2dc36d1791410158a3d5918f804fd9d8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2dc36d1791410158a3d5918f804fd9d8_JaffaCakes118
Size

3.2MB
MD5

2dc36d1791410158a3d5918f804fd9d8
SHA1

345ae5dbc5e1d8abee45016b9a351acc0066a7ba
SHA256

0a8e8149822ca92ad2fc0fc217364905e4af23b5ad6e08e1922c9611d647a665
SHA512

8942794342cf08415a53791b3e5451d077de0cd16d7c636b17ebba3140c290bb11a617e4f700f7a85370e2455adb781da35bc57eb6c54cbd9484d8970d9021f0
SSDEEP

98304:AhjipbnzRKECeqtBq6ckMj+67AniNkqYIGC87:A1GFKElSq7k70AniNkq0C87

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/assist.dll
unpack001/$PLUGINSDIR/nSisImage.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

2dc36d1791410158a3d5918f804fd9d8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2011, 00:00

Not After

16/07/2013, 23:59

Subject

CN=Shenzhen QVOD Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen QVOD Technology Co.\,Ltd,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3b:bf:07:94:1f:a0:cd:57:ae:0e:b9:b1:ee:54:7c:58:42:c8:fc:d4
Signer

Actual PE Digest

3b:bf:07:94:1f:a0:cd:57:ae:0e:b9:b1:ee:54:7c:58:42:c8:fc:d4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 174KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/Kuaiwan/KW3_AppInfo.xml
.xml
$APPDATA/Kuaiwan/KW3_OtherAppInfo.xml
$PLUGINSDIR/Assist.exe
.exe windows:4 windows x86 arch:x86

746751a402c45d9119b416e0c40abc85

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2011, 00:00

Not After

16/07/2013, 23:59

Subject

CN=Shenzhen QVOD Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen QVOD Technology Co.\,Ltd,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:34:5c:8c:92:66:49:34:69:3b:f6:a5:87:4d:94:25:e2:de:4a:e3
Signer

Actual PE Digest

50:34:5c:8c:92:66:49:34:69:3b:f6:a5:87:4d:94:25:e2:de:4a:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32NextW
Module32FirstW
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
TerminateProcess
GetPrivateProfileIntW
GetLogicalDriveStringsW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetFileAttributesW
GetDriveTypeW
SetFileAttributesW
GetModuleFileNameW
CreateDirectoryW
LocalFree
lstrcmpW
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
GetModuleHandleW
Sleep
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
OpenEventW
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
CloseHandle
CreateFileW
DeviceIoControl
OutputDebugStringW
GetProcAddress
DebugBreak
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryA
VirtualAlloc
HeapSize
GetOEMCP
GetCPInfo
GetCurrentProcessId
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
GetSystemTimeAsFileTime
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
RtlUnwind
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount

user32

FindWindowW
PostMessageW
LoadStringW
SendMessageW
CharNextW
FindWindowExW
UnregisterClassA
GetWindowThreadProcessId

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
SetFileSecurityW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetFileSecurityW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
OpenProcessToken

ole32

CoUninitialize
CoCreateInstance
CoInitialize

shell32

SHGetSpecialFolderPathW
ShellExecuteW

ws2_32

htons
WSACleanup
WSAStartup
recv
gethostbyname
socket
setsockopt
closesocket
send
connect

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/BG.png
.png
$PLUGINSDIR/Btn.png
.png
$PLUGINSDIR/Co.png
.png
$PLUGINSDIR/EditBG.png
.png
$PLUGINSDIR/Img1.png
.png
$PLUGINSDIR/Img2.png
.png
$PLUGINSDIR/Img3.png
.png
$PLUGINSDIR/Img4.png
.png
$PLUGINSDIR/ImgBG.png
.png
$PLUGINSDIR/License.txt
$PLUGINSDIR/Line.png
.png
$PLUGINSDIR/Progress.gif
.gif
$PLUGINSDIR/ProgressBK.png
.png
$PLUGINSDIR/Rin.png
.png
$PLUGINSDIR/assist.dll
.dll windows:5 windows x86 arch:x86

1329c7346f77bc3946c7df5df69fa5ff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
HeapFree
GetCommandLineA
RaiseException
RtlUnwind
HeapReAlloc
HeapSize
Sleep
ExitProcess
VirtualFree
VirtualAlloc
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CreateThread
ExitThread
GetFileAttributesW
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
InterlockedExchange
InterlockedIncrement
GlobalFlags
lstrlenA
lstrcmpA
SetErrorMode
ResumeThread
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedDecrement
GetCurrentProcessId
GetModuleFileNameW
GetModuleHandleA
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
CompareStringW
LoadLibraryA
lstrcmpW
GetModuleHandleW
GetVersionExA
FormatMessageW
LocalFree
MulDiv
GlobalLock
GlobalUnlock
FreeResource
GetLastError
SetLastError
lstrlenW
SetEvent
CloseHandle
ReadFile
GetFileSize
CreateFileW
CreateDirectoryW
lstrcpyA
CreateEventW
LockResource
GlobalFree
GetProcAddress
MultiByteToWideChar
SizeofResource
LoadLibraryW
WideCharToMultiByte
GlobalAlloc
WaitForSingleObject
LoadResource
FreeLibrary
FindResourceW
GetSystemTimeAsFileTime
lstrcpynA

user32

PostQuitMessage
DestroyMenu
LoadCursorW
GetSysColorBrush
UnregisterClassW
GetMessageW
TranslateMessage
ValidateRect
GetWindowThreadProcessId
EndPaint
BeginPaint
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
GetWindowTextLengthW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetMenu
SetForegroundWindow
UpdateWindow
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SendMessageW
ShowWindow
SetWindowPos
SetWindowLongW
GetWindowLongW
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
SetFocus
GetWindowRect
EnableWindow
CopyRect
GetClientRect
GetParent
RedrawWindow
SetWindowRgn
LoadImageW
IsIconic
GetSystemMetrics
DrawIcon
PostMessageW
GetWindowTextW
GetDC
ReleaseDC
SetTimer
KillTimer
SetWindowTextW
GetSysColor
PtInRect
LoadIconW
EndDialog
GetNextDlgTabItem
IsWindowEnabled
GetDlgItem
IsWindow
DestroyWindow
CheckMenuItem

gdi32

ScaleWindowExtEx
DeleteDC
GetStockObject
SetWindowExtEx
CreateSolidBrush
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
FloodFill
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
CreateFontW
CreateDIBSection
CreateCompatibleDC
GetObjectW
DeleteObject
CombineRgn
CreateRectRgn

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

shell32

SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW

comctl32

_TrackMouseEvent

shlwapi

PathFindExtensionW
PathFindFileNameW

gdiplus

GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipImageGetFrameCount
GdipAlloc
GdipFree
GdipCreateBitmapFromScan0
GdipCloneImage
GdipDisposeImage
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageRectRectI
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipDrawString
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdiplusShutdown
GdipCreateHBITMAPFromBitmap
GdipLoadImageFromFile
GdipCreateBitmapFromFile
GdiplusStartup
GdipBitmapGetPixel
GdipCreateFromHWND
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipImageSelectActiveFrame

ole32

StringFromGUID2

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

CompeleteDlg
FreeDllSource
HideWindow
InitDlg
MyFunc
MyFuncCenter
SetProcess
SetupStartup
SetupStartupCenter

Sections

.text
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/game.png
.png
$PLUGINSDIR/install.ico
$PLUGINSDIR/nSisImage.dll
.dll windows:5 windows x86 arch:x86

1329c7346f77bc3946c7df5df69fa5ff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
HeapFree
GetCommandLineA
RaiseException
RtlUnwind
HeapReAlloc
HeapSize
Sleep
ExitProcess
VirtualFree
VirtualAlloc
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CreateThread
ExitThread
GetFileAttributesW
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
InterlockedExchange
InterlockedIncrement
GlobalFlags
lstrlenA
lstrcmpA
SetErrorMode
ResumeThread
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedDecrement
GetCurrentProcessId
GetModuleFileNameW
GetModuleHandleA
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
CompareStringW
LoadLibraryA
lstrcmpW
GetModuleHandleW
GetVersionExA
FormatMessageW
LocalFree
MulDiv
GlobalLock
GlobalUnlock
FreeResource
GetLastError
SetLastError
lstrlenW
SetEvent
CloseHandle
ReadFile
GetFileSize
CreateFileW
CreateDirectoryW
lstrcpyA
CreateEventW
LockResource
GlobalFree
GetProcAddress
MultiByteToWideChar
SizeofResource
LoadLibraryW
WideCharToMultiByte
GlobalAlloc
WaitForSingleObject
LoadResource
FreeLibrary
FindResourceW
GetSystemTimeAsFileTime
lstrcpynA

user32

PostQuitMessage
DestroyMenu
LoadCursorW
GetSysColorBrush
UnregisterClassW
GetMessageW
TranslateMessage
ValidateRect
GetWindowThreadProcessId
EndPaint
BeginPaint
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
GetWindowTextLengthW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetMenu
SetForegroundWindow
UpdateWindow
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SendMessageW
ShowWindow
SetWindowPos
SetWindowLongW
GetWindowLongW
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
SetFocus
GetWindowRect
EnableWindow
CopyRect
GetClientRect
GetParent
RedrawWindow
SetWindowRgn
LoadImageW
IsIconic
GetSystemMetrics
DrawIcon
PostMessageW
GetWindowTextW
GetDC
ReleaseDC
SetTimer
KillTimer
SetWindowTextW
GetSysColor
PtInRect
LoadIconW
EndDialog
GetNextDlgTabItem
IsWindowEnabled
GetDlgItem
IsWindow
DestroyWindow
CheckMenuItem

gdi32

ScaleWindowExtEx
DeleteDC
GetStockObject
SetWindowExtEx
CreateSolidBrush
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
FloodFill
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
CreateFontW
CreateDIBSection
CreateCompatibleDC
GetObjectW
DeleteObject
CombineRgn
CreateRectRgn

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

shell32

SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW

comctl32

_TrackMouseEvent

shlwapi

PathFindExtensionW
PathFindFileNameW

gdiplus

GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipImageGetFrameCount
GdipAlloc
GdipFree
GdipCreateBitmapFromScan0
GdipCloneImage
GdipDisposeImage
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageRectRectI
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipDrawString
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdiplusShutdown
GdipCreateHBITMAPFromBitmap
GdipLoadImageFromFile
GdipCreateBitmapFromFile
GdiplusStartup
GdipBitmapGetPixel
GdipCreateFromHWND
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipImageSelectActiveFrame

ole32

StringFromGUID2

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

CompeleteDlg
FreeDllSource
HideWindow
InitDlg
MyFunc
MyFuncCenter
SetProcess
SetupStartup
SetupStartupCenter

