW
SearchPathW
GetFileAttributesW
GetFileSize
ReadFile
CreateEventW
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
FlushInstructionCache
GetCurrentProcess
RaiseException
GetCurrentThreadId
SetLastError
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
IsValidCodePage
GetOEMCP
LCMapStringA
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
InterlockedCompareExchange
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RtlUnwind
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetStdHandle
GetModuleFileNameA
HeapCreate
Sleep
ExitProcess
SetHandleCount

user32

UnregisterClassA
CallWindowProcW
DispatchMessageW
TranslateMessage
PostQuitMessage
RegisterClassExW
LoadCursorW
GetClassInfoExW
DefWindowProcW
KillTimer
SetTimer
DestroyWindow
CreateWindowExW
GetWindowLongW
SetWindowLongW
GetMessageW

advapi32

RegOpenKeyExW
RegNotifyChangeKeyValue

oleaut32

SysAllocString

shlwapi

PathFindFileNameW
PathUnExpandEnvStringsW
PathFileExistsW
StrCmpIW

Exports

Exports

CloseUninstallRegNotify
CreateBlockLog
CreateLocalCache
CreateUninstallRegNotify
FillBlockRecord
FillCacheLog
FreeBlockLog
FreeLocalCache
GenExtInfo
GenExtInfoEx
GetSoftsCount
GetSoftsCountEx
GetSoftsCountEx2
HandleBlockRecord
HandleSoftAdd
MatchWatchDirectory
OutputCacheLog
OutputCacheLog2
QueryCreateProcessInfo
QueryLineRule
StartRegNotifyQuery
WaitRegNotifyResult

Sections

.text
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SoftMgr/Resource.dll
.dll windows:5 windows x86 arch:x86

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ed:a2:6c:f4:3c:fb:a1:d6:8b:be:de:8e:39:8f:de:36:51:dd:5f:c4
Signer

Actual PE Digest

ed:a2:6c:f4:3c:fb:a1:d6:8b:be:de:8e:39:8f:de:36:51:dd:5f:c4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\building\360project\Anti-Install\trunk\build\x86\Resource.pdb

Sections

.text
Size: 512B - Virtual size: 5B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 117B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SoftMgr/somkernl.dll
.dll windows:5 windows x86 arch:x86

30725007bfa40950a65c48fa6ee8dee6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e1:3c:f7:dc:f3:f6:da:f5:32:91:2d:4e:8a:9b:4f:e0:49:66:e1:e7:6f:75:86:f6:25:20:95:36:c6:b6:22:37
Signer

Actual PE Digest

e1:3c:f7:dc:f3:f6:da:f5:32:91:2d:4e:8a:9b:4f:e0:49:66:e1:e7:6f:75:86:f6:25:20:95:36:c6:b6:22:37

Digest Algorithm

sha256

PE Digest Matches

true

82:13:42:43:c9:0f:7e:79:2f:93:dc:73:94:91:86:0f:73:21:fa:74
Signer

Actual PE Digest

82:13:42:43:c9:0f:7e:79:2f:93:dc:73:94:91:86:0f:73:21:fa:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\115693\out\Release\somkernl.pdb

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GlobalReAlloc
GlobalSize
LocalAlloc
LocalFree
GetVersion
ReadProcessMemory
GetExitCodeProcess
GetFullPathNameW
SearchPathW
Thread32First
Thread32Next
CreateJobObjectW
AssignProcessToJobObject
ResumeThread
QueryInformationJobObject
FileTimeToSystemTime
GetNativeSystemInfo
GetModuleHandleExW
ReleaseSemaphore
CreateSemaphoreW
GetEnvironmentVariableW
lstrcmpW
GetComputerNameW
QueryDosDeviceW
VerSetConditionMask
VerifyVersionInfoW
GetSystemInfo
FlushInstructionCache
OpenFileMappingW
DuplicateHandle
GetLogicalDrives
ExitProcess
VirtualQueryEx
VirtualProtectEx
VirtualAllocEx
WriteProcessMemory
GetFullPathNameA
HeapReAlloc
CreateFileA
QueryPerformanceCounter
UnlockFile
LockFile
UnlockFileEx
GetSystemTimeAsFileTime
FormatMessageA
FormatMessageW
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
FlushFileBuffers
HeapSize
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
GetDiskFreeSpaceA
OutputDebugStringA
GetVersionExA
GetTempPathA
AreFileApisANSI
DeleteFileA
VirtualQuery
VirtualProtect
DeviceIoControl
MapViewOfFileEx
VirtualFreeEx
CreateRemoteThread
lstrcpyW
lstrcmpA
ConnectNamedPipe
GetSystemDirectoryW
GetVolumeInformationW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SystemTimeToTzSpecificLocalTime
SetErrorMode
GetFileInformationByHandle
SetFileTime
GetStdHandle
CreateNamedPipeW
Process32NextW
Process32FirstW
GetDriveTypeA
SetEnvironmentVariableA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetModuleHandleA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetCurrentDirectoryA
PeekNamedPipe
GetConsoleMode
GetConsoleCP
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetStartupInfoA
GetFileType
SetHandleCount
GetTimeZoneInformation
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetACP
CompareStringA
CompareStringW
LCMapStringW
LCMapStringA
GetStringTypeW
GetCommandLineA
FileTimeToLocalFileTime
RtlUnwind
GetCPInfo
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocaleInfoA
TlsFree
DeleteAtom
FindAtomW
TlsAlloc
AddAtomW
GetAtomNameW
TlsSetValue
TlsGetValue
SetFilePointerEx
LocalFileTimeToFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
CreateToolhelp32Snapshot
CancelIo
InterlockedExchange
GetTempPathW
GetTempFileNameW
GetCommandLineW
GetLongPathNameW
GetWindowsDirectoryW
CreateProcessW
CreateWaitableTimerW
SetWaitableTimer
OpenProcess
lstrcmpiA
SetThreadLocale
GetThreadLocale
ExpandEnvironmentStringsW
CreateMutexW
ReleaseMutex
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
GetCurrentThreadId
GetFileAttributesW
InterlockedCompareExchange
SetLastError
FreeResource
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
OpenFile
ResetEvent
lstrcpynA
lstrcpynW
EnterCriticalSection
ReadFile
GetFileSize
GetVersionExW
SystemTimeToFileTime
GetLocalTime
WaitForMultipleObjects
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDriveStringsW
CreateEventW
TerminateProcess
GetFileAttributesExW
SetEvent
SuspendThread
GetCurrentProcess
WritePrivateProfileStringW
RemoveDirectoryW
FindClose
FindNextFileW
MoveFileW
FindFirstFileW
CopyFileW
MoveFileExW
GetSystemTime
DeleteFileW
SetFileAttributesW
CreateDirectoryW
CreateThread
lstrcmpiW
TerminateThread
MultiByteToWideChar
lstrlenA
lstrlenW
GetTickCount
GetPrivateProfileIntW
GetPrivateProfileStringW
OutputDebugStringW
GetExitCodeThread
WaitForSingleObject
WideCharToMultiByte
Sleep
WriteFile
GetLastError
GetFileSizeEx
CreateFileW
SetFilePointer
MapViewOfFile
CreateFileMappingW
SetEndOfFile
CloseHandle
UnmapViewOfFile
FlushViewOfFile
RaiseException
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
InterlockedDecrement
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
InterlockedIncrement
LoadLibraryExW
GetCurrentProcessId
GetProcAddress
LoadLibraryW
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
OpenThread

user32

SendMessageW
MessageBoxW
DispatchMessageW
TranslateMessage
GetMessageW
PostMessageW
SendMessageTimeoutW
UnregisterClassA
FindWindowW
IsWindow
GetIconInfo
GetDC
ReleaseDC
MsgWaitForMultipleObjects
GetDesktopWindow
CallWindowProcW
GetClassInfoExW
PeekMessageW
PrivateExtractIconsW
DestroyIcon
RegisterWindowMessageW
PostThreadMessageW
SetWindowPos
CharNextA
CharNextW
wsprintfW
SetTimer
KillTimer
RegisterClassExW
CreateWindowExW
SetWindowLongW
ShowWindow
DestroyWindow
GetWindowLongW
DefWindowProcW
GetWindow
GetWindowTextW
GetClassNameW
GetWindowThreadProcessId
GetForegroundWindow
AttachThreadInput
SetForegroundWindow
BringWindowToTop
SetActiveWindow
GetWindowRect
GetDlgCtrlID
GetParent
IsWindowEnabled
IsWindowVisible
SetCursorPos
SetRectEmpty
PtInRect
PostQuitMessage
GetActiveWindow
GetSystemMetrics
EnumWindows
FindWindowExW
WaitForInputIdle
LoadIconW
LoadCursorW
RegisterClassW
GetUserObjectInformationW
GetThreadDesktop
CloseDesktop
CreateDesktopW
EnumThreadWindows
LoadImageW
CreateIconIndirect
SetRect
SetCursor
PrintWindow
IsRectEmpty
GetClientRect
GetGUIThreadInfo

gdi32

CreateHalftonePalette
GetPaletteEntries
GdiFlush
StretchBlt
SetStretchBltMode
CreatePalette
CreateCompatibleBitmap
SetDIBColorTable
RealizePalette
SelectPalette
GetStockObject
GetDeviceCaps
GetBitmapBits
DeleteDC
GetDIBColorTable
SelectObject
CreateCompatibleDC
SetBitmapBits
GetObjectW
CreateDIBSection
DeleteObject
GetDIBits
GetTextExtentPoint32W
CreateFontIndirectW
SetTextColor
SetBkMode
CreateDCW
TextOutW
BitBlt

advapi32

ConvertSidToStringSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
LookupAccountNameW
QueryServiceConfigW
CloseServiceHandle
DeleteService
ControlService
OpenServiceW
OpenSCManagerW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
GetUserNameW
RegDeleteValueW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueW
RegCreateKeyW
SetNamedSecurityInfoW
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExA
RegQueryValueExA
AccessCheck
MapGenericMask
DuplicateToken
GetFileSecurityW
RegOpenKeyExA

shell32

SHOpenFolderAndSelectItems
ord190
SHFileOperationW
SHGetPathFromIDListW
ord155
SHGetDiskFreeSpaceExW
ord165
SHGetFolderPathW
ShellExecuteW
SHGetSpecialFolderLocation
SHCreateDirectoryExW
ord43
SHGetFileInfoW
ExtractIconW
ShellExecuteExW
SHGetSpecialFolderPathW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoInitializeEx
CreateBindCtx
CoTaskMemAlloc
CLSIDFromString
CoUninitialize
CreateStreamOnHGlobal
StringFromCLSID
CoGetObject
StringFromGUID2
OleRun
CoCreateGuid

oleaut32

VariantCopy
SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
VariantChangeType
VariantTimeToSystemTime
VariantInit
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
SystemTimeToVariantTime
VariantClear
GetErrorInfo

shlwapi

StrDupW
StrCpyNW
ord176
PathIsPrefixW
SHGetValueA
PathFileExistsW
PathFindFileNameW
PathCombineW
PathRemoveFileSpecW
PathAddBackslashW
PathAppendW
StrStrIW
SHGetValueW
SHSetValueW
PathIsDirectoryW
PathIsRootW
PathBuildRootW
PathFindExtensionW
PathGetDriveNumberW
StrCmpNIW
StrRStrIW
StrStrW
StrCmpW
PathRemoveBackslashW
StrChrW
StrCmpIW
SHDeleteValueW
SHDeleteKeyW
PathIsDirectoryEmptyW
PathCommonPrefixW
PathCanonicalizeW
StrCSpnIW
PathRemoveExtensionW
StrToIntW
PathCanonicalizeA
PathFindNextComponentA
PathStripPathW
SHSetValueA

msimg32

AlphaBlend

urlmon

URLDownloadToFileW
CreateURLMoniker
RegisterBindStatusCallback

iphlpapi

GetAdaptersInfo
GetIpAddrTable

dbghelp

MakeSureDirectoryPathExists
ImageDirectoryEntryToData

setupapi

SetupIterateCabinetW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

gdiplus

GdipBitmapUnlockBits
GdipBitmapLockBits
GdiplusStartup
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipFree
GdiplusShutdown
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipAlloc

psapi

EnumProcessModules
GetModuleBaseNameW
EnumProcesses
GetModuleFileNameExW

msi

ord70

crypt32

CryptBinaryToStringW
CryptStringToBinaryA

netapi32

Netbios

Exports

Exports

CreateInstance
DllGetClassObject
SomInitWithFixedMod
SomPlugin
plugins

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 485KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 174KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SoftMgr/sqlite3.dll
.dll windows:4 windows x86 arch:x86

5d395c395b41bc408f171b0d282caf1d

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f3:1f:c2:65:1d:c1:af:b4:48:fc:55:a8:b5:0a:ac:cc:3e:e9:c8:05
Signer

Actual PE Digest

f3:1f:c2:65:1d:c1:af:b4:48:fc:55:a8:b5:0a:ac:cc:3e:e9:c8:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
InitializeCriticalSection
InterlockedCompareExchange
DeleteCriticalSection
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
WideCharToMultiByte
MultiByteToWideChar
AreFileApisANSI
CloseHandle
ReadFile
GetLastError
SetFilePointer
WriteFile
SetEndOfFile
FlushFileBuffers
GetFileSize
UnlockFile
LockFile
LockFileEx
GetVersionExA
CreateFileA
CreateFileW
GetTempPathA
GetTempPathW
GetFileAttributesA
DeleteFileA
GetFileAttributesW
DeleteFileW
GetFullPathNameA
GetFullPathNameW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
LoadLibraryA
LoadLibraryW
LocalFree
FormatMessageA
FormatMessageW
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTime
GetSystemTimeAsFileTime
DisableThreadLibraryCalls

msvcrt

strncmp
localtime
atoi
_pctype
_isctype
__mb_cur_max
tolower
qsort
malloc
free
realloc
memmove
??3@YAXPAX@Z
??2@YAPAXI@Z
_initterm
_adjust_fdiv
__dllonexit
_onexit
_ftol

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_config
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_key
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_rekey
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_step
sqlite3_stmt_status
sqlite3_strnicmp
sqlite3_table_column_metadata
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_win32_mbcs_to_utf8

Sections

.text
Size: 332KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SoftMgr/themes/AI_theme.ui
.zip
Common/image/scrollv/background.png
.png
Common/image/scrollv/thumb.png
.png
Common/image/scrollv/thumbgripper.png
.png
Common/xml/CommonResource.xml
image/About.png
.png
image/BlockLog.png
.png
image/Btn.png
.png
image/BtnBlue.png
.png
image/BtnWhite.png
.png
image/Btn_2.png
.png
image/MainFrame.png
.png
image/MsgBox_Block.png
.png
image/MsgBox_NoFile.png
.png
image/MsgBox_QueryOpen.png
.png
image/Setting.png
.png
image/btn_close.png
.png
image/btn_open.png
.png
image/btn_search.png
.png
image/btn_support.png
.png
image/checkbox.png
.png
image/close.png
.png
image/icon_bbs.png
.png
image/icon_software36.png
.png
image/icon_support.png
.png
image/listcap.png
.png
image/logo48.png
.png
image/logo64.png
.png
image/logo_sd.png
.png
image/menu.png
.png
image/min.png
.png
image/msg_info.png
.png
image/msg_search.png
.png
image/msg_warning.png
.png
image/msg_warnings.png
.png
image/num.png
.png
image/protect_count.png
.png
image/snail.png
.png
image/tips.png
.png
image/tips2.png
.png
image/window_shadow.png
.png
theme.xml
xml/About.xml
xml/About_id.h
xml/BlockLog.xml
xml/BlockLog_id.h
xml/MainFrame.xml
xml/MainFrame_id.h
xml/MsgBox_Block.xml
xml/MsgBox_BlockAV.xml
xml/MsgBox_BlockAV_id.h
xml/MsgBox_BlockM.xml
xml/MsgBox_BlockM_id.h
xml/MsgBox_Block_id.h
xml/MsgBox_NoFile.xml
xml/MsgBox_NoFile_id.h
xml/MsgBox_QueryOpen.xml
xml/MsgBox_QueryOpenM.xml
xml/MsgBox_QueryOpenM_id.h
xml/MsgBox_QueryOpen_id.h
xml/MsgBox_SoftAdd.xml
xml/MsgBox_SoftAdd_id.h
Tools/360AI.png
.png
Tools/360FirstAD.png
.png
Tools/360FirstAD_gray.png
.png
Tools/360QMachine.png
.png
Tools/360SandBox.png
.png
Tools/360SandBox_gray.png
.png
Tools/360SoftMgr.png
.png
Tools/360SoftMgr_gray.png
.png
Tools/360SysReset.png
.png
Tools/360SysReset_gray.png
.png
Tools/360UDisk.png
.png
Tools/360UDisk_gray.png
.png
Tools/360himmu.png
.png
Tools/360himmu_gray.png
.png
Tools/AutoRun.png
.png
Tools/FileGuard.png
.png
Tools/FileSmash.png
.png
Tools/FileSmash_gray.png
.png
Tools/LSPFix.png
.png
Tools/LSPFix_gray.png
.png
Tools/LeakFix.png
.png
Tools/PayInsure.png
.png
Tools/PayInsure_gray.png
.png
Tools/PopWndTracker.png
.png
Tools/ProcTree.png
.png
Tools/Relocate.png
.png
Tools/Repair.png
.png
Tools/RubbishClean.png
.png
Tools/RubbishClean_gray.png
.png
Tools/SuperScan.png
.png
Tools/SysDiagnosis.png
.png
Tools/SysDiagnosis_gray.png
.png
Tools/customscan.png
.png
Tools/mobilesafe.png
.png
Tools/mobilesafe_gray.png
.png
Tools/netfos.png
.png
Tools/office.png
.png
Tools/xpbackup.png
.png
Uninst.exe
.exe windows:5 windows x86 arch:x86

29dbc95811fe18ac7d6ee071da5ee784

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a2:b1:42:fd:2c:6c:17:da:42:7d:cf:9f:06:bf:01:60:c3:81:29:16:e6:e9:29:f3:7f:bb:85:e5:34:9b:17
Signer

Actual PE Digest

71:a2:b1:42:fd:2c:6c:17:da:42:7d:cf:9f:06:bf:01:60:c3:81:29:16:e6:e9:29:f3:7f:bb:85:e5:34:9b:17

Digest Algorithm

sha256

PE Digest Matches

true

3d:c9:80:8b:41:80:f4:42:e3:16:4f:06:bd:19:88:99:e8:2d:6d:9c
Signer

Actual PE Digest

3d:c9:80:8b:41:80:f4:42:e3:16:4f:06:bd:19:88:99:e8:2d:6d:9c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\103634\out\Release\Uninst.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

GetVersion
QueryDosDeviceW
WideCharToMultiByte
AreFileApisANSI
ReadProcessMemory
Module32NextW
Module32FirstW
Process32NextW
Process32FirstW
WriteFile
GetPrivateProfileIntW
FindNextFileW
Sleep
InterlockedCompareExchange
CreateDirectoryW
CopyFileW
lstrlenA
InterlockedIncrement
DebugBreak
OutputDebugStringW
TlsSetValue
TlsGetValue
DeleteFileW
GetLongPathNameW
GetModuleFileNameW
GetTempPathW
GetACP
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesExW
GetFileAttributesW
ExpandEnvironmentStringsW
GetCommandLineW
lstrcmpW
CreateMutexW
TerminateProcess
MoveFileW
MoveFileExW
GetPrivateProfileSectionW
GetTimeZoneInformation
SetFilePointer
DeviceIoControl
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetShortPathNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
InterlockedExchange
CreateThread
RaiseException
lstrcpyW
FlushInstructionCache
CompareStringW
lstrcmpiW
GetCurrentThreadId
SizeofResource
LoadResource
FindResourceW
SetLastError
LoadLibraryExW
GetCurrentProcessId
CompareStringA
SetEndOfFile
WriteConsoleW
MultiByteToWideChar
WriteConsoleA
FlushFileBuffers
SetStdHandle
CreateFileA
GetLocaleInfoW
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
HeapSize
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapReAlloc
FatalAppExitA
HeapDestroy
HeapCreate
GetCurrentThread
TlsAlloc
IsValidCodePage
GetOEMCP
GetCPInfo
GetStartupInfoW
ExitThread
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
LocalFileTimeToFileTime
ProcessIdToSessionId
SetFilePointerEx
GetFileSizeEx
FormatMessageW
GetLocalTime
InterlockedDecrement
GetLogicalDriveStringsW
LocalFree
GetSystemTime
GetAtomNameW
GetDriveTypeW
GetDiskFreeSpaceExW
lstrlenW
GetPrivateProfileStringW
WritePrivateProfileSectionW
AddAtomW
FindAtomW
DeleteAtom
LockResource
FreeResource
WritePrivateProfileStringW
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
CreateMutexA
GetLastError
GetModuleHandleW
OpenProcess
SetEnvironmentVariableW
FileTimeToSystemTime
SystemTimeToFileTime
GlobalMemoryStatus
ResumeThread
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
Thread32Next
FindFirstFileW
FindClose
GetConsoleOutputCP
ReleaseMutex
FreeLibrary
TlsFree
CreateFileW
GetFileSize
ReadFile
CloseHandle
GetVersionExW
GetWindowsDirectoryW
LoadLibraryW
GetTickCount
GetSystemDirectoryW
SetEnvironmentVariableA

user32

FillRect
SetCursor
GetSysColor
BeginPaint
UnregisterClassA
EndPaint
ClientToScreen
GetWindowRgn
MoveWindow
RegisterClassExW
LoadCursorW
GetCursorPos
CallWindowProcW
GetDlgCtrlID
SetCapture
IsWindowEnabled
UpdateWindow
GetCapture
ReleaseCapture
PtInRect
CreateDialogParamW
SetRectEmpty
DestroyCursor
DefWindowProcW
PeekMessageW
GetMessageW
DispatchMessageW
LoadImageW
GetClassNameW
CreateCursor
OffsetRect
ExitWindowsEx
PostQuitMessage
DrawTextW
GetWindow
MapWindowPoints
AdjustWindowRectEx
IsDialogMessageW
GetDlgItem
GetParent
ChildWindowFromPoint
SetDlgItemTextW
SetFocus
EnableWindow
KillTimer
SetTimer
InvalidateRect
ReleaseDC
GetWindowDC
GetDC
ScreenToClient
GetMenu
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetWindowLongW
CreateWindowExW
SetWindowLongW
SendMessageW
DestroyWindow
GetClientRect
IsWindow
PostMessageW
MessageBoxW
CharLowerBuffW
EnumThreadWindows
CharNextW
CharLowerW
ShowWindow
WaitForInputIdle
LoadStringW
FindWindowW
SendMessageTimeoutW
GetWindowRect
BringWindowToTop
SetForegroundWindow
SwitchToThisWindow
SetWindowPos
SystemParametersInfoW
GetSystemMetrics
WindowFromPoint
wvsprintfW
TranslateMessage

gdi32

DeleteObject
GetObjectW
SetTextColor
SetBkMode
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
StretchBlt
DeleteDC
CreateFontIndirectW
PtInRegion
CreateRectRgn
CreateDIBSection
GetStockObject
SetStretchBltMode

advapi32

AdjustTokenPrivileges
GetUserNameW
RegQueryValueExA
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
FreeSid
IsValidSid
EqualSid
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
LookupPrivilegeValueW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegQueryValueExW

shell32

SHGetSpecialFolderLocation
SHChangeNotify
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetFolderPathW
SHFileOperationW
SHGetPathFromIDListW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc

oleaut32

VarUI4FromStr
SysAllocString
SysFreeString

shlwapi

PathAddBackslashW
PathRemoveFileSpecW
StrCmpNIW
SHDeleteKeyW
SHDeleteValueW
StrCmpNW
PathIsDirectoryW
SHSetValueW
SHGetValueW
PathFileExistsW
PathFindFileNameW
PathCombineW
PathAppendW
StrStrIW

comctl32

_TrackMouseEvent
ImageList_Destroy
InitCommonControlsEx
ImageList_GetIconSize

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW

msimg32

AlphaBlend

Sections

.text
Size: 550KB - Virtual size: 550KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Uninst.xml
UpFltr.def
UpTip.dat
UpTip.exe
.exe windows:5 windows x86 arch:x86