Sections

.text
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/setup.png
.png
$PLUGINSDIR/title.png
.png
Assist.exe
.exe windows:4 windows x86 arch:x86

746751a402c45d9119b416e0c40abc85

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2011, 00:00

Not After

16/07/2013, 23:59

Subject

CN=Shenzhen QVOD Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen QVOD Technology Co.\,Ltd,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:34:5c:8c:92:66:49:34:69:3b:f6:a5:87:4d:94:25:e2:de:4a:e3
Signer

Actual PE Digest

50:34:5c:8c:92:66:49:34:69:3b:f6:a5:87:4d:94:25:e2:de:4a:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32NextW
Module32FirstW
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
TerminateProcess
GetPrivateProfileIntW
GetLogicalDriveStringsW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetFileAttributesW
GetDriveTypeW
SetFileAttributesW
GetModuleFileNameW
CreateDirectoryW
LocalFree
lstrcmpW
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
GetModuleHandleW
Sleep
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
OpenEventW
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
CloseHandle
CreateFileW
DeviceIoControl
OutputDebugStringW
GetProcAddress
DebugBreak
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryA
VirtualAlloc
HeapSize
GetOEMCP
GetCPInfo
GetCurrentProcessId
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
GetSystemTimeAsFileTime
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
RtlUnwind
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount

user32

FindWindowW
PostMessageW
LoadStringW
SendMessageW
CharNextW
FindWindowExW
UnregisterClassA
GetWindowThreadProcessId

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
SetFileSecurityW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetFileSecurityW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
OpenProcessToken

ole32

CoUninitialize
CoCreateInstance
CoInitialize

shell32

SHGetSpecialFolderPathW
ShellExecuteW

ws2_32

htons
WSACleanup
WSAStartup
recv
gethostbyname
socket
setsockopt
closesocket
send
connect

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Channel.ini
Config.ini
KuaiWanGame.exe
.exe windows:4 windows x86 arch:x86

cc07b205abf2933fdeb4b6db260fca51

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2011, 00:00

Not After

16/07/2013, 23:59

Subject

CN=Shenzhen QVOD Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen QVOD Technology Co.\,Ltd,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:25:96:d1:1f:af:a2:9b:1a:eb:54:dc:11:fd:70:78:99:4d:53:90
Signer

Actual PE Digest

54:25:96:d1:1f:af:a2:9b:1a:eb:54:dc:11:fd:70:78:99:4d:53:90

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
GetVersionExW
Sleep
TerminateProcess
InitializeCriticalSection
GetCurrentThreadId
RaiseException
SetLastError
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenW
lstrcmpW
FlushInstructionCache
MulDiv
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
GetTickCount
QueryPerformanceCounter
GetCurrentThread
GetNativeSystemInfo
VirtualProtectEx
FindResourceW
FreeLibrary
LoadResource
GetModuleHandleW
SizeofResource
lstrcmpiW
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
SuspendThread
SetThreadContext
GetThreadContext
ResumeThread
OutputDebugStringW
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetFilePointer
GetOEMCP
GetCPInfo
HeapSize
GetSystemTimeAsFileTime
HeapCreate
HeapDestroy
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
WriteFile
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
DebugBreak
CreateThread
MultiByteToWideChar
GetModuleFileNameA
LoadLibraryExW
LoadLibraryExA
LoadLibraryW
LoadLibraryA
WriteProcessMemory
VirtualProtect
lstrcmpiA
GetCurrentProcessId
LocalFree
VirtualQuery
GetProcAddress
GetModuleHandleA
GetSystemInfo
Module32NextW
Module32FirstW
GetLastError
GetCurrentProcess
CreateToolhelp32Snapshot
CloseHandle
GetWindowsDirectoryW
ExitProcess

user32

MessageBoxA
GetActiveWindow
LoadIconW
DestroyWindow
PostQuitMessage
GetClientRect
MoveWindow
IsWindow
SetFocus
KillTimer
FindWindowExW
SetWindowLongW
SendMessageW
SetTimer
ShowWindow
LoadStringW
GetWindowLongW
CallWindowProcW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
CreateWindowExW
RegisterClassExW
GetClassInfoExW
LoadCursorW
GetDesktopWindow
InvalidateRgn
InvalidateRect
UnregisterClassA
DispatchMessageW
TranslateMessage
GetMessageW
DefWindowProcW
DestroyAcceleratorTable
GetSysColor
BeginPaint
FillRect
EndPaint
GetDC
ReleaseDC
IsChild
GetFocus
GetWindow
GetDlgItem
RedrawWindow
GetClassNameW
GetParent
CharNextW
SetWindowPos
CreateAcceleratorTableW
ClientToScreen
ScreenToClient
SetCapture
ReleaseCapture

advapi32

RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW

ole32

CoInitializeEx
CoCreateInstance
PropVariantClear
CoUninitialize
OleUninitialize
OleInitialize
CoTaskMemAlloc
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoInitialize
CoTaskMemFree
CoTaskMemRealloc

oleaut32

SysAllocStringLen
OleCreateFontIndirect
SysFreeString
LoadRegTypeLi
LoadTypeLi
SysStringByteLen
SysAllocString
VariantClear
VariantInit
SysStringLen
VarUI4FromStr
GetErrorInfo

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
BitBlt
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
SelectObject
GetObjectW

imagehlp

ImageDirectoryEntryToData

ntdll

RtlUnwind

winmm

waveOutPause
waveOutRestart
timeGetTime
waveOutWrite
midiStreamOut
timeSetEvent
waveOutClose

dsound

ord1

Sections

.text
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KuaiWanWebgame.exe
.exe windows:4 windows x86 arch:x86

a2ae06377a291569eee233e33952e085

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2011, 00:00

Not After

16/07/2013, 23:59

Subject

CN=Shenzhen QVOD Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen QVOD Technology Co.\,Ltd,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

40:b0:75:b5:6d:6d:63:a4:01:85:17:82:ad:d2:57:7e:39:ba:83:f8
Signer

Actual PE Digest

40:b0:75:b5:6d:6d:63:a4:01:85:17:82:ad:d2:57:7e:39:ba:83:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
RaiseException
CreateFileW
ReadFile
WriteFile
CloseHandle
GetTickCount
QueryPerformanceCounter
GetCurrentThread
GetVersionExW
GetNativeSystemInfo
VirtualProtectEx
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
GetModuleHandleW
SizeofResource
MultiByteToWideChar
GetFileAttributesW
GetVersionExA
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
SuspendThread
SetThreadContext
GetThreadContext
ResumeThread
VirtualProtect
VirtualQuery
LocalFree
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
LeaveCriticalSection
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
GetStringTypeA
LCMapStringW
WideCharToMultiByte
LCMapStringA
GetOEMCP
GetCPInfo
HeapSize
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapCreate
HeapDestroy
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
EnterCriticalSection
SetLastError
FlushInstructionCache
DeleteCriticalSection
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
lstrcmpW
DebugBreak
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
ExitProcess
GetModuleHandleA
RtlUnwind
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
GetModuleFileNameW
GetLastError
InitializeCriticalSection
TerminateProcess
GetCurrentProcess
Sleep
CreateThread
TerminateThread
InterlockedIncrement
lstrcmpiW
InterlockedDecrement
lstrlenW
lstrlenA
OutputDebugStringW
WriteConsoleA

user32

BeginPaint
LoadStringW
CharNextW
SendMessageW
PostMessageW
GetClientRect
SetWindowPos
IsWindow
PostQuitMessage
GetCursorPos
WindowFromPoint
GetFocus
IsChild
DefWindowProcW
DestroyWindow
RegisterClassExW
LoadCursorW
GetClassInfoExW
GetDesktopWindow
InvalidateRgn
InvalidateRect
UnregisterClassA
DrawTextW
DispatchMessageW
TranslateMessage
GetMessageW
SetTimer
CallWindowProcW
CreateWindowExW
ReleaseCapture
SetWindowLongW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
DestroyAcceleratorTable
GetSysColor
GetWindowLongW
FillRect
EndPaint
GetDC
ReleaseDC
SetFocus
GetWindow
GetDlgItem
RedrawWindow
GetClassNameW
GetParent
CreateAcceleratorTableW
ClientToScreen
ScreenToClient
MoveWindow
SetCapture

advapi32

RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegOpenKeyW
RegCreateKeyExW

ole32

CoTaskMemFree
OleUninitialize
CoTaskMemAlloc
StringFromCLSID
OleLockRunning
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoUninitialize
CoCreateInstance
CoInitializeEx
PropVariantClear
StringFromGUID2
CoInitialize
CreateStreamOnHGlobal
OleInitialize
CoTaskMemRealloc

shell32

SHGetSpecialFolderPathW

oleaut32

SysAllocStringLen
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VariantClear
VariantInit
SysStringLen
SysStringByteLen
SysFreeString
SysAllocString

gdi32

CreateCompatibleBitmap
SetBkMode
CreateFontIndirectW
CreateCompatibleDC
CreateSolidBrush
BitBlt
SelectObject
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
GetObjectW

winmm

waveOutPause
timeGetTime
timeSetEvent
midiStreamOut
waveOutWrite
waveOutRestart

dsound

ord1

Sections

.text
Size: 120KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Kuaiwan.exe
.exe windows:4 windows x86 arch:x86

b8434ec1babad81353cc017973372338

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2011, 00:00

Not After

16/07/2013, 23:59

Subject

CN=Shenzhen QVOD Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen QVOD Technology Co.\,Ltd,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f5:a7:d6:87:98:e9:6d:f2:87:b8:ca:28:93:b7:7b:ea:5b:31:58:12
Signer

Actual PE Digest

f5:a7:d6:87:98:e9:6d:f2:87:b8:ca:28:93:b7:7b:ea:5b:31:58:12

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SizeofResource
TerminateThread
DeviceIoControl
GlobalAddAtomW
FlushFileBuffers
SetFilePointer
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
lstrcpyW
lstrcatW
GetSystemInfo
GetTickCount
Thread32First
Thread32Next
OpenThread
SuspendThread
ResumeThread
ResetEvent
CopyFileW
GetProfileIntW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
FileTimeToSystemTime
GetDiskFreeSpaceExW
GetVolumeInformationW
GetCurrentProcessId
GetProcessHeap
HeapFree
GlobalMemoryStatusEx
GlobalMemoryStatus
SetProcessWorkingSetSize
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
SetFileTime
GetFileInformationByHandle
FileTimeToLocalFileTime
CreateSemaphoreW
ReleaseSemaphore
GetVersionExA
HeapAlloc
GetStartupInfoW
GetSystemTimeAsFileTime
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
GlobalUnlock
GetEnvironmentStrings
LoadLibraryExW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
LCMapStringA
LCMapStringW
HeapSize
GetConsoleCP
GetConsoleMode
RtlUnwind
GetFileAttributesA
InterlockedExchange
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetLocaleInfoW
GetExitCodeProcess
CreateProcessA
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetThreadLocale
InterlockedCompareExchange
IsProcessorFeaturePresent
GlobalLock
GlobalAlloc
LockResource
LoadResource
GetVersionExW
OpenEventW
WriteFile
ReadFile
GetOverlappedResult
WaitForMultipleObjects
CreateNamedPipeW
ConnectNamedPipe
DisconnectNamedPipe
TerminateProcess
Sleep
CreateProcessW
Process32FirstW
CreateToolhelp32Snapshot
Module32FirstW
Process32NextW
OpenProcess
GetPrivateProfileStringW
LocalAlloc
LocalFree
SetFileAttributesW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleW
GetLogicalDriveStringsW
GetDriveTypeW
lstrcmpiW
SetEvent
FindFirstFileW
FindNextFileW
DeleteFileW
FindClose
RemoveDirectoryW
WaitForSingleObject
CreateEventW
FreeLibrary
GetProcAddress
LoadLibraryW
SetLastError
DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetCurrentThreadId
MultiByteToWideChar
MulDiv
lstrcmpW
FreeEnvironmentStringsW
GetModuleFileNameW
FindResourceW
GlobalFree
GlobalHandle
RaiseException
InitializeCriticalSection
GetSystemTime
lstrcatA
GetFileSize
CreateThread
CloseHandle
CreateFileW
InterlockedIncrement
InterlockedDecrement
GetFileAttributesW
CreateDirectoryW
GetFileAttributesExW
GetLocalTime
WideCharToMultiByte
lstrlenW
lstrlenA
OutputDebugStringW
FreeEnvironmentStringsA
DebugBreak

user32

DrawIconEx
SetRect
InflateRect
DrawTextW
SetRectEmpty
GetCapture
UpdateWindow
EqualRect
CharLowerW
EnumWindows
GetWindowDC
SetCursorPos
IsWindowEnabled
UnregisterClassA
IsDialogMessageW
WindowFromPoint
ExitWindowsEx
PostQuitMessage
LoadIconW
IsWindowVisible
CopyRect
PrintWindow
SetClipboardData
EmptyClipboard
OpenClipboard
SetCursor
PtInRect
LoadImageW
EnumChildWindows
GetKeyState
GetMenuState
IntersectRect
SetWindowRgn
DestroyIcon
PrivateExtractIconsW
RegisterHotKey
UnregisterHotKey
EnableWindow
MapDialogRect
SetWindowContextHelpId
EndDialog
SetTimer
KillTimer
LoadMenuW
GetMenuStringW
GetMenuItemID
wsprintfW
DestroyCursor
GetIconInfo
CreateIconIndirect
CreateMenu
AppendMenuW
CharNextW
LoadStringW
GetActiveWindow
wsprintfA
PostMessageW
CallWindowProcW
DialogBoxIndirectParamW
CreatePopupMenu
GetMenuItemCount
IsMenu
ModifyMenuW
SetParent
SetLayeredWindowAttributes
OffsetRect
SetActiveWindow
DestroyMenu
GetCursorPos
UnregisterClassW
DispatchMessageW
TranslateMessage
GetMessageW
SystemParametersInfoW
GetWindowRect
MapWindowPoints
GetWindowThreadProcessId
FindWindowExW
WaitForInputIdle
MessageBoxW
SetMenuItemInfoW
GetSubMenu
TrackMouseEvent
TrackPopupMenu
GetMenuItemInfoW
FindWindowW
GetSystemMetrics
GetForegroundWindow
SetForegroundWindow
ShowWindow
DestroyWindow
SendMessageW
DefWindowProcW
GetWindowLongW
SetWindowLongW
DestroyAcceleratorTable
GetSysColor
BeginPaint
GetClientRect
FillRect
EndPaint
GetDC
ReleaseDC
IsChild
GetFocus
SetFocus
IsWindow
GetDlgItem
RedrawWindow
GetClassNameW
GetParent
CreateAcceleratorTableW
ClientToScreen
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
InvalidateRect
InvalidateRgn
GetDesktopWindow
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetClassInfoExW
LoadCursorW
RegisterClassExW
CreateWindowExW
GetWindow
SetWindowPos
CloseClipboard

advapi32

RegCloseKey
RegEnumKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegSaveKeyExW
RegRestoreKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegCreateKeyW
SetFileSecurityW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetFileSecurityW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegOpenKeyW
RegDeleteKeyW

ole32

CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoInitialize
CoUninitialize
StringFromCLSID
CoTaskMemFree
CoCreateGuid
CoTaskMemRealloc
CoSetProxyBlanket
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
CoCreateInstance

shell32

SHBrowseForFolderW
ShellExecuteW
SHGetPathFromIDListW
Shell_NotifyIconW
DragAcceptFiles
DragQueryFileW
ShellExecuteExW
SHGetSpecialFolderPathW

oleaut32

VariantInit
SysFreeString
SysAllocStringLen
OleCreateFontIndirect
LoadRegTypeLi
VariantClear
SysStringByteLen
SysStringLen
VarUI4FromStr
VariantChangeType
SysAllocString
LoadTypeLi
VariantCopy

shlwapi

PathFileExistsW
StrStrIW

comctl32

ord17
ord16
_TrackMouseEvent
InitCommonControlsEx

gdi32

GetObjectW
GetDeviceCaps
DeleteObject
DeleteDC
SelectObject
BitBlt
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
CreateDIBSection
CreateRectRgn
RealizePalette
SelectPalette
GetDIBits
CreateDCW
CombineRgn
CreateRoundRectRgn
CreateFontIndirectW
GetTextExtentPoint32W
SetBkMode
SetTextColor
SetDIBits
CreatePen
MoveToEx
LineTo
Polygon
Rectangle
Ellipse
CreateBitmap
CreatePatternBrush
SetViewportOrgEx
UnrealizeObject
SetROP2
SetMapMode
SetWindowOrgEx
PatBlt
SetBkColor
ExtTextOutW
GetClipBox
SelectClipRgn
CreateRectRgnIndirect
SetRectRgn
GetPixel
GetStockObject

msimg32

AlphaBlend

ws2_32

WSAGetLastError
send
connect
setsockopt
socket
gethostbyname
htons
recv
WSACleanup
closesocket
gethostname
bind
ntohs
ntohl
htonl
sendto
select
__WSAFDIsSet
ioctlsocket
recvfrom
WSAIoctl
WSAStartup

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

psapi

GetModuleFileNameExW
GetProcessMemoryInfo
GetModuleBaseNameW

gdiplus

GdipDrawImagePointsRectI
GdipReleaseDC
GdipGetDC
GdipDrawImagePointRectI
GdipSetPenDashStyle
GdipCreateBitmapFromFile
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFillRectangleI
GdipCreateFromHWND
GdipDrawImageRectRectI
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipMeasureString
GdipDrawString
GdipCreateBitmapFromHICON
GdipCreateHBITMAPFromBitmap
GdipCreateFromHDC
GdipGetImageWidth
GdipGetImageHeight
GdipBitmapGetPixel
GdipLoadImageFromFile
GdipImageSelectActiveFrame
GdipSetSolidFillColor
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipCreatePen1
GdipDeletePen
GdipDrawLineI
GdipGetGenericFontFamilySansSerif
GdipCreateBitmapFromHBITMAP
GdipDrawImageRectI
GdipTranslateWorldTransform
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipSetStringFormatTrimming
GdipDrawRectangleI
GdipCreatePath
GdipDeletePath
GdipStartPathFigure
GdipAddPathArcI
GdipAddPathLineI
GdipClosePathFigure
GdipFillPath
GdipDrawPath

wininet

FindFirstUrlCacheEntryW
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 336KB - Virtual size: 333KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 304KB - Virtual size: 302KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KuaiwanDp.exe
.exe windows:4 windows x86 arch:x86

648bae4a6eedc7130d6f6f9b917314d2

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2011, 00:00

Not After

16/07/2013, 23:59

Subject

CN=Shenzhen QVOD Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen QVOD Technology Co.\,Ltd,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ed:67:2b:b5:3c:c6:13:fb:20:bd:70:e7:cc:f6:c6:f5:b0:76:87:8c
Signer

Actual PE Digest

ed:67:2b:b5:3c:c6:13:fb:20:bd:70:e7:cc:f6:c6:f5:b0:76:87:8c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\QPlayGame_Kuaiwan\trunk\bin\KuaiwanDp.pdb

Imports

kernel32

GetModuleHandleW
SizeofResource
MultiByteToWideChar
lstrcmpiW
DebugBreak
OutputDebugStringW
DeviceIoControl
CreateFileW
CloseHandle
WideCharToMultiByte
CreateThread
GetPrivateProfileStringW
lstrlenA
Sleep
GetFileAttributesW
GetProcAddress
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
HeapDestroy
LoadLibraryExW
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
GetCPInfo
GetOEMCP
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
LoadResource
FreeLibrary
FindResourceW
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
SetLastError
RaiseException
InitializeCriticalSection
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
lstrcmpW
lstrlenW
GetLastError
HeapCreate
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LoadLibraryA

user32

UnregisterClassA
DestroyCursor
GetWindowRect
SetForegroundWindow
SetCursor
TrackMouseEvent
LoadStringW
GetCursorPos
GetSystemMetrics
SetWindowRgn
PostQuitMessage
ShowWindow
PostMessageW
SetWindowLongW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
DestroyWindow
CallWindowProcW
DefWindowProcW
GetWindowLongW
UnregisterClassW
TranslateMessage
GetMessageW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
DestroyAcceleratorTable
GetSysColor
BeginPaint
GetClientRect
FillRect
EndPaint
GetDC
ReleaseDC
IsChild
GetFocus
SetFocus
GetWindow
IsWindow
GetDlgItem
SendMessageW
RedrawWindow
GetClassNameW
GetParent
CharNextW
SetWindowPos
CreateAcceleratorTableW
ClientToScreen
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
InvalidateRect
InvalidateRgn
GetDesktopWindow
FindWindowW
DispatchMessageW

gdi32

CombineRgn
CreateRectRgn
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
SelectObject
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
GetObjectW
BitBlt

advapi32

RegOpenKeyW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW

shell32

ShellExecuteW

ole32

CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CoCreateInstance
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
OleUninitialize
CoInitialize

oleaut32

SysStringLen
VariantInit
SysAllocStringLen
OleCreateFontIndirect
SysFreeString
LoadRegTypeLi
LoadTypeLi
SysStringByteLen
SysAllocString
VariantClear
VarUI4FromStr