3aab699a84061e0f8495480c1d8d7c0a

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:66:45:ef:02:3a:6d:e8:9f:5c:d8:04:37:85:fd:96:89:90:dd:79:15:c7:a0:b8:67:d4:56:d4:fc:e4:76:56
Signer

Actual PE Digest

5f:66:45:ef:02:3a:6d:e8:9f:5c:d8:04:37:85:fd:96:89:90:dd:79:15:c7:a0:b8:67:d4:56:d4:fc:e4:76:56

Digest Algorithm

sha256

PE Digest Matches

true

a5:50:d9:ba:ee:8d:82:91:dc:94:ab:30:19:93:f8:77:9b:ef:0f:31
Signer

Actual PE Digest

a5:50:d9:ba:ee:8d:82:91:dc:94:ab:30:19:93:f8:77:9b:ef:0f:31

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\292268\out\Release\UpTip.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

GetModuleHandleW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
CreateProcessW
OutputDebugStringW
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
Sleep
WaitForSingleObject
SetCurrentDirectoryW
GetPrivateProfileIntW
GetWindowsDirectoryW
GetPrivateProfileStringW
ReleaseMutex
CreateMutexA
GetLocalTime
RaiseException
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
lstrlenW
lstrcmpiW
SetLastError
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
SystemTimeToFileTime
SetEnvironmentVariableA
CompareStringW
GetModuleFileNameW
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
WideCharToMultiByte
LCMapStringA
InitializeCriticalSectionAndSpinCount
InterlockedExchange
SetConsoleCtrlHandler
GetModuleHandleA
IsValidCodePage
LoadLibraryExW
GetLastError
LoadLibraryW
GetCurrentProcessId
DeviceIoControl
CreateFileW
GetFileSizeEx
GetFileSize
CloseHandle
ReadFile
GetOEMCP
GetACP
GetCPInfo
FatalAppExitA
SetFilePointer
HeapWalk
HeapLock
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
HeapCreate
GetCurrentThread
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
LocalFileTimeToFileTime
SetEndOfFile
OpenThread
HeapUnlock
CreateMutexW
SetFilePointerEx
CompareStringA
GetStartupInfoW
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW

user32

UnregisterClassA
CallWindowProcW
CreateWindowExW
RegisterClassExW
CharNextW
DefWindowProcW
PeekMessageW
DestroyWindow
TranslateMessage
DispatchMessageW
LoadCursorW
GetClassInfoExW
GetParent
GetWindow
SystemParametersInfoW
GetClientRect
MapWindowPoints
ShowWindow
FindWindowW
SendMessageTimeoutW
PostQuitMessage
GetWindowLongW
SetWindowLongW
SetWindowPos
KillTimer
SetTimer
RedrawWindow
GetWindowRect
GetMessageW

advapi32

RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExA
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteValueW
RegCloseKey

ole32

CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc

oleaut32

CreateErrorInfo
VariantChangeType
GetErrorInfo
SysAllocString
SysFreeString
VarUI4FromStr
DispCallFunc
VariantClear
VariantInit
SetErrorInfo

shlwapi

PathAppendW
SHGetValueA
SHSetValueA
PathFileExistsW
StrStrIW

comctl32

InitCommonControlsEx

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

Sections

.text
Size: 297KB - Virtual size: 296KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Win32FuncLoader.exe
.exe windows:5 windows x86 arch:x86

e4c12064b46ae2d8151e3f25d17fd2f7

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c4:bd:cb:b2:c4:22:4e:76:0f:21:43:a8:ec:7e:ae:36:eb:48:b7:06
Signer

Actual PE Digest

c4:bd:cb:b2:c4:22:4e:76:0f:21:43:a8:ec:7e:ae:36:eb:48:b7:06

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\building\360project\360sd\branches\beta\Build\x86\Win32FuncLoader.pdb

Imports

kernel32

FindResourceW
FindResourceExW
GetModuleFileNameW
LoadLibraryW
GetProcAddress
ReleaseMutex
CloseHandle
CreateMutexA
GetLastError
FreeLibrary
WaitForMultipleObjects
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
CreateFileW
WriteFile
GetFileSize
ReadFile
GetLogicalDriveStringsW
GetDriveTypeW
GetDiskFreeSpaceExW
CreateEventW
ResetEvent
InterlockedExchange
SetFilePointer
DeviceIoControl
GetCurrentProcessId
GetModuleHandleW
InitializeCriticalSection
LoadResource
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
FindAtomW
AddAtomW
OpenThread
GetAtomNameW
WaitForSingleObject
CreateMutexW
GetSystemTime
LocalFree
FormatMessageW
OutputDebugStringW
GetFileSizeEx
LockResource
SizeofResource
ExpandEnvironmentStringsW
DeleteAtom
SetFilePointerEx
LocalFileTimeToFileTime
SystemTimeToFileTime
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetConsoleMode
DeleteCriticalSection
GetCurrentProcess
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
TerminateProcess
GetModuleHandleA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
ResumeThread
CreateThread
GetStartupInfoW
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
Sleep
ExitProcess
HeapCreate
VirtualFree
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
RtlUnwind
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LoadLibraryA
GetLocaleInfoW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
LCMapStringA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
GetConsoleCP

user32

CreateWindowExW
PostMessageW
SendMessageW
RegisterClassExW
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
SetTimer
PostQuitMessage
DestroyWindow

advapi32

RegEnumKeyExW
RegQueryValueExA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ole32

CoInitialize

oleaut32

SysFreeString
SysAllocStringLen
GetErrorInfo

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAppendW
StrStrIW
SHGetValueW

Sections

.text
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WscControl.exe
.exe windows:5 windows x86 arch:x86

f07ad637b4a1f2e242d1a53ef8c058fb

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:97:86:f4:ca:05:68:e4:0d:00:27:d1:3d:e0:c2:d3:5b:e9:cb:ff:be:c9:21:3e:2e:0a:a6:60:1d:cb:e6:30
Signer

Actual PE Digest

7e:97:86:f4:ca:05:68:e4:0d:00:27:d1:3d:e0:c2:d3:5b:e9:cb:ff:be:c9:21:3e:2e:0a:a6:60:1d:cb:e6:30

Digest Algorithm

sha256

PE Digest Matches

true

80:6c:fb:9b:10:67:40:6e:e3:ba:e1:71:30:ab:9d:fe:29:e1:b0:5f
Signer

Actual PE Digest

80:6c:fb:9b:10:67:40:6e:e3:ba:e1:71:30:ab:9d:fe:29:e1:b0:5f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\315308\out\Release\WscControl.pdb

Imports

kernel32

GetPrivateProfileStringW
GetVersionExW
GetProcAddress
GetModuleHandleW
GetVersion
DebugBreak
OutputDebugStringW
lstrlenA
OpenProcess
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcess
WritePrivateProfileStringW
GetModuleFileNameW
GetWindowsDirectoryW
GetLongPathNameW
RemoveDirectoryW
DeleteFileW
GetCurrentProcessId
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
ReadFile
GetLocaleInfoW
WriteConsoleW
MultiByteToWideChar
lstrlenW
GetModuleHandleA
InterlockedDecrement
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapFree
GetProcessHeap
GetLastError
RtlUnwind
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
FatalAppExitA
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
Sleep
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

user32

wvsprintfW
LoadStringW
CharNextW
SendMessageW
PostMessageW
FindWindowW
wsprintfW

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

shell32

ShellExecuteExW
SHGetFolderPathW

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeSecurity

oleaut32

CreateErrorInfo
SysStringByteLen
SetErrorInfo
VariantInit
VariantChangeType
GetErrorInfo
SysAllocStringByteLen
SysFreeString
SysAllocString
VariantClear
SysAllocStringLen

shlwapi

SHGetValueA
PathFileExistsW
wnsprintfW
SHGetValueW
PathCombineW
StrStrIA
PathAppendW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

GetModuleFileNameExW

Sections

.text
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
arfp.db
deepscan/360Quarant.dll
.dll windows:5 windows x86 arch:x86

fd90b2df0ac321d870c8165052cb672c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

db:cd:f0:da:38:ba:9e:77:9b:6b:64:f5:ba:a8:ad:12:c7:dd:f9:bf:69:dd:30:43:8e:c2:be:de:ca:92:a2:1f
Signer

Actual PE Digest

db:cd:f0:da:38:ba:9e:77:9b:6b:64:f5:ba:a8:ad:12:c7:dd:f9:bf:69:dd:30:43:8e:c2:be:de:ca:92:a2:1f

Digest Algorithm

sha256

PE Digest Matches

true

46:0d:5b:5d:cd:7e:b8:f7:36:73:28:f0:81:2a:8d:33:84:82:2a:84
Signer

Actual PE Digest

46:0d:5b:5d:cd:7e:b8:f7:36:73:28:f0:81:2a:8d:33:84:82:2a:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\358132\out\Release\360Quarant.pdb

Imports

kernel32

LocalFree
HeapAlloc
GetProcessHeap
HeapFree
GetDriveTypeW
GetDiskFreeSpaceExW
GetTickCount
GetSystemDirectoryW
GetWindowsDirectoryW
GetEnvironmentVariableW
RaiseException
InterlockedIncrement
InterlockedDecrement
GetFileSize
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetCurrentThread
SetFilePointer
OutputDebugStringW
GetPrivateProfileStringW
WritePrivateProfileStringW
IsBadReadPtr
MapViewOfFileEx
CreateFileMappingW
GetSystemInfo
SetFileTime
GetFileAttributesExW
MoveFileExW
SetFilePointerEx
WriteFile
ReadFile
GetFileSizeEx
FindNextFileW
FindFirstFileW
FindClose
GetCurrentProcessId
CloseHandle
DeviceIoControl
CreateFileW
LoadLibraryW
SystemTimeToFileTime
FileTimeToSystemTime
GetLocalTime
DeleteCriticalSection
InitializeCriticalSection
SetFileAttributesW
GetFileAttributesW
lstrlenA
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
CreateDirectoryW
GetLongPathNameW
GetVersionExW
GetCurrentProcess
GetModuleHandleW
WideCharToMultiByte
FindResourceExW
lstrlenW
RemoveDirectoryW
GetLastError
DeleteFileW
GetCurrentThreadId
InterlockedExchange
LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
FreeLibrary
GetProcAddress
SetLastError
GetModuleFileNameW
Sleep
InterlockedCompareExchange
lstrcmpiA
lstrcmpA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
LoadLibraryA
QueryPerformanceCounter
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringA
GetSystemWindowsDirectoryW
UnmapViewOfFile
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
HeapDestroy
HeapReAlloc
HeapSize
CreateFileA
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
TlsGetValue
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
TlsAlloc
TlsFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
VirtualQuery
GetCommandLineA
RtlUnwind
ExitProcess
HeapCreate
VirtualFree
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetModuleHandleA

advapi32

SetSecurityInfo
RegQueryValueExA
RegEnumKeyExW
RegEnumKeyExA
RegOpenKeyExA
GetSecurityInfo
SetThreadToken
ImpersonateSelf
OpenThreadToken
GetSecurityDescriptorControl
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
ConvertSecurityDescriptorToStringSecurityDescriptorW
AddAce
InitializeAcl
IsValidSid
GetLengthSid
CopySid
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
FreeSid
ConvertStringSidToSidW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
OpenProcessToken
GetUserNameW
GetAce
GetAclInformation
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
DeleteAce
GetExplicitEntriesFromAclW
LookupAccountNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
ImpersonateLoggedOnUser
RevertToSelf

shell32

SHGetSpecialFolderPathW

ole32

CoCreateInstance
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
OleSaveToStream
WriteClassStm
OleLoadFromStream

oleaut32

SysAllocStringByteLen
SysFreeString
SysAllocString
SysStringLen
SysAllocStringLen
VariantCopy
VariantClear
VariantInit
SysStringByteLen
VarBstrCmp
VariantChangeType

shlwapi

StrStrIW
PathFindFileNameW
SHSetValueW
SHGetValueW
StrCmpIW
PathCombineW
PathAppendW
PathRemoveBackslashW
PathIsDirectoryW
StrChrW
PathRemoveFileSpecW
StrStrW
StrRChrW
SHSetValueA
SHGetValueA
PathFileExistsW

version

VerQueryValueW

userenv

UnloadUserProfile

netapi32

Netbios

Exports

Exports

CreateQuarantObject
GetSectionItemCount
Uninstall360SafeQuarant
UninstallQuarantItem

Sections

.text
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/360QuarantPlugin.dll
.dll windows:5 windows x86 arch:x86

ceabc757da67a43689cd041d12c5737b

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e2:06:5e:84:58:6a:15:52:fb:83:d5:21:6f:fd:4e:bf:fa:5d:5b:b4:c5:a4:54:db:b3:60:ca:44:dc:4f:ec:c1
Signer

Actual PE Digest

e2:06:5e:84:58:6a:15:52:fb:83:d5:21:6f:fd:4e:bf:fa:5d:5b:b4:c5:a4:54:db:b3:60:ca:44:dc:4f:ec:c1

Digest Algorithm

sha256

PE Digest Matches

true

2a:27:b4:d7:a7:b3:47:54:7f:9c:d1:ca:c3:7d:c5:cb:08:65:5e:47
Signer

Actual PE Digest

2a:27:b4:d7:a7:b3:47:54:7f:9c:d1:ca:c3:7d:c5:cb:08:65:5e:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\281045\out\Release\360QuarantPlugin.pdb

Imports

kernel32

GetSystemInfo
CreateMutexW
WaitForSingleObject
GetCurrentThread
lstrlenW
lstrlenA
MultiByteToWideChar
GetVersionExW
SetFilePointer
OutputDebugStringW
SetFilePointerEx
WriteFile
ReadFile
GetFileSizeEx
GetTickCount
HeapFree
GetProcessHeap
HeapAlloc
InterlockedDecrement
InterlockedIncrement
RaiseException
LocalFree
GetCurrentProcess
GetCurrentProcessId
CloseHandle
DeleteCriticalSection
DeviceIoControl
EnterCriticalSection
CreateFileW
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleW
GetLastError
LoadLibraryW
WideCharToMultiByte
FindResourceExW
GetCurrentThreadId
InterlockedExchange
LoadLibraryExW
FindResourceW
FreeLibrary
SizeofResource
LoadResource
LockResource
FreeResource
GetProcAddress
SetLastError
GetModuleFileNameW
Sleep
InterlockedCompareExchange
ReleaseMutex
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
QueryPerformanceCounter
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
HeapDestroy
HeapReAlloc
HeapSize
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
TlsGetValue
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
TlsAlloc
TlsFree
VirtualProtect
VirtualAlloc
VirtualQuery
GetCommandLineA
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
HeapCreate
VirtualFree
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetModuleHandleA

advapi32

GetSecurityDescriptorLength
SetSecurityInfo
GetSecurityInfo
SetThreadToken
ImpersonateSelf
OpenThreadToken
GetSecurityDescriptorControl
MakeSelfRelativeSD
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
ConvertSecurityDescriptorToStringSecurityDescriptorW
AddAce
InitializeAcl
IsValidSid
GetLengthSid
CopySid
RevertToSelf
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetUserNameW
GetAce
GetAclInformation
SetNamedSecurityInfoW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
DeleteAce
GetExplicitEntriesFromAclW
LookupAccountNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
FreeSid
SetEntriesInAclW
ConvertStringSidToSidW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExA

ole32

CoCreateInstance
CoInitialize
WriteClassStm
CoUninitialize
OleLoadFromStream
OleSaveToStream

oleaut32

VariantClear
VariantCopy
SysFreeString
VariantInit
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VariantChangeType

shlwapi

StrCmpIW
PathFileExistsW
SHGetValueW
StrStrIW
PathAppendW

version

VerQueryValueW

userenv

UnloadUserProfile

Exports

Exports

CreateQuarantObject
CreateQuarantObjectFactory

Sections

.text
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/360netcfg.exe
.exe windows:5 windows x86 arch:x86

00fe7c14f2917445e2f4a192b35e12ec

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c5:6d:ea:c0:ed:f9:3f:1f:a9:1c:eb:ab:8f:95:47:f7:7f:ed:92:25
Signer

Actual PE Digest

c5:6d:ea:c0:ed:f9:3f:1f:a9:1c:eb:ab:8f:95:47:f7:7f:ed:92:25

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\build\360netcfg\Release\360netcfg.pdb

Imports

kernel32

Sleep
InterlockedCompareExchange
OpenProcess
GetCurrentThread
LocalFree
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResumeThread
VirtualQuery
DeviceIoControl
VirtualAlloc
GetCurrentThreadId
FlushInstructionCache
SetThreadContext
GetThreadContext
SuspendThread
SetFilePointer
LoadLibraryA
WaitForMultipleObjects
CreateEventW
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
GetVersionExW
GetCurrentProcessId
GetCurrentProcess
GetModuleHandleW
LoadLibraryW
GetProcAddress
FreeLibrary
SetLastError
SetUnhandledExceptionFilter
GetCommandLineW
CreateFileW
GetFileSize
ReadFile
WriteFile
WritePrivateProfileSectionW
MoveFileW
GetModuleFileNameW
DeleteFileW
GetPrivateProfileStringW
FindFirstFileW
WritePrivateProfileStringW
CopyFileW
FindNextFileW
FindClose
SetCurrentDirectoryW
lstrlenA
OutputDebugStringW
DebugBreak
InterlockedIncrement
OpenEventW
SetEvent
CloseHandle
GetLastError
lstrlenW
InterlockedDecrement
VirtualProtect
ExitProcess
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
HeapSize
LCMapStringW
WideCharToMultiByte
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
RaiseException
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
GetFileSizeEx
MultiByteToWideChar
GetSystemTime
CreateMutexW
TlsGetValue
HeapAlloc
HeapFree
WaitForSingleObject
GetProcessHeap
TlsSetValue
GetAtomNameW
OpenThread
AddAtomW
ReleaseMutex
TlsAlloc
FindAtomW
DeleteAtom
TlsFree
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
HeapReAlloc
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW

user32

CharUpperW
wvsprintfW
LoadStringW
CharNextW

advapi32

RegSetValueW
RegQueryValueW
RegQueryValueA
RegOpenKeyW
RegOpenKeyA
RegCreateKeyW
RegCreateKeyA
RegFlushKey
RegSetValueExW
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumValueW
RegEnumValueA
RegEnumKeyExW
RegEnumKeyExA
RegEnumKeyW
RegEnumKeyA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
ControlService
DeleteService
RegSetValueA

shell32

CommandLineToArgvW

ole32

CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CoUninitialize

shlwapi

StrRChrW
StrStrIW
StrCmpIW
PathRemoveFileSpecW
PathAppendW
PathCombineW
PathFileExistsW
PathAddBackslashW
SHDeleteKeyW
SHGetValueW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

GetModuleFileNameExW

setupapi

SetupCopyOEMInfW

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
deepscan/BAPI.dll
.dll regsvr32 windows:5 windows x86 arch:x86

99e6f3f7a70954de2560de3e85c617ce

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:b4:53:f3:df:22:1b:df:19:5c:dd:24:53:de:6b:0e:b1:3b:32:1a:5e:33:89:5a:13:9e:12:8d:9c:8e:c4:0b
Signer

Actual PE Digest

07:b4:53:f3:df:22:1b:df:19:5c:dd:24:53:de:6b:0e:b1:3b:32:1a:5e:33:89:5a:13:9e:12:8d:9c:8e:c4:0b

Digest Algorithm

sha256

PE Digest Matches

true

0f:b7:18:f6:a4:2e:7f:54:25:ed:48:f6:ae:93:f9:c5:35:4e:7f:76
Signer

Actual PE Digest

0f:b7:18:f6:a4:2e:7f:54:25:ed:48:f6:ae:93:f9:c5:35:4e:7f:76

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\301715\out\Release\BAPI.pdb