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

gdiplus

GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipSetStringFormatAlign
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCreateBitmapFromHBITMAP
GdipTranslateWorldTransform
GdipDeleteFont
GdipCreateFromHWND
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipFree
GdipAlloc
GdipCreateBitmapFromFile
GdipBitmapGetPixel
GdipGetImageHeight
GdipGetImageWidth
GdiplusShutdown
GdiplusStartup
GdipMeasureString
GdipDrawString
GdipDrawImageRectRectI

ws2_32

setsockopt
connect
send
socket
closesocket
WSACleanup
WSAStartup
gethostbyname
htons
recv

Sections

.text
Size: 152KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KuaiwanGames.ico
KuaiwanUninst.exe.nsis
KuaiwanUpdate.txt
KuaiwanWeb.exe
.exe windows:4 windows x86 arch:x86

00fef292e7aed38c18bc71fec55cf707

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2011, 00:00

Not After

16/07/2013, 23:59

Subject

CN=Shenzhen QVOD Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen QVOD Technology Co.\,Ltd,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ad:61:fe:9d:5e:a9:80:c1:9b:93:1b:9a:5d:36:be:42:f1:3a:8b:e7
Signer

Actual PE Digest

ad:61:fe:9d:5e:a9:80:c1:9b:93:1b:9a:5d:36:be:42:f1:3a:8b:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueryPerformanceCounter
GetCurrentThread
VirtualProtectEx
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
GetModuleHandleW
SizeofResource
MultiByteToWideChar
CreateFileMappingW
MapViewOfFile
FlushViewOfFile
CreateDirectoryW
WideCharToMultiByte
LoadLibraryW
Sleep
TerminateProcess
CreateThread
GetFileAttributesW
GlobalFree
GetLocalTime
GetVersionExA
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetTickCount
CloseHandle
WriteFile
SuspendThread
SetThreadContext
GetThreadContext
ResumeThread
VirtualProtect
VirtualQuery
ReadFile
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetOEMCP
GetCPInfo
HeapSize
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapCreate
HeapDestroy
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
ExitProcess
GetModuleHandleA
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapReAlloc
GetStartupInfoW
CreateFileW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
DeleteCriticalSection
InterlockedIncrement
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
lstrcmpW
GetLastError
InitializeCriticalSection
LocalFree
GetModuleFileNameW
RaiseException
GetCurrentThreadId
SetLastError
FlushInstructionCache
GetCurrentProcess
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
lstrlenW
lstrlenA
OutputDebugStringW
DebugBreak
InterlockedDecrement

user32

IsWindow
SendMessageW
CharNextW
LoadStringW
ReleaseCapture
PostMessageW
RegisterClassExW
GetClassInfoExW
LoadCursorW
SetWindowLongW
CreateWindowExW
ReleaseDC
GetClassNameW
CallWindowProcW
GetDesktopWindow
InvalidateRgn
UnregisterClassA
GetWindowRect
SetForegroundWindow
SetCursor
IntersectRect
SetWindowRgn
MoveWindow
ScreenToClient
ClientToScreen
CreateAcceleratorTableW
SetWindowPos
GetParent
DestroyWindow
RedrawWindow
GetDlgItem
GetWindow
SetFocus
GetFocus
IsChild
GetDC
EndPaint
FillRect
GetClientRect
BeginPaint
GetSysColor
DestroyAcceleratorTable
DefWindowProcW
GetWindowLongW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
SetTimer
GetMessageW
TranslateMessage
DispatchMessageW
UnregisterClassW
DestroyCursor
EnableWindow
IsWindowVisible
GetCursorPos
MapWindowPoints
ShowWindow
TrackMouseEvent
PtInRect
GetKeyState
wsprintfW
SystemParametersInfoW
DrawTextW
PostQuitMessage
SetParent
WindowFromPoint
EnumChildWindows
IsDialogMessageW
KillTimer
InvalidateRect
SetCapture

advapi32

RegSetValueExW
RegQueryInfoKeyW
RegDeleteKeyW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegOpenKeyW
RegEnumKeyExW
RegCreateKeyExW

ole32

CLSIDFromProgID
StringFromCLSID
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
OleLockRunning
CoCreateInstance
CoGetClassObject
CLSIDFromString
OleUninitialize
CreateStreamOnHGlobal
OleInitialize
CoTaskMemRealloc
CoInitialize
CoUninitialize
PropVariantClear
CoInitializeEx

shell32

SHGetSpecialFolderPathW

oleaut32

VariantCopy
VarUI4FromStr
SysAllocStringLen
SysStringLen
VariantInit
SysStringByteLen
LoadTypeLi
SysFreeString
SysAllocString
VariantClear
OleCreateFontIndirect
LoadRegTypeLi

shlwapi

PathFileExistsW

comctl32

ord16
ord17
InitCommonControlsEx

gdi32

GetDeviceCaps
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetBkMode
CreateRectRgn
CombineRgn
BitBlt
CreateFontIndirectW
GetObjectW
DeleteObject
DeleteDC
CreateSolidBrush

ws2_32

socket
setsockopt
htons
connect
send
WSAGetLastError
recv
closesocket
gethostbyname

gdiplus

GdipBitmapGetPixel
GdipDrawImagePointsRectI
GdipDrawLineI
GdipDrawPath
GdipFillPath
GdipClosePathFigure
GdipAddPathLineI
GdipAddPathArcI
GdipCreatePen1
GdipFillRectangleI
GdipDrawString
GdipMeasureString
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipStartPathFigure
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipSetSolidFillColor
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateBitmapFromFile
GdipTranslateWorldTransform
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectRectI
GdipReleaseDC
GdipGetDC
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipFree
GdipAlloc
GdipDeletePath
GdipCreatePath
GdipImageSelectActiveFrame
GdipDeletePen
GdipLoadImageFromFile
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDrawImageRectI
GdipCreateFromHWND
GdipDrawRectangleI
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipSetStringFormatTrimming
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP

winmm

timeGetTime
waveOutWrite
waveOutPause
waveOutRestart
timeSetEvent
midiStreamOut

dsound

ord1

Sections

.text
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
P2pdll.dll
.dll windows:4 windows x86 arch:x86

eaddb24e752ca5c98b5047f53f3d064c

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2011, 00:00

Not After

16/07/2013, 23:59

Subject

CN=Shenzhen QVOD Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen QVOD Technology Co.\,Ltd,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bc:c6:97:d6:6d:58:f4:56:60:42:56:8a:e8:a1:f9:46:c7:9d:57:c8
Signer

Actual PE Digest

bc:c6:97:d6:6d:58:f4:56:60:42:56:8a:e8:a1:f9:46:c7:9d:57:c8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\QvodSvn\servertools\trunk\LibTerminal4.0\release\P2PDll.pdb

Imports

kernel32

WriteFile
MoveFileW
Sleep
GetSystemInfo
ReadFile
CreateFileW
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
InitializeCriticalSection
GetFileSizeEx
DeleteCriticalSection
GetCurrentProcess
GetTickCount
LeaveCriticalSection
GetSystemDirectoryA
GetLastError
SetFileAttributesW
MultiByteToWideChar
GetDriveTypeW
GetTempPathW
WideCharToMultiByte
DeleteFileW
HeapAlloc
GetProcessHeap
HeapFree
WaitForSingleObject
GetModuleFileNameA
GetVersionExA
LoadLibraryA
LocalAlloc
GetProcAddress
LocalFree
GetLocalTime
FlushFileBuffers
SetEvent
ResetEvent
CreateEventA
QueryPerformanceCounter
SetFileValidData
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
SetEndOfFile
SetFilePointerEx
GetCurrentThreadId
WaitForMultipleObjects
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetDriveTypeA
TerminateThread
CreateThread
CloseHandle
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocaleInfoW
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
InterlockedExchange
GetCurrentDirectoryA
GetFullPathNameW
HeapReAlloc
VirtualAlloc
SetFilePointer
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
GetCurrentProcessId
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetFileAttributesW
GetCommandLineA
CreateDirectoryW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileW
RtlUnwind
RaiseException
ExitThread
ResumeThread
GetModuleHandleA
ExitProcess

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

shell32

SHGetSpecialFolderPathW
SHFileOperationW

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SysFreeString
SysAllocString
SysStringLen

ws2_32

WSAStartup
WSAGetLastError
gethostname
recvfrom
sendto
closesocket
WSAWaitForMultipleEvents
ntohs
inet_addr
recv
htonl
accept
bind
send
socket
WSACreateEvent
WSAEnumNetworkEvents
htons
listen
WSACloseEvent
WSAEventSelect
gethostbyname
select
ioctlsocket
setsockopt
__WSAFDIsSet
connect
ntohl

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

shlwapi

StrStrIA

iphlpapi

GetAdaptersInfo

Exports

Exports

QvodNet_CancelRepair
QvodNet_Clear
QvodNet_CreateHttpTask
QvodNet_CreateP2PTask
QvodNet_GetContinueDataLen
QvodNet_Init
QvodNet_PauseTask
QvodNet_QueryRepairFile
QvodNet_QueryTask
QvodNet_RemoveTask
QvodNet_RepairFile
QvodNet_RequestCacheServer
QvodNet_SetDownMode
QvodNet_SetDownPosition
QvodNet_SetGlobalDownSpeed
QvodNet_SetGlobalUpSpeed
QvodNet_SetTaskDownSpeed
QvodNet_ShareFile
QvodNet_StartTask

Sections

.text
Size: 344KB - Virtual size: 342KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
QvodGameExtend.dll
.dll regsvr32 windows:4 windows x86 arch:x86

7db1b35260da48e4a5330a00023c0a8c

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2011, 00:00

Not After

16/07/2013, 23:59

Subject

CN=Shenzhen QVOD Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen QVOD Technology Co.\,Ltd,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b6:52:5e:18:46:d0:0a:bb:d0:27:72:fe:22:1b:fe:75:13:c3:ba:97
Signer

Actual PE Digest

b6:52:5e:18:46:d0:0a:bb:d0:27:72:fe:22:1b:fe:75:13:c3:ba:97

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\QPlayGame_Kuaiwan\trunk\bin\QvodGameExtend.pdb