Imports

kernel32

GetTickCount
TerminateThread
ExitThread
ReleaseMutex
CreateThread
FreeLibrary
MoveFileExW
OpenProcess
LoadLibraryW
CopyFileW
GetVersionExW
GetFileAttributesW
DefineDosDeviceW
DeviceIoControl
DeleteFileW
GetCurrentProcessId
SetFileAttributesW
GetCurrentProcess
VirtualFreeEx
VirtualAllocEx
UnlockFile
LockFile
LocalFree
ReadFile
CreateFileA
SearchPathW
FindFirstFileW
GetFileAttributesExA
GetFileAttributesA
GetShortPathNameA
FindFirstFileA
GetLongPathNameA
RemoveDirectoryA
CopyFileA
SearchPathA
SetFileAttributesA
FindClose
RemoveDirectoryW
FindNextFileA
FindNextFileW
GetFileAttributesExW
DeleteFileA
EnterCriticalSection
LeaveCriticalSection
GetShortPathNameW
GetLongPathNameW
GetCurrentDirectoryW
GetLastError
MultiByteToWideChar
GetModuleFileNameW
IsDBCSLeadByte
WideCharToMultiByte
GetSystemDirectoryW
GetSystemWindowsDirectoryW
SetErrorMode
GetEnvironmentVariableW
GetFullPathNameW
TlsFree
GetWindowsDirectoryW
CloseHandle
TlsAlloc
DeleteCriticalSection
GetProcAddress
SetLastError
CreateFileW
TlsSetValue
InitializeCriticalSection
GetProcessHeap
WaitForSingleObject
GetModuleHandleW
TlsGetValue
DeleteAtom
FindAtomW
AddAtomW
OpenThread
GetAtomNameW
GetSystemTime
FormatMessageW
OutputDebugStringW
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
SystemTimeToFileTime
FlushFileBuffers
GetLocaleInfoA
CreateMutexW
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LoadLibraryA
RtlUnwind
InitializeCriticalSectionAndSpinCount
RaiseException
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
SetFilePointer
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
Sleep
HeapReAlloc
VirtualAlloc
VirtualFree
HeapDestroy
GetCurrentThread
GetModuleHandleA
HeapCreate
IsDebuggerPresent
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

advapi32

RegEnumKeyExW
RegQueryValueExA
BuildExplicitAccessWithNameW
RevertToSelf
SetEntriesInAclW
GetNamedSecurityInfoW
ImpersonateLoggedOnUser
SetNamedSecurityInfoW
LookupAccountNameW
AccessCheck
GetExplicitEntriesFromAclW
DeleteAce
GetUserNameW
OpenThreadToken
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
RegDeleteValueW
StartServiceW
LookupPrivilegeValueW
RegQueryValueExW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
DeleteService
OpenProcessToken
CloseServiceHandle
CreateServiceW

oleaut32

SysFreeString
SysAllocString

ntdll

RtlInitString
_vsnwprintf
NtCreateSection
NtUnmapViewOfSection
NtMapViewOfSection
NtAllocateVirtualMemory
NtFreeVirtualMemory
RtlCompareString
_snwprintf
RtlNtStatusToDosError
wcschr
RtlFreeAnsiString
wcsrchr
wcsncpy
RtlDosPathNameToNtPathName_U
RtlInitializeCriticalSection
RtlUpcaseUnicodeChar
wcsncmp
RtlCopyUnicodeString
RtlLeaveCriticalSection
RtlDeleteCriticalSection
RtlAllocateHeap
RtlAppendUnicodeStringToString
NtCreateFile
RtlPrefixUnicodeString
RtlOemStringToUnicodeString
RtlFreeUnicodeString
NtWaitForSingleObject
RtlEqualUnicodeString
RtlUnicodeStringToOemString
RtlUnicodeStringToAnsiString
RtlInitAnsiString
NtFsControlFile
RtlInitUnicodeString
RtlFreeHeap
NtDeviceIoControlFile
RtlAnsiStringToUnicodeString
RtlEnterCriticalSection
memmove
RtlIsDosDeviceName_U
_wcsicmp
RtlCompareMemory
_wcsnicmp
_vsnprintf

shlwapi

StrRChrW
PathFileExistsW
SHGetValueW
SHDeleteKeyW
PathFileExistsA
PathIsDirectoryA
PathIsDirectoryW
PathAppendW
PathIsRootW
StrCmpIW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

psapi

GetModuleFileNameExW
EnumProcessModules
EnumProcesses

netapi32

NetShareGetInfo

Exports

Exports

AcquireArCk01
AcquireArCk02
AcquireArDs01
AcquireArDs02
AcquireArDs03
AcquireArDs04
AcquireArDs05
AcquireArLd01
AcquireArLd03
AcquireArMk01
AcquireArUf01
AcquireArUf02
AcquireArUf03
AcquireDispatch
AcquireMiniportStartIo
AcquireService
AcquireStartIoHook
BRegCloseKey
BRegCreateKey
BRegCreateKeyEx
BRegCreateKeyExW
BRegCreateKeyW
BRegDeleteKey
BRegDeleteKeyEx
BRegDeleteKeyExW
BRegDeleteKeyW
BRegDeleteValue
BRegDeleteValueW
BRegEnumKey
BRegEnumKeyEx
BRegEnumKeyExW
BRegEnumKeyW
BRegEnumValue
BRegEnumValueW
BRegOpenKey
BRegOpenKeyEx
BRegOpenKeyExW
BRegOpenKeyW
BRegQueryValueEx
BRegQueryValueExW
BRegSetValueEx
BRegSetValueExW
BapiCreateToolhelp32Snapshot
BapiDriver32First
BapiDriver32Next
BapiModule32First
BapiModule32Next
BapiProcess32First
BapiProcess32Next
BfsSetFileApisToANSI
BfsSetFileApisToOEM
DllRegisterServer
DriverVersion
DsFileUnlock
DsGetFileLockType
DsSetTargetAccess
EnumerateFilterDriver
ExpandFilePath
ExpandFilePathW
FSCloseHandle
FSCopyFile
FSCopyFileW
FSCreateFile
FSCreateFileW
FSDeleteFile
FSDeleteFileW
FSFindClose
FSFindFirstFile
FSFindFirstFileW
FSFindNextFile
FSFindNextFileW
FSGetFileAttributes
FSGetFileAttributesEx
FSGetFileAttributesExW
FSGetFileAttributesW
FSGetFileSize
FSGetFileSizeEx
FSGetLongPathName
FSGetLongPathNameW
FSGetShortPathName
FSGetShortPathNameW
FSMoveFileA
FSMoveFileExA
FSMoveFileExW
FSMoveFileW
FSPathFileExists
FSPathFileExistsW
FSPathIsDirectory
FSPathIsDirectoryW
FSReadFile
FSRemoveDirectory
FSRemoveDirectoryW
FSSearchPath
FSSearchPathW
FSSetFileAttributes
FSSetFileAttributesW
FSSetFilePointer
FSSetFilePointerEx
FSTurnOffRedirection
FSUnlockAll
FSWriteFile
FsForceKill
FsSearchPathExW
InitEngine
InitRegEngine
Install
IsConnect
JudgeVersion
ModuleDump
ModuleInformation
QueryFileLock
QueryFileLockEx
RemoveFilterDriver
RestoreArCk01
RestoreArCk02
RestoreArDs01
RestoreArDs02
RestoreArDs03
RestoreArDs04
RestoreArDs05
RestoreArLd01
RestoreArLd02
RestoreArLd03
RestoreArMk01
RestoreArUf01
RestoreArUf02
RestoreArUf03
RestoreDispatch
RestoreService
RestoreStartIoHook
SetBapiWorkingMode
SetDllBase
SetupInstall
UninitEngine
UninitRegEngine
Uninstall
UnregisterShutdown

Sections

.text
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/CQhCltHttpW.dll
.dll windows:5 windows x86 arch:x86

bbb8a93e831f1e8cf13293fa1213976e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cf:a1:13:f2:bd:72:34:14:99:9e:fa:aa:c6:c1:78:2c:66:b5:e6:1d:19:5d:22:8d:39:b9:5b:a1:9b:58:1c:e2
Signer

Actual PE Digest

cf:a1:13:f2:bd:72:34:14:99:9e:fa:aa:c6:c1:78:2c:66:b5:e6:1d:19:5d:22:8d:39:b9:5b:a1:9b:58:1c:e2

Digest Algorithm

sha256

PE Digest Matches

true

29:37:3d:9c:e0:1e:19:64:de:dc:f8:64:e5:a8:4a:6c:2f:91:95:b8
Signer

Actual PE Digest

29:37:3d:9c:e0:1e:19:64:de:dc:f8:64:e5:a8:4a:6c:2f:91:95:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\142475\out\Release\lib\CQhCltHttpW.pdb

Imports

kernel32

LoadLibraryW
FreeLibrary
GetModuleHandleW
GetProcAddress
Sleep
InterlockedCompareExchange
FindClose
SuspendThread
FreeLibraryAndExitThread
GetLastError
ReleaseMutex
ReleaseSemaphore
WaitForSingleObject
WaitForMultipleObjects
CreateEventW
CreateSemaphoreW
CreateMutexW
InterlockedIncrement
CreateWaitableTimerW
SetLastError
GetCurrentProcessId
SetEvent
CreateThread
GetFileAttributesExW
MoveFileExW
CopyFileW
GetModuleFileNameW
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateFileW
DeviceIoControl
GetTickCount
CloseHandle
InitializeCriticalSection
SetWaitableTimer
IsBadReadPtr
CreateMutexA
GetVersionExA
GetCurrentThreadId
GlobalFree
GlobalAlloc
GetModuleHandleA
GetCurrentProcess
GetSystemTimeAsFileTime
SystemTimeToFileTime
ResetEvent
CompareFileTime
GetSystemTime
MultiByteToWideChar
IsBadWritePtr
lstrlenA
ReadFile
WriteFile
GetFileAttributesW
GetFileSize
DeleteFileW
FindFirstFileW
RemoveDirectoryW
lstrlenW
lstrcpynA
GetVersionExW
FileTimeToSystemTime
LocalFileTimeToFileTime
GetACP
GetSystemWindowsDirectoryW
CreateFileA
SetEndOfFile
SetFilePointerEx
GetFileSizeEx
OutputDebugStringW
FormatMessageW
LocalFree
TlsGetValue
HeapAlloc
HeapFree
GetProcessHeap
TlsSetValue
GetAtomNameW
OpenThread
AddAtomW
TlsAlloc
FindAtomW
DeleteAtom
TlsFree
SetFilePointer
InterlockedExchange
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
ExitThread
HeapReAlloc
VirtualFree
VirtualAlloc
HeapCreate
HeapDestroy
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSize
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
WideCharToMultiByte

shlwapi

PathFileExistsW
PathCombineW
PathRemoveFileSpecW
PathAppendW
StrStrIA
PathIsDirectoryW
StrStrA
StrChrIA

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

iphlpapi

GetNetworkParams

winmm

timeGetTime

advapi32

RegOpenKeyW
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegEnumKeyExW
RegCloseKey

ws2_32

select

Exports

Exports

Init
UnInit
cancel_cqhcltdns_req
cancel_cqhclthttp_req
close_cqhcltdns_object
close_cqhclthttp_object
cqhcltdns_AsyncGetHostByName
cqhcltdns_QueryHostByName
cqhcltdns_SyncGetHostByName
cqhcltdns_SyncGetHostByNameEx
cqhclthttp_GetErrorMsg
cqhclthttp_GetErrorNo
cqhclthttp_GetOpt
cqhclthttp_GetToBuffer
cqhclthttp_GetToBuffer2
cqhclthttp_GetToFile
cqhclthttp_GetToFile2
cqhclthttp_IsNoContentLen
cqhclthttp_PostToBuffer
cqhclthttp_PostToBuffer2
cqhclthttp_PostToFile
cqhclthttp_PostToFile2
cqhclthttp_SetOpt
cqhclthttp_get_head_info
cqhclthttp_setLogParam
cqhclthttp_set_head_info
cqhclthttp_set_limit_byte
cqhclthttp_uploadlog
cqhctlhttp_GetCurrentMode
cqhctlhttp_GetIP
create_cqhcltdns_SetOpt
create_cqhcltdns_object
create_cqhclthttp_object
is_support_afd
set_cqhclthttp_mode
set_retry_count

Sections

.text
Size: 327KB - Virtual size: 326KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/CloudEngine.dll
.dll windows:5 windows x86 arch:x86

d91d1836d4bdbad40f436d5458a76251

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:af:47:0b:89:33:98:b3:43:d8:ba:56:ab:6f:74:db:53:11:0b:1a:7c:8a:5f:fe:3d:0d:d6:03:f2:16:83:71
Signer

Actual PE Digest

22:af:47:0b:89:33:98:b3:43:d8:ba:56:ab:6f:74:db:53:11:0b:1a:7c:8a:5f:fe:3d:0d:d6:03:f2:16:83:71

Digest Algorithm

sha256

PE Digest Matches

true

3b:f6:26:1c:99:82:98:75:cc:dc:58:91:a2:8b:24:98:19:4c:48:06
Signer

Actual PE Digest

3b:f6:26:1c:99:82:98:75:cc:dc:58:91:a2:8b:24:98:19:4c:48:06

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\327271\out\Release\cloudengine.pdb

Imports

shlwapi

StrStrIW
PathIsDirectoryW
SHDeleteValueW
PathFindFileNameW
StrCmpW
StrCmpNIW
StrCmpNW
StrChrW
SHSetValueW
SHGetValueW
PathRemoveFileSpecW
PathFileExistsW
StrCmpIW
PathCombineW
PathAppendW
SHDeleteKeyW

iphlpapi

GetIpAddrTable

kernel32

InitializeSListHead
LockResource
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
LoadResource
SizeofResource
GetTickCount
FindResourceW
FindResourceExW
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FreeLibrary
GetProcAddress
CreateThread
GetModuleFileNameW
GetEnvironmentVariableW
SetEnvironmentVariableW
InterlockedCompareExchange
FreeResource
GlobalMemoryStatusEx
GetCurrentProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
GetSystemInfo
LoadLibraryExW
GetModuleHandleW
GetSystemWindowsDirectoryW
GetVersionExW
InterlockedDecrement
GetCurrentThreadId
SetLastError
ReadFile
SetFilePointer
CloseHandle
GetLocalTime
CreateProcessW
GetPrivateProfileIntW
GetPrivateProfileStringW
CreateFileA
CreateFileW
CreateMutexW
FreeLibraryAndExitThread
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
GetModuleHandleExW
MultiByteToWideChar
GetLongPathNameW
GetStartupInfoW
InterlockedPopEntrySList
DeleteFileW
WideCharToMultiByte
SetErrorMode
SetEvent
GetLogicalDrives
DeviceIoControl
lstrlenW
CreateEventW
LoadLibraryW
GetDriveTypeW
GetSystemDirectoryW
GetFileAttributesExW
GetFileSize
WriteFile
GetShortPathNameW
InterlockedExchange
SetThreadPriority
ResumeThread
SystemTimeToFileTime
InterlockedIncrement
ResetEvent
GetCurrentProcessId
LocalFree
OutputDebugStringW
WriteConsoleW
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetTimeZoneInformation
LCMapStringW
CompareStringW
IsDebuggerPresent
GetStringTypeW
GetFileType
GetStdHandle
GetACP
GetModuleFileNameA
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
HeapLock
HeapUnlock
CreateDirectoryW
OpenThread
ReleaseMutex
ExitProcess
InterlockedFlushSList
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
HeapWalk

user32

GetParent
UnregisterClassW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsWindow
ShowWindow
GetActiveWindow
EnableWindow
SetWindowLongW
LoadStringW
EqualRect
CopyRect
EndDialog
DialogBoxParamW
GetWindowTextW
KillTimer
SendMessageW
GetMonitorInfoW
MonitorFromWindow
GetWindow
SetTimer
GetWindowLongW
MapWindowPoints
GetWindowRect
GetClientRect
SetWindowPos
DestroyWindow
CallWindowProcW
DefWindowProcW
SendMessageTimeoutW
LoadCursorW
FindWindowW

advapi32

RegQueryValueExA
RegEnumKeyExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitialize

oleaut32

SysAllocStringByteLen
SysStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
VariantCopy
SysAllocString
VariantClear
SysFreeString
VariantInit
DispCallFunc

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

winmm

timeGetTime

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW

ws2_32

WSAStartup
gethostbyname
WSACleanup

Exports

Exports

Create360SafeEngine
CreateCloudEngine
CreateCloudEngineLocker
CreateFileReportLog
CreatePlugin2
CreatePlugin3
CreatePlugin4
CreatePlugin5
CreateQuarantine
CreateTrustZone
ForceMerge360Log
GetModErrCode
IsSupportFeature

Sections

.text
Size: 415KB - Virtual size: 415KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/Cloudsec3.dll
.dll windows:6 windows x86 arch:x86

edf8277b88dfe1e00d8df9d84dac133c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:2d:41:81:4e:8c:3c:d1:e5:6f:6c:49:3a:c5:38:87:2c:28:a1:09:1e:8c:31:96:23:3c:c0:2e:8c:00:82:51
Signer

Actual PE Digest

52:2d:41:81:4e:8c:3c:d1:e5:6f:6c:49:3a:c5:38:87:2c:28:a1:09:1e:8c:31:96:23:3c:c0:2e:8c:00:82:51

Digest Algorithm

sha256

PE Digest Matches

true

11:84:06:6d:1b:25:ca:ce:6b:48:cd:49:75:5e:4d:ae:86:f3:65:c5
Signer

Actual PE Digest

11:84:06:6d:1b:25:ca:ce:6b:48:cd:49:75:5e:4d:ae:86:f3:65:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\350697\out\Release\Cloudsec3.pdb

Imports

kernel32

FreeResource
LoadLibraryExW
GetCurrentProcess
GetVersionExW
ReadFile
FindFirstFileW
FindClose
SearchPathW
GetFileAttributesW
LocalFree
LocalAlloc
GetCurrentThreadId
CreateProcessW
OpenProcess
CreateDirectoryW
GetSystemDirectoryW
FindNextFileW
RemoveDirectoryW
GetEnvironmentVariableW
GetShortPathNameW
GetDriveTypeW
WritePrivateProfileStringW
GetVolumeInformationW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTempPathW
GetSystemDefaultUILanguage
GetModuleHandleExW
GetFileSizeEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetFilePointer
IsDebuggerPresent
OutputDebugStringA
GetFileSize
InitializeCriticalSectionAndSpinCount
QueryDosDeviceW
SetEnvironmentVariableW
RaiseException
OpenMutexW
GetThreadPriority
GetCurrentThread
SetThreadPriority
SetFileAttributesW
SetErrorMode
QueryPerformanceFrequency
QueryPerformanceCounter
WriteFile
TerminateProcess
VirtualQueryEx
GetStartupInfoW
CreatePipe
PeekNamedPipe
ReadProcessMemory
GetThreadSelectorEntry
GetProcessId
Thread32Next
Thread32First
CreateToolhelp32Snapshot
Process32NextW
WaitForMultipleObjects
GetThreadContext
OpenThread
GetFileType
GetFileInformationByHandle
GetSystemTime
FileTimeToDosDateTime
TlsGetValue
TlsSetValue
TlsAlloc
GetFullPathNameW
GetLogicalDrives
GetSystemTimeAsFileTime
FlushFileBuffers
SetEvent
WriteConsoleW
SetStdHandle
GetCurrentProcessId
SetEnvironmentVariableA
ResetEvent
ResumeThread
CreateEventW
lstrcmpiW
GetWindowsDirectoryW
GetLongPathNameW
ExpandEnvironmentStringsW
DeviceIoControl
CreateFileW
LoadLibraryW
GetExitCodeThread
GetTickCount
SystemTimeToFileTime
GetLocalTime
GetPrivateProfileStringW
GetPrivateProfileIntW
GetSystemWindowsDirectoryW
GetLastError
WideCharToMultiByte
MultiByteToWideChar
HeapDestroy
Sleep
InterlockedCompareExchange
FreeLibrary
GetProcAddress
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetFileAttributesExW
EnterCriticalSection
LeaveCriticalSection
CreateThread
InterlockedExchange
GetModuleFileNameW
CloseHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetConsoleCP
LCMapStringW
CompareStringW
GetStringTypeW
GetStdHandle
GetACP
GetTimeZoneInformation
GetModuleFileNameA
ExitProcess
InterlockedFlushSList
RtlUnwind
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringW
TlsFree
HeapWalk
HeapUnlock
HeapLock
SetFilePointerEx
SetEndOfFile
CreateFileA
LocalFileTimeToFileTime
GetModuleHandleW
WaitForSingleObject
lstrlenW
DeleteFileW
SetLastError
CreateMutexW
ReleaseMutex
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
Process32FirstW

user32

FindWindowW
LoadStringW
SendMessageTimeoutW

advapi32

OpenServiceW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
RevertToSelf
ImpersonateLoggedOnUser
CryptAcquireContextW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteKeyW
RegEnumKeyExW
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
InitializeSecurityDescriptor
ChangeServiceConfig2W
CreateServiceW
DeleteService
ControlService
QueryServiceStatus
RegCreateKeyW
CryptReleaseContext
RegDeleteValueW
CloseServiceHandle
EnumServicesStatusExW
OpenSCManagerW
RegEnumKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyW
RegCreateKeyExW
QueryServiceConfigW
QueryServiceStatusEx
RegQueryValueExA

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal
CLSIDFromString

oleaut32

SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VariantChangeType
SysStringLen
VariantClear
SysFreeString
SysAllocString
VariantInit

shlwapi

PathAppendW
PathFileExistsW
StrChrW
SHGetValueW
StrCmpIW
PathFindExtensionW
PathFindFileNameW
StrToIntW
SHSetValueW
StrCmpNW
StrCmpNIW
StrRChrW
StrDupW
PathCombineW
StrStrIW
PathIsDirectoryW
PathRemoveFileSpecW
StrCmpW
SHCreateStreamOnFileW

psapi

EnumProcessModules
GetModuleFileNameExW
GetModuleInformation

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

inet_ntoa
gethostbyname
inet_addr

iphlpapi

DeleteIpForwardEntry
GetIpAddrTable
GetIpForwardTable
GetAdaptersInfo
DeleteIPAddress

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

rpcrt4

RpcAsyncCompleteCall
RpcBindingFree
RpcAsyncInitializeHandle
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrAsyncClientCall
RpcAsyncCancelCall

crypt32

CryptMsgClose
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetNameStringW
CertCloseStore
CryptMsgGetParam
CryptMsgUpdate
CryptMsgOpenToDecode
CertOpenStore
CertFindCertificateInStore
CryptSIPRetrieveSubjectGuidForCatalogFile

wintrust

CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext

mpr

WNetGetConnectionW

Exports

Exports

Create360Object
DSEngLib_Init
DecRefats
EngCreateObject
EngFrontFix
GetModErrCode
IsSupportFeature
LTDWS_HQD

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/DSFScan.dll
.dll windows:5 windows x86 arch:x86

6610901ab5e658aa7f5f553a5c29a552

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05-05-2015 00:00

Not After

31-12-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7a:fc:2d:d8:20:6b:d3:4c:16:a0:3a:19:1e:9d:8c:18:6a:0c:94:b1
Signer

Actual PE Digest

7a:fc:2d:d8:20:6b:d3:4c:16:a0:3a:19:1e:9d:8c:18:6a:0c:94:b1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\54824\out\Release\DSFScan.pdb

Imports

ws2_32

gethostbyname
inet_ntoa
ntohl
WSAStartup
WSACleanup
inet_addr
htons

kernel32

FindResourceW
FindResourceExW
WideCharToMultiByte
GetProcAddress
FreeLibrary
MultiByteToWideChar
CloseHandle
WaitForSingleObject
Sleep
InterlockedCompareExchange
FindClose
GetVersionExW
CreateDirectoryW
lstrlenW
CreateThread
GetExitCodeThread
LoadLibraryW
DeleteFileW
GetSystemWindowsDirectoryW
CreateFileW
DeviceIoControl
GetCurrentProcessId
FindFirstFileW
SetLastError
FreeResource
LoadLibraryExW
CreateProcessW
GetLastError
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
IsBadReadPtr
LoadResource
GetSystemDirectoryW
GetTickCount
GetFileSize
SetFilePointer
GetModuleHandleW
LoadLibraryA
ReadFile
ExpandEnvironmentStringsW
GetWindowsDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetExitCodeProcess
HeapAlloc
GetProcessHeap
HeapFree
RaiseException
HeapDestroy
HeapReAlloc
HeapSize
LockResource
SizeofResource
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetConsoleOutputCP
WriteConsoleW
WriteConsoleA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
GetACP
GetCPInfo
ExitProcess
InterlockedDecrement
InterlockedIncrement
RtlUnwind
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
InterlockedExchange
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStringTypeW
GetStringTypeA
GetStartupInfoA
WaitForMultipleObjects
CreateEventW
WriteFile
GetFileType
SetHandleCount
LCMapStringA
GetModuleFileNameA
GetStdHandle
HeapCreate
VirtualFree
LCMapStringW
IsValidCodePage
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
GetFileSizeEx
OutputDebugStringW
FormatMessageW
LocalFree
GetSystemTime
CreateMutexW
TlsGetValue
TlsSetValue
GetAtomNameW
OpenThread
AddAtomW
ReleaseMutex
TlsAlloc
FindAtomW
DeleteAtom
TlsFree
GetVersionExA
GlobalFree
GlobalAlloc
GetModuleHandleA
CreateMutexA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetOEMCP

advapi32

RegOpenKeyExW
RegCloseKey
RegEnumKeyW
RegEnumKeyExW
RegQueryValueExA
RegDeleteValueW
RegOpenKeyW
RegQueryValueExW

ole32

CoUninitialize
CoInitializeEx
CoTaskMemFree
CLSIDFromString
CoInitialize
CoCreateInstance

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString
VariantChangeType

shlwapi

PathAppendW
PathIsDirectoryW
StrStrIW
StrChrW
SHGetValueW
PathCombineW
PathFindFileNameW
PathFileExistsW
StrCmpIW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

iphlpapi

GetNetworkParams
GetIpAddrTable

setupapi

SetupFindNextMatchLineW
SetupGetFieldCount
SetupFindNextLine
SetupGetIntField
SetupCloseInfFile
SetupOpenInfFileW
SetupGetStringFieldW
SetupFindFirstLineW

Exports

Exports

DSFCreate
DSFCreateNetEnvObj
DSFDestory
DSFDestoryNetEnvObj
DSFNetEnvCancel
DSFNetEnvCheck
DSFNetEnvErrCode
DSFNetEnvIsExistBlackNDIS
DSFNetEnvRmBlackNDIS
DSFRedirect
DSFStartScan
DSFStopScan
FixImageAndHostDeep

Sections

.text
Size: 237KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/DSMain.exe
.exe windows:5 windows x86 arch:x86

a2f9da0de5124b8cd7ad4b75fb822f59

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4a:10:33:22:75:56:99:4e:86:3e:93:51:a2:4c:d5:ed:32:72:ce:0b:7b:b7:22:a8:c7:5e:7e:fd:6f:3b:3c:44
Signer

Actual PE Digest

4a:10:33:22:75:56:99:4e:86:3e:93:51:a2:4c:d5:ed:32:72:ce:0b:7b:b7:22:a8:c7:5e:7e:fd:6f:3b:3c:44

Digest Algorithm

sha256

PE Digest Matches

true

c3:8e:c7:f5:13:6e:56:a8:e1:aa:4f:0b:ca:06:ef:83:ab:d4:d7:61
Signer

Actual PE Digest

c3:8e:c7:f5:13:6e:56:a8:e1:aa:4f:0b:ca:06:ef:83:ab:d4:d7:61

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\311941\out\Release\DSMain.pdb

Imports

kernel32

FreeResource
GetCurrentThreadId
GetStartupInfoW
SetLastError
InterlockedExchange
OpenProcess
CreateDirectoryW
MultiByteToWideChar
LocalFree
CreateEventW
WaitForSingleObject
SetEvent
OpenEventW
GetCurrentThread
GetLocalTime
GetSystemWindowsDirectoryW
ResumeThread
VirtualQuery
VirtualProtect
VirtualAlloc
GetThreadContext
SetThreadContext
FlushInstructionCache
SuspendThread
WriteFile
SetFilePointer
GetFileSize
LoadLibraryA
ExpandEnvironmentStringsW
ReadFile
GetFileSizeEx
WideCharToMultiByte
lstrlenW
GetVersionExW
InitializeCriticalSectionAndSpinCount
IsValidCodePage
WritePrivateProfileStringW
CreateThread
Sleep
InterlockedCompareExchange
GetPrivateProfileStringW
GetLongPathNameW
CreateMutexW
TerminateProcess
GetCommandLineW
IsWow64Process
GetCurrentProcess
GetTickCount
EnterCriticalSection
LeaveCriticalSection
CloseHandle
CreateProcessW
InitializeCriticalSection
DeleteCriticalSection
GetLastError
LoadLibraryExW
GetModuleHandleW
DeviceIoControl
CreateFileW
LoadLibraryW
GetCurrentProcessId
FindNextFileW
FindClose
FindFirstFileW
InterlockedIncrement
GetTempPathW
GetTempFileNameW
DeleteFileW
InterlockedDecrement
GetProcAddress
FreeLibrary
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetStdHandle
GetConsoleMode
GetConsoleCP
VirtualFree
HeapCreate
RtlUnwind
IsDebuggerPresent
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetModuleHandleA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
LockResource
SizeofResource
RaiseException
LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetEndOfFile
SetFilePointerEx
TlsGetValue
HeapAlloc
HeapFree
OutputDebugStringW
GetProcessHeap
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
ReleaseMutex
TlsAlloc
TlsFree
HeapDestroy
HeapReAlloc
HeapSize
ExitProcess
FreeEnvironmentStringsW

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegEnumKeyW
RegCreateKeyW
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegOpenKeyW
DeleteService
ControlService
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegQueryValueExA

shell32

CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CreateStreamOnHGlobal

oleaut32

VariantInit
SysStringLen
SysAllocStringByteLen
SysStringByteLen
VariantClear
SysAllocString
SysFreeString

shlwapi

PathAppendW
PathCombineW
SHGetValueW
PathFileExistsW
PathIsRelativeW
StrRChrW
StrStrW
SHSetValueW
PathIsDirectoryW
PathFindFileNameW
StrCmpIW
StrChrW
StrStrIW
PathRemoveFileSpecW

version

VerQueryValueW

imm32

ImmDisableIME

psapi

GetModuleFileNameExW

ntdll

ZwQuerySystemInformation
ZwAllocateVirtualMemory
ZwProtectVirtualMemory
NtDelayExecution
RtlAllocateHeap
RtlCreateHeap
ZwQueryVirtualMemory
ZwFreeVirtualMemory
RtlReAllocateHeap

Sections

.text
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/DsSysRepair.dll
.dll windows:5 windows x86 arch:x86

64f1b9a6739070e1c27cd381a442dac9

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

26:d2:b6:3b:ef:f9:fa:81:61:21:82:82:4a:9d:04:95:3b:36:e9:40
Signer

Actual PE Digest

26:d2:b6:3b:ef:f9:fa:81:61:21:82:82:4a:9d:04:95:3b:36:e9:40

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\intermoutput\D_capital\DsSysRepair_capital\Release\DsSysRepair.pdb

Imports

kernel32

GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
SearchPathW
ExpandEnvironmentStringsW
GetSystemWindowsDirectoryW
lstrcmpiW
DeleteFileW
DeleteCriticalSection
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetTickCount
QueryPerformanceCounter
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringA
LCMapStringW
GetModuleHandleA
HeapCreate
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCommandLineA
RtlUnwind
GetLongPathNameW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
TlsFree
DeleteAtom
FindAtomW
TlsAlloc
ReleaseMutex
AddAtomW
OpenThread
GetAtomNameW
TlsSetValue
TlsGetValue
CreateMutexW
GetSystemTime
WaitForSingleObject
RaiseException
DeviceIoControl
GetModuleHandleW
CreateDirectoryW
GetSystemDefaultLangID
LocalFree
GetEnvironmentStringsW
GetCurrentProcess
GetFileAttributesW
SetFileAttributesW
MultiByteToWideChar
lstrlenW
GetProcessHeap
HeapAlloc
HeapFree
WideCharToMultiByte
GetFileSize
SetFilePointer
WriteFile
ReadFile
CreateFileW
GetLastError
SetLastError
CloseHandle
InterlockedCompareExchange
Sleep
GetProcAddress
LoadLibraryW
GetCurrentProcessId
FreeLibrary
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetVersionExW
LeaveCriticalSection
EnterCriticalSection
FormatMessageW
OutputDebugStringW
GetFileSizeEx
SetFilePointerEx
InitializeCriticalSection
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
VirtualAlloc
VirtualFree
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
ExitProcess
MoveFileW

user32

GetActiveWindow
UnregisterClassA
PostMessageW
FindWindowW
MessageBoxW

advapi32

RegSetValueExW
RegQueryValueExA
GetUserNameW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
GetExplicitEntriesFromAclW
DeleteAce
LookupAccountNameW
RegDeleteValueW
RegEnumKeyExW
RegCreateKeyExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegDeleteKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
OpenProcessToken
SetNamedSecurityInfoW
RegEnumKeyW
GetTokenInformation
GetLengthSid
CopySid
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExW
RegOpenKeyW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CreateStreamOnHGlobal

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear
VariantChangeType
SysAllocStringLen
SysStringLen
SysAllocStringByteLen
SysStringByteLen

shlwapi

SHGetValueW
PathFileExistsW
PathCombineW
PathAppendW
PathIsDirectoryW
PathRemoveFileSpecW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Exports

Exports

CreateExaminPlugin
DsCreateObject
DsCreateObject2

Sections

.text
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/ImAVEng.dll
.dll windows:5 windows x86 arch:x86

319572a18fc493a837cf509ab92d8b36

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:7b:83:fd:61:90:ba:90:1f:cd:5d:a5:9e:c3:3b:af:71:7c:fd:9f
Signer

Actual PE Digest

6b:7b:83:fd:61:90:ba:90:1f:cd:5d:a5:9e:c3:3b:af:71:7c:fd:9f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\32099\out\Release\ImAVEng.pdb

Imports

kernel32

InitializeCriticalSection
DeleteCriticalSection
SetEvent
GetProcAddress
FreeLibrary
CreateEventW
GetModuleHandleExW
CreateThread
FreeLibraryAndExitThread
Sleep
InterlockedCompareExchange
InterlockedExchange
GetFileAttributesExW
CreateFileW
MoveFileExW
DeleteFileW
SetUnhandledExceptionFilter
GetLastError
SetLastError
HeapAlloc
CloseHandle
HeapFree
ReadFile
WriteFile
SetFilePointerEx
GetFileAttributesW
GetFileSizeEx
MoveFileW
FlushFileBuffers
SetFileAttributesW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetModuleHandleW
LoadLibraryW
GetModuleFileNameW
DeviceIoControl
GetCurrentProcessId
ReleaseMutex
WaitForSingleObject
CreateMutexW
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
GetProcessHeap
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
OutputDebugStringW
FormatMessageW
MultiByteToWideChar
GetCurrentThreadId
LocalFree
GetSystemTime
TlsGetValue
TlsSetValue
GetAtomNameW
OpenThread
AddAtomW
TlsAlloc
FindAtomW
DeleteAtom
TlsFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RtlUnwind
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapCreate
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
LoadLibraryA
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
InterlockedIncrement

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
ImpersonateLoggedOnUser
RevertToSelf
RegQueryValueExA

oleaut32

SysAllocString
SysFreeString

shlwapi

PathAppendW
SHGetValueW
StrCmpIW
StrStrIW
PathFileExistsW
StrToIntW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Exports

Exports

Create360Object

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/PopSoftEng.dll
.dll windows:5 windows x86 arch:x86

c39dd26e91cfb3d390055f458bdc9802

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

bb:9b:6a:e9:af:73:54:b5:37:b8:ed:9a:54:46:48:9e:33:64:0d:f6:7a:d7:6b:82:92:20:d2:ae:91:c5:b5:77
Signer

Actual PE Digest

bb:9b:6a:e9:af:73:54:b5:37:b8:ed:9a:54:46:48:9e:33:64:0d:f6:7a:d7:6b:82:92:20:d2:ae:91:c5:b5:77

Digest Algorithm

sha256

PE Digest Matches

true

44:e5:01:c6:77:1a:cc:6b:6a:ce:6c:d6:b9:21:11:10:7c:24:b9:66
Signer

Actual PE Digest

44:e5:01:c6:77:1a:cc:6b:6a:ce:6c:d6:b9:21:11:10:7c:24:b9:66

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\191268\out\Release\PopSoftEng.pdb

Imports

kernel32

LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
GetCurrentProcessId
DeviceIoControl
CreateFileW
SetLastError
GetTempPathW
ExpandEnvironmentStringsW
GetFileAttributesExW
MultiByteToWideChar
GetEnvironmentVariableW
CreateDirectoryW
WideCharToMultiByte
SearchPathW
GetFileAttributesW
LocalAlloc
GetLongPathNameW
lstrlenW
FindResourceExW
ReadFile
SetFilePointer
GetFileSize
InterlockedIncrement
InterlockedDecrement
FindClose
DeleteFileW
GetTickCount
FindFirstFileW
FindNextFileW
GetCurrentThreadId
InterlockedExchange
WritePrivateProfileStringW
GetPrivateProfileIntW
GetFileSizeEx
GetDriveTypeW
CopyFileW
SetFileAttributesW
MoveFileExW
lstrcpyW
RemoveDirectoryW
ExitProcess
GetVersionExW
GetSystemWindowsDirectoryW
GetModuleHandleW
CloseHandle
GetLastError
GetCurrentProcess
GetSystemDirectoryW
LocalFree
GetProcAddress
LoadLibraryW
InterlockedCompareExchange
Sleep
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
RtlUnwind
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
TlsFree
DeleteAtom
FindAtomW
TlsAlloc
GetStringTypeW
GetStringTypeA
ReleaseMutex
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetModuleHandleA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringA
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetStdHandle
HeapCreate
FreeLibrary
InitializeCriticalSection
VirtualAlloc
VirtualFree
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
WriteFile
OutputDebugStringW
FormatMessageW
GetSystemTime
CreateMutexW
TlsGetValue
WaitForSingleObject
TlsSetValue
GetAtomNameW
OpenThread
AddAtomW

user32

LoadStringW

advapi32

SetNamedSecurityInfoW
SetEntriesInAclW
RegQueryValueExA
RegEnumValueW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegEnumKeyW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
GetNamedSecurityInfoW
FreeSid
AllocateAndInitializeSid

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW
ord155
SHCreateDirectoryExW
SHGetFileInfoW
ord25
ord190
SHGetDesktopFolder
ord18
SHGetSpecialFolderPathW

ole32

CoTaskMemAlloc
CoTaskMemFree
IIDFromString
StringFromGUID2

oleaut32

VariantChangeType
VariantClear
SysAllocStringLen
SysStringLen
SysAllocString
SafeArrayPutElement
VariantInit
SafeArrayCreate
SysFreeString

shlwapi

StrCmpIW
StrStrIW
StrCpyNW
StrCmpNIW
StrDupW
StrRChrW
StrChrW
PathCombineW
SHGetValueW
PathFileExistsW
PathAppendW
StrRetToBufW
PathRemoveFileSpecW
PathRemoveFileSpecA
PathCombineA
PathFindExtensionW
StrToIntW
PathFindFileNameW
PathIsDirectoryW

version

VerQueryValueW

setupapi

SetupIterateCabinetW

Exports

Exports

Create360Object

Sections

.text
Size: 416KB - Virtual size: 416KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/Qshieldz.dat
deepscan/appd.dll
.dll windows:5 windows x86 arch:x86

d6ef5245cc4541422cd4690f64f06850

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e6:c6:3b:c5:ca:da:5d:5f:de:85:e2:ac:2c:8a:9b:e5:c7:0f:01:d1:60:ed:79:e9:59:d5:56:f3:99:d4:1b:62
Signer

Actual PE Digest

e6:c6:3b:c5:ca:da:5d:5f:de:85:e2:ac:2c:8a:9b:e5:c7:0f:01:d1:60:ed:79:e9:59:d5:56:f3:99:d4:1b:62

Digest Algorithm

sha256

PE Digest Matches

true

18:b3:79:72:f4:76:51:71:f0:61:3a:5a:ba:a7:19:d3:bc:e4:82:6d
Signer

Actual PE Digest

18:b3:79:72:f4:76:51:71:f0:61:3a:5a:ba:a7:19:d3:bc:e4:82:6d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\vmagent_new\bin\joblist\91289\out\Release\appd.pdb

Imports

kernel32

lstrlenA
InterlockedExchange
InterlockedCompareExchange
GetLastError
VirtualFree
VirtualAlloc
RaiseException
FreeLibrary
GetModuleHandleExW
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
Sleep
LoadLibraryExW
GetModuleFileNameW
GetCommandLineW
GetVersion
DeviceIoControl
CreateEventW
CreateSemaphoreW
SetEvent
ReleaseSemaphore
ReadProcessMemory
GetCurrentThreadId
GetSystemDirectoryW
GetSystemWindowsDirectoryW
CreateDirectoryW
GetSystemTimeAsFileTime
GetProcessTimes
Module32NextW
Module32FirstW
GlobalFree
SystemTimeToFileTime
GetSystemTime
GlobalAlloc
WriteFile
GetTickCount
GetFileSize
CopyFileW
ExpandEnvironmentStringsW
ReadFile
OpenEventW
SetFilePointer
ResetEvent
OpenMutexW
CreateMutexW
MoveFileExW
TerminateProcess
GetCurrentProcessId
FindClose
FindNextFileW
FindFirstFileW
CreateToolhelp32Snapshot
GlobalLock
GetExitCodeProcess
GetPrivateProfileSectionW
WritePrivateProfileSectionW
IsBadReadPtr
SetLastError
QueryDosDeviceW
GetCurrentProcess
RemoveDirectoryW
GetFileAttributesW
GetShortPathNameW
WTSGetActiveConsoleSessionId
ProcessIdToSessionId
GetLongPathNameW
SearchPathW
GetVersionExW
GetExitCodeThread
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW
GlobalSize
LoadLibraryA
LocalAlloc
GetTempPathW
GetEnvironmentVariableW
GetDriveTypeW
GetFileSizeEx
EnumResourceNamesW
CreateFileA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
Process32FirstW
Process32NextW
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
CreateThread
DeleteFileW
CreateProcessW
WaitForSingleObject
GetPrivateProfileIntW
CreateFileW
OpenProcess
CloseHandle
OpenThread
GetThreadContext
GetModuleHandleW
LoadLibraryW
GetProcAddress
GetFileAttributesExW
EnterCriticalSection
HeapFree
GetProcessHeap
HeapAlloc
LocalFree
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
GlobalUnlock
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleHandleA
GetStartupInfoA
GetFileType
SetHandleCount
ExitProcess
HeapCreate
GetModuleFileNameA
GetStdHandle
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetCommandLineA
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapSize
HeapReAlloc
HeapDestroy

user32

WaitForInputIdle
CharNextW
PostMessageW
FindWindowW
RegisterWindowMessageW
GetClassNameW
AttachThreadInput
SendMessageTimeoutW
InternalGetWindowText
IsWindowVisible
EnumWindows
SendMessageW
GetWindowThreadProcessId
EnumChildWindows
GetDesktopWindow
GetForegroundWindow
LookupIconIdFromDirectoryEx

winspool.drv

GetPrinterDriverDirectoryW
GetPrintProcessorDirectoryW

advapi32

CryptReleaseContext
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
CryptEncrypt
CryptImportKey
CryptSetKeyParam
CryptDestroyKey
CryptAcquireContextW
OpenProcessToken
GetTokenInformation
ConvertStringSidToSidW
LookupAccountSidW
RegEnumValueW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey

shell32

SHFileOperationW
CommandLineToArgvW
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoUninitialize
GetHGlobalFromStream
CoInitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal

oleaut32

VariantChangeType
VarUI4FromStr
VariantCopy
SysStringByteLen
VariantInit
SysAllocString
SysAllocStringByteLen
VariantClear
SysFreeString
SysStringLen

shlwapi

StrChrIW
PathIsDirectoryW
PathFindNextComponentW
StrStrW
StrRStrIW
StrStrIA
PathGetArgsW
StrCmpNW
PathStripToRootW
StrToInt64ExW
SHRegCreateUSKeyW
SHRegCloseUSKey
StrRChrW
PathFindFileNameW
PathRemoveBackslashW
PathRemoveFileSpecW
PathFileExistsW
StrCmpNIW
StrToIntW
StrCmpIW
PathRemoveExtensionW
StrCmpW
SHDeleteValueW
SHSetValueW
SHGetValueW
StrChrW
StrDupW
PathAppendW
StrStrIW
PathFindExtensionW
StrCpyNW
PathCombineW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ntdll

RtlUnwind
RtlInitUnicodeString
NtCreateFile

mpr

WNetGetConnectionW

ws2_32

htons
inet_ntoa

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInstanceIdW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList

psapi

EnumProcessModules
GetModuleFileNameExW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

Exports

Exports

CreateTrayClient
GetExtInfo

Sections

.text
Size: 603KB - Virtual size: 602KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/art.dat
deepscan/cloudcom2.dll
.dll windows:5 windows x86 arch:x86

0395eab1ae9ff258dec894d9c3e7d85e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:e1:ab:05:90:8c:4c:84:a3:e5:8a:da:1a:62:fe:f4:8b:ed:a0:71:5a:cc:1e:74:c9:93:61:cc:8d:36:b1:49
Signer

Actual PE Digest

63:e1:ab:05:90:8c:4c:84:a3:e5:8a:da:1a:62:fe:f4:8b:ed:a0:71:5a:cc:1e:74:c9:93:61:cc:8d:36:b1:49

Digest Algorithm

sha256

PE Digest Matches

true

2e:4a:7d:26:e2:87:2a:63:75:72:bf:e2:92:68:3f:67:86:66:8a:63
Signer

Actual PE Digest

2e:4a:7d:26:e2:87:2a:63:75:72:bf:e2:92:68:3f:67:86:66:8a:63

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\358887\out\Release\cloudcom2.pdb

Imports

ws2_32

WSAStartup
WSACleanup
socket
WSACreateEvent
closesocket
WSACloseEvent
htons
WSAEventSelect
WSAWaitForMultipleEvents
recvfrom
ntohl
inet_ntoa
WSASocketW
shutdown
WSARecv
WSAGetOverlappedResult
bind
setsockopt
WSASend
WSAEnumNetworkEvents
WSARecvFrom
htonl
ntohs
WSAGetLastError
gethostbyname
sendto
WSAIoctl
inet_addr

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetProcAddress
GetModuleFileNameW
GetTickCount
CloseHandle
CreateEventW
ResetEvent
CreateFileW
DeviceIoControl
GetCurrentProcessId
FreeLibraryAndExitThread
GetModuleHandleExW
CreateThread
InterlockedCompareExchange
Sleep
InterlockedExchange
WaitForSingleObject
SetEvent
CreateMutexW
ReleaseMutex
ResumeThread
WaitForMultipleObjects
GetOverlappedResult
InterlockedIncrement
InterlockedDecrement
GetLastError
InitializeCriticalSectionAndSpinCount
GetEnvironmentVariableW
GetSystemWindowsDirectoryW
FreeResource
LoadLibraryExW
GetCurrentProcess
GetModuleHandleW
GetVersionExW
GetFileAttributesW
FindFirstFileW
FindClose
GetCurrentThread
GetFileAttributesExW
GetShortPathNameW
LocalFree
GetFileSize
SetFilePointer
ReadFile
WriteFile
OpenEventW
SetLastError
SetErrorMode
GetCurrentThreadId
GetLongPathNameW
LoadLibraryW
ExpandEnvironmentStringsW
GetExitCodeThread
GetLocalTime
SetFileAttributesW
DeleteFileW
MoveFileExW
GetVolumeInformationW
CreateDirectoryW
GetDiskFreeSpaceExW
GetTempPathW
SystemTimeToFileTime
RemoveDirectoryW
CreateProcessW
QueryPerformanceFrequency
QueryPerformanceCounter
VirtualQuery
VirtualProtect
FlushInstructionCache
VirtualAlloc
VirtualFree
GetThreadContext
SetThreadContext
SuspendThread
EnumResourceNamesW
LoadLibraryExA
GetVersion
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
GetFileSizeEx
GetSystemDirectoryW
IsBadReadPtr
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueTimer
DeleteTimerQueueEx
FileTimeToSystemTime
lstrcmpiW
RaiseException
GetSystemDefaultUILanguage
GetFileTime
CreateSemaphoreW
MapViewOfFile
ReleaseSemaphore
ReadDirectoryChangesW
CreatePipe
OpenSemaphoreW
GetFileType
GetFileInformationByHandle
GetSystemTime
FileTimeToDosDateTime
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
MultiByteToWideChar
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
lstrlenW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
WriteConsoleW
FindNextFileA
FindFirstFileExA
ReadConsoleW
LCMapStringW
CompareStringW
GetConsoleMode
GetConsoleCP
GetStdHandle
GetACP
GetStringTypeW
GetTimeZoneInformation
GetModuleFileNameA
ExitProcess
InterlockedFlushSList
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleA
CreateMutexA
GlobalFree
GlobalAlloc
GetVersionExA
SetFilePointerEx
SetEndOfFile
CreateFileA
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
OpenThread
HeapWalk
HeapUnlock
HeapLock
OutputDebugStringW
IsDebuggerPresent
FlushFileBuffers
WideCharToMultiByte

user32

CharNextW
LookupIconIdFromDirectoryEx

advapi32

RegQueryValueExW
RegQueryValueExA
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
OpenThreadToken
OpenProcessToken
GetTokenInformation
EqualSid
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegNotifyChangeKeyValue
RegEnumKeyW
RegOpenKeyExW
RegOpenKeyW
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
SetEntriesInAclW
GetExplicitEntriesFromAclW
GetNamedSecurityInfoW
FreeSid
SetNamedSecurityInfoW
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey

shell32

SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance

oleaut32

SafeArrayCreate
VarUI4FromStr
SafeArrayPutElement
SysFreeString
SysAllocString
SysStringLen
SysAllocStringLen
VariantInit
VariantClear
VariantChangeType

shlwapi

SHDeleteValueW
SHSetValueW
StrRChrW
StrStrW
StrStrIA
StrCmpNW
PathFindFileNameW
PathAddBackslashW
StrCmpW
StrCmpIW
StrCmpNIW
StrRStrIW
PathIsDirectoryW
PathRemoveFileSpecW
PathCombineW
SHGetValueW
StrChrW
PathFileExistsW
PathAppendW
StrCmpNIA
StrStrIW

iphlpapi

NotifyAddrChange
GetNetworkParams
GetBestRoute
GetFriendlyIfIndex
GetAdaptersInfo