Imports

kernel32

GetLastError
EnterCriticalSection
DeleteCriticalSection
GetStringTypeW
RaiseException
ReadFile
SetEndOfFile
CreateFileA
CreateFileW
FlushFileBuffers
lstrcpynW
LeaveCriticalSection
SizeofResource
InitializeCriticalSection
GetModuleHandleW
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
Sleep
lstrcpyW
lstrcmpiW
GetPrivateProfileIntW
GetFileAttributesW
lstrcatW
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CreateDirectoryW
lstrlenW
lstrcmpW
WritePrivateProfileStringW
OutputDebugStringW
lstrcatA
DebugBreak
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
GetStringTypeA
LCMapStringW
LCMapStringA
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
LocalFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetProcessHeap
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCPInfo
GetOEMCP
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
WriteFile
GetConsoleCP
GetConsoleMode
RtlUnwind
CloseHandle
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW

user32

FindWindowW
SendMessageW
UnregisterClassA
wsprintfW
LoadStringW
SetTimer
CharLowerW
FillRect
GetDC
CharNextW
KillTimer
ReleaseDC
wsprintfA

gdi32

CreateCompatibleDC
StretchBlt
SetStretchBltMode
CreateSolidBrush
CreateCompatibleBitmap
SelectObject
RealizePalette
SelectPalette
GetStockObject
GetDeviceCaps
CreateDCW
DeleteObject
DeleteDC
GetDIBits

advapi32

RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

ole32

CreateStreamOnHGlobal
StringFromIID
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc

oleaut32

VarUI4FromStr
VariantClear
SysAllocString
VariantInit
VariantCopy
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Unrar.dll
.dll windows:5 windows x86 arch:x86

7526cff92e5420704a20b426fc8b08c7

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2011, 00:00

Not After

16/07/2013, 23:59

Subject

CN=Shenzhen QVOD Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen QVOD Technology Co.\,Ltd,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:1e:86:14:5d:ed:0c:66:43:57:29:9c:50:79:8f:d7:57:33:ac:1c
Signer

Actual PE Digest

4d:1e:86:14:5d:ed:0c:66:43:57:29:9c:50:79:8f:d7:57:33:ac:1c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\WinRAR\rar\build\unrardll32\Release\unrar.pdb

Imports

kernel32

GetFileType
CreateFileA
CreateFileW
ReadFile
GetStdHandle
WriteFile
GetProcAddress
GetModuleHandleW
GetFileAttributesA
GetFileAttributesW
SetFileAttributesA
SetFileAttributesW
DeleteFileA
DeleteFileW
DeviceIoControl
CreateDirectoryA
CreateDirectoryW
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetVersionExW
GetModuleFileNameA
CompareStringA
LocalFileTimeToFileTime
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTime
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
IsDBCSLeadByte
GetCPInfo
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetEndOfFile
SetFilePointer
FlushFileBuffers
MoveFileW
SetFileTime
GetCurrentProcess
GetLastError
Sleep
CloseHandle
GetFullPathNameA
GetLocaleInfoA
GetStringTypeW
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
RaiseException
GetModuleHandleA
ExitProcess
GetCurrentThreadId
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapCreate
HeapDestroy
GetACP
GetOEMCP
IsValidCodePage
HeapSize
LoadLibraryA
GetVersion
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
WriteConsoleW

user32

CharLowerW
CharLowerA
CharToOemA
CharUpperW
CharToOemBuffW
OemToCharA
OemToCharBuffA
CharUpperA

advapi32

SetFileSecurityW
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

Exports

Exports

RARCloseArchive
RARGetDllVersion
RAROpenArchive
RAROpenArchiveEx
RARProcessFile
RARProcessFileW
RARReadHeader
RARReadHeaderEx
RARSetCallback
RARSetChangeVolProc
RARSetPassword
RARSetProcessDataProc

Sections

.text
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
empty.htm
.html
npKWCheck.dll
.dll regsvr32 windows:4 windows x86 arch:x86

ba9691a53789053ebf3cf5498309fbb7

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2011, 00:00

Not After

16/07/2013, 23:59

Subject

CN=Shenzhen QVOD Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen QVOD Technology Co.\,Ltd,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

89:25:09:cf:48:5f:1b:11:fc:79:c0:3b:f9:a7:9d:18:b5:8b:81:a5
Signer

Actual PE Digest

89:25:09:cf:48:5f:1b:11:fc:79:c0:3b:f9:a7:9d:18:b5:8b:81:a5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
GetLastError
DisableThreadLibraryCalls
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetProcAddress
GetFileAttributesW
InitializeCriticalSection
FlushFileBuffers
CloseHandle
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetModuleFileNameW
OutputDebugStringW
DebugBreak
lstrlenA
InterlockedIncrement
lstrcmpiW
GetThreadLocale
GetStringTypeExW
lstrlenW
InterlockedDecrement
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetProcessHeap
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
Sleep
HeapSize
GetCPInfo
GetOEMCP
LCMapStringA
WideCharToMultiByte
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA

user32

FrameRect
wvsprintfW
LoadStringW
CharNextW
SetWindowLongW
BeginPaint
GetClientRect
UnregisterClassA
GetWindowLongW
DrawTextA
EndPaint
DefWindowProcW

gdi32

GetStockObject

advapi32

RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegCloseKey
RegCreateKeyW

shell32

ShellExecuteW

ole32

StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysStringLen
SysAllocString
VariantClear
VariantInit
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npKuaiWanGame.dll
.dll regsvr32 windows:4 windows x86 arch:x86

5663d3a87906c4747578cd2839f2b392

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/04/2011, 00:00

Not After

16/07/2013, 23:59

Subject

CN=Shenzhen QVOD Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen QVOD Technology Co.\,Ltd,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bb:11:fd:13:09:ca:c5:cc:fa:6c:64:6c:fa:6f:7e:4f:b5:56:45:85
Signer

Actual PE Digest

bb:11:fd:13:09:ca:c5:cc:fa:6c:64:6c:fa:6f:7e:4f:b5:56:45:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetEvent
CreateEventW
LocalFree
ReadFile
SetEndOfFile
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetStringTypeW
GetStringTypeA
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
HeapCreate
HeapDestroy
WaitForSingleObject
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetOEMCP
GetCPInfo
GetCommandLineA
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
WriteFile
FlushFileBuffers
CreateThread
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetSystemTime
Sleep
CreateDirectoryW
LockResource
lstrcatA
LoadLibraryW
GetProcAddress
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
FreeLibrary
DisableThreadLibraryCalls
lstrcpyW
lstrcatW
lstrcmpiW
SetLastError
GetCurrentThreadId
RaiseException
GetModuleFileNameW
MulDiv
lstrcmpW
GetCurrentProcess
FlushInstructionCache
GetLastError
GlobalAlloc
CreateFileW
GlobalLock
CloseHandle
GlobalUnlock
GlobalFree
WideCharToMultiByte
GetLocalTime
GetFileAttributesW
OutputDebugStringW
DebugBreak
lstrlenA
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
InterlockedDecrement
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode

user32

SetWindowLongW
GetWindowLongW
CallWindowProcW
DefWindowProcW
LoadStringW
CharNextW
SetCursor
LoadCursorW
UnregisterClassA
SendMessageW
InvalidateRect
MoveWindow
GetClientRect
GetDC
ReleaseDC
DestroyWindow
MessageBoxW
DrawTextW
GetSysColor
GetSystemMetrics
SetWindowPos
ClientToScreen
RedrawWindow
SetCapture
IsChild
GetParent
GetDlgItem
GetClassNameW
ReleaseCapture
FillRect
EndPaint
BeginPaint
GetDesktopWindow
DestroyAcceleratorTable
SetFocus
GetWindow
GetFocus
IsWindow
GetClassInfoExW
RegisterClassExW
CreateWindowExW
CreateAcceleratorTableW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
ShowWindow
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
PtInRect
UnionRect
LoadImageW
PostMessageW
GetWindowRect
MapWindowPoints
SetTimer
KillTimer
ScreenToClient
SetParent
OpenClipboard
CopyRect
SetRect
wsprintfA
FindWindowW
GetCursorPos
CloseClipboard
FindWindowExW
SetClipboardData
EmptyClipboard
InvalidateRgn

gdi32

SetTextColor
SetBkMode
CreateRoundRectRgn
GetTextExtentPoint32W
CreateDIBSection
SetDIBits
LPtoDP
SetMapMode
SetViewportOrgEx
CreateMetaFileW
SaveDC
SetWindowOrgEx
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
CreateSolidBrush
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
CreateDCW
GetDeviceCaps
DeleteDC
GetObjectW
GetStockObject
SelectPalette
RealizePalette
GetDIBits
CreateFontIndirectW

advapi32

CryptAcquireContextW
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
RegCreateKeyW
RegEnumKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegCloseKey

shell32

ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoInitialize
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoTaskMemAlloc
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitializeEx
CoTaskMemRealloc
CoTaskMemFree
OleLoadFromStream
CreateOleAdviseHolder
OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
CreateDataAdviseHolder
WriteClassStm
OleSaveToStream
StringFromCLSID
CoUninitialize
CoCreateInstance

oleaut32

VariantClear
VariantInit
VariantCopy
OleCreatePropertyFrame
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
VariantChangeType
SysAllocStringByteLen
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysStringByteLen
SysAllocStringLen
SysStringLen
SysAllocString
SysFreeString

shlwapi

PathFileExistsW

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipCreateFont
GdipMeasureString
GdipDrawString
GdipFillRectangleI
GdipCreateFromHWND
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipCreateHBITMAPFromBitmap
GdipDeleteFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteStringFormat
GdipCreateStringFormat
GdipSetSolidFillColor
GdipDeleteBrush
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDrawImageRectRectI
GdipDrawImageRectI
GdipTranslateWorldTransform
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipCloneBrush

ws2_32

ntohl
send
recv
socket
inet_addr
htons
connect
htonl

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
skin/DefaultSkin/CatchScreen/Arc.png
.png
skin/DefaultSkin/CatchScreen/Arrowhead.png
.png
skin/DefaultSkin/CatchScreen/BigWidth.png
.png
skin/DefaultSkin/CatchScreen/Brush.png
.png
skin/DefaultSkin/CatchScreen/Cancle.png
.png
skin/DefaultSkin/CatchScreen/CatchPicBg.png
.png
skin/DefaultSkin/CatchScreen/CatchPicCopy.png
.png
skin/DefaultSkin/CatchScreen/CatchPicDel.png
.png
skin/DefaultSkin/CatchScreen/CatchPicIcon.png
.png
skin/DefaultSkin/CatchScreen/CatchPicOpen.png
.png
skin/DefaultSkin/CatchScreen/ColorBg.png
.png
skin/DefaultSkin/CatchScreen/CurDefBg.png
.png
skin/DefaultSkin/CatchScreen/LeftShadow.png
.png
skin/DefaultSkin/CatchScreen/MidWidth.png
.png
skin/DefaultSkin/CatchScreen/Rect.png
.png
skin/DefaultSkin/CatchScreen/Return.png
.png
skin/DefaultSkin/CatchScreen/RightShadow.png
.png
skin/DefaultSkin/CatchScreen/Save.png
.png
skin/DefaultSkin/CatchScreen/SaveAs.png
.png
skin/DefaultSkin/CatchScreen/SmallDefBg.png
.png
skin/DefaultSkin/CatchScreen/SmallWidth.png
.png
skin/DefaultSkin/CatchScreen/ToolBg.png
.png
skin/DefaultSkin/CatchScreen/transparent.png
.png
skin/DefaultSkin/CatchScreen/transparent2.png
.png
skin/DefaultSkin/Common/Mute.png
.png
skin/DefaultSkin/Common/catchgif.png
.png
skin/DefaultSkin/Common/file_download.png
.png
skin/DefaultSkin/Common/file_upload.png
.png
skin/DefaultSkin/Common/menu_select.png
.png
skin/DefaultSkin/Common/screenshot.png
.png
skin/DefaultSkin/Common/share.png
.png
skin/DefaultSkin/Common/transparent.png
.png
skin/DefaultSkin/DownloadManagement/bottom_left.png
.png
skin/DefaultSkin/DownloadManagement/bottom_middle.png
.png
skin/DefaultSkin/DownloadManagement/bottom_right.png
.png
skin/DefaultSkin/DownloadManagement/delete.png
.png
skin/DefaultSkin/DownloadManagement/details.png
.png
skin/DefaultSkin/DownloadManagement/gameskin.png
.png
skin/DefaultSkin/DownloadManagement/ico.png
.png
skin/DefaultSkin/DownloadManagement/line.png
.png
skin/DefaultSkin/DownloadManagement/middle.png
.png
skin/DefaultSkin/DownloadManagement/pause.png
.png
skin/DefaultSkin/DownloadManagement/progress_bg.png
.png
skin/DefaultSkin/DownloadManagement/progress_decompress.gif
.gif
skin/DefaultSkin/DownloadManagement/progress_download.gif
.gif
skin/DefaultSkin/DownloadManagement/progress_pause.png
.png
skin/DefaultSkin/DownloadManagement/shutdown.png
.png
skin/DefaultSkin/DownloadManagement/start.png
.png
skin/DefaultSkin/DownloadManagement/top_left.png
.png
skin/DefaultSkin/DownloadManagement/top_right.png
.png
skin/DefaultSkin/DownloadManagement/top_tool.png
.png
skin/DefaultSkin/FlashGame/AssistHide.png
.png
skin/DefaultSkin/FlashGame/AssistShow.png
.png
skin/DefaultSkin/FlashGame/AssistTab.png
.png
skin/DefaultSkin/FlashGame/Direct.png
.png
skin/DefaultSkin/FlashGame/DownloadDel.png
.png
skin/DefaultSkin/FlashGame/DownloadPause.png
.png
skin/DefaultSkin/FlashGame/Esc.png
.png
skin/DefaultSkin/FlashGame/FlashBgDefault.jpg
.jpg
skin/DefaultSkin/FlashGame/FlashBlogTop.png
.png
skin/DefaultSkin/FlashGame/FlashCtrlBg.png
.png
skin/DefaultSkin/FlashGame/FlashDownload.gif
.gif
skin/DefaultSkin/FlashGame/FlashDownloadBg.png
.png
skin/DefaultSkin/FlashGame/FlashStart.png
.png
skin/DefaultSkin/FlashGame/FullScreen.png
.png
skin/DefaultSkin/FlashGame/GameBlog.png
.png
skin/DefaultSkin/FlashGame/GameBlogMidLeft.png
.png
skin/DefaultSkin/FlashGame/GifBg.png
.png
skin/DefaultSkin/FlashGame/Grade.png
.png
skin/DefaultSkin/FlashGame/GradeBg.png
.png
skin/DefaultSkin/FlashGame/Istbg.png
.png
skin/DefaultSkin/FlashGame/PageDown.png
.png
skin/DefaultSkin/FlashGame/PageUp.png
.png
skin/DefaultSkin/FlashGame/Pause.png
.png
skin/DefaultSkin/FlashGame/Popular.png
.png
skin/DefaultSkin/FlashGame/RecommendNext.png
.png
skin/DefaultSkin/FlashGame/RecommendPre.png
.png
skin/DefaultSkin/FlashGame/Replay.png
.png
skin/DefaultSkin/FlashGame/ToolBg.png
.png
skin/DefaultSkin/FlashGame/close.png
.png
skin/DefaultSkin/FlashGame/flashtipbg.png
.png
skin/DefaultSkin/FlashGame/gifcatchbg.png
.png
skin/DefaultSkin/FlashGame/gifcatchstop.png
.png
skin/DefaultSkin/FlashGame/gifcatchtxtbg.png
.png
skin/DefaultSkin/FlashGame/iknow.png
.png
skin/DefaultSkin/FlashGame/rating.png
.png
skin/DefaultSkin/FlashPlugis/bg.png
.png
skin/DefaultSkin/FlashPlugis/prgoress.gif
.gif
skin/DefaultSkin/FlashPlugis/progressbg.png
.png
skin/DefaultSkin/MainTab/AddTab.png
.png
skin/DefaultSkin/MainTab/Close.png
.png
skin/DefaultSkin/MainTab/Tab.png
.png
skin/DefaultSkin/MsgTipWnd/Bottom_middle_kw.png
.png
skin/DefaultSkin/MsgTipWnd/Bottom_middle_tray.png
.png
skin/DefaultSkin/MsgTipWnd/Title.png
.png
skin/DefaultSkin/MsgTipWnd/Top_middle_tray.png
.png
skin/DefaultSkin/MsgTipWnd/msgtip_btn.PNG
.png
skin/DefaultSkin/NewPopWnd/close.png
.png
skin/DefaultSkin/NewPopWnd/complete.png
.png
skin/DefaultSkin/NewPopWnd/main_bottom_left.png
.png
skin/DefaultSkin/NewPopWnd/main_bottom_right.png
.png
skin/DefaultSkin/NewPopWnd/main_middle.png
.png
skin/DefaultSkin/NewPopWnd/main_top_left.png
.png
skin/DefaultSkin/NewPopWnd/main_top_right.png
.png
skin/DefaultSkin/NewPopWnd/pop_bottom_middle.png
.png
skin/DefaultSkin/NewPopWnd/pop_top_mid.png
.png
skin/DefaultSkin/NewPopWnd/pop_top_middle.png
.png
skin/DefaultSkin/NewPopWnd/rungame.png
.png
skin/DefaultSkin/OlineTempUser/accountbtn.png
.png
skin/DefaultSkin/OlineTempUser/accountpic.png
.png
skin/DefaultSkin/OlineTempUser/tempuserbtn.png
.png
skin/DefaultSkin/OlineTempUser/tempuserline.png
.png
skin/DefaultSkin/OlineTempUser/tempuserpic.png
.png
skin/DefaultSkin/Other/baidu.png
.png
skin/DefaultSkin/Other/baiduzhidao.png
.png
skin/DefaultSkin/Other/downfile_icon.png
.png
skin/DefaultSkin/Other/kuaiwen.png
.png
skin/DefaultSkin/Other/kwstrategy.png
.png
skin/DefaultSkin/Other/postfile_edit_border.png
.png
skin/DefaultSkin/Other/postfile_icon.png
.png
skin/DefaultSkin/Other/postfile_separator.png
.png
skin/DefaultSkin/Other/qqsoso.png
.png
skin/DefaultSkin/Other/qqwenwen.png
.png
skin/DefaultSkin/SetDlg/BottomMidBg.png
.png
skin/DefaultSkin/SetDlg/Btn210x20.png
.png
skin/DefaultSkin/SetDlg/Btn82x25.png
.png
skin/DefaultSkin/SetDlg/Check.png
.png
skin/DefaultSkin/SetDlg/EditBg119x22.png
.png
skin/DefaultSkin/SetDlg/EditClearBg.png
.png
skin/DefaultSkin/SetDlg/EditHotKeyBg.png
.png
skin/DefaultSkin/SetDlg/EditPathBg.png
.png
skin/DefaultSkin/SetDlg/Loading.gif
.gif
skin/DefaultSkin/SetDlg/PartingLine.png
.png
skin/DefaultSkin/SetDlg/RoundCheck.png
.png
skin/DefaultSkin/SetDlg/SetTab.png
.png
skin/DefaultSkin/SetDlg/TopBg.png
.png
skin/DefaultSkin/SetDlg/about.png
.png
skin/DefaultSkin/SetDlg/down.png
.png
skin/DefaultSkin/SetDlg/icon.png
.png
skin/DefaultSkin/SetDlg/up.png
.png
skin/DefaultSkin/SetSpeed/icon.png
.png
skin/DefaultSkin/SimpleBrowser/back.png
.png
skin/DefaultSkin/SimpleBrowser/bm_game.png
.png
skin/DefaultSkin/SimpleBrowser/bm_simple.png
.png
skin/DefaultSkin/SimpleBrowser/edit_left.png
.png
skin/DefaultSkin/SimpleBrowser/edit_middle.png
.png
skin/DefaultSkin/SimpleBrowser/edit_right.png
.png
skin/DefaultSkin/SimpleBrowser/favorite.png
.png
skin/DefaultSkin/SimpleBrowser/forward.png
.png
skin/DefaultSkin/SimpleBrowser/gamemode/Mute.png
.png
skin/DefaultSkin/SimpleBrowser/gamemode/NoMute.png
.png
skin/DefaultSkin/SimpleBrowser/gamemode/Speedx1.5.png
.png
skin/DefaultSkin/SimpleBrowser/gamemode/Speedx1.png
.png
skin/DefaultSkin/SimpleBrowser/gamemode/Speedx10.png
.png
skin/DefaultSkin/SimpleBrowser/gamemode/Speedx2.png
.png
skin/DefaultSkin/SimpleBrowser/gamemode/Speedx3.png
.png
skin/DefaultSkin/SimpleBrowser/gamemode/Speedx5.png
.png
skin/DefaultSkin/SimpleBrowser/gamemode/catchgif.png
.png
skin/DefaultSkin/SimpleBrowser/gamemode/stealplay.png
.png
skin/DefaultSkin/SimpleBrowser/refresh.png
.png
skin/DefaultSkin/SimpleBrowser/stop.png
.png
skin/DefaultSkin/SimpleBrowser/urlico.png
.png
skin/DefaultSkin/Skin.xml
.xml
skin/DefaultSkin/SkinUpdate/Bar.gif
.gif
skin/DefaultSkin/SkinUpdate/Bar_Bg.png
.png
skin/DefaultSkin/SkinUpdate/close.png
.png
skin/DefaultSkin/UpdateWnd/Top_bg.png
.png
skin/DefaultSkin/UpdateWnd/Top_title.png
.png
skin/DefaultSkin/UpdateWnd/Update_btn.png
.png
skin/DefaultSkin/UpdateWnd/Update_icon.png
.png
skin/DefaultSkin/UpdateWnd/bottom_bg.png
.png
skin/DefaultSkin/UpdateWnd/updatedefault.png
.png
skin/DefaultSkin/UserGuide/Appication.png
.png
skin/DefaultSkin/UserGuide/AppicationBorder.png
.png
skin/DefaultSkin/UserGuide/Close.png
.png
skin/DefaultSkin/UserGuide/ExeGameHelper.png
.png
skin/DefaultSkin/UserGuide/MyKuaiwan.png
.png
skin/DefaultSkin/UserGuide/bg_360.png
.png
skin/DefaultSkin/UserGuide/bg_466.png
.png
skin/DefaultSkin/UserGuide/skin.png
.png
skin/DefaultSkin/UserLogin/EditBg.png
.png
skin/DefaultSkin/UserLogin/Frame.png
.png
skin/DefaultSkin/UserLogin/HeadPortrait.png
.png
skin/DefaultSkin/UserLogin/Login.png
.png
skin/DefaultSkin/UserLogin/LoginBtnBg0.png
.png
skin/DefaultSkin/UserLogin/LoginBtnBg1.png
.png
skin/DefaultSkin/UserLogin/LoginBtnBg2.png
.png
skin/DefaultSkin/UserLogin/LoginFans.png
.png
skin/DefaultSkin/UserLogin/LoginGameBlog.png
.png
skin/DefaultSkin/UserLogin/LoginMoney.png
.png
skin/DefaultSkin/UserLogin/LoginPacksack.png
.png
skin/DefaultSkin/UserLogin/Member.png
.png
skin/DefaultSkin/UserLogin/Register.png
.png
skin/DefaultSkin/UserLogin/Signature.png
.png
skin/DefaultSkin/UserLogin/UserLogin.gif
.gif
skin/DefaultSkin/UserLogin/bg.png
.png
skin/DefaultSkin/UserLogin/tip_bg.png
.png
skin/DefaultSkin/UserLogin/tip_register.png
.png
skin/DefaultSkin/UserRec/UserRec.png
.png
skin/DefaultSkin/UserRec/default.jpg
.jpg
skin/DefaultSkin/add_localgame.png
.png
skin/DefaultSkin/application/add.png
.png
skin/DefaultSkin/application/app_bg.png
.png
skin/DefaultSkin/application/appbg.png
.png
skin/DefaultSkin/application/bg.png
.png
skin/DefaultSkin/application/bottom_left.png
.png
skin/DefaultSkin/application/bottom_middle.png
.png
skin/DefaultSkin/application/bottom_right.png
.png
skin/DefaultSkin/application/close.png
.png
skin/DefaultSkin/application/logo.png
.png
skin/DefaultSkin/application/middle.png
.png
skin/DefaultSkin/application/separator.png
.png
skin/DefaultSkin/application/showappbox.png
.png
skin/DefaultSkin/application/title.png
.png
skin/DefaultSkin/application/top_left.png
.png
skin/DefaultSkin/application/top_middle.png
.png
skin/DefaultSkin/application/top_right.png
.png
skin/DefaultSkin/collection/addcollection.png
.png
skin/DefaultSkin/collection/collectionbg.png
.png
skin/DefaultSkin/collection/edit.png
.png
skin/DefaultSkin/collection/logo.png
.png
skin/DefaultSkin/dp/close.png
.png
skin/DefaultSkin/dp/kown.png
.png
skin/DefaultSkin/dp/leftbottom.png
.png
skin/DefaultSkin/dp/lefttop.png
.png
skin/DefaultSkin/dp/rightbottom.png
.png
skin/DefaultSkin/dp/righttop.png
.png
skin/DefaultSkin/dp/run_leftbottom.png
.png
skin/DefaultSkin/dp/run_lefttop.png
.png
skin/DefaultSkin/dp/run_rightbottom.png
.png
skin/DefaultSkin/dp/run_righttop.png
.png
skin/DefaultSkin/findpage/homepage.PNG
.png
skin/DefaultSkin/findpage/leftbg.PNG
.png
skin/DefaultSkin/findpage/others.PNG
.png
skin/DefaultSkin/findpage/searchbg.PNG
.png
skin/DefaultSkin/findpage/searchbtn.PNG
.png
skin/DefaultSkin/findpage/select.PNG
.png
skin/DefaultSkin/findpage/selected.PNG
.png
skin/DefaultSkin/findpage/topbg.PNG
.png
skin/DefaultSkin/game_category/bg.png
.png
skin/DefaultSkin/game_category/collect.png
.png
skin/DefaultSkin/game_category/ct_exe.png
.png
skin/DefaultSkin/game_category/ct_flash.png
.png
skin/DefaultSkin/game_category/ct_online.png
.png
skin/DefaultSkin/game_category/ct_recently.png
.png
skin/DefaultSkin/game_category/ct_webgame.png
.png
skin/DefaultSkin/game_category/exe.png
.png
skin/DefaultSkin/game_category/flash.png
.png
skin/DefaultSkin/game_category/garbage_can.png
.png
skin/DefaultSkin/game_category/local.png
.png
skin/DefaultSkin/game_category/online.png
.png
skin/DefaultSkin/game_category/recently.png
.png
skin/DefaultSkin/game_category/webgame.png
.png
skin/DefaultSkin/helper/arrowleft.png
.png
skin/DefaultSkin/helper/arrowright.png
.png
skin/DefaultSkin/helper/bar_expand_right.png
.png
skin/DefaultSkin/helper/bar_left.png
.png
skin/DefaultSkin/helper/bar_middle.png
.png
skin/DefaultSkin/helper/bar_packup_right.png
.png
skin/DefaultSkin/helper/box.png
.png
skin/DefaultSkin/helper/cdkey.png
.png
skin/DefaultSkin/helper/default_related.png
.jpg
skin/DefaultSkin/helper/feedback.png
.png
skin/DefaultSkin/helper/game_booster.png
.png
skin/DefaultSkin/helper/gamerepair.png
.png
skin/DefaultSkin/helper/kuaiwen.png
.png
skin/DefaultSkin/helper/left_tool_bg.png
.png
skin/DefaultSkin/helper/meitu.png
.png
skin/DefaultSkin/helper/moreaccount.png
.png
skin/DefaultSkin/helper/network.png
.png
skin/DefaultSkin/helper/networkbg.png
.png
skin/DefaultSkin/helper/ogb_bgprogress.png
.png
skin/DefaultSkin/helper/ogb_progress.png
.png
skin/DefaultSkin/helper/rungame.png
.png
skin/DefaultSkin/helper/separator.png
.png
skin/DefaultSkin/helper/strategy.png
.png
skin/DefaultSkin/helper/tool_bg.png
.png
skin/DefaultSkin/helper/tools.png
.png
skin/DefaultSkin/helper/triangle.png
.png
skin/DefaultSkin/helper/triangle_btn.png
.png
skin/DefaultSkin/helper/wanbo.png
.png
skin/DefaultSkin/key/alt.png
.png
skin/DefaultSkin/key/arrows.png
.png
skin/DefaultSkin/key/blank.png
.png
skin/DefaultSkin/key/cmm.png
.png
skin/DefaultSkin/key/ctrl.png
.png
skin/DefaultSkin/key/down.png
.png
skin/DefaultSkin/key/end.png
.png
skin/DefaultSkin/key/enter.png
.png
skin/DefaultSkin/key/left.png
.png
skin/DefaultSkin/key/lr.png
.png
skin/DefaultSkin/key/ml.png
.png
skin/DefaultSkin/key/mm.png
.png
skin/DefaultSkin/key/mr.png
.png
skin/DefaultSkin/key/right.png
.png
skin/DefaultSkin/key/scroll.png
.png
skin/DefaultSkin/key/shift.png
.png
skin/DefaultSkin/key/space.png
.png
skin/DefaultSkin/key/tab.png
.png
skin/DefaultSkin/key/ud.png
.png
skin/DefaultSkin/key/up.png
.png
skin/DefaultSkin/key/wasd.png
.png
skin/DefaultSkin/loginwnd/AccIcon.png
.png
skin/DefaultSkin/loginwnd/FrameSel.png
.png
skin/DefaultSkin/loginwnd/FrameWin7.png
.png
skin/DefaultSkin/loginwnd/FrameXP.png
.png
skin/DefaultSkin/loginwnd/HeadPortrait.png
.png
skin/DefaultSkin/loginwnd/PasswordIcon.png
.png
skin/DefaultSkin/loginwnd/account_bg.png
.png
skin/DefaultSkin/loginwnd/errorbg.png
.png
skin/DefaultSkin/loginwnd/frame.png
.png
skin/DefaultSkin/loginwnd/list.png
.png
skin/DefaultSkin/loginwnd/list_win7.png
.png
skin/DefaultSkin/loginwnd/login.png
.png
skin/DefaultSkin/loginwnd/logining.gif
.gif
skin/DefaultSkin/loginwnd/minclose.png
.png
skin/DefaultSkin/loginwnd/picking.png
.png
skin/DefaultSkin/main_bottom_left.png
.png
skin/DefaultSkin/main_bottom_middle.png
.png
skin/DefaultSkin/main_bottom_right.png
.png
skin/DefaultSkin/main_close.png
.png
skin/DefaultSkin/main_middle.png
.png
skin/DefaultSkin/main_top_bg.png
.png
skin/DefaultSkin/main_top_left.png
.png
skin/DefaultSkin/main_top_middle.png
.png
skin/DefaultSkin/main_top_right.png
.png
skin/DefaultSkin/max.png
.png
skin/DefaultSkin/menu.png
.png
skin/DefaultSkin/min.png
.png
skin/DefaultSkin/moregame.png
.png
skin/DefaultSkin/msg.gif
.gif
skin/DefaultSkin/msg.png
.png
skin/DefaultSkin/page/arrow_left.png
.png
skin/DefaultSkin/page/arrow_right.png
.png
skin/DefaultSkin/page/page.png
.png
skin/DefaultSkin/repairwnd/Bar.png
.png
skin/DefaultSkin/repairwnd/BarBg.png
.png
skin/DefaultSkin/repairwnd/logo.png
.png
skin/DefaultSkin/restore.png
.png
skin/DefaultSkin/scroll/bg.png
.png
skin/DefaultSkin/scroll/bg13.png
.png
skin/DefaultSkin/scroll/down.png
.png
skin/DefaultSkin/scroll/down13.png
.png
skin/DefaultSkin/scroll/h_bg.png
.png
skin/DefaultSkin/scroll/roundbg.png
.png
skin/DefaultSkin/scroll/roundbg13.png
.png
skin/DefaultSkin/scroll/roundtop.png
.png
skin/DefaultSkin/scroll/roundtop13.png
.png
skin/DefaultSkin/scroll/up.png
.png
skin/DefaultSkin/scroll/up13.png
.png
skin/DefaultSkin/separator.png
.png
skin/DefaultSkin/skin.png
.png
skin/DefaultSkin/skindownload/Bar.png
.png
skin/DefaultSkin/skindownload/BarBg.png
.png
skin/DefaultSkin/skindownload/Check_CPU.png
.png
skin/DefaultSkin/skindownload/Check_Gra.png
.png
skin/DefaultSkin/skindownload/Check_Hard.png
.png
skin/DefaultSkin/skindownload/Check_Mem.png
.png
skin/DefaultSkin/skindownload/Check_Sys.png
.png
skin/DefaultSkin/skindownload/Check_YorN.png
.png
skin/DefaultSkin/skindownload/Check_ing.gif
.gif
skin/DefaultSkin/skindownload/Correct.png
.png
skin/DefaultSkin/skindownload/Del.png
.png
skin/DefaultSkin/skindownload/DelReco.png
.png
skin/DefaultSkin/skindownload/Download.png
.png
skin/DefaultSkin/skindownload/DownloadReco.png
.png
skin/DefaultSkin/skindownload/Msg.png
.png
skin/DefaultSkin/skindownload/bg.png
.png
skin/DefaultSkin/skindownload/decompress.gif
.gif
skin/DefaultSkin/skindownload/delete.png
.png
skin/DefaultSkin/skindownload/link_cdkey.png
.png
skin/DefaultSkin/skindownload/link_homgpage.png
.png
skin/DefaultSkin/skindownload/link_meitu.png
.png
skin/DefaultSkin/skindownload/link_package.png
.png
skin/DefaultSkin/skindownload/link_register.png
.png
skin/DefaultSkin/skindownload/link_strategy.png
.png
skin/DefaultSkin/skindownload/link_wanbo.png
.png
skin/DefaultSkin/skindownload/lnk_bg.png
.png
skin/DefaultSkin/skindownload/loading.gif
.gif
skin/DefaultSkin/skindownload/loading_bg.png
.png
skin/DefaultSkin/skindownload/pagebg.png
.png
skin/DefaultSkin/skindownload/pause.png
.png
skin/DefaultSkin/skindownload/start.png
.png
skin/DefaultSkin/skindownload/stoploading.png
.png
skin/DefaultSkin/skindownload/top.png
.png
skin/DefaultSkin/statusbar/B.png
.png
skin/DefaultSkin/statusbar/G.png
.png
skin/DefaultSkin/statusbar/H.png
.png
skin/DefaultSkin/statusbar/K.png
.png
skin/DefaultSkin/statusbar/Q.png
.png
skin/DefaultSkin/statusbar/V.png
.png
skin/DefaultSkin/statusbar/W.png
.png
skin/DefaultSkin/statusbar/bg.png
.png
skin/DefaultSkin/statusbar/dl_define.png
.png
skin/DefaultSkin/statusbar/dl_download.png
.png
skin/DefaultSkin/statusbar/dl_smart.png
.png
skin/DefaultSkin/statusbar/dl_stop.png
.png
skin/DefaultSkin/statusbar/logo_downlaod.png
.png
skin/DefaultSkin/statusbar/set.png
.png
skin/DefaultSkin/statusbar/transparentbtn100_21.png
.png
skin/DefaultSkin/statusbar/transparentbtn152_21.png
.png
skin/DefaultSkin/thirdskinwnd/bottom_left.png
.png
skin/DefaultSkin/thirdskinwnd/bottom_middle.png
.png
skin/DefaultSkin/thirdskinwnd/bottom_right.png
.png
skin/DefaultSkin/thirdskinwnd/middle.png
.png
skin/DefaultSkin/thirdskinwnd/no_line_top_bg.png
.png
skin/DefaultSkin/thirdskinwnd/top_bg.png
.png
skin/DefaultSkin/thirdskinwnd/top_left.png
.png
skin/DefaultSkin/thirdskinwnd/top_right.png
.png
skin/DefaultSkin/usergame.png
.jpg
skin/DefaultSkin/usergame_title.png
.png
skin/DefaultSkin/usergamebg.png
.png
skin/DefaultSkin/usergameskin.png
.png
skin/DefaultSkin/webgame/Picking.png
.png
skin/DefaultSkin/webgame/Speedx0.5.png
.png
skin/DefaultSkin/webgame/Speedx0.7.png
.png
skin/DefaultSkin/webgame/Speedx1.5.png
.png
skin/DefaultSkin/webgame/Speedx1.png
.png
skin/DefaultSkin/webgame/Speedx10.png
.png
skin/DefaultSkin/webgame/Speedx2.png
.png
skin/DefaultSkin/webgame/Speedx3.png
.png
skin/DefaultSkin/webgame/Speedx5.png
.png
skin/DefaultSkin/webgame/account.png
.png
skin/DefaultSkin/webgame/assistanttool.png
.png
skin/DefaultSkin/webgame/clearcache.png
.png
skin/DefaultSkin/webgame/clearcacheing.gif
.gif
skin/DefaultSkin/webgame/close.png
.png
skin/DefaultSkin/webgame/customer.png
.png
skin/DefaultSkin/webgame/login.png
.png
skin/DefaultSkin/webgame/logo_clearcahe.png
.png
skin/DefaultSkin/webgame/more_link.png
.png
skin/DefaultSkin/webgame/more_login.png
.png
skin/DefaultSkin/webgame/moreaccount.png
.png
skin/DefaultSkin/webgame/moreaccount_bg.png
.png
skin/DefaultSkin/webgame/ok.png
.png
skin/DefaultSkin/webgame/othertools.png
.png
skin/DefaultSkin/webgame/pay.png
.png
skin/DefaultSkin/webgame/refresh.png
.png
skin/DefaultSkin/webgame/selecting.png
.png
skin/DefaultSkin/webgame/separator.png
.png
skin/DefaultSkin/webgame/stealplay.png
.png
skin/DefaultSkin/webgame/stealplay/Speedx1.5.png
.png
skin/DefaultSkin/webgame/stealplay/Speedx1.png
.png
skin/DefaultSkin/webgame/stealplay/Speedx10.png
.png
skin/DefaultSkin/webgame/stealplay/Speedx2.png
.png
skin/DefaultSkin/webgame/stealplay/Speedx3.png
.png
skin/DefaultSkin/webgame/stealplay/Speedx5.png
.png
skin/DefaultSkin/webgame/stealplay/close.png
.png
skin/DefaultSkin/webgame/stealplay/flyin.png
.png
skin/DefaultSkin/webgame/stealplay/min.png
.png
skin/DefaultSkin/webgame/stealplay/mute.png
.png
skin/DefaultSkin/webgame/stealplay/nomute.png
.png
skin/DefaultSkin/webgame/stealplay/refresh.png
.png
skin/DefaultSkin/webgame/stealplay/rightdownmovetip.png
.png
skin/DefaultSkin/webgame/stealplay/top_mid.png
.png
skin/DefaultSkin/webgame/stealplay/top_middle.png
.png
skin/DefaultSkin/webgame/stealplay/zoom.png
.png
skin/DefaultSkin/webgame/stealplay/zoomtip.png
.png
skin/DefaultSkin/webgame/strategy.png
.png
skin/DefaultSkin/webgame/surplus_time.png
.png
skin/DefaultSkin/webgame/useravatar.png
.png
skin/DefaultSkin/webgame/useravatar_disable.png
.png
skin/DefaultSkin/xunyou/first_bg.png
.png
skin/DefaultSkin/xunyou/img.png
.png
skin/DefaultSkin/xunyou/line.png
.png
skin/DefaultSkin/xunyou/logo.png
.png
skin/DefaultSkin/xunyou/progress.png
.png
skin/DefaultSkin/xunyou/progress_bg.png
.png
skin/DefaultSkin/xunyou/speeduping.gif
.gif
skin/DefaultSkin/xunyou/start_speedup.png
.png
skin/DefaultSkin/xunyou/stop_speedup.png
.png
skin/DefaultSkin/xunyou/xunyou.png
.png
skin/common/Picking.png
.png
skin/common/PromptSuccess.png
.png
skin/common/addlocalgame.png
.png
skin/common/arrow_tray.png
.png
skin/common/btn23_23.png
.png
skin/common/btn60_25.png
.png
skin/common/btn82_25.png
.png
skin/common/btn91_23.png
.png
skin/common/default_tool.png
.png
skin/common/download_default.jpg
.jpg
skin/common/feedbackbtn.png
.png
skin/common/game_decompress_progress.png
.png
skin/common/game_progress.png
.png
skin/common/game_progressbg.png
.png
skin/common/info.png
.png
skin/common/lnk_bg.png
.png
skin/common/loading.gif
.gif
skin/common/logo16_16.png
.png
skin/common/logo24_26.png
.png
skin/common/menu.png
.png
skin/common/packup_tool.png
.png
skin/common/search.gif
.gif
skin/common/show_all_tool.png
.png
skin/common/tab111_28.png
.png
skin/common/tipclose.png
.png
skin/common/tool_cancel.png
.png
skin/common/tool_progress.png
.png
skin/common/tool_progressbg.png
.png
skin/common/tool_web.png
.png
skin/common/usergame_delete.png
.png
skin/findgame.xml
.xml