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

winmm

timeGetTime

imagehlp

ImageGetCertificateHeader
ImageGetCertificateData

Exports

Exports

AVCacheClose
AVCacheCreate
AVCacheQuery
AVDeleteWhite
AVInsertWhite
AVNetQuery
AVNetQueryCancel
CacheClearOldData
CacheIsNeedClearOldData
CheckCloudServerState
CheckStreamTrust
Create360CommXClient
CreateObject
GetBest360Dns
GetDwordValue
GetFileTrustState
GetFileTrustStateEx
GetFileTrustStateEx2
GetFileTrustStateWithHandle
GetIspDns
GetStringValue
IsCahceTruested
IsSupportFeature
MisKillCheckDangerFileSignWhitList
MisKillClose
MisKillCreate
MisKillGetIsSystemFileName
MisKillJudgeWhite
MisKillJudgeWhiteEx
MisKillJudgeWhiteOnlyFile
QueryFileCancel
QueryFileClose
QueryFileCreate
QueryFilesEx
QueryFilesEx2
QueryFilesGetError
QueryFilesIsFileInXD
QueryFilesIsFileMD5InXD
QuerySetOption
RestoreDns
SetComOption
SetDns
SetVerifyFilePath
SigDestroy
SigInit
SigMatch
SigMatchCert
SmartAddRestoreFile
SmartCacheClearFileCache
SmartCacheClearOldData
SmartCacheClose
SmartCacheCreate
SmartCacheDelFiles
SmartCacheFileMonCallBack
SmartCacheFileMonCallBackEx
SmartCacheGetFLNPNumber
SmartCacheInsert
SmartCachePETime
SmartCacheQuery
SmartCacheQueryHips
SmartCacheQueryHips2
SmartDomainHijackQuery
SmartForcePrintLog
SmartGetCloudServerTime
SmartGetOption
SmartGetProxyInfo
SmartIsFileInXD
SmartIsMD5FileInXD
SmartIsMD5InXD
SmartNetAddrQuery
SmartNetQuery
SmartNetQueryCancel
SmartNetQueryEx
SmartNetQueryEx2
SmartQueryPreExitDll
SmartSetOption
SmartUploadCancel
SmartUploadClose
SmartUploadCreate
SmartUploadGetError
SmartUploadSetNetTimeout
SmartUploadSetOption
SmartUploadWithExtInfo
UninitCheckCloudServerState
VMDetector_IsInsideVM
XDAddRecords
XDAddRecordsEx
XDClose
XDDeleteRecords
XDGetCounts
XDGetFirst
XDGetLastFlag
XDGetNext
XDGetOption
XDOpen

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 219KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/cpr.dat
deepscan/deepscan.dll
.dll regsvr32 windows:6 windows x86 arch:x86

9485821b3367023ee8560b857cae063d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

94:09:9f:28:d6:79:66:c7:a5:13:39:bd:2f:f5:37:79:95:08:0f:63:05:41:bd:8c:75:9d:b0:04:0a:7c:b0:c4
Signer

Actual PE Digest

94:09:9f:28:d6:79:66:c7:a5:13:39:bd:2f:f5:37:79:95:08:0f:63:05:41:bd:8c:75:9d:b0:04:0a:7c:b0:c4

Digest Algorithm

sha256

PE Digest Matches

true

43:de:01:84:c8:30:44:ce:34:9d:2e:0c:37:a0:c3:7e:ad:b0:88:ea
Signer

Actual PE Digest

43:de:01:84:c8:30:44:ce:34:9d:2e:0c:37:a0:c3:7e:ad:b0:88:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\359845\out\Release\deepscan.pdb

Imports

kernel32

GetSystemDefaultUILanguage
LoadLibraryW
CreateDirectoryW
GetTickCount
InterlockedExchange
LocalFree
GetShortPathNameW
GetLongPathNameW
TerminateProcess
RaiseException
CreateThread
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
GetFileSize
GetFileSizeEx
GetStartupInfoW
GetFileAttributesExW
CreatePipe
PeekNamedPipe
CreateProcessA
ExpandEnvironmentStringsA
GetFullPathNameW
MoveFileExW
ResumeThread
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualQuery
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateEventW
GetEnvironmentVariableW
GetACP
lstrcmpiW
GetExitCodeThread
FormatMessageW
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsDBCSLeadByte
GetStdHandle
SetFileTime
MoveFileW
SetEndOfFile
VirtualFree
SetEvent
ResetEvent
SetFilePointerEx
GlobalMemoryStatusEx
QueryDosDeviceW
SetEnvironmentVariableW
WritePrivateProfileSectionW
GetDriveTypeW
GetLogicalDrives
FreeLibraryAndExitThread
ReleaseMutex
CreateMutexW
OpenMutexW
OpenThread
Thread32First
Thread32Next
WriteConsoleW
FlushFileBuffers
SetStdHandle
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetFileAttributesW
GetFileType
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
InterlockedFlushSList
RtlUnwind
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
GetTempFileNameW
GetTempPathW
GetPrivateProfileStringW
Module32NextW
Module32FirstW
lstrlenW
VirtualQueryEx
MultiByteToWideChar
WritePrivateProfileStringW
GetPrivateProfileIntW
GetSystemInfo
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetVolumeInformationW
SearchPathW
FindNextFileW
FindFirstFileW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
FindClose
ReadProcessMemory
SetErrorMode
SetLastError
OpenProcess
InterlockedDecrement
InterlockedIncrement
GetVersionExW
GetSystemDirectoryW
CreateProcessW
GetModuleHandleW
InterlockedCompareExchange
LoadLibraryExW
DeviceIoControl
ReadFile
WaitForSingleObject
GetLastError
GetExitCodeProcess
GetCurrentProcessId
GetCurrentProcess
FreeResource
GetSystemWindowsDirectoryW
GetPrivateProfileSectionW
OutputDebugStringW
LocalAlloc
GetModuleFileNameW
WideCharToMultiByte
DeleteFileW
CreateFileW
RemoveDirectoryW
FindResourceExW
FindResourceW
CloseHandle
SetFilePointer
WriteFile
SizeofResource
LoadResource
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
GetCPInfo
GetStringTypeW
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapWalk
HeapUnlock
HeapLock
CreateFileA
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTimeAsFileTime
CopyFileW
SetFileAttributesW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
LockResource
GetDiskFreeSpaceExW

user32

GetWindowTextW
GetWindowLongW
SetWindowLongW
FindWindowExW
GetWindowThreadProcessId
LoadCursorW
wsprintfW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
PostQuitMessage
CallWindowProcW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
MessageBoxA
SendMessageTimeoutW
CreateWindowExW
IsWindow
FindWindowW
LoadStringW
DestroyWindow
GetActiveWindow
CharUpperW
CharNextW

winspool.drv

GetPrinterDriverDirectoryW
GetPrintProcessorDirectoryW

advapi32

RegEnumValueA
RegOpenKeyExW
RegSetValueExW
ChangeServiceConfigW
CloseServiceHandle
ControlService
EnumServicesStatusExW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
QueryServiceStatus
LookupAccountSidW
GetTokenInformation
SetSecurityInfo
SetNamedSecurityInfoW
GetSecurityInfo
GetNamedSecurityInfoW
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid
RegSetValueW
RegSetValueA
RegQueryValueW
RegQueryValueA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegFlushKey
EnumServicesStatusW
ImpersonateLoggedOnUser
RevertToSelf
CryptReleaseContext
CryptAcquireContextW
QueryServiceStatusEx
CreateServiceW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyExA
RegEnumKeyW
RegEnumKeyA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCreateKeyW
RegCreateKeyA
DeleteService
RegEnumValueW
RegEnumKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
RegOpenKeyW
StartServiceW
RegCloseKey

shell32

SHGetFolderPathW
ord155
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHCreateDirectoryExW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHFileOperationW

ole32

CoSetProxyBlanket
CoInitialize
CoUninitialize
CoCreateInstance
CLSIDFromString
CoTaskMemAlloc
CoInitializeSecurity
StgCreateDocfileOnILockBytes
StgCreateStorageEx
CoInitializeEx
StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree

oleaut32

VarCmp
VarUI4FromStr
SysAllocString
SysFreeString
SysStringLen
VariantInit
VariantClear
VariantChangeType
VariantCopy
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
VarBstrCat

shlwapi

StrCmpNW
StrDupW
StrStrIW
PathFindFileNameW
PathIsRelativeW
UrlUnescapeW
SHGetValueW
PathFileExistsW
StrCmpNIW
StrChrW
PathCombineW
StrToIntW
PathAppendW
PathRemoveFileSpecW
PathIsDirectoryW
StrRChrW
PathFindExtensionW
PathRenameExtensionW
StrTrimA
PathMatchSpecW
StrCmpIW
SHCreateStreamOnFileW
StrStrW
StrCmpW

version

VerQueryValueW

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertFindCertificateInStore
CertGetNameStringW
CertOpenStore
CryptMsgGetParam
CryptMsgUpdate
CryptMsgClose
CertCloseStore
CryptMsgOpenToDecode

setupapi

SetupCloseFileQueue
SetupOpenFileQueue
SetupIterateCabinetW
SetupOpenInfFileW
SetupCloseInfFile
SetupFindFirstLineW
SetupGetStringFieldW
SetupFindNextLine
SetupGetIntField
SetupFindNextMatchLineW
SetupGetFieldCount

ws2_32

WSACleanup
inet_addr
gethostname
inet_ntoa
WSAStartup

psapi

GetDeviceDriverBaseNameW
GetDeviceDriverFileNameW
GetModuleFileNameExW
GetProcessImageFileNameW
GetProcessMemoryInfo
EnumProcessModules
GetModuleInformation
EnumDeviceDrivers

mpr

WNetGetConnectionW

iphlpapi

GetIpAddrTable

netapi32

NetShareGetInfo
NetApiBufferFree

ntdll

ZwClose
ZwReadFile
ZwWriteFile
RtlInitUnicodeString
ZwOpenFile

Exports

Exports

ClearTDHQD
Create360Object
CreateQuarantObject
CreateQuarantObjectFactory
DSCreateOrUpdateTask
DSDeleteTaskByCom
DecRefats
DllRegisterServer
DllUnregisterServer
DsEmpEnum
DsEmpGetState
DsEmpIsSupported
DsEmpOpen
DsEmpRule
DsGetSetSuperKillerSuccFlag
DsRKM
DsSetScanItemSortList
EngLib_Init
EngSectionRestore
FixDkSec
GetDkSecStatus
GetModErrCode
IsSupportFeature
SetHijackEngIncludeMode
SetHijackExcludeOrIncludeSt
SetSpkByCk

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 467KB - Virtual size: 466KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 385KB - Virtual size: 385KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/dsbs.dat
deepscan/dsconz.dat
deepscan/dserror.dat
deepscan/dsns.dat
deepscan/dsr.dat
deepscan/dswc.dat
deepscan/dsws.dat
deepscan/dswtb.dat
deepscan/heavygate.dll
.dll windows:5 windows x86 arch:x86

48a5af31737e5dcb232afff5d2159792

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

cc:02:f8:66:54:d1:22:43:52:d7:d0:ff:46:5b:2e:dc:c7:fd:d9:02:f4:2e:9b:27:ba:e0:60:d0:22:40:1a:de
Signer

Actual PE Digest

cc:02:f8:66:54:d1:22:43:52:d7:d0:ff:46:5b:2e:dc:c7:fd:d9:02:f4:2e:9b:27:ba:e0:60:d0:22:40:1a:de

Digest Algorithm

sha256

PE Digest Matches

true

43:47:bd:f5:36:66:fa:7e:46:5e:10:81:3f:53:17:5a:9e:c1:ed:58
Signer

Actual PE Digest

43:47:bd:f5:36:66:fa:7e:46:5e:10:81:3f:53:17:5a:9e:c1:ed:58

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\233265\out\Release\heavygate.pdb

Imports

kernel32

FlushViewOfFile
InterlockedCompareExchange
GetProcessHeap
OutputDebugStringW
OutputDebugStringA
WaitForSingleObjectEx
WaitForSingleObject
WriteFile
WideCharToMultiByte
UnmapViewOfFile
UnlockFileEx
UnlockFile
SystemTimeToFileTime
Sleep
SetFilePointer
SetEndOfFile
ReadFile
QueryPerformanceCounter
MultiByteToWideChar
MapViewOfFile
LockFileEx
LockFile
LocalFree
LoadLibraryW
LoadLibraryA
HeapCompact
HeapValidate
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVersionExW
GetVersionExA
GetTickCount
GetTempPathW
GetTempPathA
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetProcAddress
GetLastError
GetFullPathNameW
GetFullPathNameA
GetFileSize
GetFileAttributesExW
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetCurrentProcessId
FreeLibrary
FormatMessageW
FormatMessageA
FlushFileBuffers
DeleteFileW
DeleteFileA
CreateMutexW
CreateFileMappingW
CreateFileMappingA
CreateFileW
CreateFileA
CloseHandle
AreFileApisANSI
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
ExitThread
CreateThread
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeZoneInformation
GetModuleHandleA
VirtualFree
VirtualAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_pointer
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare16_v3
sqlite3_prepare_v2
sqlite3_prepare_v3
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_pointer
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_set_last_insert_rowid
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_nochange
sqlite3_value_numeric_type
sqlite3_value_pointer
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_collation
sqlite3_vtab_config
sqlite3_vtab_nochange
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug

Sections

.text
Size: 438KB - Virtual size: 438KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/qshieldzh.dat
deepscan/sc.con
deepscan/sndw.dat
deepscan/ssr.dat
.ps1
deepscan/sysfilerepS.dll
.dll windows:5 windows x86 arch:x86

90b2895fa0bb952d818ea6df5fd805e1

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

99:bc:b0:e3:cc:0b:07:62:27:9d:1a:93:f0:27:99:0d:44:eb:5b:22:eb:3f:57:93:27:2d:db:5d:54:47:42:46
Signer

Actual PE Digest

99:bc:b0:e3:cc:0b:07:62:27:9d:1a:93:f0:27:99:0d:44:eb:5b:22:eb:3f:57:93:27:2d:db:5d:54:47:42:46

Digest Algorithm

sha256

PE Digest Matches

true

5c:dd:cc:05:10:7b:8b:c4:02:a8:1d:35:7e:db:63:71:55:b4:43:a2
Signer

Actual PE Digest

5c:dd:cc:05:10:7b:8b:c4:02:a8:1d:35:7e:db:63:71:55:b4:43:a2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\330002\out\Release\sysfilerepS.pdb

Imports

kernel32

InterlockedCompareExchange
GetSystemWindowsDirectoryW
Sleep
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetTempPathW
CreateDirectoryW
InterlockedExchange
FreeResource
LoadLibraryExW
CloseHandle
DeviceIoControl
CreateFileW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
lstrlenW
EnterCriticalSection
FindResourceExW
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
ResumeThread
CreateThread
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
InterlockedDecrement
GetVersionExW
DeleteFileW
MoveFileExW
GetWindowsDirectoryW
GetTickCount
CopyFileW
GetLastError
SetFileAttributesW
LocalFree
RemoveDirectoryW
InterlockedIncrement
FindResourceW
LoadResource
LockResource
SizeofResource
GetEnvironmentVariableW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
GetModuleHandleW
LoadLibraryW
GetProcAddress
FreeLibrary
SetLastError
GetSystemDefaultUILanguage
GetSystemDirectoryW
LeaveCriticalSection
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetACP
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidCodePage
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapFree
GetProcessHeap
RaiseException
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
CreateFileA
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
WriteFile
ReadFile
GetFileSizeEx
CreateMutexW
TlsGetValue
OutputDebugStringW
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
ReleaseMutex
TlsAlloc
TlsFree
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetOEMCP
GetModuleHandleA

advapi32

RegQueryValueExA
GetUserNameW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
OpenProcessToken
SetNamedSecurityInfoW
GetExplicitEntriesFromAclW
DeleteAce
LookupAccountNameW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shell32

SHCreateDirectoryExW
SHGetFolderPathW

ole32

CoInitialize
CoUninitialize

oleaut32

SysAllocString
SysFreeString

shlwapi

SHGetValueW
StrStrIW
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
StrStrW
PathFindFileNameW
StrCmpIW
StrCmpW
PathCombineW
StrCmpNIW
StrCmpNW
StrRChrW
PathAppendW
StrChrW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

winmm

timeGetTime

setupapi

SetupIterateCabinetW

Exports

Exports

GetModErrCode
WinsxsFix
cancel_sysfilerep_req
close_sysfilerep_object
create_sysfilerep_object
fix_ie_kb_fix
judgeif_sys_file
judgeif_sys_file_a
judgeif_sys_file_w
replace_all_sys_file
replace_all_sys_file_a
replace_all_sys_file_w
replace_file_w
replace_get_http_count
replace_set_http_mode
replace_set_product_a
replace_set_product_w
replace_sys_file
replace_sys_file_a
replace_sys_file_w
scan_ie_kb_fix
set_download_callback
set_option
set_sysfilerep_timeout

Sections

.text
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
deepscan/wpz.dat
define_updatecfg.xml.tmp
dep360.exe
.exe windows:5 windows x86 arch:x86

9dc7d43a1ecc62fe754ff602c4ac5fd7

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-12-2015 00:00

Not After

28-03-2019 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

35:f9:12:41:8f:62:0a:e1:06:54:c2:e0:67:f9:68:e3:b0:7a:9e:36:7e:d0:18:b8:39:77:e9:c3:df:7a:f2:8d
Signer

Actual PE Digest

35:f9:12:41:8f:62:0a:e1:06:54:c2:e0:67:f9:68:e3:b0:7a:9e:36:7e:d0:18:b8:39:77:e9:c3:df:7a:f2:8d

Digest Algorithm

sha256

PE Digest Matches

true

c9:d8:f2:8a:30:55:ca:35:0a:8f:ee:ff:5b:31:d6:1f:93:36:cd:32
Signer

Actual PE Digest

c9:d8:f2:8a:30:55:ca:35:0a:8f:ee:ff:5b:31:d6:1f:93:36:cd:32

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\292007\out\Release\dep360.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA

kernel32

GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
GetVolumeInformationW
GetFullPathNameW
GetShortPathNameW
LocalAlloc
GlobalReAlloc
GlobalHandle
TlsAlloc
LocalReAlloc
GlobalGetAtomNameW
GetAtomNameW
lstrlenA
GlobalFlags
LocalFileTimeToFileTime
SetFileTime
GetFileSizeEx
GetFileTime
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
ExitThread
HeapReAlloc
ExitProcess
SetStdHandle
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
GetStringTypeExW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
FatalAppExitA
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GetTempFileNameW
SetFilePointerEx
HeapUnlock
CreateEventW
SetThreadPriority
HeapLock
HeapWalk
LocalUnlock
GlobalAddAtomW
GlobalFindAtomW
CompareStringW
GetVersionExA
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
GlobalFree
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
MulDiv
FreeResource
lstrcmpiW
GetCurrentThread
SetLastError
CreateNamedPipeW
ConnectNamedPipe
WaitNamedPipeW
DisconnectNamedPipe
CreateEventA
GetHandleInformation
InterlockedExchange
IsBadReadPtr
GetTimeZoneInformation
GetFileAttributesW
lstrcmpW
Module32FirstW
Module32NextW
ReadProcessMemory
AreFileApisANSI
QueryDosDeviceW
SetEnvironmentVariableW
GlobalMemoryStatusEx
ResumeThread
Thread32First
OpenThread
SuspendThread
LocalLock
GetDiskFreeSpaceW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetDriveTypeA
GetFullPathNameA
Thread32Next
ProcessIdToSessionId
LoadLibraryA
GetModuleHandleA
OutputDebugStringA
UnmapViewOfFile
DuplicateHandle
CreateFileMappingW
MapViewOfFile
GetFileType
GetFileInformationByHandle
GetSystemTime
FileTimeToDosDateTime
GetLogicalDriveStringsW
GetDriveTypeW
GetDiskFreeSpaceExW
GetLogicalDrives
GlobalDeleteAtom
GlobalAddAtomA
EnumResourceNamesW
GetProcessHeap
HeapAlloc
OutputDebugStringW
SetErrorMode
LoadLibraryExW
TlsGetValue
TlsSetValue
InterlockedCompareExchange
GetCurrentProcess
OpenMutexW
TlsFree
ExpandEnvironmentStringsW
CreateMutexA
ReleaseMutex
CreateSemaphoreA
InterlockedIncrement
ReleaseSemaphore
WaitForMultipleObjects
SetEvent
DeleteCriticalSection
InitializeCriticalSection
GetCurrentDirectoryW
SetCurrentDirectoryW
SystemTimeToFileTime
GetStartupInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TerminateThread
CopyFileW
SetFilePointer
WriteFile
SetEndOfFile
GetACP
WideCharToMultiByte
CreateMutexW
GetLastError
CreateThread
LoadLibraryW
MoveFileW
GetPrivateProfileSectionNamesW
GetTempPathW
GetSystemWindowsDirectoryW
InterlockedDecrement
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
DeviceIoControl
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetLongPathNameW
GetCurrentProcessId
TerminateProcess
Sleep
OpenProcess
GetCommandLineW
GetVersion
GetModuleHandleW
GetProcAddress
SetFileAttributesW
MultiByteToWideChar
lstrlenW
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
CreateProcessA
WaitForSingleObject
MoveFileExW
GetSystemDirectoryW
GetLocalTime
GetPrivateProfileIntW
GetPrivateProfileStringW
CreateProcessW
GetExitCodeProcess
WritePrivateProfileSectionW
GetPrivateProfileSectionW
GetTickCount
DeleteFileW
GetModuleFileNameW
GetWindowsDirectoryW
CreateDirectoryW
LocalFree
WritePrivateProfileStringW
CreateFileW
GetFileSize
ReadFile
CloseHandle
FindResourceW
LoadResource
LockResource
SizeofResource
GetVersionExW
FreeEnvironmentStringsW
lstrcpynW

user32

ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
SetCursor
GetMessageW
ValidateRect
ScrollWindowEx
MoveWindow
IsDialogMessageW
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
GetPropW
RemovePropW
GetFocus
GetForegroundWindow
GetLastActivePopup
GetWindowDC
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
UpdateWindow
CreateWindowExW
GetClassInfoExW
RegisterClassW
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
DefWindowProcW
GetMenu
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
CreateDialogIndirectParamW
DestroyWindow
GetNextDlgTabItem
EndDialog
BeginPaint
EndPaint
LoadMenuW
GetKeyNameTextW
MapVirtualKeyW
InflateRect
CharUpperW
GetSysColorBrush
LoadCursorW
DeleteMenu
GetDialogBaseUnits
GetMenuItemInfoW
DestroyMenu
UnregisterClassW
CharNextW
CopyAcceleratorTableW
IsRectEmpty
SetRect
InvalidateRgn
SetCapture
ReleaseCapture
GetNextDlgGroupItem
MessageBeep
SetRectEmpty
RegisterClipboardFormatW
TranslateAcceleratorW
CreatePopupMenu
InsertMenuItemW
LoadAcceleratorsW
GetMenuBarInfo
ReuseDDElParam
UnpackDDElParam
PostThreadMessageW
GetSystemMenu
SetParent
UnionRect
GetDCEx
LockWindowUpdate
BeginDeferWindowPos
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
CopyRect
IsWindowEnabled
GetActiveWindow
IsWindowVisible
EnumThreadWindows
CharLowerBuffW
WindowFromPoint
GetWindow
GetPropA
GetTabbedTextExtentW
DrawIcon
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
IsClipboardFormatAvailable
CopyImage
MonitorFromWindow
GetMonitorInfoW
SetWindowRgn
EnumChildWindows
GetUpdateRgn
IsZoomed
EnumWindows
SetPropA
CallWindowProcW
UpdateLayeredWindow
ReleaseDC
SetLayeredWindowAttributes
DestroyIcon
DrawIconEx
GetCursorPos
PtInRect
LoadImageW
WaitForInputIdle
SystemParametersInfoW
BringWindowToTop
SetForegroundWindow
SwitchToThisWindow
IsDlgButtonChecked
KillTimer
SetTimer
SetWindowPos
SetWindowTextW
GetParent
ShowWindow
GetWindowLongW
SetWindowLongW
GetDlgItem
SetFocus
GetSystemMetrics
FrameRect
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetWindowTextLengthW
LoadIconW
InvalidateRect
GetDC
GetClientRect
GetWindowRect
FillRect
LoadStringW
GetWindowTextW
PostMessageW
IsWindow
GetClassInfoW
FindWindowExW
GetWindowThreadProcessId
SendMessageTimeoutW
GetDesktopWindow
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
EnableWindow
SetActiveWindow
MessageBoxW
FindWindowW
SendMessageW
SetPropW

gdi32

OffsetViewportOrgEx
StretchDIBits
CreateFontW
GetCharWidthW
GetRgnBox
GetTextColor
GetBkColor
GetTextMetricsW
GetTextExtentPoint32W
DPtoLP
GetMapMode
CombineRgn
SetRectRgn
CreateFontIndirectW
PatBlt
CreateRectRgnIndirect
CreateHatchBrush
CreateSolidBrush
ExtCreatePen
CreatePen
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
GetStockObject
CreatePatternBrush
CreateDIBPatternBrushPt
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
ModifyWorldTransform
SetMapMode
SetViewportOrgEx
Escape
ExtTextOutW
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
SetDIBits
GetBitmapBits
ExtCreateRegion
GetCurrentObject
GetBkMode
SetPixel
StretchBlt
GetDIBits
CreateDIBSection
TextOutW
RectVisible
PtVisible
StartDocW
GetPixel
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
GetObjectW
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
SelectObject
DeleteDC
GetDeviceCaps
CopyMetaFileW
CreateDCW
GetDCOrgEx
GetClipBox
SetTextColor
SetBkColor
CreateBitmap
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetGraphicsMode
SetWorldTransform
ExcludeClipRect
IntersectClipRect
SetViewportExtEx

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW
GetJobW

advapi32

GetAce
CloseServiceHandle
RegQueryValueW
DeleteService
RegOpenKeyW
RegEnumKeyW
RegSetValueW
ControlService
OpenThreadToken
RegEnumKeyExW
RegDeleteKeyW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameW
IsValidSid
RegCreateKeyExW
RegQueryInfoKeyW
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
InitializeAcl
RegQueryValueExW
AddAce
EqualSid
GetSecurityInfo
SetEntriesInAclW
SetSecurityInfo
RegDeleteKeyA
RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyA
CreateServiceW
AdjustTokenPrivileges
LookupPrivilegeValueW
ChangeServiceConfigW
StartServiceW
QueryServiceStatus
OpenProcessToken
CreateProcessAsUserW
RevertToSelf
DuplicateTokenEx
GetTokenInformation
OpenSCManagerW
RegCreateKeyW
RegOpenKeyExW
GetFileSecurityW
SetFileSecurityW
RegQueryValueExA
RegCloseKey
RegDeleteValueW
RegSetValueExW
OpenServiceW

shell32

SHChangeNotify
SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
ord680
SHGetFileInfoW
ExtractIconW
DragFinish
DragQueryFileW
CommandLineToArgvW

shlwapi

PathRemoveBackslashW
StrCmpW
wnsprintfW
PathIsDirectoryW
PathRemoveFileSpecW
PathAddBackslashW
PathAppendW
PathCombineW
SHDeleteValueW
SHSetValueA
SHGetValueW
SHGetValueA
SHSetValueW
PathFileExistsW
StrCmpIW
StrStrIW
StrCmpNW
StrCmpNIW
PathFindFileNameW
StrCpyNW
StrChrW
PathIsURLW
PathFindExtensionW
PathRemoveExtensionW
PathStripToRootW
PathIsUNCW
SHDeleteKeyW

oledlg

OleUIBusyW

ole32

CoInitializeEx
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
StringFromGUID2
CoDisconnectObject
CLSIDFromString
CLSIDFromProgID
CoRegisterClassObject
CoTreatAsClass
StringFromCLSID
CoRevokeClassObject
OleRun
CreateBindCtx
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoUninitialize
CoCreateInstance
OleInitialize
OleUninitialize
CoInitialize
ReleaseStgMedium
CoFreeUnusedLibraries
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CreateStreamOnHGlobal
CoTaskMemAlloc
OleDuplicateData

oleaut32

SysFreeString
SysAllocString
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
VarDateFromStr
SysReAllocStringLen
VarCyFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarBstrFromDate
OleCreateFontIndirect
GetErrorInfo
SetErrorInfo
CreateErrorInfo
OleLoadPicture

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

wininet

InternetCloseHandle
InternetOpenW
InternetOpenUrlW
InternetReadFile

ws2_32

select

msimg32

TransparentBlt
AlphaBlend

comctl32

_TrackMouseEvent

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 360KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 980KB - Virtual size: 980KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dep360.ini
feedback.exe
.exe windows:5 windows x86 arch:x86

0390be6a0585f7742074ad3e32277705

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:63:5c:44:ee:82:48:2f:72:4c:bf:9d:6c:16:87:7e:3a:59:2b:6c
Signer

Actual PE Digest

70:63:5c:44:ee:82:48:2f:72:4c:bf:9d:6c:16:87:7e:3a:59:2b:6c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\building\360project\360sd\branches\beta\Build\x86\feedback.pdb

Imports

kernel32

LocalLock
GetDiskFreeSpaceW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetDriveTypeA
GetFullPathNameA
ResetEvent
CreateSemaphoreW
CreateEventW
WaitForSingleObjectEx
OutputDebugStringA
ReadFileEx
SetThreadPriority
ReleaseSemaphore
SetEvent
GetExitCodeThread
CreateFileA
SetNamedPipeHandleState
QueryPerformanceCounter
WaitForMultipleObjects
UnmapViewOfFile
DuplicateHandle
CreateFileMappingW
MapViewOfFile
GetFileType
GetFileInformationByHandle
GetSystemTime
FileTimeToDosDateTime
GlobalDeleteAtom
GlobalAddAtomA
LoadLibraryExW
DeviceIoControl
SetFilePointer
GetTimeZoneInformation
MoveFileExW
MoveFileW
TerminateProcess
CreateMutexW
GetFileAttributesW
RemoveDirectoryW
GetACP
lstrcmpW
GetLongPathNameW
ExpandEnvironmentStringsW
GetCommandLineW
GetExitCodeProcess
CreateProcessW
TlsGetValue
TlsSetValue
CopyFileW
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
ReadProcessMemory
AreFileApisANSI
QueryDosDeviceW
GetLogicalDriveStringsW
GetDriveTypeW
GetDiskFreeSpaceExW
WritePrivateProfileSectionW
OpenProcess
SetEnvironmentVariableW
GlobalMemoryStatus
ResumeThread
CreateToolhelp32Snapshot
Thread32First
OpenThread
Thread32Next
GetCurrentProcessId
ProcessIdToSessionId
LoadLibraryA
GetModuleHandleA
GetCurrentProcess
TlsFree
GetVersion
GetLastError
ReleaseMutex
FreeResource
FindFirstFileW
SetFileAttributesW
DeleteFileW
FindNextFileW
FindClose
CreateMutexA
GetLocalTime
SystemTimeToFileTime
FileTimeToSystemTime
MultiByteToWideChar
InterlockedCompareExchange
LoadLibraryW
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTempPathW
GetPrivateProfileStringW
GetFileAttributesExW
GetTempFileNameW
Sleep
WideCharToMultiByte
WriteFile
GetModuleHandleW
GetProcAddress
GetSystemInfo
lstrcmpiW
InterlockedExchange
SuspendThread
GetPrivateProfileIntW
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetWindowsDirectoryW
CreateDirectoryW
GetVersionExW
CreateFileW
GetFileSize
ReadFile
InterlockedDecrement
InterlockedIncrement
lstrlenW
CreateThread
GetModuleFileNameW
GetTickCount
WaitForSingleObject
TerminateThread
CloseHandle
SetLastError
MulDiv
LocalFree
FormatMessageW
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GlobalFree
GetVersionExA
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
GetCurrentThreadId
GetStringTypeExW
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetVolumeInformationW
GetFullPathNameW
GetShortPathNameW
CompareStringA
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
LocalAlloc
GlobalReAlloc
GlobalHandle
TlsAlloc
LocalReAlloc
GlobalFlags
GlobalGetAtomNameW
GetAtomNameW
lstrlenA
SetErrorMode
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SetFileTime
GetFileSizeEx
GetFileTime
GetCurrentDirectoryW
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
ExitThread
HeapReAlloc
HeapAlloc
HeapFree
ExitProcess
HeapSize
VirtualProtect
VirtualAlloc
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
FatalAppExitA
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetProcessHeap
lstrcpynW
SetFilePointerEx
OutputDebugStringW
AddAtomW
FindAtomW
DeleteAtom
FindResourceW
LoadResource
LockResource
LocalUnlock
SizeofResource

user32

ClientToScreen
GetWindowDC
BeginPaint
EndPaint
InflateRect
GetCursorPos
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamW
GetDesktopWindow
CharUpperW
ValidateRect
GetMessageW
SetCursor
ShowOwnedPopups
MapDialogRect
SetWindowContextHelpId
GetSysColorBrush
LoadCursorW
GetMenuItemInfoW
DestroyMenu
GetDialogBaseUnits
UnregisterClassW
DeleteMenu
DestroyIcon
CharNextW
IsRectEmpty
SetRect
CopyAcceleratorTableW
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
SetRectEmpty
RegisterClipboardFormatW
TranslateAcceleratorW
CreatePopupMenu
InsertMenuItemW
LoadAcceleratorsW
GetMenuBarInfo
ReuseDDElParam
UnpackDDElParam
PostThreadMessageW
GetSystemMenu
SetParent
UnionRect
GetDCEx
LockWindowUpdate
GetUpdateRgn
CopyImage
IsClipboardFormatAvailable
CloseClipboard
GetClipboardData
OpenClipboard
SetClipboardData
EmptyClipboard
IsZoomed
EnumChildWindows
SetWindowRgn
GetMonitorInfoW
MonitorFromWindow
EnumWindows
DrawIcon
DrawIconEx
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
SendMessageW
RegisterWindowMessageW
SetTimer
PostMessageW
EnableWindow
DestroyWindow
GetTabbedTextExtentW
FrameRect
GetClientRect
InvalidateRect
GetSystemMetrics
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
GetWindowThreadProcessId
MapVirtualKeyW
GetKeyNameTextW
LoadMenuW
ScrollWindowEx
MoveWindow
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetParent
GetDlgItem
SetWindowTextW
AppendMenuW
SetFocus
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
GetPropA
SetPropA
CallWindowProcW
UpdateLayeredWindow
SetLayeredWindowAttributes
LoadStringW
EnumThreadWindows
CharLowerBuffW
SendMessageTimeoutW
SwitchToThisWindow
SystemParametersInfoW
WindowFromPoint
WaitForInputIdle
FindWindowW
IsIconic
BringWindowToTop
SetForegroundWindow
GetClassInfoW
IsWindowEnabled
GetActiveWindow
SetActiveWindow
GetWindowLongW
SetWindowLongW
GetWindow
IsWindowVisible
ReleaseCapture
SetCapture
OffsetRect
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
SetWindowPos
GetMenuStringW
GetMenuState
GetWindowPlacement
GetSysColor
IsWindow
GetDC
ReleaseDC
LoadImageW
PostQuitMessage
LoadIconW
KillTimer
ShowWindow
GetWindowRect
RemovePropW
GetFocus
GetWindowTextLengthW
GetWindowTextW
SystemParametersInfoA
IntersectRect
GetMenu
PtInRect
CopyRect
DefWindowProcW
GetDlgCtrlID
SetWindowPlacement
SetScrollInfo
GetScrollInfo
DeferWindowPos
EqualRect
ScreenToClient
AdjustWindowRectEx
RegisterClassW
GetClassInfoExW
CreateWindowExW
MessageBoxW
UpdateWindow
ShowScrollBar
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
SetMenu
GetKeyState
TrackPopupMenu
TrackPopupMenuEx
ScrollWindow
MapWindowPoints
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMenuItemID

gdi32

SelectClipPath
GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocW
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
PatBlt
CreateRectRgnIndirect
BitBlt
GetTextExtentPoint32W
RectInRegion
DeleteObject
CreateRectRgn
CreateCompatibleDC
SetArcDirection
SelectObject
SetStretchBltMode
StretchBlt
DeleteDC
ExtSelectClipRgn
CreateDIBPatternBrushPt
CreatePatternBrush
GetStockObject
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CreateFontIndirectW
SetRectRgn
CombineRgn
GetMapMode
DPtoLP
GetTextMetricsW
GetBkColor
GetTextColor
GetRgnBox
GetCharWidthW
CreateFontW
StretchDIBits
CreateDIBSection
GetDIBits
SetPixel
GetBkMode
GetCurrentObject
SetDIBits
ExtCreateRegion
GetBitmapBits
GetClipRgn
SelectClipRgn
CreateBitmap
SetBkColor
SetTextColor
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
GetClipBox
GetObjectW
SetColorAdjustment
GetDCOrgEx
CreateDCW
CopyMetaFileW
CreateCompatibleBitmap
SetMapperFlags
GetDeviceCaps

advapi32

GetFileSecurityW
RegEnumKeyExW
RegQueryValueExA
RegCreateKeyW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
SetFileSecurityW
RegOpenKeyW
RegSetValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
EqualSid
IsValidSid
FreeSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegDeleteValueW
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

CommandLineToArgvW
SHGetFolderPathW
SHChangeNotify
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFileInfoW
ExtractIconW
DragFinish
DragQueryFileW
ShellExecuteW

ole32

StringFromGUID2
CoDisconnectObject
CLSIDFromString
CLSIDFromProgID
CoInitializeEx
OleDuplicateData
CoTreatAsClass
StringFromCLSID
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
StgCreateDocfileOnILockBytes
ReadFmtUserTypeStg
OleRegGetUserType
CoGetClassObject
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CreateILockBytesOnHGlobal
OleRun
OleUninitialize
CoFreeUnusedLibraries
CoUninitialize
CoCreateInstance
CoInitialize
IIDFromString
OleInitialize
CoRegisterClassObject
WriteClassStg
StgOpenStorageOnILockBytes
CoRevokeClassObject
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
ReadClassStg
CreateStreamOnHGlobal

oleaut32

SysAllocStringByteLen
OleLoadPicture
CreateErrorInfo
SetErrorInfo
GetErrorInfo
OleCreateFontIndirect
VarBstrFromDate
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarCyFromStr
SysReAllocStringLen
VarDateFromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
SysStringByteLen
SysAllocStringLen
VariantChangeType
VariantCopy
VariantInit
VariantClear
SysAllocString
SysFreeString
SysStringLen

shlwapi

PathIsDirectoryW
PathFileExistsW
StrStrIW
SHGetValueW
StrCmpIW
PathFindExtensionW
StrCmpW
PathAppendW
PathRemoveFileSpecW
SHSetValueW
StrCmpNW
SHDeleteValueW
SHDeleteKeyW
StrCmpNIW
PathAddBackslashW
PathCombineW
PathRemoveExtensionW
PathStripToRootW
PathIsUNCW
PathFindFileNameW

oledlg

OleUIBusyW

ws2_32

select

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

winspool.drv

OpenPrinterW
GetJobW
DocumentPropertiesW
ClosePrinter

comdlg32

GetFileTitleW

msimg32

TransparentBlt
AlphaBlend

comctl32

_TrackMouseEvent

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 316KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
fr1.dat
fr2.dat
fr3.dat
fr4.dat
fr5.dat
guardconfig.dat
ico_info_big.png
.png
immplugin/AntiInstall.dat
immplugin/DllHijack.dat
immplugin/ProcTip.dat
immplugin/adr.dat
immplugin/adr.run
immplugin/atrs.dat
immplugin/omr.dat
immplugin/procr.dat
libwhite.dat
model/malware.02.mdf
model/malware.03.mdf
model/malware.04.mdf
model/malware.08.mdf
model/malware.09.mdf
model/malware.12.mdf
model/malware.13.mdf
model/malware.131078.mdf
model/malware.131082.mdf
model/malware.131098.mdf
model/malware.131102.mdf
model/malware.131113.mdf
model/malware.131114.mdf
model/malware.14.mdf
model/malware.15.mdf
model/malware.16.mdf
model/malware.17.mdf
model/malware.196614.mdf
model/malware.196650.mdf
model/malware.22.mdf
model/malware.23.mdf
model/malware.24.mdf
model/malware.25.mdf
model/malware.27.mdf
model/malware.28.mdf
model/malware.29.mdf
model/malware.32.mdf
model/malware.33.mdf
model/malware.34.mdf
model/malware.35.mdf
model/malware.36.mdf
model/malware.37.mdf
model/malware.38.mdf
model/malware.42.mdf
model/malware.65536.mdf
model/malware.65537.mdf
model/malware.65541.mdf
model/malware.65542.mdf
model/malware.65543.mdf
model/malware.65546.mdf
model/malware.65547.mdf
model/malware.65554.mdf
model/malware.65555.mdf
model/malware.65556.mdf
model/malware.65557.mdf
model/malware.65559.mdf
model/malware.65562.mdf
model/malware.65566.mdf
model/malware.65567.mdf
model/malware.65575.mdf
model/malware.65576.mdf
model/malware.65577.mdf
model/malware.65578.mdf
model/update.txt
msgCenter_0.db
.xml
patt.enc
plave.def
ptype.dat
qex.vdb.enc
qexvmmodel/malware.06.mdf
qexvmmodel/malware.18.mdf
repair.exe
.exe windows:5 windows x86 arch:x86

b493944eedbd926b8f77ff3647384b0b

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:72:48:64:37:0e:11:d4:47:c3:1f:24:6b:3a:53:2a:dd:73:59:33:8c:cc:61:f7:21:fd:73:4c:49:82:92:4c
Signer

Actual PE Digest

25:72:48:64:37:0e:11:d4:47:c3:1f:24:6b:3a:53:2a:dd:73:59:33:8c:cc:61:f7:21:fd:73:4c:49:82:92:4c

Digest Algorithm

sha256

PE Digest Matches

true

6f:65:92:bd:49:0c:e1:64:42:9d:4b:c0:1e:69:54:0f:58:76:7d:a1
Signer

Actual PE Digest

6f:65:92:bd:49:0c:e1:64:42:9d:4b:c0:1e:69:54:0f:58:76:7d:a1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\301811\out\Release\360Inst.pdb

Imports

shlwapi

UrlCanonicalizeW
UrlCanonicalizeA
StrStrIW
wvnsprintfW
PathFindFileNameW
SHGetValueW
PathAppendW
PathCombineA
PathIsRootW
PathCombineW
PathRemoveFileSpecW
PathFileExistsW
SHGetValueA
PathIsDirectoryW
SHSetValueA

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

GetCurrentThreadId
InterlockedIncrement
DebugBreak
OutputDebugStringW
lstrlenA
GetTempFileNameW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
GetTickCount
GetExitCodeThread
ResumeThread
GetFileSize
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrcmpiW
FreeLibrary
MultiByteToWideChar
LoadLibraryExW
GetModuleHandleW
CreateMutexW
MulDiv
GetProcAddress
GetVersionExW
GetDiskFreeSpaceExW
GlobalFree
GlobalLock
GlobalAlloc
GetFileSizeEx
GetPrivateProfileStringW
GetPrivateProfileIntW
GetFileAttributesExW
GetExitCodeProcess
TerminateProcess
Module32FirstW
GetSystemDirectoryW
CopyFileW
OpenProcess
WideCharToMultiByte
GlobalFindAtomW
TlsSetValue
TlsGetValue
TlsAlloc
WaitForSingleObject
SetEvent
CreateThread
CreateEventW
GetFileType
GetLongPathNameW
GetDriveTypeW
InterlockedCompareExchange
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
CreateToolhelp32Snapshot
PeekNamedPipe
GetFileInformationByHandle
LCMapStringW
FindFirstFileW
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
GetStdHandle
HeapSize
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FileTimeToLocalFileTime
FileTimeToSystemTime
HeapReAlloc
GetStartupInfoW
ExitProcess
IsDebuggerPresent
UnhandledExceptionFilter
ExitThread
RtlUnwind
lstrcmpiA
lstrcmpA
GetSystemDirectoryA
GetModuleHandleA
QueryPerformanceFrequency
GetFileAttributesW
QueryPerformanceCounter
ResetEvent
GetUserDefaultLangID
MoveFileW
InterlockedExchangeAdd
FreeLibraryAndExitThread
GetModuleHandleExW
GetLocalTime
CreateWaitableTimerW
SetWaitableTimer
CreateSemaphoreW
WaitForMultipleObjects
ReleaseSemaphore
TlsFree
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
GetFullPathNameW
SetLastError
FindResourceW
LoadResource
SizeofResource
LockResource
WriteFile
FlushFileBuffers
GlobalUnlock
FreeResource
SetErrorMode
SetUnhandledExceptionFilter
Sleep
DeleteFileW
MoveFileExW
ReadFile
SetFilePointer
GetCurrentProcessId
CreateFileW
DeviceIoControl
LoadLibraryW
FindClose
FindNextFileW
InterlockedDecrement
GetCurrentProcess
FlushInstructionCache
lstrlenW
Process32FirstW
CloseHandle
Process32NextW
RemoveDirectoryW
LeaveCriticalSection
EnterCriticalSection
RaiseException
InterlockedExchange
SetEnvironmentVariableA
GetDriveTypeA
CompareStringA
LCMapStringA
lstrcpyW
CompareStringW
GetCurrentDirectoryA

user32

CharLowerW
CharNextW
DialogBoxParamW
GetActiveWindow
DestroyWindow
DispatchMessageW
DrawStateW
CallWindowProcW
GetClientRect
InvalidateRect
IsWindowEnabled
CopyRect
MessageBoxW
LoadStringW
PtInRect
OffsetRect
SetForegroundWindow
LoadCursorW
GetWindowTextW
GetDC
ReleaseDC
GetWindowLongW
EndDialog
ShowWindow
SendMessageW
SetWindowLongW
wvsprintfW
PostMessageW
CreateWindowExW
SetWindowTextW
SetWindowPos
GetClassNameW
GetDlgCtrlID
PeekMessageW
GetMessageW
SetCursor
TranslateMessage
UnregisterClassA
UnregisterClassW
wsprintfW
CallNextHookEx
UnhookWindowsHookEx
CheckDlgButton
SetWindowsHookExW
IsDlgButtonChecked
GetDlgItemTextW
CreateDialogParamW
DefWindowProcW
GetDesktopWindow
GetFocus
InflateRect
MoveWindow
SetScrollInfo
ShowScrollBar
SetScrollPos
GetScrollRange
GetScrollPos
SetFocus
GetScrollInfo
GetCursorPos
GetSystemMenu
DestroyMenu
EnableMenuItem
FindWindowExW
LoadIconW
PostQuitMessage
IsDialogMessageW
UpdateWindow
GetWindowPlacement
BringWindowToTop
KillTimer
RegisterClassExW
EnableWindow
GetClassInfoExW
IsIconic
ExitWindowsEx
GetSysColor
SetDlgItemTextW
SetTimer
CharUpperW
DrawTextW
GetSystemMetrics
LoadImageW
EndPaint
BeginPaint
LoadBitmapW
GetWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
IsWindow
SetWindowRgn
GetDlgItem
GetParent
RedrawWindow
IsWindowVisible
ScreenToClient
GetWindowRect

gdi32

CreateSolidBrush
GetDeviceCaps
GetBitmapBits
SetBitmapBits
CreateRectRgn
ExtSelectClipRgn
CreateFontIndirectW
CreateRoundRectRgn
CreateFontW
SetTextColor
SetBkMode
CreateCompatibleBitmap
BitBlt
SelectObject
CreateCompatibleDC
GetTextExtentPoint32W
RestoreDC
SaveDC
DeleteDC
DeleteObject
GetObjectW

advapi32

AdjustTokenPrivileges
RegDeleteValueW
RegCloseKey
RegQueryValueExA
RegQueryValueExW
RegOpenKeyW
RegNotifyChangeKeyValue
RegCreateKeyExA
RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
OpenProcessToken
LookupPrivilegeValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHBrowseForFolderW
Shell_NotifyIconW
ShellExecuteExW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHCreateDirectoryExW

ole32

CoCreateInstance
OleRun
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitialize
CreateStreamOnHGlobal
CLSIDFromProgID

oleaut32

VariantChangeType
GetErrorInfo
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SysFreeString
OleLoadPicture
VariantInit
VariantClear
SysAllocString
VarUI4FromStr

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

AlphaBlend
TransparentBlt

ws2_32

accept
WSAAsyncSelect
WSACancelAsyncRequest
WSAAsyncGetHostByName
__WSAFDIsSet
ioctlsocket
listen
shutdown
getpeername
WSASetLastError
sendto
recvfrom
bind
WSAGetLastError
WSCEnumProtocols
ntohs
htonl
ntohl
inet_ntoa
select
gethostname
socket
htons
connect
closesocket
setsockopt
send
recv
gethostbyname
inet_addr
WSAStartup
WSACleanup

setupapi

SetupIterateCabinetW

wininet

InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetOpenUrlW
InternetCloseHandle
HttpQueryInfoW
InternetErrorDlg
InternetOpenW

psapi

GetModuleFileNameExW
EnumProcessModules

iphlpapi

GetNetworkParams
GetAdaptersInfo

secur32

InitializeSecurityContextA
FreeCredentialsHandle
AcquireCredentialsHandleA

rasapi32

RasGetConnectStatusW
RasEnumConnectionsW

Sections

.text
Size: 755KB - Virtual size: 754KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
safeup/safemon/SdAdBlock.tpi
.dll windows:5 windows x86 arch:x86

bfebd01cc93d38039e37a91ba8d4bc4f

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

42:2f:9c:f0:24:4b:bb:ce:5e:ef:20:c4:c4:80:77:20
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

14-04-2017 05:58

Not After

14-06-2020 05:58

Subject

CN=北京欣和智成科技有限公司,O=北京欣和智成科技有限公司,L=北京市,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-11-2014 00:58

Not After

08-11-2029 00:58

Subject

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:12:6b:44:ac:b9:78:1b:8e:c0:a8:a1:f9:a9:b8:4c:3e:a0:5f:09
Signer

Actual PE Digest

4d:12:6b:44:ac:b9:78:1b:8e:c0:a8:a1:f9:a9:b8:4c:3e:a0:5f:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\186837\out\Release\SdAdBlock.pdb

Imports

kernel32

CreateDirectoryW
GetTickCount
FreeLibrary
TlsFree
TlsGetValue
TlsSetValue
Sleep
ReleaseMutex
GetLastError
GetCurrentProcess
OpenProcess
LoadLibraryA
WideCharToMultiByte
MultiByteToWideChar
GetACP
GetCurrentProcessId
OpenThread
WaitForSingleObject
CreateMutexW
SystemTimeToFileTime
FileTimeToSystemTime
TerminateProcess
lstrlenW
ExpandEnvironmentStringsW
SetFilePointer
OutputDebugStringW
DeviceIoControl
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThread
SetLastError
GetSystemTime
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
RaiseException
LoadLibraryExW
GetProcessTimes
WaitForMultipleObjects
CreateEventW
SetEvent
CompareFileTime
GetLocalTime
GetPrivateProfileSectionNamesW
DeleteAtom
FindAtomW
AddAtomW
GetPrivateProfileIntW
LocalFree
FormatMessageW
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTempPathW
WritePrivateProfileStringW
GetPrivateProfileStringW
WriteFile
CloseHandle
ReadFile
GetFileSize
CreateFileW
GetFileAttributesExW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetLongPathNameW
GetModuleFileNameW
DeleteFileW
GetWindowsDirectoryW
LoadLibraryW
GetModuleHandleW
GetProcAddress
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
HeapCreate
VirtualAlloc
VirtualFree
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
ExitProcess
TlsAlloc
RtlUnwind
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateThread
GetCurrentThreadId
GetAtomNameW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetSystemTimeAsFileTime
ExitThread

user32

SendMessageTimeoutW
GetSystemMetrics
GetWindowRect
FindWindowW
GetForegroundWindow
CharNextW
IsWindowVisible
GetWindowThreadProcessId

advapi32

RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
OpenThreadToken
LookupPrivilegeValueW
RegQueryInfoKeyW
AdjustTokenPrivileges
OpenProcessToken
RegDeleteValueW
RegQueryValueExA
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetSpecialFolderPathW

ole32

CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SysAllocStringLen
VarUI4FromStr
SysFreeString
SysAllocString

shlwapi

StrStrIW
PathFileExistsW
StrCmpIW
PathCombineW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Exports

Exports

CreateTrayClient

Sections

.text
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
savapi/url_count.txt
savapi/wdbqvm.wl
sdUninst.dll
.dll windows:5 windows x86 arch:x86

04d400ba8a046cbaadc43d21f34487dc

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05-05-2015 00:00

Not After

31-12-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

00:fc:8c:ca:26:a6:d2:ba:63:81:3f:ad:71:cf:79:63:1c:a4:89:46
Signer

Actual PE Digest

00:fc:8c:ca:26:a6:d2:ba:63:81:3f:ad:71:cf:79:63:1c:a4:89:46

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\44623\out\Release\sdUninst.pdb

Imports

shlwapi

SHDeleteKeyW
PathFileExistsW

kernel32

CreateFileW
ReadFile
CloseHandle
WriteFile
GetTempPathW
RemoveDirectoryW
WideCharToMultiByte
GetCurrentProcessId
GetTickCount
CreateDirectoryW
FreeLibrary
TlsFree
TlsGetValue
TlsSetValue
Sleep
CopyFileW
MoveFileExW
ReleaseMutex
GetLastError
GetCurrentProcess
LoadLibraryA
MultiByteToWideChar
GetACP
OpenThread
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
CreateMutexW
SystemTimeToFileTime
TerminateProcess
SetFilePointer
OutputDebugStringW
DeviceIoControl
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLocalTime
GetTempFileNameW
DeleteAtom
FindAtomW
AddAtomW
GetAtomNameW
GetSystemTime
LocalFree
FormatMessageW
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
FlushFileBuffers
CreateFileA
WriteConsoleW
DeleteFileW
LoadLibraryW
GetModuleHandleW
GetProcAddress
VirtualFree
VirtualAlloc
HeapCreate
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
ExitProcess
InterlockedDecrement
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetLastError
InterlockedIncrement
TlsAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
GetSystemTimeAsFileTime
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RtlUnwind
GetConsoleCP

user32

IsWindow
FindWindowW
LoadStringW
SendMessageW
MessageBoxW

advapi32

RegQueryValueExA
RegQueryValueExW
RegEnumValueW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegOpenKeyExW

Exports

Exports

Dep360_Uninst
UnRegSDDLL
UninstEnd_360safe
UninstEnd_RegDelete
UninstPre_360safe

Sections

.text
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sdrpi.dat
sdskin/360FileGuard.uic
sdskin/Default.uic
sdskin/banner.png
.png
sdskin/bk.jpg
.jpg
sdskin/defence/appwiz_guide_win7.png
.png
sdskin/defence/appwiz_guide_xp.png
.png
sdskin/defence/findoav_detail.png
.png
sdskin/defence/keepsd_guide.png
.png
sdskin/feedback.uic
sdskin/themes/QMSkin.ui
.zip
Common/image/scrollv/background.png
.png
Common/image/scrollv/thumb.png
.png
Common/image/scrollv/thumbgripper.png
.png
Common/xml/CommonResource.xml
image/Btn.png
.png
image/BtnBlue.png
.png
image/BtnWhite.png
.png
image/MainWnd.png
.png
image/Unknown.png
.png
image/add_child.png
.png
image/btn_search.png
.png
image/btn_support.png
.png
image/checkbox.png
.png
image/close.png
.png
image/complete.png
.png
image/img_item_logo_bho.png
.png
image/img_item_logo_cpu.png
.png
image/img_item_logo_dns.png
.png
image/img_item_logo_flux.png
.png
image/img_item_logo_hd.png
.png
image/img_item_logo_io.png
.png
image/img_item_logo_mem.png
.png
image/item_line_dot.png
.png
image/item_logo_sample.png
.png
image/listcap.png
.png
image/loading.png
.png
image/logo.png
.png
image/logo_mini.png
.png
image/menu.png
.png
image/min.png
.png
image/msg.png
.png
image/msg_error.png
.png
image/msg_info.png
.png
image/msg_ok.png
.png
image/msg_ques.png
.png
image/msg_warning.png
.png
image/quart.png
.png
image/remove_child.png
.png
image/scanning.png
.png
image/window_shadow.png
.png
theme.xml
xml/ItemListWnd.xml
xml/ItemListWnd_id.h
xml/MainWnd.xml
xml/MainWnd_id.h
xml/MsgWnd.xml
xml/MsgWnd_id.h
xml/Quart.xml
xml/Quart_id.h
sdskin/themes/theme.xml
sdsp/360procmon.dll
.dll windows:4 windows x86 arch:x86

2950599686ff9c2b3661b33d3074e021

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

da:69:aa:65:a8:7d:2a:52:96:45:6c:9a:c6:92:11:f7:06:4e:3f:ae
Signer

Actual PE Digest

da:69:aa:65:a8:7d:2a:52:96:45:6c:9a:c6:92:11:f7:06:4e:3f:ae

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateEventW
CreateSemaphoreW
WaitForSingleObject
SetEvent
ReleaseSemaphore
ResetEvent
GetCurrentThreadId
lstrlenA
DebugBreak
OutputDebugStringW
FlushInstructionCache
WideCharToMultiByte
Sleep
DeleteFileW
IsBadReadPtr
MoveFileExW
MultiByteToWideChar
GlobalFree
SystemTimeToFileTime
GetSystemTime
GlobalAlloc
GetPrivateProfileIntW
InterlockedIncrement
MoveFileW
WritePrivateProfileStringW
FlushFileBuffers
GlobalFindAtomW
DeviceIoControl
GetCurrentProcessId
lstrcmpA
GetCommandLineW
InterlockedDecrement
GetSystemWindowsDirectoryW
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetModuleHandleA
GetSystemInfo
OpenProcess
LocalFree
FormatMessageW
GetACP
CreateMutexW
ReleaseMutex
HeapFree
TlsFree
SetEnvironmentVariableW
TlsAlloc
GetCurrentProcess
CopyFileW
GetModuleHandleW
GetVersionExW
SetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
QueryDosDeviceW
GetPrivateProfileStringW
GetLongPathNameW
GetWindowsDirectoryW
GetSystemDirectoryW
GetTempPathW
lstrlenW
GetFileAttributesExW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSection
GetLastError
WriteFile
CreateFileW
GetFileSize
ReadFile
SetFilePointer
CloseHandle
InterlockedCompareExchange
GetSystemTimeAsFileTime
CreateFileA
LocalFileTimeToFileTime
HeapAlloc
SetFilePointerEx
GetFileSizeEx
TlsGetValue
OpenThread
TlsSetValue
GetEnvironmentVariableW
GetProcessHeap
GetFileType

user32

LoadImageW
CharNextW
GetWindowRect
SetWindowPos
GetSystemMetrics
DialogBoxParamW
GetActiveWindow
SetWindowLongW
FindWindowW
IsDlgButtonChecked
CheckDlgButton
GetWindowLongW
GetWindow
SystemParametersInfoW
GetClientRect
MapWindowPoints
LoadStringW
EndDialog
GetDlgItem
SendMessageW
GetParent
wvsprintfW

gdi32

CreateFontIndirectW
GetObjectW
GetStockObject
SetTextColor
DeleteObject
SetBkMode

advapi32

RegEnumKeyExW
RegQueryValueExA
RegOpenKeyExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
DeleteService
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegCloseKey

shell32

SHFileOperationW
SHGetSpecialFolderPathW

oleaut32

SysAllocString
SysStringLen
VariantCopy
VariantClear
SysFreeString

shlwapi

SHDeleteValueW
SHDeleteKeyW
SHSetValueW
SHGetValueW
PathIsDirectoryW
PathCombineW
StrCmpNW
PathRemoveBackslashW
StrChrW
StrCmpNIW
PathFindFileNameW
StrCpyNW
StrCmpIW
PathStripToRootW
PathFileExistsW
PathRemoveFileSpecW
PathAppendW
StrStrIW

msvcrt

_wcsnicmp
wcsncmp
wcscmp
_CxxThrowException
wcsncpy
wcscpy
memset
??2@YAPAXI@Z
__CxxFrameHandler
memcpy
_wcsicmp
free
malloc
wcslen
_stricmp
strrchr
wcschr
wcstoul
_vsnwprintf
_purecall
_beginthreadex
realloc
memmove
iswdigit
_wtoi
wcsstr
ftell
fclose
fread
fseek
_wfopen
memcmp
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_initterm
_adjust_fdiv
_errno
wcstok
strerror
wcsrchr
_snwprintf
swprintf
strncpy
qsort
memchr
_wcslwr
swscanf
tolower
wcscat
_vsnprintf
??1type_info@@UAE@XZ

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

urlmon

URLDownloadToCacheFileW

crypt32

CryptMsgUpdate
CertGetNameStringW
CertGetCertificateContextProperty
CertOpenStore
CryptMsgClose
CertCloseStore
CryptMsgOpenToDecode

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData

Exports

Exports

AddRuleTFW
BuildAndLoadRuleFile
CheckSpStatus
CreateTrayClient
GetLogFileName
GetRuleInfo
GetSPStateEx
InstallCall
OffSelfProtect
OffSelfProtectEx
UninstallCall

Sections

.text
Size: 128KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sdsp/EfiProc.dll
.dll windows:5 windows x86 arch:x86

419d96beaf9da13f857c4ce7220894ea

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

64:58:da:f2:31:2d:ab:15:10:bb:57:66:53:72:81:c3:11:e5:76:2e
Signer

Actual PE Digest

64:58:da:f2:31:2d:ab:15:10:bb:57:66:53:72:81:c3:11:e5:76:2e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
OutputDebugStringA
CreateToolhelp32Snapshot
DeviceIoControl
Process32Next
LoadLibraryA
GetProcAddress
lstrcmpiA
GetLastError
Process32First
GetCurrentProcess
CreateFileA
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA

advapi32

DeleteService
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyA
OpenSCManagerA
RegDeleteValueA
StartServiceW
LookupPrivilegeValueA
RegCreateKeyA
RegDeleteKeyW
RegDeleteKeyA
RegOpenKeyW
CreateServiceW
OpenServiceA
CloseServiceHandle
OpenProcessToken
OpenSCManagerW
RegCreateKeyW
RegSetValueExA

shlwapi

SHGetValueA
PathFileExistsA
SHDeleteKeyA
PathCombineA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Exports

Exports

EfiLoadBitmap
EfiUnloadBitmap

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sdsp/SelfProtectAPI2.dll
.dll windows:5 windows x86 arch:x86

502b9f9bf8101aa2b8066f692d3d43c8

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a3:89:20:e4:12:9c:65:18:a2:1a:19:3e:07:20:8a:7d:85:ea:f7:2a
Signer

Actual PE Digest

a3:89:20:e4:12:9c:65:18:a2:1a:19:3e:07:20:8a:7d:85:ea:f7:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WaitForSingleObject
SetEvent
ReadFile
GetFileSize
GetOverlappedResult
GetLastError
CreateEventW
CreateThread
InitializeCriticalSection
GetTickCount
GetFileInformationByHandle
GetVersion
CloseHandle
GetSystemInfo
OpenThread
GetModuleFileNameW
GetModuleHandleW
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
FlushFileBuffers
GetConsoleMode
DeviceIoControl
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
GetProcAddress
GetSystemDirectoryW
RemoveDirectoryW
CopyFileW
DeleteFileW
MoveFileW
lstrlenW
OpenProcess
GetCurrentProcess
GetConsoleCP
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
HeapFree
HeapAlloc
RaiseException
RtlUnwind
GetCurrentThreadId
GetCommandLineA
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize

advapi32

RegQueryValueExW
RegCreateKeyExW
RegCloseKey
OpenSCManagerW
OpenServiceW
CloseServiceHandle
DeleteService
RegSetValueExW

shlwapi

PathRemoveFileSpecW
PathIsDirectoryW
PathCombineW
PathFileExistsW
PathAppendW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

EnumProcessModules
GetModuleInformation
GetModuleFileNameExW

Exports

Exports

APICreateObjectSelfProc
APIDisableSendInput
APIEnableSendInput

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sites.dll
.dll regsvr32 windows:5 windows x86 arch:x86

429cdbff1454d0ef8e1fe1910059d97b

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d9:a4:ca:51:1c:53:60:8e:b6:c9:25:51:29:ef:33:72:f8:68:9e:5b
Signer

Actual PE Digest

d9:a4:ca:51:1c:53:60:8e:b6:c9:25:51:29:ef:33:72:f8:68:9e:5b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\build\sites\Release\sites.pdb

Imports

gdiplus

GdipGetImageHeight
GdipCreateSolidFill
GdipCreateLineBrushFromRect
GdipCreateLineBrushFromRectI
GdipCreateFromHDC
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipGetImageWidth
GdipCreatePen1
GdipCreateBitmapFromHBITMAP
GdipDrawImagePointsI
GdipCreateFontFromLogfontW
GdipMeasureString
GdipFillRectangle
GdipCreateRegionRectI
GdipDeleteGraphics
GdipSetPixelOffsetMode
GdipDeletePen
GdipFillRegion
GdipCombineRegionPath
GdipAlloc
GdipFree
GdipDeleteBrush
GdipDrawImagePointRectI
GdipDeleteRegion
GdipSetLineWrapMode
GdipGetPixelOffsetMode
GdipDrawLineI
GdipAddPathLine2I
GdipSetPenColor
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawString
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteFont
GdipDeleteStringFormat
GdipCreateStringFormat
GdipSetLineBlend
GdipRestoreGraphics
GdipSaveGraphics
GdipReleaseDC
GdipGetDC
GdipDeleteCachedBitmap
GdipCreateCachedBitmap
GdipSetPathGradientFocusScales
GdipCreatePen2
GdipCloneImage
GdipResetClip
GdipSetClipPath
GdipCreateHBITMAPFromBitmap
GdipFillPath
GdipGraphicsClear
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipGetImageGraphicsContext
GdipCreatePathGradientFromPath
GdipAddPathEllipse
GdipAddPathRectangleI
GdipAddPathCurveI
GdipAddPathArcI
GdipAddPathLineI
GdipClosePathFigure
GdipCreateLineBrushFromRectWithAngleI
GdipSetImageAttributesGamma
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipDisposeImage
GdipGetPathWorldBounds
GdipSetPathGradientCenterPoint
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipSetLinePresetBlend
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdiplusStartup
GdipDrawPath
GdipDeletePath
GdipCreatePath
GdipFillPolygonI
GdipCloneBrush
GdipDrawImageRectRectI
GdipDrawImageRectI
GdipFillEllipseI
GdipFillRectangleI
GdipDrawEllipseI
GdipDrawRectangleI

imm32

ImmDisableIME
ImmReleaseContext

kernel32

CreateMutexW
GetSystemTime
FormatMessageW
OutputDebugStringW
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
InterlockedExchange
VirtualAlloc
TlsGetValue
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
InterlockedCompareExchange
OpenThread
AddAtomW
ReleaseMutex
TlsAlloc
WriteConsoleW
TlsSetValue
VirtualFree
GetAtomNameW
lstrlenW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetModuleHandleW
lstrcmpiW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
lstrlenA
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
MulDiv
LoadLibraryW
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
FindAtomW
GetLongPathNameW
GetCurrentProcessId
FindNextFileW
FindClose
GetVersionExW
GetFullPathNameW
FindFirstFileW
GetCurrentDirectoryW
GlobalFree
GlobalAlloc
CloseHandle
ReadFile
GetFileSizeEx
CreateFileW
GlobalUnlock
GlobalLock
FreeResource
LockResource
WideCharToMultiByte
GetTickCount
DeviceIoControl
SetThreadLocale
GetThreadLocale
WriteFile
TerminateThread
WaitForSingleObject
Sleep
FlushFileBuffers
LocalFree
GetFileTime
HeapFree
GetProcessHeap
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
IsValidCodePage
GetOEMCP
DeleteAtom
TlsFree
GetACP
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
VirtualProtect
GetSystemInfo
VirtualQuery
ExitThread
CreateThread
GetCommandLineA
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeW
HeapReAlloc
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameA
HeapSize
SetLastError

user32

GetCursor
wsprintfW
SetCaretPos
ShowCaret
HideCaret
CreateCaret
EnableScrollBar
GetDCEx
DestroyCursor
FrameRect
UpdateLayeredWindow
SetWindowRgn
RegisterWindowMessageW
UnionRect
IsIconic
GetIconInfo
GetSysColor
GetSystemMetrics
GetAsyncKeyState
RegisterClipboardFormatW
SetWindowsHookExW
GetClassNameW
GetClassInfoW
GetKeyState
ReleaseCapture
CharUpperW
GetFocus
DrawFocusRect
FillRect
DrawIconEx
SystemParametersInfoW
FindWindowW
OffsetRect
SetRectEmpty
GetParent
GetWindowRgn
GetWindow
SetCapture
KillTimer
SetTimer
RedrawWindow
GetClientRect
MoveWindow
SendNotifyMessageW
PostMessageW
SendMessageW
UnhookWindowsHookEx
WindowFromPoint
GetCapture
GetWindowThreadProcessId
CallNextHookEx
SetLayeredWindowAttributes
EndPaint
BeginPaint
UpdateWindow
InvalidateRect
IntersectRect
EqualRect
RegisterClassExW
CreateWindowExW
GetClassInfoExW
IsWindowVisible
GetDesktopWindow
SendMessageTimeoutW
SetWindowTextW
GetWindowTextW
EnumChildWindows
PrintWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
EnableWindow
GetMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
OpenClipboard
GetClipboardData
CloseClipboard
ShowWindow
ClientToScreen
GetWindowRect
SetWindowPos
DestroyWindow
GetActiveWindow
MessageBoxW
GetCursorPos
ScreenToClient
LoadCursorW
SetCursor
IsWindow
InflateRect
CopyRect
PtInRect
IsRectEmpty
DrawTextW
GetDC
ReleaseDC
CharLowerW
DefWindowProcW
CallWindowProcW
LoadStringW
SetRect
GetWindowLongW
SetWindowLongW
CharNextW
IsZoomed
ScrollWindowEx
UnregisterClassA
SetFocus

gdi32

BitBlt
CreateCompatibleBitmap
CreateRectRgn
GetRgnBox
SetWindowOrgEx
FrameRgn
Rectangle
CreateSolidBrush
GetStockObject
Polygon
CreateDIBSection
SelectClipRgn
OffsetClipRgn
CreateRectRgnIndirect
GetClipBox
GetObjectA
CreateFontW
SetViewportOrgEx
CombineRgn
PatBlt
SetRectRgn
CreatePatternBrush
CreateBitmap
CreateFontIndirectW
SetStretchBltMode
StretchBlt
SetDIBColorTable
GetCurrentObject
GetTextMetricsW
GetDIBits
SetDIBits
GetTextExtentPoint32W
GetTextColor
SetBkColor
ExtTextOutW
LineTo
MoveToEx
CreatePen
SetTextColor
SetBkMode
GetObjectW
GetDeviceCaps
DeleteObject
DeleteDC
SelectObject
CreateCompatibleDC
EnumFontFamiliesW

advapi32

RegQueryValueExW
RegQueryValueExA
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyW

shell32

ShellExecuteW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
ReleaseStgMedium
CoCreateInstance
CreateStreamOnHGlobal
IIDFromString
CLSIDFromString
RevokeDragDrop
DoDragDrop
OleDuplicateData
RegisterDragDrop
OleInitialize

oleaut32

SysAllocStringLen
VarUI4FromStr
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantInit
VariantClear
VariantChangeType
DispCallFunc
SafeArrayGetVartype
SafeArrayCopy
SafeArrayGetUBound
SysAllocString
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SafeArrayRedim
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
VarBstrCat
VarBstrCmp
VariantCopy
SysFreeString
SafeArrayGetLBound

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathAppendW
PathCombineW
SHGetValueW
PathIsRelativeW
PathRemoveBackslashW
ColorHLSToRGB
ColorRGBToHLS
StrToIntW
PathRelativePathToW
PathIsDirectoryW
PathRemoveExtensionW
StrStrIW
PathFindFileNameW
StrCmpIW

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime
timeGetDevCaps

Exports

Exports

CreateMemoryFile
CreateShadowEdgeInstance
CreateXMLDOMDocument
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetFileDataFromStorage
GetFileLengthFromStorage
IsDesignerMode
SetDefaultResourceInfo
SetDesignerMode
SmartDisableIME

Sections

.text
Size: 746KB - Virtual size: 745KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
speednpepre0.dat
speednpepre1.dat
themes/360restore/commonres.ui
.zip
Common/Image/360logo.ico
Common/Image/checkbox.png
.png
Common/Image/messagebox/Thumbs.db
Common/Image/messagebox/mb_btn_default.png
.png
Common/Image/messagebox/mb_btn_normal.png
.png
Common/Image/messagebox/msg_icon_check.png
.png
Common/Image/messagebox/msg_icon_error.png
.png
Common/Image/messagebox/msg_icon_info.png
.png
Common/Image/messagebox/msg_icon_question.png
.png
Common/Image/messagebox/msg_icon_warning.png
.png
Common/Image/messagebox/msg_icon_warning2.png
.png
Common/Image/radio.png
.png
Common/Image/scrollv/Thumbs.db
Common/Image/scrollv/background.png
.png
Common/Image/scrollv/thumb.png
.png
Common/Image/scrollv/thumbgripper.png
.png
Common/XML/CommonResource.xml
Common/XML/DefaultMessageBox.xml
.xml
MainFrame/Image/background_mainwnd.jpg
.jpg
MainFrame/Image/menu.png
.png
MainFrame/Image/statusbar_fail.png
.png
MainFrame/Image/sub_tabbar_split.png
.png
MainFrame/Image/sys_button_close.png
.png
MainFrame/Image/sys_button_max.png
.png
MainFrame/Image/sys_button_min.png
.png
MainFrame/Image/sys_button_restore.png
.png
skin.jpg
.jpg
window_shadow.png
.png
themes/CleanTip/SdReloc.png
.png
themes/CleanTip/SpeedUp.png
.png
themes/CleanTip/SysClean.png
.png
themes/default/ADMgr/IE.bmp
themes/default/ADMgr/pwlog_theme.ui
.zip
Common/image/scrollv/background.png
.png
Common/image/scrollv/thumb.png
.png
Common/image/scrollv/thumbgripper.png
.png
Common/xml/CommonResource.xml
image/Btn.png
.png
image/Btn_Gray.png
.png
image/bg(min).png
.png
image/bg.png
.png
image/bg_dialog.png
.png
image/bg_main.png
.png
image/btn_tab.png
.png
image/button1.png
.png
image/checkbox.png
.png
image/close.png
.png
image/count_back_2.png
.png
image/delete.png
.png
image/icon_g.png
.png
image/icon_g_w.png
.png
image/icon_r.png
.png
image/icon_r_w.png
.png
image/item_delete.png
.png
image/itembg.png
.png
image/line.png
.png
image/line_nolog.png
.png
image/logo.png
.png
image/min.png
.png
image/msg/msg_error.png
.png
image/msg/msg_info.png
.png
image/msg/msg_ok.png
.png
image/msg/msg_ques.png
.png
image/msg/msg_warning.png
.png
image/msgbox_close.png
.png
image/msgbox_tab_bk.png
.png
image/msgbox_tab_line.png
.png
image/setting.png
.png
image/shadow_bg.png
.png
image/taskbarw10.png
.png
image/taskbarw7.png
.png
image/taskbarxp.png
.png
image/tipbutton.png
.png
image/tipclose.png
.png
image/tipicon1.png
.png
image/tipicon2.png
.png
image/tipicon3.png
.png
image/tipwndbg.png
.png
image/window_shadow.png
.png
theme.xml
xml/Main.xml
xml/Msg.xml
xml/MsgBoxCenter.xml
xml/MsgTipWnd.xml
xml/Resouce.xml
xml/Resource.xml
xml/Setting.xml
themes/default/PopWndTracker/pw_theme.ui
.zip
Common/image/scrollv/background.png
.png
Common/image/scrollv/thumb.png
.png
Common/image/scrollv/thumbgripper.png
.png
Common/xml/CommonResource.xml
image/BG_DNS.png
.png
image/Btn.png
.png
image/DNSbtnoff.png
.png
image/DNSbtnon.png
.png
image/DNSoff.png
.png
image/DNSon.png
.png
image/ICON_DNS.png
.png
image/adhat/ad_icon.png
.png
image/adhat/adhat_bg.png
.png
image/adhat/adhat_bg_s.png
.png
image/adhat/adhatnew_bg.png
.png
image/adhat/btn_block.png
.png
image/adhat/btn_close.png
.png
image/adhat/close.png
.png
image/adhat/setting.png
.png
image/adhat/setting_big.png
.png
image/adhat/window_shadow_.png
.png
image/bang.png
.png
image/bg_children.png
.png
image/bg_detail.png
.png
image/bg_main.png
.png
image/bg_number.png
.png
image/bg_pop.png
.png
image/bg_scan.png
.png
image/bg_table_01_.png
.png
image/bg_table_02_.png
.png
image/btn_ignore.png
.png
image/btn_normal.png
.png
image/btn_off.png
.png
image/btn_on.png
.png
image/btn_se.png
.png
image/btn_small.png
.png
image/btn_strong.png
.png
image/btn_tab.png
.png
image/btn_tab_.png
.png
image/checkbox.png
.png
image/close.png
.png
image/gif.png
.png
image/green.png
.png
image/hand_nums.png
.png
image/handadd.png
.png
image/handadd_item.png
.png
image/handadd_load_text.png
.png
image/handadd_loadb_tn.png
.png
image/handadd_loading.png
.png
image/handadd_loadsmall.png
.png
image/icon_off.png
.png
image/icon_on.png
.png
image/icon_setup.png
.png
image/icon_thumb.png
.png
image/logo_mini.png
.png
image/mid.png
.png
image/min.png
.png
image/mouseadd.png
.png
image/msg/msg_error.png
.png
image/msg/msg_info.png
.png
image/msg/msg_ok.png
.png
image/msg/msg_ques.png
.png
image/msg/msg_warning.png
.png
image/nums.png
.png
image/ok.png
.png
image/pic_line.png
.png
image/pic_popad.png
.png
image/pic_webad.png
.png
image/pot_line.png
.png
image/rb.png
.png
image/recycle.png
.png
image/recycle_no.png
.png
image/recycle_yes.png
.png
image/rmid.png
.png
image/rrb.png
.png
image/rweb.png
.png
image/select.png
.png
image/sina.png
.png
image/sliber_bg.png
.png
image/sliber_pt.png
.png
image/small_icon.png
.png
image/soft_default_icon_16.png
.png
image/soft_default_icon_48.png
.png
image/soft_sel_bg.png
.png
image/soft_sel_mark.png
.png
image/soft_sel_mark_reverse.png
.png
image/table_01.png
.png
image/table_02.png
.png
image/table_03.png
.png
image/table_04.png
.png
image/table_05.png
.png
image/table_06.png
.png
image/tengxun.png
.png
image/thumb_bg.png
.png
image/thumb_close.png
.png
image/tip_background.png
.png
image/tip_sample.png
.png
image/tray.png
.png
image/warn.png
.png
image/web.png
.png
image/window_shadow.png
.png
image/󱳾_б.png
.png
image/󱳾_.png
.png
image/_.png
.png
image/_ѹ.png
.png
theme.xml
xml/AdHat.xml
xml/AdHatNew.xml
xml/DNSWnd.xml
xml/HandAdHat.xml
xml/HandAddTip.xml
xml/Main.xml
xml/Msg.xml
xml/Resouce.xml
xml/Setting.xml
xml/ShadeWnd.xml
xml/Shortcut.xml
xml/Thumb.xml
xml/TipWnd.xml
xml/TypeSetting.xml
xml/handadd.xml
themes/default/RelocateSD/sr_theme.ui
.zip
image/begin_bottom.png
.png
image/bg.png
.png
image/bg_begin.png
.png
image/bg_finish.png
.png
image/bg_finish_1.png
.png
image/bg_finish_ring.png
.png
image/btn_large.png
.png
image/btn_small.png
.png
image/close.png
.png
image/exclam.png
.png
image/from_begin.png
.png
image/from_finish.png
.png
image/from_title.png
.png
image/input.png
.png
image/logo.png
.png
image/min.png
.png
image/msg_btn.png
.png
image/msg_info.png
.png
image/msg_logo.png
.png
image/ok.png
.png
image/process.png
.png
image/sel.png
.png
image/shadow.png
.png
image/to_begin.png
.png
image/to_finish.png
.png
image/to_title.png
.png
theme.xml
xml/BEGIN.xml
xml/ERROR.xml
xml/FINISH.xml
xml/MAIN.xml
xml/MsgBox5.xml
xml/RELOC.xml
themes/default/SCSkin/sc_theme.ui
.zip
Common/image/scrollv/background.png
.png
Common/image/scrollv/thumb.png
.png
Common/image/scrollv/thumbgripper.png
.png
Common/xml/CommonResource.xml
image/Btn.png
.png
image/BtnBlue.png
.png
image/BtnWhite.png
.png
image/LocalImg.png
.png
image/TAB.png
.png
image/Unknown.png
.png
image/an_error.png
.png
image/an_loading.png
.png
image/auto_close.png
.png
image/auto_open.png
.png
image/autoskin.png
.png
image/balloontip.png
.png
image/blue.png
.png
image/btn_localimg.png
.png
image/btn_search.png
.png
image/btn_support.png
.png
image/btnauto.png
.png
image/cancel_store.png
.png
image/close.png
.png
image/complete.png
.png
image/default.png
.png
image/gray.png
.png
image/item_line_dot.png
.png
image/item_logo_sample.png
.png
image/left_big_button.png
.png
image/left_button.png
.png
image/listcap.png
.png
image/loading.gif
.gif
image/loading.png
.png
image/loading_text.gif
.gif
image/logo_mini.png
.png
image/menu.png
.png
image/min.png
.png
image/quart.png
.png
image/right_big_button.png
.png
image/right_button.png
.png
image/small_loading.png
.png
image/store.png
.png
image/talk.png
.png
image/thumb_default.png
.png
image/u13.png
.png
image/u14.png
.png
image/u16.png
.png
image/u24.png
.png
image/u28.png
.png
image/u54.png
.png
image/u56.png
.png
image/u58.png
.png
image/using.png
.png
image/weibo.png
.png
image/window_shadow.png
.png
main/bg_main.png
.png
theme.xml
xml/AutoChangeSkin.xml
xml/LocalImg.xml
xml/MainWnd.xml
xml/MyStore.xml
xml/OnLine.xml
themes/default/UpTip/up_theme.ui
.zip
image/btn_now.png
.png
image/cap1.png
.png
image/cap2.png
.png
image/cap3.png
.png
image/close.png
.png
image/icon.png
.png
image/left_button.png
.png
image/right_button.png
.png
image/shadow.png
.png
image/tipbg.png
.png
image/update.png
.png
theme.xml
xml/MAIN.xml
xml/TRAYTIP.xml
themes/default/bxp/bxp_theme.ui
.zip
themes/default/sd_theme.ui
.zip
themes/thumb.png
.png
usbpe
xpbackup.exe
.exe windows:5 windows x86 arch:x86

768aff3fe7bad6f6768131c58bdbddb4

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:f1:61:5a:03:3a:6a:dd:d3:59:01:5a:09:09:f0:ee:a6:a5:15:3f
Signer

Actual PE Digest

07:f1:61:5a:03:3a:6a:dd:d3:59:01:5a:09:09:f0:ee:a6:a5:15:3f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\building\360project\360sd\branches\360SD_PRO\Build\x86\xpbackup.pdb

Imports

kernel32

GetProcAddress
GetVersion
GetVersionExW
GetModuleHandleA
lstrcmpW
OpenProcess
QueryDosDeviceW
LoadLibraryA
LoadLibraryW
GetLongPathNameW
WideCharToMultiByte
AreFileApisANSI
GetACP
ProcessIdToSessionId
GetCurrentProcessId
GetTickCount
Thread32Next
SuspendThread
OpenThread
Thread32First
ResumeThread
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
CopyFileW
ReadProcessMemory
GlobalMemoryStatus
ReadFile
CreateFileW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
TlsSetValue
TlsGetValue
Sleep
InterlockedCompareExchange
TlsFree
GetFileAttributesExW
SystemTimeToFileTime
FileTimeToSystemTime
GetPrivateProfileSectionW
GetTimeZoneInformation
GetFileAttributesW
TerminateProcess
MoveFileW
MoveFileExW
SetEnvironmentVariableW
WritePrivateProfileStringW
WritePrivateProfileSectionW
GetPrivateProfileStringW
CreateMutexA
ReleaseMutex
Module32NextW
Module32FirstW
WriteFile
GetPrivateProfileIntW
ExpandEnvironmentStringsW
GetTempPathW
GetCommandLineW
GetFileSize
SetFilePointer
DeviceIoControl
lstrcpynW
SetCurrentDirectoryW
GetSystemDirectoryW
GetLocalTime
WaitForMultipleObjects
CreateThread
CompareFileTime
DeleteFileW
FindFirstFileW
DeleteAtom
FindAtomW
AddAtomW
GetAtomNameW
GetSystemTime
LocalFree
FormatMessageW
OutputDebugStringW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringA
InterlockedExchange
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
GetModuleFileNameA
GetModuleFileNameW
FindNextFileW
FindClose
GetLogicalDriveStringsW
GetWindowsDirectoryW
GetDriveTypeW
GetDiskFreeSpaceExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
lstrcmpiW
LoadLibraryExW
MultiByteToWideChar
FreeLibrary
InitializeCriticalSection
lstrlenW
GetModuleHandleW
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
InterlockedDecrement
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
RaiseException
GetCurrentThreadId
GetStdHandle
ExitProcess
TlsAlloc
FatalAppExitA
HeapCreate
GetStartupInfoW
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
lstrlenA
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
SetLastError
CreateMutexW
GetLastError
GetCurrentThread

user32

ShowWindow
SetWindowLongW
DestroyWindow
GetMessageW
TranslateMessage
DispatchMessageW
CreateWindowExW
DefWindowProcW
UnregisterClassA
FindWindowW
GetForegroundWindow
IsWindowVisible
PeekMessageW
CallWindowProcW
KillTimer
SetTimer
SetWindowTextW
PostQuitMessage
DrawIconEx
GetWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
GetClientRect
EndDialog
DialogBoxParamW
SetWindowRgn
GetActiveWindow
GetWindowLongW
GetParent
GetWindowRect
BringWindowToTop
SwitchToThisWindow
SetWindowPos
EnumThreadWindows
SystemParametersInfoW
GetSystemMetrics
WindowFromPoint
SetForegroundWindow
WaitForInputIdle
CharLowerBuffW
PostMessageW
CopyRect
CharNextW
RegisterClassExW
LoadCursorW
GetClassInfoExW
IsIconic

gdi32

DeleteObject
CreateRoundRectRgn

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

SetSecurityDescriptorDacl
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
ControlService
OpenThreadToken
LookupPrivilegeValueW
GetTokenInformation
AllocateAndInitializeSid
IsValidSid
EqualSid
FreeSid
InitializeSecurityDescriptor
RegQueryValueExA
OpenProcessToken
AdjustTokenPrivileges
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW

shell32

ExtractIconExW
SHGetFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHGetFileInfoW
ShellExecuteExW
ShellExecuteW
SHChangeNotify
CommandLineToArgvW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SysStringByteLen
SetErrorInfo
VariantChangeType
GetErrorInfo
CreateErrorInfo
SysAllocString
SysFreeString
VarUI4FromStr
DispCallFunc
VariantInit
VariantClear
SysAllocStringByteLen

shlwapi

SHGetValueW
StrCmpNW
SHSetValueW
PathRemoveFileSpecW
PathAddBackslashW
PathAppendW
PathFileExistsW
SHDeleteKeyW
StrCmpNIW
PathCombineW
SHDeleteValueW
wnsprintfW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

Sections

.text
Size: 535KB - Virtual size: 535KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

547cc532c034220469554e1b00fd2d3c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

33:90:20:77:61:c4:26:dd:94:50:03:0dCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

ce:7d:be:c6:68:f3:70:8e:bc:49:63:3e:46:66:60:63:4c:f6:64:81:bd:ef:0d:d0:01:7f:96:28:e8:77:e7:c5Signer

81:25:b9:c3:ef:09:0d:a9:93:a6:bf:28:69:a4:65:93:a2:32:72:e8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

version

crypt32

iphlpapi

Exports

Exports

Sections

.text Size: 563KB - Virtual size: 562KB

.rdata Size: 150KB - Virtual size: 150KB

.data Size: 8KB - Virtual size: 17KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 28KB - Virtual size: 27KB

290860d1d2acdafd613e1b77faec6c5f

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

ce:7d:be:c6:68:f3:70:8e:bc:49:63:3e:46:66:60:63:4c:f6:64:81:bd:ef:0d:d0:01:7f:96:28:e8:77:e7:c5
Signer

81:25:b9:c3:ef:09:0d:a9:93:a6:bf:28:69:a4:65:93:a2:32:72:e8
Signer

.text
Size: 563KB - Virtual size: 562KB

.rdata
Size: 150KB - Virtual size: 150KB

.data
Size: 8KB - Virtual size: 17KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 28KB - Virtual size: 27KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

a5:80:d7:ae:37:96:67:80:08:24:37:b6:21:ed:04:f8:34:ba:e9:c8:9d:5c:2f:d4:c3:b4:94:a6:67:ef:aa:c5
Signer

8e:c3:68:52:32:89:36:85:31:1a:2c:70:83:04:f0:4e:81:94:b8:61
Signer

.text
Size: 194KB - Virtual size: 194KB

.rdata
Size: 58KB - Virtual size: 57KB

.data
Size: 7KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 17KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

27:7f:58:e8:a0:55:01:a8:89:fc:bc:f5
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

b4:51:6e:28:75:ca:80:d7:1c:1d:69:c2:d2:75:d8:f1:a9:bc:95:ce:23:64:71:06:d1:37:8e:44:8b:3d:87:61
Signer

19:4b:6e:17:2f:3c:d9:47:30:b7:a6:ee:37:4d:9a:df:bf:1a:a2:c5
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 273KB - Virtual size: 272KB

.data
Size: 42KB - Virtual size: 65KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 57KB - Virtual size: 56KB