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

3b:bf:07:94:1f:a0:cd:57:ae:0e:b9:b1:ee:54:7c:58:42:c8:fc:d4Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 84KB

.rsrc Size: 174KB - Virtual size: 173KB

746751a402c45d9119b416e0c40abc85

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

50:34:5c:8c:92:66:49:34:69:3b:f6:a5:87:4d:94:25:e2:de:4a:e3Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

ws2_32

version

Sections

.text Size: 88KB - Virtual size: 86KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 8KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 1KB

1329c7346f77bc3946c7df5df69fa5ff

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

shell32

comctl32

shlwapi

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

3b:bf:07:94:1f:a0:cd:57:ae:0e:b9:b1:ee:54:7c:58:42:c8:fc:d4
Signer

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 84KB

.rsrc
Size: 174KB - Virtual size: 173KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

50:34:5c:8c:92:66:49:34:69:3b:f6:a5:87:4d:94:25:e2:de:4a:e3
Signer

.text
Size: 88KB - Virtual size: 86KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 1KB

.text
Size: 165KB - Virtual size: 165KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 8KB - Virtual size: 23KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 33KB - Virtual size: 32KB

.text
Size: 165KB - Virtual size: 165KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 8KB - Virtual size: 23KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 33KB - Virtual size: 32KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2c:ca:c0:20:4e:26:af:c8:93:f8:a3:db:73:e0:1c:70
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

50:34:5c:8c:92:66:49:34:69:3b:f6:a5:87:4d:94:25:e2:de:4a:e3
Signer

.text
Size: 88KB - Virtual size: 86KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 1KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate