3b4bc58ccc9d3b7cc593bbf228255a3f_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3b4bc58ccc9d3b7cc593bbf228255a3f_JaffaCakes118
Size

23.9MB
MD5

3b4bc58ccc9d3b7cc593bbf228255a3f
SHA1

323f70c103705ce86db4309a0f6863fe0cf76e38
SHA256

b64324cf3e3fe9e4d6dad9fc9da32b963a6d845f9e47473394ceb33eddac1fed
SHA512

40e275c70355e32d46243ee11bf9de31241b13a7adfcf09c6f07571dabc918773ba47787cf209a926260c3dfbe38443cd7cc9285fd4df9eaa596f5e235f4deaf
SSDEEP

393216:8K8zOUmoejKYL2uilJXPlJyu0s+3W2Qm/niWbZ4B9mESYfz9lJJIu5cpCqS1Guy:n8zD8KYGXPfX0x33QGp4jmEFzz5CCDy

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 9 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack003/$SYSDIR/$SYSDIR/CCBDMBDI.dll	vmprotect
static1/unpack003/$SYSDIR/$SYSDIR/CCBDMBDI.dll.$1	vmprotect
static1/unpack003/$SYSDIR/$SYSDIR/CCBKCAPIV2.dll	vmprotect
static1/unpack003/$SYSDIR/$SYSDIR/CCBKCAPIV2.dll.$1	vmprotect
static1/unpack006/$SYSDIR/$(LSTR_46)/TokenMgr.dll	vmprotect
static1/unpack006/$SYSDIR/$(LSTR_46)/WDAlg.dll	vmprotect
static1/unpack006/$SYSDIR/$(LSTR_46)/WDCSP03.dll	vmprotect
static1/unpack006/$SYSDIR/$(LSTR_46)/hodll.dll	vmprotect
static1/unpack001/$PROGRAMFILES64/CCBComponents/Detector/Ccb_Cert_dmwz_GM.dll	vmprotect

Unsigned PE 86 IoCs

Checks for missing Authenticode signature.

resource
unpack002/$PLUGINSDIR/GetVersion.dll
unpack002/$PLUGINSDIR/KillProcDLL.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/UserInfo.dll
unpack002/$SYSDIR/$SYSDIR/CCBKCSP.dll
unpack002/$SYSDIR/$SYSDIR/CCBKCSP.dll.$1
unpack002/$SYSDIR/$SYSDIR/CCBKCSPV2.dll
unpack002/$SYSDIR/$SYSDIR/CCBKCSPV2.dll.$1
unpack002/$SYSDIR/$SYSDIR/ChanePrivileges.exe
unpack002/$SYSDIR/$SYSDIR/ChanePrivileges.exe.$1
unpack002/$SYSDIR/$SYSDIR/DMCCBpkcs11.dll
unpack002/$SYSDIR/$SYSDIR/DMCCBpkcs11.dll.$1
unpack002/$SYSDIR/$SYSDIR/TerminateProcess_dmwz.dll
unpack002/$SYSDIR/$SYSDIR/TerminateProcess_dmwz.dll.$1
unpack002/InstallerCCID.exe
unpack002/InstallerCCID.exe.$1
unpack002/usbccid.sys
unpack002/usbccid.sys.$1
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/UserInfo.dll
unpack003/$PLUGINSDIR/nsProcess.dll
unpack003/$SYSDIR/$SYSDIR/CCBKCSP.dll
unpack003/$SYSDIR/$SYSDIR/CCBKCSP.dll.$1
unpack003/$SYSDIR/$SYSDIR/CCBKCSPV2.dll
unpack003/$SYSDIR/$SYSDIR/CCBKCSPV2.dll.$1
unpack004/$PLUGINSDIR/System.dll
unpack004/$PLUGINSDIR/nsExec.dll
unpack004/$SYSDIR/CCB_HDZB_CCID_USBKey2G/HDZB_CSP.dll
unpack004/usbccid.sys
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/SkinBtn.dll
unpack001/$PLUGINSDIR/SkinProgress.dll
unpack001/$PLUGINSDIR/System.dll
unpack005/$PLUGINSDIR/InstallOptions.dll
unpack005/$PLUGINSDIR/KillProcDLL.dll
unpack005/$PLUGINSDIR/Plugin_CCB.dll
unpack005/$PLUGINSDIR/System.dll
unpack005/$PLUGINSDIR/UserInfo.dll
unpack005/$SYSDIR/D4CSP_CCBs.dll
unpack005/usbccid.sys
unpack001/$PLUGINSDIR/UserInfo.dll
unpack006/$PLUGINSDIR/System.dll
unpack006/$PLUGINSDIR/nsProcess.dll
unpack006/$PROGRAMFILES/$(LSTR_47)/WDPKCSUtil.exe
unpack006/$SYSDIR/$(LSTR_42)/UIResC3.dll
unpack006/$SYSDIR/$(LSTR_42)/UIResE3.dll
unpack006/$SYSDIR/$(LSTR_42)/UIResT3.dll
unpack006/$SYSDIR/$(LSTR_42)/WDAlg.dll
unpack006/$SYSDIR/$(LSTR_42)/WDCSP03.dll
unpack006/$SYSDIR/$(LSTR_42)/WDCertM_CCB.exe
unpack006/$SYSDIR/$(LSTR_42)/WDEvent.dll
unpack006/$SYSDIR/$(LSTR_42)/WDKeyMonitorCCB.exe
unpack006/$SYSDIR/$(LSTR_42)/clrcert.exe
unpack006/$SYSDIR/$(LSTR_42)/wdkmgr.dll
unpack006/$SYSDIR/$(LSTR_42)/wdpkcs.dll
unpack006/$SYSDIR/$(LSTR_42)/wdsafe3.dll
unpack006/$SYSDIR/$(LSTR_46)/wdsafe3.dll
unpack006/$SYSDIR/CCBNSIS.dll
unpack006/$SYSDIR/WDCCBpkcs11.dll
unpack006/usbccid.sys
unpack001/$PLUGINSDIR/WndProc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/$PLUGINSDIR/nsWindows$_13_.dll
unpack001/$SYSDIR/WDGetDeviceCaps.dll
unpack001/$SYSDIR/mfc42.dll
unpack001/Detector/CCBSignCom.dll
unpack001/Detector/mfc42.dll
unpack001/Plugins/CARoot/certutil.exe
unpack001/Plugins/CARoot/freebl3.dll
unpack001/Plugins/CARoot/libnspr4.dll
unpack001/Plugins/CARoot/libplc4.dll
unpack001/Plugins/CARoot/libplds4.dll
unpack001/Plugins/CARoot/modutil.exe
unpack001/Plugins/CARoot/nspr4.dll
unpack001/Plugins/CARoot/nss3.dll
unpack001/Plugins/CARoot/nssckbi.dll
unpack001/Plugins/CARoot/nssdbm3.dll
unpack001/Plugins/CARoot/nssutil3.dll
unpack001/Plugins/CARoot/plc4.dll
unpack001/Plugins/CARoot/plds4.dll
unpack001/Plugins/CARoot/smime3.dll
unpack001/Plugins/CARoot/softokn3.dll
unpack001/Plugins/CARoot/sqlite3.dll
unpack001/Plugins/CARoot/ssl3.dll
unpack001/log/$SYSDIR/FindDLL.dll

NSIS installer 11 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$PLUGINSDIR/CCB_DM_LCD_32_silent.exe	nsis_installer_1
static1/unpack001/$PLUGINSDIR/CCB_DM_LCD_32_silent.exe	nsis_installer_2
static1/unpack001/$PLUGINSDIR/CCB_DM_LCD_x64_silent.exe	nsis_installer_1
static1/unpack001/$PLUGINSDIR/CCB_DM_LCD_x64_silent.exe	nsis_installer_2
static1/unpack001/$PLUGINSDIR/CCB_HDZB_USBKEY_1G_Setup_S64.exe	nsis_installer_2
static1/unpack001/$PLUGINSDIR/CCB_HDZB_USBKEY_2G_Setup_S64.exe	nsis_installer_1
static1/unpack001/$PLUGINSDIR/CCB_HDZB_USBKEY_2G_Setup_S64.exe	nsis_installer_2
static1/unpack001/$PLUGINSDIR/WDCCB_32+64bit.exe	nsis_installer_1
static1/unpack001/$PLUGINSDIR/WDCCB_32+64bit.exe	nsis_installer_2

Files

3b4bc58ccc9d3b7cc593bbf228255a3f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:f8:0a:29:62:f1:de:b7:8a:5a:88:89:67:37:f8:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-11-2015 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:4c:43:c6:70:0e:4c:81:c9:44:2b:63:01:18:c7:57
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-01-2016 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:b5:f1:4c:c2:7a:6d:af:54:33:93:a5:0d:15:ba:27:e2:91:a0:a0:2b:d7:7b:fb:e5:fd:b4:fa:9d:6e:91:e7
Signer

Actual PE Digest

19:b5:f1:4c:c2:7a:6d:af:54:33:93:a5:0d:15:ba:27:e2:91:a0:a0:2b:d7:7b:fb:e5:fd:b4:fa:9d:6e:91:e7

Digest Algorithm

sha256

PE Digest Matches

true

a8:48:78:2f:fd:72:65:26:c7:53:eb:19:00:62:e4:a7:20:1e:23:74
Signer

Actual PE Digest

a8:48:78:2f:fd:72:65:26:c7:53:eb:19:00:62:e4:a7:20:1e:23:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 112KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/CCB_DM_LCD_32_silent.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8f:53:aa:de:d5:c0:5d:a1:db:ac:7e:46:c0:53:85:bb:45:6b:82:80:9f:78:9f:a0:0b:56:2b:a4:86:bd:fd:b8
Signer

Actual PE Digest

8f:53:aa:de:d5:c0:5d:a1:db:ac:7e:46:c0:53:85:bb:45:6b:82:80:9f:78:9f:a0:0b:56:2b:a4:86:bd:fd:b8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/GetVersion.dll
.dll windows:5 windows x86 arch:x86

fb1aa2bbc159c94cb45792330366bd5f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GetModuleHandleA
lstrcpynA
GlobalAlloc
GetProcAddress
GetSystemInfo
GetVersionExA

user32

GetSystemMetrics
wsprintfA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Exports

Exports

WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsServicePack
WindowsServicePackBuild
WindowsServicePackMajor
WindowsServicePackMinor
WindowsType
WindowsVersion

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
RtlUnwind
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP

Exports

Exports

KillProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

afa8e526425f3585465337467d0b5909

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
lstrcpynA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 741B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 673B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES/CCBComponents/Plugins/$PROGRAMFILES/CCBComponents/Plugins/npdmccbplugin.dll
.dll windows:5 windows x86 arch:x86

57b14e9b47591e1278bf442ebceeafc1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

30:12:60:20:60:06:ce:3c:20:5e:a1:84:cb:0e:f6:ea:8e:5f:c6:ad:aa:2f:af:fd:18:68:73:b3:7d:72:0c:92
Signer

Actual PE Digest

30:12:60:20:60:06:ce:3c:20:5e:a1:84:cb:0e:f6:ea:8e:5f:c6:ad:aa:2f:af:fd:18:68:73:b3:7d:72:0c:92

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

netapi32

Netbios

ws2_32

inet_ntoa
gethostname
gethostbyname

kernel32

ReadFile
GetProcessHeap
FreeLibrary
GetProcAddress
LoadLibraryA
GetLastError
GetSystemDirectoryA
GetVersionExA
GlobalMemoryStatus
GetSystemDefaultLangID
GetTempPathA
GetCurrentThreadId
GetSystemTime
SetEndOfFile
GetLocaleInfoA
GetLocalTime
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
GetCurrentProcessId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleHandleA
HeapSize
CloseHandle
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
MultiByteToWideChar
LCMapStringW
SetFilePointer
InitializeCriticalSectionAndSpinCount
SetStdHandle
FlushFileBuffers
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW

user32

InvalidateRect
UpdateWindow
DefWindowProcA
SetWindowLongA

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

shlwapi

PathFileExistsA

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES/CCBComponents/Plugins/$PROGRAMFILES/CCBComponents/Plugins/npdmccbplugin.dll.$1
.dll windows:5 windows x86 arch:x86

57b14e9b47591e1278bf442ebceeafc1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

30:12:60:20:60:06:ce:3c:20:5e:a1:84:cb:0e:f6:ea:8e:5f:c6:ad:aa:2f:af:fd:18:68:73:b3:7d:72:0c:92
Signer

Actual PE Digest

30:12:60:20:60:06:ce:3c:20:5e:a1:84:cb:0e:f6:ea:8e:5f:c6:ad:aa:2f:af:fd:18:68:73:b3:7d:72:0c:92

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

netapi32

Netbios

ws2_32

inet_ntoa
gethostname
gethostbyname

kernel32

ReadFile
GetProcessHeap
FreeLibrary
GetProcAddress
LoadLibraryA
GetLastError
GetSystemDirectoryA
GetVersionExA
GlobalMemoryStatus
GetSystemDefaultLangID
GetTempPathA
GetCurrentThreadId
GetSystemTime
SetEndOfFile
GetLocaleInfoA
GetLocalTime
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
GetCurrentProcessId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleHandleA
HeapSize
CloseHandle
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
MultiByteToWideChar
LCMapStringW
SetFilePointer
InitializeCriticalSectionAndSpinCount
SetStdHandle
FlushFileBuffers
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW

user32

InvalidateRect
UpdateWindow
DefWindowProcA
SetWindowLongA

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

shlwapi

PathFileExistsA

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES/CCBComponents/Plugins/$PROGRAMFILES/CCBComponents/Plugins/npdmwritecert.dll
.dll windows:5 windows x86 arch:x86

3ed1959f0fbeb61dd31b276998198027

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:e7:24:b3:b2:26:ce:97:09:13:66:34:53:db:6a:3f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

25-06-2010 00:00

Not After

14-08-2012 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

13:d0:a2:b3:a4:94:ad:5d:bc:40:f8:89:3b:19:d9:71:5c:51:10:b3
Signer

Actual PE Digest

13:d0:a2:b3:a4:94:ad:5d:bc:40:f8:89:3b:19:d9:71:5c:51:10:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertCreateCertificateContext
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertOpenStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore

advapi32

LookupAccountNameA
LookupPrivilegeValueA
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetUserNameA
SetEntriesInAclA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AdjustTokenPrivileges

netapi32

Netbios

ws2_32

inet_ntoa
gethostname
gethostbyname

kernel32

GetStdHandle
GetCurrentProcess
GetSystemTime
CreateEventA
ResetEvent
WaitForSingleObject
SetEvent
GetLocalTime
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
ReleaseMutex
GlobalFree
GlobalAlloc
FlushConsoleInputBuffer
LocalFree
DeviceIoControl
Sleep
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
QueryPerformanceCounter
GetTickCount
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentProcessId
CloseHandle
GetLastError
GetCurrentThreadId
CreateFileA
GetSystemDefaultLangID
GlobalMemoryStatus
GetVersionExA
MultiByteToWideChar
GetModuleHandleA
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
CreateMutexA
InitializeCriticalSectionAndSpinCount
VirtualQuery
SetFilePointer
GetProcessHeap
SetStdHandle
FlushFileBuffers
GetConsoleCP
ReadFile
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetEnvironmentStringsW
WideCharToMultiByte
HeapFree
HeapAlloc
RtlUnwind
RaiseException
GetCommandLineA
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
TerminateProcess
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
VirtualAlloc
GetModuleHandleW
ExitProcess
WriteFile
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

user32

GetDlgItem
GetWindowTextA
EndDialog
UpdateWindow
DialogBoxParamA
SetWindowLongA
InvalidateRect
DefWindowProcA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces

secur32

GetUserNameExA

winscard

SCardEstablishContext
SCardDisconnect
SCardConnectA
SCardReleaseContext
SCardBeginTransaction
SCardFreeMemory
SCardListReadersA
SCardEndTransaction
SCardTransmit
g_rgSCardT1Pci

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 426KB - Virtual size: 425KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES/CCBComponents/Plugins/$PROGRAMFILES/CCBComponents/Plugins/npdmwritecert.dll.$1
.dll windows:5 windows x86 arch:x86

3ed1959f0fbeb61dd31b276998198027

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:e7:24:b3:b2:26:ce:97:09:13:66:34:53:db:6a:3f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

25-06-2010 00:00

Not After

14-08-2012 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

13:d0:a2:b3:a4:94:ad:5d:bc:40:f8:89:3b:19:d9:71:5c:51:10:b3
Signer

Actual PE Digest

13:d0:a2:b3:a4:94:ad:5d:bc:40:f8:89:3b:19:d9:71:5c:51:10:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertCreateCertificateContext
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertOpenStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore

advapi32

LookupAccountNameA
LookupPrivilegeValueA
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetUserNameA
SetEntriesInAclA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AdjustTokenPrivileges

netapi32

Netbios

ws2_32

inet_ntoa
gethostname
gethostbyname

kernel32

GetStdHandle
GetCurrentProcess
GetSystemTime
CreateEventA
ResetEvent
WaitForSingleObject
SetEvent
GetLocalTime
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
ReleaseMutex
GlobalFree
GlobalAlloc
FlushConsoleInputBuffer
LocalFree
DeviceIoControl
Sleep
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
QueryPerformanceCounter
GetTickCount
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentProcessId
CloseHandle
GetLastError
GetCurrentThreadId
CreateFileA
GetSystemDefaultLangID
GlobalMemoryStatus
GetVersionExA
MultiByteToWideChar
GetModuleHandleA
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
CreateMutexA
InitializeCriticalSectionAndSpinCount
VirtualQuery
SetFilePointer
GetProcessHeap
SetStdHandle
FlushFileBuffers
GetConsoleCP
ReadFile
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetEnvironmentStringsW
WideCharToMultiByte
HeapFree
HeapAlloc
RtlUnwind
RaiseException
GetCommandLineA
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
TerminateProcess
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
VirtualAlloc
GetModuleHandleW
ExitProcess
WriteFile
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

user32

GetDlgItem
GetWindowTextA
EndDialog
UpdateWindow
DialogBoxParamA
SetWindowLongA
InvalidateRect
DefWindowProcA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces

secur32

GetUserNameExA

winscard

SCardEstablishContext
SCardDisconnect
SCardConnectA
SCardReleaseContext
SCardBeginTransaction
SCardFreeMemory
SCardListReadersA
SCardEndTransaction
SCardTransmit
g_rgSCardT1Pci

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 426KB - Virtual size: 425KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES/CCBComponents/Plugins/CARoot/$PROGRAMFILES/CCBComponents/Plugins/CARoot/CheckP11.exe
.exe windows:5 windows x86 arch:x86

a7118d0ddba8e2e3f04c628dab59d940

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:e7:24:b3:b2:26:ce:97:09:13:66:34:53:db:6a:3f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

25-06-2010 00:00

Not After

14-08-2012 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

97:6d:9d:5d:e3:85:a0:09:67:1b:46:a0:82:ff:a8:77:be:df:7f:44
Signer

Actual PE Digest

97:6d:9d:5d:e3:85:a0:09:67:1b:46:a0:82:ff:a8:77:be:df:7f:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\2011-7-1广州\Code\eSafeAR_lite\CCB_FireFox_Check\trunk\src\CheckP11\Release\CheckP11.pdb

Imports

nss3

NSS_Shutdown
NSS_Initialize
SECMOD_FindModule

nspr4

PR_Cleanup
PR_Init

kernel32

GetFileType
HeapSize
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetLastError
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PROGRAMFILES/CCBComponents/Plugins/CARoot/$PROGRAMFILES/CCBComponents/Plugins/CARoot/CheckP11.exe.$1
.exe windows:5 windows x86 arch:x86

a7118d0ddba8e2e3f04c628dab59d940

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:e7:24:b3:b2:26:ce:97:09:13:66:34:53:db:6a:3f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

25-06-2010 00:00

Not After

14-08-2012 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

97:6d:9d:5d:e3:85:a0:09:67:1b:46:a0:82:ff:a8:77:be:df:7f:44
Signer

Actual PE Digest

97:6d:9d:5d:e3:85:a0:09:67:1b:46:a0:82:ff:a8:77:be:df:7f:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\2011-7-1广州\Code\eSafeAR_lite\CCB_FireFox_Check\trunk\src\CheckP11\Release\CheckP11.pdb

Imports

nss3

NSS_Shutdown
NSS_Initialize
SECMOD_FindModule

nspr4

PR_Cleanup
PR_Init

kernel32

GetFileType
HeapSize
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetLastError
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PROGRAMFILES/CCBComponents/Plugins/CARoot/$PROGRAMFILES/CCBComponents/Plugins/CARoot/InstallP11.exe
.exe windows:5 windows x86 arch:x86

5ecec83838b83df1f9805db89ad6098d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:e7:24:b3:b2:26:ce:97:09:13:66:34:53:db:6a:3f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

25-06-2010 00:00

Not After

14-08-2012 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

80:24:1a:7f:00:90:e8:48:94:04:b8:4d:f2:ad:6d:ec:77:b3:0e:0f
Signer

Actual PE Digest

80:24:1a:7f:00:90:e8:48:94:04:b8:4d:f2:ad:6d:ec:77:b3:0e:0f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

nss3

SECMOD_AddNewModule
NSS_Shutdown
NSS_Initialize

nspr4

PR_Cleanup
PR_Init

kernel32

InterlockedIncrement
HeapSize
GetPrivateProfileIntA
GetPrivateProfileStringA
GetWindowsDirectoryA
GetCurrentThreadId
GetLocaleInfoA
GetCurrentProcessId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
CloseHandle
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
CreateFileA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

shell32

SHGetFolderPathA

shlwapi

PathFileExistsA

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PROGRAMFILES/CCBComponents/Plugins/CARoot/$PROGRAMFILES/CCBComponents/Plugins/CARoot/InstallP11.exe.$1
.exe windows:5 windows x86 arch:x86

5ecec83838b83df1f9805db89ad6098d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:e7:24:b3:b2:26:ce:97:09:13:66:34:53:db:6a:3f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

25-06-2010 00:00

Not After

14-08-2012 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

80:24:1a:7f:00:90:e8:48:94:04:b8:4d:f2:ad:6d:ec:77:b3:0e:0f
Signer

Actual PE Digest

80:24:1a:7f:00:90:e8:48:94:04:b8:4d:f2:ad:6d:ec:77:b3:0e:0f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

nss3

SECMOD_AddNewModule
NSS_Shutdown
NSS_Initialize

nspr4

PR_Cleanup
PR_Init

kernel32

InterlockedIncrement
HeapSize
GetPrivateProfileIntA
GetPrivateProfileStringA
GetWindowsDirectoryA
GetCurrentThreadId
GetLocaleInfoA
GetCurrentProcessId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
CloseHandle
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
CreateFileA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

shell32

SHGetFolderPathA

shlwapi

PathFileExistsA

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBDMBDI.dll
.dll windows:5 windows x86 arch:x86

0306a47056206765f9c9e310bd3b51c1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

93:b8:6c:2d:77:4f:f6:3d:8c:32:6c:95:cf:87:8d:b9:af:4b:5a:41:db:03:02:df:77:da:b3:25:09:a4:05:ad
Signer

Actual PE Digest

93:b8:6c:2d:77:4f:f6:3d:8c:32:6c:95:cf:87:8d:b9:af:4b:5a:41:db:03:02:df:77:da:b3:25:09:a4:05:ad

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\liwei\Desktop\07.BDI_dll\Win32\Release\CCBDMBDI.pdb

Imports

winscard

SCardListReadersA
SCardTransmit
g_rgSCardT1Pci
SCardReleaseContext
SCardDisconnect
SCardBeginTransaction
SCardEndTransaction
SCardFreeMemory
SCardEstablishContext
SCardGetAttrib
SCardConnectA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

secur32

GetUserNameExA

advapi32

GetNamedSecurityInfoA
GetUserNameA
BuildExplicitAccessWithNameA
LookupAccountNameA
SetNamedSecurityInfoA
SetEntriesInAclA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

kernel32

GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapSize
SetEndOfFile
GetProcessHeap
GetStringTypeW
VirtualFree
GetCurrentProcess
GetLastError
GetVersionExA
WaitForSingleObject
SetEvent
CreateEventA
ResetEvent
CloseHandle
Sleep
CreateFileA
GlobalAlloc
GlobalFree
DeviceIoControl
LocalFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateMutexA
ReleaseMutex
GetLocalTime
GetTempPathA
GetCurrentThreadId
GetSystemTime
QueryPerformanceCounter
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwind
MultiByteToWideChar
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetFilePointer
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Exports

Exports

7_E��6�]��:xᦢ��-��5Q� ��vA�>m5 �<��{�gU��'�d�>�B�;�� yot 2A�Y�/�1��r0�s�6@��%�S�-\ u�$I�R��[��g� xK�ut��DL�j��y{ilR3��u�|ũ\�4��G��Q�� 3>��V�f]s��(��2�i]p׵��x�Թ #ݯ1R{&9/yA��^�~��"��򫶍��X3)��o��(&�7�h�4<��O��ܦ��s�s]�R4~�[�0�W�_�:00Bg\�;��C��֛��-;�e��b bU/h�Ơݥ�Op֞�Ñs�vz�N?��z�\��_�_-:�s��9 �`��Y(��ȭ~��y�?s�C��a��6y!�K�Hݓ�|".6k��O�1�o��T��=e瑟��))��nvA��4Qj��|��+ �R�ߗ��:Ʈ�(7�;�|��<}�)��:��ڲ�_�Ej)[�E��cV �&& �|�T?dMF�7�OQ��4M��"!��3�T�5��(��~38�9Ϻ��0E��C�yu��j~[� PwZ?��m��zB��y��wl��}�\3�L��ޛ�T�+N�[��k�ܪ��#�7��n:@ڮ�Q��E�I��vاJG�"Dt��AA�Au��'S��[��y�P}�th;�N�+ӛ��g�򽉴��g?sJ<��zϭV��M�Ɍ��i^��% Ez�U?BI��wr��/@2~Ř�A�h��Q2Qv��Vp:�| ��PԖ҉H��L��,�|��F�(��< �)�<O��@M(�L0l- ?�p��H!laȟX�3��Mo��H?[h?o}�}e�YDo��J��D�6��Pۚ{��N;��]��S�*��p�e~>g3�r�I��r�� 1͍��{"�5��㊑ߡ��Mߴ��,��Jn§� PP��?�D�<�p�#3��$EU}��Ì{yP�w<��j&��fY�͈/{(��Y�r:�$�6y�֘�\�p��ӟ�j�z��uq��2�j�1u;+��^W�G��>��dMº:�K��ۓ��D�T�+�39fH�J��G:0�^�H��#P��?��Q�߹V��ѷ|�Pٗ9dm��k��p��e��X�2��G<c��j�`��%{:�RB�մ��to�p��J��LOko��c�*j�G8p.��bG�dN�s�b\@��7b|��W��N��Q��n�ˋ\��w��|�Vb�!�Ŝ�Zo$[�l[N��@��}�Ԁ�ɋI�q]�~L��g��2�'�/J��h�oTs��%��5HQ��J��#N!N�� >��G��>�lVH1��]��a�D��_]j�e*n/Q�x]�b��En�7?L��k�+�l?R�1�ES ��'��RC��E�y�'rZ�~��+wC"��Pr��j��^��ZGs�n��s� ��Yn��G�̪{9"�S�b�N��8aR;RJ��'I��d��9X�TK�%�a5h�r�(�҄�W�'�S kC��/�u^H��B'�C�Yj�x-6k&->��m��r\6�� ]��*G�b�;�'*t�D�� DFF4��?�]Mn{�23f� �Y�ۂy�0��O;��b�~�ٳ�d��)��y��~5E�pN��YW=5��C�ϧ�1ޭk<׊��ɞv�▗r� MI4�Զ#��i�2B��ӉWm��3��=�̉�uV_C��\��2K8?�^>^��W��pz�n�Z'R$�r��e��T�\7ފ��8{��Լ-@��y�?hG��Y��W@��at��&Ta��+�G"T�*��)�#��RYh}�|s�<��O�I&��o+�8e�2,��*<�kZ�]WAyK�xh�^�(��i}�,�L�{��>��q��ڞ>P��g]�'k��ln3�m+ѽ�8��p��q��!�n��z�|Z�*ztQ͓��^�*��Cd�QB�i;N^��?�N CI�rC6��Pg��Σ m goj��s�h��O�7Wdm#ě�~�� k��Y��̗��M��d6퐭�U�aZ�Ug��] j�]괟tD��g䨈��Z�{i�ؔ��`�*H��ljY��B��l�7�G��3�c��gJ�+�*�iNI��" ��{wV�D\��%H��*�h}л=R/mF�%Oйf�<{� ��+�約�=��!q��L)��^�olk�Φ�D�"�� )),H>�{� �xdRl/!<b>D.��8�Bp�'K��hg�"��_! ��2�a��5ß��ޕZ��J��e�u�n��=V�`'��z�Ї�aO�:��pq ц�U��*b�ʁ�m�(��s.�̯��q��ء0o��ʸNl�+��yY��U�� 3C�� !��t��ܪ��k�蒘~��z�^��h�Ȋ��r��;tyqI�eA �iYZ�5:�i�m73��{�3��;�.��eW X��iB�©��:ɓ��A��TE}�3�l�p߫��mW�t�U��qX�uY�9�Ѫ��q�;\��1��AT}D ��Nۨ'&g�=��sJ�"#�� m�9��?&�� : VL"�Yy�Ƅ)�u�\S�&��$h6_ -��T��Bא#>��#\��.4��, ^� ӏ|��U�C@o(� �̏h�MCkI�RЂ��\@��\�T�q��`��s�gM۫1z�i��=�2�P*��3 0L��U�qe��Z�]P�P�Q'o3��[�~�{)"{�TT��&� ��+E�q��Y&#�#��]s�ŵ5f2t��i�M�k9�51�TX��U�)U��
DM_GetFunctionList_All
DM_GetFunctionList_CertTool
DM_GetFunctionList_FireFox
DM_GetFunctionList_Ocx
DM_GetFunctionList_Skf

Sections

.text
Size: - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.test0
Size: - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.test1
Size: 503KB - Virtual size: 503KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBDMBDI.dll.$1
.dll windows:5 windows x86 arch:x86

0306a47056206765f9c9e310bd3b51c1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

93:b8:6c:2d:77:4f:f6:3d:8c:32:6c:95:cf:87:8d:b9:af:4b:5a:41:db:03:02:df:77:da:b3:25:09:a4:05:ad
Signer

Actual PE Digest

93:b8:6c:2d:77:4f:f6:3d:8c:32:6c:95:cf:87:8d:b9:af:4b:5a:41:db:03:02:df:77:da:b3:25:09:a4:05:ad

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\liwei\Desktop\07.BDI_dll\Win32\Release\CCBDMBDI.pdb

Imports

winscard

SCardListReadersA
SCardTransmit
g_rgSCardT1Pci
SCardReleaseContext
SCardDisconnect
SCardBeginTransaction
SCardEndTransaction
SCardFreeMemory
SCardEstablishContext
SCardGetAttrib
SCardConnectA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

secur32

GetUserNameExA

advapi32

GetNamedSecurityInfoA
GetUserNameA
BuildExplicitAccessWithNameA
LookupAccountNameA
SetNamedSecurityInfoA
SetEntriesInAclA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

kernel32

GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapSize
SetEndOfFile
GetProcessHeap
GetStringTypeW
VirtualFree
GetCurrentProcess
GetLastError
GetVersionExA
WaitForSingleObject
SetEvent
CreateEventA
ResetEvent
CloseHandle
Sleep
CreateFileA
GlobalAlloc
GlobalFree
DeviceIoControl
LocalFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateMutexA
ReleaseMutex
GetLocalTime
GetTempPathA
GetCurrentThreadId
GetSystemTime
QueryPerformanceCounter
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwind
MultiByteToWideChar
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetFilePointer
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Exports

Exports

7_E��6�]��:xᦢ��-��5Q� ��vA�>m5 �<��{�gU��'�d�>�B�;�� yot 2A�Y�/�1��r0�s�6@��%�S�-\ u�$I�R��[��g� xK�ut��DL�j��y{ilR3��u�|ũ\�4��G��Q�� 3>��V�f]s��(��2�i]p׵��x�Թ #ݯ1R{&9/yA��^�~��"��򫶍��X3)��o��(&�7�h�4<��O��ܦ��s�s]�R4~�[�0�W�_�:00Bg\�;��C��֛��-;�e��b bU/h�Ơݥ�Op֞�Ñs�vz�N?��z�\��_�_-:�s��9 �`��Y(��ȭ~��y�?s�C��a��6y!�K�Hݓ�|".6k��O�1�o��T��=e瑟��))��nvA��4Qj��|��+ �R�ߗ��:Ʈ�(7�;�|��<}�)��:��ڲ�_�Ej)[�E��cV �&& �|�T?dMF�7�OQ��4M��"!��3�T�5��(��~38�9Ϻ��0E��C�yu��j~[� PwZ?��m��zB��y��wl��}�\3�L��ޛ�T�+N�[��k�ܪ��#�7��n:@ڮ�Q��E�I��vاJG�"Dt��AA�Au��'S��[��y�P}�th;�N�+ӛ��g�򽉴��g?sJ<��zϭV��M�Ɍ��i^��% Ez�U?BI��wr��/@2~Ř�A�h��Q2Qv��Vp:�| ��PԖ҉H��L��,�|��F�(��< �)�<O��@M(�L0l- ?�p��H!laȟX�3��Mo��H?[h?o}�}e�YDo��J��D�6��Pۚ{��N;��]��S�*��p�e~>g3�r�I��r�� 1͍��{"�5��㊑ߡ��Mߴ��,��Jn§� PP��?�D�<�p�#3��$EU}��Ì{yP�w<��j&��fY�͈/{(��Y�r:�$�6y�֘�\�p��ӟ�j�z��uq��2�j�1u;+��^W�G��>��dMº:�K��ۓ��D�T�+�39fH�J��G:0�^�H��#P��?��Q�߹V��ѷ|�Pٗ9dm��k��p��e��X�2��G<c��j�`��%{:�RB�մ��to�p��J��LOko��c�*j�G8p.��bG�dN�s�b\@��7b|��W��N��Q��n�ˋ\��w��|�Vb�!�Ŝ�Zo$[�l[N��@��}�Ԁ�ɋI�q]�~L��g��2�'�/J��h�oTs��%��5HQ��J��#N!N�� >��G��>�lVH1��]��a�D��_]j�e*n/Q�x]�b��En�7?L��k�+�l?R�1�ES ��'��RC��E�y�'rZ�~��+wC"��Pr��j��^��ZGs�n��s� ��Yn��G�̪{9"�S�b�N��8aR;RJ��'I��d��9X�TK�%�a5h�r�(�҄�W�'�S kC��/�u^H��B'�C�Yj�x-6k&->��m��r\6�� ]��*G�b�;�'*t�D�� DFF4��?�]Mn{�23f� �Y�ۂy�0��O;��b�~�ٳ�d��)��y��~5E�pN��YW=5��C�ϧ�1ޭk<׊��ɞv�▗r� MI4�Զ#��i�2B��ӉWm��3��=�̉�uV_C��\��2K8?�^>^��W��pz�n�Z'R$�r��e��T�\7ފ��8{��Լ-@��y�?hG��Y��W@��at��&Ta��+�G"T�*��)�#��RYh}�|s�<��O�I&��o+�8e�2,��*<�kZ�]WAyK�xh�^�(��i}�,�L�{��>��q��ڞ>P��g]�'k��ln3�m+ѽ�8��p��q��!�n��z�|Z�*ztQ͓��^�*��Cd�QB�i;N^��?�N CI�rC6��Pg��Σ m goj��s�h��O�7Wdm#ě�~�� k��Y��̗��M��d6퐭�U�aZ�Ug��] j�]괟tD��g䨈��Z�{i�ؔ��`�*H��ljY��B��l�7�G��3�c��gJ�+�*�iNI��" ��{wV�D\��%H��*�h}л=R/mF�%Oйf�<{� ��+�約�=��!q��L)��^�olk�Φ�D�"�� )),H>�{� �xdRl/!<b>D.��8�Bp�'K��hg�"��_! ��2�a��5ß��ޕZ��J��e�u�n��=V�`'��z�Ї�aO�:��pq ц�U��*b�ʁ�m�(��s.�̯��q��ء0o��ʸNl�+��yY��U�� 3C�� !��t��ܪ��k�蒘~��z�^��h�Ȋ��r��;tyqI�eA �iYZ�5:�i�m73��{�3��;�.��eW X��iB�©��:ɓ��A��TE}�3�l�p߫��mW�t�U��qX�uY�9�Ѫ��q�;\��1��AT}D ��Nۨ'&g�=��sJ�"#�� m�9��?&�� : VL"�Yy�Ƅ)�u�\S�&��$h6_ -��T��Bא#>��#\��.4��, ^� ӏ|��U�C@o(� �̏h�MCkI�RЂ��\@��\�T�q��`��s�gM۫1z�i��=�2�P*��3 0L��U�qe��Z�]P�P�Q'o3��[�~�{)"{�TT��&� ��+E�q��Y&#�#��]s�ŵ5f2t��i�M�k9�51�TX��U�)U��
DM_GetFunctionList_All
DM_GetFunctionList_CertTool
DM_GetFunctionList_FireFox
DM_GetFunctionList_Ocx
DM_GetFunctionList_Skf

Sections

.text
Size: - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.test0
Size: - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.test1
Size: 503KB - Virtual size: 503KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCAPI.dll
.dll windows:5 windows x86 arch:x86

0171517137bcf7907eda0033ea4d9565

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24:b0:4f:fa:66:ea:05:b4:54:af:b9:39:23:a1:ce:5d:c4:9c:5e:b7:4a:3b:56:dd:12:27:c4:7e:cf:a4:99:0c
Signer

Actual PE Digest

24:b0:4f:fa:66:ea:05:b4:54:af:b9:39:23:a1:ce:5d:c4:9c:5e:b7:4a:3b:56:dd:12:27:c4:7e:cf:a4:99:0c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

secur32

GetUserNameExW

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
InterlockedExchange
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
GetModuleHandleA
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapDestroy
HeapCreate
SetEndOfFile
GetProcessHeap
ReadFile
QueryPerformanceCounter
FindResourceW
SizeofResource
LoadResource
GlobalLock
GlobalUnlock
EnterCriticalSection
GetConsoleCP
LeaveCriticalSection
GetSystemTime
GetTempPathA
GetLocalTime
DeviceIoControl
CreateEventW
LocalFree
CreateFileA
GlobalAlloc
GlobalFree
CloseHandle
SetEvent
WaitForSingleObject
InitializeCriticalSection
ResetEvent
CreateEventA
GetCurrentProcess
GetVersionExA
DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress
GetModuleFileNameW
GetCurrentThreadId
LoadLibraryW
GetLastError
Sleep
FreeLibrary
lstrcpyW
GetVersionExW
MultiByteToWideChar
SetLastError
GetPrivateProfileStringA
WideCharToMultiByte
HeapReAlloc
VirtualFree
DeleteCriticalSection
GetCommandLineA
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
GetCurrentProcessId
RtlUnwind
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
HeapFree
HeapAlloc

user32

GetClientRect
EndDialog
DrawTextW
OffsetRect
GetWindowTextW
FillRect
FrameRect
GetCursorPos
SendMessageW
SystemParametersInfoW
GetDC
ScreenToClient
GetDlgItem
DestroyWindow
CallNextHookEx
GetWindowRect
SetWindowTextW
FindWindowW
GetSystemMetrics
EnableWindow
UnhookWindowsHookEx
MoveWindow
SetWindowTextA
SetWindowPos
GetFocus
GetNextDlgTabItem
SetDlgItemTextA
GetWindowDC
GetSysColorBrush
ReleaseDC
ClientToScreen
SetWindowLongW
GetWindowTextLengthW
GetWindowTextA
GetWindowLongW
CallWindowProcW
GetKeyState
DialogBoxParamA
PostMessageA
RegisterWindowMessageA
GetForegroundWindow
SetForegroundWindow
SetDlgItemTextW
KillTimer
GetDlgItemTextA
SetFocus
ShowWindow
DialogBoxParamW
SetWindowsHookExW
SetTimer
MessageBoxW

gdi32

SetDIBColorTable
CreateCompatibleDC
SelectObject
GetObjectW
CreateFontIndirectW
CreatePen
RoundRect
DeleteObject
CreateSolidBrush
SetBkMode
SetTextColor
DeleteDC
SetStretchBltMode
StretchBlt
GetStockObject
CreateDIBSection

advapi32

CryptGetUserKey
LookupAccountNameW
SetNamedSecurityInfoA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameW
SetEntriesInAclW
GetUserNameW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptDuplicateKey
CryptDuplicateHash
CryptDestroyHash
CryptHashSessionKey
CryptHashData
CryptCreateHash
CryptDecrypt
CryptImportKey
CryptEncrypt
CryptExportKey
CryptGetHashParam
CryptSetHashParam
CryptGetKeyParam
CryptSetKeyParam
CryptDestroyKey
CryptDeriveKey
CryptGenKey
CryptReleaseContext
GetUserNameA
CryptAcquireContextA

shell32

SHGetSpecialFolderPathA

ole32

CreateStreamOnHGlobal

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

gdiplus

GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CCB_CSP
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCAPI.dll.$1
.dll windows:5 windows x86 arch:x86

0171517137bcf7907eda0033ea4d9565

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24:b0:4f:fa:66:ea:05:b4:54:af:b9:39:23:a1:ce:5d:c4:9c:5e:b7:4a:3b:56:dd:12:27:c4:7e:cf:a4:99:0c
Signer

Actual PE Digest

24:b0:4f:fa:66:ea:05:b4:54:af:b9:39:23:a1:ce:5d:c4:9c:5e:b7:4a:3b:56:dd:12:27:c4:7e:cf:a4:99:0c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

secur32

GetUserNameExW

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
InterlockedExchange
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
GetModuleHandleA
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapDestroy
HeapCreate
SetEndOfFile
GetProcessHeap
ReadFile
QueryPerformanceCounter
FindResourceW
SizeofResource
LoadResource
GlobalLock
GlobalUnlock
EnterCriticalSection
GetConsoleCP
LeaveCriticalSection
GetSystemTime
GetTempPathA
GetLocalTime
DeviceIoControl
CreateEventW
LocalFree
CreateFileA
GlobalAlloc
GlobalFree
CloseHandle
SetEvent
WaitForSingleObject
InitializeCriticalSection
ResetEvent
CreateEventA
GetCurrentProcess
GetVersionExA
DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress
GetModuleFileNameW
GetCurrentThreadId
LoadLibraryW
GetLastError
Sleep
FreeLibrary
lstrcpyW
GetVersionExW
MultiByteToWideChar
SetLastError
GetPrivateProfileStringA
WideCharToMultiByte
HeapReAlloc
VirtualFree
DeleteCriticalSection
GetCommandLineA
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
GetCurrentProcessId
RtlUnwind
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
HeapFree
HeapAlloc

user32

GetClientRect
EndDialog
DrawTextW
OffsetRect
GetWindowTextW
FillRect
FrameRect
GetCursorPos
SendMessageW
SystemParametersInfoW
GetDC
ScreenToClient
GetDlgItem
DestroyWindow
CallNextHookEx
GetWindowRect
SetWindowTextW
FindWindowW
GetSystemMetrics
EnableWindow
UnhookWindowsHookEx
MoveWindow
SetWindowTextA
SetWindowPos
GetFocus
GetNextDlgTabItem
SetDlgItemTextA
GetWindowDC
GetSysColorBrush
ReleaseDC
ClientToScreen
SetWindowLongW
GetWindowTextLengthW
GetWindowTextA
GetWindowLongW
CallWindowProcW
GetKeyState
DialogBoxParamA
PostMessageA
RegisterWindowMessageA
GetForegroundWindow
SetForegroundWindow
SetDlgItemTextW
KillTimer
GetDlgItemTextA
SetFocus
ShowWindow
DialogBoxParamW
SetWindowsHookExW
SetTimer
MessageBoxW

gdi32

SetDIBColorTable
CreateCompatibleDC
SelectObject
GetObjectW
CreateFontIndirectW
CreatePen
RoundRect
DeleteObject
CreateSolidBrush
SetBkMode
SetTextColor
DeleteDC
SetStretchBltMode
StretchBlt
GetStockObject
CreateDIBSection

advapi32

CryptGetUserKey
LookupAccountNameW
SetNamedSecurityInfoA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameW
SetEntriesInAclW
GetUserNameW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptDuplicateKey
CryptDuplicateHash
CryptDestroyHash
CryptHashSessionKey
CryptHashData
CryptCreateHash
CryptDecrypt
CryptImportKey
CryptEncrypt
CryptExportKey
CryptGetHashParam
CryptSetHashParam
CryptGetKeyParam
CryptSetKeyParam
CryptDestroyKey
CryptDeriveKey
CryptGenKey
CryptReleaseContext
GetUserNameA
CryptAcquireContextA

shell32

SHGetSpecialFolderPathA

ole32

CreateStreamOnHGlobal

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

gdiplus

GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CCB_CSP
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCAPIV2.dll
.dll windows:5 windows x86 arch:x86

f36f6fd7dfaf624dddfb653c7a5c212c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:0a:73:b7:6a:ef:5f:76:bb:96:1f:9a:9b:5f:fd:05:eb:66:3e:35:eb:6d:1c:16:46:7f:70:e5:ae:01:4e:65
Signer

Actual PE Digest

4f:0a:73:b7:6a:ef:5f:76:bb:96:1f:9a:9b:5f:fd:05:eb:66:3e:35:eb:6d:1c:16:46:7f:70:e5:ae:01:4e:65

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertCreateCertificateContext
CertFreeCertificateContext

secur32

GetUserNameExW

kernel32

LocalFree
DeviceIoControl
CreateMutexA
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
ReleaseMutex
GetLocalTime
GetTempPathA
GetSystemTime
InterlockedExchange
GlobalUnlock
GlobalLock
QueryPerformanceCounter
CreateThread
GetProcessHeap
SetEndOfFile
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
GetLocaleInfoA
SizeofResource
CreateFileA
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
ReadFile
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetModuleHandleA
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GlobalAlloc
GlobalFree
CloseHandle
SetEvent
WaitForSingleObject
ResetEvent
CreateEventA
GetCurrentProcess
GetVersionExA
DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress
GetModuleFileNameW
GetCurrentThreadId
FindResourceW
LoadResource
LockResource
GetVersionExW
SetLastError
MultiByteToWideChar
LoadLibraryW
GetLastError
Sleep
FreeLibrary
lstrcpyW
GetPrivateProfileStringA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetStdHandle
WriteFile
ExitProcess
HeapDestroy
HeapCreate
HeapReAlloc
VirtualFree
DeleteCriticalSection
GetCommandLineA
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
GetCurrentProcessId
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitThread
RtlUnwind
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

ScreenToClient
GetCursorPos
GetClientRect
SetWindowTextA
SendMessageW
SystemParametersInfoW
GetDC
SetWindowTextW
EndDialog
DrawTextW
OffsetRect
GetWindowTextW
GetDlgItem
FillRect
FrameRect
DialogBoxParamW
GetActiveWindow
KillTimer
GetWindowLongW
SetTimer
FindWindowW
GetDlgItemTextA
EnableWindow
SetFocus
UnhookWindowsHookEx
MessageBoxW
SetWindowsHookExW
GetForegroundWindow
RegisterWindowMessageA
PostMessageA
GetWindowTextLengthW
GetKeyState
CallWindowProcW
GetWindowTextA
SetDlgItemTextA
SetDlgItemTextW
GetNextDlgTabItem
GetFocus
ShowWindow
GetSystemMetrics
MoveWindow
GetWindowRect
CallNextHookEx
SetWindowLongW
SetWindowPos

gdi32

SetDIBColorTable
CreatePen
SelectObject
RoundRect
DeleteObject
CreateSolidBrush
SetBkMode
SetTextColor
DeleteDC
CreateCompatibleDC
GetObjectW
CreateFontIndirectW
SetStretchBltMode
StretchBlt
GetStockObject
CreateDIBSection

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
SetNamedSecurityInfoA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameW
SetEntriesInAclW
GetUserNameW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
GetUserNameA

shell32

SHGetSpecialFolderPathA

ole32

CreateStreamOnHGlobal
StringFromGUID2

gdiplus

GdipGetPropertyItem
GdiplusShutdown
GdipCreateFromHDC
GdipDrawImageRectI
GdipCloneImage
GdiplusStartup
GdipGetPropertyItemSize
GdipGetImageHeight
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipGetImageWidth
GdipBitmapUnlockBits
GdipDrawImageI
GdipGetImageGraphicsContext
GdipGetImagePaletteSize
GdipGetImagePixelFormat

winscard

SCardReleaseContext
SCardFreeMemory
SCardGetAttrib
SCardDisconnect
SCardBeginTransaction
SCardConnectA
SCardEstablishContext
SCardListReadersA
SCardTransmit
g_rgSCardT1Pci
SCardEndTransaction

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature

Sections

.text
Size: - Virtual size: 273KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CCB_CSP
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.test0
Size: - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.test1
Size: 534KB - Virtual size: 534KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCAPIV2.dll.$1
.dll windows:5 windows x86 arch:x86

f36f6fd7dfaf624dddfb653c7a5c212c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:0a:73:b7:6a:ef:5f:76:bb:96:1f:9a:9b:5f:fd:05:eb:66:3e:35:eb:6d:1c:16:46:7f:70:e5:ae:01:4e:65
Signer

Actual PE Digest

4f:0a:73:b7:6a:ef:5f:76:bb:96:1f:9a:9b:5f:fd:05:eb:66:3e:35:eb:6d:1c:16:46:7f:70:e5:ae:01:4e:65

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertCreateCertificateContext
CertFreeCertificateContext

secur32

GetUserNameExW

kernel32

LocalFree
DeviceIoControl
CreateMutexA
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
ReleaseMutex
GetLocalTime
GetTempPathA
GetSystemTime
InterlockedExchange
GlobalUnlock
GlobalLock
QueryPerformanceCounter
CreateThread
GetProcessHeap
SetEndOfFile
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
GetLocaleInfoA
SizeofResource
CreateFileA
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
ReadFile
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetModuleHandleA
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GlobalAlloc
GlobalFree
CloseHandle
SetEvent
WaitForSingleObject
ResetEvent
CreateEventA
GetCurrentProcess
GetVersionExA
DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress
GetModuleFileNameW
GetCurrentThreadId
FindResourceW
LoadResource
LockResource
GetVersionExW
SetLastError
MultiByteToWideChar
LoadLibraryW
GetLastError
Sleep
FreeLibrary
lstrcpyW
GetPrivateProfileStringA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetStdHandle
WriteFile
ExitProcess
HeapDestroy
HeapCreate
HeapReAlloc
VirtualFree
DeleteCriticalSection
GetCommandLineA
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
GetCurrentProcessId
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitThread
RtlUnwind
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

ScreenToClient
GetCursorPos
GetClientRect
SetWindowTextA
SendMessageW
SystemParametersInfoW
GetDC
SetWindowTextW
EndDialog
DrawTextW
OffsetRect
GetWindowTextW
GetDlgItem
FillRect
FrameRect
DialogBoxParamW
GetActiveWindow
KillTimer
GetWindowLongW
SetTimer
FindWindowW
GetDlgItemTextA
EnableWindow
SetFocus
UnhookWindowsHookEx
MessageBoxW
SetWindowsHookExW
GetForegroundWindow
RegisterWindowMessageA
PostMessageA
GetWindowTextLengthW
GetKeyState
CallWindowProcW
GetWindowTextA
SetDlgItemTextA
SetDlgItemTextW
GetNextDlgTabItem
GetFocus
ShowWindow
GetSystemMetrics
MoveWindow
GetWindowRect
CallNextHookEx
SetWindowLongW
SetWindowPos

gdi32

SetDIBColorTable
CreatePen
SelectObject
RoundRect
DeleteObject
CreateSolidBrush
SetBkMode
SetTextColor
DeleteDC
CreateCompatibleDC
GetObjectW
CreateFontIndirectW
SetStretchBltMode
StretchBlt
GetStockObject
CreateDIBSection

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
SetNamedSecurityInfoA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameW
SetEntriesInAclW
GetUserNameW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
GetUserNameA

shell32

SHGetSpecialFolderPathA

ole32

CreateStreamOnHGlobal
StringFromGUID2

gdiplus

GdipGetPropertyItem
GdiplusShutdown
GdipCreateFromHDC
GdipDrawImageRectI
GdipCloneImage
GdiplusStartup
GdipGetPropertyItemSize
GdipGetImageHeight
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipGetImageWidth
GdipBitmapUnlockBits
GdipDrawImageI
GdipGetImageGraphicsContext
GdipGetImagePaletteSize
GdipGetImagePixelFormat

winscard

SCardReleaseContext
SCardFreeMemory
SCardGetAttrib
SCardDisconnect
SCardBeginTransaction
SCardConnectA
SCardEstablishContext
SCardListReadersA
SCardTransmit
g_rgSCardT1Pci
SCardEndTransaction

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature

Sections

.text
Size: - Virtual size: 273KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CCB_CSP
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.test0
Size: - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.test1
Size: 534KB - Virtual size: 534KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCSP.dll
.dll regsvr32 windows:4 windows x86 arch:x86

5c6d7aadc4b235a498a1882864c27ae0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindResourceA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetVersionExA
LoadLibraryA
FreeLibrary
DisableThreadLibraryCalls
CreateFileA
GetFileSize
ReadFile
GetProcAddress
CloseHandle
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
HeapAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedDecrement
InterlockedIncrement

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegSetValueExA

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCSP.dll.$1
.dll regsvr32 windows:4 windows x86 arch:x86

5c6d7aadc4b235a498a1882864c27ae0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindResourceA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetVersionExA
LoadLibraryA
FreeLibrary
DisableThreadLibraryCalls
CreateFileA
GetFileSize
ReadFile
GetProcAddress
CloseHandle
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
HeapAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedDecrement
InterlockedIncrement

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegSetValueExA

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCSP.sig
$SYSDIR/$SYSDIR/CCBKCSP.sig.$1
$SYSDIR/$SYSDIR/CCBKCSPV2.dll
.dll regsvr32 windows:4 windows x86 arch:x86

5c6d7aadc4b235a498a1882864c27ae0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindResourceA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetVersionExA
LoadLibraryA
FreeLibrary
DisableThreadLibraryCalls
CreateFileA
GetFileSize
ReadFile
GetProcAddress
CloseHandle
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
HeapAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedDecrement
InterlockedIncrement

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegSetValueExA

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCSPV2.dll.$1
.dll regsvr32 windows:4 windows x86 arch:x86

5c6d7aadc4b235a498a1882864c27ae0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindResourceA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetVersionExA
LoadLibraryA
FreeLibrary
DisableThreadLibraryCalls
CreateFileA
GetFileSize
ReadFile
GetProcAddress
CloseHandle
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
HeapAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedDecrement
InterlockedIncrement

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegSetValueExA

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCSPV2.sig
$SYSDIR/$SYSDIR/CCBKCSPV2.sig.$1
$SYSDIR/$SYSDIR/CCB_DM_UI.dll
.dll windows:5 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

aa:ef:f2:f3:62:e3:c5:e0:6a:06:6d:b6:c7:5b:b1:c9:1a:11:72:ee:ad:a3:a8:cb:fa:98:89:6c:f0:5f:bc:4a
Signer

Actual PE Digest

aa:ef:f2:f3:62:e3:c5:e0:6a:06:6d:b6:c7:5b:b1:c9:1a:11:72:ee:ad:a3:a8:cb:fa:98:89:6c:f0:5f:bc:4a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCB_DM_UI.dll.$1
.dll windows:5 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

aa:ef:f2:f3:62:e3:c5:e0:6a:06:6d:b6:c7:5b:b1:c9:1a:11:72:ee:ad:a3:a8:cb:fa:98:89:6c:f0:5f:bc:4a
Signer

Actual PE Digest

aa:ef:f2:f3:62:e3:c5:e0:6a:06:6d:b6:c7:5b:b1:c9:1a:11:72:ee:ad:a3:a8:cb:fa:98:89:6c:f0:5f:bc:4a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/ChanePrivileges.exe
.exe windows:4 windows x86 arch:x86

b35cdf6c44b4ffb4220fa520c866de7f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

advapi32

LsaOpenPolicy
LsaClose
LsaAddAccountRights
LookupAccountNameA

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$SYSDIR/$SYSDIR/ChanePrivileges.exe.$1
.exe windows:4 windows x86 arch:x86

b35cdf6c44b4ffb4220fa520c866de7f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

advapi32

LsaOpenPolicy
LsaClose
LsaAddAccountRights
LookupAccountNameA

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$SYSDIR/$SYSDIR/DMCCBpkcs11.dll
.dll windows:4 windows x86 arch:x86

c8eadad12ac2b24889b56b237750020d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyA
RegEnumKeyA
RegCreateKeyA
RegSetValueA
RegQueryValueA
SetFileSecurityA
GetFileSecurityA
RegCloseKey

kernel32

GetCurrentThreadId
GetSystemTime
GlobalFree
GlobalAlloc
CreateFileA
CloseHandle
GetLastError
DeviceIoControl
CreateEventA
GlobalDeleteAtom
GetModuleHandleA
SetLastError
GetVersion
lstrlenA
lstrcpynA
GetModuleFileNameA
lstrcpyA
lstrcatA
SetErrorMode
InterlockedDecrement
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
GlobalLock
TlsFree
GlobalHandle
GlobalUnlock
DeleteCriticalSection
TlsAlloc
LocalAlloc
LocalFree
SuspendThread
QueryPerformanceCounter
GetTickCount
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
GlobalMemoryStatus
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetEvent
WaitForSingleObject
SetEnvironmentVariableA
IsBadCodePtr
CompareStringW
CompareStringA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapCreate
HeapDestroy
GetEnvironmentVariableA
VirtualAlloc
VirtualFree
HeapFree
HeapReAlloc
GlobalFindAtomA
HeapAlloc
GetACP
TerminateProcess
ExitProcess
OutputDebugStringA
GetStdHandle
DebugBreak
RaiseException
ExitThread
CreateThread
GetCommandLineA
RtlUnwind
GetLocalTime
GetTimeZoneInformation
HeapValidate
SetFileAttributesA
SystemTimeToFileTime
LocalFileTimeToFileTime
ResetEvent
GetFileSize
GetDiskFreeSpaceA
GetFileTime
SetFileTime
GetTempFileNameA
GetFileAttributesA
GetShortPathNameA
GetThreadLocale
GetStringTypeExA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DeleteFileA
MoveFileA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetCurrentProcess
DuplicateHandle
FindResourceExA
FormatMessageA
SizeofResource
GetCurrentDirectoryA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetProfileIntA
VirtualProtect
FileTimeToLocalFileTime
FileTimeToSystemTime
GetOEMCP
GetCPInfo
GetCurrentThread
IsBadReadPtr
IsBadWritePtr
IsBadStringPtrA
IsBadStringPtrW
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
GlobalFlags
lstrcmpA
MulDiv
GetPrivateProfileIntA
GetProcessVersion
ResumeThread
GetThreadPriority
SetThreadPriority
FindResourceA
LoadResource
LockResource
FreeResource
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA

user32

GetAsyncKeyState
EndDialog
CreateDialogIndirectParamA
LoadStringA
DestroyMenu
OemToCharA
CharToOemA
UnpackDDElParam
GetClipboardFormatNameA
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
PostQuitMessage
OpenIcon
CloseWindow
LoadCursorA
PostThreadMessageA
MapDialogRect
EnableWindow
GetWindowContextHelpId
SetWindowContextHelpId
GetForegroundWindow
SetForegroundWindow
ShowCaret
HideCaret
SetCaretPos
GetCaretPos
CreateCaret
GetClipboardViewer
GetClipboardOwner
GetOpenClipboardWindow
OpenClipboard
SetClipboardViewer
ChangeClipboardChain
FlashWindow
WindowFromPoint
SetParent
GetLastActivePopup
FindWindowA
ChildWindowFromPointEx
ShowScrollBar
GetNextDlgTabItem
GetNextDlgGroupItem
DlgDirSelectComboBoxExA
DlgDirSelectExA
DlgDirListComboBoxA
DlgDirListA
GetDesktopWindow
SetCapture
GetActiveWindow
KillTimer
SetTimer
EnableScrollBar
RedrawWindow
LockWindowUpdate
GetDCEx
ShowOwnedPopups
IsWindowVisible
ValidateRgn
InvalidateRgn
InvalidateRect
GetUpdateRgn
GetUpdateRect
UpdateWindow
ReleaseDC
GetWindowDC
GetDC
EndPaint
BeginPaint
ClientToScreen
BringWindowToTop
GetWindowRgn
SetWindowRgn
ArrangeIconicWindows
IsZoomed
HiliteMenuItem
GetSystemMenu
DrawMenuBar
SetMenu
GetMenu
PostMessageA
LoadIconA
SendDlgItemMessageA
GetClientRect
ReleaseCapture
GetSysColor
SetActiveWindow
SetFocus
AdjustWindowRectEx
ScreenToClient
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
MessageBoxA
IsChild
GetParent
GetWindow
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
TrackPopupMenu
SetWindowPlacement
GetDlgItem
GetWindowTextLengthA
GetWindowTextA
DestroyWindow
SendMessageA
GetClassNameA
GetDlgCtrlID
IsWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetWindowLongA
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetMenuCheckMarkDimensions
GetFocus
UnregisterClassA
CheckMenuRadioItem
GetMenuContextHelpId
SetMenuContextHelpId
LoadMenuIndirectA
LoadMenuA
SetMenuItemBitmaps
RemoveMenu
ModifyMenuA
InsertMenuA
GetSubMenu
GetMenuItemInfoA
GetMenuStringA
GetMenuState
GetMenuItemID
GetMenuItemCount
GetMenuDefaultItem
SetMenuDefaultItem
EnableMenuItem
CheckMenuItem
AppendMenuA
DeleteMenu
IsMenu
CreatePopupMenu
CreateMenu
ScrollDC
GrayStringA
GetTabbedTextExtentA
DrawTextA
TabbedTextOutA
DrawFocusRect
DrawFrameControl
DrawEdge
DrawStateA
DrawIcon
InvertRect
FrameRect
FillRect
ExcludeUpdateRgn
WindowFromDC
SetCursorPos
DestroyCursor
SetCursor
LoadAcceleratorsA
ReuseDDElParam
TranslateAcceleratorA
GetDialogBaseUnits
CharUpperA
DestroyIcon
MapWindowPoints
LoadBitmapA
GetSysColorBrush
SubtractRect
UnionRect
IntersectRect
OffsetRect
InflateRect
EqualRect
SetRectEmpty
SetRect
PtInRect
IsRectEmpty
CopyRect
UnhookWindowsHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyState
CallNextHookEx
ValidateRect
PeekMessageA
GetCursorPos
SetWindowsHookExA
SendNotifyMessageA
ChildWindowFromPoint

gdi32

LineTo
ExtCreatePen
CreatePenIndirect
CreatePen
GetObjectType
UnrealizeObject
GetStockObject
CreateDCA
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
GetObjectA
BitBlt
GetBitmapBits
DeleteObject
DeleteDC
CreateHatchBrush
CreateBrushIndirect
CreatePatternBrush
CreateDIBPatternBrushPt
CreateFontIndirectA
CreateFontA
CreateBitmap
CreateBitmapIndirect
SetBitmapBits
SetBitmapDimensionEx
GetBitmapDimensionEx
CreateDiscardableBitmap
CreatePalette
CreateHalftonePalette
GetPaletteEntries
SetPaletteEntries
AnimatePalette
GetNearestPaletteIndex
ResizePalette
CreateRectRgn
CreateRectRgnIndirect
CreateEllipticRgn
CreateEllipticRgnIndirect
CreatePolygonRgn
CreatePolyPolygonRgn
CreateRoundRectRgn
PathToRegion
ExtCreateRegion
GetRegionData
SetRectRgn
CombineRgn
EqualRgn
OffsetRgn
GetRgnBox
PtInRegion
RectInRegion
CreateICA
GetBrushOrgEx
SetBrushOrgEx
EnumObjects
GetNearestColor
RealizePalette
UpdateColors
GetBkColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextColor
GetMapMode
GetViewportOrgEx
GetViewportExtEx
GetWindowOrgEx
GetWindowExtEx
DPtoLP
LPtoDP
FillRgn
FrameRgn
InvertRgn
PaintRgn
PtVisible
RectVisible
GetCurrentPositionEx
Arc
Polyline
Chord
Ellipse
Pie
Polygon
PolyPolygon
Rectangle
RoundRect
PatBlt
StretchBlt
GetPixel
SetPixel
FloodFill
ExtFloodFill
TextOutA
ExtTextOutA
GetTextExtentPoint32A
GetTextAlign
GetTextFaceA
GetTextMetricsA
GetTextCharacterExtra
GetCharWidthA
GetAspectRatioFilterEx
Escape
SetBoundsRect
GetBoundsRect
ResetDCA
GetOutlineTextMetricsA
GetCharABCWidthsA
GetFontData
GetKerningPairsA
GetGlyphOutlineA
StartDocA
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
MaskBlt
PlgBlt
SetPixelV
AngleArc
GetArcDirection
PolyPolyline
GetColorAdjustment
GetCurrentObject
PolyBezier
DrawEscape
ExtEscape
GetCharABCWidthsFloatA
GetCharWidthFloatA
AbortPath
BeginPath
CloseFigure
EndPath
FillPath
FlattenPath
GetMiterLimit
GetPath
SetMiterLimit
StrokeAndFillPath
StrokePath
WidenPath
GdiComment
PlayEnhMetaFile
GetDCOrgEx
GetClipBox
SetTextColor
SetBkColor
CreateMetaFileA
CloseMetaFile
CreateEnhMetaFileA
CloseEnhMetaFile
SaveDC
RestoreDC
SelectPalette
SetBkMode
EnumFontFamiliesExA
StretchDIBits
PlayMetaFile
EnumMetaFile
PlayMetaFileRecord
ExtSelectClipRgn
SelectClipPath
GetClipRgn
PolyBezierTo
SetColorAdjustment
PolylineTo
PolyDraw
SetArcDirection
ArcTo
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
CreateSolidBrush
MoveToEx
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

comdlg32

GetOpenFileNameA
ChooseColorA
GetFileTitleA
GetSaveFileNameA

shell32

SHGetFileInfoA
DragQueryFileA
DragFinish
DragAcceptFiles
ExtractIconA

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA

comctl32

ImageList_ReplaceIcon
ImageList_Replace
ImageList_Remove
ImageList_AddMasked
ImageList_Add
ImageList_GetImageCount
ord14
ImageList_Write
ImageList_GetIcon
ImageList_Merge
ImageList_LoadImageA
ImageList_Create
ImageList_Destroy
ord13
CreatePropertySheetPageA
DestroyPropertySheetPage
PropertySheetA
ord17
ord8
ImageList_Draw
ImageList_SetBkColor
ImageList_GetBkColor
ImageList_SetOverlayImage
ImageList_GetImageInfo
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragMove
ImageList_SetDragCursorImage
ImageList_DragShowNolock
ImageList_GetDragImage
ImageList_DragEnter
ImageList_DragLeave
ImageList_Read

Exports

Exports

C_CancelFunction
C_CloseAllSessions
C_CloseSession
C_CopyObject
C_CreateObject
C_Decrypt
C_DecryptDigestUpdate
C_DecryptFinal
C_DecryptInit
C_DecryptUpdate
C_DecryptVerifyUpdate
C_DeriveKey
C_DestroyObject
C_Digest
C_DigestEncryptUpdate
C_DigestFinal
C_DigestInit
C_DigestKey
C_DigestUpdate
C_Encrypt
C_EncryptFinal
C_EncryptInit
C_EncryptUpdate
C_Finalize
C_FindObjects
C_FindObjectsFinal
C_FindObjectsInit
C_GenerateKey
C_GenerateKeyPair
C_GenerateRandom
C_GetAttributeValue
C_GetFunctionList
C_GetFunctionStatus
C_GetInfo
C_GetMechanismInfo
C_GetMechanismList
C_GetObjectSize
C_GetOperationState
C_GetSessionInfo
C_GetSlotInfo
C_GetSlotList
C_GetTokenInfo
C_InitPIN
C_InitToken
C_Initialize
C_Login
C_Logout
C_OpenSession
C_SeedRandom
C_SetAttributeValue
C_SetOperationState
C_SetPIN
C_Sign
C_SignEncryptUpdate
C_SignFinal
C_SignInit
C_SignRecover
C_SignRecoverInit
C_SignUpdate
C_UnwrapKey
C_Verify
C_VerifyFinal
C_VerifyInit
C_VerifyRecover
C_VerifyRecoverInit
C_VerifyUpdate
C_WaitForSlotEvent
C_WrapKey

Sections

.text
Size: 796KB - Virtual size: 794KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/DMCCBpkcs11.dll.$1
.dll windows:4 windows x86 arch:x86

c8eadad12ac2b24889b56b237750020d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyA
RegEnumKeyA
RegCreateKeyA
RegSetValueA
RegQueryValueA
SetFileSecurityA
GetFileSecurityA
RegCloseKey

kernel32

GetCurrentThreadId
GetSystemTime
GlobalFree
GlobalAlloc
CreateFileA
CloseHandle
GetLastError
DeviceIoControl
CreateEventA
GlobalDeleteAtom
GetModuleHandleA
SetLastError
GetVersion
lstrlenA
lstrcpynA
GetModuleFileNameA
lstrcpyA
lstrcatA
SetErrorMode
InterlockedDecrement
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
GlobalLock
TlsFree
GlobalHandle
GlobalUnlock
DeleteCriticalSection
TlsAlloc
LocalAlloc
LocalFree
SuspendThread
QueryPerformanceCounter
GetTickCount
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
GlobalMemoryStatus
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetEvent
WaitForSingleObject
SetEnvironmentVariableA
IsBadCodePtr
CompareStringW
CompareStringA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapCreate
HeapDestroy
GetEnvironmentVariableA
VirtualAlloc
VirtualFree
HeapFree
HeapReAlloc
GlobalFindAtomA
HeapAlloc
GetACP
TerminateProcess
ExitProcess
OutputDebugStringA
GetStdHandle
DebugBreak
RaiseException
ExitThread
CreateThread
GetCommandLineA
RtlUnwind
GetLocalTime
GetTimeZoneInformation
HeapValidate
SetFileAttributesA
SystemTimeToFileTime
LocalFileTimeToFileTime
ResetEvent
GetFileSize
GetDiskFreeSpaceA
GetFileTime
SetFileTime
GetTempFileNameA
GetFileAttributesA
GetShortPathNameA
GetThreadLocale
GetStringTypeExA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DeleteFileA
MoveFileA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetCurrentProcess
DuplicateHandle
FindResourceExA
FormatMessageA
SizeofResource
GetCurrentDirectoryA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetProfileIntA
VirtualProtect
FileTimeToLocalFileTime
FileTimeToSystemTime
GetOEMCP
GetCPInfo
GetCurrentThread
IsBadReadPtr
IsBadWritePtr
IsBadStringPtrA
IsBadStringPtrW
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
GlobalFlags
lstrcmpA
MulDiv
GetPrivateProfileIntA
GetProcessVersion
ResumeThread
GetThreadPriority
SetThreadPriority
FindResourceA
LoadResource
LockResource
FreeResource
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA

user32

GetAsyncKeyState
EndDialog
CreateDialogIndirectParamA
LoadStringA
DestroyMenu
OemToCharA
CharToOemA
UnpackDDElParam
GetClipboardFormatNameA
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
PostQuitMessage
OpenIcon
CloseWindow
LoadCursorA
PostThreadMessageA
MapDialogRect
EnableWindow
GetWindowContextHelpId
SetWindowContextHelpId
GetForegroundWindow
SetForegroundWindow
ShowCaret
HideCaret
SetCaretPos
GetCaretPos
CreateCaret
GetClipboardViewer
GetClipboardOwner
GetOpenClipboardWindow
OpenClipboard
SetClipboardViewer
ChangeClipboardChain
FlashWindow
WindowFromPoint
SetParent
GetLastActivePopup
FindWindowA
ChildWindowFromPointEx
ShowScrollBar
GetNextDlgTabItem
GetNextDlgGroupItem
DlgDirSelectComboBoxExA
DlgDirSelectExA
DlgDirListComboBoxA
DlgDirListA
GetDesktopWindow
SetCapture
GetActiveWindow
KillTimer
SetTimer
EnableScrollBar
RedrawWindow
LockWindowUpdate
GetDCEx
ShowOwnedPopups
IsWindowVisible
ValidateRgn
InvalidateRgn
InvalidateRect
GetUpdateRgn
GetUpdateRect
UpdateWindow
ReleaseDC
GetWindowDC
GetDC
EndPaint
BeginPaint
ClientToScreen
BringWindowToTop
GetWindowRgn
SetWindowRgn
ArrangeIconicWindows
IsZoomed
HiliteMenuItem
GetSystemMenu
DrawMenuBar
SetMenu
GetMenu
PostMessageA
LoadIconA
SendDlgItemMessageA
GetClientRect
ReleaseCapture
GetSysColor
SetActiveWindow
SetFocus
AdjustWindowRectEx
ScreenToClient
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
MessageBoxA
IsChild
GetParent
GetWindow
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
TrackPopupMenu
SetWindowPlacement
GetDlgItem
GetWindowTextLengthA
GetWindowTextA
DestroyWindow
SendMessageA
GetClassNameA
GetDlgCtrlID
IsWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetWindowLongA
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetMenuCheckMarkDimensions
GetFocus
UnregisterClassA
CheckMenuRadioItem
GetMenuContextHelpId
SetMenuContextHelpId
LoadMenuIndirectA
LoadMenuA
SetMenuItemBitmaps
RemoveMenu
ModifyMenuA
InsertMenuA
GetSubMenu
GetMenuItemInfoA
GetMenuStringA
GetMenuState
GetMenuItemID
GetMenuItemCount
GetMenuDefaultItem
SetMenuDefaultItem
EnableMenuItem
CheckMenuItem
AppendMenuA
DeleteMenu
IsMenu
CreatePopupMenu
CreateMenu
ScrollDC
GrayStringA
GetTabbedTextExtentA
DrawTextA
TabbedTextOutA
DrawFocusRect
DrawFrameControl
DrawEdge
DrawStateA
DrawIcon
InvertRect
FrameRect
FillRect
ExcludeUpdateRgn
WindowFromDC
SetCursorPos
DestroyCursor
SetCursor
LoadAcceleratorsA
ReuseDDElParam
TranslateAcceleratorA
GetDialogBaseUnits
CharUpperA
DestroyIcon
MapWindowPoints
LoadBitmapA
GetSysColorBrush
SubtractRect
UnionRect
IntersectRect
OffsetRect
InflateRect
EqualRect
SetRectEmpty
SetRect
PtInRect
IsRectEmpty
CopyRect
UnhookWindowsHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyState
CallNextHookEx
ValidateRect
PeekMessageA
GetCursorPos
SetWindowsHookExA
SendNotifyMessageA
ChildWindowFromPoint

gdi32

LineTo
ExtCreatePen
CreatePenIndirect
CreatePen
GetObjectType
UnrealizeObject
GetStockObject
CreateDCA
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
GetObjectA
BitBlt
GetBitmapBits
DeleteObject
DeleteDC
CreateHatchBrush
CreateBrushIndirect
CreatePatternBrush
CreateDIBPatternBrushPt
CreateFontIndirectA
CreateFontA
CreateBitmap
CreateBitmapIndirect
SetBitmapBits
SetBitmapDimensionEx
GetBitmapDimensionEx
CreateDiscardableBitmap
CreatePalette
CreateHalftonePalette
GetPaletteEntries
SetPaletteEntries
AnimatePalette
GetNearestPaletteIndex
ResizePalette
CreateRectRgn
CreateRectRgnIndirect
CreateEllipticRgn
CreateEllipticRgnIndirect
CreatePolygonRgn
CreatePolyPolygonRgn
CreateRoundRectRgn
PathToRegion
ExtCreateRegion
GetRegionData
SetRectRgn
CombineRgn
EqualRgn
OffsetRgn
GetRgnBox
PtInRegion
RectInRegion
CreateICA
GetBrushOrgEx
SetBrushOrgEx
EnumObjects
GetNearestColor
RealizePalette
UpdateColors
GetBkColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextColor
GetMapMode
GetViewportOrgEx
GetViewportExtEx
GetWindowOrgEx
GetWindowExtEx
DPtoLP
LPtoDP
FillRgn
FrameRgn
InvertRgn
PaintRgn
PtVisible
RectVisible
GetCurrentPositionEx
Arc
Polyline
Chord
Ellipse
Pie
Polygon
PolyPolygon
Rectangle
RoundRect
PatBlt
StretchBlt
GetPixel
SetPixel
FloodFill
ExtFloodFill
TextOutA
ExtTextOutA
GetTextExtentPoint32A
GetTextAlign
GetTextFaceA
GetTextMetricsA
GetTextCharacterExtra
GetCharWidthA
GetAspectRatioFilterEx
Escape
SetBoundsRect
GetBoundsRect
ResetDCA
GetOutlineTextMetricsA
GetCharABCWidthsA
GetFontData
GetKerningPairsA
GetGlyphOutlineA
StartDocA
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
MaskBlt
PlgBlt
SetPixelV
AngleArc
GetArcDirection
PolyPolyline
GetColorAdjustment
GetCurrentObject
PolyBezier
DrawEscape
ExtEscape
GetCharABCWidthsFloatA
GetCharWidthFloatA
AbortPath
BeginPath
CloseFigure
EndPath
FillPath
FlattenPath
GetMiterLimit
GetPath
SetMiterLimit
StrokeAndFillPath
StrokePath
WidenPath
GdiComment
PlayEnhMetaFile
GetDCOrgEx
GetClipBox
SetTextColor
SetBkColor
CreateMetaFileA
CloseMetaFile
CreateEnhMetaFileA
CloseEnhMetaFile
SaveDC
RestoreDC
SelectPalette
SetBkMode
EnumFontFamiliesExA
StretchDIBits
PlayMetaFile
EnumMetaFile
PlayMetaFileRecord
ExtSelectClipRgn
SelectClipPath
GetClipRgn
PolyBezierTo
SetColorAdjustment
PolylineTo
PolyDraw
SetArcDirection
ArcTo
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
CreateSolidBrush
MoveToEx
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

comdlg32

GetOpenFileNameA
ChooseColorA
GetFileTitleA
GetSaveFileNameA

shell32

SHGetFileInfoA
DragQueryFileA
DragFinish
DragAcceptFiles
ExtractIconA

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA

comctl32

ImageList_ReplaceIcon
ImageList_Replace
ImageList_Remove
ImageList_AddMasked
ImageList_Add
ImageList_GetImageCount
ord14
ImageList_Write
ImageList_GetIcon
ImageList_Merge
ImageList_LoadImageA
ImageList_Create
ImageList_Destroy
ord13
CreatePropertySheetPageA
DestroyPropertySheetPage
PropertySheetA
ord17
ord8
ImageList_Draw
ImageList_SetBkColor
ImageList_GetBkColor
ImageList_SetOverlayImage
ImageList_GetImageInfo
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragMove
ImageList_SetDragCursorImage
ImageList_DragShowNolock
ImageList_GetDragImage
ImageList_DragEnter
ImageList_DragLeave
ImageList_Read

Exports

Exports

C_CancelFunction
C_CloseAllSessions
C_CloseSession
C_CopyObject
C_CreateObject
C_Decrypt
C_DecryptDigestUpdate
C_DecryptFinal
C_DecryptInit
C_DecryptUpdate
C_DecryptVerifyUpdate
C_DeriveKey
C_DestroyObject
C_Digest
C_DigestEncryptUpdate
C_DigestFinal
C_DigestInit
C_DigestKey
C_DigestUpdate
C_Encrypt
C_EncryptFinal
C_EncryptInit
C_EncryptUpdate
C_Finalize
C_FindObjects
C_FindObjectsFinal
C_FindObjectsInit
C_GenerateKey
C_GenerateKeyPair
C_GenerateRandom
C_GetAttributeValue
C_GetFunctionList
C_GetFunctionStatus
C_GetInfo
C_GetMechanismInfo
C_GetMechanismList
C_GetObjectSize
C_GetOperationState
C_GetSessionInfo
C_GetSlotInfo
C_GetSlotList
C_GetTokenInfo
C_InitPIN
C_InitToken
C_Initialize
C_Login
C_Logout
C_OpenSession
C_SeedRandom
C_SetAttributeValue
C_SetOperationState
C_SetPIN
C_Sign
C_SignEncryptUpdate
C_SignFinal
C_SignInit
C_SignRecover
C_SignRecoverInit
C_SignUpdate
C_UnwrapKey
C_Verify
C_VerifyFinal
C_VerifyInit
C_VerifyRecover
C_VerifyRecoverInit
C_VerifyUpdate
C_WaitForSlotEvent
C_WrapKey

Sections

.text
Size: 796KB - Virtual size: 794KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/GetID.ocx
.dll regsvr32 windows:5 windows x86 arch:x86

21bbbfe993030aa6b741119b938c3819

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d0:0c:46:9e:f9:c8:9c:4c:d1:f0:ed:77:77:8e:d3:0c:84:0d:1e:b7:9d:84:c5:91:0f:a5:2e:5e:b2:c0:d5:e0
Signer

Actual PE Digest

d0:0c:46:9e:f9:c8:9c:4c:d1:f0:ed:77:77:8e:d3:0c:84:0d:1e:b7:9d:84:c5:91:0f:a5:2e:5e:b2:c0:d5:e0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
GetCommandLineA
Sleep
ExitProcess
RaiseException
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
HeapFree
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionAndSpinCount
GetACP
IsValidCodePage
GetTimeZoneInformation
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
RtlUnwind
GetSystemTimeAsFileTime
GetProfileIntA
GetFileTime
GetFileSizeEx
GetFileAttributesA
FindResourceExA
GetOEMCP
GetCPInfo
GetVersion
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileA
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
IsDBCSLeadByte
FreeResource
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
GetUserDefaultLCID
CopyFileA
GlobalSize
FormatMessageA
LocalFree
lstrlenW
MulDiv
GlobalUnlock
GetModuleHandleW
lstrlenA
InterlockedIncrement
GetCurrentProcessId
GlobalAddAtomA
CloseHandle
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpA
InterlockedDecrement
GetModuleFileNameW
SetLastError
GetModuleHandleA
GlobalAlloc
GlobalFree
GetSystemTime
GetCurrentThreadId
GetTempPathA
GetLocalTime
GetSystemDirectoryA
GetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
FreeEnvironmentStringsA
SizeofResource

user32

GetDCEx
GetDialogBaseUnits
GetTabbedTextExtentA
CharUpperA
DestroyIcon
GetSysColorBrush
UnregisterClassA
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
LockWindowUpdate
EnumChildWindows
RegisterClipboardFormatA
SetRect
SetWindowRgn
IsRectEmpty
CreateMenu
DestroyMenu
SetRectEmpty
LoadCursorA
SetCapture
ReleaseCapture
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
LoadIconA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
SetFocus
GetWindowTextA
GetForegroundWindow
SetActiveWindow
GetDlgItem
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
PtInRect
GetMenu
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
EndPaint
BeginPaint
GetWindowDC
FillRect
EnableWindow
UnhookWindowsHookEx
PostQuitMessage
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
GetSysColor
PostMessageA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
SetCursor
MessageBoxA
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetWindowThreadProcessId
SetParent
DrawEdge
ShowWindow
CopyRect
DefWindowProcA
InflateRect
OffsetRect
GetMenuItemCount
GetMenuItemID
CallWindowProcA
SetWindowPos
DestroyWindow
GetDesktopWindow
SetWindowLongA
InvalidateRect
UpdateWindow
GetWindowRect
GetSubMenu
SendDlgItemMessageA

gdi32

CreatePatternBrush
CreatePen
CreateSolidBrush
CombineRgn
CreateRectRgnIndirect
GetTextExtentPoint32A
GetTextAlign
GetTextMetricsA
SetRectRgn
PatBlt
EnumFontFamiliesExA
Rectangle
UnrealizeObject
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
CreateFontIndirectA
Ellipse
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetObjectA
CreateRectRgn
SelectClipRgn
DeleteObject
MoveToEx
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
DeleteDC
DeleteMetaFile
CloseMetaFile
CreateMetaFileA
LPtoDP
GetDeviceCaps
CreateBitmap
GetStockObject
SetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegSetValueA
RegCreateKeyA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteValueA

shell32

ExtractIconA

shlwapi

PathFileExistsA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

ole32

ReadClassStm
CreateStreamOnHGlobal
CoDisconnectObject
CreateDataAdviseHolder
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateOleAdviseHolder
OleDuplicateData
ReleaseStgMedium
ReadFmtUserTypeStg
OleSaveToStream
CoTaskMemAlloc
CreateDataCache
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
OleLoadFromStream
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal

oleaut32

SysAllocStringLen
SysFreeString
SysStringByteLen
SysStringLen
RegisterTypeLi
LoadTypeLi
OleCreatePropertyFrame
VariantClear
VariantChangeType
VariantInit
SysAllocStringByteLen
OleLoadPicture
SysAllocString
VariantCopy
OleCreateFontIndirect
OleCreatePictureIndirect
LoadRegTypeLi

winscard

SCardReleaseContext
SCardListReadersA
SCardFreeMemory
SCardEstablishContext

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 258KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/GetID.ocx.$1
.dll regsvr32 windows:5 windows x86 arch:x86

21bbbfe993030aa6b741119b938c3819

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d0:0c:46:9e:f9:c8:9c:4c:d1:f0:ed:77:77:8e:d3:0c:84:0d:1e:b7:9d:84:c5:91:0f:a5:2e:5e:b2:c0:d5:e0
Signer

Actual PE Digest

d0:0c:46:9e:f9:c8:9c:4c:d1:f0:ed:77:77:8e:d3:0c:84:0d:1e:b7:9d:84:c5:91:0f:a5:2e:5e:b2:c0:d5:e0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
GetCommandLineA
Sleep
ExitProcess
RaiseException
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
HeapFree
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionAndSpinCount
GetACP
IsValidCodePage
GetTimeZoneInformation
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
RtlUnwind
GetSystemTimeAsFileTime
GetProfileIntA
GetFileTime
GetFileSizeEx
GetFileAttributesA
FindResourceExA
GetOEMCP
GetCPInfo
GetVersion
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileA
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
IsDBCSLeadByte
FreeResource
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
GetUserDefaultLCID
CopyFileA
GlobalSize
FormatMessageA
LocalFree
lstrlenW
MulDiv
GlobalUnlock
GetModuleHandleW
lstrlenA
InterlockedIncrement
GetCurrentProcessId
GlobalAddAtomA
CloseHandle
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpA
InterlockedDecrement
GetModuleFileNameW
SetLastError
GetModuleHandleA
GlobalAlloc
GlobalFree
GetSystemTime
GetCurrentThreadId
GetTempPathA
GetLocalTime
GetSystemDirectoryA
GetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
FreeEnvironmentStringsA
SizeofResource

user32

GetDCEx
GetDialogBaseUnits
GetTabbedTextExtentA
CharUpperA
DestroyIcon
GetSysColorBrush
UnregisterClassA
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
LockWindowUpdate
EnumChildWindows
RegisterClipboardFormatA
SetRect
SetWindowRgn
IsRectEmpty
CreateMenu
DestroyMenu
SetRectEmpty
LoadCursorA
SetCapture
ReleaseCapture
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
LoadIconA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
SetFocus
GetWindowTextA
GetForegroundWindow
SetActiveWindow
GetDlgItem
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
PtInRect
GetMenu
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
EndPaint
BeginPaint
GetWindowDC
FillRect
EnableWindow
UnhookWindowsHookEx
PostQuitMessage
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
GetSysColor
PostMessageA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
SetCursor
MessageBoxA
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetWindowThreadProcessId
SetParent
DrawEdge
ShowWindow
CopyRect
DefWindowProcA
InflateRect
OffsetRect
GetMenuItemCount
GetMenuItemID
CallWindowProcA
SetWindowPos
DestroyWindow
GetDesktopWindow
SetWindowLongA
InvalidateRect
UpdateWindow
GetWindowRect
GetSubMenu
SendDlgItemMessageA

gdi32

CreatePatternBrush
CreatePen
CreateSolidBrush
CombineRgn
CreateRectRgnIndirect
GetTextExtentPoint32A
GetTextAlign
GetTextMetricsA
SetRectRgn
PatBlt
EnumFontFamiliesExA
Rectangle
UnrealizeObject
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
CreateFontIndirectA
Ellipse
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetObjectA
CreateRectRgn
SelectClipRgn
DeleteObject
MoveToEx
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
DeleteDC
DeleteMetaFile
CloseMetaFile
CreateMetaFileA
LPtoDP
GetDeviceCaps
CreateBitmap
GetStockObject
SetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegSetValueA
RegCreateKeyA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteValueA

shell32

ExtractIconA

shlwapi

PathFileExistsA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

ole32

ReadClassStm
CreateStreamOnHGlobal
CoDisconnectObject
CreateDataAdviseHolder
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateOleAdviseHolder
OleDuplicateData
ReleaseStgMedium
ReadFmtUserTypeStg
OleSaveToStream
CoTaskMemAlloc
CreateDataCache
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
OleLoadFromStream
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal

oleaut32

SysAllocStringLen
SysFreeString
SysStringByteLen
SysStringLen
RegisterTypeLi
LoadTypeLi
OleCreatePropertyFrame
VariantClear
VariantChangeType
VariantInit
SysAllocStringByteLen
OleLoadPicture
SysAllocString
VariantCopy
OleCreateFontIndirect
OleCreatePictureIndirect
LoadRegTypeLi

winscard

SCardReleaseContext
SCardListReadersA
SCardFreeMemory
SCardEstablishContext

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 258KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/TerminateProcess_dmwz.dll
.dll windows:5 windows x86 arch:x86

1d9fa39282d173fcdf6f8aad72ee700c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathFindExtensionA
PathFindFileNameA
PathFileExistsA

kernel32

RtlUnwind
GetCommandLineA
Sleep
ExitProcess
RaiseException
VirtualAlloc
HeapReAlloc
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
GetOEMCP
GetCPInfo
GetModuleHandleW
CreateFileA
GetCurrentProcess
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
InterlockedIncrement
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedDecrement
GetModuleFileNameW
GlobalFree
GlobalUnlock
FormatMessageA
LocalFree
MultiByteToWideChar
lstrlenA
GetCurrentProcessId
GetLastError
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpA
GlobalAlloc
GetModuleHandleA
GetSystemTime
GetCurrentThreadId
WaitForSingleObject
TerminateProcess
CloseHandle
FindResourceA
LoadResource
LockResource
SizeofResource
HeapAlloc
HeapFree
WideCharToMultiByte
SetLastError
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
FreeEnvironmentStringsW

user32

DestroyMenu
LoadCursorA
GetSysColorBrush
ShowWindow
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
PostMessageA
GetWindowThreadProcessId
EnumWindows
PostQuitMessage
GetWindowPlacement
GetSystemMetrics
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
GetWindowTextA
SetWindowTextA
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
SetCursor
SetWindowsHookExA

gdi32

GetStockObject
DeleteDC
GetDeviceCaps
CreateBitmap
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

SHGetSpecialFolderPathA

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

KillProcessByName
PrintLog

Sections

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/TerminateProcess_dmwz.dll.$1
.dll windows:5 windows x86 arch:x86

1d9fa39282d173fcdf6f8aad72ee700c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathFindExtensionA
PathFindFileNameA
PathFileExistsA

kernel32

RtlUnwind
GetCommandLineA
Sleep
ExitProcess
RaiseException
VirtualAlloc
HeapReAlloc
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
GetOEMCP
GetCPInfo
GetModuleHandleW
CreateFileA
GetCurrentProcess
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
InterlockedIncrement
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedDecrement
GetModuleFileNameW
GlobalFree
GlobalUnlock
FormatMessageA
LocalFree
MultiByteToWideChar
lstrlenA
GetCurrentProcessId
GetLastError
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpA
GlobalAlloc
GetModuleHandleA
GetSystemTime
GetCurrentThreadId
WaitForSingleObject
TerminateProcess
CloseHandle
FindResourceA
LoadResource
LockResource
SizeofResource
HeapAlloc
HeapFree
WideCharToMultiByte
SetLastError
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
FreeEnvironmentStringsW

user32

DestroyMenu
LoadCursorA
GetSysColorBrush
ShowWindow
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
PostMessageA
GetWindowThreadProcessId
EnumWindows
PostQuitMessage
GetWindowPlacement
GetSystemMetrics
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
GetWindowTextA
SetWindowTextA
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
SetCursor
SetWindowsHookExA

gdi32

GetStockObject
DeleteDC
GetDeviceCaps
CreateBitmap
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

SHGetSpecialFolderPathA

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

KillProcessByName
PrintLog

Sections

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/ccb_gm_api.dll
.dll windows:5 windows x86 arch:x86

bc538bda7083814e7125cdaf2f8faefe

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b9:bf:f0:03:12:d1:3f:23:1e:ff:74:21:c7:a1:37:55:91:b1:aa:5b:d3:ed:9d:e2:e0:69:2e:7d:e9:c9:f4:c7
Signer

Actual PE Digest

b9:bf:f0:03:12:d1:3f:23:1e:ff:74:21:c7:a1:37:55:91:b1:aa:5b:d3:ed:9d:e2:e0:69:2e:7d:e9:c9:f4:c7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\mhy\Desktop\NewUI\09.SKF_dll\Win32\Release\ccb_gm_api.pdb

Imports

kernel32

FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
CreateEventA
CloseHandle
SetLastError
GetLocalTime
GetCurrentThreadId
GetTempPathA
GetSystemTime
QueryPerformanceCounter
Sleep
HeapFree
HeapAlloc
GetCurrentProcessId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwind
MultiByteToWideChar
ReadFile
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
CreateFileA
SetFilePointer
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
SetEndOfFile
GetProcessHeap
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Exports

Exports

SKF_CancelWaitForDevEvent
SKF_ChangeDevAuthKey
SKF_ChangePIN
SKF_ClearSecureState
SKF_CloseApplication
SKF_CloseContainer
SKF_CloseHandle
SKF_ConnectDev
SKF_CreateApplication
SKF_CreateContainer
SKF_CreateFile
SKF_Decrypt
SKF_DecryptFinal
SKF_DecryptInit
SKF_DecryptUpdate
SKF_DeleteApplication
SKF_DeleteContainer
SKF_DeleteFile
SKF_DevAuth
SKF_Digest
SKF_DigestFinal
SKF_DigestInit
SKF_DigestUpdate
SKF_DisConnectDev
SKF_ECCExportSessionKey
SKF_ECCSignData
SKF_ECCVerify
SKF_Encrypt
SKF_EncryptFinal
SKF_EncryptInit
SKF_EncryptUpdate
SKF_EnumApplication
SKF_EnumContainer
SKF_EnumDev
SKF_EnumFiles
SKF_ExportCertificate
SKF_ExportPublicKey
SKF_ExtECCDecrypt
SKF_ExtECCEncrypt
SKF_ExtECCSign
SKF_ExtECCVerify
SKF_ExtRSAPriKeyOperation
SKF_ExtRSAPubKeyOperation
SKF_GenECCKeyPair
SKF_GenExtRSAKey
SKF_GenRSAKeyPair
SKF_GenRandom
SKF_GenerateAgreementDataAndKeyWithECC
SKF_GenerateAgreementDataWithECC
SKF_GenerateKeyWithECC
SKF_GetContainerType
SKF_GetDevInfo
SKF_GetDevState
SKF_GetFileInfo
SKF_GetPINInfo
SKF_GetUkeyInfo
SKF_ImportCertificate
SKF_ImportECCKeyPair
SKF_ImportRSAKeyPair
SKF_ImportSessionKey
SKF_LockDev
SKF_Mac
SKF_MacFinal
SKF_MacInit
SKF_MacUpdate
SKF_OpenApplication
SKF_OpenContainer
SKF_RSAExportSessionKey
SKF_RSASignData
SKF_RSAVerify
SKF_ReadFile
SKF_SetLabel
SKF_SetSymmKey
SKF_Transmit
SKF_UnblockPIN
SKF_UnlockDev
SKF_VerifyPIN
SKF_WaitForDevEvent
SKF_WriteFile

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/ccb_gm_api.dll.$1
.dll windows:5 windows x86 arch:x86

bc538bda7083814e7125cdaf2f8faefe

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b9:bf:f0:03:12:d1:3f:23:1e:ff:74:21:c7:a1:37:55:91:b1:aa:5b:d3:ed:9d:e2:e0:69:2e:7d:e9:c9:f4:c7
Signer

Actual PE Digest

b9:bf:f0:03:12:d1:3f:23:1e:ff:74:21:c7:a1:37:55:91:b1:aa:5b:d3:ed:9d:e2:e0:69:2e:7d:e9:c9:f4:c7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\mhy\Desktop\NewUI\09.SKF_dll\Win32\Release\ccb_gm_api.pdb

Imports

kernel32

FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
CreateEventA
CloseHandle
SetLastError
GetLocalTime
GetCurrentThreadId
GetTempPathA
GetSystemTime
QueryPerformanceCounter
Sleep
HeapFree
HeapAlloc
GetCurrentProcessId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwind
MultiByteToWideChar
ReadFile
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
CreateFileA
SetFilePointer
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
SetEndOfFile
GetProcessHeap
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Exports

Exports

SKF_CancelWaitForDevEvent
SKF_ChangeDevAuthKey
SKF_ChangePIN
SKF_ClearSecureState
SKF_CloseApplication
SKF_CloseContainer
SKF_CloseHandle
SKF_ConnectDev
SKF_CreateApplication
SKF_CreateContainer
SKF_CreateFile
SKF_Decrypt
SKF_DecryptFinal
SKF_DecryptInit
SKF_DecryptUpdate
SKF_DeleteApplication
SKF_DeleteContainer
SKF_DeleteFile
SKF_DevAuth
SKF_Digest
SKF_DigestFinal
SKF_DigestInit
SKF_DigestUpdate
SKF_DisConnectDev
SKF_ECCExportSessionKey
SKF_ECCSignData
SKF_ECCVerify
SKF_Encrypt
SKF_EncryptFinal
SKF_EncryptInit
SKF_EncryptUpdate
SKF_EnumApplication
SKF_EnumContainer
SKF_EnumDev
SKF_EnumFiles
SKF_ExportCertificate
SKF_ExportPublicKey
SKF_ExtECCDecrypt
SKF_ExtECCEncrypt
SKF_ExtECCSign
SKF_ExtECCVerify
SKF_ExtRSAPriKeyOperation
SKF_ExtRSAPubKeyOperation
SKF_GenECCKeyPair
SKF_GenExtRSAKey
SKF_GenRSAKeyPair
SKF_GenRandom
SKF_GenerateAgreementDataAndKeyWithECC
SKF_GenerateAgreementDataWithECC
SKF_GenerateKeyWithECC
SKF_GetContainerType
SKF_GetDevInfo
SKF_GetDevState
SKF_GetFileInfo
SKF_GetPINInfo
SKF_GetUkeyInfo
SKF_ImportCertificate
SKF_ImportECCKeyPair
SKF_ImportRSAKeyPair
SKF_ImportSessionKey
SKF_LockDev
SKF_Mac
SKF_MacFinal
SKF_MacInit
SKF_MacUpdate
SKF_OpenApplication
SKF_OpenContainer
SKF_RSAExportSessionKey
SKF_RSASignData
SKF_RSAVerify
SKF_ReadFile
SKF_SetLabel
SKF_SetSymmKey
SKF_Transmit
SKF_UnblockPIN
SKF_UnlockDev
SKF_VerifyPIN
SKF_WaitForDevEvent
SKF_WriteFile

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CCBCertificate.exe
.exe windows:5 windows x86 arch:x86

8a2fafe2ccc6a2a8281185360aa87614

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:b9:ff:10:25:5c:8e:fb:29:64:3e:94:dc:27:6a:35:b1:8b:4e:d4:79:63:9a:30:4e:c7:21:d5:e9:4b:19:7e
Signer

Actual PE Digest

4e:b9:ff:10:25:5c:8e:fb:29:64:3e:94:dc:27:6a:35:b1:8b:4e:d4:79:63:9a:30:4e:c7:21:d5:e9:4b:19:7e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\liwei\Desktop\02.CCBCertificate_exe\Win32\Release\CCBCertificate.pdb

Imports

kernel32

ExitThread
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
HeapReAlloc
ExitProcess
HeapSize
VirtualFree
HeapCreate
GetStdHandle
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualQuery
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetDriveTypeA
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
GetSystemInfo
VirtualAlloc
VirtualProtect
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapFree
HeapAlloc
GetTickCount
GetFileTime
GetFileSizeEx
GetFileAttributesA
SetErrorMode
GetCurrentDirectoryA
GetOEMCP
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
InterlockedIncrement
GetModuleHandleW
GlobalFlags
CreateFileA
GetFullPathNameA
GetVersion
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
FindFirstFileA
FileTimeToLocalFileTime
FindNextFileA
FindClose
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
LoadLibraryExA
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
SuspendThread
SetThreadPriority
InterlockedDecrement
GetModuleFileNameW
FormatMessageA
GetCurrentProcessId
CreateThread
QueryPerformanceCounter
ResetEvent
SetEvent
MulDiv
CreateEventA
InterlockedExchange
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
EnterCriticalSection
LeaveCriticalSection
ReleaseMutex
CreateFileMappingA
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
GetSystemTime
GetTempPathA
GetLocalTime
FileTimeToSystemTime
GetExitCodeThread
LocalAlloc
LocalFree
WritePrivateProfileStringA
CreateDirectoryA
GetPrivateProfileStringA
GetModuleFileNameA
ResumeThread
GetCurrentThreadId
FreeLibrary
Sleep
CreateMutexA
CloseHandle
lstrcmpiA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetProcAddress
GetModuleHandleA
LoadLibraryA
GetLastError
SetLastError
GetCPInfo
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
lstrlenA
GetVersionExA
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

gdi32

GetRgnBox
GetTextColor
GetBkColor
DPtoLP
GetMapMode
CreateRectRgnIndirect
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetWindowExtEx
GetViewportExtEx
MoveToEx
LineTo
GetClipBox
SetMapMode
RestoreDC
SaveDC
SetDIBColorTable
SetBkMode
RoundRect
CreatePatternBrush
SetTextColor
SetBkColor
CreateBitmap
GetStockObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
PatBlt
SetPixel
GetPixel
GetObjectA
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
Ellipse
GetTextExtentPoint32A
GetTextExtentPoint32W
CreateFontIndirectA
GetBkMode
CreatePen
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCreateKeyExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

shell32

ShellExecuteExA
ShellExecuteA
Shell_NotifyIconA
SHGetSpecialFolderPathA

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathFindFileNameA
PathIsUNCA
PathStripToRootA
PathFindExtensionA
PathFileExistsA

oledlg

ord8

ole32

CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoTaskMemFree
CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance
CoInitialize
CoRegisterMessageFilter
OleFlushClipboard
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard

oleaut32

VariantInit
VariantChangeType
VariantClear
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
OleLoadPicture
SysFreeString
SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy

gdiplus

GdiplusStartup
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipCloneImage
GdipAlloc
GdipFree
GdipDisposeImage
GdiplusShutdown
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext

winmm

PlaySoundA

crypt32

CertGetNameStringA
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCloseStore
CertSetCertificateContextProperty
CertFreeCertificateContext
CertFindCertificateInStore
CertCompareCertificate
CryptVerifyCertificateSignature
CertOpenStore
CertCreateCertificateContext

winscard

SCardListReadersA
SCardReleaseContext
SCardFreeMemory
SCardGetStatusChangeA
SCardEstablishContext

Sections

.text
Size: - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.test0
Size: - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.test1
Size: 403KB - Virtual size: 402KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 47KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CCBCertificate.exe.$1
.exe windows:5 windows x86 arch:x86

8a2fafe2ccc6a2a8281185360aa87614

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:b9:ff:10:25:5c:8e:fb:29:64:3e:94:dc:27:6a:35:b1:8b:4e:d4:79:63:9a:30:4e:c7:21:d5:e9:4b:19:7e
Signer

Actual PE Digest

4e:b9:ff:10:25:5c:8e:fb:29:64:3e:94:dc:27:6a:35:b1:8b:4e:d4:79:63:9a:30:4e:c7:21:d5:e9:4b:19:7e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\liwei\Desktop\02.CCBCertificate_exe\Win32\Release\CCBCertificate.pdb

Imports

kernel32

ExitThread
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
HeapReAlloc
ExitProcess
HeapSize
VirtualFree
HeapCreate
GetStdHandle
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualQuery
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetDriveTypeA
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
GetSystemInfo
VirtualAlloc
VirtualProtect
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapFree
HeapAlloc
GetTickCount
GetFileTime
GetFileSizeEx
GetFileAttributesA
SetErrorMode
GetCurrentDirectoryA
GetOEMCP
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
InterlockedIncrement
GetModuleHandleW
GlobalFlags
CreateFileA
GetFullPathNameA
GetVersion
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
FindFirstFileA
FileTimeToLocalFileTime
FindNextFileA
FindClose
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
LoadLibraryExA
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
SuspendThread
SetThreadPriority
InterlockedDecrement
GetModuleFileNameW
FormatMessageA
GetCurrentProcessId
CreateThread
QueryPerformanceCounter
ResetEvent
SetEvent
MulDiv
CreateEventA
InterlockedExchange
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
EnterCriticalSection
LeaveCriticalSection
ReleaseMutex
CreateFileMappingA
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
GetSystemTime
GetTempPathA
GetLocalTime
FileTimeToSystemTime
GetExitCodeThread
LocalAlloc
LocalFree
WritePrivateProfileStringA
CreateDirectoryA
GetPrivateProfileStringA
GetModuleFileNameA
ResumeThread
GetCurrentThreadId
FreeLibrary
Sleep
CreateMutexA
CloseHandle
lstrcmpiA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetProcAddress
GetModuleHandleA
LoadLibraryA
GetLastError
SetLastError
GetCPInfo
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
lstrlenA
GetVersionExA
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

gdi32

GetRgnBox
GetTextColor
GetBkColor
DPtoLP
GetMapMode
CreateRectRgnIndirect
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetWindowExtEx
GetViewportExtEx
MoveToEx
LineTo
GetClipBox
SetMapMode
RestoreDC
SaveDC
SetDIBColorTable
SetBkMode
RoundRect
CreatePatternBrush
SetTextColor
SetBkColor
CreateBitmap
GetStockObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
PatBlt
SetPixel
GetPixel
GetObjectA
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
Ellipse
GetTextExtentPoint32A
GetTextExtentPoint32W
CreateFontIndirectA
GetBkMode
CreatePen
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCreateKeyExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

shell32

ShellExecuteExA
ShellExecuteA
Shell_NotifyIconA
SHGetSpecialFolderPathA

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathFindFileNameA
PathIsUNCA
PathStripToRootA
PathFindExtensionA
PathFileExistsA

oledlg

ord8

ole32

CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoTaskMemFree
CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance
CoInitialize
CoRegisterMessageFilter
OleFlushClipboard
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard

oleaut32

VariantInit
VariantChangeType
VariantClear
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
OleLoadPicture
SysFreeString
SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy

gdiplus

GdiplusStartup
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipCloneImage
GdipAlloc
GdipFree
GdipDisposeImage
GdiplusShutdown
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext

winmm

PlaySoundA

crypt32

CertGetNameStringA
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCloseStore
CertSetCertificateContextProperty
CertFreeCertificateContext
CertFindCertificateInStore
CertCompareCertificate
CryptVerifyCertificateSignature
CertOpenStore
CertCreateCertificateContext

winscard

SCardListReadersA
SCardReleaseContext
SCardFreeMemory
SCardGetStatusChangeA
SCardEstablishContext

Sections

.text
Size: - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.test0
Size: - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.test1
Size: 403KB - Virtual size: 402KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 47KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
InstallerCCID.exe
.exe windows:5 windows x86 arch:x86

da7295fc3453e6ba23e26584cd6252f7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\CCID\Installer_CCID\trunk\InstallerCCID\Release\InstallerCCID.pdb

Imports

setupapi

SetupDiGetDeviceRegistryPropertyW
CM_Reenumerate_DevNode
CM_Get_Child
CM_Get_Sibling
CM_Get_Device_IDW
SetupDiCallClassInstaller
SetupDiDestroyDeviceInfoList
CM_Locate_DevNodeW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupCopyOEMInfW

newdev

UpdateDriverForPlugAndPlayDevicesW

shell32

ShellExecuteExW
ShellExecuteW

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LoadLibraryA
InterlockedExchange
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
GetLastError
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
CloseHandle
GetModuleFileNameW
CreateFileW
ReadFile
GetFileSizeEx
GetWindowsDirectoryW
FlushFileBuffers
FindFirstFileW
FindClose
FindNextFileW
GetVersionExW
Sleep
WaitForSingleObject
GetCurrentDirectoryW
GetProcAddress
FreeLibrary
LoadLibraryW
DeleteFileW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetLocaleInfoW
CreateFileA
InterlockedCompareExchange
CopyFileW
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleHandleA
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringW
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
LCMapStringA
WideCharToMultiByte
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode

advapi32

RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyW

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
InstallerCCID.exe.$1
.exe windows:5 windows x86 arch:x86

da7295fc3453e6ba23e26584cd6252f7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\CCID\Installer_CCID\trunk\InstallerCCID\Release\InstallerCCID.pdb

Imports

setupapi

SetupDiGetDeviceRegistryPropertyW
CM_Reenumerate_DevNode
CM_Get_Child
CM_Get_Sibling
CM_Get_Device_IDW
SetupDiCallClassInstaller
SetupDiDestroyDeviceInfoList
CM_Locate_DevNodeW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupCopyOEMInfW

newdev

UpdateDriverForPlugAndPlayDevicesW

shell32

ShellExecuteExW
ShellExecuteW

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LoadLibraryA
InterlockedExchange
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
GetLastError
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
CloseHandle
GetModuleFileNameW
CreateFileW
ReadFile
GetFileSizeEx
GetWindowsDirectoryW
FlushFileBuffers
FindFirstFileW
FindClose
FindNextFileW
GetVersionExW
Sleep
WaitForSingleObject
GetCurrentDirectoryW
GetProcAddress
FreeLibrary
LoadLibraryW
DeleteFileW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetLocaleInfoW
CreateFileA
InterlockedCompareExchange
CopyFileW
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleHandleA
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringW
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
LCMapStringA
WideCharToMultiByte
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode

advapi32

RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyW

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
language/Chinese.ini
language/Chinese.ini.$1
language/English.ini
language/English.ini.$1
language/TraditionalChinese.ini
language/TraditionalChinese.ini.$1
uninst.exe.nsis
usbccid.cat
usbccid.cat.$1
usbccid.inf
usbccid.inf.$1
usbccid.sys
.sys windows:5 windows x86 arch:x86

f39b03ee1f9cd5628c4512b5c20bceb3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

usbccid.pdb

Imports

ntoskrnl.exe

KeTickCount
KeBugCheckEx
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
IoCreateDevice
IoOpenDeviceRegistryKey
IoAttachDeviceToDeviceStack
KeDelayExecutionThread
ExAllocatePoolWithTag
ExFreePoolWithTag
IofCompleteRequest
_except_handler3
RtlInitUnicodeString
ZwQueryValueKey
IoInitializeRemoveLockEx
ZwClose
KeSetEvent
ExFreePool
IoAcquireCancelSpinLock
IoFreeIrp
IoReleaseRemoveLockEx
IoCancelIrp
KeWaitForSingleObject
IofCallDriver
IoAllocateIrp
KeInitializeEvent
IoAcquireRemoveLockEx
_allmul
IoBuildDeviceIoControlRequest
InterlockedDecrement
InterlockedIncrement
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
KeInitializeSpinLock
IoFreeWorkItem
IoQueueWorkItem
InterlockedCompareExchange
IoAllocateWorkItem
KeResetEvent
KeClearEvent
IoRegisterDeviceInterface
PoStartNextPowerIrp
PoSetPowerState
PoCallDriver
PoRequestPowerIrp
IoSetDeviceInterfaceState
IoDeleteDevice
IoDetachDevice
RtlFreeUnicodeString
IoReleaseRemoveLockAndWaitEx
InterlockedExchange
IoReleaseCancelSpinLock

hal

KfReleaseSpinLock
KfAcquireSpinLock

smclib.sys

SmartcardT1Request
SmartcardT0Request
SmartcardT0Reply
SmartcardUpdateCardCapabilities
SmartcardDeviceControl
SmartcardT1Reply
SmartcardInitialize
SmartcardExit

usbd.sys

USBD_ParseConfigurationDescriptorEx
USBD_CreateConfigurationRequestEx
USBD_ParseDescriptors

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEABLE
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
usbccid.sys.$1
.sys windows:5 windows x86 arch:x86

f39b03ee1f9cd5628c4512b5c20bceb3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

usbccid.pdb

Imports

ntoskrnl.exe

KeTickCount
KeBugCheckEx
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
IoCreateDevice
IoOpenDeviceRegistryKey
IoAttachDeviceToDeviceStack
KeDelayExecutionThread
ExAllocatePoolWithTag
ExFreePoolWithTag
IofCompleteRequest
_except_handler3
RtlInitUnicodeString
ZwQueryValueKey
IoInitializeRemoveLockEx
ZwClose
KeSetEvent
ExFreePool
IoAcquireCancelSpinLock
IoFreeIrp
IoReleaseRemoveLockEx
IoCancelIrp
KeWaitForSingleObject
IofCallDriver
IoAllocateIrp
KeInitializeEvent
IoAcquireRemoveLockEx
_allmul
IoBuildDeviceIoControlRequest
InterlockedDecrement
InterlockedIncrement
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
KeInitializeSpinLock
IoFreeWorkItem
IoQueueWorkItem
InterlockedCompareExchange
IoAllocateWorkItem
KeResetEvent
KeClearEvent
IoRegisterDeviceInterface
PoStartNextPowerIrp
PoSetPowerState
PoCallDriver
PoRequestPowerIrp
IoSetDeviceInterfaceState
IoDeleteDevice
IoDetachDevice
RtlFreeUnicodeString
IoReleaseRemoveLockAndWaitEx
InterlockedExchange
IoReleaseCancelSpinLock

hal

KfReleaseSpinLock
KfAcquireSpinLock

smclib.sys

SmartcardT1Request
SmartcardT0Request
SmartcardT0Reply
SmartcardUpdateCardCapabilities
SmartcardDeviceControl
SmartcardT1Reply
SmartcardInitialize
SmartcardExit

usbd.sys

USBD_ParseConfigurationDescriptorEx
USBD_CreateConfigurationRequestEx
USBD_ParseDescriptors

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEABLE
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/CCB_DM_LCD_x64_silent.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9f:c8:25:48:c4:70:72:d6:ad:11:9f:11:d3:33:c0:7a:70:1f:0c:6d:fa:d1:e6:b7:ab:10:78:d1:3b:e0:8d:40
Signer

Actual PE Digest

9f:c8:25:48:c4:70:72:d6:ad:11:9f:11:d3:33:c0:7a:70:1f:0c:6d:fa:d1:e6:b7:ab:10:78:d1:3b:e0:8d:40

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

afa8e526425f3585465337467d0b5909

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
lstrcpynA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 741B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 673B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsProcess.dll
.dll windows:5 windows x86 arch:x86

a49b0342971aa199fc6349725b90146d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
OpenProcess
lstrcpynA
lstrlenA
LoadLibraryA
lstrcmpiA
WideCharToMultiByte
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetVersionExA
GlobalFree
GlobalAlloc

user32

GetWindowThreadProcessId
EnumWindows
wsprintfA
PostMessageA

Exports

Exports

_CloseProcess
_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 910B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 250B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBDMBDI.dll
.dll windows:5 windows x64 arch:x64

a0ae1132d65abe2a00f5c94b5088b6cd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:a3:32:8e:43:de:d4:e6:bc:b4:39:d0:28:41:98:a1:11:7d:1f:bd:75:20:6f:04:95:3e:54:cb:1d:d6:22:f0
Signer

Actual PE Digest

41:a3:32:8e:43:de:d4:e6:bc:b4:39:d0:28:41:98:a1:11:7d:1f:bd:75:20:6f:04:95:3e:54:cb:1d:d6:22:f0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\Users\liwei\Desktop\07.BDI_dll\x64\Release\CCBDMBDI.pdb

Imports

winscard

SCardListReadersA
SCardTransmit
g_rgSCardT1Pci
SCardReleaseContext
SCardDisconnect
SCardBeginTransaction
SCardEndTransaction
SCardFreeMemory
SCardEstablishContext
SCardGetAttrib
SCardConnectA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

secur32

GetUserNameExA

advapi32

GetNamedSecurityInfoA
GetUserNameA
BuildExplicitAccessWithNameA
LookupAccountNameA
SetNamedSecurityInfoA
SetEntriesInAclA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

kernel32

GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapSize
SetEndOfFile
GetProcessHeap
GetStringTypeW
RtlCaptureContext
GetCurrentProcess
GetLastError
GetVersionExA
WaitForSingleObject
SetEvent
CreateEventA
ResetEvent
CloseHandle
Sleep
CreateFileA
GlobalAlloc
GlobalFree
DeviceIoControl
LocalFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateMutexA
ReleaseMutex
GetLocalTime
GetTempPathA
GetCurrentThreadId
GetSystemTime
QueryPerformanceCounter
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
FlsSetValue
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
HeapSetInformation
HeapCreate
HeapDestroy
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
ReadFile
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetFilePointer
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapReAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Exports

Exports

DM_GetFunctionList_All
DM_GetFunctionList_CertTool
DM_GetFunctionList_FireFox
DM_GetFunctionList_Ocx
DM_GetFunctionList_Skf

Sections

.text
Size: - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 519KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 545KB - Virtual size: 544KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBDMBDI.dll.$1
.dll windows:5 windows x64 arch:x64

a0ae1132d65abe2a00f5c94b5088b6cd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:a3:32:8e:43:de:d4:e6:bc:b4:39:d0:28:41:98:a1:11:7d:1f:bd:75:20:6f:04:95:3e:54:cb:1d:d6:22:f0
Signer

Actual PE Digest

41:a3:32:8e:43:de:d4:e6:bc:b4:39:d0:28:41:98:a1:11:7d:1f:bd:75:20:6f:04:95:3e:54:cb:1d:d6:22:f0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\Users\liwei\Desktop\07.BDI_dll\x64\Release\CCBDMBDI.pdb

Imports

winscard

SCardListReadersA
SCardTransmit
g_rgSCardT1Pci
SCardReleaseContext
SCardDisconnect
SCardBeginTransaction
SCardEndTransaction
SCardFreeMemory
SCardEstablishContext
SCardGetAttrib
SCardConnectA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

secur32

GetUserNameExA

advapi32

GetNamedSecurityInfoA
GetUserNameA
BuildExplicitAccessWithNameA
LookupAccountNameA
SetNamedSecurityInfoA
SetEntriesInAclA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

kernel32

GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapSize
SetEndOfFile
GetProcessHeap
GetStringTypeW
RtlCaptureContext
GetCurrentProcess
GetLastError
GetVersionExA
WaitForSingleObject
SetEvent
CreateEventA
ResetEvent
CloseHandle
Sleep
CreateFileA
GlobalAlloc
GlobalFree
DeviceIoControl
LocalFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateMutexA
ReleaseMutex
GetLocalTime
GetTempPathA
GetCurrentThreadId
GetSystemTime
QueryPerformanceCounter
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
FlsSetValue
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
HeapSetInformation
HeapCreate
HeapDestroy
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
ReadFile
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetFilePointer
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapReAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Exports

Exports

DM_GetFunctionList_All
DM_GetFunctionList_CertTool
DM_GetFunctionList_FireFox
DM_GetFunctionList_Ocx
DM_GetFunctionList_Skf

Sections

.text
Size: - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 519KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 545KB - Virtual size: 544KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCAPI.dll
.dll windows:5 windows x64 arch:x64

619d97aefe98609ab70f806f0b38b504

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

31:c9:fd:74:94:fc:ea:78:f7:cb:73:56:ef:9b:04:5f:0f:46:9a:82:c7:71:5f:5b:91:4a:13:30:71:e7:c7:ee
Signer

Actual PE Digest

31:c9:fd:74:94:fc:ea:78:f7:cb:73:56:ef:9b:04:5f:0f:46:9a:82:c7:71:5f:5b:91:4a:13:30:71:e7:c7:ee

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

secur32

GetUserNameExW

kernel32

GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
HeapReAlloc
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WriteConsoleW
GetConsoleCP
WideCharToMultiByte
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FlsAlloc
FlsFree
FlsGetValue
DecodePointer
EncodePointer
HeapDestroy
HeapCreate
HeapSetInformation
GetModuleFileNameA
SetEndOfFile
GetProcessHeap
ReadFile
QueryPerformanceCounter
FindResourceW
SizeofResource
LoadResource
GlobalLock
GlobalUnlock
LeaveCriticalSection
EnterCriticalSection
GetSystemTime
GetTempPathA
GetLocalTime
DeviceIoControl
CreateEventW
LocalFree
CreateFileA
GlobalAlloc
GlobalFree
CloseHandle
SetEvent
WaitForSingleObject
ResetEvent
CreateEventA
GetCurrentProcess
InitializeCriticalSection
GetVersionExA
DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress
GetModuleFileNameW
GetCurrentThreadId
LoadLibraryW
GetLastError
Sleep
FreeLibrary
lstrcpyW
GetVersionExW
MultiByteToWideChar
SetLastError
GetPrivateProfileStringA
GetConsoleMode
GetStdHandle
WriteFile
ExitProcess
GetCommandLineA
FlsSetValue
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
GetCurrentProcessId
RtlUnwindEx
RtlPcToFileHeader
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
HeapFree
HeapAlloc

user32

GetWindowTextW
FillRect
FrameRect
SetWindowTextA
GetDC
SetWindowTextW
EndDialog
OffsetRect
ScreenToClient
GetCursorPos
GetClientRect
DrawTextW
GetDlgItem
DestroyWindow
CallNextHookEx
GetWindowRect
SystemParametersInfoW
UnhookWindowsHookEx
MessageBoxW
SetTimer
SetWindowsHookExW
MoveWindow
SendMessageW
SetWindowPos
GetFocus
GetNextDlgTabItem
SetDlgItemTextA
GetWindowDC
GetSysColorBrush
ReleaseDC
ClientToScreen
SetWindowLongW
GetWindowTextLengthW
GetWindowTextA
GetWindowLongW
CallWindowProcW
GetKeyState
DialogBoxParamA
PostMessageA
RegisterWindowMessageA
GetForegroundWindow
SetForegroundWindow
SetDlgItemTextW
KillTimer
GetSystemMetrics
EnableWindow
FindWindowW
GetDlgItemTextA
SetFocus
ShowWindow
DialogBoxParamW

gdi32

SetDIBColorTable
SetStretchBltMode
StretchBlt
GetStockObject
CreateCompatibleDC
SelectObject
GetObjectW
CreateFontIndirectW
CreatePen
RoundRect
DeleteObject
CreateSolidBrush
SetBkMode
SetTextColor
DeleteDC
CreateDIBSection

advapi32

CryptCreateHash
LookupAccountNameW
SetNamedSecurityInfoA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameW
SetEntriesInAclW
GetUserNameW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptDuplicateKey
CryptDuplicateHash
CryptDestroyHash
CryptHashSessionKey
CryptHashData
CryptDecrypt
CryptImportKey
CryptGetUserKey
CryptEncrypt
CryptExportKey
CryptGetHashParam
CryptSetHashParam
CryptGetKeyParam
CryptSetKeyParam
CryptDestroyKey
CryptDeriveKey
CryptGenKey
CryptReleaseContext
GetUserNameA
CryptAcquireContextA

shell32

SHGetSpecialFolderPathA

ole32

CreateStreamOnHGlobal

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

gdiplus

GdipGetImagePaletteSize
GdipBitmapUnlockBits
GdiplusStartup
GdiplusShutdown
GdipGetImageGraphicsContext
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipBitmapLockBits
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCloneImage
GdipDrawImageI

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature

Sections

.text
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CCB_CSP
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCAPI.dll.$1
.dll windows:5 windows x64 arch:x64

619d97aefe98609ab70f806f0b38b504

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

31:c9:fd:74:94:fc:ea:78:f7:cb:73:56:ef:9b:04:5f:0f:46:9a:82:c7:71:5f:5b:91:4a:13:30:71:e7:c7:ee
Signer

Actual PE Digest

31:c9:fd:74:94:fc:ea:78:f7:cb:73:56:ef:9b:04:5f:0f:46:9a:82:c7:71:5f:5b:91:4a:13:30:71:e7:c7:ee

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

secur32

GetUserNameExW

kernel32

GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
HeapReAlloc
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WriteConsoleW
GetConsoleCP
WideCharToMultiByte
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FlsAlloc
FlsFree
FlsGetValue
DecodePointer
EncodePointer
HeapDestroy
HeapCreate
HeapSetInformation
GetModuleFileNameA
SetEndOfFile
GetProcessHeap
ReadFile
QueryPerformanceCounter
FindResourceW
SizeofResource
LoadResource
GlobalLock
GlobalUnlock
LeaveCriticalSection
EnterCriticalSection
GetSystemTime
GetTempPathA
GetLocalTime
DeviceIoControl
CreateEventW
LocalFree
CreateFileA
GlobalAlloc
GlobalFree
CloseHandle
SetEvent
WaitForSingleObject
ResetEvent
CreateEventA
GetCurrentProcess
InitializeCriticalSection
GetVersionExA
DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress
GetModuleFileNameW
GetCurrentThreadId
LoadLibraryW
GetLastError
Sleep
FreeLibrary
lstrcpyW
GetVersionExW
MultiByteToWideChar
SetLastError
GetPrivateProfileStringA
GetConsoleMode
GetStdHandle
WriteFile
ExitProcess
GetCommandLineA
FlsSetValue
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
GetCurrentProcessId
RtlUnwindEx
RtlPcToFileHeader
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
HeapFree
HeapAlloc

user32

GetWindowTextW
FillRect
FrameRect
SetWindowTextA
GetDC
SetWindowTextW
EndDialog
OffsetRect
ScreenToClient
GetCursorPos
GetClientRect
DrawTextW
GetDlgItem
DestroyWindow
CallNextHookEx
GetWindowRect
SystemParametersInfoW
UnhookWindowsHookEx
MessageBoxW
SetTimer
SetWindowsHookExW
MoveWindow
SendMessageW
SetWindowPos
GetFocus
GetNextDlgTabItem
SetDlgItemTextA
GetWindowDC
GetSysColorBrush
ReleaseDC
ClientToScreen
SetWindowLongW
GetWindowTextLengthW
GetWindowTextA
GetWindowLongW
CallWindowProcW
GetKeyState
DialogBoxParamA
PostMessageA
RegisterWindowMessageA
GetForegroundWindow
SetForegroundWindow
SetDlgItemTextW
KillTimer
GetSystemMetrics
EnableWindow
FindWindowW
GetDlgItemTextA
SetFocus
ShowWindow
DialogBoxParamW

gdi32

SetDIBColorTable
SetStretchBltMode
StretchBlt
GetStockObject
CreateCompatibleDC
SelectObject
GetObjectW
CreateFontIndirectW
CreatePen
RoundRect
DeleteObject
CreateSolidBrush
SetBkMode
SetTextColor
DeleteDC
CreateDIBSection

advapi32

CryptCreateHash
LookupAccountNameW
SetNamedSecurityInfoA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameW
SetEntriesInAclW
GetUserNameW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptDuplicateKey
CryptDuplicateHash
CryptDestroyHash
CryptHashSessionKey
CryptHashData
CryptDecrypt
CryptImportKey
CryptGetUserKey
CryptEncrypt
CryptExportKey
CryptGetHashParam
CryptSetHashParam
CryptGetKeyParam
CryptSetKeyParam
CryptDestroyKey
CryptDeriveKey
CryptGenKey
CryptReleaseContext
GetUserNameA
CryptAcquireContextA

shell32

SHGetSpecialFolderPathA

ole32

CreateStreamOnHGlobal

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

gdiplus

GdipGetImagePaletteSize
GdipBitmapUnlockBits
GdiplusStartup
GdiplusShutdown
GdipGetImageGraphicsContext
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipBitmapLockBits
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCloneImage
GdipDrawImageI

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature

Sections

.text
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CCB_CSP
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCAPIV2.dll
.dll windows:5 windows x64 arch:x64

54dccf09f06440340568fb61c7bdc1b9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cb:58:13:4f:1a:5b:91:3e:2f:04:e5:2d:8f:6b:02:e6:0f:24:e4:59:1b:e1:fc:8a:f9:40:a8:b3:dc:05:b0:11
Signer

Actual PE Digest

cb:58:13:4f:1a:5b:91:3e:2f:04:e5:2d:8f:6b:02:e6:0f:24:e4:59:1b:e1:fc:8a:f9:40:a8:b3:dc:05:b0:11

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

crypt32

CertCreateCertificateContext
CertFreeCertificateContext

secur32

GetUserNameExW

kernel32

LocalFree
DeviceIoControl
CreateMutexA
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
ReleaseMutex
GetLocalTime
GetTempPathA
GetSystemTime
GlobalUnlock
GlobalLock
QueryPerformanceCounter
CreateThread
GetProcessHeap
SetEndOfFile
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
GetLocaleInfoA
SizeofResource
CreateFileA
GetStringTypeA
LCMapStringA
HeapReAlloc
InitializeCriticalSectionAndSpinCount
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
ReadFile
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FlsAlloc
FlsFree
FlsGetValue
DecodePointer
EncodePointer
HeapDestroy
GlobalAlloc
GlobalFree
CloseHandle
SetEvent
WaitForSingleObject
ResetEvent
CreateEventA
GetCurrentProcess
GetVersionExA
DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress
GetModuleFileNameW
GetCurrentThreadId
FindResourceW
LoadResource
GetStringTypeW
LockResource
GetVersionExW
SetLastError
MultiByteToWideChar
LoadLibraryW
GetLastError
Sleep
FreeLibrary
lstrcpyW
GetPrivateProfileStringA
EnterCriticalSection
LeaveCriticalSection
HeapCreate
InitializeCriticalSection
HeapSetInformation
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetCommandLineA
FlsSetValue
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
GetCurrentProcessId
RtlUnwindEx
RtlPcToFileHeader
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitThread
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

DrawTextW
OffsetRect
GetWindowTextW
FillRect
FrameRect
SetWindowTextA
GetDlgItem
GetWindowLongPtrW
SetWindowTextW
EndDialog
SendMessageW
ScreenToClient
CallNextHookEx
GetWindowRect
MoveWindow
GetSystemMetrics
GetDC
GetCursorPos
SetWindowLongPtrW
SystemParametersInfoW
DialogBoxParamW
GetActiveWindow
ShowWindow
SetTimer
KillTimer
FindWindowW
GetDlgItemTextA
EnableWindow
SetFocus
UnhookWindowsHookEx
MessageBoxW
SetWindowsHookExW
GetForegroundWindow
RegisterWindowMessageA
PostMessageA
GetWindowTextLengthW
GetKeyState
CallWindowProcW
GetWindowLongW
GetWindowTextA
SetWindowLongW
SetDlgItemTextA
SetDlgItemTextW
GetNextDlgTabItem
GetClientRect
SetWindowPos
GetFocus

gdi32

SetDIBColorTable
SetStretchBltMode
StretchBlt
GetStockObject
CreateCompatibleDC
SelectObject
GetObjectW
CreateFontIndirectW
CreatePen
RoundRect
DeleteObject
CreateSolidBrush
SetBkMode
SetTextColor
DeleteDC
CreateDIBSection

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
SetNamedSecurityInfoA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameW
SetEntriesInAclW
GetUserNameW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
GetUserNameA

shell32

SHGetSpecialFolderPathA

ole32

CreateStreamOnHGlobal
StringFromGUID2

gdiplus

GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdiplusShutdown
GdipDisposeImage
GdipDrawImageRectI
GdipCloneImage
GdiplusStartup
GdipGetImageWidth
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipLoadImageFromStream
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipCreateFromHDC
GdipGetImageHeight
GdipDrawImageI
GdipGetImageGraphicsContext

winscard

SCardReleaseContext
SCardFreeMemory
SCardGetAttrib
SCardDisconnect
SCardBeginTransaction
SCardConnectA
SCardEstablishContext
SCardListReadersA
SCardTransmit
g_rgSCardT1Pci
SCardEndTransaction

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature

Sections

.text
Size: - Virtual size: 326KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CCB_CSP
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 669KB - Virtual size: 669KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCAPIV2.dll.$1
.dll windows:5 windows x64 arch:x64

54dccf09f06440340568fb61c7bdc1b9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cb:58:13:4f:1a:5b:91:3e:2f:04:e5:2d:8f:6b:02:e6:0f:24:e4:59:1b:e1:fc:8a:f9:40:a8:b3:dc:05:b0:11
Signer

Actual PE Digest

cb:58:13:4f:1a:5b:91:3e:2f:04:e5:2d:8f:6b:02:e6:0f:24:e4:59:1b:e1:fc:8a:f9:40:a8:b3:dc:05:b0:11

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

crypt32

CertCreateCertificateContext
CertFreeCertificateContext

secur32

GetUserNameExW

kernel32

LocalFree
DeviceIoControl
CreateMutexA
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
ReleaseMutex
GetLocalTime
GetTempPathA
GetSystemTime
GlobalUnlock
GlobalLock
QueryPerformanceCounter
CreateThread
GetProcessHeap
SetEndOfFile
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
GetLocaleInfoA
SizeofResource
CreateFileA
GetStringTypeA
LCMapStringA
HeapReAlloc
InitializeCriticalSectionAndSpinCount
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
ReadFile
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FlsAlloc
FlsFree
FlsGetValue
DecodePointer
EncodePointer
HeapDestroy
GlobalAlloc
GlobalFree
CloseHandle
SetEvent
WaitForSingleObject
ResetEvent
CreateEventA
GetCurrentProcess
GetVersionExA
DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress
GetModuleFileNameW
GetCurrentThreadId
FindResourceW
LoadResource
GetStringTypeW
LockResource
GetVersionExW
SetLastError
MultiByteToWideChar
LoadLibraryW
GetLastError
Sleep
FreeLibrary
lstrcpyW
GetPrivateProfileStringA
EnterCriticalSection
LeaveCriticalSection
HeapCreate
InitializeCriticalSection
HeapSetInformation
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetCommandLineA
FlsSetValue
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
GetCurrentProcessId
RtlUnwindEx
RtlPcToFileHeader
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitThread
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

DrawTextW
OffsetRect
GetWindowTextW
FillRect
FrameRect
SetWindowTextA
GetDlgItem
GetWindowLongPtrW
SetWindowTextW
EndDialog
SendMessageW
ScreenToClient
CallNextHookEx
GetWindowRect
MoveWindow
GetSystemMetrics
GetDC
GetCursorPos
SetWindowLongPtrW
SystemParametersInfoW
DialogBoxParamW
GetActiveWindow
ShowWindow
SetTimer
KillTimer
FindWindowW
GetDlgItemTextA
EnableWindow
SetFocus
UnhookWindowsHookEx
MessageBoxW
SetWindowsHookExW
GetForegroundWindow
RegisterWindowMessageA
PostMessageA
GetWindowTextLengthW
GetKeyState
CallWindowProcW
GetWindowLongW
GetWindowTextA
SetWindowLongW
SetDlgItemTextA
SetDlgItemTextW
GetNextDlgTabItem
GetClientRect
SetWindowPos
GetFocus

gdi32

SetDIBColorTable
SetStretchBltMode
StretchBlt
GetStockObject
CreateCompatibleDC
SelectObject
GetObjectW
CreateFontIndirectW
CreatePen
RoundRect
DeleteObject
CreateSolidBrush
SetBkMode
SetTextColor
DeleteDC
CreateDIBSection

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
SetNamedSecurityInfoA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameW
SetEntriesInAclW
GetUserNameW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
GetUserNameA

shell32

SHGetSpecialFolderPathA

ole32

CreateStreamOnHGlobal
StringFromGUID2

gdiplus

GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdiplusShutdown
GdipDisposeImage
GdipDrawImageRectI
GdipCloneImage
GdiplusStartup
GdipGetImageWidth
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipLoadImageFromStream
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipCreateFromHDC
GdipGetImageHeight
GdipDrawImageI
GdipGetImageGraphicsContext

winscard

SCardReleaseContext
SCardFreeMemory
SCardGetAttrib
SCardDisconnect
SCardBeginTransaction
SCardConnectA
SCardEstablishContext
SCardListReadersA
SCardTransmit
g_rgSCardT1Pci
SCardEndTransaction

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature

Sections

.text
Size: - Virtual size: 326KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CCB_CSP
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 669KB - Virtual size: 669KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCSP.dll
.dll regsvr32 windows:5 windows x64 arch:x64

460a8e21eec0e201c7e68a6dcd70b8c0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
FindResourceA
GetLastError
GetModuleFileNameA
CreateFileA
LoadLibraryA
FreeLibrary
DisableThreadLibraryCalls
GetFileSize
ReadFile
CloseHandle
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapFree
Sleep
GetModuleHandleW
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
RtlUnwindEx
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
HeapAlloc
HeapReAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
HeapSize

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegSetValueExA

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCSP.dll.$1
.dll regsvr32 windows:5 windows x64 arch:x64

460a8e21eec0e201c7e68a6dcd70b8c0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
FindResourceA
GetLastError
GetModuleFileNameA
CreateFileA
LoadLibraryA
FreeLibrary
DisableThreadLibraryCalls
GetFileSize
ReadFile
CloseHandle
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapFree
Sleep
GetModuleHandleW
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
RtlUnwindEx
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
HeapAlloc
HeapReAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
HeapSize

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegSetValueExA

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCSP.sig
$SYSDIR/$SYSDIR/CCBKCSP.sig.$1
$SYSDIR/$SYSDIR/CCBKCSPV2.dll
.dll regsvr32 windows:5 windows x64 arch:x64

460a8e21eec0e201c7e68a6dcd70b8c0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
FindResourceA
GetLastError
GetModuleFileNameA
CreateFileA
LoadLibraryA
FreeLibrary
DisableThreadLibraryCalls
GetFileSize
ReadFile
CloseHandle
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapFree
Sleep
GetModuleHandleW
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
RtlUnwindEx
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
HeapAlloc
HeapReAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
HeapSize

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegSetValueExA

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCSPV2.dll.$1
.dll regsvr32 windows:5 windows x64 arch:x64

460a8e21eec0e201c7e68a6dcd70b8c0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
FindResourceA
GetLastError
GetModuleFileNameA
CreateFileA
LoadLibraryA
FreeLibrary
DisableThreadLibraryCalls
GetFileSize
ReadFile
CloseHandle
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapFree
Sleep
GetModuleHandleW
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
RtlUnwindEx
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
HeapAlloc
HeapReAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
HeapSize

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegSetValueExA

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCBKCSPV2.sig
$SYSDIR/$SYSDIR/CCBKCSPV2.sig.$1
$SYSDIR/$SYSDIR/CCB_DM_UI.dll
.dll windows:5 windows x64 arch:x64

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fa:fb:4d:86:4e:c4:a8:bb:e4:c9:3a:6e:f8:c0:a9:6e:9d:b3:aa:7a:29:a6:76:e9:88:aa:e9:d5:6f:b3:0f:d4
Signer

Actual PE Digest

fa:fb:4d:86:4e:c4:a8:bb:e4:c9:3a:6e:f8:c0:a9:6e:9d:b3:aa:7a:29:a6:76:e9:88:aa:e9:d5:6f:b3:0f:d4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/CCB_DM_UI.dll.$1
.dll windows:5 windows x64 arch:x64

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fa:fb:4d:86:4e:c4:a8:bb:e4:c9:3a:6e:f8:c0:a9:6e:9d:b3:aa:7a:29:a6:76:e9:88:aa:e9:d5:6f:b3:0f:d4
Signer

Actual PE Digest

fa:fb:4d:86:4e:c4:a8:bb:e4:c9:3a:6e:f8:c0:a9:6e:9d:b3:aa:7a:29:a6:76:e9:88:aa:e9:d5:6f:b3:0f:d4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/GetID.ocx
.dll regsvr32 windows:5 windows x64 arch:x64

2d1940fc030691941ed86340c85427a7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b4:cf:b7:c2:93:4b:3a:7c:4e:b1:22:a2:21:ce:43:94:a7:b5:89:3e:37:4d:3d:6a:04:62:4a:4b:19:f2:b6:02
Signer

Actual PE Digest

b4:cf:b7:c2:93:4b:3a:7c:4e:b1:22:a2:21:ce:43:94:a7:b5:89:3e:37:4d:3d:6a:04:62:4a:4b:19:f2:b6:02

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
Sleep
ExitProcess
RaiseException
RtlPcToFileHeader
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
HeapSize
HeapQueryInformation
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
HeapDestroy
GetStdHandle
SetHandleCount
GetFileType
FlsSetValue
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionAndSpinCount
GetACP
IsValidCodePage
GetTimeZoneInformation
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
HeapAlloc
HeapFree
RtlUnwindEx
RtlLookupFunctionEntry
GetSystemTimeAsFileTime
GetProfileIntA
GetFileTime
GetFileSizeEx
GetFileAttributesA
FindResourceExA
GetOEMCP
GetCPInfo
GetVersion
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileA
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
InitializeCriticalSection
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
IsDBCSLeadByte
FreeResource
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
GetUserDefaultLCID
CopyFileA
GlobalSize
FormatMessageA
LocalFree
lstrlenW
MulDiv
GlobalUnlock
GetModuleHandleW
lstrlenA
GetCurrentProcessId
GlobalAddAtomA
CloseHandle
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
CompareStringA
GlobalLock
lstrcmpA
GetModuleFileNameW
SetLastError
GetModuleHandleA
GlobalAlloc
GlobalFree
GetSystemTime
GetCurrentThreadId
GetTempPathA
GetLocalTime
GetSystemDirectoryA
GetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
GetStartupInfoA
SizeofResource

user32

GetDCEx
GetDialogBaseUnits
GetTabbedTextExtentA
CharUpperA
DestroyIcon
GetSysColorBrush
UnregisterClassA
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
LockWindowUpdate
EnumChildWindows
RegisterClipboardFormatA
SetRect
SetWindowRgn
IsRectEmpty
CreateMenu
DestroyMenu
SetRectEmpty
LoadCursorA
SetCapture
ReleaseCapture
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
SetFocus
GetWindowTextA
GetForegroundWindow
SetActiveWindow
GetDlgItem
GetTopWindow
GetWindowLongPtrA
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
PtInRect
GetMenu
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
FillRect
EnableWindow
UnhookWindowsHookEx
PostQuitMessage
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
GetSysColor
SetWindowLongA
PostMessageA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
SetCursor
MessageBoxA
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetWindowThreadProcessId
SetParent
DrawEdge
ShowWindow
CopyRect
DefWindowProcA
InflateRect
OffsetRect
GetMenuItemCount
GetMenuItemID
CallWindowProcA
SetWindowPos
SetWindowLongPtrA
DestroyWindow
GetDesktopWindow
InvalidateRect
UpdateWindow
GetWindowRect
GetSubMenu
GetClassLongPtrA

gdi32

CreatePatternBrush
CreatePen
CreateSolidBrush
CombineRgn
CreateRectRgnIndirect
GetTextExtentPoint32A
GetTextAlign
GetTextMetricsA
SetRectRgn
PatBlt
EnumFontFamiliesExA
Rectangle
UnrealizeObject
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
CreateFontIndirectA
Ellipse
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetObjectA
CreateRectRgn
SelectClipRgn
DeleteObject
MoveToEx
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
DeleteDC
DeleteMetaFile
CloseMetaFile
CreateMetaFileA
LPtoDP
GetDeviceCaps
CreateBitmap
GetStockObject
SetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegSetValueA
RegCreateKeyA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteValueA

shell32

ExtractIconA

shlwapi

PathFileExistsA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

ole32

ReadClassStm
CreateStreamOnHGlobal
CoDisconnectObject
CreateDataAdviseHolder
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateOleAdviseHolder
OleDuplicateData
ReleaseStgMedium
ReadFmtUserTypeStg
OleSaveToStream
CoTaskMemAlloc
CreateDataCache
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
OleLoadFromStream
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal

oleaut32

SysAllocStringLen
SysFreeString
SysStringByteLen
SysStringLen
RegisterTypeLi
LoadTypeLi
OleCreatePropertyFrame
VariantClear
VariantChangeType
VariantInit
SysAllocStringByteLen
OleLoadPicture
SysAllocString
VariantCopy
OleCreateFontIndirect
OleCreatePictureIndirect
LoadRegTypeLi

winscard

SCardReleaseContext
SCardListReadersA
SCardFreeMemory
SCardEstablishContext

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 325KB - Virtual size: 324KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$SYSDIR/GetID.ocx.$1
.dll regsvr32 windows:5 windows x64 arch:x64

2d1940fc030691941ed86340c85427a7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-07-2015 00:00

Not After

06-10-2018 23:59

Subject

CN=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,OU=Research and Development Department,O=Beijing Daming Wuzhou Science & Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b4:cf:b7:c2:93:4b:3a:7c:4e:b1:22:a2:21:ce:43:94:a7:b5:89:3e:37:4d:3d:6a:04:62:4a:4b:19:f2:b6:02
Signer

Actual PE Digest

b4:cf:b7:c2:93:4b:3a:7c:4e:b1:22:a2:21:ce:43:94:a7:b5:89:3e:37:4d:3d:6a:04:62:4a:4b:19:f2:b6:02

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
Sleep
ExitProcess
RaiseException
RtlPcToFileHeader
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
HeapSize
HeapQueryInformation
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
HeapDestroy
GetStdHandle
SetHandleCount
GetFileType
FlsSetValue
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionAndSpinCount
GetACP
IsValidCodePage
GetTimeZoneInformation
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
HeapAlloc
HeapFree
RtlUnwindEx
RtlLookupFunctionEntry
GetSystemTimeAsFileTime
GetProfileIntA
GetFileTime
GetFileSizeEx
GetFileAttributesA
FindResourceExA
GetOEMCP
GetCPInfo
GetVersion
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileA
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
InitializeCriticalSection
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
IsDBCSLeadByte
FreeResource
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
GetUserDefaultLCID
CopyFileA
GlobalSize
FormatMessageA
LocalFree
lstrlenW
MulDiv
GlobalUnlock
GetModuleHandleW
lstrlenA
GetCurrentProcessId
GlobalAddAtomA
CloseHandle
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
CompareStringA
GlobalLock
lstrcmpA
GetModuleFileNameW
SetLastError
GetModuleHandleA
GlobalAlloc
GlobalFree
GetSystemTime
GetCurrentThreadId
GetTempPathA
GetLocalTime
GetSystemDirectoryA
GetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
GetStartupInfoA
SizeofResource

user32

GetDCEx
GetDialogBaseUnits
GetTabbedTextExtentA
CharUpperA
DestroyIcon
GetSysColorBrush
UnregisterClassA
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
LockWindowUpdate
EnumChildWindows
RegisterClipboardFormatA
SetRect
SetWindowRgn
IsRectEmpty
CreateMenu
DestroyMenu
SetRectEmpty
LoadCursorA
SetCapture
ReleaseCapture
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
SetFocus
GetWindowTextA
GetForegroundWindow
SetActiveWindow
GetDlgItem
GetTopWindow
GetWindowLongPtrA
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
PtInRect
GetMenu
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
FillRect
EnableWindow
UnhookWindowsHookEx
PostQuitMessage
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
GetSysColor
SetWindowLongA
PostMessageA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
SetCursor
MessageBoxA
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetWindowThreadProcessId
SetParent
DrawEdge
ShowWindow
CopyRect
DefWindowProcA
InflateRect
OffsetRect
GetMenuItemCount
GetMenuItemID
CallWindowProcA
SetWindowPos
SetWindowLongPtrA
DestroyWindow
GetDesktopWindow
InvalidateRect
UpdateWindow
GetWindowRect
GetSubMenu
GetClassLongPtrA

gdi32

CreatePatternBrush
CreatePen
CreateSolidBrush
CombineRgn
CreateRectRgnIndirect
GetTextExtentPoint32A
GetTextAlign
GetTextMetricsA
SetRectRgn
PatBlt
EnumFontFamiliesExA
Rectangle
UnrealizeObject
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
CreateFontIndirectA
Ellipse
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetObjectA
CreateRectRgn
SelectClipRgn
DeleteObject
MoveToEx
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
DeleteDC
DeleteMetaFile
CloseMetaFile
CreateMetaFileA
LPtoDP
GetDeviceCaps
CreateBitmap
GetStockObject
SetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegSetValueA
RegCreateKeyA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteValueA

shell32

ExtractIconA

shlwapi

PathFileExistsA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

ole32

ReadClassStm
CreateStreamOnHGlobal
CoDisconnectObject
CreateDataAdviseHolder
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateOleAdviseHolder
OleDuplicateData
ReleaseStgMedium
ReadFmtUserTypeStg
OleSaveToStream
CoTaskMemAlloc
CreateDataCache
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
OleLoadFromStream
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal

oleaut32

SysAllocStringLen
SysFreeString
SysStringByteLen
SysStringLen
RegisterTypeLi
LoadTypeLi
OleCreatePropertyFrame
VariantClear
VariantChangeType
VariantInit
SysAllocStringByteLen
OleLoadPicture
SysAllocString
VariantCopy
OleCreateFontIndirect
OleCreatePictureIndirect
LoadRegTypeLi

winscard

SCardReleaseContext
SCardListReadersA
SCardFreeMemory
SCardEstablishContext

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 325KB - Virtual size: 324KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
language/Chinese.ini
language/Chinese.ini.$1
language/English.ini
language/English.ini.$1
language/TraditionalChinese.ini
language/TraditionalChinese.ini.$1
uninst.exe.nsis
$PLUGINSDIR/CCB_HDZB_USBKEY_1G_Setup_S64.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:cf:12:3d:6d:bd:40:52:fd:94:d9:5d:3b:8d:32:9f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

05-01-2016 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

db:c0:d4:97:6e:5e:c3:20:34:7e:79:9a:fb:b7:8c:32:fb:4f:c5:75:d1:15:e5:56:c1:a3:ce:47:2d:03:b1:d2
Signer

Actual PE Digest

db:c0:d4:97:6e:5e:c3:20:34:7e:79:9a:fb:b7:8c:32:fb:4f:c5:75:d1:15:e5:56:c1:a3:ce:47:2d:03:b1:d2

Digest Algorithm

sha256

PE Digest Matches

true

ae:9b:f2:6f:fa:a6:f7:4c:89:ce:d3:dd:07:8e:37:9b:b9:6c:78:87
Signer

Actual PE Digest

ae:9b:f2:6f:fa:a6:f7:4c:89:ce:d3:dd:07:8e:37:9b:b9:6c:78:87

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/CCB_HDZB_USBKEY_2G_Setup_S64.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:cf:12:3d:6d:bd:40:52:fd:94:d9:5d:3b:8d:32:9f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

05-01-2016 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:80:6d:c8:79:2f:86:69:53:65:8f:13:fc:a2:f3:78:fd:7c:15:e7:60:c8:29:df:4d:1f:1a:47:f0:9b:a9:21
Signer

Actual PE Digest

71:80:6d:c8:79:2f:86:69:53:65:8f:13:fc:a2:f3:78:fd:7c:15:e7:60:c8:29:df:4d:1f:1a:47:f0:9b:a9:21

Digest Algorithm

sha256

PE Digest Matches

true

c2:74:ed:8e:74:8e:6e:8a:28:73:10:38:06:c7:28:ff:a8:54:24:57
Signer

Actual PE Digest

c2:74:ed:8e:74:8e:6e:8a:28:73:10:38:06:c7:28:ff:a8:54:24:57

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ThreadTimer.dll
.dll windows:5 windows x86 arch:x86

b4e2cb4cd76ace4c830a3e097a0098b6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

67:d8:96:b9:7b:db:9f:c4:d2:50:d8:d9:f8:1e:9a:17
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-03-2012 00:00

Not After

25-05-2015 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24:94:38:1c:79:be:db:da:38:d5:64:b7:d1:54:a9:28:41:2a:24:76
Signer

Actual PE Digest

24:94:38:1c:79:be:db:da:38:d5:64:b7:d1:54:a9:28:41:2a:24:76

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
CloseHandle
CreateThread
GetStdHandle
HeapAlloc
GetProcessHeap
GlobalFree
lstrcpynA
GlobalAlloc

user32

wsprintfA

Exports

Exports

Start
Stop

Sections

.text
Size: 1024B - Virtual size: 1005B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 423B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/hzSrv.dll
.dll windows:5 windows x86 arch:x86

da7e9f1a126d6b30cd63252ac01f4944

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:c8:e8:de:1a:62:d3:44:1a:13:4d:c0:ab:a7:67:d3:e5:a3:fe:4d
Signer

Actual PE Digest

44:c8:e8:de:1a:62:d3:44:1a:13:4d:c0:ab:a7:67:d3:e5:a3:fe:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
GetLastError
MultiByteToWideChar
OpenProcess
GetProcessHeap
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
TerminateProcess
CloseHandle
GetSystemDirectoryA
WinExec
Sleep
lstrcpyA
GlobalAlloc
lstrcpynA
GlobalFree
GetCurrentThreadId
GetCommandLineA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
RtlUnwind
HeapAlloc
RaiseException
ReadFile
SetFilePointer
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
SetStdHandle
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
CreateFileA
HeapSize
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

GetMessageA
TranslateMessage
DispatchMessageA
GetWindowLongA
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoA
GetClientRect
MapWindowPoints
SetWindowPos

crypt32

CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CertEnumCertificatesInStore
CertOpenSystemStoreA
CertOpenStore
CertCreateCertificateContext
CertCloseStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CertGetCertificateContextProperty

Exports

Exports

CenterWindows
DelCert
InstallCert
KillProc
ModulessMsgLoop
ResetIEex
StartHzSrv_NET
StartHzSrv_SC
StopHzSrv_NET
StopHzSrv_SC

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

d83f71e61ee459ee63ca3e829966a9dc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
lstrcpyA
lstrcpynA
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
PeekNamedPipe
GetTickCount
CreateProcessA
GetStartupInfoA
CreatePipe
GetVersionExA
GetModuleHandleA
DeleteFileA
lstrcmpiA
lstrlenA
lstrcatA
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
GetProcAddress
GlobalLock
GetCurrentProcess

user32

SendMessageA
OemToCharBuffA
CharNextA
wsprintfA
CharPrevA
FindWindowExA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 410B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R6/InstallP11_2G.exe
.exe windows:5 windows x86 arch:x86

7d5dd080b6a14668628cba66e6ef8879

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

67:d8:96:b9:7b:db:9f:c4:d2:50:d8:d9:f8:1e:9a:17
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-03-2012 00:00

Not After

25-05-2015 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b1:72:8a:84:16:d9:14:57:4e:78:53:47:6f:93:96:17:f4:d6:7c:ff
Signer

Actual PE Digest

b1:72:8a:84:16:d9:14:57:4e:78:53:47:6f:93:96:17:f4:d6:7c:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

nss3

SECMOD_FindModule
NSS_Shutdown
PR_Cleanup
SECMOD_AddNewModule
SECMOD_DeleteModule
NSS_Initialize
PR_Init

kernel32

GlobalAddAtomA
GlobalFlags
GetVersionExA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GetLocaleInfoA
GetCPInfo
GetOEMCP
RtlUnwind
GetCommandLineA
HeapAlloc
CreateFileA
RaiseException
VirtualAlloc
HeapReAlloc
HeapSize
Sleep
ExitProcess
GetACP
IsValidCodePage
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
GetCurrentProcess
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
LoadLibraryA
DeleteFileA
GetCurrentThreadId
CloseHandle
lstrcmpA
GlobalGetAtomNameA
InterlockedIncrement
GetModuleHandleW
CompareStringA
FreeLibrary
InterlockedDecrement
GetModuleHandleA
GetProcAddress
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
MultiByteToWideChar
lstrlenA
GetLastError
SetLastError
GetTempPathA
GetModuleFileNameA
WaitForSingleObject
GetSystemDirectoryA
GetPrivateProfileStringA
GetPrivateProfileIntA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
HeapFree

shell32

SHGetFolderPathA
ShellExecuteExA

shlwapi

PathFileExistsA

oleacc

LresultFromObject
CreateStdAccessibleObject

user32

DrawTextA
TabbedTextOutA
PostQuitMessage
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SystemParametersInfoA
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
SetWindowPos
SetWindowLongA
IsWindow
GetDlgItem
GetFocus
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
SetWindowTextA
SetWindowsHookExA
CallNextHookEx
DispatchMessageA
GetKeyState
PeekMessageA
ValidateRect
GetWindowTextA
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnhookWindowsHookEx
GetWindowThreadProcessId
SendMessageA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
IsIconic
DestroyMenu
GrayStringA
DrawTextExA

gdi32

ScaleWindowExtEx
SetBkColor
SaveDC
RestoreDC
SetMapMode
DeleteDC
GetStockObject
SetWindowExtEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetTextColor
GetClipBox
CreateBitmap
DeleteObject
GetDeviceCaps
SelectObject

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

oleaut32

VariantChangeType
VariantClear
VariantInit

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$PROGRAMFILES/CCBComponents/Plugins/CARoot/Cert_HDZB_2G_Firefox.exe
.exe windows:5 windows x86 arch:x86

280a496dea18907eb33aa344a16a7380

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:cf:12:3d:6d:bd:40:52:fd:94:d9:5d:3b:8d:32:9f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

05-01-2016 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:59:1f:22:94:7c:3c:b1:47:71:7d:69:11:64:ad:31:cc:f9:ec:3f:1b:9d:6e:c2:16:61:25:08:4a:a3:fd:47
Signer

Actual PE Digest

16:59:1f:22:94:7c:3c:b1:47:71:7d:69:11:64:ad:31:cc:f9:ec:3f:1b:9d:6e:c2:16:61:25:08:4a:a3:fd:47

Digest Algorithm

sha256

PE Digest Matches

true

cb:61:23:20:80:3c:39:a9:f7:c5:7a:d4:b3:9e:48:cd:be:57:57:84
Signer

Actual PE Digest

cb:61:23:20:80:3c:39:a9:f7:c5:7a:d4:b3:9e:48:cd:be:57:57:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFlags
GetVersionExA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GetLocaleInfoA
GetCPInfo
GetOEMCP
RtlUnwind
GetCommandLineA
HeapAlloc
HeapFree
RaiseException
GlobalAddAtomA
VirtualAlloc
HeapReAlloc
HeapSize
ExitProcess
GetACP
IsValidCodePage
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CreateFileA
GetCurrentProcess
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
LoadLibraryA
DeleteFileA
GetCurrentThreadId
CloseHandle
lstrcmpA
GlobalGetAtomNameA
InterlockedIncrement
GetModuleHandleW
CompareStringA
FreeLibrary
InterlockedDecrement
GetModuleHandleA
GetProcAddress
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
MultiByteToWideChar
lstrlenA
GetLastError
SetLastError
Sleep
GetTempPathA
GetModuleFileNameA
WaitForSingleObject
GetSystemDirectoryA
GetPrivateProfileStringA
GetPrivateProfileIntA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource

shell32

ShellExecuteExA
SHGetFolderPathA

shlwapi

PathFileExistsA

nss3

NSS_Initialize
NSS_Shutdown
SECMOD_FindModule
SECMOD_DeleteModule
SECMOD_AddNewModule

oleacc

LresultFromObject
CreateStdAccessibleObject

user32

GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
PostQuitMessage
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
SetWindowPos
SetWindowLongA
IsWindow
GetDlgItem
GetFocus
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
SetWindowTextA
SetWindowsHookExA
CallNextHookEx
DispatchMessageA
GetKeyState
PeekMessageA
ValidateRect
GetWindowTextA
DestroyMenu
AdjustWindowRectEx
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
MessageBoxA
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnhookWindowsHookEx
GetWindowThreadProcessId
SendMessageA
GetParent

gdi32

DeleteObject
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
SaveDC
RestoreDC
SetMapMode
DeleteDC
GetStockObject
ScaleWindowExtEx
SetWindowExtEx
SelectObject
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
GetDeviceCaps
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
SetViewportOrgEx

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

oleaut32

VariantClear
VariantChangeType
VariantInit

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$PROGRAMFILES/CCBComponents/Plugins/npHDZB2gCertCtrl.dll
.dll windows:5 windows x86 arch:x86

0a0f39a722267e04fadfe1815b3588f1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:ff:52:6d:ac:40:66:cf:05:5d:fe:a6:0c:ad:53:14
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13-03-2009 00:00

Not After

11-04-2012 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3b:9c:f8:5d:50:6b:ae:36:61:16:98:2e:a1:7b:2c:4a:3a:c2:4f:88
Signer

Actual PE Digest

3b:9c:f8:5d:50:6b:ae:36:61:16:98:2e:a1:7b:2c:4a:3a:c2:4f:88

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapFree
HeapAlloc
GetCommandLineA
RtlUnwind
RaiseException
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetACP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
DeviceIoControl
ReleaseMutex
CreateMutexA
CreateFileA
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
WritePrivateProfileStringA
GetOEMCP
GetCPInfo
InterlockedIncrement
GetModuleHandleW
GlobalFlags
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
WaitForSingleObject
CloseHandle
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
lstrcmpA
InterlockedDecrement
GetModuleFileNameW
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
LoadLibraryA
lstrcmpW
GetModuleHandleA
GetVersionExA
GetLastError
SetLastError
GlobalAlloc
FormatMessageA
LocalFree
MultiByteToWideChar
MulDiv
lstrlenA
GlobalLock
GlobalUnlock
GlobalFree
FreeResource
GetSystemDefaultLCID
GetSystemDirectoryA
GetProcAddress
FreeLibrary
GetVersion
LoadLibraryExA
GetModuleFileNameA
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
GetTickCount
OutputDebugStringA

user32

EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
SetMenu
SetForegroundWindow
IsWindowVisible
GetClientRect
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
CopyRect
ModifyMenuA
GetMenu
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetFocus
SetWindowPos
ShowWindow
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SendDlgItemMessageA
GetWindowTextLengthA
GetWindowTextA
GetWindow
SetFocus
GetMenuState
GetMenuItemID
EnableWindow
GetMenuItemCount
GetSubMenu
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
PostQuitMessage
ValidateRect
CallWindowProcA
PtInRect
MessageBoxA
SetWindowLongA
UpdateWindow
DefWindowProcA
LoadStringA
EndDialog
SendMessageA
GetNextDlgTabItem
GetParent
DestroyMenu
LoadCursorA
GetSysColorBrush
EndPaint
BeginPaint
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
GetWindowThreadProcessId
SetCursor
GetMessageA
TranslateMessage
SystemParametersInfoA
GetCursorPos
LoadIconA

gdi32

DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
SetMapMode
RestoreDC
SaveDC
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

InitializeSecurityDescriptor
LookupAccountNameA
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
InitializeAcl

shlwapi

PathFindFileNameA
PathFindExtensionA

oleaut32

VariantInit
VariantChangeType
VariantClear

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

winscard

SCardReleaseContext
SCardGetAttrib
g_rgSCardT0Pci
SCardTransmit
SCardListReadersA
SCardDisconnect
SCardConnectA
SCardEstablishContext

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$PROGRAMFILES/CCBComponents/Plugins/npHDZB2gSNCtrl.dll
.dll windows:5 windows x86 arch:x86

467a608ca43111fa40a7151316362008

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:ff:52:6d:ac:40:66:cf:05:5d:fe:a6:0c:ad:53:14
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13-03-2009 00:00

Not After

11-04-2012 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7d:59:4d:53:6a:e4:a0:17:bd:c0:e6:f2:5b:4a:f3:d6:bd:e7:df:d3
Signer

Actual PE Digest

7d:59:4d:53:6a:e4:a0:17:bd:c0:e6:f2:5b:4a:f3:d6:bd:e7:df:d3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Documents and Settings\PengWei\桌面\NPAPI\npwdk\Release\npwdk.pdb

Imports

kernel32

OutputDebugStringA
InterlockedDecrement
GetProcessHeap
lstrlenA
FlushFileBuffers
CloseHandle
CreateFileA
GetLocaleInfoA
RtlUnwind
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
RaiseException
GetLastError
HeapFree
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetModuleHandleA

user32

SetWindowLongA
DefWindowProcA
MessageBoxA

ole32

CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

SysStringLen
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear
GetErrorInfo

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCBHDSNCtrl.dll
.dll regsvr32 windows:5 windows x86 arch:x86

317bfcfd45133d48a98d17258e9e408f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:1a:8c:ce:dc:9a:9d:aa:d6:07:fb:24:ef:10:26:67:72:ee:f6:c2
Signer

Actual PE Digest

52:1a:8c:ce:dc:9a:9d:aa:d6:07:fb:24:ef:10:26:67:72:ee:f6:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
LoadLibraryA
GetSystemDirectoryA
GetStdHandle
WriteFile
FlushFileBuffers
CloseHandle
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetLastError
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GetCurrentProcess
FlushInstructionCache
IsDBCSLeadByte
GetModuleHandleW
MultiByteToWideChar
GetProcAddress
GetModuleFileNameA
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
lstrcmpiA
lstrlenA
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
SetStdHandle
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
ExitProcess
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
Sleep
HeapReAlloc
HeapDestroy
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCommandLineA
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
RtlUnwind
VirtualProtect
GetSystemInfo
VirtualQuery
HeapSize

user32

CallWindowProcA
CharNextW
UnregisterClassA
DestroyWindow
DefWindowProcA
PtInRect
UnionRect
SetWindowLongA
GetWindowLongA
ShowWindow
GetClassInfoExA
LoadCursorA
ReleaseDC
CreateWindowExA
RegisterClassExA
InvalidateRect
IsWindow
GetKeyState
GetParent
GetFocus
IsChild
SetFocus
CharNextA
BeginPaint
GetClientRect
EndPaint
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
GetDC

gdi32

LPtoDP
SetMapMode
SetViewportOrgEx
DeleteDC
CreateDCA
CreateMetaFileA
SetWindowOrgEx
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
GetDeviceCaps
Rectangle
SetTextAlign
SaveDC

advapi32

RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
OleLoadFromStream
OleRegGetUserType
OleRegGetMiscStatus
CreateDataAdviseHolder
CreateOleAdviseHolder
WriteClassStm
OleSaveToStream
OleRegEnumVerbs

oleaut32

OleCreatePropertyFrame
LoadRegTypeLi
VariantChangeType
VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCB_HDZB_2G_P11.dll
.dll windows:5 windows x86 arch:x86

8302d713fd43f5b481b6931184b66aa7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:50:7f:0a:d5:e0:59:e0:99:aa:56:c4:51:08:59:1b:d3:8d:ea:57
Signer

Actual PE Digest

4f:50:7f:0a:d5:e0:59:e0:99:aa:56:c4:51:08:59:1b:d3:8d:ea:57

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\10.1.10.3\建行中间件\开发库\PC\trunk\src\hd_pkcs11\Win32\Release\CCB_HDZB_2G_P11.pdb

Imports

kernel32

GetCurrentProcess
FreeLibrary
SetCurrentDirectoryA
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetCurrentDirectoryA
Sleep
GetLocalTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
GetLastError
HeapFree
HeapAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
CloseHandle
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
CreateFileA
SetStdHandle
FlushFileBuffers
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
GetModuleHandleA

ole32

CoCreateGuid

Exports

Exports

C_CancelFunction
C_CloseAllSessions
C_CloseSession
C_CopyObject
C_CreateObject
C_Decrypt
C_DecryptDigestUpdate
C_DecryptFinal
C_DecryptInit
C_DecryptUpdate
C_DecryptVerifyUpdate
C_DeriveKey
C_DestroyObject
C_Digest
C_DigestEncryptUpdate
C_DigestFinal
C_DigestInit
C_DigestKey
C_DigestUpdate
C_Encrypt
C_EncryptFinal
C_EncryptInit
C_EncryptUpdate
C_Finalize
C_FindObjects
C_FindObjectsFinal
C_FindObjectsInit
C_GenerateKey
C_GenerateKeyPair
C_GenerateRandom
C_GetAttributeValue
C_GetFunctionList
C_GetFunctionStatus
C_GetInfo
C_GetMechanismInfo
C_GetMechanismList
C_GetObjectSize
C_GetOperationState
C_GetSessionInfo
C_GetSlotInfo
C_GetSlotList
C_GetTokenInfo
C_InitPIN
C_InitToken
C_Initialize
C_Login
C_Logout
C_OpenSession
C_SeedRandom
C_SetAttributeValue
C_SetOperationState
C_SetPIN
C_Sign
C_SignEncryptUpdate
C_SignFinal
C_SignInit
C_SignRecover
C_SignRecoverInit
C_SignUpdate
C_UnwrapKey
C_Verify
C_VerifyFinal
C_VerifyInit
C_VerifyRecover
C_VerifyRecoverInit
C_VerifyUpdate
C_WaitForSlotEvent
C_WrapKey

Sections

.text
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCB_HDZB_CCID_USBKey2G/DisplayK33.gif
.gif
$SYSDIR/CCB_HDZB_CCID_USBKey2G/DisplayK43.gif
.gif
$SYSDIR/CCB_HDZB_CCID_USBKey2G/DisplayK54.gif
.gif
$SYSDIR/CCB_HDZB_CCID_USBKey2G/HDZB_CSP.dll
.dll windows:4 windows x86 arch:x86

ee43e2c1dc5cb1ac9418c07b1fc7fa81

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_initterm
malloc
free
fseek
fopen
fread
_adjust_fdiv
fclose

kernel32

GetProcAddress
FreeLibrary
GetModuleFileNameA
LoadLibraryA

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 995B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 418B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCB_HDZB_CCID_USBKey2G/HDZB_CSP_Imp.dll
.dll windows:5 windows x86 arch:x86

1331e16b48f18e599fe1ba0df94d7203

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:12:07:35:da:5b:cc:c5:6c:7c:48:88:21:7f:64:72:fe:52:32:13
Signer

Actual PE Digest

2c:12:07:35:da:5b:cc:c5:6c:7c:48:88:21:7f:64:72:fe:52:32:13

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\10.1.10.3\建行中间件\开发库\PC\trunk\bin\Win32\Release\HDZB_CSP_Imp.pdb

Imports

kernel32

FlushFileBuffers
GetVersionExA
GetVersion
SetLastError
FreeLibrary
GetProcAddress
GetLastError
LoadLibraryExA
CloseHandle
CreateFileA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetPrivateProfileStringA
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
HeapAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

user32

SendMessageA
FindWindowA

advapi32

CryptGetProvParam
CryptEncrypt
CryptGenKey
CryptGetUserKey
CryptDuplicateKey
CryptImportKey
CryptExportKey
CryptGetKeyParam
CryptSetKeyParam
CryptDeriveKey
CryptDestroyKey
CryptDuplicateHash
CryptSetHashParam
CryptHashSessionKey
CryptDestroyHash
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptReleaseContext
CryptSetProvParam
CryptDecrypt

ole32

CoCreateGuid

crypt32

CertGetNameStringA
CertFreeCertificateContext
CertCreateCertificateContext

Exports

Exports

HD_CPAcquireContext
HD_CPCreateHash
HD_CPDecrypt
HD_CPDeriveKey
HD_CPDestroyHash
HD_CPDestroyKey
HD_CPDuplicateHash
HD_CPDuplicateKey
HD_CPEncrypt
HD_CPExportKey
HD_CPGenKey
HD_CPGenRandom
HD_CPGetHashParam
HD_CPGetKeyParam
HD_CPGetProvParam
HD_CPGetUserKey
HD_CPHashData
HD_CPHashSessionKey
HD_CPImportKey
HD_CPReleaseContext
HD_CPSetHashParam
HD_CPSetKeyParam
HD_CPSetProvParam
HD_CPSignHash
HD_CPVerifySignature

Sections

.text
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCB_HDZB_CCID_USBKey2G/HDZB_CSP_Imp.ini
$SYSDIR/CCB_HDZB_CCID_USBKey2G/HDZB_CSP_Imp.mac
$SYSDIR/CCB_HDZB_CCID_USBKey2G/HD_CCB_GM_SSL.dll
.dll windows:5 windows x86 arch:x86

34818d66c8a1043e3c2db6643c3a428b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:32:33:f7:95:8a:03:e4:20:fe:50:c5:63:c5:ef:64:39:14:c2:be
Signer

Actual PE Digest

12:32:33:f7:95:8a:03:e4:20:fe:50:c5:63:c5:ef:64:39:14:c2:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\10.1.10.3\建行中间件\开发库\PC\trunk\src\HD_CCB_GM_SSL\Win32\Release\HD_CCB_GM_SSL.pdb

Imports

kernel32

SetLastError
GetModuleFileNameA
GetCurrentDirectoryA
SetCurrentDirectoryA
LoadLibraryExA
GetLastError
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
DeleteCriticalSection
HeapValidate
IsBadReadPtr
GetModuleFileNameW
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
MultiByteToWideChar
LCMapStringA
LCMapStringW
DebugBreak
LoadLibraryA
InitializeCriticalSectionAndSpinCount
WriteFile
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetModuleHandleA
GetLocaleInfoA
GetProcessHeap
VirtualQuery
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CloseHandle
CreateFileA

Exports

Exports

SKF_CloseApplication
SKF_CloseContainer
SKF_ConnectDev
SKF_DisConnectDev
SKF_ECCSignData
SKF_EnumApplication
SKF_EnumContainer
SKF_EnumDev
SKF_ExportCertificate
SKF_GetDevInfo
SKF_GetUkeyInfo
SKF_OpenApplication
SKF_OpenContainer
SKF_VerifyPIN

Sections

.text
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCB_HDZB_CCID_USBKey2G/HD_DetectCert2G.dll
.dll windows:5 windows x86 arch:x86

468264af30b164f43c3d7f2b1723b14f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:cf:12:3d:6d:bd:40:52:fd:94:d9:5d:3b:8d:32:9f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

05-01-2016 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:0c:5b:0c:79:3f:89:c6:a7:8e:96:ec:13:ea:b7:7d:99:a4:96:63:ae:26:37:93:36:65:4b:0e:d5:37:2f:48
Signer

Actual PE Digest

23:0c:5b:0c:79:3f:89:c6:a7:8e:96:ec:13:ea:b7:7d:99:a4:96:63:ae:26:37:93:36:65:4b:0e:d5:37:2f:48

Digest Algorithm

sha256

PE Digest Matches

true

a6:9c:d6:88:47:f5:05:19:4c:5f:05:94:82:94:4c:2a:fb:21:fd:48
Signer

Actual PE Digest

a6:9c:d6:88:47:f5:05:19:4c:5f:05:94:82:94:4c:2a:fb:21:fd:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetConsoleCP
GetConsoleMode
GetACP
IsValidCodePage
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetDriveTypeA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
VirtualFree
HeapDestroy
HeapCreate
HeapSize
VirtualQuery
InitializeCriticalSection
VirtualAlloc
ExitProcess
GetCommandLineA
HeapReAlloc
GetDateFormatA
GetTimeFormatA
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
HeapAlloc
HeapFree
GetOEMCP
GetCPInfo
GetModuleHandleW
CreateFileA
GetFullPathNameA
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
InterlockedIncrement
GlobalFlags
DebugBreak
GetCurrentDirectoryA
WritePrivateProfileStringA
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GetModuleFileNameW
FindFirstFileA
FindNextFileA
FindClose
GlobalFree
GlobalUnlock
FormatMessageA
LocalFree
lstrlenA
SetLastError
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpA
GlobalAlloc
GetExitCodeThread
GetCurrentProcessId
GetVersionExA
GetModuleHandleA
GetCurrentProcess
ReleaseMutex
OpenMutexA
CreateMutexA
GetSystemDefaultLCID
InterlockedDecrement
CreateProcessA
CreateThread
CloseHandle
ExitThread
EnterCriticalSection
LeaveCriticalSection
GetSystemDirectoryA
Sleep
WaitForSingleObject
GetExitCodeProcess
GetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemTime
CompareFileTime
GetTempPathA
GetModuleFileNameA
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
WideCharToMultiByte
SystemTimeToFileTime
FindResourceA
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
DeleteCriticalSection

user32

DestroyMenu
LoadCursorA
GetSysColorBrush
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
SetWindowTextA
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
PostMessageA
PostQuitMessage
GetWindowThreadProcessId
ShowWindow
SetForegroundWindow
EnumWindows
GetWindowTextA
SendMessageA
GetForegroundWindow

gdi32

ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
TextOutA
RectVisible
PtVisible
DeleteObject
CreateBitmap
GetDeviceCaps
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox
OffsetViewportOrgEx

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptSignHashA
CryptHashData
CryptCreateHash
CryptGetUserKey
CryptAcquireContextA
CryptGetHashParam
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
InitializeSecurityDescriptor
InitializeAcl
LookupAccountNameA
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueA
RegOpenKeyExA

shell32

ShellExecuteExA
SHGetSpecialFolderPathA
ShellExecuteA

shlwapi

PathFindFileNameA
PathFindExtensionA

ole32

OleRun
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

GetErrorInfo
VariantTimeToSystemTime
SystemTimeToVariantTime
VarUdateFromDate
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VariantCopy
VariantInit
VariantClear
VariantChangeType

ws2_32

htonl

crypt32

CertGetNameStringA
CertFindCertificateInStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CertVerifySubjectCertificateContext
CertNameToStrA
CertOpenSystemStoreA
CertSetCertificateContextProperty
CertCloseStore
CertAddCertificateContextToStore
CertCreateCertificateContext
CryptEncodeObjectEx
CertFreeCertificateContext

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam
getInfo

Sections

.text
Size: 250KB - Virtual size: 250KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCB_HDZB_CCID_USBKey2G/HD_DetectCertGM.dll
.dll windows:5 windows x86 arch:x86

ac0046244c466482df65f8e973142965

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:cf:12:3d:6d:bd:40:52:fd:94:d9:5d:3b:8d:32:9f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

05-01-2016 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

26:3f:48:f0:ee:ef:3c:5e:ec:0c:78:4e:d0:76:8b:3c:1e:7c:56:3f:78:7a:7b:3d:03:03:65:de:39:e8:76:fd
Signer

Actual PE Digest

26:3f:48:f0:ee:ef:3c:5e:ec:0c:78:4e:d0:76:8b:3c:1e:7c:56:3f:78:7a:7b:3d:03:03:65:de:39:e8:76:fd

Digest Algorithm

sha256

PE Digest Matches

true

28:c8:93:5f:20:00:16:9d:5e:bd:ac:46:00:fc:5e:6f:a0:02:7c:e0
Signer

Actual PE Digest

28:c8:93:5f:20:00:16:9d:5e:bd:ac:46:00:fc:5e:6f:a0:02:7c:e0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetConsoleCP
GetConsoleMode
GetACP
IsValidCodePage
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoA
SetStdHandle
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetDriveTypeA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
VirtualFree
HeapDestroy
HeapCreate
HeapSize
VirtualQuery
InitializeCriticalSection
VirtualAlloc
ExitProcess
GetCommandLineA
HeapReAlloc
GetDateFormatA
GetTimeFormatA
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
HeapAlloc
HeapFree
GetOEMCP
GetCPInfo
GetModuleHandleW
CreateFileA
GetFullPathNameA
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
InterlockedIncrement
GlobalFlags
DebugBreak
GetCurrentDirectoryA
WritePrivateProfileStringA
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GetModuleFileNameW
FindFirstFileA
FindNextFileA
FindClose
GlobalFree
GlobalUnlock
FormatMessageA
LocalFree
lstrlenA
SetLastError
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpA
GlobalAlloc
GetExitCodeThread
GetCurrentProcessId
GetVersionExA
GetModuleHandleA
GetCurrentProcess
ReleaseMutex
OpenMutexA
CreateMutexA
GetSystemDefaultLCID
InterlockedDecrement
CreateProcessA
CreateThread
CloseHandle
ExitThread
EnterCriticalSection
LeaveCriticalSection
GetSystemDirectoryA
WaitForSingleObject
GetExitCodeProcess
Sleep
GetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemTime
CompareFileTime
GetTempPathA
GetModuleFileNameA
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
WideCharToMultiByte
SystemTimeToFileTime
FindResourceA
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
DeleteCriticalSection

user32

DestroyMenu
LoadCursorA
GetSysColorBrush
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
SetWindowTextA
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
PostMessageA
PostQuitMessage
GetWindowThreadProcessId
ShowWindow
SetForegroundWindow
EnumWindows
GetWindowTextA
SendMessageA
GetForegroundWindow

gdi32

ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
TextOutA
RectVisible
PtVisible
DeleteObject
CreateBitmap
GetDeviceCaps
SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox
OffsetViewportOrgEx

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
InitializeSecurityDescriptor
InitializeAcl
LookupAccountNameA
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueA
RegOpenKeyExA

shell32

ShellExecuteExA
SHGetSpecialFolderPathA
ShellExecuteA

shlwapi

PathFindFileNameA
PathFindExtensionA

ole32

OleRun
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

GetErrorInfo
VariantTimeToSystemTime
SystemTimeToVariantTime
VarUdateFromDate
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VariantCopy
VariantInit
VariantClear
VariantChangeType

ws2_32

htonl
htons

crypt32

CertGetNameStringA
CertFindCertificateInStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CertVerifySubjectCertificateContext
CertNameToStrA
CertOpenSystemStoreA
CertSetCertificateContextProperty
CertCloseStore
CertAddCertificateContextToStore
CertCreateCertificateContext
CryptEncodeObjectEx
CertFreeCertificateContext

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam
getInfo

Sections

.text
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCB_HDZB_CCID_USBKey2G/HD_LibUI.dll
.dll windows:5 windows x86 arch:x86

e95b897f3ae658fe30cd1c966229ce1d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e1:40:b9:e0:2e:ff:9e:2c:c5:87:e3:9e:7b:ab:29:e6:62:c2:da:56
Signer

Actual PE Digest

e1:40:b9:e0:2e:ff:9e:2c:c5:87:e3:9e:7b:ab:29:e6:62:c2:da:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\10.1.10.3\建行中间件\开发库\PC\trunk\srcNewUI\HD_LibUI\Win32\Release\HD_LibUI.pdb

Imports

kernel32

SetEvent
ResetEvent
WaitForSingleObject
CreateFileA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
CreateFileW
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GlobalAlloc
ReadFile
GetStartupInfoA
GetFileType
SetHandleCount
SetFilePointer
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
GetStdHandle
WriteFile
ExitProcess
HeapReAlloc
HeapDestroy
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
GetCommandLineA
VirtualQuery
GetSystemInfo
VirtualProtect
GetSystemTimeAsFileTime
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
ResumeThread
GlobalFree
GlobalUnlock
GlobalLock
CreateEventW
InterlockedDecrement
WideCharToMultiByte
lstrcmpW
LoadLibraryW
Sleep
CreateProcessW
GetVersionExW
lstrlenA
OutputDebugStringW
DebugBreak
GetModuleFileNameA
SetLastError
CloseHandle
GetTickCount
GetCurrentThreadId
DeleteCriticalSection
lstrcmpiW
EnterCriticalSection
GetProcAddress
GetLastError
RaiseException
MultiByteToWideChar
GetModuleFileNameW
LeaveCriticalSection
SizeofResource
InitializeCriticalSection
GetModuleHandleW
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
FlushInstructionCache
GetCurrentProcess
MulDiv
InterlockedIncrement
lstrlenW
FreeEnvironmentStringsA
GetModuleHandleA

user32

GetWindowLongW
LoadBitmapW
GetDlgItem
GetDC
ReleaseDC
UnregisterClassA
SetWindowPos
SetWindowLongW
GetDlgCtrlID
GetWindowTextW
CopyRect
GetUpdateRect
FillRect
SetDlgItemTextA
ToAscii
GetKeyboardState
CallNextHookEx
GetDlgItemTextA
GetClassNameW
UnhookWindowsHookEx
SetWindowsHookExW
IsRectEmpty
SetRectEmpty
GetSysColor
LoadIconW
SetWindowTextW
CallWindowProcW
GetSystemMetrics
DefWindowProcW
keybd_event
VkKeyScanW
ScreenToClient
PtInRect
InflateRect
GetKeyState
UpdateWindow
SystemParametersInfoW
KillTimer
LoadStringW
wvsprintfW
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
FrameRect
GetWindowTextLengthW
InvalidateRect
SetFocus
CreateDialogParamW
DialogBoxParamW
RedrawWindow
GetActiveWindow
UnregisterHotKey
RegisterHotKey
IsWindow
DestroyWindow
CharNextW
EndDialog
SetTimer
SetForegroundWindow
SendMessageW
DrawTextW
SetWindowRgn
OffsetRect
SetRect
EndPaint
BeginPaint
ShowWindow
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
SetDlgItemTextW
MoveWindow

gdi32

CreateRoundRectRgn
CreateRectRgnIndirect
GetTextExtentPoint32W
TextOutW
SelectClipRgn
FillRgn
BitBlt
CreateCompatibleBitmap
GetTextMetricsW
GetObjectW
Ellipse
CreatePen
CreateRectRgn
CreateSolidBrush
ExtTextOutW
SetBkColor
LineTo
MoveToEx
FrameRgn
SetTextColor
SetBkMode
GetStockObject
StretchBlt
CreateCompatibleDC
DeleteObject
GetDeviceCaps
DeleteDC
CombineRgn
SelectObject
CreatePolygonRgn
CreateFontIndirectW

advapi32

GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom

shell32

ShellExecuteExW

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoTaskMemRealloc
CoUninitialize
CoCreateInstance

oleaut32

OleLoadPicture
VarUI4FromStr

Exports

Exports

LibUI_CloseFirstPrompt
LibUI_CloseGenKeyPairDlg
LibUI_CloseRemoveKeyDlg
LibUI_CloseStateDlg
LibUI_InputPIN
LibUI_InputPIN_1G
LibUI_MessageBox
LibUI_ModifyPIN
LibUI_ModifyPIN_1G
LibUI_OldPinError
LibUI_PinError
LibUI_RemoveKeyDlg
LibUI_SetShortcutLogin
LibUI_ShowFirstPrompt
LibUI_ShowGenKeyPair
LibUI_ShowStateDlg
LibUI_ShowTipsForLastTwoRetryTimesModal
LibUI_ShowTipsForLcdKeyModal
LibUI_ShowTipsForModifyPinModal
LibUI_ShowTipsForSignModal
LibUI_ShowTipsForUpdateCertModal

Sections

.text
Size: 253KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCB_HDZB_CCID_USBKey2G/HD_TokenV2.dll
.dll windows:5 windows x86 arch:x86

65b30284150336569e53c75cf804bb95

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:78:17:cd:64:49:8e:92:5f:eb:87:fe:d8:2b:4c:6d:66:0b:6a:60
Signer

Actual PE Digest

4f:78:17:cd:64:49:8e:92:5f:eb:87:fe:d8:2b:4c:6d:66:0b:6a:60

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetLastError
HeapFree
HeapAlloc
RtlUnwind
RaiseException
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetModuleHandleA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
GetTickCount
GetCurrentDirectoryA
GetModuleFileNameW
GetProcessHeap
DebugBreak
GetModuleFileNameA
LoadLibraryA
GetProcAddress
SetCurrentDirectoryA
FreeLibrary
CloseHandle
ReleaseMutex
DeleteCriticalSection
CreateMutexA
OpenMutexA
EnterCriticalSection
ConnectNamedPipe
ReadFile
DisconnectNamedPipe
CreateNamedPipeA
GetVersion
DeviceIoControl
GetVersionExA
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
VirtualFree
InterlockedIncrement
VirtualQuery

advapi32

OpenSCManagerA
StartServiceA
CloseServiceHandle
OpenServiceA
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorSacl
CryptSetKeyParam
CryptImportKey
CryptEncrypt
CryptCreateHash
CryptDestroyKey
CryptVerifySignatureA
CryptDestroyHash
CryptHashData
CryptGenRandom
CryptAcquireContextA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
LookupAccountNameA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AddAccessAllowedAce
CryptReleaseContext
QueryServiceStatus

winscard

SCardReleaseContext
SCardListReadersA
SCardTransmit
g_rgSCardT0Pci
SCardEstablishContext
g_rgSCardT1Pci
SCardGetAttrib
SCardConnectA
SCardDisconnect

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA

Exports

Exports

T_ChangePin
T_CloseDevice
T_ConnectContainer
T_ControlDev
T_DeleteContainer
T_ECCGetZ
T_EnumContainer
T_EnumDevice
T_EnumObject
T_GenKeyPair
T_GenPKCS10
T_GetIdleObject
T_GetInfo
T_GetPinRetryTimes
T_GetRandom
T_HashFinal
T_HashInit
T_HashUpdate
T_IsDefaultPin
T_LcdSignature
T_OpenDevice
T_PrivateKeyDecrypt
T_PublicKeyEncrypt
T_ReadObjAttribute
T_RealCloseDevice
T_ReloadPin
T_ResetObject
T_SetLanguageAndCharset
T_Signature
T_SymmCalcFinal
T_SymmCalcInit
T_SymmCalcUpdate
T_UpdateContainerInfo
T_UpdateObjAttribute
T_VerifyPin
T_VerifySignature
T_WriteCert

Sections

.text
Size: 455KB - Virtual size: 455KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCB_HD_TokenV2.dll
.dll windows:5 windows x86 arch:x86

65b30284150336569e53c75cf804bb95

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:78:17:cd:64:49:8e:92:5f:eb:87:fe:d8:2b:4c:6d:66:0b:6a:60
Signer

Actual PE Digest

4f:78:17:cd:64:49:8e:92:5f:eb:87:fe:d8:2b:4c:6d:66:0b:6a:60

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetLastError
HeapFree
HeapAlloc
RtlUnwind
RaiseException
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetModuleHandleA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
GetTickCount
GetCurrentDirectoryA
GetModuleFileNameW
GetProcessHeap
DebugBreak
GetModuleFileNameA
LoadLibraryA
GetProcAddress
SetCurrentDirectoryA
FreeLibrary
CloseHandle
ReleaseMutex
DeleteCriticalSection
CreateMutexA
OpenMutexA
EnterCriticalSection
ConnectNamedPipe
ReadFile
DisconnectNamedPipe
CreateNamedPipeA
GetVersion
DeviceIoControl
GetVersionExA
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
VirtualFree
InterlockedIncrement
VirtualQuery

advapi32

OpenSCManagerA
StartServiceA
CloseServiceHandle
OpenServiceA
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorSacl
CryptSetKeyParam
CryptImportKey
CryptEncrypt
CryptCreateHash
CryptDestroyKey
CryptVerifySignatureA
CryptDestroyHash
CryptHashData
CryptGenRandom
CryptAcquireContextA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
LookupAccountNameA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AddAccessAllowedAce
CryptReleaseContext
QueryServiceStatus

winscard

SCardReleaseContext
SCardListReadersA
SCardTransmit
g_rgSCardT0Pci
SCardEstablishContext
g_rgSCardT1Pci
SCardGetAttrib
SCardConnectA
SCardDisconnect

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA

Exports

Exports

T_ChangePin
T_CloseDevice
T_ConnectContainer
T_ControlDev
T_DeleteContainer
T_ECCGetZ
T_EnumContainer
T_EnumDevice
T_EnumObject
T_GenKeyPair
T_GenPKCS10
T_GetIdleObject
T_GetInfo
T_GetPinRetryTimes
T_GetRandom
T_HashFinal
T_HashInit
T_HashUpdate
T_IsDefaultPin
T_LcdSignature
T_OpenDevice
T_PrivateKeyDecrypt
T_PublicKeyEncrypt
T_ReadObjAttribute
T_RealCloseDevice
T_ReloadPin
T_ResetObject
T_SetLanguageAndCharset
T_Signature
T_SymmCalcFinal
T_SymmCalcInit
T_SymmCalcUpdate
T_UpdateContainerInfo
T_UpdateObjAttribute
T_VerifyPin
T_VerifySignature
T_WriteCert

Sections

.text
Size: 455KB - Virtual size: 455KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CCB_HDZB_2G_DeviceService.exe
.exe windows:5 windows x86 arch:x86

9fdd6c2dd1e37475b79e0b422ba6761f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

57:47:62:64:05:b4:89:f3:a5:55:25:af:83:40:b8:af:d9:64:15:2b
Signer

Actual PE Digest

57:47:62:64:05:b4:89:f3:a5:55:25:af:83:40:b8:af:d9:64:15:2b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
DeleteCriticalSection
GetModuleFileNameW
GetProcessHeap
DebugBreak
GetModuleHandleA
GetModuleFileNameA
EnterCriticalSection
GetLastError
FlushFileBuffers
ReadFile
LeaveCriticalSection
Sleep
InitializeCriticalSection
WriteFile
WaitNamedPipeA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
CreateFileA
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapAlloc
HeapFree
RaiseException
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
RtlUnwind
HeapSize
FreeLibrary
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateNamedPipeA
DeviceIoControl
GetVersionExA
GetVersion
CloseHandle
TlsGetValue
DisconnectNamedPipe
VirtualQuery

advapi32

CryptImportKey
CryptReleaseContext
CryptSetKeyParam
SetSecurityDescriptorSacl
CryptAcquireContextA
CryptEncrypt
CryptCreateHash
CryptDestroyKey
CryptVerifySignatureA
CryptDestroyHash
CryptHashData
CryptGenRandom
ControlService
OpenSCManagerA
LookupAccountNameA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AddAccessAllowedAce
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
OpenServiceA
CloseServiceHandle
StartServiceCtrlDispatcherA
DeleteService
CreateServiceA
RegisterServiceCtrlHandlerExA
QueryServiceStatus
SetServiceStatus

winscard

SCardReleaseContext
SCardTransmit
g_rgSCardT0Pci
SCardEstablishContext
g_rgSCardT1Pci
SCardGetAttrib
SCardConnectA
SCardDisconnect

Sections

.text
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CCIDDriverInstall.exe
.exe windows:5 windows x86 arch:x86

84c6f6265cf317234226d0cd82e7bb1f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

67:d8:96:b9:7b:db:9f:c4:d2:50:d8:d9:f8:1e:9a:17
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-03-2012 00:00

Not After

25-05-2015 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

95:5b:6f:82:74:74:1b:1c:93:9e:d0:5d:84:40:7f:f6:fc:f4:b7:2e
Signer

Actual PE Digest

95:5b:6f:82:74:74:1b:1c:93:9e:d0:5d:84:40:7f:f6:fc:f4:b7:2e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExW
HeapSize
GetLocaleInfoA
GetCommandLineA
GetLastError
HeapFree
CloseHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CreateFileA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetFilePointer
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

shell32

SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

setupapi

SetupCopyOEMInfW

newdev

UpdateDriverForPlugAndPlayDevicesW

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CCIDDriverInstall64.exe
.exe windows:5 windows x64 arch:x64

fd468c2f3c2b6355558982356db790f9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

67:d8:96:b9:7b:db:9f:c4:d2:50:d8:d9:f8:1e:9a:17
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-03-2012 00:00

Not After

25-05-2015 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8f:d5:24:8d:ab:63:2b:0a:37:ef:e6:1f:bb:0b:fe:ed:57:95:56:db
Signer

Actual PE Digest

8f:d5:24:8d:ab:63:2b:0a:37:ef:e6:1f:bb:0b:fe:ed:57:95:56:db

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetVersionExA
HeapSize
GetLocaleInfoA
GetCommandLineA
GetLastError
HeapFree
CloseHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CreateFileA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetFilePointer
HeapAlloc
HeapReAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

shell32

SHGetSpecialFolderPathA

shlwapi

PathFileExistsA

setupapi

SetupCopyOEMInfA

newdev

UpdateDriverForPlugAndPlayDevicesA

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DisplayK33.gif
.gif
DisplayK43.gif
.gif
DisplayK54.gif
.gif
FileOccupiedProcess.exe
.exe windows:4 windows x86 arch:x86

f36aecc852e7c9f32939fa1ba3b00beb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

67:d8:96:b9:7b:db:9f:c4:d2:50:d8:d9:f8:1e:9a:17
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-03-2012 00:00

Not After

25-05-2015 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a8:80:f7:c0:cf:64:09:62:e9:26:19:6a:61:5a:dd:0e:00:d2:de:11
Signer

Actual PE Digest

a8:80:f7:c0:cf:64:09:62:e9:26:19:6a:61:5a:dd:0e:00:d2:de:11

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32First
CreateToolhelp32Snapshot
FreeLibrary
GetVersion
GetProcAddress
LoadLibraryA
CreateEventA
OpenProcess
WaitForSingleObject
lstrcpyA
lstrcmpiA
GlobalFree
GlobalAlloc
lstrcatA
QueryDosDeviceA
GetStringTypeA
LCMapStringW
TerminateProcess
CloseHandle
lstrlenA
Process32Next
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
ExitProcess
HeapReAlloc
HeapAlloc
GetCurrentProcess
HeapSize
HeapFree
GetLastError
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
VirtualAlloc
SetFilePointer
SetStdHandle
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
GetStringTypeW

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
lang/ChineseSimple.dll
.dll windows:5 windows x86 arch:x86

b1ef5315be487f2c21eade374734763b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b4:af:8c:68:34:d1:c9:03:7b:c2:28:1a:16:b7:4e:e8:ed:b4:3f:89
Signer

Actual PE Digest

b4:af:8c:68:34:d1:c9:03:7b:c2:28:1a:16:b7:4e:e8:ed:b4:3f:89

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\10.1.10.3\建行中间件\开发库\PC\trunk\srcNewUI\LanguageResource\ChineseSimple\Win32\Release\ChineseSimple.pdb

Imports

kernel32

GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/ChineseTraditional.dll
.dll windows:5 windows x86 arch:x86

b1ef5315be487f2c21eade374734763b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ed:26:a9:da:fa:fd:a0:45:66:85:63:63:7c:78:dc:52:50:fc:5d:cd
Signer

Actual PE Digest

ed:26:a9:da:fa:fd:a0:45:66:85:63:63:7c:78:dc:52:50:fc:5d:cd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\10.1.10.3\建行中间件\开发库\PC\trunk\srcNewUI\LanguageResource\ChineseTraditional\Win32\Release\ChineseTraditional.pdb

Imports

kernel32

GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/English.dll
.dll windows:5 windows x86 arch:x86

b1ef5315be487f2c21eade374734763b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3f:e2:e6:ce:5d:3e:c1:08:2a:35:4b:40:2f:97:65:6b:e2:e7:28:3c
Signer

Actual PE Digest

3f:e2:e6:ce:5d:3e:c1:08:2a:35:4b:40:2f:97:65:6b:e2:e7:28:3c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\10.1.10.3\建行中间件\开发库\PC\trunk\srcNewUI\LanguageResource\English\Win32\Release\English.pdb

Imports

kernel32

GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
usbccid.cat
usbccid.inf
usbccid.sys
.sys windows:5 windows x86 arch:x86

f39b03ee1f9cd5628c4512b5c20bceb3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

usbccid.pdb

Imports

ntoskrnl.exe

KeTickCount
KeBugCheckEx
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
IoCreateDevice
IoOpenDeviceRegistryKey
IoAttachDeviceToDeviceStack
KeDelayExecutionThread
ExAllocatePoolWithTag
ExFreePoolWithTag
IofCompleteRequest
_except_handler3
RtlInitUnicodeString
ZwQueryValueKey
IoInitializeRemoveLockEx
ZwClose
KeSetEvent
ExFreePool
IoAcquireCancelSpinLock
IoFreeIrp
IoReleaseRemoveLockEx
IoCancelIrp
KeWaitForSingleObject
IofCallDriver
IoAllocateIrp
KeInitializeEvent
IoAcquireRemoveLockEx
_allmul
IoBuildDeviceIoControlRequest
InterlockedDecrement
InterlockedIncrement
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
KeInitializeSpinLock
IoFreeWorkItem
IoQueueWorkItem
InterlockedCompareExchange
IoAllocateWorkItem
KeResetEvent
KeClearEvent
IoRegisterDeviceInterface
PoStartNextPowerIrp
PoSetPowerState
PoCallDriver
PoRequestPowerIrp
IoSetDeviceInterfaceState
IoDeleteDevice
IoDetachDevice
RtlFreeUnicodeString
IoReleaseRemoveLockAndWaitEx
InterlockedExchange
IoReleaseCancelSpinLock

hal

KfReleaseSpinLock
KfAcquireSpinLock

smclib.sys

SmartcardT1Request
SmartcardT0Request
SmartcardT0Reply
SmartcardUpdateCardCapabilities
SmartcardDeviceControl
SmartcardT1Reply
SmartcardInitialize
SmartcardExit

usbd.sys

USBD_ParseConfigurationDescriptorEx
USBD_CreateConfigurationRequestEx
USBD_ParseDescriptors

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEABLE
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

153027ec3b10bcea606b777657dd3402

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
TerminateProcess
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
FreeLibrary
GlobalFree
lstrcpyA
DisableThreadLibraryCalls

msvcrt

strcmp
_strupr
toupper
strlen
free
_initterm
malloc
_adjust_fdiv
strcpy
_itoa

Exports

Exports

KillProc

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SkinBtn.dll
.dll windows:4 windows x86 arch:x86

baf2d405231cd43dae48df474a521d01

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GlobalAlloc
lstrcpynA
GetModuleHandleA
GlobalFree

user32

InvalidateRect
GetParent
SetWindowLongA
CallWindowProcA
GetPropA
SendMessageA
DrawTextA
DrawStateA
LoadImageA
RemovePropA
GetWindowLongA
SetPropA

gdi32

GetObjectA
CreateCompatibleDC
DeleteObject
SelectObject
DeleteDC
SetBkMode

msimg32

TransparentBlt

comctl32

_TrackMouseEvent

Exports

Exports

Init
Set
onClick

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 947B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SkinProgress.dll
.dll windows:4 windows x86 arch:x86

df38729be926f91d3390389029adf53b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GlobalAlloc
GlobalFree
GetModuleHandleA

user32

GetWindowRect
BeginPaint
GetWindowDC
CallWindowProcA
ReleaseDC
EndPaint
GetWindowLongA
GetPropA
SetPropA
SetWindowLongA
RemovePropA
LoadImageA
SendMessageA

gdi32

DeleteDC
BitBlt
CreateCompatibleBitmap
StretchBlt
SelectObject
CreateCompatibleDC
GetObjectA
DeleteObject

Exports

Exports

Set

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 797B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Tendyron_Install_Silent.exe
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:9f:96:ed:63:36:36:32:3e:aa:d7:01:4c:82:72:e3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

31-03-2015 00:00

Not After

29-05-2016 23:59

Subject

CN=Tendyron Corporation,OU=Application & Support Department No.2,O=Tendyron Corporation,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:64:b8:be:80:4a:2e:92:7c:48:d2:f3:11:e0:c3:0a:4d:6d:4b:00
Signer

Actual PE Digest

44:64:b8:be:80:4a:2e:92:7c:48:d2:f3:11:e0:c3:0a:4d:6d:4b:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 676KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
RtlUnwind
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP

Exports

Exports

KillProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Plugin_CCB.dll
.dll windows:4 windows x86 arch:x86

16910738fe4da941cea59ec4cc359e74

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\svn\software\src\Project\建行二代\建行国密新ui\NsisPlugin\Release\NsisPlugin.pdb

Imports

kernel32

CreateFileW
SetLastError
GetSystemDirectoryW
lstrcatW
CreateDirectoryW
Sleep
MultiByteToWideChar
LoadLibraryA
LoadLibraryW
LocalAlloc
FreeLibrary
OpenProcess
lstrcmpW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
GetProcessHeap
lstrcpyW
OutputDebugStringW
GetVersionExW
GlobalFree
InterlockedDecrement
InterlockedIncrement
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
RaiseException
lstrlenW
CloseHandle
GetLastError
LocalFree
GetModuleHandleW
GetProcAddress
GetCurrentProcess
lstrcpynW

user32

MessageBoxW
wsprintfW
CharUpperW

shlwapi

PathFileExistsW

advapi32

OpenProcessToken
GetSecurityDescriptorSacl
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupPrivilegeValueW
AdjustTokenPrivileges
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl

psapi

EnumProcesses
GetModuleFileNameExW
EnumProcessModules
GetModuleBaseNameW

ole32

CoCreateInstance
CoUninitialize
CoInitialize

crypt32

CertFreeCertificateContext
CertAddCertificateContextToStore
CertCreateCertificateContext
CertOpenStore
CertSetCertificateContextProperty
CertCompareCertificateName
CertCloseStore

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

newdev

UpdateDriverForPlugAndPlayDevicesW

setupapi

SetupCopyOEMInfW
SetupDiGetINFClassW
SetupDiCreateDeviceInfoList
SetupDiCreateDeviceInfoW
SetupDiSetDeviceRegistryPropertyW
SetupDiCallClassInstaller
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

Exports

Exports

CreateLogDirectory
DeleteRegKey
DeleteRegValue
FindProc
GetDllOwnerProcName
GetSysVersion
InstallCCIDDriver
IsSupport64
MicroAddRootCert
MicroAddTrustSite
RWCreate
RestIEToDefaults
UnInstallMiniDriver
WriteRegBin
WriteRegDWORD
WriteRegStr
XStartSmartService

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:5 windows x86 arch:x86

45d25ca52c312b2254c60dbcb30342d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynW
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 753B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$SYSDIR/$PROGRAMFILES64/CCBComponents/Detector/Ccb_Cert_TDR2G.dll
.dll windows:5 windows x64 arch:x64

ac0b1bc8ad69fa956a113c08df7e1b67

Code Sign

de:4e:43:0f:70:6b:4c:b5:3b:2d:1c:8c:ee:74:76:d8:a6:f1:15:4a
Signer

Actual PE Digest

de:4e:43:0f:70:6b:4c:b5:3b:2d:1c:8c:ee:74:76:d8:a6:f1:15:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\svn\software\src\Project\建行二代\EventCCBCode\install\193I3\bin64\Release\Ccb_Cert_TDR2G.pdb

Imports

kernel32

FreeLibrary
lstrcatA
SetCurrentDirectoryA
LoadLibraryA
GetPrivateProfileStringA
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcmpA
GetLocalTime
SystemTimeToFileTime
CompareFileTime
ReadFile
MultiByteToWideChar
SetLastError
GetModuleFileNameW
GetSystemDirectoryA
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetPrivateProfileStringW
GetSystemDefaultLangID
SetConsoleMode
ReadConsoleInputA
FlushConsoleInputBuffer
GlobalMemoryStatus
GetVersion
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
lstrlenA
LoadLibraryW
GetVersionExW
CreateToolhelp32Snapshot
Process32FirstW
WideCharToMultiByte
Process32NextW
GetModuleHandleW
GetProcAddress
FindFirstFileW
FindNextFileW
FindClose
GetSystemDirectoryW
lstrcatW
lstrcmpW
lstrlenW
lstrcpyW
lstrcpyA
lstrcmpiW
GetLastError
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
RtlUnwindEx
RtlPcToFileHeader
RtlLookupFunctionEntry
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapSetInformation
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoA

user32

GetProcessWindowStation
GetDesktopWindow
MessageBoxW
GetActiveWindow
wsprintfA
wsprintfW
GetUserObjectInformationW

advapi32

RegQueryValueExW
CryptDestroyKey
CryptSignHashW
CryptHashData
CryptSetHashParam
CryptCreateHash
CryptAcquireContextA
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
CryptGetProvParam
CryptAcquireContextW
CryptSetKeyParam
CryptExportKey
CryptGetUserKey
CryptGenKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptReleaseContext

shell32

SHGetSpecialFolderPathA
ShellExecuteExW
ord680
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize

shlwapi

PathFileExistsW
StrStrA

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

winscard

SCardEstablishContext
SCardReleaseContext

crypt32

CertFreeCertificateContext
CertCloseStore
CertOpenStore
CertCompareCertificateName
CertFindCertificateInStore
CryptMsgClose
CryptMsgGetParam
CryptMsgUpdate
CryptMsgOpenToDecode
CertCreateCertificateContext
CryptSignAndEncodeCertificate
CryptExportPublicKeyInfo
CertDuplicateCertificateContext
CertGetNameStringW
CertAddCertificateContextToStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertFreeCertificateChain
CertGetCertificateChain
CertNameToStrA
CertGetNameStringA
CertSetCertificateContextProperty
CertDeleteCertificateFromStore
CryptEncodeObjectEx

ws2_32

ntohl
htonl

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 526KB - Virtual size: 526KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$PROGRAMFILES64/CCBComponents/Detector/Ccb_Cert_TDR_GM.dll
.dll windows:5 windows x64 arch:x64

060250c9a80a192be819a9e94b2b28cc

Code Sign

26:ba:bf:54:d0:ad:14:08:33:7b:dc:d4:46:71:66:41:be:f4:e7:75
Signer

Actual PE Digest

26:ba:bf:54:d0:ad:14:08:33:7b:dc:d4:46:71:66:41:be:f4:e7:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\svn\software\src\Project\建行二代\建行国密新UI\install\193I3\bin64\Release\Ccb_Cert_TDR_GM.pdb

Imports

kernel32

GetSystemDirectoryA
SetCurrentDirectoryA
LoadLibraryA
GetPrivateProfileStringA
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcmpA
GetLocalTime
SystemTimeToFileTime
CompareFileTime
SetLastError
GetModuleFileNameW
MultiByteToWideChar
GetModuleFileNameA
lstrcatA
WinExec
FreeLibrary
GetWindowsDirectoryW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetPrivateProfileStringW
GetSystemDefaultLangID
ReadFile
SetEndOfFile
ReadConsoleInputA
FlushConsoleInputBuffer
GlobalMemoryStatus
GetVersion
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
lstrlenA
LoadLibraryW
GetVersionExW
CreateToolhelp32Snapshot
Process32FirstW
WideCharToMultiByte
Process32NextW
GetModuleHandleW
GetProcAddress
FindFirstFileW
FindNextFileW
FindClose
GetSystemDirectoryW
lstrcpyA
lstrcatW
lstrcmpW
lstrlenW
lstrcpyW
lstrcmpiW
GetLastError
SetConsoleMode
FlushFileBuffers
GetLocaleInfoA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
RtlUnwindEx
RtlPcToFileHeader
RtlLookupFunctionEntry
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapSetInformation
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode

user32

GetUserObjectInformationW
GetProcessWindowStation
GetActiveWindow
MessageBoxW
wsprintfA
FindWindowW
wsprintfW
GetDesktopWindow

advapi32

RegQueryValueExW
CryptDestroyKey
CryptSignHashW
CryptHashData
CryptSetHashParam
CryptCreateHash
CryptAcquireContextA
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
CryptGetProvParam
CryptAcquireContextW
CryptSetKeyParam
CryptExportKey
CryptGetUserKey
CryptGenKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptReleaseContext

shell32

SHGetSpecialFolderPathA
ShellExecuteExW
ord680
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoCreateInstance
CLSIDFromString
CoInitialize
CoCreateGuid
CoUninitialize

shlwapi

PathFileExistsW
wvnsprintfW
PathFindFileNameA
StrStrA

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winscard

SCardEstablishContext
SCardReleaseContext

crypt32

CertFreeCertificateContext
CertCloseStore
CertOpenStore
CertCompareCertificateName
CertFindCertificateInStore
CryptMsgClose
CryptMsgGetParam
CryptMsgUpdate
CryptMsgOpenToDecode
CertCreateCertificateContext
CryptSignAndEncodeCertificate
CryptExportPublicKeyInfo
CertDuplicateCertificateContext
CertGetNameStringW
CertNameToStrA
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertGetNameStringA
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CertDeleteCertificateFromStore
CertFreeCertificateChain
CertGetCertificateChain
CryptEncodeObjectEx

ws2_32

ntohl
htonl

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 577KB - Virtual size: 577KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 213KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCBSignCom.ocx
.dll regsvr32 windows:5 windows x64 arch:x64

49188f25931fb9cf8ce4eebe9e438404

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:67:53:94:f0:24:36:2c:76:4d:69:e7:02:75:cf:7f:1f:c2:46:b3
Signer

Actual PE Digest

2c:67:53:94:f0:24:36:2c:76:4d:69:e7:02:75:cf:7f:1f:c2:46:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

HeapSetInformation
HeapCreate
HeapDestroy
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetConsoleCP
GetConsoleMode
GetACP
IsValidCodePage
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
SizeofResource
LockResource
LoadResource
FindResourceA
WideCharToMultiByte
LCMapStringA
GetStdHandle
FlsAlloc
FlsFree
FlsGetValue
DecodePointer
EncodePointer
HeapQueryInformation
HeapSize
VirtualQuery
GetSystemInfo
VirtualAlloc
GetSystemDefaultLangID
FindClose
DeleteFileA
FindFirstFileA
CreateDirectoryA
TerminateProcess
GetTempPathA
FileTimeToSystemTime
GetLastError
GetProcAddress
GetModuleHandleA
FreeLibrary
GlobalAlloc
lstrcmpA
GlobalLock
CompareStringA
LoadLibraryA
GetLocaleInfoA
GetModuleFileNameA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThreadId
GetCurrentThread
GlobalDeleteAtom
CloseHandle
GlobalAddAtomA
SetLastError
GetCurrentProcessId
GetModuleFileNameW
lstrlenA
GetModuleHandleW
GlobalUnlock
GlobalFree
FreeResource
MulDiv
lstrlenW
LocalFree
FormatMessageA
GlobalSize
CopyFileA
GetUserDefaultLCID
VirtualProtect
ExitProcess
Sleep
GetCommandLineA
FlsSetValue
HeapReAlloc
RtlPcToFileHeader
RaiseException
HeapFree
HeapAlloc
RtlUnwindEx
RtlLookupFunctionEntry
GetProfileIntA
GetFileTime
GetFileSizeEx
GetFileAttributesA
FindResourceExA
GetOEMCP
GetCPInfo
GetVersion
FileTimeToLocalFileTime
CreateFileA
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
InitializeCriticalSection
EnterCriticalSection
TlsGetValue
GetVersionExA
LeaveCriticalSection
LocalAlloc
IsDBCSLeadByte
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
MultiByteToWideChar

user32

GetDCEx
GetDialogBaseUnits
GetTabbedTextExtentA
CharUpperA
DestroyIcon
GetSysColorBrush
UnregisterClassA
LockWindowUpdate
EnumChildWindows
RegisterClipboardFormatA
SetRect
SetWindowRgn
IsRectEmpty
CreateMenu
DestroyMenu
SetRectEmpty
LoadCursorA
SetCapture
ReleaseCapture
MoveWindow
SetWindowTextA
IsDialogMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
GetClassLongPtrA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextA
GetTopWindow
GetWindowLongPtrA
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
FillRect
EnableWindow
SendMessageA
PostQuitMessage
PtInRect
GetDlgCtrlID
GetMenu
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
GetForegroundWindow
PostMessageA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
SetCursor
MessageBoxA
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetWindowThreadProcessId
UnhookWindowsHookEx
SetParent
DrawEdge
ShowWindow
CopyRect
DefWindowProcA
InflateRect
OffsetRect
GetMenuItemCount
GetMenuItemID
TabbedTextOutA
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
SetActiveWindow
CreateDialogIndirectParamA
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetSysColor
SetWindowLongA
CallWindowProcA
SetWindowPos
SetWindowLongPtrA
DestroyWindow
GetDesktopWindow
InvalidateRect
UpdateWindow
GetWindowRect
GetSubMenu
RegisterWindowMessageA

gdi32

DeleteObject
SelectClipRgn
CreateRectRgn
GetObjectA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
CreatePatternBrush
CreatePen
CreateSolidBrush
CombineRgn
CreateRectRgnIndirect
CreateFontIndirectA
GetTextExtentPoint32A
GetTextAlign
GetTextMetricsA
SetRectRgn
PatBlt
EnumFontFamiliesExA
Rectangle
UnrealizeObject
MoveToEx
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetBkMode
SetBkColor
RestoreDC
SaveDC
Ellipse
GetStockObject
CreateBitmap
GetDeviceCaps
LPtoDP
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
DeleteDC
CopyMetaFileA
CreateDCA

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegQueryValueA
RegQueryValueExA
CryptReleaseContext
CryptDestroyHash
CryptSignHashA
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
CryptGetProvParam
RegDeleteValueA
RegSetValueExA
RegSetValueA
RegCreateKeyA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegCloseKey

shell32

ExtractIconA
ShellExecuteExA

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

ole32

OleLoadFromStream
CoCreateInstance
ReadClassStm
CreateStreamOnHGlobal
CreateDataAdviseHolder
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateOleAdviseHolder
CoDisconnectObject
OleDuplicateData
ReleaseStgMedium
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
ReadFmtUserTypeStg
OleSaveToStream
CoTaskMemAlloc
CreateDataCache
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CoRevokeClassObject
CoRegisterClassObject

oleaut32

SysStringLen
RegisterTypeLi
LoadTypeLi
OleCreatePropertyFrame
VariantClear
VariantChangeType
SysAllocStringByteLen
VariantInit
OleLoadPicture
SysAllocString
VariantCopy
OleCreateFontIndirect
SysStringByteLen
OleCreatePictureIndirect
SysFreeString
SysAllocStringLen
LoadRegTypeLi

crypt32

CertNameToStrA
CertFindCertificateInStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CryptEncodeObjectEx
CertCloseStore
CertFreeCertificateContext
CertOIDToAlgId
CertEnumCertificateContextProperties
CertOpenStore

ws2_32

htonl

oleacc

LresultFromObject
CreateStdAccessibleObject

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCB_AUTO_RUN.reg
$SYSDIR/D4CSP_CCB.dll
.dll windows:5 windows x64 arch:x64

33c5cfbd8d08c788dcbd779b436ee998

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:9f:96:ed:63:36:36:32:3e:aa:d7:01:4c:82:72:e3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

31-03-2015 00:00

Not After

29-05-2016 23:59

Subject

CN=Tendyron Corporation,OU=Application & Support Department No.2,O=Tendyron Corporation,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:df:1a:f8:d3:11:cd:7e:8b:d6:f7:fc:ed:e3:1c:cd:93:71:19:39
Signer

Actual PE Digest

39:df:1a:f8:d3:11:cd:7e:8b:d6:f7:fc:ed:e3:1c:cd:93:71:19:39

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpW
SetEndOfFile
GetProcessHeap
lstrcpyW
lstrlenW
DeleteCriticalSection
InitializeCriticalSection
lstrcmpA
EnterCriticalSection
LeaveCriticalSection
GetLocalTime
lstrcpyA
CompareFileTime
FindFirstFileA
lstrcatW
lstrcpynA
GetVersionExW
IsBadWritePtr
LocalReAlloc
GetProcAddress
GetLastError
SetLastError
lstrlenA
WideCharToMultiByte
LocalAlloc
MultiByteToWideChar
LocalFree
FreeLibrary
LoadLibraryW
ReadFile
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
RaiseException
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
GetModuleHandleW
ExitProcess
CloseHandle
WriteFile
GetConsoleCP
GetConsoleMode
GetStdHandle
GetModuleFileNameA
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
FlushFileBuffers

user32

wsprintfW
wsprintfA

advapi32

CryptSetKeyParam
CryptGetUserKey
CryptImportKey
CryptGetKeyParam
CryptDecrypt
CryptExportKey
CryptDestroyKey
CryptGenKey
CryptAcquireContextW
CryptReleaseContext
GetUserNameA
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
CryptEncrypt
RegQueryValueExW

shell32

SHGetSpecialFolderPathW

d4token_ccb

OnKeyT_ChangePin
OnKeyT_WaitForSlotEvent
OnKeyT_RsaVerify
OnKeyT_RsaSignEx
OnKeyT_RsaSign
OnKeyT_EccDecrypt
Ossl_DecryptUpdate
OnKeyT_RsaDecrypt
Ossl_DecryptInitEx
Ossl_EncryptFinal
OnKeyT_DevAlgCalc
Ossl_RsaPublic_crypt
OnKeyT_RsaEncrypt
OnKeyT_EccEncrypt
Ossl_EncryptUpdate
Ossl_EncryptInitEx
OnKeyT_ReadObjectEx
OnKeyT_ClearObjectsLoadType
OnKeyT_Login
OnKeyT_Ex_DisplayInfo
OnKeyT_Ex_SelectSlot
OnKeyT_ManTokenParam
OnKeyT_ContextFinal
OnKeyT_UpdateObject
OnKeyT_GetSlotList
OnKeyT_ContextInit
OnKeyT_GetRandBytes
Ossl_GetCertPublicKeyN
Ossl_DigestEncode
OnKeyT_EccVerify
Ossl_DigestFinal
Ossl_DecryptFinal
Ossl_DigestUpdate
Ossl_DigestInit
Ossl_GetBytes
OnKeyT_AppendEventInfo
OnKeyT_InitToken
OnKeyT_ReloadPin
OnKeyT_GetDeviceInfo
OnKeyT_Logout
OnKeyT_ExportPairKey
OnKeyT_GeneratePairKey
OnKeyT_ImportPairKey
OnKeyT_CreateObject
OnKeyT_DeleteObject

crypt32

CertFreeCertificateContext
CertGetNameStringW
CertCreateCertificateContext
CertAddCertificateContextToStore
CertOpenStore
CertSetCertificateContextProperty
CertCompareCertificateName
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CertCloseStore

shlwapi

StrCSpnA
StrChrA
wvnsprintfW
wvnsprintfA
StrRChrA
StrStrA

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
C_CancelFunction
C_CloseAllSessions
C_CloseSession
C_CopyObject
C_CreateObject
C_Decrypt
C_DecryptDigestUpdate
C_DecryptFinal
C_DecryptInit
C_DecryptUpdate
C_DecryptVerifyUpdate
C_DeriveKey
C_DestroyObject
C_Digest
C_DigestEncryptUpdate
C_DigestFinal
C_DigestInit
C_DigestKey
C_DigestUpdate
C_Encrypt
C_EncryptFinal
C_EncryptInit
C_EncryptUpdate
C_Finalize
C_FindObjects
C_FindObjectsFinal
C_FindObjectsInit
C_GenerateKey
C_GenerateKeyPair
C_GenerateRandom
C_GetAttributeValue
C_GetFunctionList
C_GetFunctionStatus
C_GetInfo
C_GetMechanismInfo
C_GetMechanismList
C_GetObjectSize
C_GetOperationState
C_GetSessionInfo
C_GetSlotInfo
C_GetSlotList
C_GetTokenInfo
C_InitPIN
C_InitToken
C_Initialize
C_Login
C_Logout
C_OpenSession
C_SeedRandom
C_SetAttributeValue
C_SetOperationState
C_SetPIN
C_Sign
C_SignEncryptUpdate
C_SignFinal
C_SignInit
C_SignRecover
C_SignRecoverInit
C_SignUpdate
C_UnwrapKey
C_Verify
C_VerifyFinal
C_VerifyInit
C_VerifyRecover
C_VerifyRecoverInit
C_VerifyUpdate
C_WaitForSlotEvent
C_WrapKey

Sections

.text
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/D4CSP_CCBs.dll
.dll windows:5 windows x64 arch:x64

e2af0e56da4eab5f77d44678a7e8fbe8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
GetModuleFileNameA
FreeLibrary
DisableThreadLibraryCalls
SetLastError

shlwapi

PathFindFileNameA

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/D4DevEx01_CCB.dll
.dll windows:5 windows x64 arch:x64

b75239f55a3ec60c0af72af44bb5731b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:9f:96:ed:63:36:36:32:3e:aa:d7:01:4c:82:72:e3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

31-03-2015 00:00

Not After

29-05-2016 23:59

Subject

CN=Tendyron Corporation,OU=Application & Support Department No.2,O=Tendyron Corporation,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:24:0c:bb:00:ec:59:c5:30:96:51:86:35:19:85:18:a8:63:c7:98
Signer

Actual PE Digest

8d:24:0c:bb:00:ec:59:c5:30:96:51:86:35:19:85:18:a8:63:c7:98

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
GetLogicalDrives
GetVersionExW
Sleep
GetLastError
CallNamedPipeA
WaitNamedPipeA
ReadFile
WriteFile
lstrcpyW
lstrlenW
lstrcmpW
MultiByteToWideChar
WideCharToMultiByte
lstrcmpiA
CloseHandle
GetTickCount
GetProcAddress
LoadLibraryW
FreeLibrary
CancelIo
GetOverlappedResult
WaitForSingleObject
CreateEventW
CreateFileW
lstrcpyA
lstrcpynA
DeviceIoControl
GlobalAlloc
lstrlenA
GetSystemDefaultLangID
GlobalFree
HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetLocaleInfoA
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
RtlPcToFileHeader
RaiseException
HeapDestroy
HeapCreate
HeapAlloc
HeapFree
HeapReAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSetInformation

user32

wsprintfW
wsprintfA

advapi32

RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW

shell32

SHGetSpecialFolderPathW
ord680

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdA

winscard

SCardDisconnect
SCardEndTransaction
SCardReconnect
SCardConnectA
g_rgSCardT1Pci
SCardBeginTransaction
SCardEstablishContext
SCardListReadersA
SCardTransmit
SCardReleaseContext

shlwapi

StrStrIA
StrChrA
StrRChrA
wvnsprintfA
StrStrW
StrStrA
StrCSpnA

Exports

Exports

OnKey_GetFunctionList

Sections

.text
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/D4Pinpad_CCB.dll
.dll windows:5 windows x64 arch:x64

dcf3589759be06b4fbf4673a497839d1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:9f:96:ed:63:36:36:32:3e:aa:d7:01:4c:82:72:e3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

31-03-2015 00:00

Not After

29-05-2016 23:59

Subject

CN=Tendyron Corporation,OU=Application & Support Department No.2,O=Tendyron Corporation,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:a0:bb:14:37:f7:c5:03:00:08:bf:10:13:d9:d8:ac:40:33:78:2a
Signer

Actual PE Digest

2b:a0:bb:14:37:f7:c5:03:00:08:bf:10:13:d9:d8:ac:40:33:78:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

RaiseException
RtlPcToFileHeader
ExitThread
CreateThread
FlsSetValue
GetCommandLineA
HeapReAlloc
ExitProcess
HeapSize
HeapQueryInformation
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
GetStdHandle
GetModuleFileNameA
HeapSetInformation
HeapCreate
HeapDestroy
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
RtlCaptureContext
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapFree
HeapAlloc
RtlUnwindEx
RtlLookupFunctionEntry
GetFileTime
GetFileSizeEx
GetFileAttributesW
FileTimeToLocalFileTime
WritePrivateProfileStringW
FileTimeToSystemTime
GlobalFlags
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
InitializeCriticalSection
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetProfileIntW
CreateFileW
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
LoadLibraryExW
CompareStringA
SuspendThread
GetCurrentProcessId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
GetVersionExA
CopyFileW
GlobalSize
FormatMessageW
LocalFree
SetLastError
GetModuleHandleW
GetLastError
FreeResource
GlobalLock
GlobalUnlock
GlobalFree
CreateEventW
GlobalAlloc
SetEvent
ResetEvent
WideCharToMultiByte
Sleep
SetThreadPriority
Beep
GetUserDefaultUILanguage
CreateSemaphoreW
CloseHandle
ReleaseSemaphore
lstrcatW
lstrcmpiW
OpenEventW
WaitForSingleObject
ResumeThread
MultiByteToWideChar
MulDiv
GetTickCount
LoadLibraryW
GetProcAddress
FreeLibrary
GetVersionExW
lstrlenA
GetModuleFileNameW
GetPrivateProfileStringW
GetCurrentThreadId
GetSystemDefaultLangID
lstrcmpW
lstrlenW
lstrcpyW
FindResourceW
LoadResource
LockResource
FreeEnvironmentStringsA
SizeofResource

user32

CharUpperW
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
CheckMenuItem
EndPaint
BeginPaint
MoveWindow
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageA
SendDlgItemMessageW
WinHelpW
GetCapture
GetClassLongPtrW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
GetLastActivePopup
DispatchMessageW
GetWindowLongPtrW
SetWindowLongPtrW
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
SetMenu
IsWindowVisible
UpdateWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
AdjustWindowRectEx
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
GetMenuState
GetMenuItemID
GetMenuItemCount
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetDlgItem
IsWindowEnabled
EndDialog
ReleaseCapture
SetCapture
GetWindowRgn
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
DestroyMenu
DestroyCursor
GetSubMenu
TrackPopupMenuEx
SetCursor
WindowFromPoint
GetNextDlgTabItem
ClientToScreen
DrawFocusRect
FrameRect
OffsetRect
InflateRect
DrawStateW
DestroyIcon
GetWindowDC
SetWindowRgn
SetWindowsHookExW
GetParent
GetFocus
GetTopWindow
OpenClipboard
EmptyClipboard
CloseClipboard
PostMessageW
CallNextHookEx
UnhookWindowsHookEx
LoadCursorW
GetSysColorBrush
UnregisterClassW
RegisterClassW
IsClipboardFormatAvailable
SetRect
ReleaseDC
FillRect
SetWindowTextW
SetDlgItemTextW
GetActiveWindow
PostThreadMessageW
EnumChildWindows
GetWindowTextW
GetClassNameW
ShowWindow
MonitorFromWindow
GetMonitorInfoW
GetWindowLongW
SetWindowLongW
SetLayeredWindowAttributes
CopyRect
PostQuitMessage
LoadImageW
GetDC
ScreenToClient
GetClientRect
PtInRect
MessageBoxW
GetSysColor
SetWindowPos
GetKeyState
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
wsprintfW
LoadIconW
EnableWindow
SetForegroundWindow
KillTimer
SetTimer
RedrawWindow
InvalidateRect
GetWindowRect
SendMessageW
LoadBitmapW
GetMenu

gdi32

GetRgnBox
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
Rectangle
OffsetRgn
FillRgn
MoveToEx
LineTo
SetMapMode
RestoreDC
SaveDC
GetClipBox
CopyMetaFileW
SetBkMode
SetTextAlign
SelectClipRgn
CreateFontIndirectW
GetTextMetricsW
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
SetStretchBltMode
SetBkColor
SetTextColor
LPtoDP
DPtoLP
GetWindowExtEx
GetViewportExtEx
GetMapMode
CreateBitmap
GetPixel
SetPixel
CombineRgn
GetBkColor
GetDIBits
CreateCompatibleBitmap
DeleteDC
BitBlt
CreateFontW
CreateRectRgn
CreatePen
SelectObject
Ellipse
GetObjectW
GetStockObject
GetDeviceCaps
CreateSolidBrush
SetBrushOrgEx
CreateRoundRectRgn
DeleteObject
StretchBlt
CreateCompatibleDC
PtInRegion

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegDeleteKeyW
RegSetValueExW
RegEnumKeyW
RegQueryValueW
RegOpenKeyW
RegOpenKeyExW

shell32

ShellExecuteW
SHGetFolderPathW
ShellExecuteExW
SHGetSpecialFolderPathW

comctl32

_TrackMouseEvent
ord17

shlwapi

StrToIntW
PathFindFileNameW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
StrStrW

d4token_ccb

OnKeyT_GetSlotList
OnKeyT_ManTokenParam
OnKeyT_GetDeviceInfo

ole32

OleGetClipboard
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleDuplicateData
CoTaskMemAlloc
CreateStreamOnHGlobal
ReleaseStgMedium

oleaut32

OleLoadPicture
VariantClear
VariantChangeType
VariantInit

winmm

PlaySoundW

Exports

Exports

Pinpad_CreateKey
Pinpad_CreateKeyEx
Pinpad_GetKeyInfo
Pinpad_Indicator
Pinpad_Indicator_HIP
Pinpad_MLChangeDlgRes
Pinpad_MLGetText
Pinpad_ShowDialog

Sections

.text
Size: 342KB - Virtual size: 341KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 257KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/D4Token_CCB.dll
.dll windows:5 windows x64 arch:x64

58fac1e1e1ec93189479b56399b246fa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:9f:96:ed:63:36:36:32:3e:aa:d7:01:4c:82:72:e3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

31-03-2015 00:00

Not After

29-05-2016 23:59

Subject

CN=Tendyron Corporation,OU=Application & Support Department No.2,O=Tendyron Corporation,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

94:4f:9c:ea:29:c8:c3:58:ab:8d:21:d0:5a:c2:1c:1b:e3:a3:fb:54
Signer

Actual PE Digest

94:4f:9c:ea:29:c8:c3:58:ab:8d:21:d0:5a:c2:1c:1b:e3:a3:fb:54

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

ResetEvent
GetTickCount
GetVersionExW
lstrcpynA
CreateMutexW
OpenMutexW
MapViewOfFile
CreateFileMappingW
ProcessIdToSessionId
GetCurrentProcessId
OpenFileMappingW
UnmapViewOfFile
ReleaseMutex
LocalFree
OpenEventW
SetConsoleMode
ReadConsoleInputA
GetProcessHeap
Sleep
MultiByteToWideChar
WaitForSingleObject
CloseHandle
SetEvent
WaitForMultipleObjects
CreateEventW
SetEndOfFile
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
ReadFile
CreateThread
GetModuleFileNameA
WideCharToMultiByte
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
GetLastError
HeapFree
HeapReAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
lstrcatA
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
RaiseException
RtlPcToFileHeader
HeapSize
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetConsoleCtrlHandler
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetVersion
GlobalMemoryStatus
FlushConsoleInputBuffer
FileTimeToSystemTime
FindClose
WinExec
lstrcmpA
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
lstrlenA
lstrcpyA
DeleteCriticalSection
FreeLibrary
InitializeCriticalSection
LoadLibraryW
GetProcAddress
RtlVirtualUnwind
DisableThreadLibraryCalls

user32

GetDesktopWindow
CharLowerA
FindWindowW
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
wsprintfW

advapi32

DeregisterEventSource
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegisterEventSourceW
ReportEventW
SetSecurityDescriptorSacl

shlwapi

PathFindFileNameA
StrChrA
wvnsprintfA
StrStrA
StrRChrA
StrCSpnA

crypt32

CertFreeCertificateContext
CertCreateCertificateContext

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory

Exports

Exports

ALG_Decrypt
ALG_Encrypt
OnKeyT_AppendEventInfo
OnKeyT_ChangePin
OnKeyT_ClearObjectsLoadType
OnKeyT_ClearToken
OnKeyT_ContextFinal
OnKeyT_ContextInit
OnKeyT_CreateObject
OnKeyT_DeleteObject
OnKeyT_DevAlgCalc
OnKeyT_EccDecrypt
OnKeyT_EccEncrypt
OnKeyT_EccSign
OnKeyT_EccVerify
OnKeyT_Ex_DisplayInfo
OnKeyT_Ex_SelectSlot
OnKeyT_ExportPairKey
OnKeyT_GeneratePairKey
OnKeyT_GeneratePairKeyEx
OnKeyT_GetDeviceInfo
OnKeyT_GetObjectList
OnKeyT_GetRandBytes
OnKeyT_GetSlotList
OnKeyT_ImportPairKey
OnKeyT_InitToken
OnKeyT_Login
OnKeyT_Logout
OnKeyT_ManTokenParam
OnKeyT_Name2SlotID
OnKeyT_ReadObject
OnKeyT_ReadObjectEx
OnKeyT_ReloadPin
OnKeyT_RsaDecrypt
OnKeyT_RsaEncrypt
OnKeyT_RsaSign
OnKeyT_RsaSignEx
OnKeyT_RsaVerify
OnKeyT_UpdateObject
OnKeyT_WaitForSlotEvent
Ossl_Base64_Decode
Ossl_Base64_Encode
Ossl_Base64_P7_FileData
Ossl_BytesToKey
Ossl_Cipher_SetPadding
Ossl_DecryptFinal
Ossl_DecryptInit
Ossl_DecryptInitEx
Ossl_DecryptUpdate
Ossl_DigestDecode
Ossl_DigestEncode
Ossl_DigestFinal
Ossl_DigestInit
Ossl_DigestUpdate
Ossl_EncryptFinal
Ossl_EncryptInit
Ossl_EncryptInitEx
Ossl_EncryptUpdate
Ossl_GetBytes
Ossl_GetCertFromP7
Ossl_GetCertPublicKeyN
Ossl_GetHashNID
Ossl_PKCS7_Sign
Ossl_PKCS7_Verify
Ossl_PKCS7_free
Ossl_PackageP10
Ossl_ParseCertDN
Ossl_RC2_SetKey
Ossl_RsaPrivate_crypt
Ossl_RsaPrivate_d2me
Ossl_RsaPublic_crypt
Ossl_RsaPublic_d2i
Ossl_RsaPublic_i2d
Ossl_Z_SM3

Sections

.text
Size: 625KB - Virtual size: 624KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/D4VD_CCB.dll
.dll windows:5 windows x64 arch:x64

00c645bf454e1deddfaa50dcb47e973e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:9f:96:ed:63:36:36:32:3e:aa:d7:01:4c:82:72:e3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

31-03-2015 00:00

Not After

29-05-2016 23:59

Subject

CN=Tendyron Corporation,OU=Application & Support Department No.2,O=Tendyron Corporation,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7d:53:36:b7:1b:eb:38:29:d4:d5:eb:7d:89:05:f6:45:1f:3e:36:0d
Signer

Actual PE Digest

7d:53:36:b7:1b:eb:38:29:d4:d5:eb:7d:89:05:f6:45:1f:3e:36:0d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\svn\software\src\Project\建行二代\建行国密新UI\install\193I3\bin64\release\D4VD.pdb

Imports

kernel32

LeaveCriticalSection
EnterCriticalSection
SetEvent
ProcessIdToSessionId
GetCurrentProcessId
GetProcAddress
LoadLibraryW
FreeLibrary
Sleep
GetExitCodeThread
CreateThread
ResetEvent
CreateEventW
DeleteCriticalSection
CreateToolhelp32Snapshot
CloseHandle
Process32FirstW
Process32NextW
OpenProcess
ReadFile
GetProcessHeap
SetEndOfFile
lstrcpyA
InitializeCriticalSection
HeapReAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
RtlLookupFunctionEntry
RtlUnwindEx
GetLastError
HeapFree
HeapAlloc
RaiseException
RtlPcToFileHeader
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
WriteFile
GetConsoleCP
GetConsoleMode
HeapSetInformation
HeapCreate
HeapDestroy
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
SetFilePointer
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA

user32

ReleaseDC
GetSysColor
MsgWaitForMultipleObjects
GetDC
PeekMessageW
DispatchMessageW

gdi32

GetDIBits

ole32

CoCreateGuid

psapi

GetModuleFileNameExA

Exports

Exports

vdInputPin

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/ccb_tdrmanager.dll
.dll regsvr32 windows:5 windows x64 arch:x64

cc57d0e784fcf376fb61b78d77f132fe

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:9f:96:ed:63:36:36:32:3e:aa:d7:01:4c:82:72:e3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

31-03-2015 00:00

Not After

29-05-2016 23:59

Subject

CN=Tendyron Corporation,OU=Application & Support Department No.2,O=Tendyron Corporation,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

eb:80:d1:89:26:09:2b:1a:e7:39:b9:d1:85:57:52:56:5a:83:7b:e7
Signer

Actual PE Digest

eb:80:d1:89:26:09:2b:1a:e7:39:b9:d1:85:57:52:56:5a:83:7b:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\svn\software\src\Project\建行二代\建行国密新UI\install\193I3\bin64\Release\ccb_tdrmanager.pdb

Imports

kernel32

LoadResource
FindResourceW
LoadLibraryExW
lstrcmpiW
GetProcAddress
RaiseException
EnterCriticalSection
LeaveCriticalSection
SizeofResource
DeleteCriticalSection
LoadLibraryW
lstrcpyA
WideCharToMultiByte
FlushFileBuffers
MultiByteToWideChar
FreeLibrary
GetLastError
lstrlenW
GetModuleFileNameW
GetModuleHandleW
GetThreadLocale
InitializeCriticalSection
SetThreadLocale
CloseHandle
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetConsoleMode
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
GetSystemTimeAsFileTime
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
HeapSetInformation
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP

user32

LoadStringW
CharNextW

advapi32

RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW

ole32

StringFromGUID2
CoTaskMemFree
CoCreateInstance
ProgIDFromCLSID
CoTaskMemAlloc
CoTaskMemRealloc

oleaut32

CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
SysAllocStringLen
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
RegisterTypeLi
VarUI4FromStr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
usbccid.CAT
usbccid.inf
usbccid.sys
.sys windows:5 windows x86 arch:x86

f39b03ee1f9cd5628c4512b5c20bceb3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

usbccid.pdb

Imports

ntoskrnl.exe

KeTickCount
KeBugCheckEx
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
IoCreateDevice
IoOpenDeviceRegistryKey
IoAttachDeviceToDeviceStack
KeDelayExecutionThread
ExAllocatePoolWithTag
ExFreePoolWithTag
IofCompleteRequest
_except_handler3
RtlInitUnicodeString
ZwQueryValueKey
IoInitializeRemoveLockEx
ZwClose
KeSetEvent
ExFreePool
IoAcquireCancelSpinLock
IoFreeIrp
IoReleaseRemoveLockEx
IoCancelIrp
KeWaitForSingleObject
IofCallDriver
IoAllocateIrp
KeInitializeEvent
IoAcquireRemoveLockEx
_allmul
IoBuildDeviceIoControlRequest
InterlockedDecrement
InterlockedIncrement
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
KeInitializeSpinLock
IoFreeWorkItem
IoQueueWorkItem
InterlockedCompareExchange
IoAllocateWorkItem
KeResetEvent
KeClearEvent
IoRegisterDeviceInterface
PoStartNextPowerIrp
PoSetPowerState
PoCallDriver
PoRequestPowerIrp
IoSetDeviceInterfaceState
IoDeleteDevice
IoDetachDevice
RtlFreeUnicodeString
IoReleaseRemoveLockAndWaitEx
InterlockedExchange
IoReleaseCancelSpinLock

hal

KfReleaseSpinLock
KfAcquireSpinLock

smclib.sys

SmartcardT1Request
SmartcardT0Request
SmartcardT0Reply
SmartcardUpdateCardCapabilities
SmartcardDeviceControl
SmartcardT1Reply
SmartcardInitialize
SmartcardExit

usbd.sys

USBD_ParseConfigurationDescriptorEx
USBD_CreateConfigurationRequestEx
USBD_ParseDescriptors

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEABLE
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

afa8e526425f3585465337467d0b5909

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
lstrcpynA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 741B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 673B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/WDCCB_32+64bit.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:f8:0a:29:62:f1:de:b7:8a:5a:88:89:67:37:f8:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-11-2015 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:4c:43:c6:70:0e:4c:81:c9:44:2b:63:01:18:c7:57
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-01-2016 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f2:03:af:21:b2:4c:cc:4b:fd:12:50:4b:2a:fb:a7:d9:1d:e1:95:42:fc:72:7f:17:16:ca:e8:57:62:e7:29:8c
Signer

Actual PE Digest

f2:03:af:21:b2:4c:cc:4b:fd:12:50:4b:2a:fb:a7:d9:1d:e1:95:42:fc:72:7f:17:16:ca:e8:57:62:e7:29:8c

Digest Algorithm

sha256

PE Digest Matches

true

61:08:21:db:04:93:b7:1c:0b:6f:89:57:f5:1d:8d:1b:1e:0c:73:b5
Signer

Actual PE Digest

61:08:21:db:04:93:b7:1c:0b:6f:89:57:f5:1d:8d:1b:1e:0c:73:b5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsProcess.dll
.dll windows:4 windows x86 arch:x86

c9fc7f6df8fedf8f8f1f9f820c072664

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
CloseHandle
TerminateProcess
OpenProcess
lstrcmpiA
WideCharToMultiByte
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryA
GetVersionExA
GlobalFree
lstrcpynA
GlobalAlloc

Exports

Exports

_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 646B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 146B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES/$(LSTR_47)/WDPKCSUtil.exe
.exe windows:4 windows x86 arch:x86

d4aecd60fcab62e5d64066f4d7d3223b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsA

mfc42

ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord5199
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord2764
ord1168
ord537
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord823
ord825
ord4673
ord1576
ord2985
ord800

msvcrt

__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
__dllonexit
__CxxFrameHandler
exit
sprintf
strstr
atoi
_setmbcp

kernel32

GetCommandLineA
LoadLibraryExA
GetProcAddress
GetStartupInfoA
GetModuleHandleA
GetPrivateProfileStringA
GetSystemDirectoryA

advapi32

RegOpenKeyExA
RegEnumKeyA
RegCloseKey
RegQueryValueExA

shell32

SHGetFolderPathA

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/RegTrustedSite.exe
.exe windows:4 windows x86 arch:x86

c54200f44e48cd946b6ce18f104be94f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:1d:a1:9f:e1:0f:74:7c:d7:ac:8f:dd:c7:ec:ed:e3:85:fe:78:03
Signer

Actual PE Digest

3c:1d:a1:9f:e1:0f:74:7c:d7:ac:8f:dd:c7:ec:ed:e3:85:fe:78:03

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
DeleteFileA
FreeLibrary
GetStringTypeA
LCMapStringW
GetCommandLineA
GetVersion
ExitProcess
HeapFree
GetLastError
CloseHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
ReadFile
CreateFileA
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
SetEndOfFile
MultiByteToWideChar
LCMapStringA
GetStringTypeW

advapi32

RegSetValueExA
RegOpenKeyA
RegCloseKey

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/TokenMgr.dll
.dll windows:4 windows x86 arch:x86

d97f353b5c1dbb040df48c9c193a2966

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

26:77:96:c8:00:4b:11:9a:26:c0:a7:43:c1:51:c8:ed:d0:ad:87:01
Signer

Actual PE Digest

26:77:96:c8:00:4b:11:9a:26:c0:a7:43:c1:51:c8:ed:d0:ad:87:01

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertSetCertificateContextProperty
CertCloseStore
CertAddCertificateContextToStore
CertGetEnhancedKeyUsage
CertCreateCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertCompareCertificate
CertDeleteCertificateFromStore
CertFreeCertificateContext

winscard

g_rgSCardT0Pci
g_rgSCardT1Pci
SCardTransmit
SCardReconnect
SCardDisconnect
SCardStatusA
SCardConnectA
SCardReleaseContext
SCardEstablishContext
SCardListReadersA
SCardGetStatusChangeA
SCardFreeMemory
SCardControl

advapi32

RegSetValueExA
SetKernelObjectSecurity
GetTokenInformation
OpenProcessToken
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
SetSecurityDescriptorDacl

user32

PostMessageA

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

hid

HidD_FreePreparsedData
HidP_GetCaps
HidD_GetPreparsedData
HidD_GetHidGuid
HidD_GetFeature
HidD_SetFeature

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces

msvcrt

sprintf
fclose
fopen
fwrite
fread
mbstowcs
_initterm
_adjust_fdiv
strrchr
_strlwr
memcmp
strstr
strlen
malloc
free
strcpy
strcat
memset
memcpy
_strnicmp
_strupr
strcmp
_stricmp

kernel32

GetCurrentProcessId
LocalFree
LocalAlloc
GetVersion
MapViewOfFile
CreateFileMappingA
DeleteFileA
GetWindowsDirectoryA
CreateDirectoryA
GetPrivateProfileIntA
UnmapViewOfFile
OpenFileMappingA
GetCurrentProcess
ProcessIdToSessionId
WriteFile
ReadFile
GetModuleFileNameA
GetPrivateProfileStringA
LoadLibraryA
GetProcAddress
FreeLibrary
CreateNamedPipeA
lstrlenA
GetTickCount
Sleep
GetVersionExA
GetLastError
CreateFileA
ConnectNamedPipe
SetLastError
CreateMutexA
WaitForSingleObject
CloseHandle
ReleaseMutex

Exports

Exports

HIDCloseDevice
HIDEstablishContext
HIDGetSlotList
HIDGetTokenDevPath
HIDGetTokenDevPathEx
HIDGetTokenLabel
HIDOpenDevice
HIDOpenDeviceByDevPath
HIDOpenDeviceByIndex
HIDReleaseContext
HIDReset
IsHIDKey
NDCloseDevice
NDEstablishContext
NDEstablishContextEx
NDGetSlotList
NDGetSlotListProduce
NDGetTokenDevPath
NDGetTokenLabel
NDOpenDeviceByDevPath
NDOpenDeviceByIndex
NDReleaseContext
NDResetDevice
NDTransmit
PC_AddPinToCacheEx
PC_CreatePinCache
PC_GetPinFromCache
PC_ReleasePinCache
PC_RemoveAllPinFromCache
PC_RemovePinFromCacheEx
PC_UpdatePinToCache
SCardAPDU
SCardAppendRecord
SCardChangePin
SCardChangePinOCL
SCardCreateDF
SCardCreateEF
SCardCreateFile
SCardCreateFileEx
SCardEraseDF
SCardEraseEF
SCardExternAuth
SCardGenerateRSAKey
SCardGenerateRSAKeyOCL
SCardGetChallenge
SCardGetFreeSpace
SCardGetFreeSpaceEx
SCardGetSerialNo
SCardPubKeyEnc
SCardRSAPriKeyDec
SCardRSASign
SCardRSAVerify
SCardReadBin
SCardReadBinEx
SCardReadFixedRecord
SCardReset
SCardSelectFileByID
SCardSetSerialNo
SCardUnlockPin
SCardUnlockPinOCL
SCardUpdateBin
SCardUpdateFixedRecord
SCardVerifyPin
SCardVerifyPinOCL
SCardWriteKey
SCardWriteKeyDESMAC
UDKCloseDevice
UDKEstablishContext
UDKGetSlotList
UDKGetTokenDevPath
UDKGetTokenLabel
UDKIszteByHD
UDKOpenDeviceByIndex
UDKReleaseContext
UDKReset
WDCryptGetParam
WDCryptGetString
WDCryptIsCompatible
WDCryptIsSupportedReader
WDGetLoginUser
WDGetPrefixByTokenName
WDGetTempCertDIR
WDLock
WDSCardAddPkcsObjectFileId
WDSCardAddRSAKeytoContainer
WDSCardAuth
WDSCardChangePinHardware
WDSCardChangeSOPin
WDSCardChangeUserPin
WDSCardCloseFile
WDSCardConnectToken
WDSCardCreateFile
WDSCardCreateFileExEx
WDSCardCreateRSAKeyFile
WDSCardDelAllPKCSObject
WDSCardDelCertInContainer
WDSCardDelContainer
WDSCardDelFile
WDSCardDelKeyInContainer
WDSCardDelPKCS11Object
WDSCardDeleteAllOldCerts
WDSCardDeleteCertFromDiskAndIE
WDSCardDisconnectToken
WDSCardEncodeSignDataEx
WDSCardEncodeSignDataExEx
WDSCardEnumContainer
WDSCardEraseAllFiles
WDSCardEstablishContext
WDSCardGenContainerName
WDSCardGenRSAKey
WDSCardGenRSAKeyThreadProc
WDSCardGenRandom
WDSCardGenerateTokenSN
WDSCardGetCertCount
WDSCardGetContainerName
WDSCardGetCreatedFileNum
WDSCardGetCurrentFileID
WDSCardGetFileID
WDSCardGetFileIndex
WDSCardGetFileSize
WDSCardGetFileType
WDSCardGetInvalidCertCntAndContainerCnt
WDSCardGetKeySetInfo
WDSCardGetProvName
WDSCardGetPublicKey
WDSCardGetPublicKeyNum
WDSCardGetRSAContainer
WDSCardGetRSAContainerFromCertindex
WDSCardGetRSAKeyIndex
WDSCardGetRSAKeyType
WDSCardGetRSAKeyfromContainer
WDSCardGetRSAKeyfromContainerEx
WDSCardGetReaderName
WDSCardGetSlotList
WDSCardGetSlotName
WDSCardGetTokenATR
WDSCardGetTokenHandle
WDSCardGetTokenInfo
WDSCardGetTokenLabel
WDSCardGetTokenMaterKeyType
WDSCardGetTokenSN
WDSCardGetTokenStatus
WDSCardGetTokenVersion
WDSCardGetTotalSlotList
WDSCardGetVersion
WDSCardImportRSAKeysToCard
WDSCardInit
WDSCardInitEx
WDSCardInitializeAdminKey
WDSCardNewContainer
WDSCardOpenContainer
WDSCardOpenDefaultContainer
WDSCardOpenFile
WDSCardRSAPrivateKeyDecrypt
WDSCardRSAPublicKeyEncrypt
WDSCardRSASign
WDSCardRSASignData
WDSCardRSASignEx
WDSCardRSAVerifySignature
WDSCardReadBin
WDSCardReadCACert
WDSCardReadCert
WDSCardReadCertEx
WDSCardReadDevInfo
WDSCardReadDevType
WDSCardReadFile
WDSCardReadFileEx
WDSCardReadPublicKey
WDSCardReadPublicKeyC
WDSCardReadPublicKeyCEx
WDSCardReadPublicKeyEx
WDSCardReadSerialNoC
WDSCardReadShortCutLoginStatus
WDSCardRegisterCert
WDSCardReleaseContext
WDSCardReleaseContextEx
WDSCardReset
WDSCardSCB2Decrypt
WDSCardSCB2Decrypt_CBC
WDSCardSCB2Encrypt
WDSCardSCB2Encrypt_CBC
WDSCardSSF33Decrypt
WDSCardSSF33Decrypt_CBC
WDSCardSSF33Encrypt
WDSCardSSF33Encrypt_CBC
WDSCardSetAllCertsToOldState
WDSCardSetAllPKCSObjectToOldState
WDSCardSetCertState
WDSCardSetNextFileID
WDSCardTradeAccountHardware
WDSCardTradeAccountPwdHardware
WDSCardTradeAddCodeHardware
WDSCardTradeAmountHardware
WDSCardUnblockUserPin
WDSCardUpdateAdminKey
WDSCardVerifyPinHardware
WDSCardVerifySOPin
WDSCardVerifyUserPin
WDSCardVerifyUserPinEx
WDSCardVerifyUserPinHardware
WDSCardWaitForSlotEvent
WDSCardWaitForSlotEvent_Ex
WDSCardWriteBin
WDSCardWriteCACert
WDSCardWriteCert
WDSCardWriteCertEx
WDSCardWriteFile
WDSCardWritePKCS11Object
WDSCardWriteProvName
WDSCardWriteShortCutLoginStatus
WDSCardWriteTokenInfo
WDSCardWriteTokenLabel
WDSCardWriteTokenSN
WDSCardZTECloseChannel
WDSCardZTEEndecrypt
WDSCardZTEOpenChannel
WDSetExitWaitEvent
WDUnlock

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/UIResC3.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/UIResE3.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/UIResT3.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/WDAlg.dll
.dll windows:4 windows x86 arch:x86

347028ec9947032028f238f47a940ac5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertCloseStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CertCreateCertificateContext
CertOpenStore
CertFindCertificateInStore
CertDeleteCertificateFromStore
CryptDecodeObject

ole32

CoTaskMemFree
CoTaskMemAlloc

shlwapi

PathFileExistsA

kernel32

SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
MultiByteToWideChar
WideCharToMultiByte
FileTimeToSystemTime
CloseHandle
WaitForMultipleObjects
CreateThread
Sleep
GetPrivateProfileStringA
ReadFile
GetFileSize
CreateFileA
GetModuleFileNameA
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetSystemTime
GetLocalTime
RtlUnwind
HeapAlloc
HeapFree
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetStdHandle
GetStringTypeA
GetStringTypeW

Exports

Exports

Compute_d
WDAlgPriKeyToCard
WDAlgPriKeyToCardPubKey
WDAlgPubKeyToCard
WDBlockDecrypt
WDBlockDecrypt_CBC
WDBlockEncrypt
WDBlockEncrypt_CBC
WDCardPriKeyToAlg
WDCardPubKeyToAlg
WDComputeDigest
WDComputeDigestEx
WDDelCertOnMyStore
WDGetDatefromCert
WDGetIDFromCert
WDGetIssuerfromCert
WDGetSubjectfromCert
WDIsCertOnMyStore
WDPrivateKeyBlobToAlg
WDPublicKeyBlobToAlg
WDRSAGenerateKeys
WDRSAPrivateDecrypt
WDRSAPrivateEncrypt
WDRSAPublicDecrypt
WDRSAPublicEncrypt
WDRSAPublicEncryptPKCS1
WDRSASignData
WDRSASignPKCSBlock
WDRSAVerifySign
WDRSAVerifySign1
WDRSAVerifySignedPKCSBlock
WDRegCertToMyStore
WDRegRootCert
WDRegUserCert
WDRevMemCopy
WDSCardEncodeSignData
WDSCardEncodeSignData1
WDStreamDecrypt
WDStreamEncrypt
WDVerifyMac
rdtsc_call

Sections

.text
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/WDCSP03.dll
.dll windows:4 windows x86 arch:x86

b2fafad018695099e0282058377c9611

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

CryptReleaseContext
CryptAcquireContextA
CryptGetProvParam

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

user32

RegisterWindowMessageA
MessageBoxA

crypt32

CertGetNameStringA
CertOpenStore
CertEnumCertificatesInStore
CertCompareCertificate
CertFreeCertificateContext
CertNameToStrA
CertCreateCertificateContext
CertDeleteCertificateFromStore
CertCloseStore

msvcrt

_adjust_fdiv
_initterm
??2@YAPAXI@Z
realloc
wcstok
wcscpy
wcschr
wcslen
wcscat
strtok
??3@YAXPAX@Z
_ftol
time
srand
rand
fwrite
free
vsprintf
fopen
fprintf
fclose
sprintf
strchr
_except_handler3
_strlwr
strstr
strrchr
malloc
_stricmp

kernel32

CreateFileMappingA
InitializeCriticalSection
GetVersionExA
GetCurrentProcess
DeleteCriticalSection
LoadLibraryA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
GetTickCount
MultiByteToWideChar
CreateMutexA
WaitForSingleObject
ReleaseMutex
FindFirstFileA
FindNextFileA
FindClose
CreateFileA
ReadFile
DeleteFileA
GetLastError
GetPrivateProfileStringA
GetLocalTime
GetCurrentProcessId
GetPrivateProfileIntA
OpenFileMappingA
MapViewOfFile
CloseHandle
UnmapViewOfFile
GetVersion
GetModuleFileNameA
OutputDebugStringA
SetLastError
FreeLibrary

Exports

Exports

WDAcquireContext
WDCreateHash
WDDecrypt
WDDeriveKey
WDDestroyHash
WDDestroyKey
WDDuplicateKey
WDEncrypt
WDExportKey
WDGenKey
WDGenRandom
WDGetHashParam
WDGetKeyParam
WDGetProvParam
WDGetUserKey
WDHashData
WDHashSessionKey
WDImportKey
WDReleaseContext
WDSetHashParam
WDSetKeyParam
WDSetProvParam
WDSignHash
WDVerifySignature

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/WDCertM_CCB.exe
.exe windows:4 windows x86 arch:x86

8cf2375491e257d65da71e5d263d7df7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$SYSDIR/$(LSTR_42)/WDEvent.dll
.dll windows:4 windows x86 arch:x86

bdcf54f823d0b0cf7b073369c3c2b26d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertDeleteCertificateFromStore
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertCloseStore
CertGetNameStringA
CertFreeCertificateContext
CertCreateCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertCompareCertificate

shlwapi

PathFileExistsA

oleacc

ObjectFromLresult

mfc42

ord1168
ord2915
ord6334
ord6241
ord3092
ord4710
ord4376
ord2379
ord2642
ord5981
ord823
ord861
ord3873
ord2864
ord2817
ord2575
ord4396
ord3574
ord6055
ord1776
ord5290
ord3402
ord4424
ord3721
ord795
ord567
ord609
ord2301
ord2302
ord4160
ord6215
ord6453
ord2086
ord3610
ord656
ord4275
ord3098
ord4274
ord6375
ord4486
ord2554
ord4224
ord5731
ord3922
ord1089
ord1775
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord6467
ord3953
ord2725
ord5953
ord4853
ord4234
ord2370
ord5265
ord4998
ord2514
ord6052
ord4078
ord269
ord826
ord600
ord1578
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1575
ord1176
ord1116
ord825
ord324
ord540
ord860
ord641
ord800
ord3597
ord4425
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord2512
ord4407
ord5199

msvcrt

_stricmp
_CxxThrowException
wcslen
??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
free
_onexit
__dllonexit
_strupr
malloc
srand
rand
strncpy
fprintf
strstr
_strlwr
atoi
mbstowcs
fopen
fclose
strrchr
sprintf
__CxxFrameHandler

kernel32

LocalAlloc
UnmapViewOfFile
DeleteCriticalSection
CreateFileMappingA
MapViewOfFile
InitializeCriticalSection
GetPrivateProfileIntA
GetPrivateProfileStringA
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateThread
GetTickCount
CreateDirectoryA
FreeLibrary
LoadLibraryA
GetProcAddress
GetSystemDirectoryA
InterlockedDecrement
GetSystemDefaultLangID
SetThreadLocale
DeleteFileA
WriteFile
FindFirstFileA
ReadFile
CreateFileA
EnterCriticalSection
LeaveCriticalSection
FindNextFileA
FindClose
CreateProcessA
GetLastError
GetCurrentProcess
ReleaseMutex
CloseHandle
CreateMutexA
WaitForSingleObject
GetModuleFileNameA
GetVersionExA
Sleep
WideCharToMultiByte
LocalFree

user32

GetWindowTextA
SetForegroundWindow
SetActiveWindow
EnumWindows
MessageBoxA
GetClassNameA
RegisterWindowMessageA
WindowFromPoint
KillTimer
EnableWindow
SendMessageA
SetTimer
LoadStringA
GetForegroundWindow
SendMessageTimeoutA
GetCursorPos
EnumChildWindows

advapi32

RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey

shell32

ShellExecuteA

ole32

CoCreateInstance
OleRun
CoUninitialize
CoInitialize

oleaut32

GetErrorInfo
VariantClear
SysFreeString

Exports

Exports

CheckContainCCBUrl
DeleteInstallCert
InsertDeviceEvent
ReadAllCertFromKey
ReadAllCertFromKeyEx
RemoveDeviceEvent

Sections

.text
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/WDKeyMonitorCCB.exe
.exe windows:4 windows x86 arch:x86

8cf2375491e257d65da71e5d263d7df7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$SYSDIR/$(LSTR_42)/WatchSafe.ini
$SYSDIR/$(LSTR_42)/clrcert.exe
.exe windows:4 windows x86 arch:x86

d4fdca877fce9dc99c6aa4b2c6c2c485

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetPrivateProfileStringA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$SYSDIR/$(LSTR_42)/hodll.dll
.dll windows:4 windows x86 arch:x86

4f4a302b47bbeb2c8054997a8f351bb0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bb:b1:0e:9a:1a:43:09:06:e2:5a:8d:be:3b:c5:60:d1:ae:a1:57:d5
Signer

Actual PE Digest

bb:b1:0e:9a:1a:43:09:06:e2:5a:8d:be:3b:c5:60:d1:ae:a1:57:d5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord6375
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord1176
ord1116
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord6467
ord1168
ord3830
ord4274
ord269

msvcrt

??1type_info@@UAE@XZ
__CxxFrameHandler
rand
srand
time
??2@YAPAXI@Z
__dllonexit
_onexit
free
_initterm
malloc
sprintf
_adjust_fdiv

kernel32

LocalFree
GetLastError
LocalAlloc

user32

keybd_event
GetKeyState
UnhookWindowsHookEx
GetAsyncKeyState
SetWindowsHookExA
GetForegroundWindow
GetActiveWindow
GetFocus
CallNextHookEx
MapVirtualKeyA

Exports

Exports

?KeyboardProcForCheck@@YGJHIJ@Z
?KeyboardProcForUI@@YGJHIJ@Z
PWD_ClearStoreAndKey
PWD_GetString
PWD_InputChar
PWD_InputChar_SoftKbd
PWD_SetCurPwdType
PWD_SetCurPwdWnd
installhookForCheck
installhookForUI
unhook

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARDAT
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 830B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/wdcspui.dll
.dll windows:4 windows x86 arch:x86

3200970add211b950b9784d99390c22b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:f8:0a:29:62:f1:de:b7:8a:5a:88:89:67:37:f8:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-11-2015 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:4c:43:c6:70:0e:4c:81:c9:44:2b:63:01:18:c7:57
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-01-2016 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:4f:5d:8c:69:bd:e7:fe:13:8b:11:cf:de:87:fd:9d:38:85:4d:2b:67:1f:58:57:18:17:3c:74:88:18:c6:02
Signer

Actual PE Digest

50:4f:5d:8c:69:bd:e7:fe:13:8b:11:cf:de:87:fd:9d:38:85:4d:2b:67:1f:58:57:18:17:3c:74:88:18:c6:02

Digest Algorithm

sha256

PE Digest Matches

true

1d:e0:81:7e:b3:56:67:97:14:17:6e:85:a6:5a:fd:f1:ee:e7:24:ae
Signer

Actual PE Digest

1d:e0:81:7e:b3:56:67:97:14:17:6e:85:a6:5a:fd:f1:ee:e7:24:ae

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SizeofResource
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetWindowsDirectoryW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
LocalAlloc
LocalFree
GetPrivateProfileIntW
CreateMutexA
WaitForSingleObject
ReleaseMutex
WriteFile
ReadFile
LoadLibraryW
FreeLibrary
CreateNamedPipeA
ConnectNamedPipe
GetLastError
CloseHandle
GetPrivateProfileStringW
WideCharToMultiByte
GetSystemDefaultLangID
GetCurrentThreadId
lstrcpyW
GetModuleFileNameW
lstrcatW
GetSystemDirectoryA
GetModuleHandleW
GetProcAddress
lstrlenW
lstrcmpiW
FreeResource
GetVersionExW
FindResourceW
LoadResource
LockResource
GetCPInfo
lstrlenA
GetVersion

user32

InflateRect
LoadMenuW
LoadImageW
GetIconInfo
CreateIconIndirect
SendMessageW
TrackPopupMenuEx
PostMessageW
SetCursor
DestroyCursor
DestroyMenu
EnableWindow
GetDesktopWindow
ReleaseDC
GetDC
RemoveMenu
ModifyMenuW
GetClientRect
ClientToScreen
InvalidateRect
GetActiveWindow
GetNextDlgTabItem
GetParent
WindowFromPoint
GetWindowLongW
UpdateWindow
SetActiveWindow
SetForegroundWindow
ShowWindow
SetWindowPos
SetTimer
KillTimer
LoadIconW
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
RegisterDeviceNotificationA
FindWindowW
SetWindowTextW
OffsetRect
ScreenToClient
GetDlgItem
PtInRect
LoadCursorW
SetWindowLongW
IsRectEmpty
SetRectEmpty
IntersectRect
UnionRect
GetCursorPos
ReleaseCapture
IsIconic
IsZoomed
SetWindowRgn
GetUpdateRect
InsertMenuW
GetSubMenu
GetMenuStringW
GetMenuState
GetMenuItemID
GetMenuItemCount
AppendMenuW
DeleteMenu
GetMenuItemInfoW
GetSysColor
SystemParametersInfoW
DestroyIcon
DrawIconEx
GetSystemMetrics
SetRect
CopyRect
FillRect
GetSysColorBrush
LoadBitmapW
DrawEdge
TabbedTextOutW
DrawTextW
GrayStringW
CreateMenu
CreatePopupMenu
DrawStateW
FrameRect
DrawFocusRect
MoveWindow
GetWindowRect
LoadStringW
SetCapture

gdi32

GetDeviceCaps
GetBkMode
PtVisible
RectVisible
Ellipse
PatBlt
GetObjectW
SetPixel
TextOutW
ExtTextOutW
Escape
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
CreateDIBSection
SelectObject
BitBlt
DeleteObject
DeleteDC
GetPixel
Rectangle
SetTextColor
SetBkColor
CreateBitmap
CreateFontW
CreateEllipticRgnIndirect
PtInRegion
GetStockObject
CreateRectRgn
CombineRgn
GetDIBits
CreateSolidBrush
CreatePen
CreateHatchBrush
GetTextExtentPoint32W

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

ShellExecuteExW
ShellExecuteA

ole32

CreateStreamOnHGlobal

mfc42u

ord4074
ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord4269
ord4219
ord3092
ord6466
ord2810
ord4294
ord2910
ord859
ord2634
ord3088
ord860
ord6330
ord6211
ord5949
ord3087
ord2362
ord2294
ord1165
ord5276
ord2637
ord4704
ord6191
ord1105
ord4229
ord641
ord4692
ord5303
ord5285
ord5710
ord4616
ord3733
ord561
ord3948
ord2717
ord3701
ord3605
ord656
ord755
ord470
ord5706
ord6655
ord1808
ord816
ord1761
ord562
ord2550
ord2855
ord922
ord269
ord826
ord600
ord1571
ord1250
ord1248
ord1563
ord1194
ord1240
ord342
ord1179
ord1570
ord1568
ord1173
ord1115
ord815
ord324
ord3592
ord4282
ord6195
ord4419
ord384
ord686
ord1099
ord800
ord535
ord861
ord540
ord772
ord3696
ord500
ord1854
ord825
ord823
ord2430
ord4078
ord2858
ord5602
ord6138
ord2854
ord5871
ord4124
ord2755
ord4272
ord5679
ord2406
ord2559
ord5784
ord2606
ord858
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6017
ord6168
ord5869
ord5785
ord5790
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord3591
ord640
ord6190
ord323
ord2397
ord2088
ord2400
ord1172
ord538
ord2915
ord2004
ord3284
ord2112
ord3290
ord6150
ord2522
ord4360
ord4051
ord5467
ord4116
ord2381
ord5080
ord1703
ord1708
ord6051
ord4073
ord1768
ord4401
ord5230
ord2377
ord5157
ord6365
ord4347
ord5275
ord3793
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5058
ord1720
ord5244
ord2436
ord2116
ord5273
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3390
ord3825
ord3826
ord3820
ord3074
ord4075
ord4621
ord4418
ord3725
ord554
ord807
ord1143
ord3688
ord3621
ord3658
ord1634
ord940
ord941
ord942
ord3568
ord3614
ord5783
ord3566
ord4128
ord4292
ord2756
ord4197
ord5852
ord536
ord1633
ord5781
ord2444
ord2745
ord1192
ord537
ord472
ord4215
ord2576
ord3649
ord1637
ord5568
ord2914
ord6142
ord5879
ord1073
ord5856
ord1614
ord3981
ord5446
ord6390
ord2859
ord5436
ord6379
ord4158
ord4390
ord5237
ord6370
ord5059
ord5257
ord2438
ord3569
ord809
ord609
ord556
ord4270
ord4279
ord5286
ord5047
ord5977
ord3871
ord613
ord6871
ord289
ord2114
ord4155
ord6354
ord1088
ord6193
ord283
ord2371
ord2567
ord3397
ord567
ord5261
ord4370
ord4847
ord4992
ord2506
ord6048
ord1767

msvcrt

wcstok
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
_purecall
_wcsicmp
_CxxThrowException
??0exception@@QAE@ABV0@@Z
wcscat
strtok
strchr
strncpy
wcsstr
_wcslwr
wcstombs
_strlwr
strstr
sprintf
strcmp
strlen
wcsrchr
rand
strrchr
strcat
strcpy
wcsncpy
memmove
memcpy
wcscmp
_ftol
wcslen
wcscpy
__CxxFrameHandler
malloc
memset
free

comctl32

ImageList_GetImageCount
_TrackMouseEvent
ImageList_Draw
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_AddMasked
ImageList_GetIconSize

gdiplus

GdipGetPathWorldBounds
GdipGetFamily
GdipGetFontStyle
GdipGetFontSize
GdipGetFontHeightGivenDPI
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdipAddPathString
GdipDeletePath
GdipCreatePath
GdipDrawImageRectRectI
GdipGetImageHeight
GdipGetImageWidth
GdiplusShutdown
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawString
GdipSetTextRenderingHint
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdiplusStartup

msvcp60

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z

shlwapi

PathFileExistsW

Exports

Exports

WDGenRSAKeyPair
WDSignOCLDlg
WDTransInfoDlg
WDUIStopWaitForDeviceEvent
WDUIWaitForDeviceEvent
WDUI_ChangeUserPin
WDUI_CheckCertDlg
WDUI_MsgBoxDlg
WDUI_SetUserLogin
WDUI_SetUserPin
WDVerifyUserPin

Sections

.text
Size: 212KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/wdkmgr.dll
.dll windows:4 windows x86 arch:x86

1431b33174c78065acfb56f7d9a66cdf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

kernel32

HeapDestroy
FreeLibrary
GetLastError
LoadLibraryA
CreateEventA
GetVersionExA
WaitForSingleObject
ResetEvent
GetProcAddress
CreateFileA
CloseHandle
Sleep
DeviceIoControl
SetEvent
CreateThread
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetModuleFileNameA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
HeapCreate
VirtualFree
TerminateProcess
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
RtlUnwind
LCMapStringA
LCMapStringW
SetStdHandle
FlushFileBuffers

Exports

Exports

CloseWdDev
EnumWdDevPath
FlashDiskTransmit
GetWdDevInfo
Icc_Set_NadWdDev
Icc_tsi_apiWdDev
OpenWdDev

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/wdpkcs.dll
.dll windows:4 windows x86 arch:x86

b0b894d1a66739d5622b3688782c3210

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetForegroundWindow
MessageBoxA

msvcrt

sprintf
strftime
_strlwr
_initterm
_adjust_fdiv
strstr
strrchr
realloc
malloc
free
_ftol
time
srand
rand
localtime

kernel32

FreeLibrary
GetModuleFileNameA
GetProcAddress
GetSystemDefaultLangID
CreateFileMappingA
CreateMutexA
GetLastError
OpenFileMappingA
MapViewOfFile
CloseHandle
UnmapViewOfFile
WaitForSingleObject
ReleaseMutex
LoadLibraryA

Exports

Exports

C_CancelFunction
C_CloseAllSessions
C_CloseSession
C_CopyObject
C_CreateObject
C_Decrypt
C_DecryptDigestUpdate
C_DecryptFinal
C_DecryptInit
C_DecryptUpdate
C_DecryptVerifyUpdate
C_DeriveKey
C_DestroyObject
C_Digest
C_DigestEncryptUpdate
C_DigestFinal
C_DigestInit
C_DigestKey
C_DigestUpdate
C_Encrypt
C_EncryptFinal
C_EncryptInit
C_EncryptUpdate
C_Finalize
C_FindObjects
C_FindObjectsFinal
C_FindObjectsInit
C_GenerateKey
C_GenerateKeyPair
C_GenerateRandom
C_GetAttributeValue
C_GetFunctionList
C_GetFunctionStatus
C_GetInfo
C_GetMechanismInfo
C_GetMechanismList
C_GetObjectSize
C_GetOperationState
C_GetSessionInfo
C_GetSlotInfo
C_GetSlotList
C_GetTokenInfo
C_InitPIN
C_InitToken
C_Initialize
C_Login
C_Logout
C_OpenSession
C_SeedRandom
C_SetAttributeValue
C_SetOperationState
C_SetPIN
C_Sign
C_SignEncryptUpdate
C_SignFinal
C_SignInit
C_SignRecover
C_SignRecoverInit
C_SignUpdate
C_UnwrapKey
C_Verify
C_VerifyFinal
C_VerifyInit
C_VerifyRecover
C_VerifyRecoverInit
C_VerifyUpdate
C_WaitForSlotEvent
C_WrapKey
WDBuildAttribute
WDComputeNextTokenObjName
WDDeleteTokenObject
WDLoadTokenData
WDObjectCreateSkel
WDObjectFree
WDSaveTokenData
WDSaveTokenObject
WDTemplateUpdateAttribute

Sections

.text
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/wdsafe3.dll
.dll regsvr32 windows:4 windows x86 arch:x86

8a85370b0e868908b699d3a2729acd13

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
FindResourceA
GetVersionExA
ReadFile
LoadLibraryA
DisableThreadLibraryCalls
CreateFileA
GetFileSize
GetModuleFileNameA
GetProcAddress
GetStdHandle
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
CloseHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
HeapAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedDecrement
InterlockedIncrement

advapi32

RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_42)/wdsafe3.sig
$SYSDIR/$(LSTR_46)/DisplayKey.gif
.gif
$SYSDIR/$(LSTR_46)/DisplayKeyA18.gif
.gif
$SYSDIR/$(LSTR_46)/DisplayKeyA7-3.gif
.gif
$SYSDIR/$(LSTR_46)/Protectini.ini
$SYSDIR/$(LSTR_46)/RegTrustedSite.exe
.exe windows:4 windows x86 arch:x86

c54200f44e48cd946b6ce18f104be94f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d2:f7:75:51:8d:1d:84:37:31:f0:d2:f6:f6:fd:4f:f5:16:13:4e:3b
Signer

Actual PE Digest

d2:f7:75:51:8d:1d:84:37:31:f0:d2:f6:f6:fd:4f:f5:16:13:4e:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
DeleteFileA
FreeLibrary
GetStringTypeA
LCMapStringW
GetCommandLineA
GetVersion
ExitProcess
HeapFree
GetLastError
CloseHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
ReadFile
CreateFileA
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
SetEndOfFile
MultiByteToWideChar
LCMapStringA
GetStringTypeW

advapi32

RegSetValueExA
RegOpenKeyA
RegCloseKey

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/TokenMgr.dll
.dll windows:4 windows x86 arch:x86

07ffb2377771c9e0761870bbaa56b1f0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:fc:fd:1d:d8:08:d5:9c:6a:b2:41:1c:74:dd:f7:f5:8f:f4:80:c2
Signer

Actual PE Digest

02:fc:fd:1d:d8:08:d5:9c:6a:b2:41:1c:74:dd:f7:f5:8f:f4:80:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertCloseStore

winscard

g_rgSCardT0Pci

advapi32

GetSidIdentifierAuthority

user32

MessageBoxA

rpcrt4

UuidCreate

hid

HidD_FreePreparsedData

setupapi

SetupDiEnumDeviceInfo

msvcrt

memcmp

kernel32

GetVersionExA
GetVersion
LocalFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Exports

Exports

HIDCloseDevice
HIDEstablishContext
HIDGetSlotList
HIDGetTokenDevPath
HIDGetTokenDevPathEx
HIDGetTokenLabel
HIDOpenDevice
HIDOpenDeviceByDevPath
HIDOpenDeviceByIndex
HIDReleaseContext
HIDReset
IsHIDKey
NDCloseDevice
NDEstablishContext
NDEstablishContextEx
NDGetSlotList
NDGetSlotListProduce
NDGetTokenDevPath
NDGetTokenLabel
NDOpenDeviceByDevPath
NDOpenDeviceByIndex
NDReleaseContext
NDResetDevice
NDTransmit
PC_AddPinToCacheEx
PC_CreatePinCache
PC_GetPinFromCache
PC_ReleasePinCache
PC_RemoveAllPinFromCache
PC_RemovePinFromCacheEx
PC_UpdatePinToCache
SCardAPDU
SCardAppendRecord
SCardChangePin
SCardChangePinOCL
SCardComputeDigestMAC
SCardCreateDF
SCardCreateEF
SCardCreateFile
SCardCreateFileEx
SCardECCExportSessionKey
SCardECCExportSessionKeyEx
SCardECCExtAuth
SCardECCPriKeyDec
SCardECCPriKeyDecEx
SCardECCPubKeyEnc
SCardECCPubKeyEncEx
SCardECCSM3Hash
SCardECCSign
SCardECCSignEx
SCardECCVerify
SCardEraseDF
SCardEraseEF
SCardExternAuth
SCardGenerateECCKey
SCardGenerateExchangeKeyWithECC
SCardGenerateRSAKey
SCardGenerateRSAKeyOCL
SCardGetChallenge
SCardGetFreeSpace
SCardGetFreeSpaceEx
SCardGetGmKeyType
SCardGetKeyLifecycle
SCardGetPinStatus
SCardGetRetryTime
SCardGetSerialNo
SCardImportECCKeyPair
SCardPubKeyEnc
SCardRSAPriKeyDec
SCardRSASign
SCardRSAVerify
SCardReadBin
SCardReadBinEx
SCardReadFixedRecord
SCardReset
SCardSelectFileByID
SCardSetKeyToUserStatus
SCardSetSerialNo
SCardUnlockPin
SCardUnlockPinOCL
SCardUpdateBin
SCardUpdateFixedRecord
SCardVerifyPin
SCardVerifyPinOCL
SCardWriteKey
SCardWriteKeyDESMAC
SetTranSignFlag
TransPIN
UDKCloseDevice
UDKEstablishContext
UDKGetSlotList
UDKGetTokenDevPath
UDKGetTokenLabel
UDKOpenDeviceByIndex
UDKReleaseContext
UDKReset
WDCryptGetParam
WDCryptGetString
WDCryptIsCompatible
WDCryptIsSupportedReader
WDGetLoginUser
WDGetP10ProtectKeyStatus
WDGetPrefixByTokenName
WDGetTempCertDIR
WDLock
WDSCardAddPkcsObjectFileId
WDSCardAddRSAKeytoContainer
WDSCardAuth
WDSCardAuthEx
WDSCardAuthMF
WDSCardChangePinHardware
WDSCardChangeSOPin
WDSCardChangeSOPinGM
WDSCardChangeUserPin
WDSCardChangeUserPinGM
WDSCardChangeUserPin_EAL
WDSCardCloseFile
WDSCardConnectToken
WDSCardCreateFile
WDSCardCreateFileExEx
WDSCardCreateRSAKeyFile
WDSCardDelAllPKCSObject
WDSCardDelCertInContainer
WDSCardDelContainer
WDSCardDelFile
WDSCardDelKeyInContainer
WDSCardDelPKCS11Object
WDSCardDeleteAllOldCerts
WDSCardDeleteCertFromDiskAndIE
WDSCardDeleteOldSKFCerts
WDSCardDisconnectToken
WDSCardEncodeSignDataEx
WDSCardEncodeSignDataExEx
WDSCardEnumContainer
WDSCardEnumSKFContainer
WDSCardEraseAllFiles
WDSCardEraseEccKeyFile
WDSCardEstablishContext
WDSCardGenContainerName
WDSCardGenECCKeyThreadProc
WDSCardGenP10ThreadProc
WDSCardGenRSAKey
WDSCardGenRSAKeyThreadProc
WDSCardGenRandom
WDSCardGenerateTokenSN
WDSCardGetCertCount
WDSCardGetContainerName
WDSCardGetCreatedFileNum
WDSCardGetCurrentFileID
WDSCardGetDeviceName
WDSCardGetECCKeyIndex
WDSCardGetFileID
WDSCardGetFileIndex
WDSCardGetFileSize
WDSCardGetFileType
WDSCardGetInvalidCertCntAndContainerCnt
WDSCardGetKeySetInfo
WDSCardGetProvName
WDSCardGetPublicKey
WDSCardGetPublicKeyNum
WDSCardGetRSAContainer
WDSCardGetRSAContainerFromCertindex
WDSCardGetRSAKeyIndex
WDSCardGetRSAKeyType
WDSCardGetRSAKeyfromContainer
WDSCardGetRSAKeyfromContainerEx
WDSCardGetReaderName
WDSCardGetSlotList
WDSCardGetSlotName
WDSCardGetTokenATR
WDSCardGetTokenHandle
WDSCardGetTokenInfo
WDSCardGetTokenLabel
WDSCardGetTokenMaterKeyType
WDSCardGetTokenSN
WDSCardGetTokenStatus
WDSCardGetTokenVersion
WDSCardGetTotalSlotList
WDSCardGetVersion
WDSCardImportRSAKeysToCard
WDSCardImportaAsyKeysToCard
WDSCardInit
WDSCardInitEx
WDSCardInitializeAdminKey
WDSCardNewContainer
WDSCardOpenContainer
WDSCardOpenDefaultContainer
WDSCardOpenFile
WDSCardRSAPrivateKeyDecrypt
WDSCardRSAPublicKeyEncrypt
WDSCardRSASign
WDSCardRSASignData
WDSCardRSASignEx
WDSCardRSAVerifySignature
WDSCardReadBin
WDSCardReadCACert
WDSCardReadCert
WDSCardReadCertEx
WDSCardReadDevInfo
WDSCardReadDevType
WDSCardReadFile
WDSCardReadFileEx
WDSCardReadPublicKey
WDSCardReadPublicKeyC
WDSCardReadPublicKeyCEx
WDSCardReadPublicKeyEx
WDSCardReadSerialNoC
WDSCardReadShortCutLoginStatus
WDSCardRegisterCert
WDSCardReleaseContext
WDSCardReleaseContextEx
WDSCardReset
WDSCardSM3Hash
WDSCardSM3HashGM
WDSCardSM3Sign
WDSCardSetAllCertsToOldState
WDSCardSetAllPKCSObjectToOldState
WDSCardSetCertState
WDSCardSetLanguage
WDSCardSetNextFileID
WDSCardSetSKFCertsToOldState
WDSCardTradeAccountHardware
WDSCardTradeAccountPwdHardware
WDSCardTradeAddCodeHardware
WDSCardTradeAmountHardware
WDSCardUnblockUserPin
WDSCardUnblockUserPinGM
WDSCardUpdateAdminKey
WDSCardVerifyPinHardware
WDSCardVerifySOPin
WDSCardVerifySOPinGM
WDSCardVerifyUserPin
WDSCardVerifyUserPinByCache
WDSCardVerifyUserPinEx
WDSCardVerifyUserPinGM
WDSCardVerifyUserPinHardware
WDSCardVerifyUserPin_EAL
WDSCardWaitForSlotEvent
WDSCardWaitForSlotEvent_Ex
WDSCardWriteBin
WDSCardWriteCACert
WDSCardWriteCert
WDSCardWriteCertEx
WDSCardWriteFile
WDSCardWritePKCS11Object
WDSCardWriteProvName
WDSCardWriteShortCutLoginStatus
WDSCardWriteTokenInfo
WDSCardWriteTokenLabel
WDSCardWriteTokenSN
WDSetExitWaitEvent
WDUnlock
|{Me*R��wS�A�K�� \�[|`��Wo*n�ض��\�q+=��0��UXW�/��3FT�34�UI'�Q�ϧ#a):��(M��P�s��ӄ[!��e5�Ә$@�媐��J/�p��3�ԝ��,I��AC��XC�K�z� ��\/\fM�S!��4:�/V��R8B�E>4e�6�'*�,�Z�9�`2ޥ-Vj'�?D= @�^`!�o��qvq^�Ks,��a��-.��*��-z��D�M!�[��446��ȡн�ozN�;�Vy_�P��9� L��n�6o��)��Ml��ĹcU�d*%��M~@��o� � ��l(�XAq��w�XD��}2z�>#�m��,�y��T�!�#��1*o+Ύ��M:\k屃�?�Mn4�'�v�N�=y]�G~��|)�0�,�Vz[ښL��gx��Cٹ�3F��,��rRƴ�~�E��nҍ ��3�P.��Eӻ�<�E,Zռ��ضe��NYǓ6��fTfGQ��)�YpwIe��n��(�۾��%�0�3��{\/|l��L�$�=��W�8��/.��S��}>'�M��']��wHRa�z��J��u�KG群�97C� CgR�l��bI��&�x<�]��V��o�H��5�{�$��d^Ԑ١7�@�H�Ϣ��*�N^��̎8 xiG!�3c�VPnDg��; }rq��ѡ�!��!�+��cA��<C��<>l2�7&}1*�/��{��7�Qˠ��c v�I_V��6UɰE$��#�V2��1��\D̖Ď��Ѩ��0�j��;/&�q�-�� lLv9I��[�F��φF��_0��;x8p��I(g��sW =ŉ��d�dM��H�<f۞W�R�įi}X;&�.�c�r9hOس1��%��p��Ҽ(a�Ӏ�J+�G��y�5�g 釿�jy|��Uѝ�?��6�%��E}9��7��rS��t�O�.5rg��1b�S��%�¬��7��X}�uy�]�)%K�V��Wо��A�X��L��j%XA�@��C�c64A.3��&��b�� i��ֺ�@إ"{��iM� �l� |��x�R��[��׳$,��I:p�ҿ�PG��1��֣�`5aC�IE �}E)ȧ��I��]�e� P��b5<o.�{aבKa�M yTA�3 �B.�"�%�<X��Y�I��q��i8,��伜F/횩��F��[��zC0��5�nS�z�ֶ0Urɽ �ʐ�<��r_��m�(��X&�z��~�cn4��&��:�8.,y��_� }~֍�0 n ��X��,�6��E�"(��x�@`G��?��c�<�}~9h��ܛ�A��e�e�N��dU?bN]$��Ru�j&(��{2+��*��&1��fx��{ Jlu�fO|9Aq��d��aF�c�p&� �\l��7��S��V��\cN��#�r9�q�W��f`��x=��h��%�zX�T�L�p��!VIg�<Ԇ*��E��yǃog*z!�Ks`0��X�QXaK�u�W�/qo��̂�xt}��1�n��`y��2E�y-M�>��7~tF=�b%=ͮ{Y��y@|x��s[��WɚM��lՅ#5N�l��\�� ʳ�so��+Ug��?�wQ��X�3��Cܮ+r�j�'��Z.ܠil��q�c��(��p��:dZ1�tlҞ��N�t��]֋ڀ #B��jy�DM��M��ǝM� !��zN��55N��a!��9ˤI\0 �;��mY��$��2�z~� 4 Kh0;Z�變�fd��5 �jz��$G��4�΋��1,�M��q��I�r#;G�^Q__p��0�#��~L��Lc�m�pf�a��,Q��3z��rĄ��9ܾ7!��E��:O=A38�h�mN��h_��b3Խ #Ђ}11%��Q�h��q��(��o]o��)��?* �1��Cg3?vϺ[�g7d�;��eZ�s�ɗ(�_�q��5�i�4�K2��,֘=�(�md%;��lb��c�U�� Rs�(�n=e�nW��;��넅z�F��\��ø�M9i��$,�I*7:��Z��)�_cn��iEU&��Z��3�B9�n5G�m��v��~3��4��0��0�(Qd�Votd��j*{��a:��` kgY��7e.��H�7�hz�c$d��B��]� Θ'w�Fق��N�L>f�f�� 5�%>?�:皾�Tbl+�V�G��{��L��d]NsF��ԫ2L�o.LH�]�ڲ�{j�Å'��2�-:�ђ��0��̓��=��#��$!vi��?��$�ӈ��f�� X��g��x[�:�N�>N{��ak�2�<$!�Њ�|~*�"s��K��)��e��^+/�{�Aug�As��n�b�ʱ��dS�i�n�`c�S �*J�� XT��E+U�L�9�򎁝Au,O/��:[ �ٸ��.Y?��r��j�[�`�Va�T7�s��ҡ,��[n1�w��>��%��@��bd�?��~*l��zJ'�8i �(S1�5��]}z�7�n��i�\��:C��]��1�F|�*��m��INA��F��!��n�E��O3��pk]��o`}5��A�E5��x�)��47�tf� R�[J]*��%�^�1��v��)�7��<� �3��1�[Jh�K��\�w��Q�a��\$ |&X<{�>A��,��Cl�8��7�m��JC�޷U��8ʝMv�[J��Ra��f9��6x�F�!��~�I[��]T�i��Z�RYpy�t�"6��m<��ыxoެQ��[q`�c��`�0�?V�6�U#Oj ��4��"��Cm˱J*-��M��wS�3�X��Q��\��F��#zv$�xT��

Sections

.text
Size: - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 284KB - Virtual size: 283KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/WDAlg.dll
.dll windows:4 windows x86 arch:x86

06fb6973fee0bff9e0b4b11ebe4a91ba

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7d:75:e5:79:e3:aa:69:1f:a3:e1:00:fc:0a:e7:4a:b8:ac:ca:36:2d
Signer

Actual PE Digest

7d:75:e5:79:e3:aa:69:1f:a3:e1:00:fc:0a:e7:4a:b8:ac:ca:36:2d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertFreeCertificateContext

ole32

CoTaskMemAlloc

user32

MessageBoxA

shlwapi

PathFileExistsA

kernel32

GetVersionExA
GetVersion
SetHandleCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Exports

Exports

Compute_d
WDAlgPriKeyToCard
WDAlgPriKeyToCardPubKey
WDAlgPubKeyToCard
WDBlockDecrypt
WDBlockDecrypt_CBC
WDBlockEncrypt
WDBlockEncrypt_CBC
WDCardPriKeyToAlg
WDCardPubKeyToAlg
WDComputeDigest
WDComputeDigestEx
WDDelCertOnMyStore
WDGetDatefromCert
WDGetIDFromCert
WDGetIssuerfromCert
WDGetSubjectfromCert
WDIsCertOnMyStore
WDPrivateKeyBlobToAlg
WDPublicKeyBlobToAlg
WDRSAGenerateKeys
WDRSAPrivateDecrypt
WDRSAPrivateEncrypt
WDRSAPublicDecrypt
WDRSAPublicEncrypt
WDRSAPublicEncryptPKCS1
WDRSASignData
WDRSASignPKCSBlock
WDRSAVerifySign
WDRSAVerifySign1
WDRSAVerifySignedPKCSBlock
WDRegCertToMyStore
WDRegRootCert
WDRegUserCert
WDRevMemCopy
WDSCardEncodeSignData
WDSCardEncodeSignData1
WDStreamDecrypt
WDStreamEncrypt
WDVerifyMac
bTZ `�?��'��+��!�j��ʧ�|�=5�xt�N�|��Nn�.L�)�@ڬ��Y�r��F��O�Lm iz�M�3U%1�D1ĕ�8>h�z@t�#�<*�u�Kj�5(��B7m�j��f@5�0Lvi�X�[J�_cH� 3Ɵ2�cv��ÄӼ��Ẑ�H�O�� hz��E�%�a(��|&�fd�)��0�t��ӄ��#��F��YjY3o�l\z�UuZi?� .��^��PC��a\�'��w8�&}X�װ/K%8��aQ�r��$.+��>�ɁુG��/M�_3�2N�mX!?��YI?0q=덏�ף|��x��8=�>u��ʀ��ū|�C*v��\��;��~/Z2U�[h�`gy>V�~d�%}{-�[nrpdSU�ۿ_ �~^�>1��%*Gי��U�VȯP�?��SH֩�ma.ب��z��۰��04򽒹"&��c�Ӽo��J��d�=ꯦ�(�w��Y(��NƊ(lML��=QM蝭Cq��O��QT�r|E��A�+��N"H��%v䕵��̹� �L �jF��i��΅�ۑ()~h��8��VY�"��؂A7(5$�f�?��X��g��ʼ�� n��K��S��;;Cu��s[8N��:��id��7M:.h��珫�u�V��v��M��]FwzP,A��4�D%�9;��l�<��BjO��!��F�#�| S�z�X�?�u,�wҢE��7V�/��*K�a��rC܇�[�(��!=3^�!��gǵQ�ڴ1p��&� A��MɎ�,��E ��;Z�ltP�8U߁iE��6(��;Q�� J��y��8�w{� ��720��v`��U4R#t�\��Gd�kn'U�,�1"��t��ԗ3m��oɇ�αF��l��X"�spd�4F�W�˂��S.{��,��@T��t��ˋ�\�R�H�A[sD��D��7�a��u�q0��x�0�c�`]L�_s$#�a]�͓lj��z:gp�U}2��8��L�\y��G�ŀ3ۢ`�`�̀Q"Y�N�G�H<�p3�G�w��lU�%I��9��*,�>�~\j��H�neA`3e{��2Ԧ��鏮�oX�E'گ,2�MB��Z_�1��ۿ��N2�4�M�a#f�=�j�Q缈��[�v�j1`��7��:ػ��%�L��,/�}�K�Y=��údN��`�t#.QdHKX��lWrg��VLeG!�R�qU�A%��Ƌ�:�?�p-��µ��0��A��os��8㡊H��<��i�Vi�`GM2��<�$��kIG�p��|��/gX��e� �gm��c�<�)]�㔋� [�wQ!H��a9�s~Y~��Dw�Z�Ls��&t�e�EW@4��~z�j^�V�ݦ?q�D'bf�o�RjHM53b��0z�qubc��SWt2s��rQm��t��%��,�R��h��R�<i3��Q�+7�8 ��9��1J�m�02�tXa?rѹ��Ĉ��)��B>YJYm�N�{�4I�e��~�>�fĖ��'�,�a��c�/hk�bw�� 󷀉�y�56*?|�gEd��c�>�_��x��=��v��<zz��yԐ=*d��a��ԙ��tC(�!�G�@�ܝEJ�@��{��@Rܷ]S �[��e!`�� K=��[�Nʂ��u��E�-s�aR��< H��n3� ��s6�U��L�;��1�Y��$G)��r՝ ��I��s��v� ��]�n��UA�m&/��&Bb�Z�1Jv��\DGZ��T�;_��ZN��\5˞��jCf��5�ҭ*��.��i�l�<eC-Cpb�y�Y&�D��w��s��Y筳Wu><m�|U��,�$,M��C�r��hfj��3_C|6��T��v��u�}��^�'*e��4�zg��6va �t5A�APZu�D��2 \��wB��"�iڂ��5%�3{�;�E��I 9}��L�kJ��߈�X��LQ��K�mdv�R��I�Ө@��8F��:�"�n�H|(�WT��9I��PG`(�`[L�I�O��0��wCx�a��:i�O�]��$4e��$�tooD��d��)[�H f��k6�n��{�[(� �,-�G��E��R��$�Y$v!&L]��t/��h.��8V�ӒR�]�l��4o-�9��4O�4�*��"�d��뱷~D��_)c7��gE��K�'kn�Ç�r�Hl17`i_5��K\�W��)��(!�Wſ¸�gK?r]�*�d�--��_z�I�m��6䠩��ARuSSȏjI"��N��a��Ya�dфv��ӟ`�n��|f�f��t��ö��퉌Tv8��ͻ"K�H�.��1=E]�ʗk= �/��+� P��M�[q��Gշ��pm�B"g@x$ѵߢ�٣�X^�&u5�+�CX��=d��T1�i�;��]��t��K��sNm��8�y9$�#� .6H}�[[�=��RZ�]�2�ü��ɂ�q�(0̃6�C��EW�G��F�ftA��(Ӽ(��MruC38i<0�7UZ��F�(��7��p�E+@uZ�,��{�a0Y�)�cۂ��b ��ޕa��_��p?s�kM��/-{Կu�FT��#Q��)>RrI�O��B�NE�C�wDu�Sp��%p%"I��.-��X��b�]23�̹+�V�V�C��.��8�B4��dDޅ��gu�02��/��&�<�L�p>��R,f�d��7Mc sy~�v��>N��E��[�!�N��A� �ǯL1�� ͅx2.n��
rdtsc_call

Sections

.text
Size: - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/WDCSP03.dll
.dll windows:4 windows x86 arch:x86

16ad8dcdb560c9d095efbb7348379f83

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c6:5b:ef:db:95:fc:13:0f:34:58:dd:ca:a1:9c:bb:ec:05:8f:04:0b
Signer

Actual PE Digest

c6:5b:ef:db:95:fc:13:0f:34:58:dd:ca:a1:9c:bb:ec:05:8f:04:0b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

CryptReleaseContext

rpcrt4

RpcStringFreeA

user32

RegisterWindowMessageA

crypt32

CertCompareCertificate

msvcrt

free

kernel32

GetVersion
GetVersionExA
FindFirstFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Exports

Exports

WDAcquireContext
WDCreateHash
WDDecrypt
WDDeriveKey
WDDestroyHash
WDDestroyKey
WDDuplicateKey
WDEncrypt
WDExportKey
WDGenKey
WDGenRandom
WDGetHashParam
WDGetKeyParam
WDGetProvParam
WDGetUserKey
WDHashData
WDHashSessionKey
WDImportKey
WDReleaseContext
WDSetHashParam
WDSetKeyParam
WDSetProvParam
WDSignHash
WDVerifySignature
�W��"�0��+�%�A��]��~�QN/"��:N`��F��|��+��2(��B��*'M�A��pt�h(�u4��hqc�9��'鋰��L��8"'�SKh��ד&�{*�^�2@��n�뢘�VK��ET�S:��hB��5OZ�?GN�?��Q�.3��ɛ��0��!�s��9�>��H��PX��r1�sH�8�xP�� ے�f2��"PJ}��'�B��.�ʳȒ�{�Y��{[Շ�.U��K�V�$-{�#)��<O� p�T��?��4�*��M<r�4�c��_��]Q#^x��9�>�n��B��^>�L�k-e>nKF[��8�v�A�O7��a�dD1�!�yg�0��!�00,��@��VM�}IR�<��꯱�=,1��p-��l �A }0A{ޤ�ȹpa�6��[��>��eW,p�4~A�G�=��@��^��N��q�:�+�M�R�V�-��ĶMdbOL�띉A��B��G��;�q ۂ��@<\ǵ-g�o�/o�(��g6z �QǛLnR!Sx;��tX��c��r�O�Ro5iC+��[�S��h7 g��[y��(tL��u`�~&r��c��?��s�o��p��n��*��ll˞N�S�w�2.��#�nl8G��sGlq��T0�`��|�x�χ��:=��(�{̴�R*�+��aD�܇tlʬd{)Ր�؎��C��R'aX�.�=��:22P}�T�~"*�}>�V��s��̼JT�� z��,!�3�0WaAC0� �UL+Ȩkxϑ}��J6Z[�� Ag��Le��U��S�pO�&��x��D�;,��-�b�*�d�=o�s�%*s1ȼ��~4�6��J�s��zgؗe9��z��6 RId>��T�)z"�/A�G�T��l�ۋ$�]Q`�V�� :�1c�e��\��-;��RjD0SLX��໾��P��@�t=}��c��f.!Z��%�T�H��+S�-��Ynk��#�a �-Ĕ��;�焖�2��y�0��+3��!JD_�>Mxz��>��F|3NX�KS�@�fm�J�3[%~_'��t�w��ؘ��S`�S�,�J��A��B��ڄ��q��G��.c��Kq��!��O��;]�q��rG]�5��35��s�kƆ��O�L��c-�ܶ�Ě䤽j|J�߀A!n��͎ð&:gnN�2;�8.�7��_�&X��߿R�V��I�)��[s��//�� #w�f�[�,��|��0.�<EͲS�&*}�eMJlb�a(��s��mq�FY� u�;ة��z��#�� I/,�^��R��*�Y,`�ubOuo��P8�ϑڠ ��Aǳj�^r�+�%.OyЏN5��)��O��tu��ȟ�N��bO@�|��t@��6bv��t�$��-8fn)̅7;9ƹ�j�2E�E=Hs@pOȹ?52�B`9��r�y�4��A�4�pА뾪�g{�d "ŷE�ey�JIg��d�ޗ6M�MGw��E��d�«��g<z"��2>�v��$p�v�p�{T��]r_T�� _�y�Mȑ��ד��V>bT�f��<��yg��¶�PI�\�CD$z^�jae|�9P�-⇌��F��ۊ�S'��/�m�<_��kn�!� @FIQ��:�r|Ŭ��B�H��D�L��.��ҿ��{�"�/Wd΁ ��M��9s�yY��{?�y �jc��o��?hqv�7LT��GU>0C̉MJw yV=�ݡ�m�]�NjE��If/Y䜑�QQ��qm��R. (cxN��Ξg�Yi��>��%ݠ�<�딭cMQ��#2�!K�G?}*�Gd��tx��/��eL��ƗR'�5K��"��2W�8�5iF��$�- Sw$��?��4��kD��{��x.�V!I��\6H�w+�:C�l�q��b��V��N�X�Kz0up��祐��F�^��у�8��p��7��q�SWz�l��S��u�'Ӈ��,�6n��w"�=p�(��-��X>p&��v7AyF�%��[��H��<ڪx9��sP�"��o�.׫��iU��Q-��?�'�L��_��P3�� T�^�'��Ӣ�u �ŋMzx�]�J��>�-��O 6��2�q-,IJfO|��'.<{3�v��8Yi}u^��kW֍Ϩ��lg��yK��D�%�"��8Ld��`/�%qs1�N>Da6�B��7/H%��ŧ�v�. O�4��1x��f�]�Fz��Z��D�}wq��܄5��lDھ�G��ѩ'ܑ��ʛ�T��1+O܀��<�"�Ao5"��3�qI�î�<M/q��ۿ�lh�R~e�1U�ji=c��"�Ҝ�<xZX��e�{Sn �M�UL�8ʎD�E��N��Sn ��OlL�fC��K��o�b��̜T/Qd �q�$D�?�o��p��7;��9�i�y�c�Y�G=��a�[lu2��U��BR�Z�;MXl��9��^��y��/�`�� b��lc��t��|DM!fo<��c��'��w dˈ;�W��{��N\ѢX#>B9�I0ILD��}gdrGs��"��ߌ��9d�� Ő�h>��at�Kd�ŋ1K��>�~�R#_d�[<�:B��΁r��Zȅ�/�:P��mn�p%>��%t`Q��S�:�V��ZH�̎r��wU"��k��i��J9wǇ�]hOQ�ՏL2̾HW��%��紘��^75�R�`Ѫ(;��?1�

Sections

.text
Size: - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 176KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/WDCertM_CCB.exe
.exe windows:4 windows x86 arch:x86

11ba1073ea1d947846b72cfe3374c147

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:76:21:4d:52:21:c0:95:c4:1d:dc:56:73:1d:32:4c:b8:fb:c5:07
Signer

Actual PE Digest

73:76:21:4d:52:21:c0:95:c4:1d:dc:56:73:1d:32:4c:b8:fb:c5:07

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winscard

SCardReleaseContext
SCardListReadersA
SCardEstablishContext
SCardGetStatusChangeA

shlwapi

PathFileExistsA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

mfc42

ord4424
ord3738
ord561
ord825
ord815
ord800
ord641
ord2514
ord540
ord2621
ord1134
ord2725
ord5265
ord4376
ord4853
ord4998
ord4710
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4622
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord4234
ord1146
ord1168
ord6215
ord4160
ord2863
ord1768
ord2864
ord2379
ord6453
ord4220
ord2584
ord3654
ord1576
ord1644
ord1175
ord3663
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord4673
ord4353
ord2438

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_strlwr
fopen
fclose
_strupr
__CxxFrameHandler
_chmod
malloc
sprintf
free
strstr
strrchr
_strcmpi
_setmbcp

kernel32

EnterCriticalSection
InitializeCriticalSection
FreeLibrary
LoadLibraryA
GetProcAddress
GetModuleFileNameA
GetPrivateProfileStringA
LeaveCriticalSection
GetModuleHandleA
DeleteFileA
CopyFileA
CloseHandle
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
GetLastError
CreateMutexA
Sleep
GetVersionExA
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateDirectoryA
ReleaseMutex
lstrlenA
WaitForMultipleObjects
ResumeThread
SetThreadPriority
CreateThread
GetWindowsDirectoryA
GetCurrentProcess
lstrcpyA
GetStartupInfoA
DeleteCriticalSection

user32

GetDesktopWindow
RegisterDeviceNotificationA
SetTimer
KillTimer
TrackPopupMenu
ModifyMenuA
GetSystemMenu
GetCursorPos
GetSubMenu
LoadMenuA
EnableWindow
FindWindowA
LoadIconA
AppendMenuA
SendMessageA
LoadStringA
SetForegroundWindow
PostMessageA

advapi32

RegOpenKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
RegSetValueExA
RegCreateKeyA
RegOpenKeyExA
RegQueryValueExA

shell32

Shell_NotifyIconA
ShellExecuteA

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/WDEvent.dll
.dll windows:4 windows x86 arch:x86

8c596ec44e71b02d367053257ab68880

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:f8:0a:29:62:f1:de:b7:8a:5a:88:89:67:37:f8:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-11-2015 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:4c:43:c6:70:0e:4c:81:c9:44:2b:63:01:18:c7:57
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-01-2016 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9d:a5:d7:fc:a7:3a:7a:19:03:bc:73:35:7c:26:62:20:83:d3:00:2f:9d:07:8e:3a:33:d9:be:71:dd:bb:72:c4
Signer

Actual PE Digest

9d:a5:d7:fc:a7:3a:7a:19:03:bc:73:35:7c:26:62:20:83:d3:00:2f:9d:07:8e:3a:33:d9:be:71:dd:bb:72:c4

Digest Algorithm

sha256

PE Digest Matches

true

d3:10:f7:33:c2:67:17:dc:65:ec:b1:3e:18:b6:f9:30:76:da:11:bb
Signer

Actual PE Digest

d3:10:f7:33:c2:67:17:dc:65:ec:b1:3e:18:b6:f9:30:76:da:11:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertEnumCertificatesInStore
CertCompareCertificate
CertDeleteCertificateFromStore
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore
CertCloseStore
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertCreateCertificateContext
CertGetNameStringA

mfc42

ord3922
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord1243
ord342
ord1182
ord1577
ord1575
ord1176
ord1116
ord800
ord2725
ord3953
ord6467
ord1168
ord815
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord825
ord823
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord5933
ord920
ord540
ord1197

msvcrt

strrchr
strstr
_stricmp
_CxxThrowException
wcslen
sprintf
mbstowcs
_strlwr
__CxxFrameHandler
_ftol
_strupr
??1type_info@@UAE@XZ
__dllonexit
_adjust_fdiv
malloc
_initterm
free
_onexit

kernel32

WideCharToMultiByte
LocalAlloc
LocalFree
UnmapViewOfFile
DeleteCriticalSection
CreateFileMappingA
MapViewOfFile
InitializeCriticalSection
GetPrivateProfileIntA
GetPrivateProfileStringA
CreateThread
Sleep
GetLocalTime
FileTimeToSystemTime
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
InterlockedDecrement
GetSystemDefaultLangID
SetThreadLocale
DeleteFileA
WriteFile
FindFirstFileA
ReadFile
CreateFileA
FindNextFileA
FindClose
CreateProcessA
GetLastError
GetCurrentProcess
ReleaseMutex
CloseHandle
CreateMutexA
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetVersionExA

user32

SendMessageA

advapi32

RegCloseKey
OpenProcessToken
RegSetValueExA
RegCreateKeyA
RegOpenKeyA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
LookupPrivilegeValueA

shell32

ShellExecuteA

ole32

CoInitialize
CoCreateInstance
OleRun
CoUninitialize

oleaut32

SysFreeString
VariantClear
GetErrorInfo

wininet

InternetSetOptionA

Exports

Exports

DeleteInstallCert
InsertDeviceEvent
RemoveDeviceEvent

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/WDKeyMonitorCCB.exe
.exe windows:4 windows x86 arch:x86

e0198f6cd30139598f16aa9cf186bb84

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:f8:0a:29:62:f1:de:b7:8a:5a:88:89:67:37:f8:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-11-2015 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:4c:43:c6:70:0e:4c:81:c9:44:2b:63:01:18:c7:57
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-01-2016 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:78:13:b5:02:bd:1d:3b:b6:7a:80:21:a9:d3:d9:1f:8b:cb:ca:fc:a1:be:6e:1a:08:07:d2:00:27:2f:2e:40
Signer

Actual PE Digest

67:78:13:b5:02:bd:1d:3b:b6:7a:80:21:a9:d3:d9:1f:8b:cb:ca:fc:a1:be:6e:1a:08:07:d2:00:27:2f:2e:40

Digest Algorithm

sha256

PE Digest Matches

true

14:4a:93:c9:f1:3f:6c:35:58:e7:e0:bd:e1:76:31:b0:c6:26:61:e7
Signer

Actual PE Digest

14:4a:93:c9:f1:3f:6c:35:58:e7:e0:bd:e1:76:31:b0:c6:26:61:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateMutexA
ReleaseMutex
lstrlenA
FindClose
SetLastError
FindFirstFileA
lstrcpyA
FindNextFileA
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
MultiByteToWideChar
LocalFree
FileTimeToSystemTime
FileTimeToLocalFileTime
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcpynA
GetVersion
LocalAlloc
TlsAlloc
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
lstrcmpA
GetCurrentThreadId
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
lstrcmpiA
GlobalGetAtomNameA
lstrcatA
GetProcessVersion
GlobalFlags
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
GetCurrentProcess
SetFilePointer
FlushFileBuffers
GetFullPathNameA
HeapAlloc
HeapFree
ExitProcess
TerminateProcess
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetTimeZoneInformation
GetACP
RaiseException
HeapSize
HeapReAlloc
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetDriveTypeA
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetSystemDirectoryA
GetVersionExA
GetModuleHandleA
GetLocalTime
OutputDebugStringA
GetLastError
FreeLibrary
LoadLibraryA
GetProcAddress
CreateFileA
Sleep
CreateThread
ReadFile
WriteFile
CloseHandle
GetModuleFileNameA
GetPrivateProfileStringA

user32

GetForegroundWindow
GetMessagePos
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
GetDlgCtrlID
GetDlgItem
GetMenuItemID
GetSubMenu
GetMenuItemCount
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
SetWindowPos
SetForegroundWindow
SetWindowTextA
GetSysColorBrush
ReleaseDC
GetDC
GetClassNameA
PtInRect
ClientToScreen
DestroyMenu
TabbedTextOutA
GrayStringA
GetFocus
GetNextDlgTabItem
GetKeyState
CallNextHookEx
PeekMessageA
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
EnableWindow
UnhookWindowsHookEx
RegisterWindowMessageA
SendMessageA
GetWindowTextA
EnumChildWindows
FindWindowA
GetWindow
SetWindowLongA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EndDialog
DefWindowProcA
DestroyWindow
DialogBoxParamA
BeginPaint
GetClientRect
DrawTextA
EndPaint
PostQuitMessage
CreateWindowExA
ShowWindow
UpdateWindow
LoadIconA
LoadCursorA
RegisterClassExA
PostMessageA
LoadStringA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
RegisterDeviceNotificationA
EnableMenuItem

advapi32

ControlService
RegEnumKeyA
RegSetValueExA
RegEnumKeyExA
RegDeleteKeyA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
DeleteService
QueryServiceStatus
OpenServiceA
CreateServiceA
ChangeServiceConfig2A
OpenSCManagerA
CloseServiceHandle
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA

comctl32

ord17

setupapi

SetupDiGetDeviceRegistryPropertyA
CM_Locate_DevNodeA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
CM_Get_DevNode_Status
SetupDiEnumDeviceInfo
CM_Reenumerate_DevNode
CM_Query_And_Remove_SubTreeA
CM_Get_Parent

shlwapi

PathFileExistsA
StrStrIA

winscard

SCardReleaseContext
SCardFreeMemory
SCardListReadersA
SCardEstablishContext

gdi32

ScaleViewportExtEx
SetViewportExtEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
GetDeviceCaps
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
ScaleWindowExtEx
SetWindowExtEx

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/WDSKF.dll
.dll windows:4 windows x86 arch:x86

869e99896d1d2c777310a32220c631b7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:aa:ed:69:88:59:db:5a:d8:1f:7f:4b:85:03:19:6d:47:d7:9a:dd
Signer

Actual PE Digest

1d:aa:ed:69:88:59:db:5a:d8:1f:7f:4b:85:03:19:6d:47:d7:9a:dd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
HeapFree
HeapAlloc
RtlUnwind
HeapReAlloc
RaiseException
HeapSize
ExitProcess
TerminateProcess
GetACP
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GetOEMCP
GetCPInfo
GlobalFlags
lstrcmpA
GetProcessVersion
lstrcatA
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcpyA
GetModuleHandleA
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalAlloc
GlobalReAlloc
GlobalLock
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
TlsAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
lstrcpynA
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
lstrlenA
WideCharToMultiByte
GetCurrentThreadId
ReleaseMutex
CreateMutexA
WaitForSingleObject
Sleep
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
FindFirstFileA
CreateFileA
ReadFile
CloseHandle
DeleteFileA
FindNextFileA
FindClose
SetLastError
GetVersion
LocalAlloc
GetLastError
LocalFree
FreeLibrary
GetModuleFileNameA
LoadLibraryA
GetCommandLineA
GetProcAddress

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetKernelObjectSecurity

crypt32

CertAddCertificateContextToStore
CertOpenStore
CertEnumCertificatesInStore
CertCompareCertificate
CertDeleteCertificateFromStore
CertFreeCertificateContext
CertCloseStore
CertCreateCertificateContext
CertNameToStrA
CertSetCertificateContextProperty

comctl32

ord17

user32

CopyRect
GetClientRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
PostMessageA
LoadIconA
SetWindowTextA
LoadCursorA
GetSysColorBrush
ReleaseDC
GetDC
GetClassNameA
PtInRect
ClientToScreen
PostQuitMessage
DestroyMenu
TabbedTextOutA
DrawTextA
GrayStringA
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextA
GetDlgCtrlID
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
EnableMenuItem
GetFocus
GetNextDlgTabItem
DispatchMessageA
GetKeyState
CallNextHookEx
PeekMessageA
SetWindowsHookExA
GetParent
LoadStringA
UnhookWindowsHookEx
EnableWindow
MessageBoxA
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
SendMessageA
CheckMenuItem

gdi32

GetStockObject
SelectObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
RestoreDC
SetTextColor
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SaveDC
DeleteDC
DeleteObject
GetDeviceCaps
GetObjectA
CreateBitmap
GetClipBox
SetBkColor

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

Exports

Exports

SKF_CancelWaitForDevEvent
SKF_ChangeDevAuthKey
SKF_ChangePIN
SKF_ClearSecureState
SKF_CloseApplication
SKF_CloseContainer
SKF_CloseHandle
SKF_ConnectDev
SKF_CreateApplication
SKF_CreateCert
SKF_CreateContainer
SKF_CreateFile
SKF_Decrypt
SKF_DecryptFinal
SKF_DecryptInit
SKF_DecryptUpdate
SKF_DelectCert
SKF_DeleteApplication
SKF_DeleteContainer
SKF_DeleteFile
SKF_DevAuth
SKF_Digest
SKF_DigestFinal
SKF_DigestInit
SKF_DigestUpdate
SKF_DisConnectDev
SKF_ECCExportSessionKey
SKF_ECCSignData
SKF_ECCVerify
SKF_Encrypt
SKF_EncryptFinal
SKF_EncryptInit
SKF_EncryptUpdate
SKF_EnumApplication
SKF_EnumContainer
SKF_EnumDev
SKF_EnumFiles
SKF_ExportCertificate
SKF_ExportPublicKey
SKF_ExtECCDecrypt
SKF_ExtECCEncrypt
SKF_ExtECCSign
SKF_ExtECCVerify
SKF_ExtRSAPriKeyOperation
SKF_ExtRSAPubKeyOperation
SKF_Format
SKF_GenECCKeyPair
SKF_GenExtRSAKey
SKF_GenRSAKeyPair
SKF_GenRandom
SKF_GenerateAgreementDataAndKeyWithECC
SKF_GenerateAgreementDataWithECC
SKF_GenerateKeyWithECC
SKF_GetContainerType
SKF_GetDevInfo
SKF_GetDevState
SKF_GetFileInfo
SKF_GetPINInfo
SKF_GetUkeyInfo
SKF_ImportCertificate
SKF_ImportECCKeyPair
SKF_ImportRSAKeyPair
SKF_ImportSessionKey
SKF_LockDev
SKF_Mac
SKF_MacFinal
SKF_MacInit
SKF_MacUpdate
SKF_OpenApplication
SKF_OpenContainer
SKF_PrvKeyDecrypt
SKF_RSAExportSessionKey
SKF_RSASignData
SKF_RSAVerify
SKF_ReadCert
SKF_ReadFile
SKF_SetLabel
SKF_SetSymmKey
SKF_Transmit
SKF_UnblockPIN
SKF_UnlockDev
SKF_VerifyPIN
SKF_WaitForDevEvent
SKF_WriteCert
SKF_WriteFile

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/WatchSafe.ini
$SYSDIR/$(LSTR_46)/clrcert.exe
.exe windows:4 windows x86 arch:x86

d4fdca877fce9dc99c6aa4b2c6c2c485

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:1c:d6:b4:ad:18:77:8e:40:27:e3:ae:d3:6f:73:ef:fa:ac:75:4f
Signer

Actual PE Digest

3c:1c:d6:b4:ad:18:77:8e:40:27:e3:ae:d3:6f:73:ef:fa:ac:75:4f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetPrivateProfileStringA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$SYSDIR/$(LSTR_46)/hodll.dll
.dll windows:4 windows x86 arch:x86

e84e454c85633de19dcce65047a30b60

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

96:b8:88:de:0b:24:ef:4d:0a:83:2d:ce:68:5a:bf:86:13:c1:11:02
Signer

Actual PE Digest

96:b8:88:de:0b:24:ef:4d:0a:83:2d:ce:68:5a:bf:86:13:c1:11:02

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord1578

msvcrt

_onexit

kernel32

LocalFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

UnhookWindowsHookEx

advapi32

CryptGenRandom

Exports

Exports

?KeyboardProcForUI@@YGJHIJ@Z
?KeyboardProcForUI_EAL@@YGJHIJ@Z
PWD_ChangeUserPIN
PWD_CheckNewPIN
PWD_ClearAllPINAndKey
PWD_ClearStoreAndKey
PWD_GetString
PWD_InputChar
PWD_InputChar_SoftKbd
PWD_InputChar_SoftKbd_EAL
PWD_PreparePINOperation
PWD_SetCurPwdType
PWD_SetCurPwdWnd
PWD_SetUserPIN
PWD_VerifyUserPIN
installhookForUI
installhookForUI_EAL
unhook
ے�g�=7D��E-�T>�A1pi��8?�J��3g��/��GU�f�O�ME��^�w�C��Y�*�UοQ(�5}6!�D�HM" �Z��8(�C3|�ӱ��9k�mXS�œ��Q� d�1��i��*�/��1��Q��u��qp��t��Y�Q�z-ۮyN'��pH�lxh��e��< Ԑ7�+�"b'r�.B�Aj�~��2d��XlV��I�C��P�n� E��=K�eK|��^��<��>�;$53�Jn��Gg臓T��|)��~��Ն�)r+��8��k��c�i/��*0 }(d}�@�dI:%��!��M��1�&��!ݚY�زlD�6�aKF�B�c4� ��~"�%��c�ًo� fĬ1��[�ԟW�5O��7�h��VHe��O�C��*Ƅ*��RBt�Z��˲�@>�R�vG��+�cWWx�O�l�Pk.a�k��{��P��P(��n�s�z��ϳh��~��p�Ts�$��9h�O<��.ҷǁ��}�[�@�.�A�~�!�総�J�z1�̟��0�0�,�L%��pϳ��uO92\��٭� ��8?ZTx��?�5�o��en��̨�[�?m;�$�GȖ��.�1v�Rx�zn�D0bb4m0k�6��c ��kn��C%��%i�,��L4��RÑ�Re6��1��|�}��=3Y�~�%��~u� W`O�wX��> *��|m'D��?�6X/&�l�C�Z��>:�v�$��<�V9EL g%�H8CO��C@�Έ5�"3sB��u��x\V�8�2h�N��ri��s,c�MdI1t�.я�GM9g1��4P��#@�W��oi�m�x��ѻ�a3��[��Ub�OD!�鈐~�/�6��6�դՑ=��įʅbV�x%s�ˁV��1�oꙫ��v�S��Ne�R��@^�%��]��X�N�.,�X�g��K��٢$��n�@/-�(��(W�9x��# �"��q��b(Q�<��P��L�Z΋2&*c�wծƣ �_*��-��A|�� }A�ni�S��F�Ԋ��)_z�Hi`Ť��z ȍU��+��Ia��H��1��+ ��Gv��<ܡՅM�dn�.6�D÷��@%jy�s��獎��zUA!֮*��ܭd�#n��#� W�;ܔ(��{"��8��/̌��]U��D�I��1�i�n։�r*b�3�T�{� e��ߟ��1�8n��z,�@�� N�i�&W�ǯ��tcw��U2ZI{�c�`N߹��<ȘRƍq�@�J�ڶ�K��&\��c؉�܈Tx�O�[��M�+� ��A*<cc3��p��]��(UkA�_��<8%��FT�(��-�R��X.�1ڠ�椸��񲚐��tíYʚ�C4��U��>1�K�G�BZ�8�� bLKhM�Ȗ�_a79RC��W�|��}�\'1�)&�! z��o� v��`&㳣<��gί�>��̃R.&��.ݍ�y��u�<�E��U��˛-��U��E��ϋ�Nߤ��a��?A�X�2��K��T��{'�Z0��d�׸A��& ��%j~B�¯�ڊ��C>�&EՕ��q^=��zZn�ܙ�VY�i]��F��)��_.�~B��N��2�ue� !��N��dg��+�~��2J7Vڛg�OK�Y��Z��+p��9b+@��ذ�ΟB��s��}��R̞�_a�^��tby �,祒T�0�Yq��`r�� 1��nu��2G��bıU*g�3��q�e�_��))��1 ;�,�CӨ�+2.+6�Oט'b:OE��Ʉx+n��˦��9B��$M��v��l5M$��ۥ,��L@$�-\s�PB7&9R`��#�!�2�� V�&j��?�� 4��`��9/��f��\0��JU1�y�1��Xg��~�� m�̧��\S�J�N� f�E��Մ��<ҧk��g�S��f+�w��zd�J9+ޚ< r#�l^��$M�R��L��d� r�2k^V�^��u�0LUz͙��`��p�S�U8ᗺ��X��V�{n��Mj �ܻB^��rXS� �|��T��YM77�W�~f�r8��m��O��eX#V��B��lj��&Os`�a�]��H�um!j�d�>��V�J��M��{U��Q��x�z��=#�� g@�YP� ɼMQ5�_�S��;�)!65�2�z��_��_lRo⵿(��t<_��W��\j}n��D�B��2�-�X��W��bgG��N�-/TH��X�� 6��L�:v3׏�kU��{4��dx4��q��PŜBð��gТ� Қ/P��/��5<V�]BpG�SIG��h� 2��(=�- u�k��R*�S!oP�9��o��?�i��-��'�[�3�0�,X��)��b��F��9w�Ť$��\Jhd��4�P:I��:��~��ɂ7h��@�VeeC��VQ j��H��M�wtx�@�(��o+MUm��~�5�``�� 2�y�u6ka��.YZ��j�\"��j��m��G��}@�Ԯ��h�w�)Ä g�[�H�u�:Ҟ�!�.Z%g��J�֍W֖h�@A�*��٭ϫa?��2��uؐ�]��:z�Z�T��Y$�0��e�3`\�k(�%�/)C�WXa{�<wЍ�B��W�3γw� ��j�9��u�D�ь�ĺ�)��K0��o4\��㽆S-��E��<B'�M�'��htZNEƏ�x>��~9��& -o��g�ｼ�g擟��/�&�C��Ī�l� M+`vRŤ��49HΎ�+A� ,�I��Y;�*��!U�K;�>0�筕��:7_��a�4��kF+Ϗm��ku�.�W�R��A�[�

Sections

.text
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARDAT
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 132KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/wd_ccb_cert_gm.dll
.dll windows:4 windows x86 arch:x86

454895b0aacaa178430d12b49463ff96

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:f8:0a:29:62:f1:de:b7:8a:5a:88:89:67:37:f8:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-11-2015 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:4c:43:c6:70:0e:4c:81:c9:44:2b:63:01:18:c7:57
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-01-2016 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

db:40:10:c0:eb:a9:56:57:37:8b:25:cf:82:89:ac:99:55:95:1d:c0:77:7a:99:4f:7b:b4:25:1f:bc:7c:fa:71
Signer

Actual PE Digest

db:40:10:c0:eb:a9:56:57:37:8b:25:cf:82:89:ac:99:55:95:1d:c0:77:7a:99:4f:7b:b4:25:1f:bc:7c:fa:71

Digest Algorithm

sha256

PE Digest Matches

true

9d:0a:e2:f3:c3:6d:3a:9c:9d:d8:82:da:d2:80:56:1e:78:0d:96:b4
Signer

Actual PE Digest

9d:0a:e2:f3:c3:6d:3a:9c:9d:d8:82:da:d2:80:56:1e:78:0d:96:b4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CryptEncodeObjectEx
CryptMsgOpenToDecode
CryptMsgUpdate
CryptMsgClose
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringA
CertGetCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore
CertCompareCertificate
CertDeleteCertificateFromStore
CertOpenStore
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertFreeCertificateContext
CertCloseStore
CertCreateCertificateContext
CertNameToStrA

shlwapi

SHSetValueA
PathFileExistsA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

ws2_32

htonl

mfc42

ord1577
ord1182
ord5933
ord342
ord1243
ord1197
ord1570
ord1253
ord1575
ord1578
ord600
ord826
ord825
ord823
ord6467
ord920
ord269
ord1176
ord2725
ord1168
ord1116
ord3953
ord815
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord1255
ord1175

msvcrt

_adjust_fdiv
_initterm
_onexit
__dllonexit
memmove
realloc
toupper
fread
strrchr
_except_handler3
_ftol
fopen
fwrite
fclose
sprintf
mbstowcs
malloc
_strupr
strstr
__CxxFrameHandler
strchr
??1type_info@@UAE@XZ
_stricmp
free

kernel32

SetLastError
CreateProcessA
GetExitCodeProcess
GetPrivateProfileStringA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
GetModuleHandleA
GetSystemDirectoryA
FindResourceA
SizeofResource
LoadResource
LockResource
CompareFileTime
GetWindowsDirectoryA
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemDefaultLangID
GetLastError
GetLocalTime
FileTimeToSystemTime
FindFirstFileA
CreateFileA
ReadFile
DeleteFileA
FindNextFileA
FindClose
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateMutexA
WaitForSingleObject
ReleaseMutex
CloseHandle
WriteFile
GetVersionExA
LocalFree
LocalAlloc
CreateThread

user32

RegisterWindowMessageA

advapi32

CryptCreateHash
QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
StartServiceA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegDeleteKeyA
CryptReleaseContext
CryptAcquireContextA
CryptDestroyHash
CryptSignHashA
CryptHashData

shell32

ShellExecuteA
SHGetFolderPathA

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/wdcspui.dll
.dll windows:4 windows x86 arch:x86

ea41f2bcfb13ce74260cc989404968c6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:f8:0a:29:62:f1:de:b7:8a:5a:88:89:67:37:f8:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-11-2015 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:4c:43:c6:70:0e:4c:81:c9:44:2b:63:01:18:c7:57
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-01-2016 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ed:de:9c:d4:73:b4:46:45:dd:b1:0e:86:5b:64:b7:6b:e9:f6:c6:12:13:56:db:d0:dd:bc:85:ab:2b:49:89:c6
Signer

Actual PE Digest

ed:de:9c:d4:73:b4:46:45:dd:b1:0e:86:5b:64:b7:6b:e9:f6:c6:12:13:56:db:d0:dd:bc:85:ab:2b:49:89:c6

Digest Algorithm

sha256

PE Digest Matches

true

51:97:70:71:d0:05:1c:0c:52:ec:31:df:5c:96:6d:5c:ee:86:33:a8
Signer

Actual PE Digest

51:97:70:71:d0:05:1c:0c:52:ec:31:df:5c:96:6d:5c:ee:86:33:a8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindResourceW
LoadResource
LockResource
EnterCriticalSection
lstrlenA
GetVersion
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
MultiByteToWideChar
CreateMutexW
FreeLibrary
LoadLibraryW
CreateMutexA
LocalAlloc
LocalFree
ReleaseMutex
WideCharToMultiByte
GetSystemDefaultLangID
GetPrivateProfileIntW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentThreadId
SetEvent
ResetEvent
SizeofResource
GlobalAlloc
ResumeThread
GlobalLock
GlobalUnlock
MulDiv
GlobalFree
CloseHandle
CreateEventW
CreateThread
WaitForSingleObject
CreateDirectoryA
GetModuleFileNameA
GetVersionExW
GetPrivateProfileStringW
GetWindowsDirectoryW
GetSystemDirectoryW
lstrcpyW
GetModuleFileNameW
lstrcatW
GetSystemDirectoryA
GetModuleHandleW
GetProcAddress
lstrlenW
lstrcmpiW
GetCPInfo
FreeResource

user32

LoadMenuW
LoadImageW
GetIconInfo
CreateIconIndirect
SendMessageW
TrackPopupMenuEx
PostMessageW
SetCursor
DestroyCursor
DestroyMenu
EnableWindow
GetDesktopWindow
ReleaseDC
GetDC
RemoveMenu
ModifyMenuW
GetParent
WindowFromPoint
GetWindowLongW
UpdateWindow
SetActiveWindow
SetForegroundWindow
ShowWindow
SetWindowPos
SetTimer
KillTimer
LoadStringW
LoadIconW
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
DrawIcon
IsIconic
RegisterDeviceNotificationA
EnumWindows
wsprintfW
GetSystemMenu
FindWindowW
InflateRect
PtInRect
LoadCursorW
SetWindowLongW
IsRectEmpty
SetRectEmpty
IntersectRect
UnionRect
GetCursorPos
ReleaseCapture
IsZoomed
SetWindowRgn
GetUpdateRect
SetCapture
OffsetRect
FrameRect
DrawStateW
DrawFocusRect
InsertMenuW
GetSubMenu
GetMenuStringW
GetMenuState
GetMenuItemID
GetMenuItemCount
AppendMenuW
DeleteMenu
GetWindowRect
GetMenuItemInfoW
GetSysColor
SystemParametersInfoW
DestroyIcon
DrawIconEx
GetSystemMetrics
SetRect
CopyRect
FillRect
GetSysColorBrush
LoadBitmapW
DrawEdge
TabbedTextOutW
DrawTextW
GrayStringW
CreateMenu
CreatePopupMenu
GetClientRect
ClientToScreen
InvalidateRect
GetActiveWindow
IsWindow
GetNextDlgTabItem

gdi32

CreateDIBSection
CreateCompatibleDC
GetObjectW
GetDeviceCaps
GetBkMode
PtVisible
RectVisible
Ellipse
PatBlt
SelectObject
SetPixel
TextOutW
ExtTextOutW
Escape
CreateHatchBrush
Rectangle
SetTextColor
SetBkColor
CreateBitmap
BitBlt
DeleteObject
DeleteDC
CreateCompatibleBitmap
CreateFontIndirectW
CreateSolidBrush
GetPixel
GetTextExtentPoint32W
CreateFontW
StretchBlt
CreateEllipticRgnIndirect
PtInRegion
GetStockObject
CreateRectRgn
CombineRgn
GetDIBits
CreatePen

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExA
RegOpenKeyA
RegCreateKeyA

shell32

ShellExecuteA
Shell_NotifyIconW
ShellExecuteExW
ShellExecuteW

ole32

CreateStreamOnHGlobal

oleaut32

OleLoadPicture

shlwapi

StrCatW
PathFileExistsW
PathFileExistsA

mfc42u

ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord4269
ord663
ord348
ord6466
ord4219
ord2078
ord4470
ord6451
ord470
ord755
ord1560
ord354
ord5180
ord665
ord3313
ord268
ord5438
ord2385
ord1971
ord795
ord3716
ord2910
ord859
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord3733
ord561
ord815
ord3948
ord2717
ord3701
ord3605
ord5706
ord6655
ord1808
ord816
ord1761
ord562
ord2550
ord2855
ord1941
ord818
ord1230
ord6437
ord4803
ord922
ord269
ord826
ord600
ord1571
ord1250
ord1248
ord1563
ord1194
ord1240
ord342
ord1179
ord1570
ord1568
ord1173
ord1115
ord656
ord2634
ord3088
ord860
ord6211
ord5949
ord2362
ord6330
ord1165
ord2810
ord4294
ord3087
ord2294
ord5276
ord384
ord686
ord1099
ord800
ord535
ord861
ord540
ord772
ord3696
ord500
ord1854
ord825
ord823
ord2430
ord4078
ord2858
ord5602
ord6138
ord2854
ord5871
ord4124
ord2755
ord4272
ord5679
ord2406
ord2559
ord5784
ord2606
ord858
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6017
ord6168
ord5869
ord5785
ord5790
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord3591
ord640
ord6190
ord323
ord2397
ord2088
ord2400
ord1172
ord538
ord2915
ord2004
ord3284
ord2112
ord3290
ord6150
ord2522
ord4360
ord4051
ord5467
ord4116
ord2381
ord5080
ord1703
ord1708
ord6051
ord4073
ord1768
ord4401
ord5230
ord2377
ord5157
ord6365
ord4347
ord5275
ord3793
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5058
ord1720
ord5244
ord2436
ord2116
ord5273
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3390
ord3825
ord3826
ord3820
ord3074
ord4075
ord4621
ord4418
ord3725
ord554
ord807
ord1143
ord3688
ord3621
ord3658
ord1634
ord940
ord941
ord942
ord3568
ord3614
ord5783
ord3566
ord4128
ord4292
ord2756
ord4197
ord5852
ord536
ord1633
ord5781
ord2444
ord2745
ord1192
ord537
ord472
ord4215
ord2576
ord3649
ord1637
ord5568
ord2914
ord6142
ord5879
ord1073
ord5856
ord1614
ord3981
ord5446
ord6390
ord2859
ord5436
ord6379
ord4158
ord4390
ord5237
ord6370
ord5059
ord5257
ord2438
ord3569
ord809
ord609
ord556
ord4270
ord4279
ord5286
ord5047
ord5977
ord3871
ord613
ord6871
ord289
ord2114
ord4155
ord6354
ord1088
ord6193
ord283
ord2371
ord2567
ord3397
ord567
ord5261
ord4370
ord4847
ord4992
ord2506
ord6048
ord1767
ord4419
ord6195
ord4282
ord3592
ord324
ord641
ord4229
ord1105
ord6191
ord4704
ord2637

msvcrt

memcmp
_stricmp
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
_purecall
_wcsicmp
_CxxThrowException
??0exception@@QAE@ABV0@@Z
strncpy
wcscat
_wcsupr
wcstombs
_strlwr
strstr
_beginthreadex
_wcslwr
strcmp
sprintf
fopen
fprintf
fclose
wcsstr
wcsrchr
rand
strlen
strrchr
strcat
strcpy
wcsncpy
memmove
memcpy
wcscmp
_ftol
wcslen
wcscpy
__CxxFrameHandler
malloc
memset
free

comctl32

ImageList_Draw
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_AddMasked
ImageList_GetImageCount
ImageList_GetIconSize
_TrackMouseEvent

gdiplus

GdipGetPathWorldBounds
GdipGetFamily
GdipGetFontStyle
GdipGetFontSize
GdipGetFontHeightGivenDPI
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipAddPathString
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdipFillRectangleI
GdiplusStartup
GdiplusShutdown
GdipDrawImageRectRectI
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteFont
GdipDeletePath
GdipCreatePath
GdipCloneImage
GdipDisposeImage
GdipLoadImageFromFileICM
GdipCreateBitmapFromStream
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawString
GdipSetTextRenderingHint
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipLoadImageFromFile

msvcp60

??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0out_of_range@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0logic_error@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1out_of_range@std@@UAE@XZ

winmm

timeKillEvent
timeGetDevCaps
timeBeginPeriod
timeSetEvent
timeEndPeriod

Exports

Exports

WDGenECCKeyPair
WDGenP10InKey
WDGenRSAKeyPair
WDScreenLockSetHook
WDScreenLockdelHook
WDSignCCIDOCLDlg
WDSignOCLDlg
WDUIStopWaitForDeviceEvent
WDUIWaitForDeviceEvent
WDUI_AddUIHWndToArray
WDUI_ChangeUserPin
WDUI_CheckCertDlg
WDUI_CloseAllUI
WDUI_MsgBoxDlg
WDUI_SafetyMentionDlg
WDUI_SetUserLogin
WDUI_SetUserPin
WDUI_USBKeyAuxTool
WDVerifyUserPin

Sections

.text
Size: 296KB - Virtual size: 292KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/wdkmgr.dll
.dll windows:4 windows x86 arch:x86

48609ea7754f5390730024051fa5a89d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c2:e9:7e:0b:26:05:be:fe:05:29:df:31:a7:72:e3:05:30:36:b5:10
Signer

Actual PE Digest

c2:e9:7e:0b:26:05:be:fe:05:29:df:31:a7:72:e3:05:30:36:b5:10

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

advapi32

CryptAcquireContextA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptCreateHash
CryptHashData
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
MakeAbsoluteSD
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptDestroyHash
CryptEncrypt
CryptImportKey
CryptVerifySignatureA

msvcrt

_adjust_fdiv
_initterm
_strupr
??2@YAPAXI@Z
??3@YAXPAX@Z
strncmp
srand
rand
sprintf
_strlwr
strstr
malloc
memset
strcpy
free
strrchr
strcat
strlen
memcpy
memcmp
_except_handler3

kernel32

SetEvent
CreateThread
TerminateThread
Sleep
DeviceIoControl
CreateFileA
ResetEvent
CreateMutexA
GetCurrentProcessId
GetTickCount
SetLastError
GetNamedPipeInfo
DisconnectNamedPipe
GetLastError
GetProcessHeap
HeapAlloc
CreateNamedPipeA
ConnectNamedPipe
ReleaseMutex
CreateEventA
LocalAlloc
WaitForSingleObject
WriteFile
ReadFile
HeapFree
LocalFree
CloseHandle
GetVersionExA
GetProcAddress
LoadLibraryA
GetModuleFileNameA
FreeLibrary

Exports

Exports

CloseWdDev
EnumWdDevPath
EnumWdDevPathByName
FlashDiskTransmit
Icc_Set_NadWdDev
Icc_tsi_apiWdDev
OpenWdDev

Sections

.text
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/wdpkcs.dll
.dll windows:4 windows x86 arch:x86

0ec148163a1e4249726ef31c74f7d260

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:76:35:64:63:e0:ff:1f:3b:8e:2c:ab:27:f4:fc:8d:3f:a9:8f:0d
Signer

Actual PE Digest

53:76:35:64:63:e0:ff:1f:3b:8e:2c:ab:27:f4:fc:8d:3f:a9:8f:0d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetForegroundWindow
MessageBoxA

msvcrt

sprintf
_strlwr
_adjust_fdiv
strstr
strrchr
realloc
malloc
free
_ftol
time
srand
rand
_initterm

kernel32

FreeLibrary
GetModuleFileNameA
GetProcAddress
GetLocalTime
GetSystemDefaultLangID
CreateFileMappingA
CreateMutexA
GetLastError
OpenFileMappingA
MapViewOfFile
CloseHandle
UnmapViewOfFile
WaitForSingleObject
ReleaseMutex
LoadLibraryA

Exports

Exports

C_CancelFunction
C_CloseAllSessions
C_CloseSession
C_CopyObject
C_CreateObject
C_Decrypt
C_DecryptDigestUpdate
C_DecryptFinal
C_DecryptInit
C_DecryptUpdate
C_DecryptVerifyUpdate
C_DeriveKey
C_DestroyObject
C_Digest
C_DigestEncryptUpdate
C_DigestFinal
C_DigestInit
C_DigestKey
C_DigestUpdate
C_Encrypt
C_EncryptFinal
C_EncryptInit
C_EncryptUpdate
C_Finalize
C_FindObjects
C_FindObjectsFinal
C_FindObjectsInit
C_GenerateKey
C_GenerateKeyPair
C_GenerateRandom
C_GetAttributeValue
C_GetFunctionList
C_GetFunctionStatus
C_GetInfo
C_GetMechanismInfo
C_GetMechanismList
C_GetObjectSize
C_GetOperationState
C_GetSessionInfo
C_GetSlotInfo
C_GetSlotList
C_GetTokenInfo
C_InitPIN
C_InitToken
C_Initialize
C_Login
C_Logout
C_OpenSession
C_SeedRandom
C_SetAttributeValue
C_SetOperationState
C_SetPIN
C_Sign
C_SignEncryptUpdate
C_SignFinal
C_SignInit
C_SignRecover
C_SignRecoverInit
C_SignUpdate
C_UnwrapKey
C_Verify
C_VerifyFinal
C_VerifyInit
C_VerifyRecover
C_VerifyRecoverInit
C_VerifyUpdate
C_WaitForSlotEvent
C_WrapKey
WDBuildAttribute
WDComputeNextTokenObjName
WDDeleteTokenObject
WDLoadTokenData
WDObjectCreateSkel
WDObjectFree
WDSaveTokenData
WDSaveTokenObject
WDTemplateUpdateAttribute

Sections

.text
Size: 152KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/wdsafe3.dll
.dll regsvr32 windows:4 windows x86 arch:x86

8a85370b0e868908b699d3a2729acd13

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
FindResourceA
GetVersionExA
ReadFile
LoadLibraryA
DisableThreadLibraryCalls
CreateFileA
GetFileSize
GetModuleFileNameA
GetProcAddress
GetStdHandle
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
CloseHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
HeapAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedDecrement
InterlockedIncrement

advapi32

RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPDuplicateHash
CPDuplicateKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/$(LSTR_46)/wdsafe3.sig
$SYSDIR/$(LSTR_46)/wdsm3.dll
.dll windows:4 windows x86 arch:x86

0001b81b5c0f3909a0b4eeea09f476ea

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

13:1d:6e:84:b7:77:88:d3:ef:a3:89:e4:78:6b:6c:c2:0f:1c:19:d5
Signer

Actual PE Digest

13:1d:6e:84:b7:77:88:d3:ef:a3:89:e4:78:6b:6c:c2:0f:1c:19:d5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetLastError
CloseHandle
InitializeCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
FlushFileBuffers
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

Exports

Exports

HashMessage

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCBNSIS.dll
.dll windows:4 windows x86 arch:x86

835622bce9ea6b71d320353d35c552ba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTickCount
GetLastError
Sleep
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
HeapFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

advapi32

OpenServiceA
DeleteService
ControlService
CreateServiceA
CloseServiceHandle
StartServiceA
QueryServiceStatus
OpenSCManagerA
ChangeServiceConfig2A

Exports

Exports

WDDeleteService
WDStartService
WDStartSmartCard

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/WDCCB.dll
.dll regsvr32 windows:4 windows x86 arch:x86

8383df65c6488862090adf75abf602c5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:6b:55:f2:d5:c3:2e:4c:6b:9c:f7:23:57:cc:a0:f4:3f:89:2d:b0
Signer

Actual PE Digest

4b:6b:55:f2:d5:c3:2e:4c:6b:9c:f7:23:57:cc:a0:f4:3f:89:2d:b0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
GlobalUnlock
GlobalLock
GlobalAlloc
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
LocalFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
lstrcatA
WideCharToMultiByte
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetStdHandle
IsBadCodePtr
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
SetUnhandledExceptionFilter
HeapSize
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
lstrcpyA
DeleteCriticalSection
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
IsDBCSLeadByte
lstrcpynA
lstrcmpiA
LoadLibraryExA
GetLastError
FindResourceA
LoadResource
SizeofResource
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
LoadLibraryA
FlushFileBuffers
GetStdHandle
SetHandleCount
TerminateProcess
RtlUnwind
ExitProcess
VirtualAlloc
VirtualFree
HeapCreate
GetVersionExA
GetEnvironmentVariableA
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
RaiseException
GetVersion
GetCommandLineA
HeapReAlloc
GetLocalTime
GetSystemTime
GetTimeZoneInformation
HeapAlloc
HeapFree

user32

SetWindowRgn
CharNextA
DefWindowProcA
GetKeyState
PtInRect
UnionRect
ShowWindow
SetWindowLongA
GetWindowLongA
CallWindowProcA
CreateWindowExA
RegisterClassExA
wsprintfA
GetClientRect
EndPaint
InvalidateRect
GetDC
ReleaseDC
IntersectRect
EqualRect
OffsetRect
BeginPaint
SetWindowPos
IsWindow
GetParent
SetFocus
GetFocus
IsChild
DestroyWindow
GetClassInfoExA
LoadCursorA

gdi32

LPtoDP
SetMapMode
SetViewportOrgEx
DeleteDC
GetDeviceCaps
CreateMetaFileA
SaveDC
SetWindowOrgEx
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
CreateDCA

advapi32

RegSetValueExA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

ole32

CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
CreateDataAdviseHolder
OleLoadFromStream
WriteClassStm
OleSaveToStream
CreateOleAdviseHolder

oleaut32

OleCreatePropertyFrame
SysStringLen
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VariantClear
RegisterTypeLi
LoadTypeLi
SysAllocString
VarUI4FromStr
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/WDCCBpkcs11.dll
.dll windows:4 windows x86 arch:x86

b4e88f570f10738a34f00aec9d0bbb4d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
GetModuleFileNameA
LoadLibraryA
GetProcAddress
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
RtlUnwind
CloseHandle

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Exports

Exports

C_CancelFunction
C_CloseAllSessions
C_CloseSession
C_CopyObject
C_CreateObject
C_Decrypt
C_DecryptDigestUpdate
C_DecryptFinal
C_DecryptInit
C_DecryptUpdate
C_DecryptVerifyUpdate
C_DeriveKey
C_DestroyObject
C_Digest
C_DigestEncryptUpdate
C_DigestFinal
C_DigestInit
C_DigestKey
C_DigestUpdate
C_Encrypt
C_EncryptFinal
C_EncryptInit
C_EncryptUpdate
C_Finalize
C_FindObjects
C_FindObjectsFinal
C_FindObjectsInit
C_GenerateKey
C_GenerateKeyPair
C_GenerateRandom
C_GetAttributeValue
C_GetFunctionList
C_GetFunctionStatus
C_GetInfo
C_GetMechanismInfo
C_GetMechanismList
C_GetObjectSize
C_GetOperationState
C_GetSessionInfo
C_GetSlotInfo
C_GetSlotList
C_GetTokenInfo
C_InitPIN
C_InitToken
C_Initialize
C_Login
C_Logout
C_OpenSession
C_SeedRandom
C_SetAttributeValue
C_SetOperationState
C_SetPIN
C_Sign
C_SignEncryptUpdate
C_SignFinal
C_SignInit
C_SignRecover
C_SignRecoverInit
C_SignUpdate
C_UnwrapKey
C_Verify
C_VerifyFinal
C_VerifyInit
C_VerifyRecover
C_VerifyRecoverInit
C_VerifyUpdate
C_WaitForSlotEvent
C_WrapKey

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ChineseSimp.ini
ChineseTrad.ini
DisableUDKDevice.exe
.exe windows:4 windows x86 arch:x86

d7a3a100b145b5179f0924c4954190c8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:f8:0a:29:62:f1:de:b7:8a:5a:88:89:67:37:f8:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-11-2015 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:4c:43:c6:70:0e:4c:81:c9:44:2b:63:01:18:c7:57
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-01-2016 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:54:79:d8:b1:dd:12:75:06:61:fc:cc:cd:3b:21:b7:15:91:ce:5f:a9:4a:63:f0:53:c7:2c:96:d5:2a:54:1d
Signer

Actual PE Digest

51:54:79:d8:b1:dd:12:75:06:61:fc:cc:cd:3b:21:b7:15:91:ce:5f:a9:4a:63:f0:53:c7:2c:96:d5:2a:54:1d

Digest Algorithm

sha256

PE Digest Matches

true

6f:4b:44:fc:6f:69:06:cd:88:cd:eb:4d:ab:3a:8d:a7:98:16:90:64
Signer

Actual PE Digest

6f:4b:44:fc:6f:69:06:cd:88:cd:eb:4d:ab:3a:8d:a7:98:16:90:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
CM_Get_DevNode_Status
SetupDiSetClassInstallParamsA
SetupDiCallClassInstaller
SetupDiDestroyDeviceInfoList

kernel32

GetModuleHandleA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
InstallUsbccid.exe
.exe windows:4 windows x86 arch:x86

3e8dea21102b3f35153ae36e4e8deca2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

97:aa:e2:4c:9c:d8:6c:99:f3:dd:6e:a4:bd:56:1a:98:01:d3:d2:60
Signer

Actual PE Digest

97:aa:e2:4c:9c:d8:6c:99:f3:dd:6e:a4:bd:56:1a:98:01:d3:d2:60

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetModuleFileNameA
FreeLibrary
GetProcAddress
GetLastError
LoadLibraryA
GetSystemDirectoryA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
SetFilePointer
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
CloseHandle

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ProviderName.ini
WatchData.ico
english.ini
logo.bmp
recfull.ico
registCCID.exe
.exe windows:4 windows x86 arch:x86

a1c7f3a7847762d0771403aa76d898f1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

85:ec:4e:52:44:34:c9:72:fd:d4:eb:cd:78:31:6c:d4:a8:c4:8e:f1
Signer

Actual PE Digest

85:ec:4e:52:44:34:c9:72:fd:d4:eb:cd:78:31:6c:d4:a8:c4:8e:f1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsA

advapi32

RegSetValueExA
RegOpenKeyExA
RegCreateKeyA
RegCloseKey
RegQueryValueExA

shell32

ShellExecuteA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

kernel32

UnhandledExceptionFilter
CloseHandle
FlushFileBuffers
SetStdHandle
LoadLibraryA
GetProcAddress
LCMapStringW
LCMapStringA
GetVersionExA
GetSystemDirectoryA
Sleep
GetCurrentDirectoryA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
VirtualAlloc
HeapReAlloc
GetLastError
SetFilePointer
MultiByteToWideChar
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
registCCIDCom.exe
.exe windows:4 windows x86 arch:x86

831d8890de2679b2a5896c3941b53938

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6c:57:6f:8e:9a:81:27:50:bb:84:00:94:83:fc:39:54:50:c6:9b:65
Signer

Actual PE Digest

6c:57:6f:8e:9a:81:27:50:bb:84:00:94:83:fc:39:54:50:c6:9b:65

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
SetNamedSecurityInfoA
SetEntriesInAclA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
RegEnumKeyA
RegCreateKeyA

kernel32

GetVersionExA
GetSystemDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
GetFullPathNameA
LocalFree
GetCommandLineA
GetVersion
ExitProcess
HeapFree
GetLastError
CloseHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
registerocx.exe
.exe windows:4 windows x86 arch:x86

45e5fdbb97a5dff92461ead53856b27d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:59:b7:ac:e8:ef:2f:51:15:f3:52:10:6d:4d:9f:16:d7:c4:c1:0a
Signer

Actual PE Digest

16:59:b7:ac:e8:ef:2f:51:15:f3:52:10:6d:4d:9f:16:d7:c4:c1:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
GetProcAddress
Sleep
LoadLibraryA
GetVersionExA
GetStringTypeA
HeapReAlloc
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
GetStringTypeW

advapi32

RegEnumKeyA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA

ole32

OleUninitialize
OleInitialize

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
usb.inf
usbccid.cat
usbccid.inf
usbccid.sys
.sys windows:5 windows x86 arch:x86

f39b03ee1f9cd5628c4512b5c20bceb3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

usbccid.pdb

Imports

ntoskrnl.exe

KeTickCount
KeBugCheckEx
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
IoCreateDevice
IoOpenDeviceRegistryKey
IoAttachDeviceToDeviceStack
KeDelayExecutionThread
ExAllocatePoolWithTag
ExFreePoolWithTag
IofCompleteRequest
_except_handler3
RtlInitUnicodeString
ZwQueryValueKey
IoInitializeRemoveLockEx
ZwClose
KeSetEvent
ExFreePool
IoAcquireCancelSpinLock
IoFreeIrp
IoReleaseRemoveLockEx
IoCancelIrp
KeWaitForSingleObject
IofCallDriver
IoAllocateIrp
KeInitializeEvent
IoAcquireRemoveLockEx
_allmul
IoBuildDeviceIoControlRequest
InterlockedDecrement
InterlockedIncrement
ExfInterlockedInsertTailList
ExfInterlockedRemoveHeadList
KeInitializeSpinLock
IoFreeWorkItem
IoQueueWorkItem
InterlockedCompareExchange
IoAllocateWorkItem
KeResetEvent
KeClearEvent
IoRegisterDeviceInterface
PoStartNextPowerIrp
PoSetPowerState
PoCallDriver
PoRequestPowerIrp
IoSetDeviceInterfaceState
IoDeleteDevice
IoDetachDevice
RtlFreeUnicodeString
IoReleaseRemoveLockAndWaitEx
InterlockedExchange
IoReleaseCancelSpinLock

hal

KfReleaseSpinLock
KfAcquireSpinLock

smclib.sys

SmartcardT1Request
SmartcardT0Request
SmartcardT0Reply
SmartcardUpdateCardCapabilities
SmartcardDeviceControl
SmartcardT1Reply
SmartcardInitialize
SmartcardExit

usbd.sys

USBD_ParseConfigurationDescriptorEx
USBD_CreateConfigurationRequestEx
USBD_ParseDescriptors

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEABLE
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Warning.bmp
$PLUGINSDIR/WndProc.dll
.dll windows:4 windows x86 arch:x86

b3f659d7637a91b4fec12ff9b930080d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpyA
GlobalAlloc

user32

CallWindowProcA
SetWindowLongA
GetPropA
SetPropA
wsprintfA

Exports

Exports

onCallback

Sections

.text
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 377B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/bg.bmp
$PLUGINSDIR/bg_check.bmp
$PLUGINSDIR/btn_close.bmp
$PLUGINSDIR/btn_no.bmp
$PLUGINSDIR/btn_ok.bmp
$PLUGINSDIR/check.bmp
$PLUGINSDIR/failed.bmp
$PLUGINSDIR/loading1.bmp
$PLUGINSDIR/loading2.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsProcess.dll
.dll windows:4 windows x86 arch:x86

c9fc7f6df8fedf8f8f1f9f820c072664

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
CloseHandle
TerminateProcess
OpenProcess
lstrcmpiA
WideCharToMultiByte
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryA
GetVersionExA
GlobalFree
lstrcpynA
GlobalAlloc

Exports

Exports

_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 646B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 146B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsWindows$_13_.dll
.dll windows:4 windows x86 arch:x86

8baa37b4b9803e205026a5e2d38eebac

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapAlloc
lstrcpyA
HeapFree
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetCurrentDirectoryA
GetProcessHeap
SetCurrentDirectoryA

user32

IsIconic
GetDlgItem
RemovePropA
DestroyWindow
DrawFocusRect
GetWindowLongA
DrawTextA
ShowWindow
CallWindowProcA
SetCursor
LoadCursorA
SetWindowPos
MapWindowPoints
CreateWindowExA
RegisterClassA
LoadIconA
GetWindowRect
IsWindow
SetWindowLongA
SetPropA
SetTimer
KillTimer
SetLayeredWindowAttributes
DispatchMessageA
TranslateMessage
IsDialogMessageA
GetMessageA
wsprintfA
SetForegroundWindow
GetPropA
CharPrevA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
GetWindowTextA

gdi32

SetTextColor
GetStockObject

shell32

DragQueryFileA
DragAcceptFiles
SHGetPathFromIDListA
SHBrowseForFolderA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetTransparent
SetUserData
Show
onDropFiles

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/title-install.bmp
$PLUGINSDIR/title-welcome.bmp
$PROGRAMFILES64/CCBComponents/Detector/CCBSignCom.ocx
.dll regsvr32 windows:5 windows x64 arch:x64

49188f25931fb9cf8ce4eebe9e438404

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:67:53:94:f0:24:36:2c:76:4d:69:e7:02:75:cf:7f:1f:c2:46:b3
Signer

Actual PE Digest

2c:67:53:94:f0:24:36:2c:76:4d:69:e7:02:75:cf:7f:1f:c2:46:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

HeapSetInformation
HeapCreate
HeapDestroy
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetConsoleCP
GetConsoleMode
GetACP
IsValidCodePage
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
SizeofResource
LockResource
LoadResource
FindResourceA
WideCharToMultiByte
LCMapStringA
GetStdHandle
FlsAlloc
FlsFree
FlsGetValue
DecodePointer
EncodePointer
HeapQueryInformation
HeapSize
VirtualQuery
GetSystemInfo
VirtualAlloc
GetSystemDefaultLangID
FindClose
DeleteFileA
FindFirstFileA
CreateDirectoryA
TerminateProcess
GetTempPathA
FileTimeToSystemTime
GetLastError
GetProcAddress
GetModuleHandleA
FreeLibrary
GlobalAlloc
lstrcmpA
GlobalLock
CompareStringA
LoadLibraryA
GetLocaleInfoA
GetModuleFileNameA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThreadId
GetCurrentThread
GlobalDeleteAtom
CloseHandle
GlobalAddAtomA
SetLastError
GetCurrentProcessId
GetModuleFileNameW
lstrlenA
GetModuleHandleW
GlobalUnlock
GlobalFree
FreeResource
MulDiv
lstrlenW
LocalFree
FormatMessageA
GlobalSize
CopyFileA
GetUserDefaultLCID
VirtualProtect
ExitProcess
Sleep
GetCommandLineA
FlsSetValue
HeapReAlloc
RtlPcToFileHeader
RaiseException
HeapFree
HeapAlloc
RtlUnwindEx
RtlLookupFunctionEntry
GetProfileIntA
GetFileTime
GetFileSizeEx
GetFileAttributesA
FindResourceExA
GetOEMCP
GetCPInfo
GetVersion
FileTimeToLocalFileTime
CreateFileA
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
InitializeCriticalSection
EnterCriticalSection
TlsGetValue
GetVersionExA
LeaveCriticalSection
LocalAlloc
IsDBCSLeadByte
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
MultiByteToWideChar

user32

GetDCEx
GetDialogBaseUnits
GetTabbedTextExtentA
CharUpperA
DestroyIcon
GetSysColorBrush
UnregisterClassA
LockWindowUpdate
EnumChildWindows
RegisterClipboardFormatA
SetRect
SetWindowRgn
IsRectEmpty
CreateMenu
DestroyMenu
SetRectEmpty
LoadCursorA
SetCapture
ReleaseCapture
MoveWindow
SetWindowTextA
IsDialogMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
GetClassLongPtrA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextA
GetTopWindow
GetWindowLongPtrA
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
FillRect
EnableWindow
SendMessageA
PostQuitMessage
PtInRect
GetDlgCtrlID
GetMenu
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
GetForegroundWindow
PostMessageA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
SetCursor
MessageBoxA
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetWindowThreadProcessId
UnhookWindowsHookEx
SetParent
DrawEdge
ShowWindow
CopyRect
DefWindowProcA
InflateRect
OffsetRect
GetMenuItemCount
GetMenuItemID
TabbedTextOutA
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
SetActiveWindow
CreateDialogIndirectParamA
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetSysColor
SetWindowLongA
CallWindowProcA
SetWindowPos
SetWindowLongPtrA
DestroyWindow
GetDesktopWindow
InvalidateRect
UpdateWindow
GetWindowRect
GetSubMenu
RegisterWindowMessageA

gdi32

DeleteObject
SelectClipRgn
CreateRectRgn
GetObjectA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
CreatePatternBrush
CreatePen
CreateSolidBrush
CombineRgn
CreateRectRgnIndirect
CreateFontIndirectA
GetTextExtentPoint32A
GetTextAlign
GetTextMetricsA
SetRectRgn
PatBlt
EnumFontFamiliesExA
Rectangle
UnrealizeObject
MoveToEx
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetBkMode
SetBkColor
RestoreDC
SaveDC
Ellipse
GetStockObject
CreateBitmap
GetDeviceCaps
LPtoDP
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
DeleteDC
CopyMetaFileA
CreateDCA

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegQueryValueA
RegQueryValueExA
CryptReleaseContext
CryptDestroyHash
CryptSignHashA
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam
CryptGetProvParam
RegDeleteValueA
RegSetValueExA
RegSetValueA
RegCreateKeyA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegCloseKey

shell32

ExtractIconA
ShellExecuteExA

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

ole32

OleLoadFromStream
CoCreateInstance
ReadClassStm
CreateStreamOnHGlobal
CreateDataAdviseHolder
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateOleAdviseHolder
CoDisconnectObject
OleDuplicateData
ReleaseStgMedium
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
ReadFmtUserTypeStg
OleSaveToStream
CoTaskMemAlloc
CreateDataCache
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CoRevokeClassObject
CoRegisterClassObject

oleaut32

SysStringLen
RegisterTypeLi
LoadTypeLi
OleCreatePropertyFrame
VariantClear
VariantChangeType
SysAllocStringByteLen
VariantInit
OleLoadPicture
SysAllocString
VariantCopy
OleCreateFontIndirect
SysStringByteLen
OleCreatePictureIndirect
SysFreeString
SysAllocStringLen
LoadRegTypeLi

crypt32

CertNameToStrA
CertFindCertificateInStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CryptEncodeObjectEx
CertCloseStore
CertFreeCertificateContext
CertOIDToAlgId
CertEnumCertificateContextProperties
CertOpenStore

ws2_32

htonl

oleacc

LresultFromObject
CreateStdAccessibleObject

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES64/CCBComponents/Detector/Ccb_Cert_dmwz_GM.dll
.dll windows:5 windows x64 arch:x64

eeeff6d6f6f8d156c57e6cf3f5d76253

Code Sign

55:cd:9f:f7:c4:a4:6f:45:96:c6:6b:18:18:87:66:30:4e:24:59:a3
Signer

Actual PE Digest

55:cd:9f:f7:c4:a4:6f:45:96:c6:6b:18:18:87:66:30:4e:24:59:a3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Administrator\Desktop\V3.0\x64\Release\Ccb_Cert_dmwz_GM.pdb

Imports

kernel32

RaiseException
RtlPcToFileHeader
HeapSize
HeapQueryInformation
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapSetInformation
HeapCreate
HeapDestroy
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
RtlUnwindEx
GetCommandLineA
FlsSetValue
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapReAlloc
HeapFree
ExitThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapAlloc
GetOEMCP
GetCPInfo
GetModuleHandleW
GlobalFlags
WritePrivateProfileStringA
CreateFileA
GetCurrentProcess
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetCurrentProcessId
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
InitializeCriticalSection
TlsGetValue
SetErrorMode
SuspendThread
SetThreadPriority
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
lstrcmpW
GetModuleFileNameW
FormatMessageA
lstrlenA
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
CompareStringA
lstrcmpA
CreateThread
QueryPerformanceCounter
lstrcpyA
ResetEvent
SetEvent
FreeResource
GlobalAlloc
GlobalFree
MulDiv
GlobalUnlock
GlobalLock
CreateEventA
GetSystemTime
GetModuleFileNameA
GetVersionExA
FileTimeToSystemTime
CompareFileTime
SystemTimeToFileTime
GetLocalTime
Sleep
Process32Next
Process32First
CreateToolhelp32Snapshot
LocalFree
LocalAlloc
GetSystemDirectoryA
GetLastError
GetModuleHandleA
MultiByteToWideChar
CloseHandle
ResumeThread
LockResource
GetCurrentThreadId
LoadLibraryA
FreeLibrary
SizeofResource
LoadResource
FindResourceA
WideCharToMultiByte
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
GetExitCodeProcess
WaitForSingleObject
GetPrivateProfileIntA
GetPrivateProfileStringA
GetTempPathA
GetEnvironmentStrings
SetLastError
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetSysColorBrush
GetWindowThreadProcessId
EndPaint
BeginPaint
GrayStringA
DrawTextExA
TabbedTextOutA
UnregisterClassA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
ValidateRect
SetWindowTextA
IsDialogMessageA
GetDesktopWindow
CreateDialogIndirectParamA
IsWindowEnabled
SendDlgItemMessageA
WinHelpA
GetCapture
GetClassLongPtrA
SetPropA
GetPropA
RemovePropA
IsWindow
GetWindowTextLengthA
GetLastActivePopup
SetActiveWindow
GetTopWindow
GetWindowLongPtrA
SetWindowLongPtrA
GetMessageTime
MapWindowPoints
SetMenu
IsWindowVisible
MessageBoxA
GetClassInfoExA
GetClassInfoA
AdjustWindowRectEx
PtInRect
CallWindowProcA
GetMenu
IsIconic
GetWindowPlacement
GetWindow
GetMenuState
GetMenuItemID
GetMenuItemCount
EndDialog
ChildWindowFromPoint
GetDlgCtrlID
ScreenToClient
GetCursorPos
DrawTextA
GetWindowTextA
SystemParametersInfoA
GetClassLongA
SetWindowLongA
SetRect
FrameRect
ReleaseDC
GetSysColor
FillRect
DrawStateA
OffsetRect
GetMessagePos
GetClientRect
DrawFocusRect
InflateRect
CopyRect
TrackPopupMenuEx
GetSubMenu
GetActiveWindow
WindowFromPoint
ClientToScreen
InvalidateRect
SetCursor
GetParent
GetWindowLongA
DestroyIcon
DestroyMenu
DestroyCursor
GetKeyState
MoveWindow
CallNextHookEx
KillTimer
GetDC
SetTimer
PostMessageA
RegisterWindowMessageA
SetForegroundWindow
GetForegroundWindow
PeekMessageA
MsgWaitForMultipleObjects
UnregisterDeviceNotification
DispatchMessageA
TranslateMessage
GetMessageA
RegisterDeviceNotificationA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
LoadCursorA
DefWindowProcA
PostQuitMessage
DestroyWindow
CharUpperA
EnableWindow
GetSystemMetrics
SetFocus
GetNextDlgTabItem
GetFocus
SetWindowPos
GetWindowRect
GetClassNameA
FindWindowA
SetWindowsHookExA
GetDlgItem
SendMessageA
UnhookWindowsHookEx
LoadIconA

gdi32

ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteDC
MoveToEx
LineTo
SetMapMode
RestoreDC
SaveDC
GetClipBox
RoundRect
CreatePen
CreateFontIndirectA
SetDIBColorTable
CreateDIBSection
CreateSolidBrush
GetDeviceCaps
GetObjectA
SetBkColor
CreateBitmap
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
SetTextColor
SetBkMode
GetStockObject
SetStretchBltMode
SelectObject
StretchBlt
DeleteObject

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegEnumKeyA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
CryptAcquireContextA
CryptGetProvParam
CryptReleaseContext
RegOpenKeyA
RegSetValueExA
RegDeleteKeyA
RegQueryValueA

shell32

SHGetSpecialFolderPathA
ShellExecuteExA
ShellExecuteA
SHGetFolderPathA

comctl32

_TrackMouseEvent

shlwapi

PathFindExtensionA
PathFindFileNameA
PathFileExistsA

ole32

CreateStreamOnHGlobal
StringFromGUID2

oleaut32

VariantClear
VariantChangeType
VariantInit

gdiplus

GdiplusShutdown
GdipFree
GdipAlloc
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectI
GdipLoadImageFromStream
GdipCloneImage
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdiplusStartup
GdipGetImageGraphicsContext
GdipDrawImageI
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits

crypt32

CryptMsgOpenToDecode
CryptEncodeObjectEx
CertNameToStrA
CertFindRDNAttr
CryptDecodeObjectEx
CertAddEncodedCertificateToStore
CertGetNameStringA
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CertCreateCertificateContext
CertCloseStore
CertFreeCertificateContext
CryptMsgUpdate
CryptMsgClose
CryptMsgGetParam
CertGetCertificateContextProperty
CertOpenStore
CertEnumCertificatesInStore

ws2_32

htonl

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: - Virtual size: 352KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 388KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PROGRAMFILES64/CCBComponents/Detector/Ccb_Cert_hdzb_GM.dll
.dll windows:5 windows x64 arch:x64

678d72dbd2c1c7670f68f957fb852901

Code Sign

43:f0:31:c7:f6:2b:c7:af:53:86:b7:ef:3f:70:7c:c0:52:c1:c1:8a
Signer

Actual PE Digest

43:f0:31:c7:f6:2b:c7:af:53:86:b7:ef:3f:70:7c:c0:52:c1:c1:8a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\10.1.10.3\建行中间件\开发库\PC\trunk\srcNewUI\CCB_CERT_HDZB_SHELL\x64\Release_GM\Ccb_Cert_hdzb_GM.pdb

Imports

kernel32

GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
GetLastError
FlsAlloc
HeapFree
Sleep
GetModuleHandleW
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
RtlUnwindEx
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES64/CCBComponents/Detector/Ccb_Cert_watchdata2G_GM.dll
.dll windows:5 windows x64 arch:x64

df16f7163c665f140c7398dfe6ecc8eb

Code Sign

f8:27:0f:e3:f9:46:38:9f:69:b0:70:17:12:4a:d5:e2:82:d1:25:74
Signer

Actual PE Digest

f8:27:0f:e3:f9:46:38:9f:69:b0:70:17:12:4a:d5:e2:82:d1:25:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

RtlUnwindEx
Sleep
ExitProcess
RaiseException
RtlPcToFileHeader
HeapSize
HeapQueryInformation
HeapReAlloc
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
RtlLookupFunctionEntry
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetACP
IsValidCodePage
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapFree
HeapAlloc
GetCommandLineA
FlsSetValue
GetOEMCP
GetCPInfo
GetModuleHandleW
CreateFileA
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
FormatMessageA
MultiByteToWideChar
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
lstrlenA
TlsFree
GlobalFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalUnlock
GlobalReAlloc
TlsAlloc
InitializeCriticalSection
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalFree
LocalAlloc
GetModuleFileNameW
GetCurrentProcessId
GetLastError
SetLastError
GlobalAddAtomA
CloseHandle
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
WideCharToMultiByte
CompareStringA
FindResourceA
LoadResource
LockResource
SizeofResource
GlobalLock
lstrcmpA
GlobalAlloc
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeEnvironmentStringsW
FreeLibrary

user32

DestroyMenu
LoadCursorA
GetSysColorBrush
ShowWindow
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
GetClassLongPtrA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetWindowLongPtrA
SetWindowLongPtrA
GetMessageTime
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetMenuItemID
GetSubMenu
GetWindow
GetDlgCtrlID
GetWindowRect
PostQuitMessage
PostMessageA
CheckMenuItem
EnableMenuItem
GetClassNameA
PtInRect
GetWindowTextA
SetWindowTextA
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringA
GetMessagePos
GetMenuState
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
SetCursor
DrawTextExA
DrawTextA
TabbedTextOutA
GetMenuItemCount
UnregisterClassA
UnhookWindowsHookEx
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA

gdi32

DeleteDC
GetStockObject
GetDeviceCaps
SelectObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
CreateBitmap
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
SetViewportOrgEx

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shlwapi

PathFindFileNameA
PathFindExtensionA

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

CryptSign
Detect
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCBNetSignCom.dll
.dll regsvr32 windows:4 windows x86 arch:x86

8dee353a812b5dff0236bdd313a12919

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

dd:f2:b0:ba:d1:96:12:c5:ee:0e:3c:f6:c2:fb:0d:61:42:05:65:bd
Signer

Actual PE Digest

dd:f2:b0:ba:d1:96:12:c5:ee:0e:3c:f6:c2:fb:0d:61:42:05:65:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

htonl

crypt32

CryptEncodeObjectEx
CertOpenStore
CertEnumCertificateContextProperties
CertOIDToAlgId
CertFreeCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertNameToStrA
CertFindCertificateInStore

kernel32

FindFirstFileA
TerminateProcess
GetTempPathA
CreateDirectoryA
lstrcmpA
LCMapStringA
GetSystemDefaultLangID
ReadFile
SetEndOfFile
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
CreateFileA
FlushFileBuffers
SetStdHandle
DeleteFileA
GetCPInfo
SetFilePointer
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
WriteFile
CloseHandle
SetUnhandledExceptionFilter
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
ExitProcess
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetVersionExA
GetEnvironmentVariableA
GetVersion
GetCommandLineA
RaiseException
HeapReAlloc
HeapAlloc
FindClose
LockResource
GlobalHandle
GlobalFree
FreeResource
FileTimeToSystemTime
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
InterlockedIncrement
HeapSize
InterlockedDecrement
LoadLibraryA
GetProcAddress
lstrcatA
lstrcpyA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
DisableThreadLibraryCalls
IsDBCSLeadByte
lstrcpynA
lstrcmpiA
LoadLibraryExA
GetLastError
FindResourceA
LoadResource
SizeofResource
FreeLibrary
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
LocalFree
RtlUnwind
HeapFree

user32

GetClientRect
GetFocus
IsChild
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
DestroyWindow
DefWindowProcA
GetDC
ReleaseDC
CharNextA
SetFocus
IsWindow
EndPaint
GetDlgItem
InvalidateRgn
SetCapture
ReleaseCapture
CreateAcceleratorTableA
GetDesktopWindow
GetClassNameA
RedrawWindow
FillRect
GetSysColor
GetWindowRect
SystemParametersInfoA
MapWindowPoints
ShowWindow
SendMessageA
EndDialog
MessageBoxA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetWindow
RegisterWindowMessageA
DialogBoxIndirectParamA
GetActiveWindow
LoadStringA
CreateWindowExA
CallWindowProcA
GetWindowLongA
SetWindowLongA
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
UnionRect
PtInRect
GetKeyState
InvalidateRect
GetParent
BeginPaint

gdi32

GetStockObject
GetObjectA
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
CreateMetaFileA
SetWindowExtEx
CloseMetaFile
CreateRectRgnIndirect
Rectangle
SetTextAlign
TextOutA
CreateDCA
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
DeleteMetaFile

advapi32

CryptGetProvParam
CryptGetHashParam
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumValueA
CryptReleaseContext
CryptDestroyHash
CryptSignHashA
CryptAcquireContextA
CryptCreateHash
CryptHashData
RegDeleteKeyA

shell32

ShellExecuteExA

ole32

OleLockRunning
StringFromCLSID
CLSIDFromString
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
OleLoadFromStream
CreateDataAdviseHolder
OleRegGetMiscStatus
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
OleSaveToStream
WriteClassStm
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

SysStringByteLen
OleCreateFontIndirect
SysAllocStringLen
SysAllocStringByteLen
OleCreatePropertyFrame
SysFreeString
VariantChangeType
VariantClear
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
RegisterTypeLi
VarUI4FromStr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCBSignCom.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

910fe4adf8cff0c8776fce03e839b689

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7c:60:a8:52:2a:39:55:0a:ca:ec:46:82:bb:42:98:a2:dd:6a:1e:4e
Signer

Actual PE Digest

7c:60:a8:52:2a:39:55:0a:ca:ec:46:82:bb:42:98:a2:dd:6a:1e:4e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord6354
ord1216
ord1168
ord6467
ord1227
ord6042
ord823
ord1877
ord4249
ord2486
ord2687
ord4006
ord6364
ord3326
ord6365
ord4472
ord5498
ord3278
ord3353
ord3681
ord446
ord743
ord1177
ord1226
ord1210
ord2727
ord2730
ord2729
ord2439
ord1693
ord5618
ord994
ord4342
ord4687
ord4639
ord5674
ord2156
ord4856
ord4920
ord6002
ord2137
ord1963
ord5213
ord2953
ord3868
ord5150
ord4705
ord4707
ord2876
ord2998
ord5649
ord4113
ord4661
ord4660
ord4768
ord4650
ord4903
ord4548
ord4521
ord4594
ord4988
ord4925
ord4930
ord4935
ord4659
ord4909
ord4908
ord4668
ord4667
ord4666
ord4648
ord4689
ord5023
ord4654
ord4643
ord4354
ord4780
ord4649
ord4637
ord4636
ord5060
ord4584
ord4371
ord4361
ord4356
ord4739
ord4741
ord4738
ord4409
ord4603
ord5008
ord4415
ord4992
ord4979
ord2488
ord3404
ord4539
ord2954
ord6055
ord4078
ord1776
ord5199
ord3136
ord2384
ord5163
ord6370
ord2724
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2983
ord3148
ord3260
ord4466
ord2986
ord3080
ord4081
ord4624
ord5825
ord723
ord3946
ord2614
ord540
ord800
ord423
ord2860
ord2541
ord4949
ord641
ord2514
ord324
ord1601
ord2818
ord5572
ord2915
ord1892
ord4252
ord1212
ord4570
ord4672
ord4843
ord5011
ord5265
ord4376
ord4853
ord4998
ord4713
ord6052
ord1775
ord2385
ord6371
ord5286
ord4438
ord3279
ord4625
ord4425
ord449
ord746
ord2278
ord537
ord860
ord941
ord4710
ord6374
ord5280
ord4627
ord3597
ord4234
ord1768
ord6199
ord3092
ord2379
ord1200
ord4224
ord1132
ord3952
ord825
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord561
ord3670
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord3401
ord2976
ord3081
ord2985
ord4353
ord3262
ord5300
ord1089
ord3922
ord5731
ord3346
ord5241
ord2396
ord2512
ord2554
ord4486
ord6375
ord4407
ord815
ord1131

msvcrt

__CxxFrameHandler
calloc
free
wcslen
_itoa
malloc
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_onexit
__dllonexit
memmove
printf
fopen
fclose
realloc
toupper
iswdigit
strchr
_CxxThrowException
strstr
sprintf
fwrite

kernel32

LocalFree
GetLastError
FileTimeToSystemTime
CreateDirectoryA
GetTempPathA
TerminateProcess
FindFirstFileA
DeleteFileA
FindClose
GetSystemDefaultLangID
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LocalAlloc

user32

FillRect
SendMessageA
EnableWindow

gdi32

Ellipse
GetStockObject

advapi32

CryptAcquireContextA
CryptHashData
CryptSignHashA
CryptDestroyHash
CryptReleaseContext
CryptGetHashParam
CryptGetProvParam
CryptCreateHash

shell32

ShellExecuteExA

oleaut32

VariantClear
LoadRegTypeLi

crypt32

CertCloseStore
CryptEncodeObjectEx
CertFindCertificateInStore
CertNameToStrA
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOIDToAlgId
CertEnumCertificateContextProperties
CertOpenStore

ws2_32

htonl

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCB_B2B_NetSign.dll
.dll regsvr32 windows:4 windows x86 arch:x86

aa5531ecbff723b149fb7f029f835b73

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9d:06:62:fe:6b:a7:6a:3c:5d:c2:04:99:48:9e:2f:21:e4:e2:39:1e
Signer

Actual PE Digest

9d:06:62:fe:6b:a7:6a:3c:5d:c2:04:99:48:9e:2f:21:e4:e2:39:1e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalLock
GlobalUnlock
GlobalAlloc
FindResourceA
LoadResource
LockResource
GlobalHandle
GlobalFree
FreeResource
GetCurrentProcess
InterlockedIncrement
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
CreateFileA
WriteFile
CloseHandle
lstrlenA
GetLastError
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
lstrcmpA
lstrcatA
lstrcpyA
FileTimeToSystemTime
ReadFile
GetFileSize
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetShortPathNameA
GetModuleHandleA
SizeofResource
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
LCMapStringA
GetSystemDefaultLangID
FlushInstructionCache

user32

CallWindowProcA
GetWindowLongA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetWindow
DefWindowProcA
RegisterWindowMessageA
GetClassInfoExA
LoadCursorA
RegisterClassExA
DialogBoxIndirectParamA
SetWindowLongA
GetSysColor
MessageBoxA
GetActiveWindow
GetFocus
ReleaseDC
GetDC
EndPaint
FillRect
GetClientRect
BeginPaint
SetWindowPos
IsWindow
RedrawWindow
GetClassNameA
GetParent
SetFocus
LoadStringA
GetDesktopWindow
CreateAcceleratorTableA
DestroyWindow
wsprintfA
CreateWindowExA
ReleaseCapture
SetCapture
InvalidateRect
InvalidateRgn
SendMessageA
GetDlgItem
EndDialog
MapWindowPoints
SystemParametersInfoA
GetWindowRect
GetKeyState
PtInRect
UnionRect
ShowWindow
CharNextA
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
IsChild

gdi32

SaveDC
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
GetTextExtentPointA
GetStockObject
GetObjectA
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetDeviceCaps
CreateMetaFileA
SetViewportOrgEx
SetMapMode
LPtoDP
CreateDCA
SetTextAlign
Rectangle
SetWindowOrgEx

comdlg32

CommDlgExtendedError
GetOpenFileNameA
GetSaveFileNameA

advapi32

RegEnumKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptAcquireContextA
CryptReleaseContext
CryptDestroyHash
CryptSignHashA
CryptHashData
CryptCreateHash
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegSetValueExA
RegQueryInfoKeyA
RegEnumValueA

shell32

SHGetSpecialFolderPathA

ole32

OleLoadFromStream
CreateDataAdviseHolder
OleRegGetMiscStatus
OleRegGetUserType
OleRegEnumVerbs
CoTaskMemAlloc
WriteClassStm
CoTaskMemFree
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
OleSaveToStream
CreateOleAdviseHolder
StringFromCLSID
CoTaskMemRealloc
OleLockRunning

oleaut32

VarUI4FromStr
OleCreatePropertyFrame
SysFreeString
SysAllocStringLen
SysStringLen
SysAllocString
LoadRegTypeLi
VariantClear
OleCreateFontIndirect
LoadTypeLi
RegisterTypeLi
VariantChangeType
SysAllocStringByteLen
SysStringByteLen

wsock32

ntohl

crypt32

CertFreeCertificateContext
CryptEncryptMessage
CryptSignMessage
CertFindCertificateInStore
CertCloseStore
CertNameToStrA
CertEnumCertificatesInStore
CertOpenStore
CertVerifySubjectCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptVerifyMessageSignature
CryptHashMessage
CryptVerifyDetachedMessageSignature
CryptMsgGetParam
CryptMsgUpdate
CryptMsgOpenToDecode
CertGetNameStringA
CryptDecodeObject
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertOpenSystemStoreA
CertCompareIntegerBlob
CryptDecryptMessage
CryptSignAndEncryptMessage
CryptDecryptAndVerifyMessageSignature
CertOIDToAlgId
CertGetCertificateContextProperty
CertEnumCertificateContextProperties

msvcrt

_open
memmove
_strdate
_strtime
fflush
_stat
fread
_filelength
_read
_tzset
_timezone
fopen
fwrite
fclose
??2@YAPAXI@Z
strcmp
strtok
strrchr
strncpy
isprint
abs
strchr
_local_unwind2
_except_handler3
printf
atoi
_CxxThrowException
__CxxFrameHandler
strcpy
strstr
_daylight
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
?terminate@@YAXXZ
sprintf
realloc
calloc
strlen
strcat
??3@YAXPAX@Z
free
malloc
memset
mktime
memcmp
memcpy
_purecall
time
_errno

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCB_GMSignCom.dll
.dll regsvr32 windows:4 windows x86 arch:x86

2ecb8bef43ae874152feb4446e9cbd6f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ae:3e:13:02:7b:52:86:f8:33:86:75:1d:ea:16:86:0e:62:db:f3:fe
Signer

Actual PE Digest

ae:3e:13:02:7b:52:86:f8:33:86:75:1d:ea:16:86:0e:62:db:f3:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord1116
ord1176
ord1575
ord1168
ord1577
ord1182
ord342
ord4224
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord1200
ord4376
ord4853
ord2379
ord3092
ord6199
ord1768
ord4234
ord641
ord324
ord3597
ord4425
ord4627
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4710
ord4998
ord5265
ord941
ord860
ord2915
ord5572
ord2818
ord537
ord1601
ord4274
ord540
ord800
ord2614
ord823
ord6467
ord1131
ord2725
ord3953
ord825
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord815
ord1243

msvcrt

memcmp
fclose
fprintf
fopen
strcat
vsprintf
sprintf
memset
realloc
malloc
strlen
strstr
_CxxThrowException
fwrite
strchr
strcmp
printf
toupper
memmove
_purecall
memcpy
_itoa
wcslen
strcpy
__CxxFrameHandler
calloc
free
__dllonexit
_onexit
_except_handler3
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
?terminate@@YAXXZ

kernel32

lstrcpyA
LoadLibraryA
GetProcAddress
HeapDestroy
IsDBCSLeadByte
lstrcpynA
lstrcmpiA
LoadLibraryExA
GetLastError
FindResourceA
LoadResource
SizeofResource
FreeLibrary
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
MultiByteToWideChar
lstrlenW
lstrlenA
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FlushInstructionCache
GetCurrentProcess
GlobalUnlock
GlobalLock
GlobalAlloc
OutputDebugStringA
GetCurrentProcessId
LCMapStringA
GetSystemDefaultLangID
FindClose
DeleteFileA
FindFirstFileA
TerminateProcess
GetTempPathA
CreateDirectoryA
FileTimeToSystemTime
LocalFree
LocalAlloc
lstrcatA
GetCurrentThreadId

user32

DefWindowProcA
GetKeyState
PtInRect
UnionRect
ShowWindow
SetWindowLongA
GetWindowLongA
CallWindowProcA
CreateWindowExA
CharNextA
RegisterClassExA
wsprintfA
LoadCursorA
GetClassInfoExA
DestroyWindow
IsChild
GetFocus
SetFocus
GetParent
IsWindow
SetWindowPos
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
ReleaseDC
GetDC
EnableWindow
SendMessageA
BeginPaint
GetClientRect
EndPaint
InvalidateRect

gdi32

SaveDC
CreateMetaFileA
GetDeviceCaps
DeleteDC
SetViewportOrgEx
SetMapMode
LPtoDP
CreateDCA
SetWindowOrgEx
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
Rectangle
SetTextAlign
TextOutA

advapi32

RegEnumKeyExA
CryptDestroyHash
CryptSignHashA
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGetProvParam
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
CryptReleaseContext
RegOpenKeyExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA

shell32

SHGetSpecialFolderPathA
ShellExecuteExA

ole32

CreateOleAdviseHolder
OleSaveToStream
OleLoadFromStream
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CreateDataAdviseHolder
OleRegGetMiscStatus
OleRegGetUserType
OleRegEnumVerbs
WriteClassStm

olepro32

ord250

oleaut32

VariantClear
VarUI4FromStr
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
SysAllocStringByteLen
SysStringByteLen
LoadRegTypeLi
SysStringLen
SysAllocStringLen
VariantChangeType

crypt32

CertCloseStore
CertFindCertificateInStore
CertNameToStrA
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOIDToAlgId
CertEnumCertificateContextProperties
CryptEncodeObjectEx
CertOpenStore

ws2_32

htonl

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/CCB_SwxCryptSimple.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

5a30ad7fbb51814a3892f0e358c5b09d

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:40:02:24:5f:30:08:7c:f6:b1:dc:07:e4:96:f9:63
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

15-12-2009 00:00

Not After

30-12-2012 23:59

Subject

CN=Beijing Watchdata System Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Watchdata System Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bf:cd:04:a0:6b:54:4e:01:68:55:57:89:6b:b1:89:9c:52:48:46:56
Signer

Actual PE Digest

bf:cd:04:a0:6b:54:4e:01:68:55:57:89:6b:b1:89:9c:52:48:46:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenSystemStoreA
CertNameToStrA
CertCloseStore
CertGetCertificateContextProperty

mfc42

ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3402
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4424
ord3639
ord692
ord641
ord567
ord324
ord825
ord2340
ord2302
ord1200
ord4710
ord4234
ord4853
ord858
ord4376
ord860
ord823
ord2915
ord815
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord3401
ord4622
ord3670
ord561
ord3952
ord2724
ord6354
ord1216
ord1168
ord6467
ord1227
ord1131
ord1132
ord1877
ord4249
ord2486
ord2687
ord6364
ord3326
ord6365
ord4472
ord5498
ord3278
ord3353
ord3681
ord446
ord743
ord1177
ord1226
ord1210
ord2439
ord1693
ord5618
ord994
ord4342
ord4687
ord4639
ord5674
ord2156
ord4856
ord4920
ord6002
ord2137
ord6366
ord5213
ord2953
ord3868
ord5150
ord4705
ord4707
ord3749
ord2998
ord5649
ord4113
ord4661
ord4660
ord4768
ord4650
ord4903
ord4548
ord4521
ord4594
ord4988
ord4925
ord4930
ord4935
ord4659
ord4909
ord4908
ord4668
ord4667
ord4666
ord4648
ord4689
ord5023
ord4654
ord4643
ord4354
ord4780
ord4649
ord4637
ord4636
ord5060
ord4584
ord4371
ord4361
ord4356
ord4739
ord4741
ord4738
ord4409
ord4603
ord5008
ord4415
ord4992
ord4979
ord2488
ord3404
ord4539
ord2954
ord2384
ord6370
ord2983
ord3148
ord3260
ord4466
ord3269
ord2986
ord3080
ord4081
ord4624
ord5825
ord723
ord2614
ord3946
ord423
ord2860
ord2541
ord4949
ord1601
ord1892
ord4252
ord1212
ord4570
ord4672
ord4843
ord5011
ord4713
ord6371
ord5286
ord4438
ord3279
ord4625
ord449
ord746
ord2278
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord1771
ord3597
ord4425
ord5280
ord4407
ord1775
ord6052
ord2514
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4401
ord1776
ord4078
ord6055
ord2581
ord4219
ord2024
ord2876
ord2413
ord4998
ord5265
ord800
ord540
ord1963

msvcrt

_unlink
free
malloc
__CxxFrameHandler
wcstombs
??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
?terminate@@YAXXZ
_onexit
__dllonexit
_except_handler3
printf
strchr
strstr
fclose
fwrite
fopen
sprintf
wcsncpy
_EH_prolog
wcslen

kernel32

LocalFree
GetModuleFileNameA
WideCharToMultiByte
lstrcatA
lstrlenA
MultiByteToWideChar
lstrcpyA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
FreeLibrary
lstrlenW
DeleteCriticalSection
HeapDestroy
GetTempPathA
WinExec
GetLastError
LocalAlloc

user32

FillRect
SendMessageA
EnableWindow
CharNextA

gdi32

GetStockObject
Ellipse

advapi32

CryptSignHashA
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash

ole32

CoCreateInstance

oleaut32

LoadRegTypeLi
LoadTypeLi
SysAllocString
RegisterTypeLi
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/WDGetDeviceCaps.dll
.dll windows:4 windows x86 arch:x86

e0da1190d9fa88306e52d2bb4b4a0151

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3953
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord2512
ord6375
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord1176
ord1575
ord1168
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord2554
ord3081
ord4486
ord1255
ord6467
ord2976
ord4274
ord269
ord826
ord600
ord1578
ord1116

msvcrt

__CxxFrameHandler
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
??2@YAPAXI@Z

kernel32

LocalFree
LocalAlloc

user32

GetDC

gdi32

GetDeviceCaps

Exports

Exports

WDGetDeviceCaps

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/mfc42.dll
.dll regsvr32 windows:4 windows x86 arch:x86

bcd2542f46e742c06cabefff84c7320d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MFC42.pdb

Imports

msvcrt

memcpy
memmove
malloc
free
abort
_mbsinc
memset
_get_osfhandle
__doserrno
_fdopen
_open_osfhandle
fclose
clearerr
fread
fwrite
fputs
fgets
ftell
fseek
fflush
realloc
_mbscmp
_mbschr
_mbspbrk
_mbsrev
_mbslwr
_mbsupr
wcslen
_mbscspn
_mbsrchr
_mbsspn
_mbsstr
_mbsnbcmp
_mbclen
vsprintf
strlen
sprintf
_ismbcdigit
atoi
_ismbcspace
mktime
gmtime
localtime
strftime
time
_mbctype
_purecall
_msize
calloc
memcmp
abs
strtoul
strtol
strtod
_expand
_mbsdec
_strdup
_endthreadex
_beginthreadex
__p___argv
__p___argc
atol
_fullpath
_splitpath
floor
fabs
_ftol
ceil
modf
_itoa
labs
swprintf
_ultoa
_ltoa
wcscpy
wcsncpy
_mbsnbicmp
??1type_info@@UAE@XZ
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_initterm
_adjust_fdiv
strcmp
strcpy
_CxxThrowException
__CxxFrameHandler

kernel32

WriteFile
GetProcAddress
LoadLibraryA
lstrcpyA
FindClose
FindFirstFileA
GetVolumeInformationA
GetFullPathNameA
GetCurrentProcess
GlobalSize
GlobalLock
GlobalAlloc
GlobalReAlloc
GlobalUnlock
GlobalFree
GetFileAttributesA
GetFileSize
GetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
SetFileAttributesA
InterlockedDecrement
WideCharToMultiByte
InterlockedIncrement
LocalFree
FormatMessageA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCPInfo
GetOEMCP
LocalAlloc
LeaveCriticalSection
GlobalHandle
EnterCriticalSection
TlsGetValue
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
WaitForSingleObject
CreateSemaphoreA
ReleaseSemaphore
CreateMutexA
ReleaseMutex
CreateEventA
WaitForMultipleObjects
GetVersionExA
GetModuleHandleA
lstrcatA
FreeLibrary
GlobalDeleteAtom
GlobalFindAtomA
GetVersion
GlobalAddAtomA
GlobalGetAtomNameA
GetCurrentThreadId
FreeResource
LockResource
LoadResource
FindResourceA
MulDiv
GetProfileIntA
VirtualProtect
FindResourceExA
SizeofResource
GetProcessVersion
GlobalFlags
GetTempFileNameA
GetDiskFreeSpaceA
LocalUnlock
LocalLock
SearchPathA
GetTempPathA
SetThreadPriority
ResumeThread
SetEvent
SuspendThread
GetCurrentThread
SetErrorMode
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetCurrentDirectoryA
FindNextFileA
GetTickCount
lstrlenW
CopyFileA
lstrcpyW
GetUserDefaultLCID
IsDBCSLeadByte
GetSystemDirectoryA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DuplicateHandle
MultiByteToWideChar
GetModuleFileNameA
GetShortPathNameA
lstrcmpiA
GetThreadLocale
GetStringTypeExA
DeleteFileA
MoveFileA
SetEndOfFile
UnlockFile
LockFile
CloseHandle
FlushFileBuffers
SetFilePointer
ReadFile
lstrcmpA
OutputDebugStringA
lstrlenA
IsBadReadPtr
IsBadWritePtr
IsBadStringPtrA
IsBadStringPtrW
GetLastError
SetLastError
lstrcpynA
RaiseException
InterlockedExchange
CreateFileA

gdi32

ScaleWindowExtEx
GetROP2
EnumFontFamiliesA
GetPixel
GetPaletteEntries
RealizePalette
CreatePalette
OffsetRgn
SetBrushOrgEx
CreateMetaFileA
CopyMetaFileA
LPtoDP
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
DPtoLP
GetMapMode
CombineRgn
SetRectRgn
CreateHatchBrush
ExtCreatePen
CreateDIBPatternBrushPt
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
OffsetWindowOrgEx
SelectPalette
StartDocA
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
LineTo
OffsetClipRgn
ExcludeClipRect
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
EnumFontFamiliesExA
CreateDCA
CreateRectRgnIndirect
UnrealizeObject
CreateBitmap
CreatePatternBrush
CreatePen
PatBlt
Rectangle
TextOutA
DeleteMetaFile
CloseMetaFile
GetPolyFillMode
ScaleViewportExtEx
IntersectClipRect
GetDeviceCaps
SetMapMode
SetWindowExtEx
SetViewportExtEx
OffsetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
GetWindowOrgEx
SetWindowOrgEx
GetCurrentPositionEx
MoveToEx
GetWindowExtEx
GetViewportExtEx
GetTextFaceA
GetTextAlign
RectVisible
PtVisible
GetTextColor
GetBkMode
GetBkColor
Escape
GetNearestColor
SaveDC
RestoreDC
GetStockObject
CreateFontA
GetCharWidthA
DeleteObject
CreateCompatibleBitmap
StretchDIBits
DeleteDC
CreateFontIndirectA
GetTextMetricsA
GetTextExtentPoint32A
ExtTextOutA
BitBlt
SelectObject
CreateCompatibleDC
CreateSolidBrush
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetStretchBltMode

user32

GetScrollRange
LoadStringA
FrameRect
InvalidateRgn
EnumChildWindows
DrawEdge
ClipCursor
GetNextDlgGroupItem
CharNextA
SetWindowContextHelpId
CountClipboardFormats
WindowFromDC
CreateMenu
PostThreadMessageA
InSendMessage
CopyAcceleratorTableA
RegisterClipboardFormatA
InsertMenuA
GetMenuStringA
ShowOwnedPopups
UnregisterClassA
PostQuitMessage
ValidateRect
RemoveMenu
MessageBeep
IsClipboardFormatAvailable
FindWindowA
SetCursorPos
DestroyCursor
DestroyIcon
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
MoveWindow
IsDialogMessageA
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetWindowTextA
GetClassNameA
GetSysColorBrush
EndPaint
BeginPaint
TabbedTextOutA
GetDialogBaseUnits
MapDialogRect
GetAsyncKeyState
wvsprintfA
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
DrawFocusRect
UnionRect
GrayStringA
DrawTextA
GetTabbedTextExtentA
LockWindowUpdate
GetDCEx
SetParent
GetSystemMenu
AppendMenuA
DeleteMenu
IsRectEmpty
IsZoomed
GetDC
KillTimer
SetTimer
SetRect
LoadBitmapA
ReleaseDC
GetWindowDC
InvertRect
FillRect
PtInRect
InflateRect
RedrawWindow
TranslateMDISysAccel
wsprintfA
GetSystemMetrics
CharUpperA
CharToOemA
OemToCharA
UnhookWindowsHookEx
MsgWaitForMultipleObjects
GetWindow
CopyRect
GetWindowRect
GetWindowPlacement
IsIconic
SystemParametersInfoA
IntersectRect
OffsetRect
SetWindowPos
SetWindowLongA
GetWindowLongA
CallWindowProcA
DefWindowProcA
SendMessageA
GetDlgCtrlID
GetWindowTextA
GetWindowTextLengthA
GetDlgItem
SetWindowPlacement
RegisterClassA
GetClassInfoA
GetMenuItemCount
GetMenuItemID
GetSubMenu
PostMessageA
GetMenu
GetClientRect
GetParent
UpdateWindow
MessageBoxA
IsWindowVisible
SetActiveWindow
SetScrollInfo
GetScrollInfo
ScrollWindow
ShowScrollBar
GetLastActivePopup
DeferWindowPos
EqualRect
ScreenToClient
AdjustWindowRectEx
SetForegroundWindow
GetForegroundWindow
GetSysColor
MapWindowPoints
EnableWindow
PeekMessageA
LoadIconA
GetScrollPos
SetScrollPos
DrawMenuBar
SetScrollRange
DestroyWindow
GetKeyState
TrackPopupMenu
IsChild
GetTopWindow
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
IsWindow
GetFocus
GetMessagePos
GetMessageTime
RemovePropA
GetPropA
DispatchMessageA
SendDlgItemMessageA
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
WinHelpA
GetCapture
RegisterWindowMessageA
LoadAcceleratorsA
TranslateAcceleratorA
IsWindowEnabled
GetDesktopWindow
ShowWindow
SetMenu
BringWindowToTop
SetRectEmpty
InvalidateRect
ReleaseCapture
SetCursor
DestroyMenu
LoadMenuA
ReuseDDElParam
UnpackDDElParam
GetActiveWindow
LoadCursorA
ClientToScreen
GetWindowThreadProcessId
SetCapture
WindowFromPoint
GetCursorPos
TranslateMessage
GetMessageA
WaitMessage
DefFrameProcA
DefMDIChildProcA

Exports

Exports

?classCCachedDataPathProperty@CCachedDataPathProperty@@2UCRuntimeClass@@B
?classCDataPathProperty@CDataPathProperty@@2UCRuntimeClass@@B
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 660KB - Virtual size: 656KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/CCBDetector.exe
.exe windows:5 windows x86 arch:x86

f5f9fe40f289e08ac9f1fdd3fffbecfc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:f8:0a:29:62:f1:de:b7:8a:5a:88:89:67:37:f8:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-11-2015 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:4c:43:c6:70:0e:4c:81:c9:44:2b:63:01:18:c7:57
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-01-2016 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e3:46:75:38:c3:df:8e:a6:94:a0:7b:11:b7:cc:a7:eb:a6:2a:d8:db:84:72:74:dd:64:2a:8f:6e:a6:7c:00:86
Signer

Actual PE Digest

e3:46:75:38:c3:df:8e:a6:94:a0:7b:11:b7:cc:a7:eb:a6:2a:d8:db:84:72:74:dd:64:2a:8f:6e:a6:7c:00:86

Digest Algorithm

sha256

PE Digest Matches

true

50:b2:3f:f5:30:29:2f:00:b1:2d:2b:ca:34:ee:36:07:ab:12:c6:24
Signer

Actual PE Digest

50:b2:3f:f5:30:29:2f:00:b1:2d:2b:ca:34:ee:36:07:ab:12:c6:24

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FileTimeToLocalFileTime
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetVersion
GlobalMemoryStatus
SetEnvironmentVariableA
GetProcessHeap
CreateFileW
GetCurrentDirectoryW
CompareStringW
GetDriveTypeW
HeapFree
HeapQueryInformation
HeapSize
HeapReAlloc
HeapAlloc
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
QueryPerformanceCounter
SetHandleCount
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
IsProcessorFeaturePresent
LCMapStringW
IsValidCodePage
GetStringTypeW
OutputDebugStringW
WriteConsoleW
OutputDebugStringA
GetStdHandle
SetStdHandle
ExitThread
VirtualQuery
GetSystemInfo
VirtualAlloc
IsBadReadPtr
HeapValidate
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetSystemTimeAsFileTime
ExitProcess
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DecodePointer
EncodePointer
RtlUnwind
SearchPathA
GetNumberFormatA
GetTempFileNameA
FindResourceExW
InitializeCriticalSectionAndSpinCount
GetOEMCP
GetCPInfo
GetFullPathNameA
GetVolumeInformationA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetHandleInformation
GetSystemDirectoryW
GlobalFlags
GetProfileIntA
VirtualProtect
FileTimeToSystemTime
SetErrorMode
GetFileAttributesExA
GetFileTime
GetFileSizeEx
FindNextFileA
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
InterlockedIncrement
OpenEventA
GetAtomNameA
GetThreadLocale
LoadLibraryW
lstrcmpW
GlobalGetAtomNameA
GlobalFindAtomA
ResumeThread
SetThreadPriority
GlobalAddAtomA
CreateEventA
SuspendThread
SetEvent
CompareStringA
ActivateActCtx
DeactivateActCtx
GetModuleHandleW
InterlockedExchange
GlobalDeleteAtom
GetCurrentThread
GetLocaleInfoA
LoadLibraryExA
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
FindResourceA
FreeResource
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
MulDiv
lstrlenW
GlobalSize
SetLastError
GetCurrentDirectoryA
DuplicateHandle
GetFileType
lstrcmpA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetFileSize
LocalAlloc
GetCurrentThreadId
GetCurrentProcessId
GetACP
GetSystemDirectoryA
GetFileAttributesA
DeleteFileA
CreateProcessA
TerminateProcess
WaitForSingleObject
GetTempPathA
GetTickCount
CreateDirectoryA
GetCurrentProcess
SizeofResource
ReadFile
CreateFileA
WriteFile
SetFilePointer
GetVersionExA
lstrcpyA
lstrcmpiA
LoadLibraryA
FreeLibrary
GetModuleHandleA
GetProcAddress
lstrlenA
lstrcatA
GetWindowsDirectoryA
WinExec
CopyFileA
FindFirstFileA
FindClose
Sleep
GetModuleFileNameA
GetPrivateProfileStringA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetLocalTime
GetPrivateProfileIntA
WritePrivateProfileStringA
CreateThread
DeleteCriticalSection
GetSystemDefaultLangID
GetCommandLineW
CreateMutexA
GetLastError
CloseHandle
FormatMessageA
LocalFree
MultiByteToWideChar
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
InterlockedDecrement

user32

SetDlgItemTextA
CheckDlgButton
RegisterWindowMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
SendDlgItemMessageA
MonitorFromWindow
GetMonitorInfoA
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
WinHelpA
TrackPopupMenu
SetWindowPlacement
GetWindowPlacement
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetClassLongA
GetClassNameA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
SetMenu
GetMenu
GetMessageTime
GetMessagePos
SetWindowLongA
LoadIconW
LoadIconA
LoadCursorW
LoadCursorA
PostThreadMessageA
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
NotifyWinEvent
GetForegroundWindow
HideCaret
OpenClipboard
WindowFromPoint
SetParent
IsChild
GetTopWindow
ShowScrollBar
GetNextDlgTabItem
GetNextDlgGroupItem
SetCapture
GetCapture
KillTimer
SetTimer
EnableScrollBar
RedrawWindow
LockWindowUpdate
ShowOwnedPopups
InvalidateRgn
InvalidateRect
GetUpdateRect
UpdateWindow
ReleaseDC
GetWindowDC
EndPaint
BeginPaint
ScreenToClient
ClientToScreen
MoveWindow
ShowWindow
MapWindowPoints
GetClientRect
DestroyCursor
GetSysColor
SendMessageA
SetForegroundWindow
GetWindowRect
BringWindowToTop
GetWindowRgn
SetWindowRgn
IsZoomed
IsIconic
GetSystemMenu
DrawMenuBar
EndDialog
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
GetDC
CopyRect
SetFocus
IsWindowVisible
CopyAcceleratorTableA
GetLastActivePopup
EnableWindow
GetWindowThreadProcessId
SetCursor
CallNextHookEx
PeekMessageA
GetCursorPos
SetWindowsHookExA
CharNextA
GetSysColorBrush
FillRect
FrameRect
InvertRect
DrawIcon
DrawStateA
DrawEdge
DrawFrameControl
DrawFocusRect
DrawTextA
DrawTextExA
GrayStringA
ValidateRect
GetMessageA
TranslateMessage
DispatchMessageA
GetMenuCheckMarkDimensions
LoadBitmapW
SetMenuItemBitmaps
PostQuitMessage
MessageBeep
IsDialogMessageA
CreateMenu
CreatePopupMenu
DeleteMenu
CheckMenuItem
EnableMenuItem
SetMenuDefaultItem
GetMenuDefaultItem
GetMenuItemInfoA
InsertMenuItemA
ModifyMenuA
LoadMenuA
LoadMenuW
FindWindowA
GetSystemMetrics
LoadBitmapA
GetProcessWindowStation
GetUserObjectInformationW
SubtractRect
UnionRect
IntersectRect
InflateRect
SetRect
RegisterDeviceNotificationA
UnregisterDeviceNotification
SetWindowTextA
MessageBoxA
GetKeyState
GetAsyncKeyState
ReleaseCapture
PtInRect
GetMenuItemID
InsertMenuA
AppendMenuA
GetMenuStringA
MapVirtualKeyExA
IsCharLowerA
GetMenuState
GetSubMenu
GetMenuItemCount
IsMenu
RemoveMenu
MapDialogRect
IsWindow
PostMessageA
TabbedTextOutA
GetParent
SetWindowContextHelpId
GetWindow
SetWindowPos
GetWindowLongA
IsWindowEnabled
GetFocus
GetDoubleClickTime
IsClipboardFormatAvailable
DefMDIChildProcA
TranslateMDISysAccel
DefFrameProcA
CharUpperBuffA
IsRectEmpty
CopyIcon
OffsetRect
UpdateLayeredWindow
MonitorFromPoint
EmptyClipboard
CloseClipboard
SetClipboardData
LoadImageW
GetIconInfo
SetClassLongA
SetCursorPos
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
CreateAcceleratorTableA
DestroyAcceleratorTable
DrawIconEx
UnregisterClassA
MapVirtualKeyA
GetKeyNameTextA
CopyImage
RegisterClipboardFormatA
LoadImageA
ReuseDDElParam
TranslateAcceleratorA
LoadAcceleratorsA
DestroyIcon
SetRectEmpty
RealChildWindowFromPoint
SystemParametersInfoA
EnumDisplayMonitors
SetLayeredWindowAttributes
LoadAcceleratorsW
DestroyMenu
WaitMessage
GetClipboardFormatNameA
UnpackDDElParam
CharUpperA

gdi32

ExtSelectClipRgn
GetObjectType
CreatePen
CreateHatchBrush
CreatePatternBrush
CreateFontA
CreateCompatibleBitmap
CreatePalette
GetPaletteEntries
SetPaletteEntries
GetNearestPaletteIndex
CreateRectRgnIndirect
CreateEllipticRgn
CreatePolygonRgn
SetRectRgn
CreateCompatibleDC
RealizePalette
GetBkColor
GetTextColor
GetMapMode
GetViewportOrgEx
GetViewportExtEx
GetWindowOrgEx
GetWindowExtEx
DPtoLP
LPtoDP
FrameRgn
PtVisible
RectVisible
Polyline
Ellipse
ScaleWindowExtEx
Rectangle
PatBlt
StretchBlt
GetPixel
SetPixel
ExtFloodFill
GetTextExtentPoint32A
GetTextFaceA
Escape
GetBoundsRect
SetPixelV
EnumFontFamiliesA
GetTextCharsetInfo
CreateDIBitmap
EnumFontFamiliesExA
CreateDIBSection
GetSystemPaletteEntries
SetDIBColorTable
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetROP2
SetLayout
GetLayout
LineTo
MoveToEx
IntersectClipRect
ExcludeClipRect
BitBlt
GetClipBox
SetPolyFillMode
SelectPalette
RestoreDC
SaveDC
DeleteDC
GetObjectA
SetBkColor
ScaleViewportExtEx
CreateBitmap
ExtTextOutA
GetDeviceCaps
CreateDCA
CopyMetaFileA
SetBkMode
CreateFontIndirectA
SelectObject
GetTextMetricsA
GetStockObject
DeleteObject
CreateSolidBrush
CreateRoundRectRgn
OffsetRgn
GetRgnBox
CombineRgn
CreateRectRgn
PtInRegion
FillRgn
SelectClipRgn
TextOutA
SetTextAlign
Polygon
SetTextColor

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegDeleteKeyA
RegEnumKeyExA
RegEnumValueA
RegQueryValueA
RegQueryInfoKeyA
RegOpenKeyA
RegFlushKey
QueryServiceStatus
QueryServiceConfigA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
StartServiceA
ChangeServiceConfigA
RegEnumKeyA
ReportEventA
DeregisterEventSource
OpenThreadToken
RevertToSelf
SetThreadToken
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegisterEventSourceA

shell32

SHGetPathFromIDListA
CommandLineToArgvW
ShellExecuteA
SHGetFileInfoA
DragFinish
DragQueryFileA
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderA

comctl32

ImageList_GetIconSize

shlwapi

PathRemoveFileSpecW
StrCmpW
PathFindExtensionA
PathFindFileNameA
PathIsUNCA
PathStripToRootA

ole32

CoInitializeEx
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleGetClipboard
OleLockRunning
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CreateStreamOnHGlobal
DoDragDrop
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CoInitialize
CoCreateInstance
CoUninitialize
OleTranslateAccelerator
IsAccelerator
StringFromGUID2
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleInitialize
StgOpenStorageOnILockBytes
CoGetClassObject
CoCreateGuid
CLSIDFromString
CLSIDFromProgID
ReleaseStgMedium
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
OleDuplicateData

oleaut32

SysFreeString
VariantInit
SystemTimeToVariantTime
VariantTimeToSystemTime
VarBstrFromDate
OleCreateFontIndirect
VariantChangeType
SysAllocString
SafeArrayDestroy
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VariantCopy
VariantClear

oledlg

ord8

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

imagehlp

ImageGetCertificateData
ImageEnumerateCertificates
ImageGetCertificateHeader

crypt32

CryptMsgGetParam
CryptMsgClose
CryptMsgUpdate
CryptMsgOpenToDecode
CertCloseStore
CertNameToStrA
CertCreateCertificateContext
CertOpenStore
CertAddEncodedCertificateToStore
CertGetCertificateChain
CertCompareCertificate
CertComparePublicKeyInfo
CertEnumCertificatesInStore
CertFreeCertificateContext

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

wininet

InternetSetFilePointer
InternetGetLastResponseInfoA
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetQueryDataAvailable
InternetReadFile
InternetWriteFile
InternetSetStatusCallback
InternetSetOptionExA
InternetCloseHandle
InternetOpenA
InternetQueryOptionA

gdiplus

GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdiplusStartup
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipSetInterpolationMode
GdipGetImagePalette
GdipGetImageGraphicsContext
GdipDrawImageI
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipFree
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdipCreateBitmapFromStreamICM
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipDrawImageRectI

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundA

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 483KB - Virtual size: 483KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Detector/CCBNetSignCom.dll
.dll regsvr32 windows:4 windows x86 arch:x86

8dee353a812b5dff0236bdd313a12919

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

dd:f2:b0:ba:d1:96:12:c5:ee:0e:3c:f6:c2:fb:0d:61:42:05:65:bd
Signer

Actual PE Digest

dd:f2:b0:ba:d1:96:12:c5:ee:0e:3c:f6:c2:fb:0d:61:42:05:65:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

htonl

crypt32

CryptEncodeObjectEx
CertOpenStore
CertEnumCertificateContextProperties
CertOIDToAlgId
CertFreeCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertNameToStrA
CertFindCertificateInStore

kernel32

FindFirstFileA
TerminateProcess
GetTempPathA
CreateDirectoryA
lstrcmpA
LCMapStringA
GetSystemDefaultLangID
ReadFile
SetEndOfFile
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
CreateFileA
FlushFileBuffers
SetStdHandle
DeleteFileA
GetCPInfo
SetFilePointer
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
WriteFile
CloseHandle
SetUnhandledExceptionFilter
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
ExitProcess
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetVersionExA
GetEnvironmentVariableA
GetVersion
GetCommandLineA
RaiseException
HeapReAlloc
HeapAlloc
FindClose
LockResource
GlobalHandle
GlobalFree
FreeResource
FileTimeToSystemTime
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
InterlockedIncrement
HeapSize
InterlockedDecrement
LoadLibraryA
GetProcAddress
lstrcatA
lstrcpyA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
DisableThreadLibraryCalls
IsDBCSLeadByte
lstrcpynA
lstrcmpiA
LoadLibraryExA
GetLastError
FindResourceA
LoadResource
SizeofResource
FreeLibrary
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
LocalFree
RtlUnwind
HeapFree

user32

GetClientRect
GetFocus
IsChild
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
DestroyWindow
DefWindowProcA
GetDC
ReleaseDC
CharNextA
SetFocus
IsWindow
EndPaint
GetDlgItem
InvalidateRgn
SetCapture
ReleaseCapture
CreateAcceleratorTableA
GetDesktopWindow
GetClassNameA
RedrawWindow
FillRect
GetSysColor
GetWindowRect
SystemParametersInfoA
MapWindowPoints
ShowWindow
SendMessageA
EndDialog
MessageBoxA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetWindow
RegisterWindowMessageA
DialogBoxIndirectParamA
GetActiveWindow
LoadStringA
CreateWindowExA
CallWindowProcA
GetWindowLongA
SetWindowLongA
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
UnionRect
PtInRect
GetKeyState
InvalidateRect
GetParent
BeginPaint

gdi32

GetStockObject
GetObjectA
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
CreateMetaFileA
SetWindowExtEx
CloseMetaFile
CreateRectRgnIndirect
Rectangle
SetTextAlign
TextOutA
CreateDCA
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
DeleteMetaFile

advapi32

CryptGetProvParam
CryptGetHashParam
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumValueA
CryptReleaseContext
CryptDestroyHash
CryptSignHashA
CryptAcquireContextA
CryptCreateHash
CryptHashData
RegDeleteKeyA

shell32

ShellExecuteExA

ole32

OleLockRunning
StringFromCLSID
CLSIDFromString
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
OleLoadFromStream
CreateDataAdviseHolder
OleRegGetMiscStatus
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
OleSaveToStream
WriteClassStm
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

SysStringByteLen
OleCreateFontIndirect
SysAllocStringLen
SysAllocStringByteLen
OleCreatePropertyFrame
SysFreeString
VariantChangeType
VariantClear
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
RegisterTypeLi
VarUI4FromStr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/CCBSignCom.dll
.dll regsvr32 windows:5 windows x86 arch:x86

0b141e006602ff7bd14e6b4e71840d76

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
HeapCreate
HeapDestroy
GetStdHandle
GetConsoleCP
GetConsoleMode
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
WideCharToMultiByte
lstrlenW
GetACP
HeapSize
ExitProcess
Sleep
GetCommandLineA
HeapReAlloc
RtlUnwind
VirtualQuery
GetSystemInfo
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrlenA
lstrcmpiA
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
LCMapStringA
GetSystemDefaultLangID
FindClose
DeleteFileA
FindFirstFileA
CreateDirectoryA
TerminateProcess
GetTempPathA
LockResource
FileTimeToSystemTime
GlobalAlloc
lstrcmpA
GlobalLock
InterlockedExchange
CompareStringA
LoadLibraryA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThreadId
GetCurrentThread
GlobalDeleteAtom
CloseHandle
VirtualAlloc
VirtualProtect
HeapFree
HeapAlloc
GetOEMCP
GetCPInfo
CreateFileA
GetCurrentProcess
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
FreeResource
GetModuleFileNameW
GlobalFree
GlobalUnlock
FormatMessageA
LocalFree
MulDiv
GetCurrentProcessId
SetLastError
GlobalAddAtomA
MultiByteToWideChar

user32

DestroyMenu
LoadCursorA
GetSysColorBrush
EndPaint
BeginPaint
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
ShowWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextA
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
CharNextA
CharNextW
SendMessageA
EnableWindow
UpdateWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
GetCapture
PostQuitMessage
PostMessageA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetWindow
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
MessageBoxA
SetCursor
SetWindowsHookExA
LoadIconA

gdi32

PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

CryptGetProvParam
CryptDestroyHash
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegQueryValueExA
CryptSignHashA
CryptGetHashParam
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptReleaseContext

shell32

ShellExecuteExA

shlwapi

PathFindFileNameA
PathFindExtensionA

ole32

StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SysStringLen
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
VariantClear
VariantChangeType
VariantInit

crypt32

CertNameToStrA
CertFindCertificateInStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CryptEncodeObjectEx
CertCloseStore
CertFreeCertificateContext
CertOIDToAlgId
CertEnumCertificateContextProperties
CertOpenStore

ws2_32

htonl

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/CCBSignCom.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

910fe4adf8cff0c8776fce03e839b689

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7c:60:a8:52:2a:39:55:0a:ca:ec:46:82:bb:42:98:a2:dd:6a:1e:4e
Signer

Actual PE Digest

7c:60:a8:52:2a:39:55:0a:ca:ec:46:82:bb:42:98:a2:dd:6a:1e:4e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord6354
ord1216
ord1168
ord6467
ord1227
ord6042
ord823
ord1877
ord4249
ord2486
ord2687
ord4006
ord6364
ord3326
ord6365
ord4472
ord5498
ord3278
ord3353
ord3681
ord446
ord743
ord1177
ord1226
ord1210
ord2727
ord2730
ord2729
ord2439
ord1693
ord5618
ord994
ord4342
ord4687
ord4639
ord5674
ord2156
ord4856
ord4920
ord6002
ord2137
ord1963
ord5213
ord2953
ord3868
ord5150
ord4705
ord4707
ord2876
ord2998
ord5649
ord4113
ord4661
ord4660
ord4768
ord4650
ord4903
ord4548
ord4521
ord4594
ord4988
ord4925
ord4930
ord4935
ord4659
ord4909
ord4908
ord4668
ord4667
ord4666
ord4648
ord4689
ord5023
ord4654
ord4643
ord4354
ord4780
ord4649
ord4637
ord4636
ord5060
ord4584
ord4371
ord4361
ord4356
ord4739
ord4741
ord4738
ord4409
ord4603
ord5008
ord4415
ord4992
ord4979
ord2488
ord3404
ord4539
ord2954
ord6055
ord4078
ord1776
ord5199
ord3136
ord2384
ord5163
ord6370
ord2724
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2983
ord3148
ord3260
ord4466
ord2986
ord3080
ord4081
ord4624
ord5825
ord723
ord3946
ord2614
ord540
ord800
ord423
ord2860
ord2541
ord4949
ord641
ord2514
ord324
ord1601
ord2818
ord5572
ord2915
ord1892
ord4252
ord1212
ord4570
ord4672
ord4843
ord5011
ord5265
ord4376
ord4853
ord4998
ord4713
ord6052
ord1775
ord2385
ord6371
ord5286
ord4438
ord3279
ord4625
ord4425
ord449
ord746
ord2278
ord537
ord860
ord941
ord4710
ord6374
ord5280
ord4627
ord3597
ord4234
ord1768
ord6199
ord3092
ord2379
ord1200
ord4224
ord1132
ord3952
ord825
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord561
ord3670
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord3401
ord2976
ord3081
ord2985
ord4353
ord3262
ord5300
ord1089
ord3922
ord5731
ord3346
ord5241
ord2396
ord2512
ord2554
ord4486
ord6375
ord4407
ord815
ord1131

msvcrt

__CxxFrameHandler
calloc
free
wcslen
_itoa
malloc
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_onexit
__dllonexit
memmove
printf
fopen
fclose
realloc
toupper
iswdigit
strchr
_CxxThrowException
strstr
sprintf
fwrite

kernel32

LocalFree
GetLastError
FileTimeToSystemTime
CreateDirectoryA
GetTempPathA
TerminateProcess
FindFirstFileA
DeleteFileA
FindClose
GetSystemDefaultLangID
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LocalAlloc

user32

FillRect
SendMessageA
EnableWindow

gdi32

Ellipse
GetStockObject

advapi32

CryptAcquireContextA
CryptHashData
CryptSignHashA
CryptDestroyHash
CryptReleaseContext
CryptGetHashParam
CryptGetProvParam
CryptCreateHash

shell32

ShellExecuteExA

oleaut32

VariantClear
LoadRegTypeLi

crypt32

CertCloseStore
CryptEncodeObjectEx
CertFindCertificateInStore
CertNameToStrA
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOIDToAlgId
CertEnumCertificateContextProperties
CertOpenStore

ws2_32

htonl

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/CCB_B2B_NetSign.dll
.dll regsvr32 windows:4 windows x86 arch:x86

aa5531ecbff723b149fb7f029f835b73

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9d:06:62:fe:6b:a7:6a:3c:5d:c2:04:99:48:9e:2f:21:e4:e2:39:1e
Signer

Actual PE Digest

9d:06:62:fe:6b:a7:6a:3c:5d:c2:04:99:48:9e:2f:21:e4:e2:39:1e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalLock
GlobalUnlock
GlobalAlloc
FindResourceA
LoadResource
LockResource
GlobalHandle
GlobalFree
FreeResource
GetCurrentProcess
InterlockedIncrement
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
CreateFileA
WriteFile
CloseHandle
lstrlenA
GetLastError
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
lstrcmpA
lstrcatA
lstrcpyA
FileTimeToSystemTime
ReadFile
GetFileSize
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetShortPathNameA
GetModuleHandleA
SizeofResource
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
LCMapStringA
GetSystemDefaultLangID
FlushInstructionCache

user32

CallWindowProcA
GetWindowLongA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetWindow
DefWindowProcA
RegisterWindowMessageA
GetClassInfoExA
LoadCursorA
RegisterClassExA
DialogBoxIndirectParamA
SetWindowLongA
GetSysColor
MessageBoxA
GetActiveWindow
GetFocus
ReleaseDC
GetDC
EndPaint
FillRect
GetClientRect
BeginPaint
SetWindowPos
IsWindow
RedrawWindow
GetClassNameA
GetParent
SetFocus
LoadStringA
GetDesktopWindow
CreateAcceleratorTableA
DestroyWindow
wsprintfA
CreateWindowExA
ReleaseCapture
SetCapture
InvalidateRect
InvalidateRgn
SendMessageA
GetDlgItem
EndDialog
MapWindowPoints
SystemParametersInfoA
GetWindowRect
GetKeyState
PtInRect
UnionRect
ShowWindow
CharNextA
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
IsChild

gdi32

SaveDC
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
GetTextExtentPointA
GetStockObject
GetObjectA
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetDeviceCaps
CreateMetaFileA
SetViewportOrgEx
SetMapMode
LPtoDP
CreateDCA
SetTextAlign
Rectangle
SetWindowOrgEx

comdlg32

CommDlgExtendedError
GetOpenFileNameA
GetSaveFileNameA

advapi32

RegEnumKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptAcquireContextA
CryptReleaseContext
CryptDestroyHash
CryptSignHashA
CryptHashData
CryptCreateHash
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegSetValueExA
RegQueryInfoKeyA
RegEnumValueA

shell32

SHGetSpecialFolderPathA

ole32

OleLoadFromStream
CreateDataAdviseHolder
OleRegGetMiscStatus
OleRegGetUserType
OleRegEnumVerbs
CoTaskMemAlloc
WriteClassStm
CoTaskMemFree
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
OleSaveToStream
CreateOleAdviseHolder
StringFromCLSID
CoTaskMemRealloc
OleLockRunning

oleaut32

VarUI4FromStr
OleCreatePropertyFrame
SysFreeString
SysAllocStringLen
SysStringLen
SysAllocString
LoadRegTypeLi
VariantClear
OleCreateFontIndirect
LoadTypeLi
RegisterTypeLi
VariantChangeType
SysAllocStringByteLen
SysStringByteLen

wsock32

ntohl

crypt32

CertFreeCertificateContext
CryptEncryptMessage
CryptSignMessage
CertFindCertificateInStore
CertCloseStore
CertNameToStrA
CertEnumCertificatesInStore
CertOpenStore
CertVerifySubjectCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptVerifyMessageSignature
CryptHashMessage
CryptVerifyDetachedMessageSignature
CryptMsgGetParam
CryptMsgUpdate
CryptMsgOpenToDecode
CertGetNameStringA
CryptDecodeObject
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertOpenSystemStoreA
CertCompareIntegerBlob
CryptDecryptMessage
CryptSignAndEncryptMessage
CryptDecryptAndVerifyMessageSignature
CertOIDToAlgId
CertGetCertificateContextProperty
CertEnumCertificateContextProperties

msvcrt

_open
memmove
_strdate
_strtime
fflush
_stat
fread
_filelength
_read
_tzset
_timezone
fopen
fwrite
fclose
??2@YAPAXI@Z
strcmp
strtok
strrchr
strncpy
isprint
abs
strchr
_local_unwind2
_except_handler3
printf
atoi
_CxxThrowException
__CxxFrameHandler
strcpy
strstr
_daylight
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
?terminate@@YAXXZ
sprintf
realloc
calloc
strlen
strcat
??3@YAXPAX@Z
free
malloc
memset
mktime
memcmp
memcpy
_purecall
time
_errno

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/CCB_GMSignCom.dll
.dll regsvr32 windows:4 windows x86 arch:x86

2ecb8bef43ae874152feb4446e9cbd6f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ae:3e:13:02:7b:52:86:f8:33:86:75:1d:ea:16:86:0e:62:db:f3:fe
Signer

Actual PE Digest

ae:3e:13:02:7b:52:86:f8:33:86:75:1d:ea:16:86:0e:62:db:f3:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord1116
ord1176
ord1575
ord1168
ord1577
ord1182
ord342
ord4224
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord1200
ord4376
ord4853
ord2379
ord3092
ord6199
ord1768
ord4234
ord641
ord324
ord3597
ord4425
ord4627
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4710
ord4998
ord5265
ord941
ord860
ord2915
ord5572
ord2818
ord537
ord1601
ord4274
ord540
ord800
ord2614
ord823
ord6467
ord1131
ord2725
ord3953
ord825
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord815
ord1243

msvcrt

memcmp
fclose
fprintf
fopen
strcat
vsprintf
sprintf
memset
realloc
malloc
strlen
strstr
_CxxThrowException
fwrite
strchr
strcmp
printf
toupper
memmove
_purecall
memcpy
_itoa
wcslen
strcpy
__CxxFrameHandler
calloc
free
__dllonexit
_onexit
_except_handler3
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
?terminate@@YAXXZ

kernel32

lstrcpyA
LoadLibraryA
GetProcAddress
HeapDestroy
IsDBCSLeadByte
lstrcpynA
lstrcmpiA
LoadLibraryExA
GetLastError
FindResourceA
LoadResource
SizeofResource
FreeLibrary
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
MultiByteToWideChar
lstrlenW
lstrlenA
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FlushInstructionCache
GetCurrentProcess
GlobalUnlock
GlobalLock
GlobalAlloc
OutputDebugStringA
GetCurrentProcessId
LCMapStringA
GetSystemDefaultLangID
FindClose
DeleteFileA
FindFirstFileA
TerminateProcess
GetTempPathA
CreateDirectoryA
FileTimeToSystemTime
LocalFree
LocalAlloc
lstrcatA
GetCurrentThreadId

user32

DefWindowProcA
GetKeyState
PtInRect
UnionRect
ShowWindow
SetWindowLongA
GetWindowLongA
CallWindowProcA
CreateWindowExA
CharNextA
RegisterClassExA
wsprintfA
LoadCursorA
GetClassInfoExA
DestroyWindow
IsChild
GetFocus
SetFocus
GetParent
IsWindow
SetWindowPos
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
ReleaseDC
GetDC
EnableWindow
SendMessageA
BeginPaint
GetClientRect
EndPaint
InvalidateRect

gdi32

SaveDC
CreateMetaFileA
GetDeviceCaps
DeleteDC
SetViewportOrgEx
SetMapMode
LPtoDP
CreateDCA
SetWindowOrgEx
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
Rectangle
SetTextAlign
TextOutA

advapi32

RegEnumKeyExA
CryptDestroyHash
CryptSignHashA
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGetProvParam
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
CryptReleaseContext
RegOpenKeyExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA

shell32

SHGetSpecialFolderPathA
ShellExecuteExA

ole32

CreateOleAdviseHolder
OleSaveToStream
OleLoadFromStream
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CreateDataAdviseHolder
OleRegGetMiscStatus
OleRegGetUserType
OleRegEnumVerbs
WriteClassStm

olepro32

ord250

oleaut32

VariantClear
VarUI4FromStr
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
SysAllocStringByteLen
SysStringByteLen
LoadRegTypeLi
SysStringLen
SysAllocStringLen
VariantChangeType

crypt32

CertCloseStore
CertFindCertificateInStore
CertNameToStrA
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOIDToAlgId
CertEnumCertificateContextProperties
CryptEncodeObjectEx
CertOpenStore

ws2_32

htonl

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/CCB_SwxCryptSimple.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

5a30ad7fbb51814a3892f0e358c5b09d

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:40:02:24:5f:30:08:7c:f6:b1:dc:07:e4:96:f9:63
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

15-12-2009 00:00

Not After

30-12-2012 23:59

Subject

CN=Beijing Watchdata System Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Watchdata System Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bf:cd:04:a0:6b:54:4e:01:68:55:57:89:6b:b1:89:9c:52:48:46:56
Signer

Actual PE Digest

bf:cd:04:a0:6b:54:4e:01:68:55:57:89:6b:b1:89:9c:52:48:46:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenSystemStoreA
CertNameToStrA
CertCloseStore
CertGetCertificateContextProperty

mfc42

ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3402
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4424
ord3639
ord692
ord641
ord567
ord324
ord825
ord2340
ord2302
ord1200
ord4710
ord4234
ord4853
ord858
ord4376
ord860
ord823
ord2915
ord815
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord3401
ord4622
ord3670
ord561
ord3952
ord2724
ord6354
ord1216
ord1168
ord6467
ord1227
ord1131
ord1132
ord1877
ord4249
ord2486
ord2687
ord6364
ord3326
ord6365
ord4472
ord5498
ord3278
ord3353
ord3681
ord446
ord743
ord1177
ord1226
ord1210
ord2439
ord1693
ord5618
ord994
ord4342
ord4687
ord4639
ord5674
ord2156
ord4856
ord4920
ord6002
ord2137
ord6366
ord5213
ord2953
ord3868
ord5150
ord4705
ord4707
ord3749
ord2998
ord5649
ord4113
ord4661
ord4660
ord4768
ord4650
ord4903
ord4548
ord4521
ord4594
ord4988
ord4925
ord4930
ord4935
ord4659
ord4909
ord4908
ord4668
ord4667
ord4666
ord4648
ord4689
ord5023
ord4654
ord4643
ord4354
ord4780
ord4649
ord4637
ord4636
ord5060
ord4584
ord4371
ord4361
ord4356
ord4739
ord4741
ord4738
ord4409
ord4603
ord5008
ord4415
ord4992
ord4979
ord2488
ord3404
ord4539
ord2954
ord2384
ord6370
ord2983
ord3148
ord3260
ord4466
ord3269
ord2986
ord3080
ord4081
ord4624
ord5825
ord723
ord2614
ord3946
ord423
ord2860
ord2541
ord4949
ord1601
ord1892
ord4252
ord1212
ord4570
ord4672
ord4843
ord5011
ord4713
ord6371
ord5286
ord4438
ord3279
ord4625
ord449
ord746
ord2278
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord1771
ord3597
ord4425
ord5280
ord4407
ord1775
ord6052
ord2514
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4401
ord1776
ord4078
ord6055
ord2581
ord4219
ord2024
ord2876
ord2413
ord4998
ord5265
ord800
ord540
ord1963

msvcrt

_unlink
free
malloc
__CxxFrameHandler
wcstombs
??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
?terminate@@YAXXZ
_onexit
__dllonexit
_except_handler3
printf
strchr
strstr
fclose
fwrite
fopen
sprintf
wcsncpy
_EH_prolog
wcslen

kernel32

LocalFree
GetModuleFileNameA
WideCharToMultiByte
lstrcatA
lstrlenA
MultiByteToWideChar
lstrcpyA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
FreeLibrary
lstrlenW
DeleteCriticalSection
HeapDestroy
GetTempPathA
WinExec
GetLastError
LocalAlloc

user32

FillRect
SendMessageA
EnableWindow
CharNextA

gdi32

GetStockObject
Ellipse

advapi32

CryptSignHashA
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash

ole32

CoCreateInstance

oleaut32

LoadRegTypeLi
LoadTypeLi
SysAllocString
RegisterTypeLi
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/Ccb_Cert_TDR2G.dll
.dll windows:4 windows x86 arch:x86

c3d034b12ae7338f1a73fd34c572a34d

Code Sign

61:1d:0a:40:dd:e1:88:b4:bd:45:61:e1:21:a2:50:7f:35:63:ca:e8
Signer

Actual PE Digest

61:1d:0a:40:dd:e1:88:b4:bd:45:61:e1:21:a2:50:7f:35:63:ca:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\svn\software\src\Project\建行二代\EventCCBCode\CCBCertTDR\Release\CCB_Cert_TDR2G.pdb

Imports

kernel32

lstrcmpA
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
GetPrivateProfileStringW
GetSystemDefaultLangID
FreeLibrary
LoadLibraryA
SetLastError
GetModuleFileNameW
LoadLibraryW
lstrcpyA
lstrlenA
GetLastError
CreateToolhelp32Snapshot
SetEndOfFile
CreateFileA
ReadFile
Process32FirstW
WideCharToMultiByte
Process32NextW
FileTimeToSystemTime
FileTimeToLocalFileTime
MultiByteToWideChar
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetLocalTime
SystemTimeToFileTime
FlushConsoleInputBuffer
GlobalMemoryStatus
GetVersion
SetEnvironmentVariableA
CompareStringW
CompareStringA
FindFirstFileW
FindNextFileW
FindClose
GetSystemDirectoryW
lstrcatW
lstrcmpiW
lstrcmpW
lstrlenW
lstrcpyW
GetModuleHandleW
GetProcAddress
GetCurrentProcess
FindResourceExW
InterlockedExchange
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
CompareFileTime
SetConsoleCtrlHandler
SetStdHandle
FlushFileBuffers
GetVersionExA
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
ExitProcess
RtlUnwind
GetCurrentThreadId
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
SetUnhandledExceptionFilter
VirtualQuery
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetOEMCP
GetCPInfo
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
TerminateProcess
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
IsBadReadPtr
IsBadCodePtr
SetFilePointer
VirtualProtect
GetSystemInfo

user32

GetDesktopWindow
MessageBoxA
GetProcessWindowStation
GetActiveWindow
GetUserObjectInformationW
wsprintfA
wsprintfW

advapi32

CryptAcquireContextW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
CryptReleaseContext
CryptGetProvParam
CryptDestroyKey
CryptSignHashW
CryptSetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptSetKeyParam
CryptExportKey
CryptGetUserKey
CryptGenKey
RegSetValueExW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCreateKeyExW

shell32

SHGetSpecialFolderPathW
ShellExecuteW
ord680
ShellExecuteExW

ole32

CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize

shlwapi

StrStrA
PathFileExistsW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winscard

SCardEstablishContext
SCardReleaseContext

crypt32

CertCompareCertificateName
CertFindCertificateInStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CertCreateCertificateContext
CryptMsgClose
CryptMsgGetParam
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSignAndEncodeCertificate
CryptExportPublicKeyInfo
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertFreeCertificateChain
CertGetCertificateChain
CertNameToStrA
CertGetNameStringA
CertDuplicateCertificateContext
CertGetNameStringW
CertGetCertificateContextProperty
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CertDeleteCertificateFromStore
CryptEncodeObjectEx

ws2_32

htonl

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 340KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/Ccb_Cert_TDR_GM.dll
.dll windows:4 windows x86 arch:x86

b8fc9ba0fee6c13a3bcc80c041750819

Code Sign

5e:7f:5b:2b:95:af:48:9e:4e:37:57:da:94:4b:c3:75:ee:9d:46:74
Signer

Actual PE Digest

5e:7f:5b:2b:95:af:48:9e:4e:37:57:da:94:4b:c3:75:ee:9d:46:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\svn\software\src\Project\建行二代\建行国密新ui\CCBCertTDR\Release\CCB_Cert_TDR2G.pdb

Imports

kernel32

SetEndOfFile
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
GetPrivateProfileStringW
GetSystemDefaultLangID
LoadLibraryA
SetLastError
GetModuleFileNameW
GetWindowsDirectoryW
MultiByteToWideChar
FreeLibrary
GetModuleFileNameA
lstrcatA
WinExec
LoadLibraryW
lstrcpyA
lstrlenA
GetLastError
CreateToolhelp32Snapshot
CreateFileA
ReadFile
Process32FirstW
WideCharToMultiByte
Process32NextW
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetLocalTime
SystemTimeToFileTime
CompareFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FlushConsoleInputBuffer
GlobalMemoryStatus
GetVersion
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetConsoleCtrlHandler
SetStdHandle
FindFirstFileW
FindNextFileW
FindClose
GetSystemDirectoryW
lstrcatW
lstrcmpiW
lstrcmpW
lstrlenW
lstrcpyW
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetCurrentProcess
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
lstrcmpA
FlushFileBuffers
GetSystemInfo
GetVersionExA
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
ExitProcess
RtlUnwind
GetCurrentThreadId
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
VirtualQuery
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetOEMCP
GetCPInfo
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
TerminateProcess
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
IsBadReadPtr
IsBadCodePtr
SetFilePointer
VirtualProtect

user32

GetUserObjectInformationW
GetProcessWindowStation
GetDesktopWindow
MessageBoxA
GetActiveWindow
wsprintfA
FindWindowW
wsprintfW

advapi32

CryptGetProvParam
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
CryptReleaseContext
CryptAcquireContextW
CryptDestroyKey
CryptSignHashW
CryptSetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptSetKeyParam
CryptExportKey
CryptGetUserKey
CryptGenKey
RegSetValueExW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegCreateKeyExW

shell32

SHGetSpecialFolderPathW
ShellExecuteW
ord680
ShellExecuteExW

ole32

CoCreateInstance
CLSIDFromString
CoInitialize
CoCreateGuid
CoUninitialize

shlwapi

PathFindFileNameA
StrStrA
wvnsprintfW
PathFileExistsW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winscard

SCardEstablishContext
SCardReleaseContext

crypt32

CertCompareCertificateName
CertFindCertificateInStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CertCreateCertificateContext
CryptMsgClose
CryptMsgGetParam
CryptMsgOpenToDecode
CryptSignAndEncodeCertificate
CryptExportPublicKeyInfo
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertNameToStrA
CertGetNameStringA
CertGetNameStringW
CertGetCertificateContextProperty
CertAddCertificateContextToStore
CryptMsgUpdate
CertSetCertificateContextProperty
CertDeleteCertificateFromStore
CryptEncodeObjectEx

ws2_32

htonl

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 356KB - Virtual size: 353KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/Ccb_Cert_dmwz.dll
.dll windows:5 windows x86 arch:x86

2833332b2f802672800593dc7749e3a3

Code Sign

30:12:f8:26:b2:08:20:9e:4e:f2:d0:a9:26:7b:0d:09:bb:ec:4f:12
Signer

Actual PE Digest

30:12:f8:26:b2:08:20:9e:4e:f2:d0:a9:26:7b:0d:09:bb:ec:4f:12

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

htonl

shlwapi

PathFileExistsA

crypt32

CertOIDToAlgId
CryptEncodeObjectEx
CryptDecodeObjectEx
CertFindRDNAttr
CertAddEncodedCertificateToStore
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertCreateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertGetNameStringA
CertCloseStore

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA

kernel32

UnmapViewOfFile
WaitForSingleObject
CreateFileA
ResetEvent
CreateEventA
SetEvent
DeviceIoControl
InterlockedExchange
GlobalUnlock
GlobalLock
QueryPerformanceCounter
CreateThread
HeapSize
HeapAlloc
SetFilePointer
SetStdHandle
FlushFileBuffers
ReadFile
GetStringTypeW
GetStringTypeA
VirtualFree
HeapFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetStartupInfoA
SetHandleCount
LoadLibraryW
ExitProcess
GetFileType
WriteConsoleW
WriteFile
DebugBreak
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetModuleFileNameA
IsBadReadPtr
HeapValidate
SetConsoleCtrlHandler
GetCommandLineA
VirtualQuery
GetModuleHandleW
VirtualProtect
GetSystemTimeAsFileTime
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
ExitThread
CreateFileMappingA
MapViewOfFile
GetTempPathA
GetLocalTime
CreateMutexA
GetCurrentThreadId
lstrcpyA
GetVersionExA
GetModuleHandleA
GetPrivateProfileStringA
FindResourceA
SizeofResource
LoadResource
LockResource
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
LocalFree
FileTimeToSystemTime
GetSystemTime
SystemTimeToFileTime
CompareFileTime
GetLastError
GetSystemDirectoryA
GlobalAlloc
GlobalFree
EnterCriticalSection
LeaveCriticalSection
GetCurrentThread
HeapReAlloc
GetSystemInfo
VirtualAlloc
GetModuleFileNameW
lstrlenA
OutputDebugStringW
OutputDebugStringA
OpenEventA
SetConsoleMode
ReadConsoleInputA
GetProcessHeap
RaiseException
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
GetCurrentProcessId
GlobalMemoryStatus
GetTickCount
FlushConsoleInputBuffer
GetStdHandle
InterlockedIncrement

user32

DestroyWindow
PostQuitMessage
CallWindowProcA
GetKeyState
GetWindowTextLengthA
GetWindowRect
GetFocus
GetNextDlgTabItem
SetDlgItemTextA
MoveWindow
GetWindowLongA
SetWindowLongA
EnableWindow
GetDlgItemTextA
GetSystemMetrics
DialogBoxParamA
SetFocus
SetWindowTextA
GetClientRect
GetCursorPos
SendMessageA
ChildWindowFromPoint
GetDlgCtrlID
EndDialog
FrameRect
FillRect
GetDlgItem
GetWindowTextA
OffsetRect
DrawTextA
GetDC
SystemParametersInfoA
SetWindowPos
RegisterWindowMessageA
PostMessageA
GetForegroundWindow
SetForegroundWindow
UnregisterDeviceNotification
LoadCursorA
LoadIconA
RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
RegisterDeviceNotificationA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
CharUpperA
FindWindowA
ScreenToClient

gdi32

CreateDIBSection
SetDIBColorTable
DeleteDC
SetStretchBltMode
StretchBlt
CreatePen
RoundRect
DeleteObject
CreateSolidBrush
SetBkMode
SetTextColor
CreateCompatibleDC
SelectObject
GetObjectA
CreateFontIndirectA
GetStockObject

advapi32

RegOpenKeyExA
RegQueryValueExA
CryptReleaseContext
CryptGetProvParam
CryptAcquireContextA
CryptDestroyKey
CryptGetKeyParam
CryptGetUserKey
RegCreateKeyExA
CryptDestroyHash
CryptSignHashA
CryptHashData
CryptCreateHash
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetThreadToken
RevertToSelf
OpenThreadToken
RegCloseKey

shell32

ShellExecuteA
SHGetSpecialFolderPathA

ole32

CreateStreamOnHGlobal

gdiplus

GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteGraphics
GdipAlloc
GdipFree
GdiplusShutdown
GdipDisposeImage

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 579KB - Virtual size: 578KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/Ccb_Cert_dmwz2G.dll
.dll windows:5 windows x86 arch:x86

4682cb6cfd9b6261f743701d820151ad

Code Sign

45:f0:e0:00:47:1c:9e:ab:fb:21:e9:c3:5c:30:d4:20:98:43:fd:f7
Signer

Actual PE Digest

45:f0:e0:00:47:1c:9e:ab:fb:21:e9:c3:5c:30:d4:20:98:43:fd:f7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wsock32

htonl

shlwapi

PathFileExistsA

crypt32

CertSetCertificateContextProperty
CertAddCertificateContextToStore
CryptEncodeObjectEx
CryptDecodeObjectEx
CertFindRDNAttr
CertGetNameStringA
CertCreateCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCloseStore
CertAddEncodedCertificateToStore

kernel32

GetLocalTime
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
ReleaseMutex
InterlockedExchange
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
ExitThread
HeapFree
HeapAlloc
RtlUnwind
GetSystemTimeAsFileTime
HeapReAlloc
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
CreateFileA
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetConsoleCP
GetConsoleMode
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
SetFilePointer
SetStdHandle
FlushFileBuffers
ReadFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
SetEnvironmentVariableA
InitializeCriticalSection
GetCurrentThreadId
lstrcpyA
EnterCriticalSection
LeaveCriticalSection
GetTempPathA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetExitCodeProcess
WaitForSingleObject
CreateMutexA
CreateThread
FindResourceA
SizeofResource
LoadResource
LockResource
GetVersionExA
LoadLibraryA
GetProcAddress
ReadConsoleInputA
SetConsoleMode
FreeLibrary
MultiByteToWideChar
GetModuleHandleA
FileTimeToSystemTime
GetSystemTime
SystemTimeToFileTime
CompareFileTime
LocalAlloc
GetSystemDirectoryA
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
Sleep
GetLastError
LocalFree
SetLastError
FlushConsoleInputBuffer
TlsFree
GlobalMemoryStatus

user32

GetWindowTextLengthA
GetKeyState
CallWindowProcA
SetDlgItemTextA
GetNextDlgTabItem
GetFocus
GetWindowRect
MoveWindow
SetFocus
GetDC
SetWindowPos
FrameRect
FillRect
GetDlgItem
GetWindowTextA
OffsetRect
DrawTextA
SystemParametersInfoA
GetClientRect
GetCursorPos
ScreenToClient
ChildWindowFromPoint
UnhookWindowsHookEx
EndDialog
GetWindowLongA
SetWindowLongA
SetForegroundWindow
RegisterWindowMessageA
PostMessageA
DialogBoxParamA
GetForegroundWindow
SetWindowsHookExA
EnableWindow
GetDlgItemTextA
GetSystemMetrics
SetTimer
UnregisterDeviceNotification
LoadCursorA
LoadIconA
RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
RegisterDeviceNotificationA
GetMessageA
DispatchMessageA
TranslateMessage
DefWindowProcA
CharUpperA
FindWindowA
SendMessageA
DestroyWindow
PostQuitMessage
KillTimer
GetDlgCtrlID
SetWindowTextA

advapi32

RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptAcquireContextA
CryptGetProvParam
CryptReleaseContext
CryptGetUserKey
CryptGetKeyParam
CryptDestroyKey
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptSignHashA
RegCreateKeyExA

ole32

CreateStreamOnHGlobal
StringFromGUID2

shell32

SHGetFolderPathA
ShellExecuteExA
SHGetSpecialFolderPathA
ShellExecuteA

gdi32

GetStockObject
SetTextColor
SetBkMode
CreateSolidBrush
DeleteObject
RoundRect
SelectObject
CreatePen
GetObjectA
CreateCompatibleDC
CreateFontIndirectA
StretchBlt
SetStretchBltMode
DeleteDC
SetDIBColorTable
CreateDIBSection

gdiplus

GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipGetImageWidth
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdiplusStartup
GdipCloneImage
GdipDrawImageRectI
GdipCreateFromHDC
GdiplusShutdown
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipBitmapLockBits
GdipLoadImageFromStream

winscard

SCardTransmit
SCardListReadersA
SCardEstablishContext
SCardConnectA
SCardBeginTransaction
SCardDisconnect
SCardReleaseContext
SCardGetAttrib
SCardFreeMemory
SCardEndTransaction
g_rgSCardT1Pci

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 495KB - Virtual size: 494KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 289KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/Ccb_Cert_dmwz_GM.dll
.dll windows:5 windows x86 arch:x86

3162e15c88589695e839b220452e4be6

Code Sign

7b:6b:48:a3:6a:72:0c:37:f0:01:a8:1a:00:32:8d:f1:ed:a7:00:d2
Signer

Actual PE Digest

7b:6b:48:a3:6a:72:0c:37:f0:01:a8:1a:00:32:8d:f1:ed:a7:00:d2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Administrator\Desktop\V3.0\Win32\Release\Ccb_Cert_dmwz_GM.pdb

Imports

kernel32

HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
VirtualFree
HeapCreate
HeapDestroy
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
RaiseException
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
ExitProcess
SetLastError
RtlUnwind
GetCommandLineA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapReAlloc
HeapFree
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapAlloc
GetOEMCP
GetCPInfo
GetModuleHandleW
InterlockedIncrement
GlobalFlags
WritePrivateProfileStringA
CreateFileA
GetCurrentProcess
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetCurrentProcessId
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
SetErrorMode
SuspendThread
SetThreadPriority
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
lstrcmpW
InterlockedDecrement
GetModuleFileNameW
FormatMessageA
lstrlenA
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
CompareStringA
lstrcmpA
CreateThread
QueryPerformanceCounter
lstrcpyA
InterlockedExchange
ResetEvent
SetEvent
FreeResource
GlobalAlloc
GlobalFree
MulDiv
GlobalUnlock
GlobalLock
CreateEventA
GetSystemTime
GetModuleFileNameA
GetVersionExA
FileTimeToSystemTime
CompareFileTime
SystemTimeToFileTime
GetLocalTime
Sleep
Process32Next
Process32First
CreateToolhelp32Snapshot
LocalFree
LocalAlloc
GetSystemDirectoryA
GetLastError
GetModuleHandleA
MultiByteToWideChar
CloseHandle
ResumeThread
LockResource
GetCurrentThreadId
LoadLibraryA
FreeLibrary
SizeofResource
LoadResource
FindResourceA
WideCharToMultiByte
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
GetExitCodeProcess
WaitForSingleObject
GetPrivateProfileIntA
GetPrivateProfileStringA
GetTempPathA
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetSysColorBrush
GetWindowThreadProcessId
EndPaint
BeginPaint
GrayStringA
DrawTextExA
TabbedTextOutA
UnregisterClassA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
ValidateRect
SetWindowTextA
IsDialogMessageA
GetDesktopWindow
CreateDialogIndirectParamA
IsWindowEnabled
SendDlgItemMessageA
WinHelpA
GetCapture
SetPropA
GetPropA
RemovePropA
IsWindow
GetWindowTextLengthA
GetLastActivePopup
SetActiveWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
IsWindowVisible
MessageBoxA
GetClassInfoA
AdjustWindowRectEx
CallWindowProcA
PtInRect
GetMenu
IsIconic
GetWindowPlacement
GetWindow
GetMenuState
GetMenuItemID
GetMenuItemCount
EndDialog
ChildWindowFromPoint
GetDlgCtrlID
ScreenToClient
GetCursorPos
DrawTextA
GetWindowTextA
SystemParametersInfoA
GetClassLongA
SetWindowLongA
SetRect
FrameRect
ReleaseDC
GetSysColor
FillRect
DrawStateA
OffsetRect
GetClientRect
DrawFocusRect
InflateRect
CopyRect
TrackPopupMenuEx
GetSubMenu
GetActiveWindow
WindowFromPoint
ClientToScreen
InvalidateRect
SetCursor
GetParent
GetWindowLongA
DestroyIcon
DestroyMenu
DestroyCursor
GetKeyState
MoveWindow
CallNextHookEx
KillTimer
GetDC
SetTimer
PostMessageA
RegisterWindowMessageA
SetForegroundWindow
GetForegroundWindow
PeekMessageA
MsgWaitForMultipleObjects
UnregisterDeviceNotification
DispatchMessageA
TranslateMessage
GetMessageA
RegisterDeviceNotificationA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
LoadCursorA
DefWindowProcA
PostQuitMessage
DestroyWindow
CharUpperA
EnableWindow
GetSystemMetrics
SetFocus
GetNextDlgTabItem
GetFocus
SetWindowPos
GetWindowRect
GetClassNameA
FindWindowA
SetWindowsHookExA
GetDlgItem
SendMessageA
UnhookWindowsHookEx
LoadIconA
GetClassInfoExA

gdi32

ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteDC
MoveToEx
LineTo
SetMapMode
RestoreDC
SaveDC
GetClipBox
RoundRect
CreatePen
CreateFontIndirectA
SetDIBColorTable
CreateDIBSection
CreateSolidBrush
GetDeviceCaps
GetObjectA
SetBkColor
CreateBitmap
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
SetTextColor
SetBkMode
GetStockObject
SetStretchBltMode
SelectObject
StretchBlt
DeleteObject

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegEnumKeyA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
CryptAcquireContextA
CryptGetProvParam
CryptReleaseContext
RegOpenKeyA
RegSetValueExA
RegDeleteKeyA
RegQueryValueA

shell32

SHGetSpecialFolderPathA
ShellExecuteExA
ShellExecuteA
SHGetFolderPathA

comctl32

_TrackMouseEvent

shlwapi

PathFindExtensionA
PathFindFileNameA
PathFileExistsA

ole32

CreateStreamOnHGlobal
StringFromGUID2

oleaut32

VariantClear
VariantChangeType
VariantInit

gdiplus

GdiplusShutdown
GdipFree
GdipAlloc
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectI
GdipLoadImageFromStream
GdipCloneImage
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdiplusStartup
GdipGetImageGraphicsContext
GdipDrawImageI
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits

crypt32

CryptMsgOpenToDecode
CryptEncodeObjectEx
CertNameToStrA
CertFindRDNAttr
CryptDecodeObjectEx
CertAddEncodedCertificateToStore
CertGetNameStringA
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CertCreateCertificateContext
CertCloseStore
CertFreeCertificateContext
CryptMsgUpdate
CryptMsgClose
CryptMsgGetParam
CertGetCertificateContextProperty
CertOpenStore
CertEnumCertificatesInStore

ws2_32

htonl

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: - Virtual size: 279KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.test0
Size: - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.test1
Size: 353KB - Virtual size: 353KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Detector/Ccb_Cert_hdzb.dll
.dll windows:5 windows x86 arch:x86

12d376b907f88b6c78a51dc2feecf997

Code Sign

00:c0:a5:28:b1:34:e8:f3:a3:c8:dd:1e:07:d8:3b:6d:db:87:23:ed
Signer

Actual PE Digest

00:c0:a5:28:b1:34:e8:f3:a3:c8:dd:1e:07:d8:3b:6d:db:87:23:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
TlsFree
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
GetModuleHandleW
GetCommandLineA
IsValidCodePage
GetCurrentThreadId

ccb_pin_cert

ord1

ccb_detect_hdzb

ord2
ord1

hd_clientchangecert

ord3
ord1
ord2
ord4

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/Ccb_Cert_hdzb2G.dll
.dll windows:5 windows x86 arch:x86

d56e6f932ff369d01ed537207167f433

Code Sign

bd:43:95:bd:a2:55:fb:76:d6:a4:c0:cf:8c:55:3d:71:8e:a3:b7:9b
Signer

Actual PE Digest

bd:43:95:bd:a2:55:fb:76:d6:a4:c0:cf:8c:55:3d:71:8e:a3:b7:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\10.1.10.3\建行中间件\开发库\PC\trunk\srcNewUI\CCB_CERT_HDZB_SHELL\Win32\Release\Ccb_Cert_hdzb2G.pdb

Imports

kernel32

GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/Ccb_Cert_hdzb_GM.dll
.dll windows:5 windows x86 arch:x86

d56e6f932ff369d01ed537207167f433

Code Sign

88:29:bf:09:63:41:64:cd:9d:85:f0:79:b8:a1:c6:a1:e2:0c:c4:75
Signer

Actual PE Digest

88:29:bf:09:63:41:64:cd:9d:85:f0:79:b8:a1:c6:a1:e2:0c:c4:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\10.1.10.3\建行中间件\开发库\PC\trunk\srcNewUI\CCB_CERT_HDZB_SHELL\Win32\Release_GM\Ccb_Cert_hdzb_GM.pdb

Imports

kernel32

GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/Ccb_Cert_watchdata.dll
.dll windows:4 windows x86 arch:x86

72a6144e752487da696435fc357322a8

Code Sign

e7:21:12:cb:e6:0d:8c:cc:9f:15:45:44:b6:f0:c7:11:f1:1a:f4:3d
Signer

Actual PE Digest

e7:21:12:cb:e6:0d:8c:cc:9f:15:45:44:b6:f0:c7:11:f1:1a:f4:3d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CryptMsgUpdate
CryptMsgOpenToDecode
CryptMsgClose
CertOIDToAlgId
CryptMsgGetParam
CertNameToStrA
CryptEncodeObject
CryptExportPublicKeyInfo
CryptSignAndEncodeCertificate
CertGetNameStringA
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCompareCertificate
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CertCreateCertificateContext
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertFreeCertificateContext
CryptEncodeObjectEx
CertCloseStore

shlwapi

PathFileExistsA
SHSetValueA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

ws2_32

htonl

mfc42

ord5933
ord823
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord920
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord825
ord6467
ord2725
ord1168
ord3953
ord1116
ord815
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord1197
ord4274

msvcrt

??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
_onexit
__dllonexit
memmove
realloc
toupper
printf
fopen
fread
fclose
_ftol
strrchr
malloc
free
_except_handler3
sprintf
time
mbstowcs
_strupr
strstr
__CxxFrameHandler
strchr

kernel32

GetPrivateProfileStringA
CreateFileA
ReadFile
WriteFile
GetSystemDirectoryA
GetLocalTime
Sleep
FindResourceA
SizeofResource
LoadResource
LockResource
CompareFileTime
LoadLibraryA
FreeLibrary
GetSystemDefaultLangID
GetModuleHandleA
GetProcAddress
GetLastError
FileTimeToSystemTime
SystemTimeToFileTime
CreateToolhelp32Snapshot
Process32First
Process32Next
GetWindowsDirectoryA
GetVersionExA
CreateMutexA
WaitForSingleObject
ReleaseMutex
CloseHandle
DeleteFileA
GetExitCodeProcess
CreateProcessA
CreateThread
SetLastError
LocalFree
LocalAlloc
FindFirstFileA

user32

RegisterWindowMessageA

advapi32

CryptSignHashA
CryptHashData
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
CryptReleaseContext
CryptGenKey
CryptAcquireContextA
CryptDestroyKey
CryptSetKeyParam
CryptGetUserKey
CryptDestroyHash
CryptCreateHash

shell32

ShellExecuteA
SHGetFolderPathA

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/Ccb_Cert_watchdata2G.dll
.dll windows:4 windows x86 arch:x86

72a6144e752487da696435fc357322a8

Code Sign

88:ab:11:82:33:be:ef:1e:8f:a3:fd:e1:7a:db:39:10:c4:af:30:aa
Signer

Actual PE Digest

88:ab:11:82:33:be:ef:1e:8f:a3:fd:e1:7a:db:39:10:c4:af:30:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CryptMsgUpdate
CryptMsgOpenToDecode
CryptMsgClose
CertOIDToAlgId
CryptMsgGetParam
CertNameToStrA
CryptEncodeObject
CryptExportPublicKeyInfo
CryptSignAndEncodeCertificate
CertGetNameStringA
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCompareCertificate
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CertCreateCertificateContext
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertFreeCertificateContext
CryptEncodeObjectEx
CertCloseStore

shlwapi

PathFileExistsA
SHSetValueA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

ws2_32

htonl

mfc42

ord5933
ord823
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord920
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord825
ord6467
ord2725
ord1168
ord3953
ord1116
ord815
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord1197
ord4274

msvcrt

??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
_onexit
__dllonexit
memmove
realloc
toupper
printf
fopen
fread
fclose
_ftol
strrchr
malloc
free
_except_handler3
sprintf
time
mbstowcs
_strupr
strstr
__CxxFrameHandler
strchr

kernel32

GetPrivateProfileStringA
CreateFileA
ReadFile
WriteFile
GetSystemDirectoryA
GetLocalTime
Sleep
FindResourceA
SizeofResource
LoadResource
LockResource
CompareFileTime
LoadLibraryA
FreeLibrary
GetSystemDefaultLangID
GetModuleHandleA
GetProcAddress
GetLastError
FileTimeToSystemTime
SystemTimeToFileTime
CreateToolhelp32Snapshot
Process32First
Process32Next
GetWindowsDirectoryA
GetVersionExA
CreateMutexA
WaitForSingleObject
ReleaseMutex
CloseHandle
DeleteFileA
GetExitCodeProcess
CreateProcessA
CreateThread
SetLastError
LocalFree
LocalAlloc
FindFirstFileA

user32

RegisterWindowMessageA

advapi32

CryptSignHashA
CryptHashData
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
CryptReleaseContext
CryptGenKey
CryptAcquireContextA
CryptDestroyKey
CryptSetKeyParam
CryptGetUserKey
CryptDestroyHash
CryptCreateHash

shell32

ShellExecuteA
SHGetFolderPathA

Exports

Exports

CryptSign
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/Ccb_Cert_watchdata2G_GM.dll
.dll windows:4 windows x86 arch:x86

74861f1ac0101e84377d937c9dd6f2c5

Code Sign

b3:31:67:82:55:cb:ca:c1:bb:41:93:0f:83:6e:6f:cb:e6:61:21:4e
Signer

Actual PE Digest

b3:31:67:82:55:cb:ca:c1:bb:41:93:0f:83:6e:6f:cb:e6:61:21:4e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord2396
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord3953
ord2725
ord1176
ord1575
ord1168
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord5199
ord1089
ord3922
ord5731
ord2554
ord2512
ord4486
ord6375
ord3079
ord4274
ord269
ord826
ord600
ord1578
ord6467
ord1116

msvcrt

??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
??2@YAPAXI@Z
__CxxFrameHandler
strrchr

kernel32

LocalFree
LoadLibraryA
GetProcAddress
FreeLibrary
LocalAlloc

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Exports

Exports

CryptSign
Detect
DriverInfo
FreeMemory
GetParam
Manage
Repair
WriteParam

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/Ccb_detect_hdzb.dll
.dll windows:5 windows x86 arch:x86

8b3519f72d77f71be8e54d4af939beea

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:c2:4a:a6:c6:8c:33:76:a9:db:ee:18:3b:33:67:12:5d:1c:ab:17
Signer

Actual PE Digest

3a:c2:4a:a6:c6:8c:33:76:a9:db:ee:18:3b:33:67:12:5d:1c:ab:17

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

hd_comm

ord53
ord30
ord32
ord33
ord91
ord29
ord27
ord36
ord28
ord92

kernel32

HeapReAlloc
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetDriveTypeA
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
InitializeCriticalSection
DeleteCriticalSection
GetSystemDefaultLCID
GetSystemDirectoryA
FileTimeToSystemTime
CompareFileTime
GetSystemTime
SystemTimeToFileTime
lstrlenA
GetVersionExA
GetVersion
FreeLibrary
GetProcAddress
LoadLibraryA
SizeofResource
LockResource
LoadResource
FindResourceA
GetLastError
MultiByteToWideChar
WideCharToMultiByte
GetExitCodeProcess
WaitForSingleObject
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
CreateMutexA
OpenMutexA
CloseHandle
ReleaseMutex
GetModuleHandleA
GlobalAlloc
lstrcmpA
GlobalLock
InterlockedExchange
CompareStringA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThreadId
GetCurrentThread
VirtualAlloc
RaiseException
ExitProcess
Sleep
GetCommandLineA
HeapAlloc
HeapFree
RtlUnwind
GetOEMCP
GetCPInfo
GetModuleHandleW
CreateFileA
GetFullPathNameA
GetCurrentProcess
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
InterlockedIncrement
GlobalDeleteAtom
GlobalFlags
GetCurrentDirectoryA
WritePrivateProfileStringA
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedDecrement
GetModuleFileNameW
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
FindFirstFileA
FileTimeToLocalFileTime
FindNextFileA
FindClose
GlobalFree
GlobalUnlock
FormatMessageA
LocalFree
GetCurrentProcessId
SetLastError
GlobalAddAtomA

user32

DestroyMenu
LoadCursorA
GetSysColorBrush
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
ShowWindow
SetWindowTextA
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
RemovePropA
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
CopyRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
PtInRect
GetMenu
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetWindowTextA
GetPropA
SetPropA
GetWindow
DestroyWindow
IsWindow
GetDlgItem
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
SendMessageA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
PostMessageA
PostQuitMessage
EnableWindow
MessageBoxA

gdi32

DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
SetMapMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
SetWindowExtEx
CreateBitmap

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
StartServiceA
EnumServicesStatusExA
RegCloseKey
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
InitializeSecurityDescriptor
InitializeAcl
LookupAccountNameA
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA

shell32

ShellExecuteExA

shlwapi

PathFindFileNameA
PathFindExtensionA

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantChangeType
VariantInit

crypt32

CertCreateCertificateContext
CertSetCertificateContextProperty
CertOpenSystemStoreA
CertEnumCertificatesInStore
CertCloseStore
CertGetNameStringA
CertAddCertificateContextToStore
CertFreeCertificateContext

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Exports

Exports

DriverInfo
Repair

Sections

.text
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/HD_ClientChangeCert.dll
.dll windows:5 windows x86 arch:x86

6a6e934178c29a04b4e092d32ef7f9d3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24:85:5e:f0:01:9a:45:a4:97:8d:37:53:76:90:8e:52:0a:47:a6:26
Signer

Actual PE Digest

24:85:5e:f0:01:9a:45:a4:97:8d:37:53:76:90:8e:52:0a:47:a6:26

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ccb_pin_cert

ord2

kernel32

CreateFileA
GlobalAddAtomA
GlobalFlags
GetCurrentThreadId
GetCurrentProcess
GetLocaleInfoA
GlobalDeleteAtom
GetVersionExA
lstrcmpW
GlobalFindAtomA
GetCPInfo
GetOEMCP
HeapFree
HeapAlloc
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
HeapReAlloc
GetCommandLineA
VirtualAlloc
HeapSize
Sleep
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
GetACP
IsValidCodePage
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoA
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
FlushFileBuffers
SetFilePointer
WriteFile
lstrcmpA
GlobalGetAtomNameA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GetCurrentProcessId
GetModuleFileNameA
InterlockedIncrement
GetModuleHandleW
CompareStringA
InterlockedDecrement
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
GetSystemDirectoryA
GetModuleHandleA
lstrlenA
ReleaseMutex
WaitForSingleObject
CloseHandle
OpenMutexA
CreateMutexA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetSystemDefaultLCID
FreeLibrary
LoadLibraryA
GetProcAddress
FileTimeToLocalFileTime
FileTimeToSystemTime
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
GetLastError

user32

DestroyMenu
TabbedTextOutA
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SystemParametersInfoA
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
PostQuitMessage
SetForegroundWindow
IsIconic
PostMessageA
SetWindowPos
SetWindowLongA
IsWindow
SetWindowsHookExA
CallNextHookEx
DispatchMessageA
GetKeyState
ValidateRect
GetFocus
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
GetWindowThreadProcessId
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
MessageBoxA
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GrayStringA
DrawTextExA
DrawTextA
GetForegroundWindow
GetDlgItem
GetWindowTextA
SetWindowTextA
EnableWindow
FindWindowA
SendMessageA
PeekMessageA

advapi32

InitializeSecurityDescriptor
InitializeAcl
LookupAccountNameA
AddAccessAllowedAce
SetSecurityDescriptorDacl
CryptAcquireContextA
CryptGetUserKey
CryptGenKey
CryptExportKey
CryptCreateHash
CryptHashData
CryptSetKeyParam
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext

oleaut32

VariantChangeType
VariantClear
VarUdateFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantInit

ws2_32

htonl

crypt32

CertGetNameStringA
CertNameToStrA
CertFindCertificateInStore
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CertOpenSystemStoreA
CertCloseStore
CertAddCertificateContextToStore
CertCreateCertificateContext
CertFreeCertificateContext
CryptEncodeObjectEx
CertSetCertificateContextProperty

oleacc

CreateStdAccessibleObject
LresultFromObject

gdi32

GetStockObject
DeleteDC
SetMapMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
DeleteObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
GetDeviceCaps
PtVisible
SetViewportOrgEx

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

Exports

Exports

CryptSign
FreeMemory
GetParam
WriteParam

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/HD_Comm.dll
.dll windows:5 windows x86 arch:x86

953c3926ab991a36f8d544ec613d844f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:66:e7:d8:76:ec:ed:2c:0d:16:af:24:a3:53:99:e5:45:6f:f0:91
Signer

Actual PE Digest

71:66:e7:d8:76:ec:ed:2c:0d:16:af:24:a3:53:99:e5:45:6f:f0:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualFree
GetStdHandle
GetACP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
GetConsoleCP
GetConsoleMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapDestroy
InitializeCriticalSection
GetVersion
DeleteCriticalSection
GetSystemDefaultLCID
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
CloseHandle
GetCurrentProcess
GetLastError
SetLastError
SizeofResource
LockResource
LoadResource
FindResourceA
WideCharToMultiByte
ExitProcess
LocalFree
CreateMutexA
WaitForSingleObject
OpenMutexA
ReleaseMutex
GetSystemDirectoryA
CreateNamedPipeA
DisconnectNamedPipe
ReadFile
FlushFileBuffers
WriteFile
GetTickCount
LeaveCriticalSection
EnterCriticalSection
ConnectNamedPipe
GetModuleHandleA
GlobalAlloc
lstrcmpA
GlobalLock
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapReAlloc
VirtualAlloc
RaiseException
Sleep
GetCommandLineA
RtlUnwind
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
GetOEMCP
GetCPInfo
GetModuleHandleW
CreateFileA
SetFilePointer
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
InterlockedIncrement
GlobalFlags
WritePrivateProfileStringA
SetErrorMode
TlsFree
InterlockedExchange
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GlobalFree
GlobalUnlock
FormatMessageA
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
CompareStringA

user32

DestroyMenu
LoadCursorA
GetSysColorBrush
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
GetMenu
LoadStringA
GetForegroundWindow
MessageBoxA
SetDlgItemTextA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetDlgCtrlID
GetClassNameA
PtInRect
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
GetMenuItemID
GetMenuItemCount
GetSubMenu
UnhookWindowsHookEx
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
PeekMessageA
GetClassInfoA
SetWindowTextA
SendMessageA
EndDialog
EnableWindow
GetDlgItem
DialogBoxParamA
ShowWindow
CreateDialogParamA
DestroyWindow
CallWindowProcA
GetKeyState
SetWindowLongA
IsWindow
GetWindowTextA
GetWindowRect
GetSystemMetrics
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
PostMessageA
PostQuitMessage
GetClientRect
CreateWindowExA

gdi32

SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
ExtTextOutA
SelectObject
Escape
TextOutA
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
SetTextColor
CreateBitmap
GetDeviceCaps
SaveDC
RestoreDC
SetBkColor

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
InitializeAcl
LookupAccountNameA
AddAccessAllowedAce
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSecurityDescriptorSacl
SetNamedSecurityInfoA
CryptDeriveKey
CryptVerifySignatureA
CryptExportKey
CryptDuplicateKey
CryptSetKeyParam
CryptGetKeyParam
CryptImportKey
CryptDuplicateHash
CryptGetHashParam
CryptSetHashParam
CryptHashSessionKey
CryptHashData
CryptCreateHash
CryptGetUserKey
CryptGenKey
CryptEncrypt
CryptDecrypt
CryptAcquireContextA
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
CryptGetProvParam
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA

shlwapi

PathFindFileNameA
PathFindExtensionA

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

CAPDUtoSM
Cal3DES
ClearPinFromMem
GetSN
HDCSP_CloseDev
HDCSP_ListAllDev
HDCSP_OpenDev
HDM1_ChangePIN
HDM1_GetSn
HDPro_COSType
HDPro_GetSn
HD_APDUDev
HD_CPAcquireContext
HD_CPCreateHash
HD_CPDecrypt
HD_CPDeriveKey
HD_CPDestroyHash
HD_CPDestroyKey
HD_CPDuplicateHash
HD_CPDuplicateKey
HD_CPEncrypt
HD_CPExportKey
HD_CPGenKey
HD_CPGenRandom
HD_CPGetHashParam
HD_CPGetKeyParam
HD_CPGetProvParam
HD_CPGetUserKey
HD_CPHashData
HD_CPHashSessionKey
HD_CPImportKey
HD_CPReleaseContext
HD_CPSetHashParam
HD_CPSetKeyParam
HD_CPSetProvParam
HD_CPSignHash
HD_CPVerifySignature
HD_ChangeOpenPageFlag
HD_CloseDev
HD_Finalize
HD_GetDevInfo
HD_Initialize
HD_IsDefaultPin
HD_IsOpenPage
HD_ListAllDev
HD_OpenDev
HD_ResetDev
HD_SelectDev
HD_ToKenChangeSo
HD_ToKenChangeUser
HD_ToKenGenRSAKeyPair
HD_ToKenVerifySo
HD_ToKenVerifySoSm
HD_ToKenVerifyUser
HD_TokeGetPubKey
HD_TokenCreateCon
HD_TokenDelBinFile_SM
HD_TokenFindCon
HD_TokenGetCert
HD_TokenGetCertSize
HD_TokenImportRsaKeyObj
HD_TokenListContainer
HD_TokenSignData
HD_TokenWrtCert
HDpro_GetPinTime
HDpro_InitDynamicCode
HDpro_IsSupportDynamicCode
HDpro_ReloadPin
HDpro_RemoveDynamicCode
HDpro_UpdataContainerInfo
LockUKey
UnlockUKey
hmac_sha

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/InfoScan.dll
.dll regsvr32 windows:4 windows x86 arch:x86

b1b1835dbe84247312eadbac1ede3f56

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-12-2012 00:00

Not After

05-12-2015 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

40:25:de:14:15:e3:9a:6f:64:4d:71:be:3a:25:e3:70:88:a3:71:01
Signer

Actual PE Digest

40:25:de:14:15:e3:9a:6f:64:4d:71:be:3a:25:e3:70:88:a3:71:01

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

netapi32

Netbios

mfc42

ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3401
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3670
ord561
ord1199
ord1247
ord3952
ord2724
ord6354
ord1216
ord1168
ord6467
ord1227
ord823
ord1877
ord4249
ord2486
ord2687
ord4006
ord6364
ord3326
ord6365
ord4472
ord5498
ord3278
ord3353
ord3681
ord446
ord743
ord1177
ord1226
ord1210
ord2727
ord2730
ord2729
ord2439
ord1693
ord5618
ord994
ord4342
ord4687
ord4639
ord5674
ord2156
ord4856
ord4920
ord6002
ord2137
ord1963
ord5213
ord2953
ord3868
ord5150
ord4705
ord4707
ord2876
ord2998
ord5649
ord4113
ord4661
ord4660
ord4768
ord4650
ord4903
ord4548
ord4521
ord4594
ord4988
ord4925
ord4930
ord4935
ord4659
ord4909
ord4908
ord4668
ord4667
ord4666
ord4648
ord4689
ord5023
ord4654
ord4643
ord4354
ord4780
ord4649
ord4637
ord4636
ord5060
ord5307
ord815
ord4361
ord4356
ord4739
ord4741
ord4738
ord4409
ord4603
ord5008
ord4415
ord4992
ord4979
ord2488
ord3404
ord4539
ord2954
ord6055
ord4078
ord1776
ord4407
ord5241
ord2384
ord5163
ord1131
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2983
ord3148
ord3260
ord4466
ord2986
ord3080
ord4081
ord4624
ord5825
ord723
ord860
ord3946
ord423
ord2614
ord2860
ord2541
ord4949
ord641
ord2514
ord324
ord1601
ord858
ord4129
ord939
ord535
ord2818
ord941
ord537
ord922
ord924
ord6663
ord4204
ord3663
ord1892
ord4252
ord1212
ord4570
ord4672
ord4843
ord5011
ord5265
ord4376
ord4853
ord4998
ord4713
ord6052
ord1775
ord2385
ord6371
ord5286
ord4438
ord3279
ord4625
ord4425
ord449
ord746
ord2278
ord4698
ord4079
ord5302
ord5300
ord3346
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord4584
ord6375
ord1570
ord1253
ord1255
ord800
ord540
ord825
ord1132
ord4371
ord6370
ord1578
ord600
ord826
ord269

msvcrt

_initterm
strstr
__CxxFrameHandler
sprintf
free
malloc
_CxxThrowException
wcslen
_ftol
_strupr
__dllonexit
_onexit
??1type_info@@UAE@XZ
_adjust_fdiv

kernel32

LocalFree
InterlockedDecrement
GetSystemDefaultLangID
GlobalMemoryStatus
GetLocalTime
GetVersionExA
GetDriveTypeA
GetVolumeInformationA
GetLastError
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
LocalAlloc

user32

EnableWindow
FillRect

gdi32

GetStockObject

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

ole32

CoSetProxyBlanket
CoCreateInstance

oleaut32

VariantClear
SysAllocString
VariantInit
SysFreeString
LoadRegTypeLi

wsock32

WSACleanup
WSAStartup
gethostbyname
gethostname
inet_addr

iphlpapi

GetAdaptersInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/ccb_pin_cert.dll
.dll windows:5 windows x86 arch:x86

12b6933296b01586d90cc580706d664a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:9a:bf:0e:19:50:f2:c5:35:bd:58:9c:b8:aa:bb:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-04-2015 00:00

Not After

13-06-2018 23:59

Subject

CN=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,O=BeiJing HuaDa ZhiBao Electronic System CO.\, LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:06:e3:43:25:eb:af:5e:76:54:a8:81:ab:b4:c7:fe:b8:32:9f:18
Signer

Actual PE Digest

2a:06:e3:43:25:eb:af:5e:76:54:a8:81:ab:b4:c7:fe:b8:32:9f:18

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CertVerifySubjectCertificateContext
CertCloseStore
CertSetCertificateContextProperty
CertAddCertificateContextToStore
CertCreateCertificateContext
CertGetNameStringA
CertOpenSystemStoreA
CertFreeCertificateContext

kernel32

HeapReAlloc
HeapSize
Sleep
ExitProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
HeapCreate
HeapDestroy
VirtualFree
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetACP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
GetProcessHeap
GetSystemDefaultLCID
DeleteCriticalSection
InitializeCriticalSection
lstrcmpA
lstrlenA
GetTempPathA
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleFileNameA
FindResourceA
SizeofResource
LockResource
LoadResource
WideCharToMultiByte
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLocalTime
SystemTimeToFileTime
GetLastError
MultiByteToWideChar
GetSystemDirectoryA
CloseHandle
CreateThread
InterlockedDecrement
GetCurrentProcess
CreateProcessA
LeaveCriticalSection
EnterCriticalSection
CreateMutexA
OpenMutexA
WaitForSingleObject
ReleaseMutex
LocalFree
GetVersion
GetCurrentProcessId
FormatMessageA
GlobalUnlock
GlobalLock
GlobalAlloc
RaiseException
GetCommandLineA
HeapAlloc
HeapFree
RtlUnwind
GetOEMCP
GetCPInfo
GlobalFindAtomA
lstrcmpW
GetVersionExA
GlobalDeleteAtom
GetLocaleInfoA
InterlockedExchange
GetCurrentThreadId
GlobalFlags
GlobalAddAtomA
CreateFileA
SetEndOfFile
FlushFileBuffers
SetFilePointer
GlobalFree
WriteFile
ReadFile
GlobalGetAtomNameA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedIncrement
GetModuleHandleA
GetModuleHandleW
CompareStringA
SetLastError

user32

DestroyMenu
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
GetClientRect
CreateWindowExA
GetClassInfoA
RegisterClassA
CopyRect
DefWindowProcA
CallWindowProcA
GetMenu
SystemParametersInfoA
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
PostQuitMessage
IsIconic
GetWindowRect
GetSystemMetrics
PostMessageA
SetWindowPos
SetWindowLongA
IsWindow
SetWindowsHookExA
CallNextHookEx
DispatchMessageA
GetKeyState
PeekMessageA
ValidateRect
GetFocus
ClientToScreen
GetWindow
GetClassInfoExA
MessageBoxA
SendMessageA
GetDlgItem
SetWindowTextA
SetForegroundWindow
GetForegroundWindow
ShowWindow
GetWindowThreadProcessId
EnumWindows
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
GetDlgCtrlID
GetClassNameA
PtInRect
GetWindowTextA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
UnhookWindowsHookEx
LoadCursorA
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
AdjustWindowRectEx

gdi32

PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
SetMapMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
DeleteObject
GetDeviceCaps

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
SetSecurityDescriptorDacl
AddAccessAllowedAce
LookupAccountNameA
AllocateAndInitializeSid
FreeSid
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSecurityDescriptorSacl
SetNamedSecurityInfoA
InitializeSecurityDescriptor
InitializeAcl

shell32

ShellExecuteA

ole32

CoCreateInstance
OleRun
CoInitialize
CoUninitialize

oleaut32

SysFreeString
VariantCopy
VariantInit
VariantClear
SysAllocStringByteLen
SysStringByteLen
VariantChangeType
GetErrorInfo

Exports

Exports

Manage
bGetTokenType
getInfo

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Detector/mfc42.dll
.dll regsvr32 windows:4 windows x86 arch:x86

bcd2542f46e742c06cabefff84c7320d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MFC42.pdb

Imports

msvcrt

memcpy
memmove
malloc
free
abort
_mbsinc
memset
_get_osfhandle
__doserrno
_fdopen
_open_osfhandle
fclose
clearerr
fread
fwrite
fputs
fgets
ftell
fseek
fflush
realloc
_mbscmp
_mbschr
_mbspbrk
_mbsrev
_mbslwr
_mbsupr
wcslen
_mbscspn
_mbsrchr
_mbsspn
_mbsstr
_mbsnbcmp
_mbclen
vsprintf
strlen
sprintf
_ismbcdigit
atoi
_ismbcspace
mktime
gmtime
localtime
strftime
time
_mbctype
_purecall
_msize
calloc
memcmp
abs
strtoul
strtol
strtod
_expand
_mbsdec
_strdup
_endthreadex
_beginthreadex
__p___argv
__p___argc
atol
_fullpath
_splitpath
floor
fabs
_ftol
ceil
modf
_itoa
labs
swprintf
_ultoa
_ltoa
wcscpy
wcsncpy
_mbsnbicmp
??1type_info@@UAE@XZ
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_initterm
_adjust_fdiv
strcmp
strcpy
_CxxThrowException
__CxxFrameHandler

kernel32

WriteFile
GetProcAddress
LoadLibraryA
lstrcpyA
FindClose
FindFirstFileA
GetVolumeInformationA
GetFullPathNameA
GetCurrentProcess
GlobalSize
GlobalLock
GlobalAlloc
GlobalReAlloc
GlobalUnlock
GlobalFree
GetFileAttributesA
GetFileSize
GetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
SetFileAttributesA
InterlockedDecrement
WideCharToMultiByte
InterlockedIncrement
LocalFree
FormatMessageA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCPInfo
GetOEMCP
LocalAlloc
LeaveCriticalSection
GlobalHandle
EnterCriticalSection
TlsGetValue
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
WaitForSingleObject
CreateSemaphoreA
ReleaseSemaphore
CreateMutexA
ReleaseMutex
CreateEventA
WaitForMultipleObjects
GetVersionExA
GetModuleHandleA
lstrcatA
FreeLibrary
GlobalDeleteAtom
GlobalFindAtomA
GetVersion
GlobalAddAtomA
GlobalGetAtomNameA
GetCurrentThreadId
FreeResource
LockResource
LoadResource
FindResourceA
MulDiv
GetProfileIntA
VirtualProtect
FindResourceExA
SizeofResource
GetProcessVersion
GlobalFlags
GetTempFileNameA
GetDiskFreeSpaceA
LocalUnlock
LocalLock
SearchPathA
GetTempPathA
SetThreadPriority
ResumeThread
SetEvent
SuspendThread
GetCurrentThread
SetErrorMode
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetCurrentDirectoryA
FindNextFileA
GetTickCount
lstrlenW
CopyFileA
lstrcpyW
GetUserDefaultLCID
IsDBCSLeadByte
GetSystemDirectoryA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DuplicateHandle
MultiByteToWideChar
GetModuleFileNameA
GetShortPathNameA
lstrcmpiA
GetThreadLocale
GetStringTypeExA
DeleteFileA
MoveFileA
SetEndOfFile
UnlockFile
LockFile
CloseHandle
FlushFileBuffers
SetFilePointer
ReadFile
lstrcmpA
OutputDebugStringA
lstrlenA
IsBadReadPtr
IsBadWritePtr
IsBadStringPtrA
IsBadStringPtrW
GetLastError
SetLastError
lstrcpynA
RaiseException
InterlockedExchange
CreateFileA

gdi32

ScaleWindowExtEx
GetROP2
EnumFontFamiliesA
GetPixel
GetPaletteEntries
RealizePalette
CreatePalette
OffsetRgn
SetBrushOrgEx
CreateMetaFileA
CopyMetaFileA
LPtoDP
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
DPtoLP
GetMapMode
CombineRgn
SetRectRgn
CreateHatchBrush
ExtCreatePen
CreateDIBPatternBrushPt
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
OffsetWindowOrgEx
SelectPalette
StartDocA
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
LineTo
OffsetClipRgn
ExcludeClipRect
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
EnumFontFamiliesExA
CreateDCA
CreateRectRgnIndirect
UnrealizeObject
CreateBitmap
CreatePatternBrush
CreatePen
PatBlt
Rectangle
TextOutA
DeleteMetaFile
CloseMetaFile
GetPolyFillMode
ScaleViewportExtEx
IntersectClipRect
GetDeviceCaps
SetMapMode
SetWindowExtEx
SetViewportExtEx
OffsetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
GetWindowOrgEx
SetWindowOrgEx
GetCurrentPositionEx
MoveToEx
GetWindowExtEx
GetViewportExtEx
GetTextFaceA
GetTextAlign
RectVisible
PtVisible
GetTextColor
GetBkMode
GetBkColor
Escape
GetNearestColor
SaveDC
RestoreDC
GetStockObject
CreateFontA
GetCharWidthA
DeleteObject
CreateCompatibleBitmap
StretchDIBits
DeleteDC
CreateFontIndirectA
GetTextMetricsA
GetTextExtentPoint32A
ExtTextOutA
BitBlt
SelectObject
CreateCompatibleDC
CreateSolidBrush
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetStretchBltMode

user32

GetScrollRange
LoadStringA
FrameRect
InvalidateRgn
EnumChildWindows
DrawEdge
ClipCursor
GetNextDlgGroupItem
CharNextA
SetWindowContextHelpId
CountClipboardFormats
WindowFromDC
CreateMenu
PostThreadMessageA
InSendMessage
CopyAcceleratorTableA
RegisterClipboardFormatA
InsertMenuA
GetMenuStringA
ShowOwnedPopups
UnregisterClassA
PostQuitMessage
ValidateRect
RemoveMenu
MessageBeep
IsClipboardFormatAvailable
FindWindowA
SetCursorPos
DestroyCursor
DestroyIcon
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
MoveWindow
IsDialogMessageA
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetWindowTextA
GetClassNameA
GetSysColorBrush
EndPaint
BeginPaint
TabbedTextOutA
GetDialogBaseUnits
MapDialogRect
GetAsyncKeyState
wvsprintfA
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
DrawFocusRect
UnionRect
GrayStringA
DrawTextA
GetTabbedTextExtentA
LockWindowUpdate
GetDCEx
SetParent
GetSystemMenu
AppendMenuA
DeleteMenu
IsRectEmpty
IsZoomed
GetDC
KillTimer
SetTimer
SetRect
LoadBitmapA
ReleaseDC
GetWindowDC
InvertRect
FillRect
PtInRect
InflateRect
RedrawWindow
TranslateMDISysAccel
wsprintfA
GetSystemMetrics
CharUpperA
CharToOemA
OemToCharA
UnhookWindowsHookEx
MsgWaitForMultipleObjects
GetWindow
CopyRect
GetWindowRect
GetWindowPlacement
IsIconic
SystemParametersInfoA
IntersectRect
OffsetRect
SetWindowPos
SetWindowLongA
GetWindowLongA
CallWindowProcA
DefWindowProcA
SendMessageA
GetDlgCtrlID
GetWindowTextA
GetWindowTextLengthA
GetDlgItem
SetWindowPlacement
RegisterClassA
GetClassInfoA
GetMenuItemCount
GetMenuItemID
GetSubMenu
PostMessageA
GetMenu
GetClientRect
GetParent
UpdateWindow
MessageBoxA
IsWindowVisible
SetActiveWindow
SetScrollInfo
GetScrollInfo
ScrollWindow
ShowScrollBar
GetLastActivePopup
DeferWindowPos
EqualRect
ScreenToClient
AdjustWindowRectEx
SetForegroundWindow
GetForegroundWindow
GetSysColor
MapWindowPoints
EnableWindow
PeekMessageA
LoadIconA
GetScrollPos
SetScrollPos
DrawMenuBar
SetScrollRange
DestroyWindow
GetKeyState
TrackPopupMenu
IsChild
GetTopWindow
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
IsWindow
GetFocus
GetMessagePos
GetMessageTime
RemovePropA
GetPropA
DispatchMessageA
SendDlgItemMessageA
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
WinHelpA
GetCapture
RegisterWindowMessageA
LoadAcceleratorsA
TranslateAcceleratorA
IsWindowEnabled
GetDesktopWindow
ShowWindow
SetMenu
BringWindowToTop
SetRectEmpty
InvalidateRect
ReleaseCapture
SetCursor
DestroyMenu
LoadMenuA
ReuseDDElParam
UnpackDDElParam
GetActiveWindow
LoadCursorA
ClientToScreen
GetWindowThreadProcessId
SetCapture
WindowFromPoint
GetCursorPos
TranslateMessage
GetMessageA
WaitMessage
DefFrameProcA
DefMDIChildProcA

Exports

Exports

?classCCachedDataPathProperty@CCachedDataPathProperty@@2UCRuntimeClass@@B
?classCDataPathProperty@CDataPathProperty@@2UCRuntimeClass@@B
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 660KB - Virtual size: 656KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/AddCert.exe
.exe windows:4 windows x86 arch:x86

bcb787ce8c887361827e52084a145423

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:f8:0a:29:62:f1:de:b7:8a:5a:88:89:67:37:f8:92
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-11-2015 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:4c:43:c6:70:0e:4c:81:c9:44:2b:63:01:18:c7:57
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-01-2016 00:00

Not After

25-12-2018 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:7e:60:51:1e:61:9b:a0:d7:e5:9d:aa:92:d6:e8:ec:91:32:ee:68:73:18:58:41:94:10:3f:66:d7:cd:c2:9e
Signer

Actual PE Digest

2a:7e:60:51:1e:61:9b:a0:d7:e5:9d:aa:92:d6:e8:ec:91:32:ee:68:73:18:58:41:94:10:3f:66:d7:cd:c2:9e

Digest Algorithm

sha256

PE Digest Matches

true

0e:dc:88:68:99:0c:83:59:fc:76:47:0d:f7:35:62:34:3a:ef:1d:e4
Signer

Actual PE Digest

0e:dc:88:68:99:0c:83:59:fc:76:47:0d:f7:35:62:34:3a:ef:1d:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteA
SHGetFolderPathA

shlwapi

PathFileExistsA

kernel32

GetModuleFileNameA
GetStringTypeW
GetStringTypeA
SetStdHandle
LoadLibraryA
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
GetProcAddress
GetModuleHandleA
GetSystemDirectoryA
Sleep
WaitForSingleObject
CreateThread
GetCommandLineA
GetVersion
ExitProcess
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FlushFileBuffers
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
VirtualAlloc
HeapReAlloc
GetLastError
SetFilePointer
GetCPInfo
GetACP
GetOEMCP

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Plugins/CARoot/CCBSM2CACHILD.cer
Plugins/CARoot/CCBSM2CAROOT.cer
Plugins/CARoot/Microsoft.VC90.CRT.manifest
Plugins/CARoot/ccbcert.cer
Plugins/CARoot/certutil.exe
.exe windows:5 windows x86 arch:x86

4c9bebbb9daf0ef3005c395e49f4132c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

nssutil3

SECITEM_ZfreeItem_Util
PORT_SetError_Util
PORT_ArenaRelease_Util
PORT_ArenaAlloc_Util
SECOID_AddEntry_Util
NSS_Get_SEC_GeneralizedTimeTemplate_Util
CERT_GenTime2FormattedAscii_Util
SECOID_GetAlgorithmTag_Util
SEC_QuickDERDecodeItem_Util
SECOID_FindOID_Util
DER_GeneralizedTimeToTime_Util
DER_UTCTimeToTime_Util
DER_GetInteger_Util
ATOB_ConvertAsciiToItem_Util
SECITEM_AllocItem_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
ATOB_AsciiToData_Util
SEC_ASN1Decode_Util
PORT_Realloc_Util
PORT_Alloc_Util
SECOID_FindOIDTag_Util
SECOID_SetAlgorithmID_Util
PORT_Strdup_Util
NSS_Get_SEC_ObjectIDTemplate_Util
DER_AsciiToTime_Util
BTOA_DataToAscii_Util
BTOA_ConvertItemToAscii_Util
PORT_Free_Util
SEC_ASN1DecodeItem_Util
SECITEM_FreeItem_Util
PORT_ArenaStrdup_Util
NSS_Get_SEC_IA5StringTemplate_Util
SECITEM_CopyItem_Util
SEC_StringToOID
SEC_ASN1EncodeInteger_Util
PORT_ArenaGrow_Util
PORT_GetError_Util
PORT_ZAlloc_Util
SEC_ASN1EncodeItem_Util
SECOID_FindOIDByTag_Util
PORT_NewArena_Util
PORT_FreeArena_Util
PORT_ArenaMark_Util
PORT_ArenaZAlloc_Util

smime3

CERT_DecodeCertFromPackage

nss3

SECKEY_DestroyPrivateKeyList
PK11_GetCertFromPrivateKey
PK11_GetPrivateKeyNickname
PK11_ListPrivateKeysInSlot
PK11_ListPrivKeysInSlot
PK11_FreeSlotList
PK11_GetSlotName
PK11_GetAllTokens
PK11_DeleteTokenCertAndKey
PK11_FreeSlot
PK11_GetInternalKeySlot
CERT_DestroyValidity
CERT_CreateCertificate
CERT_CreateValidity
SECKEY_DestroyPrivateKey
NSS_Get_CERT_CertificateTemplate
NSS_Get_CERT_SignedDataTemplate
CERT_DestroyCertificateRequest
PK11_FindKeyByDERCert
CERT_MergeExtensions
CERT_GetCertificateRequestExtensions
CERT_StartCertExtensions
PK11_ReadRawAttribute
NSS_Shutdown
SECKEY_DestroyPublicKey
CERT_ExtractPublicKey
PK11_ResetToken
PK11_DestroyMergeLog
PK11_MergeTokens
PK11_CreateMergeLog
SECMOD_CloseUserDB
SECMOD_OpenUserDB
PK11_IsPresent
PK11_IsLoggedIn
PK11_IsRemovable
PK11_IsInternal
PK11_FindSlotByName
CERT_GetDefaultCertDB
NSS_InitWithMerge
NSS_Initialize
PK11_GetLowLevelKeyIDForPrivateKey
PK11_RandomUpdate
PK11_GenerateKeyPair
PK11_ProtectedAuthenticationPath
PK11_ChangePW
PK11_CheckUserPassword
PK11_InitPin
PK11_NeedUserInit
CERT_GetOidString
SEC_PKCS5IsAlgorithmPBEAlgTag
CERT_DestroyOidSequence
CERT_DecodeOidSequence
CERT_DecodeBasicConstraintValue
CERT_NameToAscii
CERT_Hexify
PK11_HashBuf
SECKEY_ExtractPublicKey
CERT_GetNextGeneralName
CERT_DecodeAuthKeyID
CERT_DecodeAltNameExtension
CERT_GetNextNameConstraint
CERT_DecodeNameConstraintsExtension
CERT_DecodeAuthInfoAccessExtension
CERT_DecodeCRLDistributionPoints
CERT_DestroyUserNotice
CERT_DecodeUserNotice
CERT_DestroyCertificatePoliciesExtension
CERT_DecodePrivKeyUsagePeriodExtension
CERT_VerifyCertificate
SEC_DeletePermCertificate
PK11_ListCerts
PK11_IsFriendly
PK11_NeedLogin
CERT_CreateSubjectCertList
CERT_DestroyCertList
PK11_ListCertsInSlot
PK11_FindCertFromNickname
CERT_CertChainFromCert
CERT_FindCertByDERCert
CERT_DestroyCertificateList
CERT_FindCertByNicknameOrEmailAddr
SECKEY_CreateSubjectPublicKeyInfo
CERT_CreateCertificateRequest
SECKEY_DestroySubjectPublicKeyInfo
CERT_StartCertificateRequestAttributes
CERT_FinishExtensions
CERT_FinishCertificateRequestAttributes
SEC_GetSignatureAlgorithmOidTag
SEC_DerSignData
CERT_GetCommonName
CERT_GetCertEmailAddress
CERT_GetOrgName
CERT_GetStateName
CERT_GetCountryName
CERT_DecodeTrustString
PK11_ImportCert
PK11_Authenticate
PK11_GetTokenName
CERT_ChangeCertTrust
CERT_SaveSMimeProfile
PK11_SetPasswordFunc
CERT_DestroyCertificate
NSS_Get_CERT_CertificateRequestTemplate
CERT_VerifySignedDataWithPublicKeyInfo
CERT_EncodeAltNameExtension
CERT_EncodeInfoAccessExtension
CERT_EncodeCertPoliciesExtension
CERT_EncodeNoticeReference
CERT_EncodeUserNotice
CERT_EncodePolicyMappingExtension
CERT_EncodeInhibitAnyExtension
CERT_EncodePolicyConstraintsExtension
CERT_CopyRDN
CERT_EncodeCRLDistributionPoints
CERT_EncodeSubjectKeyID
CERT_EncodeAuthKeyID
CERT_EncodeBasicConstraintValue
CERT_AddExtension
CERT_EncodeAndAddBitStrExtension
CERT_AsciiToName
CERT_CopyName
CERT_DestroyName
PK11_FindKeyByAnyCert

libplc4

PL_CreateLongOptState
PL_GetNextOpt
PL_DestroyOptState
PL_strdup
PL_strcmp
PL_strlen
PL_strncasecmp

libnspr4

PR_GetErrorText
PR_IsNetAddrType
PR_NetAddrToString
PR_FormatTime
PR_GetEnv
PR_GetOpenFileInfo
PR_Read
PR_Cleanup
PR_Open
PR_GetOSError
PR_Init
PR_smprintf
PR_smprintf_free
PR_Close
PR_Delete
PR_GetError
PR_GMTParameters
PR_ExplodeTime
PR_ImplodeTime
PR_GetSpecialFD
PR_Now
PR_fprintf
PR_Write
PR_snprintf
PR_GetErrorTextLength

msvcr90

_getch
_fileno
_isatty
_strdup
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
tolower
isprint
strstr
_errno
strerror
getc
strrchr
fopen
strpbrk
isspace
fclose
exit
sprintf
memset
printf
strchr
strncmp
memcpy
strtol
puts
fprintf
fputs
fflush
__iob_func
fgets
vfprintf

kernel32

QueryPerformanceCounter
Sleep
InterlockedCompareExchange
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
InterlockedExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Plugins/CARoot/freebl3.dll
.dll windows:5 windows x86 arch:x86

954079e3ab0d3ffddf19642181185a31

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nssutil3

SECITEM_CompareItem_Util
PORT_GetError_Util
SECITEM_FreeItem_Util
SECITEM_ZfreeItem_Util
SECITEM_CopyItem_Util
PORT_NewArena_Util
PORT_ArenaZAlloc_Util
PORT_FreeArena_Util
SECITEM_AllocItem_Util
PORT_ZFree_Util
PORT_ZAlloc_Util
PORT_SetError_Util
PORT_Free_Util
PORT_Alloc_Util

libnspr4

PR_GetLibraryFilePathname
PR_Seek
PR_Free
PR_Lock
PR_Unlock
PR_CallOnce
PR_NewLock
PR_DestroyLock
PR_Open
PR_Read
PR_Close

shell32

SHGetSpecialFolderPathW

msvcr90

_except_handler4_common
_time64
_stat64i32
memcpy
_snwprintf
fclose
fread
fopen
memset
strncmp
rand
free
malloc
abort
calloc
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit

kernel32

GetSystemTimeAsFileTime
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryA
GetProcAddress
FreeLibrary
GlobalMemoryStatus
GetLogicalDrives
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetVolumeInformationA
GetDiskFreeSpaceA
WideCharToMultiByte
GetTempPathW
FindFirstFileW
FindNextFileW
FindClose
GetTickCount
QueryPerformanceCounter

Exports

Exports

FREEBL_GetVector

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/libnspr4.dll
.dll windows:5 windows x86 arch:x86

9ce7f9d36ecd7c8c282672671029a463

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AllocateAndInitializeSid
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor

wsock32

WSACleanup
WSASetLastError
select
recvfrom
sendto
send
recv
__WSAFDIsSet
getpeername
shutdown
ord1140
ord1141
ord1142
setsockopt
inet_ntoa
WSAStartup
socket
bind
getsockname
listen
connect
accept
getsockopt
ntohl
ntohs
htons
getprotobynumber
getprotobyname
gethostbyaddr
gethostbyname
htonl
closesocket
WSAGetLastError
gethostname

winmm

timeGetTime

msvcr90

_lock
_onexit
_except_handler4_common
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_time64
_beginthreadex
_exit
_endthreadex
_access
_mbsdec
_stat64i32
_mbsinc
qsort
_stricmp
strpbrk
memmove
isalpha
strftime
_mktime64
_localtime64
strncmp
_errno
strerror
realloc
calloc
malloc
strrchr
strstr
getenv
strchr
isdigit
strtoul
strtol
isspace
tolower
memchr
sprintf
abort
free
fwrite
fflush
fopen
setvbuf
fclose
sscanf
memcpy
exit
__iob_func
fprintf
atoi
memset
_strdup
_environ
_putenv

kernel32

GetFileAttributesExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OpenFileMappingA
GetTickCount
QueryPerformanceCounter
OpenSemaphoreA
SetLastError
SwitchToFiber
CreateFiber
ResumeThread
SuspendThread
GetProcessAffinityMask
SetThreadAffinityMask
ConvertThreadToFiber
SetThreadPriority
GetCurrentThread
DuplicateHandle
CreateEventA
TlsFree
TlsAlloc
CancelIo
GetLogicalDriveStringsA
SetErrorMode
GetDriveTypeA
GetVolumeInformationA
lstrlenA
UnlockFileEx
LockFileEx
RemoveDirectoryA
CreateDirectoryA
MoveFileA
DeleteFileA
FindNextFileA
FindFirstFileA
FindClose
GetHandleInformation
SetHandleInformation
FlushFileBuffers
CreateFileA
SetFilePointer
WriteFile
WaitForMultipleObjects
GetOverlappedResult
ResetEvent
CreateIoCompletionPort
PostQueuedCompletionStatus
DeleteFiber
GetQueuedCompletionStatus
GetThreadContext
ReleaseSemaphore
CreateSemaphoreA
GetCurrentProcess
UnmapViewOfFile
MapViewOfFile
FormatMessageA
CreateFileMappingA
GetVersionExA
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTime
SystemTimeToFileTime
TryEnterCriticalSection
Sleep
GetStdHandle
CreatePipe
CloseHandle
GetFileInformationByHandle
GlobalMemoryStatus
InterlockedExchange
GetSystemInfo
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryExW
GetModuleHandleA
DebugBreak
TlsGetValue
TlsSetValue
OutputDebugStringA
GetLastError
ReadFile
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedCompareExchange

Exports

Exports

GetExecutionEnvironment
LL_MaxInt
LL_MaxUint
LL_MinInt
LL_Zero
PRP_DestroyNakedCondVar
PRP_NakedBroadcast
PRP_NakedNotify
PRP_NakedWait
PRP_NewNakedCondVar
PRP_TryLock
PR_Abort
PR_Accept
PR_AcceptRead
PR_Access
PR_AddToCounter
PR_AddWaitFileDesc
PR_AllocFileDesc
PR_Assert
PR_AssertCurrentThreadInMonitor
PR_AssertCurrentThreadOwnsLock
PR_AtomicAdd
PR_AtomicDecrement
PR_AtomicIncrement
PR_AtomicSet
PR_AttachSharedMemory
PR_AttachThread
PR_AttachThreadGCAble
PR_Available
PR_Available64
PR_Bind
PR_BlockClockInterrupts
PR_BlockInterrupt
PR_CEnterMonitor
PR_CExitMonitor
PR_CNotify
PR_CNotifyAll
PR_CSetOnMonitorRecycle
PR_CWait
PR_CallOnce
PR_CallOnceWithArg
PR_Calloc
PR_CancelJob
PR_CancelWaitFileDesc
PR_CancelWaitGroup
PR_CeilingLog2
PR_ChangeFileDescNativeHandle
PR_Cleanup
PR_ClearInterrupt
PR_ClearThreadGCAble
PR_Close
PR_CloseDir
PR_CloseFileMap
PR_CloseSemaphore
PR_CloseSharedMemory
PR_Connect
PR_ConnectContinue
PR_ConvertIPv4AddrToIPv6
PR_CreateAlarm
PR_CreateCounter
PR_CreateFileMap
PR_CreateIOLayer
PR_CreateIOLayerStub
PR_CreateMWaitEnumerator
PR_CreateOrderedLock
PR_CreatePipe
PR_CreateProcess
PR_CreateProcessDetached
PR_CreateSocketPollFd
PR_CreateStack
PR_CreateThread
PR_CreateThreadGCAble
PR_CreateThreadPool
PR_CreateTrace
PR_CreateWaitGroup
PR_DecrementCounter
PR_Delete
PR_DeleteSemaphore
PR_DeleteSharedMemory
PR_DestroyAlarm
PR_DestroyCondVar
PR_DestroyCounter
PR_DestroyLock
PR_DestroyMWaitEnumerator
PR_DestroyMonitor
PR_DestroyOrderedLock
PR_DestroyPollableEvent
PR_DestroyProcessAttr
PR_DestroyRWLock
PR_DestroySem
PR_DestroySocketPollFd
PR_DestroyStack
PR_DestroyTrace
PR_DestroyWaitGroup
PR_DetachProcess
PR_DetachSharedMemory
PR_DetachThread
PR_DisableClockInterrupts
PR_EmulateAcceptRead
PR_EmulateSendFile
PR_EnableClockInterrupts
PR_EnterMonitor
PR_EnumerateAddrInfo
PR_EnumerateHostEnt
PR_EnumerateThreads
PR_EnumerateWaitGroup
PR_ErrorInstallCallback
PR_ErrorInstallTable
PR_ErrorLanguages
PR_ErrorToName
PR_ErrorToString
PR_ExitMonitor
PR_ExplodeTime
PR_ExportFileMapAsString
PR_FD_CLR
PR_FD_ISSET
PR_FD_NCLR
PR_FD_NISSET
PR_FD_NSET
PR_FD_SET
PR_FD_ZERO
PR_FileDesc2NativeHandle
PR_FindFunctionSymbol
PR_FindFunctionSymbolAndLibrary
PR_FindNextCounterQname
PR_FindNextCounterRname
PR_FindNextTraceQname
PR_FindNextTraceRname
PR_FindSymbol
PR_FindSymbolAndLibrary
PR_FloorLog2
PR_FormatTime
PR_FormatTimeUSEnglish
PR_Free
PR_FreeAddrInfo
PR_FreeFileDesc
PR_FreeLibraryName
PR_GMTParameters
PR_GetAddrInfoByName
PR_GetCanonNameFromAddrInfo
PR_GetConnectStatus
PR_GetCounter
PR_GetCounterHandleFromName
PR_GetCounterNameFromHandle
PR_GetCurrentThread
PR_GetDefaultIOMethods
PR_GetDescType
PR_GetDirectorySeparator
PR_GetDirectorySepartor
PR_GetEnv
PR_GetError
PR_GetErrorText
PR_GetErrorTextLength
PR_GetFileInfo
PR_GetFileInfo64
PR_GetFileMethods
PR_GetGCRegisters
PR_GetHostByAddr
PR_GetHostByName
PR_GetIPNodeByName
PR_GetIdentitiesLayer
PR_GetInheritedFD
PR_GetInheritedFileMap
PR_GetLayersIdentity
PR_GetLibraryFilePathname
PR_GetLibraryName
PR_GetLibraryPath
PR_GetMemMapAlignment
PR_GetMonitorEntryCount
PR_GetNameForIdentity
PR_GetNumberOfProcessors
PR_GetOSError
PR_GetOpenFileInfo
PR_GetOpenFileInfo64
PR_GetPageShift
PR_GetPageSize
PR_GetPathSeparator
PR_GetPeerName
PR_GetPhysicalMemorySize
PR_GetPipeMethods
PR_GetProtoByName
PR_GetProtoByNumber
PR_GetRandomNoise
PR_GetSP
PR_GetSockName
PR_GetSocketOption
PR_GetSpecialFD
PR_GetStackSpaceLeft
PR_GetSysfdTableMax
PR_GetSystemInfo
PR_GetTCPMethods
PR_GetThreadAffinityMask
PR_GetThreadID
PR_GetThreadPriority
PR_GetThreadPrivate
PR_GetThreadScope
PR_GetThreadState
PR_GetThreadType
PR_GetTraceEntries
PR_GetTraceHandleFromName
PR_GetTraceNameFromHandle
PR_GetTraceOption
PR_GetUDPMethods
PR_GetUniqueIdentity
PR_ImplodeTime
PR_ImportFile
PR_ImportFileMapFromString
PR_ImportPipe
PR_ImportTCPSocket
PR_ImportUDPSocket
PR_IncrementCounter
PR_Init
PR_Initialize
PR_InitializeNetAddr
PR_Initialized
PR_Interrupt
PR_IntervalNow
PR_IntervalToMicroseconds
PR_IntervalToMilliseconds
PR_IntervalToSeconds
PR_IsNetAddrType
PR_JoinJob
PR_JoinThread
PR_JoinThreadPool
PR_KillProcess
PR_Listen
PR_LoadLibrary
PR_LoadLibraryWithFlags
PR_LoadStaticLibrary
PR_LocalTimeParameters
PR_Lock
PR_LockFile
PR_LockOrderedLock
PR_LogFlush
PR_LogPrint
PR_MakeDir
PR_Malloc
PR_MemMap
PR_MemUnmap
PR_MicrosecondsToInterval
PR_MillisecondsToInterval
PR_MkDir
PR_NTFast_Accept
PR_NTFast_AcceptRead
PR_NTFast_AcceptRead_WithTimeoutCallback
PR_NTFast_UpdateAcceptContext
PR_NT_CancelIo
PR_NetAddrToString
PR_NewCondVar
PR_NewLock
PR_NewLogModule
PR_NewMonitor
PR_NewNamedMonitor
PR_NewPollableEvent
PR_NewProcessAttr
PR_NewRWLock
PR_NewSem
PR_NewTCPSocket
PR_NewTCPSocketPair
PR_NewThreadPrivateIndex
PR_NewUDPSocket
PR_NormalizeTime
PR_Notify
PR_NotifyAll
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_Now
PR_Open
PR_OpenAnonFileMap
PR_OpenDir
PR_OpenFile
PR_OpenSemaphore
PR_OpenSharedMemory
PR_OpenTCPSocket
PR_OpenUDPSocket
PR_ParseTimeString
PR_ParseTimeStringToExplodedTime
PR_Poll
PR_PopIOLayer
PR_PostSem
PR_PostSemaphore
PR_ProcessAttrSetCurrentDirectory
PR_ProcessAttrSetInheritableFD
PR_ProcessAttrSetInheritableFileMap
PR_ProcessAttrSetStdioRedirect
PR_ProcessExit
PR_PushIOLayer
PR_QueueJob
PR_QueueJob_Accept
PR_QueueJob_Connect
PR_QueueJob_Read
PR_QueueJob_Timer
PR_QueueJob_Write
PR_RWLock_Rlock
PR_RWLock_Unlock
PR_RWLock_Wlock
PR_Read
PR_ReadDir
PR_Realloc
PR_RecordTraceEntries
PR_Recv
PR_RecvFrom
PR_Rename
PR_ResetAlarm
PR_ResetProcessAttr
PR_ResumeAll
PR_RmDir
PR_ScanStackPointers
PR_SecondsToInterval
PR_Seek
PR_Seek64
PR_Select
PR_Send
PR_SendFile
PR_SendTo
PR_SetAlarm
PR_SetCPUAffinityMask
PR_SetConcurrency
PR_SetCounter
PR_SetEnv
PR_SetError
PR_SetErrorText
PR_SetFDCacheSize
PR_SetFDInheritable
PR_SetLibraryPath
PR_SetLogBuffering
PR_SetLogFile
PR_SetNetAddr
PR_SetPollableEvent
PR_SetSocketOption
PR_SetStdioRedirect
PR_SetSysfdTableSize
PR_SetThreadAffinityMask
PR_SetThreadDumpProc
PR_SetThreadGCAble
PR_SetThreadPriority
PR_SetThreadPrivate
PR_SetThreadRecycleMode
PR_SetTraceOption
PR_ShowStatus
PR_Shutdown
PR_ShutdownThreadPool
PR_Sleep
PR_Socket
PR_StackPop
PR_StackPush
PR_Stat
PR_StringToNetAddr
PR_SubtractFromCounter
PR_SuspendAll
PR_Sync
PR_TLockFile
PR_TestAndEnterMonitor
PR_TestAndLock
PR_ThreadScanStackPointers
PR_TicksPerSecond
PR_Trace
PR_TransmitFile
PR_USPacificTimeParameters
PR_UnblockClockInterrupts
PR_UnblockInterrupt
PR_UnloadLibrary
PR_Unlock
PR_UnlockFile
PR_UnlockOrderedLock
PR_VersionCheck
PR_Wait
PR_WaitCondVar
PR_WaitForPollableEvent
PR_WaitProcess
PR_WaitRecvReady
PR_WaitSem
PR_WaitSemaphore
PR_Write
PR_Writev
PR_Yield
PR_cnvtf
PR_dtoa
PR_fprintf
PR_htonl
PR_htonll
PR_htons
PR_ntohl
PR_ntohll
PR_ntohs
PR_smprintf
PR_smprintf_free
PR_snprintf
PR_sprintf_append
PR_sscanf
PR_strtod
PR_sxprintf
PR_vfprintf
PR_vsmprintf
PR_vsnprintf
PR_vsprintf_append
PR_vsxprintf
PT_FPrintStats
SetExecutionEnvironment
_PR_AddSleepQ
_PR_CreateThread
_PR_DelSleepQ
_PR_GetPrimordialCPU
_PR_NativeCreateThread
_pr_push_ipv6toipv4_layer
_pr_test_ipv6_socket
libVersionPoint

Sections

.text
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 25B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/libplc4.dll
.dll windows:5 windows x86 arch:x86

4186cd42be9b2afabef8dd72516938ad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libnspr4

PR_SetError
PR_Calloc
PR_GetSpecialFD
PR_GetError
PR_GetOSError
PR_ErrorToName
PR_fprintf
PR_Free
PR_Malloc

msvcr90

strrchr
strpbrk
strstr
_encode_pointer
_malloc_crt
strchr
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
strncmp
free
memcpy
malloc
_encoded_null

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
QueryPerformanceCounter

Exports

Exports

PL_Base64Decode
PL_Base64Encode
PL_CreateLongOptState
PL_CreateOptState
PL_DestroyOptState
PL_FPrintError
PL_GetNextOpt
PL_PrintError
PL_strcasecmp
PL_strcaserstr
PL_strcasestr
PL_strcat
PL_strcatn
PL_strchr
PL_strcmp
PL_strcpy
PL_strdup
PL_strfree
PL_strlen
PL_strncasecmp
PL_strncaserstr
PL_strncasestr
PL_strncat
PL_strnchr
PL_strncmp
PL_strncpy
PL_strncpyz
PL_strndup
PL_strnlen
PL_strnpbrk
PL_strnprbrk
PL_strnrchr
PL_strnrstr
PL_strnstr
PL_strpbrk
PL_strprbrk
PL_strrchr
PL_strrstr
PL_strstr
PL_strtok_r
libVersionPoint

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 538B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/libplds4.dll
.dll windows:5 windows x86 arch:x86

b6d90a32750acf0af0a8655d5d0a030b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libnspr4

PR_DestroyLock
PR_Free
PR_Malloc
PR_CeilingLog2
PR_Unlock
PR_CallOnce
PR_Lock
PR_NewLock

msvcr90

_decode_pointer
_initterm
_encoded_null
_amsg_exit
_adjust_fdiv
__CppXcptFilter
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
free
_malloc_crt
_encode_pointer
memset
memcpy
_initterm_e

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTickCount

Exports

Exports

PL_ArenaAllocate
PL_ArenaFinish
PL_ArenaGrow
PL_ArenaRelease
PL_ClearArenaPool
PL_CompactArenaPool
PL_CompareStrings
PL_CompareValues
PL_FinishArenaPool
PL_FreeArenaPool
PL_HashString
PL_HashTableAdd
PL_HashTableDestroy
PL_HashTableDump
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableLookupConst
PL_HashTableRawAdd
PL_HashTableRawLookup
PL_HashTableRawLookupConst
PL_HashTableRawRemove
PL_HashTableRemove
PL_InitArenaPool
PL_NewHashTable
libVersionPoint

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 514B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/modutil.exe
.exe windows:5 windows x86 arch:x86

d1c110c6fd01d9faf03947596064714c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

nssutil3

PORT_Free_Util
PORT_ZAlloc_Util
PORT_Strdup_Util
PORT_Alloc_Util
PORT_RegExpSearch
ATOB_AsciiToData_Util
PORT_SetError_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
PORT_GetError_Util

smime3

SEC_PKCS7DestroyContentInfo
SEC_PKCS7VerifyDetachedSignature
SEC_PKCS7ContentIsSigned
SEC_PKCS7ContentIsEncrypted
SEC_PKCS7DecoderFinish
SEC_PKCS7DecoderUpdate
SEC_PKCS7DecoderStart

nss3

SECMOD_FindModule
PK11_GetModInfo
PK11_CreateDigestContext
PK11_DigestBegin
PK11_DigestOp
PK11_DigestFinal
PK11_DestroyContext
CERT_DupCertificate
CERT_GetDefaultCertDB
CERT_DestroyCertificate
SECMOD_AddNewModule
PK11_GetDefaultArray
PK11_UpdateSlotAttribute
PK11_UserEnableSlot
PK11_UserDisableSlot
PK11_FindSlotByName
PK11_NeedUserInit
PK11_CheckUserPassword
PK11_InitPin
PK11_ChangePW
PK11_FreeSlot
PK11_GetDefaultFlags
PK11_GetSlotInfo
PK11_IsHW
PK11_IsDisabled
PK11_GetDisabledReason
PK11_GetTokenInfo
SECMOD_DestroyModule
SECMOD_GetDefaultModuleListLock
SECMOD_GetReadLock
SECMOD_GetDefaultModuleList
SECMOD_GetDeadModuleList
SECMOD_ReleaseReadLock
PK11_GetSlotName
PK11_GetTokenName
SECMOD_UpdateModule
SECMOD_LoadModule
SECMOD_GetModuleSpecList
SECMOD_DeleteModule
SECMOD_PubCipherFlagstoInternal
SECMOD_PubMechFlagstoInternal
SECMOD_AddNewModuleEx
PK11_IsFIPS
SECMOD_GetInternalModule
SECMOD_DeleteInternalModule
NSS_Shutdown
NSS_Initialize

libplc4

PL_strncasecmp
PL_strcasestr
PL_strcasecmp

libnspr4

PR_GetEnv
PR_Seek
PR_Write
PR_Close
PR_snprintf
PR_Realloc
PR_Open
PR_GetSystemInfo
PR_NewProcessAttr
PR_CreateProcess
PR_WaitProcess
PR_DestroyProcessAttr
PR_MkDir
PR_Access
PR_GetFileInfo
PR_OpenDir
PR_ReadDir
PR_CloseDir
PR_RmDir
PR_Delete
PR_vsmprintf
PR_NewLock
PR_Lock
PR_Unlock
PR_GetErrorTextLength
PR_GetErrorText
PR_Malloc
PR_Free
PR_smprintf_free
PR_Init
PR_smprintf
PR_Cleanup
PR_Read
PR_GetSpecialFD
PR_fprintf

msvcr90

_isatty
_fileno
_getch
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
fflush
vfprintf
memcpy
fwrite
__iob_func
fprintf
free
strtol
strpbrk
sprintf
malloc
memset
printf
strchr
strrchr
strtok
exit
strncmp
fgets

kernel32

QueryPerformanceCounter
Sleep
InterlockedCompareExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
InterlockedExchange
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Plugins/CARoot/msvcr90.dll
.dll windows:5 windows x86 arch:x86

0fda4497453286b1daa098623dfc53ce

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10-01-1997 07:00

Not After

31-12-2020 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10-01-1997 07:00

Not After

31-12-2020 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22-08-2007 22:31

Not After

25-08-2012 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-08-2007 00:23

Not After

23-02-2009 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-09-2006 01:53

Not After

16-09-2011 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-09-2006 01:53

Not After

16-09-2011 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

54:13:79:94:a8:94:70:d8:e8:ea:19:5c:85:d8:c4:57:81:82:2d:8c
Signer

Actual PE Digest

54:13:79:94:a8:94:70:d8:e8:ea:19:5c:85:d8:c4:57:81:82:2d:8c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msvcr90.i386.pdb

Imports

kernel32

GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetLongPathNameW
GetCurrentThreadId
TlsGetValue
DebugBreak
OutputDebugStringA
GetCommandLineA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
FindNextFileA
FindFirstFileA
FindClose
FindNextFileW
FindFirstFileW
GetLogicalDrives
GetDiskFreeSpaceA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetErrorMode
Beep
GetFileAttributesA
SetFileAttributesA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetFullPathNameA
GetDriveTypeA
GetCurrentProcessId
CreateDirectoryA
MoveFileA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
DeleteFileW
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
LoadLibraryA
FreeLibrary
CreateProcessW
ReadFile
DuplicateHandle
GetCurrentProcess
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetLocalTime
WideCharToMultiByte
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetLocalTime
MultiByteToWideChar
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
RtlUnwind
RaiseException
HeapFree
HeapAlloc
GetProcessHeap
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapSize
HeapReAlloc
VirtualAlloc
HeapValidate
HeapCompact
HeapWalk
VirtualProtect
GetSystemInfo
VirtualQuery
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
CreateFileA
FlushFileBuffers
CreatePipe
CreateFileW
SetStdHandle
ReadConsoleInputA
SetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
IsDBCSLeadByteEx
ReadConsoleA
ReadConsoleW
SetEndOfFile
GetFileInformationByHandle
PeekNamedPipe
InterlockedExchange
LockFile
UnlockFile
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
FreeEnvironmentStringsA
GetEnvironmentStrings
QueryPerformanceCounter
GetTickCount
GetStringTypeW
GetStringTypeA
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
GetLocaleInfoW
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
LoadLibraryW
GetModuleHandleA

Exports

Exports

$I10_OUTPUT
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1exception@std@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@@6B@
??_7exception@std@@6B@
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZH@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?raw_name@type_info@@QBEPBDXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?unexpected@@YAXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?what@exception@std@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_Strftime
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindStdDelDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___fls_getvalue@4
___fls_setvalue@8
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringW
__crtGetLocaleInfoW
__crtGetStringTypeW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_app_type
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lc_clike
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__amblksiz
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__set_flsgetvalue
__setlc_active
__setusermatherr
__strncnt
__swprintf_l
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__unDNameHelper
__uncaught_exception
__unguarded_readlc_active
__vswprintf_l
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_amsg_exit
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_crt
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_commode
_configthreadlocale
_control87
_controlfp
_controlfp_s
_copysign
_cprintf
_cprintf_l
_cprintf_p
_cprintf_p_l
_cprintf_s
_cprintf_s_l
_cputs
_cputws
_creat
_create_locale
_crt_debugger_hook
_cscanf
_cscanf_l
_cscanf_s
_cscanf_s_l
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_cwait
_cwprintf
_cwprintf_l
_cwprintf_p
_cwprintf_p_l
_cwprintf_s
_cwprintf_s_l
_cwscanf
_cwscanf_l
_cwscanf_s
_cwscanf_s_l
_daylight
_decode_pointer
_difftime32
_difftime64
_dosmaperr
_dstbias
_dup
_dup2
_dupenv_s
_ecvt
_ecvt_s
_encode_pointer
_encoded_null
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_except_handler4_common
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fclose_nolock
_fcloseall
_fcvt
_fcvt_s
_fdopen
_fflush_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filbuf
_filelength
_filelengthi64
_fileno
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_free_locale
_freea
_freea_s
_freefls
_fscanf_l
_fscanf_s_l
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_ftell_nolock
_ftelli64
_ftelli64_nolock
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_ftol
_fullpath
_futime32
_futime64
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwrite_nolock
_fwscanf_l
_fwscanf_s_l
_gcvt
_gcvt_s
_get_amblksiz
_get_current_locale
_get_daylight
_get_doserrno
_get_dstbias
_get_errno
_get_fmode
_get_heap_handle
_get_invalid_parameter_handler
_get_osfhandle
_get_output_format
_get_pgmptr
_get_printf_count_output
_get_purecall_handler
_get_sbh_threshold
_get_terminate
_get_timezone
_get_tzname
_get_unexpected
_get_wpgmptr
_getc_nolock
_getch
_getch_nolock
_getche
_getche_nolock
_getcwd
_getdcwd
_getdcwd_nolock
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getptd
_getsystime
_getw
_getwch
_getwch_nolock
_getwche
_getwche_nolock
_getws
_getws_s
_global_unwind2
_gmtime32

Sections

.text
Size: 598KB - Virtual size: 598KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/nspr4.dll
.dll windows:5 windows x86 arch:x86

e336f25dce4d873c578e183b318c3009

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AllocateAndInitializeSid
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor

wsock32

recvfrom
sendto
send
recv
connect
accept
select
__WSAFDIsSet
setsockopt
getpeername
getsockname
shutdown
listen
bind
inet_ntoa
closesocket
WSAStartup
WSACleanup
gethostname
getsockopt
WSAGetLastError
ioctlsocket
ntohl
ntohs
htons
getprotobynumber
getprotobyname
gethostbyaddr
gethostbyname
htonl
socket

winmm

timeGetTime

msvcr90

_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_time64
_stat64i32
_access
_mbspbrk
_mbsdec
_mbsinc
_beginthreadex
_exit
_environ
qsort
_stricmp
strpbrk
strftime
_mktime64
_localtime64
strncmp
_errno
strerror
realloc
calloc
malloc
strrchr
strstr
getenv
memset
strchr
isdigit
strtoul
strtol
isspace
tolower
memchr
sprintf
abort
free
fwrite
fflush
fopen
setvbuf
__iob_func
fclose
sscanf
memcpy
atoi
_strdup
isalpha
_putenv

kernel32

ResumeThread
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
OpenFileMappingA
GetTickCount
QueryPerformanceCounter
OpenSemaphoreA
LoadLibraryW
LeaveCriticalSection
UnlockFile
LockFile
RemoveDirectoryA
CreateDirectoryA
MoveFileA
GetHandleInformation
SetHandleInformation
GetFileInformationByHandle
SetLastError
FindFirstFileA
GetFullPathNameA
GetDriveTypeA
DeleteFileA
FindNextFileA
FindClose
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
SuspendThread
SetThreadPriority
GetCurrentThread
DuplicateHandle
TlsFree
TlsAlloc
GetThreadContext
ReleaseSemaphore
CreateSemaphoreA
GetCurrentProcess
UnmapViewOfFile
MapViewOfFile
FormatMessageA
CreateFileMappingA
GetVersionExA
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTime
SystemTimeToFileTime
TlsSetValue
DeleteCriticalSection
InitializeCriticalSection
TlsGetValue
Sleep
GetStdHandle
CreatePipe
CreateFileA
CloseHandle
GlobalMemoryStatus
InterlockedExchange
GetSystemInfo
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
GetLastError
LoadLibraryExW
GetModuleHandleA
DebugBreak
EnterCriticalSection
OutputDebugStringA

Exports

Exports

GetExecutionEnvironment
LL_MaxInt
LL_MaxUint
LL_MinInt
LL_Zero
PRP_DestroyNakedCondVar
PRP_NakedBroadcast
PRP_NakedNotify
PRP_NakedWait
PRP_NewNakedCondVar
PRP_TryLock
PR_Abort
PR_Accept
PR_AcceptRead
PR_Access
PR_AddToCounter
PR_AddWaitFileDesc
PR_AllocFileDesc
PR_Assert
PR_AssertCurrentThreadInMonitor
PR_AssertCurrentThreadOwnsLock
PR_AtomicAdd
PR_AtomicDecrement
PR_AtomicIncrement
PR_AtomicSet
PR_AttachSharedMemory
PR_AttachThread
PR_AttachThreadGCAble
PR_Available
PR_Available64
PR_Bind
PR_BlockClockInterrupts
PR_BlockInterrupt
PR_CEnterMonitor
PR_CExitMonitor
PR_CNotify
PR_CNotifyAll
PR_CSetOnMonitorRecycle
PR_CWait
PR_CallOnce
PR_CallOnceWithArg
PR_Calloc
PR_CancelJob
PR_CancelWaitFileDesc
PR_CancelWaitGroup
PR_CeilingLog2
PR_ChangeFileDescNativeHandle
PR_Cleanup
PR_ClearInterrupt
PR_ClearThreadGCAble
PR_Close
PR_CloseDir
PR_CloseFileMap
PR_CloseSemaphore
PR_CloseSharedMemory
PR_Connect
PR_ConnectContinue
PR_ConvertIPv4AddrToIPv6
PR_CreateAlarm
PR_CreateCounter
PR_CreateFileMap
PR_CreateIOLayer
PR_CreateIOLayerStub
PR_CreateMWaitEnumerator
PR_CreateOrderedLock
PR_CreatePipe
PR_CreateProcess
PR_CreateProcessDetached
PR_CreateSocketPollFd
PR_CreateStack
PR_CreateThread
PR_CreateThreadGCAble
PR_CreateThreadPool
PR_CreateTrace
PR_CreateWaitGroup
PR_DecrementCounter
PR_Delete
PR_DeleteSemaphore
PR_DeleteSharedMemory
PR_DestroyAlarm
PR_DestroyCondVar
PR_DestroyCounter
PR_DestroyLock
PR_DestroyMWaitEnumerator
PR_DestroyMonitor
PR_DestroyOrderedLock
PR_DestroyPollableEvent
PR_DestroyProcessAttr
PR_DestroyRWLock
PR_DestroySem
PR_DestroySocketPollFd
PR_DestroyStack
PR_DestroyTrace
PR_DestroyWaitGroup
PR_DetachProcess
PR_DetachSharedMemory
PR_DetachThread
PR_DisableClockInterrupts
PR_EmulateAcceptRead
PR_EmulateSendFile
PR_EnableClockInterrupts
PR_EnterMonitor
PR_EnumerateAddrInfo
PR_EnumerateHostEnt
PR_EnumerateThreads
PR_EnumerateWaitGroup
PR_ErrorInstallCallback
PR_ErrorInstallTable
PR_ErrorLanguages
PR_ErrorToName
PR_ErrorToString
PR_ExitMonitor
PR_ExplodeTime
PR_ExportFileMapAsString
PR_FD_CLR
PR_FD_ISSET
PR_FD_NCLR
PR_FD_NISSET
PR_FD_NSET
PR_FD_SET
PR_FD_ZERO
PR_FileDesc2NativeHandle
PR_FindFunctionSymbol
PR_FindFunctionSymbolAndLibrary
PR_FindNextCounterQname
PR_FindNextCounterRname
PR_FindNextTraceQname
PR_FindNextTraceRname
PR_FindSymbol
PR_FindSymbolAndLibrary
PR_FloorLog2
PR_FormatTime
PR_FormatTimeUSEnglish
PR_Free
PR_FreeAddrInfo
PR_FreeFileDesc
PR_FreeLibraryName
PR_GMTParameters
PR_GetAddrInfoByName
PR_GetCanonNameFromAddrInfo
PR_GetConnectStatus
PR_GetCounter
PR_GetCounterHandleFromName
PR_GetCounterNameFromHandle
PR_GetCurrentThread
PR_GetDefaultIOMethods
PR_GetDescType
PR_GetDirectorySeparator
PR_GetDirectorySepartor
PR_GetEnv
PR_GetError
PR_GetErrorText
PR_GetErrorTextLength
PR_GetFileInfo
PR_GetFileInfo64
PR_GetFileMethods
PR_GetGCRegisters
PR_GetHostByAddr
PR_GetHostByName
PR_GetIPNodeByName
PR_GetIdentitiesLayer
PR_GetInheritedFD
PR_GetInheritedFileMap
PR_GetLayersIdentity
PR_GetLibraryFilePathname
PR_GetLibraryName
PR_GetLibraryPath
PR_GetMemMapAlignment
PR_GetMonitorEntryCount
PR_GetNameForIdentity
PR_GetNumberOfProcessors
PR_GetOSError
PR_GetOpenFileInfo
PR_GetOpenFileInfo64
PR_GetPageShift
PR_GetPageSize
PR_GetPathSeparator
PR_GetPeerName
PR_GetPhysicalMemorySize
PR_GetPipeMethods
PR_GetProtoByName
PR_GetProtoByNumber
PR_GetRandomNoise
PR_GetSP
PR_GetSockName
PR_GetSocketOption
PR_GetSpecialFD
PR_GetStackSpaceLeft
PR_GetSysfdTableMax
PR_GetSystemInfo
PR_GetTCPMethods
PR_GetThreadAffinityMask
PR_GetThreadID
PR_GetThreadPriority
PR_GetThreadPrivate
PR_GetThreadScope
PR_GetThreadState
PR_GetThreadType
PR_GetTraceEntries
PR_GetTraceHandleFromName
PR_GetTraceNameFromHandle
PR_GetTraceOption
PR_GetUDPMethods
PR_GetUniqueIdentity
PR_ImplodeTime
PR_ImportFile
PR_ImportFileMapFromString
PR_ImportPipe
PR_ImportTCPSocket
PR_ImportUDPSocket
PR_IncrementCounter
PR_Init
PR_Initialize
PR_InitializeNetAddr
PR_Initialized
PR_Interrupt
PR_IntervalNow
PR_IntervalToMicroseconds
PR_IntervalToMilliseconds
PR_IntervalToSeconds
PR_IsNetAddrType
PR_JoinJob
PR_JoinThread
PR_JoinThreadPool
PR_KillProcess
PR_Listen
PR_LoadLibrary
PR_LoadLibraryWithFlags
PR_LoadStaticLibrary
PR_LocalTimeParameters
PR_Lock
PR_LockFile
PR_LockOrderedLock
PR_LogFlush
PR_LogPrint
PR_MakeDir
PR_Malloc
PR_MemMap
PR_MemUnmap
PR_MicrosecondsToInterval
PR_MillisecondsToInterval
PR_MkDir
PR_NetAddrToString
PR_NewCondVar
PR_NewLock
PR_NewLogModule
PR_NewMonitor
PR_NewNamedMonitor
PR_NewPollableEvent
PR_NewProcessAttr
PR_NewRWLock
PR_NewSem
PR_NewTCPSocket
PR_NewTCPSocketPair
PR_NewThreadPrivateIndex
PR_NewUDPSocket
PR_NormalizeTime
PR_Notify
PR_NotifyAll
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_Now
PR_Open
PR_OpenAnonFileMap
PR_OpenDir
PR_OpenFile
PR_OpenSemaphore
PR_OpenSharedMemory
PR_OpenTCPSocket
PR_OpenUDPSocket
PR_ParseTimeString
PR_ParseTimeStringToExplodedTime
PR_Poll
PR_PopIOLayer
PR_PostSem
PR_PostSemaphore
PR_ProcessAttrSetCurrentDirectory
PR_ProcessAttrSetInheritableFD
PR_ProcessAttrSetInheritableFileMap
PR_ProcessAttrSetStdioRedirect
PR_ProcessExit
PR_PushIOLayer
PR_QueueJob
PR_QueueJob_Accept
PR_QueueJob_Connect
PR_QueueJob_Read
PR_QueueJob_Timer
PR_QueueJob_Write
PR_RWLock_Rlock
PR_RWLock_Unlock
PR_RWLock_Wlock
PR_Read
PR_ReadDir
PR_Realloc
PR_RecordTraceEntries
PR_Recv
PR_RecvFrom
PR_Rename
PR_ResetAlarm
PR_ResetProcessAttr
PR_ResumeAll
PR_RmDir
PR_ScanStackPointers
PR_SecondsToInterval
PR_Seek
PR_Seek64
PR_Select
PR_Send
PR_SendFile
PR_SendTo
PR_SetAlarm
PR_SetCPUAffinityMask
PR_SetConcurrency
PR_SetCounter
PR_SetEnv
PR_SetError
PR_SetErrorText
PR_SetFDCacheSize
PR_SetFDInheritable
PR_SetLibraryPath
PR_SetLogBuffering
PR_SetLogFile
PR_SetNetAddr
PR_SetPollableEvent
PR_SetSocketOption
PR_SetStdioRedirect
PR_SetSysfdTableSize
PR_SetThreadAffinityMask
PR_SetThreadDumpProc
PR_SetThreadGCAble
PR_SetThreadPriority
PR_SetThreadPrivate
PR_SetThreadRecycleMode
PR_SetTraceOption
PR_ShowStatus
PR_Shutdown
PR_ShutdownThreadPool
PR_Sleep
PR_Socket
PR_StackPop
PR_StackPush
PR_Stat
PR_StringToNetAddr
PR_SubtractFromCounter
PR_SuspendAll
PR_Sync
PR_TLockFile
PR_TestAndEnterMonitor
PR_TestAndLock
PR_ThreadScanStackPointers
PR_TicksPerSecond
PR_Trace
PR_TransmitFile
PR_USPacificTimeParameters
PR_UnblockClockInterrupts
PR_UnblockInterrupt
PR_UnloadLibrary
PR_Unlock
PR_UnlockFile
PR_UnlockOrderedLock
PR_VersionCheck
PR_Wait
PR_WaitCondVar
PR_WaitForPollableEvent
PR_WaitProcess
PR_WaitRecvReady
PR_WaitSem
PR_WaitSemaphore
PR_Write
PR_Writev
PR_Yield
PR_cnvtf
PR_dtoa
PR_fprintf
PR_htonl
PR_htonll
PR_htons
PR_ntohl
PR_ntohll
PR_ntohs
PR_smprintf
PR_smprintf_free
PR_snprintf
PR_sprintf_append
PR_sscanf
PR_strtod
PR_sxprintf
PR_vfprintf
PR_vsmprintf
PR_vsnprintf
PR_vsprintf_append
PR_vsxprintf
PT_FPrintStats
SetExecutionEnvironment
_PR_AddSleepQ
_PR_CreateThread
_PR_DelSleepQ
_PR_GetPrimordialCPU
_PR_MD_FREE_CV
_PR_MD_NEW_CV
_PR_MD_NOTIFYALL_CV
_PR_MD_NOTIFY_CV
_PR_MD_UNLOCK
_PR_MD_WAIT_CV
_PR_NativeCreateThread
_pr_push_ipv6toipv4_layer
_pr_test_ipv6_socket
libVersionPoint

Sections

.text
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/nss3.dll
.dll windows:5 windows x86 arch:x86

325b68c91cd2e51c7407b8bf789b7706

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nssutil3

SECITEM_HashCompare
SECITEM_Hash
NSS_Get_SEC_IA5StringTemplate_Util
PORT_RegExpCaseSearch
NSS_Get_SEC_SkipTemplate
SECOID_KnownCertExtenOID
DER_GetUInteger
DER_StoreHeader
DER_LengthLength
PORT_UCS4_UTF8Conversion
PORT_ISO88591_UTF8Conversion
NSS_Get_SEC_UTF8StringTemplate_Util
NSS_Get_SEC_SetOfAnyTemplate_Util
NSS_Get_SEC_UniversalStringTemplate
NSS_Get_SEC_PrintableStringTemplate
NSS_Get_SEC_T61StringTemplate
PORT_RegExpValid
NSS_Get_SEC_BMPStringTemplate_Util
SEC_StringToOID
SECOID_FindOIDByMechanism
PORT_LoadLibraryFromOrigin
NSS_Get_SEC_ObjectIDTemplate_Util
SGN_DecodeDigestInfo
NSS_Get_SEC_BitStringTemplate_Util
NSS_GetAlgorithmPolicy
NSS_Get_SEC_SequenceOfObjectIDTemplate
NSS_Get_SEC_NullTemplate_Util
NSS_Get_SEC_OctetStringTemplate_Util
NSS_Get_SEC_PointerToAnyTemplate_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_SequenceOfAnyTemplate
NSS_Get_SEC_PointerToGeneralizedTimeTemplate
NSS_Get_SEC_PointerToEnumeratedTemplate
NSS_Get_SEC_GeneralizedTimeTemplate_Util
NSS_Get_SEC_EnumeratedTemplate
NSS_Get_SEC_IntegerTemplate_Util
DER_SetUInteger
NSS_Get_SEC_AnyTemplate_Util
NSSRWLock_HaveWriteLock_Util
NSSRWLock_UnlockWrite_Util
NSSRWLock_UnlockRead_Util
NSSRWLock_LockWrite_Util
NSSRWLock_LockRead_Util
NSSRWLock_Destroy_Util
NSSRWLock_New_Util
NSSBase64_EncodeItem_Util
NSSBase64_DecodeBuffer_Util
NSSBase64Encoder_Destroy_Util
NSSBase64Decoder_Destroy_Util
NSSBase64Encoder_Update_Util
NSSBase64Decoder_Update_Util
NSSBase64Encoder_Create_Util
NSSBase64Decoder_Create_Util
BTOA_ConvertItemToAscii_Util
ATOB_ConvertAsciiToItem_Util
ATOB_AsciiToData_Util
BTOA_DataToAscii_Util
SEC_ASN1LengthLength_Util
SEC_ASN1DecodeInteger_Util
SEC_ASN1EncodeUnsignedInteger_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1Encode_Util
SEC_ASN1EncoderClearTakeFromBuf_Util
SEC_ASN1EncoderSetTakeFromBuf_Util
SEC_ASN1EncoderClearStreaming_Util
SEC_ASN1EncoderSetStreaming_Util
SEC_ASN1EncoderClearNotifyProc_Util
SEC_ASN1EncoderSetNotifyProc_Util
SEC_ASN1EncoderAbort_Util
SEC_ASN1EncoderFinish_Util
SEC_ASN1EncoderUpdate_Util
SEC_ASN1EncoderStart_Util
SEC_QuickDERDecodeItem_Util
SEC_ASN1DecodeItem_Util
SEC_ASN1Decode_Util
SEC_ASN1DecoderClearNotifyProc_Util
SEC_ASN1DecoderSetNotifyProc_Util
SEC_ASN1DecoderClearFilterProc_Util
SEC_ASN1DecoderSetFilterProc_Util
SEC_ASN1DecoderAbort_Util
SEC_ASN1DecoderFinish_Util
SEC_ASN1DecoderUpdate_Util
SEC_ASN1DecoderStart_Util
DER_EncodeTimeChoice_Util
DER_DecodeTimeChoice_Util
CERT_GenTime2FormattedAscii_Util
DER_GeneralizedTimeToTime_Util
DER_TimeToGeneralizedTimeArena_Util
DER_TimeToGeneralizedTime_Util
DER_TimeChoiceDayToAscii_Util
DER_GeneralizedDayToAscii_Util
DER_UTCDayToAscii_Util
DER_UTCTimeToAscii_Util
DER_UTCTimeToTime_Util
DER_AsciiToTime_Util
DER_TimeToUTCTime_Util
DER_GetInteger_Util
DER_Lengths_Util
DER_Encode_Util
SGN_CompareDigestInfo_Util
SGN_CopyDigestInfo_Util
SGN_DestroyDigestInfo_Util
SGN_CreateDigestInfo_Util
SECITEM_ZfreeItem_Util
SECITEM_FreeItem_Util
SECITEM_ArenaDupItem_Util
SECITEM_DupItem_Util
SECITEM_CopyItem_Util
SECITEM_ItemsAreEqual_Util
SECITEM_CompareItem_Util
SECITEM_AllocItem_Util
SECOID_AddEntry_Util
SECOID_FindOIDTagDescription_Util
SECOID_CompareAlgorithmID_Util
SECOID_DestroyAlgorithmID_Util
SECOID_GetAlgorithmTag_Util
SECOID_CopyAlgorithmID_Util
SECOID_SetAlgorithmID_Util
SECOID_FindOIDByTag_Util
SECOID_FindOIDTag_Util
SECOID_FindOID_Util
NSS_PutEnv_Util
PORT_UCS2_ASCIIConversion_Util
PORT_UCS2_UTF8Conversion_Util
PORT_SetUCS2_UTF8ConversionFunction_Util
PORT_SetUCS2_ASCIIConversionFunction_Util
PORT_SetUCS4_UTF8ConversionFunction_Util
PORT_ArenaStrdup_Util
PORT_ArenaUnmark_Util
PORT_ArenaRelease_Util
PORT_ArenaMark_Util
PORT_ArenaGrow_Util
PORT_FreeArena_Util
PORT_ArenaZAlloc_Util
PORT_ArenaAlloc_Util
PORT_NewArena_Util
PORT_GetError_Util
PORT_ZFree_Util
PORT_Realloc_Util
SECOID_Init
SECOID_Shutdown
PORT_SetError_Util
PORT_ZAlloc_Util
PORT_Free_Util
PORT_Strdup_Util
PORT_Alloc_Util

libplc4

PL_strdup
PL_strfree
PL_strnstr
PL_strstr
PL_strcat
PL_strlen
PL_strncpyz
PL_strcatn
PL_strcasecmp
PL_strncasecmp

libplds4

PL_HashString
PL_FinishArenaPool
PL_InitArenaPool
PL_ArenaAllocate
PL_ArenaRelease
PL_HashTableEnumerateEntries
PL_HashTableDestroy
PL_CompareValues
PL_NewHashTable
PL_HashTableAdd
PL_HashTableRemove
PL_HashTableLookup
PL_CompareStrings

libnspr4

PR_htons
PR_Accept
PR_Send
PR_Shutdown
PR_Listen
PR_ConnectContinue
PR_Bind
PR_ErrorToString
PR_FindFunctionSymbol
PR_DestroyRWLock
PR_Realloc
PR_Malloc
PR_GetThreadPrivate
PR_SetThreadPrivate
PR_NewThreadPrivateIndex
PR_Free
PR_Calloc
PR_sprintf_append
PR_GetError
PR_NetAddrToString
PR_ConvertIPv4AddrToIPv6
PR_htonl
PR_SetErrorText
PR_Sleep
PR_CallOnce
PR_FindSymbol
PR_LoadLibrary
PR_UnloadLibrary
PR_IntervalToSeconds
PR_IntervalToMilliseconds
PR_IntervalToMicroseconds
PR_NewLogModule
PR_LogPrint
PR_snprintf
PR_CallOnceWithArg
PR_IntervalNow
PR_GetEnv
PR_Poll
PR_TicksPerSecond
PR_Recv
PR_Write
PR_NewTCPSocket
PR_SecondsToInterval
PR_StringToNetAddr
PR_GetHostByName
PR_EnumerateHostEnt
PR_Connect
PR_InitializeNetAddr
PR_Close
PR_DestroyMonitor
PR_NewMonitor
PR_Now
PR_EnterMonitor
PR_ExitMonitor
PR_Lock
PR_Unlock
PR_VersionCheck
PR_NewLock
PR_DestroyLock
PR_smprintf
PR_smprintf_free

msvcr90

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
printf
sprintf
qsort
tolower
strncpy
isspace
fopen
__iob_func
fprintf
fflush
fclose
strstr
strchr
atoi
memmove
strtol
strncmp
getenv
isdigit
memcpy
strrchr
memset
_mktemp

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange

Exports

Exports

ATOB_AsciiToData
ATOB_ConvertAsciiToItem
BTOA_ConvertItemToAscii
BTOA_DataToAscii
CERT_AddCertToListSorted
CERT_AddCertToListTail
CERT_AddExtension
CERT_AddOCSPAcceptableResponses
CERT_AddOKDomainName
CERT_AddRDN
CERT_AsciiToName
CERT_CRLCacheRefreshIssuer
CERT_CacheCRL
CERT_CacheOCSPResponseFromSideChannel
CERT_CertChainFromCert
CERT_CertListFromCert
CERT_CertTimesValid
CERT_ChangeCertTrust
CERT_CheckCertUsage
CERT_CheckCertValidTimes
CERT_CheckNameSpace
CERT_ClearOCSPCache
CERT_CompareCerts
CERT_CompareName
CERT_CompareValidityTimes
CERT_CompleteCRLDecodeEntries
CERT_CopyName
CERT_CopyRDN
CERT_CreateAVA
CERT_CreateCertificate
CERT_CreateCertificateRequest
CERT_CreateName
CERT_CreateOCSPCertID
CERT_CreateOCSPRequest
CERT_CreateRDN
CERT_CreateSubjectCertList
CERT_CreateValidity
CERT_DecodeAVAValue
CERT_DecodeAltNameExtension
CERT_DecodeAuthInfoAccessExtension
CERT_DecodeAuthKeyID
CERT_DecodeBasicConstraintValue
CERT_DecodeCRLDistributionPoints
CERT_DecodeCertificatePoliciesExtension
CERT_DecodeDERCrl
CERT_DecodeDERCrlWithFlags
CERT_DecodeGeneralName
CERT_DecodeNameConstraintsExtension
CERT_DecodeOCSPResponse
CERT_DecodeOidSequence
CERT_DecodePrivKeyUsagePeriodExtension
CERT_DecodeTrustString
CERT_DecodeUserNotice
CERT_DerNameToAscii
CERT_DestroyCertArray
CERT_DestroyCertList
CERT_DestroyCertificate
CERT_DestroyCertificateList
CERT_DestroyCertificatePoliciesExtension
CERT_DestroyCertificateRequest
CERT_DestroyName
CERT_DestroyOCSPCertID
CERT_DestroyOCSPRequest
CERT_DestroyOCSPResponse
CERT_DestroyOidSequence
CERT_DestroyUserNotice
CERT_DestroyValidity
CERT_DisableOCSPChecking
CERT_DisableOCSPDefaultResponder
CERT_DistNamesFromCertList
CERT_DupCertList
CERT_DupCertificate
CERT_DupDistNames
CERT_EnableOCSPChecking
CERT_EnableOCSPDefaultResponder
CERT_EncodeAltNameExtension
CERT_EncodeAndAddBitStrExtension
CERT_EncodeAuthKeyID
CERT_EncodeBasicConstraintValue
CERT_EncodeCRLDistributionPoints
CERT_EncodeCertPoliciesExtension
CERT_EncodeGeneralName
CERT_EncodeInfoAccessExtension
CERT_EncodeInhibitAnyExtension
CERT_EncodeNoticeReference
CERT_EncodeOCSPRequest
CERT_EncodePolicyConstraintsExtension
CERT_EncodePolicyMappingExtension
CERT_EncodeSubjectKeyID
CERT_EncodeUserNotice
CERT_ExtractPublicKey
CERT_FilterCertListByCANames
CERT_FilterCertListByUsage
CERT_FilterCertListForUserCerts
CERT_FindCRLEntryReasonExten
CERT_FindCRLNumberExten
CERT_FindCertByDERCert
CERT_FindCertByIssuerAndSN
CERT_FindCertByName
CERT_FindCertByNickname
CERT_FindCertByNicknameOrEmailAddr
CERT_FindCertBySubjectKeyID
CERT_FindCertExtension
CERT_FindCertIssuer
CERT_FindKeyUsageExtension
CERT_FindNameConstraintsExten
CERT_FindSMimeProfile
CERT_FindSubjectKeyIDExtension
CERT_FindUserCertByUsage
CERT_FindUserCertsByUsage
CERT_FinishCertificateRequestAttributes
CERT_FinishExtensions
CERT_FormatName
CERT_FreeDistNames
CERT_FreeNicknames
CERT_GenTime2FormattedAscii
CERT_GetAVATag
CERT_GetCertChainFromCert
CERT_GetCertEmailAddress
CERT_GetCertIssuerAndSN
CERT_GetCertNicknames
CERT_GetCertTimes
CERT_GetCertTrust
CERT_GetCertUid
CERT_GetCertificateNames
CERT_GetCertificateRequestExtensions
CERT_GetClassicOCSPDisabledPolicy
CERT_GetClassicOCSPEnabledHardFailurePolicy
CERT_GetClassicOCSPEnabledSoftFailurePolicy
CERT_GetCommonName
CERT_GetConstrainedCertificateNames
CERT_GetCountryName
CERT_GetDBContentVersion
CERT_GetDefaultCertDB
CERT_GetDomainComponentName
CERT_GetFirstEmailAddress
CERT_GetLocalityName
CERT_GetNextEmailAddress
CERT_GetNextGeneralName
CERT_GetNextNameConstraint
CERT_GetOCSPAuthorityInfoAccessLocation
CERT_GetOCSPResponseStatus
CERT_GetOCSPStatusForCertID
CERT_GetOidString
CERT_GetOrgName
CERT_GetOrgUnitName
CERT_GetPKIXVerifyNistRevocationPolicy
CERT_GetPrevGeneralName
CERT_GetPrevNameConstraint
CERT_GetSSLCACerts
CERT_GetSlopTime
CERT_GetStateName
CERT_GetUsePKIXForValidation
CERT_GetValidDNSPatternsFromCert
CERT_Hexify
CERT_ImportCAChain
CERT_ImportCAChainTrusted
CERT_ImportCRL
CERT_ImportCerts
CERT_IsCACert
CERT_IsCADERCert
CERT_IsRootDERCert
CERT_IsUserCert
CERT_KeyFromDERCrl
CERT_MakeCANickname
CERT_MergeExtensions
CERT_NameToAscii
CERT_NameToAsciiInvertible
CERT_NewCertList
CERT_NewTempCertificate
CERT_NicknameStringsFromCertList
CERT_OCSPCacheSettings
CERT_OpenCertDBFilename
CERT_PKIXVerifyCert
CERT_RFC1485_EscapeAndQuote
CERT_RegisterAlternateOCSPAIAInfoCallBack
CERT_RemoveCertListNode
CERT_SaveSMimeProfile
CERT_SetOCSPDefaultResponder
CERT_SetOCSPFailureMode
CERT_SetOCSPTimeout
CERT_SetSlopTime
CERT_SetUsePKIXForValidation
CERT_StartCRLEntryExtensions
CERT_StartCRLExtensions
CERT_StartCertExtensions
CERT_StartCertificateRequestAttributes
CERT_UncacheCRL
CERT_VerifyCACertForUsage
CERT_VerifyCert
CERT_VerifyCertName
CERT_VerifyCertNow
CERT_VerifyCertificate
CERT_VerifyCertificateNow
CERT_VerifyOCSPResponseSignature
CERT_VerifySignedData
CERT_VerifySignedDataWithPublicKey
CERT_VerifySignedDataWithPublicKeyInfo
DER_AsciiToTime
DER_DecodeTimeChoice
DER_Encode
DER_EncodeTimeChoice
DER_GeneralizedDayToAscii
DER_GeneralizedTimeToTime
DER_GetInteger
DER_Lengths
DER_TimeChoiceDayToAscii
DER_TimeToGeneralizedTime
DER_TimeToGeneralizedTimeArena
DER_TimeToUTCTime
DER_UTCDayToAscii
DER_UTCTimeToAscii
DER_UTCTimeToTime
DSAU_DecodeDerSig
DSAU_DecodeDerSigToLen
DSAU_EncodeDerSig
DSAU_EncodeDerSigWithLen
HASH_Begin
HASH_Clone
HASH_Create
HASH_Destroy
HASH_End
HASH_GetHashObject
HASH_GetHashObjectByOidTag
HASH_GetHashTypeByOidTag
HASH_GetType
HASH_HashBuf
HASH_ResultLen
HASH_ResultLenByOidTag
HASH_ResultLenContext
HASH_Update
NSSBase64Decoder_Create
NSSBase64Decoder_Destroy
NSSBase64Decoder_Update
NSSBase64Encoder_Create
NSSBase64Encoder_Destroy
NSSBase64Encoder_Update
NSSBase64_DecodeBuffer
NSSBase64_EncodeItem
NSSRWLock_Destroy
NSSRWLock_HaveWriteLock
NSSRWLock_LockRead
NSSRWLock_LockWrite
NSSRWLock_New
NSSRWLock_UnlockRead
NSSRWLock_UnlockWrite
NSS_Get_CERT_CertificateRequestTemplate
NSS_Get_CERT_CertificateTemplate
NSS_Get_CERT_CrlTemplate
NSS_Get_CERT_IssuerAndSNTemplate
NSS_Get_CERT_NameTemplate
NSS_Get_CERT_SequenceOfCertExtensionTemplate
NSS_Get_CERT_SetOfSignedCrlTemplate
NSS_Get_CERT_SignedCrlTemplate
NSS_Get_CERT_SignedDataTemplate
NSS_Get_CERT_SubjectPublicKeyInfoTemplate
NSS_Get_CERT_TimeChoiceTemplate
NSS_Get_SECKEY_DSAPublicKeyTemplate
NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToEncryptedPrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToPrivateKeyInfoTemplate
NSS_Get_SECKEY_PrivateKeyInfoTemplate
NSS_Get_SECKEY_RSAPublicKeyTemplate
NSS_Get_SECOID_AlgorithmIDTemplate
NSS_Get_SEC_AnyTemplate
NSS_Get_SEC_BMPStringTemplate
NSS_Get_SEC_BitStringTemplate
NSS_Get_SEC_BooleanTemplate
NSS_Get_SEC_GeneralizedTimeTemplate
NSS_Get_SEC_IA5StringTemplate
NSS_Get_SEC_IntegerTemplate
NSS_Get_SEC_NullTemplate
NSS_Get_SEC_ObjectIDTemplate
NSS_Get_SEC_OctetStringTemplate
NSS_Get_SEC_PointerToAnyTemplate
NSS_Get_SEC_PointerToOctetStringTemplate
NSS_Get_SEC_SetOfAnyTemplate
NSS_Get_SEC_SignedCertificateTemplate
NSS_Get_SEC_UTCTimeTemplate
NSS_Get_SEC_UTF8StringTemplate
NSS_Get_sgn_DigestInfoTemplate
NSS_Init
NSS_InitContext
NSS_InitReadWrite
NSS_InitWithMerge
NSS_Initialize
NSS_IsInitialized
NSS_NoDB_Init
NSS_PutEnv
NSS_RegisterShutdown
NSS_Shutdown
NSS_ShutdownContext
NSS_UnregisterShutdown
NSS_VersionCheck
PBE_CreateContext
PBE_DestroyContext
PBE_GenerateBits
PK11SDR_Decrypt
PK11SDR_Encrypt
PK11_AlgtagToMechanism
PK11_Authenticate
PK11_BlockData
PK11_ChangePW
PK11_CheckSSOPassword
PK11_CheckUserPassword
PK11_CipherOp
PK11_CloneContext
PK11_ConfigurePKCS11
PK11_ConvertSessionPrivKeyToTokenPrivKey
PK11_ConvertSessionSymKeyToTokenSymKey
PK11_CopySymKeyForSigning
PK11_CopyTokenPrivKeyToSessionPrivKey
PK11_CreateContextBySymKey
PK11_CreateDigestContext
PK11_CreateGenericObject
PK11_CreateMergeLog
PK11_CreatePBEAlgorithmID
PK11_CreatePBEParams
PK11_CreatePBEV2AlgorithmID
PK11_DEREncodePublicKey
PK11_DeleteTokenCertAndKey
PK11_DeleteTokenPrivateKey
PK11_DeleteTokenPublicKey
PK11_DeleteTokenSymKey
PK11_Derive
PK11_DeriveWithFlags
PK11_DeriveWithFlagsPerm
PK11_DestroyContext
PK11_DestroyGenericObject
PK11_DestroyGenericObjects
PK11_DestroyMergeLog
PK11_DestroyObject
PK11_DestroyPBEParams
PK11_DestroyTokenObject
PK11_DigestBegin
PK11_DigestFinal
PK11_DigestKey
PK11_DigestOp
PK11_DoesMechanism
PK11_ExportEncryptedPrivKeyInfo
PK11_ExportEncryptedPrivateKeyInfo
PK11_ExportPrivateKeyInfo
PK11_ExtractKeyValue
PK11_Finalize
PK11_FindBestKEAMatch
PK11_FindCertAndKeyByRecipientList
PK11_FindCertAndKeyByRecipientListNew
PK11_FindCertByIssuerAndSN
PK11_FindCertFromDERCert
PK11_FindCertFromDERCertItem
PK11_FindCertFromNickname
PK11_FindCertInSlot
PK11_FindCertsFromNickname
PK11_FindFixedKey
PK11_FindGenericObjects
PK11_FindKeyByAnyCert
PK11_FindKeyByDERCert
PK11_FindKeyByKeyID
PK11_FindPrivateKeyFromCert
PK11_FindSlotByName
PK11_FindSlotsByNames
PK11_FortezzaHasKEA
PK11_FortezzaMapSig
PK11_FreeSlot
PK11_FreeSlotList
PK11_FreeSlotListElement
PK11_FreeSymKey
PK11_GenerateFortezzaIV
PK11_GenerateKeyPair
PK11_GenerateKeyPairWithFlags
PK11_GenerateKeyPairWithOpFlags
PK11_GenerateNewParam
PK11_GenerateRandom
PK11_GenerateRandomOnSlot
PK11_GetAllSlotsForCert
PK11_GetAllTokens
PK11_GetBestKeyLength
PK11_GetBestSlot
PK11_GetBestSlotMultiple
PK11_GetBestWrapMechanism
PK11_GetBlockSize
PK11_GetCertFromPrivateKey
PK11_GetCurrentWrapIndex
PK11_GetDefaultArray
PK11_GetDefaultFlags
PK11_GetDisabledReason
PK11_GetFirstSafe
PK11_GetIVLength
PK11_GetInternalKeySlot
PK11_GetInternalSlot
PK11_GetKeyData
PK11_GetKeyGen
PK11_GetKeyLength
PK11_GetKeyStrength
PK11_GetKeyType
PK11_GetLowLevelKeyIDForCert
PK11_GetLowLevelKeyIDForPrivateKey
PK11_GetMechanism
PK11_GetMinimumPwdLength
PK11_GetModInfo
PK11_GetModule
PK11_GetModuleID
PK11_GetNextGenericObject
PK11_GetNextSafe
PK11_GetNextSymKey
PK11_GetPBECryptoMechanism
PK11_GetPBEIV
PK11_GetPQGParamsFromPrivateKey
PK11_GetPadMechanism
PK11_GetPrevGenericObject
PK11_GetPrivateKeyNickname
PK11_GetPrivateModulusLen
PK11_GetPublicKeyNickname
PK11_GetSlotFromKey
PK11_GetSlotFromPrivateKey
PK11_GetSlotID
PK11_GetSlotInfo
PK11_GetSlotName
PK11_GetSlotPWValues
PK11_GetSlotSeries
PK11_GetSymKeyHandle
PK11_GetSymKeyNickname
PK11_GetSymKeyType
PK11_GetSymKeyUserData
PK11_GetTokenInfo
PK11_GetTokenName
PK11_GetWindow
PK11_GetWrapKey
PK11_HasRootCerts
PK11_HashBuf
PK11_IVFromParam
PK11_ImportCRL
PK11_ImportCert
PK11_ImportCertForKey
PK11_ImportCertForKeyToSlot
PK11_ImportDERCert
PK11_ImportDERCertForKey
PK11_ImportDERPrivateKeyInfo
PK11_ImportDERPrivateKeyInfoAndReturnKey
PK11_ImportEncryptedPrivateKeyInfo
PK11_ImportPrivateKeyInfo
PK11_ImportPrivateKeyInfoAndReturnKey
PK11_ImportPublicKey
PK11_ImportSymKey
PK11_ImportSymKeyWithFlags
PK11_InitPin
PK11_IsDisabled
PK11_IsFIPS
PK11_IsFriendly
PK11_IsHW
PK11_IsInternal
PK11_IsInternalKeySlot
PK11_IsLoggedIn
PK11_IsPresent
PK11_IsReadOnly
PK11_IsRemovable
PK11_KeyForCertExists
PK11_KeyForDERCertExists
PK11_KeyGen
PK11_LinkGenericObject
PK11_ListCerts
PK11_ListCertsInSlot
PK11_ListFixedKeysInSlot
PK11_ListPrivKeysInSlot
PK11_ListPrivateKeysInSlot
PK11_ListPublicKeysInSlot
PK11_LoadPrivKey
PK11_Logout
PK11_LogoutAll
PK11_MakeIDFromPubKey
PK11_MakeKEAPubKey
PK11_MapPBEMechanismToCryptoMechanism
PK11_MapSignKeyType
PK11_MechanismToAlgtag
PK11_MergeTokens
PK11_MoveSymKey
PK11_NeedLogin
PK11_NeedPWInit
PK11_NeedUserInit
PK11_PBEKeyGen
PK11_PQG_DestroyParams
PK11_PQG_DestroyVerify
PK11_PQG_GetBaseFromParams
PK11_PQG_GetCounterFromVerify
PK11_PQG_GetHFromVerify
PK11_PQG_GetPrimeFromParams
PK11_PQG_GetSeedFromVerify
PK11_PQG_GetSubPrimeFromParams
PK11_PQG_NewParams
PK11_PQG_NewVerify
PK11_PQG_ParamGen
PK11_PQG_ParamGenSeedLen
PK11_PQG_VerifyParams
PK11_ParamFromAlgid
PK11_ParamFromIV
PK11_ParamToAlgid
PK11_PrivDecryptPKCS1
PK11_ProtectedAuthenticationPath
PK11_PubDecryptRaw
PK11_PubDerive

Sections

.text
Size: 629KB - Virtual size: 629KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/nssckbi.dll
.dll windows:5 windows x86 arch:x86

c5503482ef8b9ca430a42f7593d706b3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libplc4

PL_strlen

libplds4

PL_ArenaAllocate
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableRemove
PL_HashTableAdd
PL_HashTableDestroy
PL_CompareValues
PL_NewHashTable
PL_FinishArenaPool
PL_InitArenaPool

libnspr4

PR_CallOnce
PR_GetThreadPrivate
PR_SetThreadPrivate
PR_NewThreadPrivateIndex
PR_Free
PR_Calloc
PR_Unlock
PR_Lock
PR_DestroyLock
PR_NewLock

msvcr90

_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_adjust_fdiv
_amsg_exit
memcpy
memset
memmove
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange

Exports

Exports

C_GetFunctionList

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 240KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/nssdbm3.dll
.dll windows:5 windows x86 arch:x86

3ee47eced1cde33db6a3dc7585fc5c4e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libplc4

PL_strcasecmp
PL_strncasecmp

libplds4

PL_HashTableDestroy
PL_HashTableRemove
PL_HashTableLookup
PL_HashTableAdd
PL_HashTableEnumerateEntries
PL_NewHashTable

libnspr4

PR_CallOnce
PR_FindFunctionSymbol
PR_GetLibraryFilePathname
PR_GetDirectorySeparator
PR_LoadLibraryWithFlags
PR_NewMonitor
PR_DestroyMonitor
PR_ExitMonitor
PR_EnterMonitor
PR_Now
PR_LoadLibrary
PR_FindSymbol
PR_GetEnv
PR_UnloadLibrary
PR_SetError
PR_Free
PR_htonl
PR_ntohl
PR_DestroyLock
PR_Lock
PR_Unlock
PR_NewLock
PR_CreateFileMap
PR_MemMap
PR_Read
PR_MemUnmap
PR_CloseFileMap
PR_Access
PR_MkDir
PR_OpenFile
PR_GetError
PR_Write
PR_Close
PR_Delete
PR_smprintf_free
PR_smprintf

nssutil3

NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
DER_DecodeTimeChoice_Util
SECITEM_AllocItem_Util
SECOID_Init
SECITEM_HashCompare
PORT_Realloc_Util
DER_SetUInteger
PORT_Strdup_Util
SECOID_FindOIDTag_Util
SECITEM_FreeItem_Util
SECOID_FindOIDByTag_Util
PORT_ArenaAlloc_Util
PORT_GetError_Util
SECITEM_ZfreeItem_Util
NSS_Get_SEC_AnyTemplate_Util
SEC_QuickDERDecodeItem_Util
SECOID_GetAlgorithmTag_Util
SECITEM_ItemsAreEqual_Util
SECITEM_CopyItem_Util
SECITEM_DupItem_Util
SEC_ASN1EncodeItem_Util
SECOID_SetAlgorithmID_Util
PORT_SetError_Util
PORT_NewArena_Util
PORT_ArenaZAlloc_Util
PORT_FreeArena_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
PORT_ZAlloc_Util
PORT_Alloc_Util
PORT_Free_Util
NSSBase64_EncodeItem_Util
PORT_ArenaRelease_Util
PORT_ArenaUnmark_Util
PORT_ArenaMark_Util
PORT_ArenaStrdup_Util
SECITEM_CompareItem_Util
SEC_ASN1EncodeInteger_Util
SECOID_Shutdown

msvcr90

tolower
strncmp
memcpy
free
memmove
malloc
calloc
abort
getenv
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
memset
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
isspace
atoi
isdigit
strncpy
strrchr
_lseek
_write
_getpid
_unlink
_close
_read
_open
_strdup
_errno
_stat64i32
_initterm
_get_osfhandle

kernel32

GetCurrentProcessId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
FlushFileBuffers
GetCurrentProcess

Exports

Exports

legacy_AddSecmodDB
legacy_DeleteSecmodDB
legacy_Open
legacy_ReadSecmodDB
legacy_ReleaseSecmodDBData
legacy_SetCryptFunctions
legacy_Shutdown

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/nssutil3.dll
.dll windows:5 windows x86 arch:x86

8185d98bb77aeac629df9a7bb74862d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libplc4

PL_strncasecmp
PL_strcasecmp
PL_strpbrk
PL_strlen

libplds4

PL_FreeArenaPool
PL_FinishArenaPool
PL_ArenaAllocate
PL_HashTableDestroy
PL_ClearArenaPool
PL_HashTableLookup
PL_CompareValues
PL_NewHashTable
PL_HashTableAdd
PL_ArenaGrow
PL_ArenaRelease
PL_InitArenaPool
PL_HashTableLookupConst

libnspr4

PR_GetError
PR_LocalTimeParameters
PR_FormatTime
PR_GetEnv
PR_GetLibraryFilePathname
PR_GetDirectorySeparator
PR_LoadLibraryWithFlags
PR_NewLock
PR_NewCondVar
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_GetCurrentThread
PR_Lock
PR_WaitCondVar
PR_Unlock
PR_DestroyCondVar
PR_DestroyLock
PR_Free
PR_Realloc
PR_Malloc
PR_SetError
PR_Calloc
PR_ImplodeTime
PR_GMTParameters
PR_ExplodeTime

msvcr90

memcpy
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
strstr
strrchr
strchr
isalnum
isalpha
toupper
memset
tolower
isdigit
_putenv

kernel32

IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
SetEnvironmentVariableA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange

Exports

Exports

ATOB_AsciiToData_Util
ATOB_ConvertAsciiToItem_Util
BTOA_ConvertItemToAscii_Util
BTOA_DataToAscii_Util
CERT_GenTime2FormattedAscii_Util
DER_AsciiToTime_Util
DER_DecodeTimeChoice_Util
DER_EncodeTimeChoice_Util
DER_Encode_Util
DER_GeneralizedDayToAscii_Util
DER_GeneralizedTimeToTime_Util
DER_GetInteger_Util
DER_GetUInteger
DER_LengthLength
DER_Lengths_Util
DER_SetUInteger
DER_StoreHeader
DER_TimeChoiceDayToAscii_Util
DER_TimeToGeneralizedTimeArena_Util
DER_TimeToGeneralizedTime_Util
DER_TimeToUTCTime_Util
DER_UTCDayToAscii_Util
DER_UTCTimeToAscii_Util
DER_UTCTimeToTime_Util
NSSBase64Decoder_Create_Util
NSSBase64Decoder_Destroy_Util
NSSBase64Decoder_Update_Util
NSSBase64Encoder_Create_Util
NSSBase64Encoder_Destroy_Util
NSSBase64Encoder_Update_Util
NSSBase64_DecodeBuffer_Util
NSSBase64_EncodeItem_Util
NSSRWLock_Destroy_Util
NSSRWLock_HaveWriteLock_Util
NSSRWLock_LockRead_Util
NSSRWLock_LockWrite_Util
NSSRWLock_New_Util
NSSRWLock_UnlockRead_Util
NSSRWLock_UnlockWrite_Util
NSS_GetAlgorithmPolicy
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_BMPStringTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_BooleanTemplate_Util
NSS_Get_SEC_EnumeratedTemplate
NSS_Get_SEC_GeneralizedTimeTemplate_Util
NSS_Get_SEC_IA5StringTemplate_Util
NSS_Get_SEC_IntegerTemplate_Util
NSS_Get_SEC_NullTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
NSS_Get_SEC_OctetStringTemplate_Util
NSS_Get_SEC_PointerToAnyTemplate_Util
NSS_Get_SEC_PointerToEnumeratedTemplate
NSS_Get_SEC_PointerToGeneralizedTimeTemplate
NSS_Get_SEC_PointerToOctetStringTemplate_Util
NSS_Get_SEC_PrintableStringTemplate
NSS_Get_SEC_SequenceOfAnyTemplate
NSS_Get_SEC_SequenceOfObjectIDTemplate
NSS_Get_SEC_SetOfAnyTemplate_Util
NSS_Get_SEC_SkipTemplate
NSS_Get_SEC_T61StringTemplate
NSS_Get_SEC_UTF8StringTemplate_Util
NSS_Get_SEC_UniversalStringTemplate
NSS_Get_sgn_DigestInfoTemplate_Util
NSS_PutEnv_Util
NSS_SecureMemcmp
NSS_SetAlgorithmPolicy
PORT_Alloc_Util
PORT_ArenaAlloc_Util
PORT_ArenaGrow_Util
PORT_ArenaMark_Util
PORT_ArenaRelease_Util
PORT_ArenaStrdup_Util
PORT_ArenaUnmark_Util
PORT_ArenaZAlloc_Util
PORT_FreeArena_Util
PORT_Free_Util
PORT_GetError_Util
PORT_ISO88591_UTF8Conversion
PORT_LoadLibraryFromOrigin
PORT_NewArena_Util
PORT_Realloc_Util
PORT_RegExpCaseSearch
PORT_RegExpSearch
PORT_RegExpValid
PORT_SetError_Util
PORT_SetUCS2_ASCIIConversionFunction_Util
PORT_SetUCS2_UTF8ConversionFunction_Util
PORT_SetUCS4_UTF8ConversionFunction_Util
PORT_Strdup_Util
PORT_UCS2_ASCIIConversion_Util
PORT_UCS2_UTF8Conversion_Util
PORT_UCS4_UTF8Conversion
PORT_ZAlloc_Util
PORT_ZFree_Util
SECITEM_AllocItem_Util
SECITEM_ArenaDupItem_Util
SECITEM_CompareItem_Util
SECITEM_CopyItem_Util
SECITEM_DupItem_Util
SECITEM_FreeItem_Util
SECITEM_Hash
SECITEM_HashCompare
SECITEM_ItemsAreEqual_Util
SECITEM_ReallocItem
SECITEM_ZfreeItem_Util
SECOID_AddEntry_Util
SECOID_CompareAlgorithmID_Util
SECOID_CopyAlgorithmID_Util
SECOID_DestroyAlgorithmID_Util
SECOID_FindOIDByMechanism
SECOID_FindOIDByTag_Util
SECOID_FindOIDTagDescription_Util
SECOID_FindOIDTag_Util
SECOID_FindOID_Util
SECOID_GetAlgorithmTag_Util
SECOID_Init
SECOID_KnownCertExtenOID
SECOID_SetAlgorithmID_Util
SECOID_Shutdown
SEC_ASN1DecodeInteger_Util
SEC_ASN1DecodeItem_Util
SEC_ASN1Decode_Util
SEC_ASN1DecoderAbort_Util
SEC_ASN1DecoderClearFilterProc_Util
SEC_ASN1DecoderClearNotifyProc_Util
SEC_ASN1DecoderFinish_Util
SEC_ASN1DecoderSetFilterProc_Util
SEC_ASN1DecoderSetNotifyProc_Util
SEC_ASN1DecoderStart_Util
SEC_ASN1DecoderUpdate_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1EncodeUnsignedInteger_Util
SEC_ASN1Encode_Util
SEC_ASN1EncoderAbort_Util
SEC_ASN1EncoderClearNotifyProc_Util
SEC_ASN1EncoderClearStreaming_Util
SEC_ASN1EncoderClearTakeFromBuf_Util
SEC_ASN1EncoderFinish_Util
SEC_ASN1EncoderSetNotifyProc_Util
SEC_ASN1EncoderSetStreaming_Util
SEC_ASN1EncoderSetTakeFromBuf_Util
SEC_ASN1EncoderStart_Util
SEC_ASN1EncoderUpdate_Util
SEC_ASN1LengthLength_Util
SEC_QuickDERDecodeItem_Util
SEC_StringToOID
SGN_CompareDigestInfo_Util
SGN_CopyDigestInfo_Util
SGN_CreateDigestInfo_Util
SGN_DecodeDigestInfo
SGN_DestroyDigestInfo_Util
UTIL_SetForkState

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/plc4.dll
.dll windows:5 windows x86 arch:x86

ed34896d023ebecd1611eecfb70c835f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nspr4

PR_SetError
PR_Calloc
PR_GetSpecialFD
PR_GetError
PR_GetOSError
PR_ErrorToName
PR_fprintf
PR_Free
PR_Malloc

msvcr90

strrchr
strpbrk
strstr
_encode_pointer
_malloc_crt
strchr
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
strncmp
free
memcpy
malloc
_encoded_null

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
QueryPerformanceCounter

Exports

Exports

PL_Base64Decode
PL_Base64Encode
PL_CreateLongOptState
PL_CreateOptState
PL_DestroyOptState
PL_FPrintError
PL_GetNextOpt
PL_PrintError
PL_strcasecmp
PL_strcaserstr
PL_strcasestr
PL_strcat
PL_strcatn
PL_strchr
PL_strcmp
PL_strcpy
PL_strdup
PL_strfree
PL_strlen
PL_strncasecmp
PL_strncaserstr
PL_strncasestr
PL_strncat
PL_strnchr
PL_strncmp
PL_strncpy
PL_strncpyz
PL_strndup
PL_strnlen
PL_strnpbrk
PL_strnprbrk
PL_strnrchr
PL_strnrstr
PL_strnstr
PL_strpbrk
PL_strprbrk
PL_strrchr
PL_strrstr
PL_strstr
PL_strtok_r
libVersionPoint

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 538B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/plds4.dll
.dll windows:5 windows x86 arch:x86

911c0f542103f8dffb47c759e9d17331

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nspr4

PR_DestroyLock
PR_Free
PR_Malloc
PR_CeilingLog2
PR_Unlock
PR_CallOnce
PR_Lock
PR_NewLock

msvcr90

_decode_pointer
_initterm
_encoded_null
_amsg_exit
_adjust_fdiv
__CppXcptFilter
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
free
_malloc_crt
_encode_pointer
memset
memcpy
_initterm_e

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTickCount

Exports

Exports

PL_ArenaAllocate
PL_ArenaFinish
PL_ArenaGrow
PL_ArenaRelease
PL_CompactArenaPool
PL_CompareStrings
PL_CompareValues
PL_FinishArenaPool
PL_FreeArenaPool
PL_HashString
PL_HashTableAdd
PL_HashTableDestroy
PL_HashTableDump
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableLookupConst
PL_HashTableRawAdd
PL_HashTableRawLookup
PL_HashTableRawLookupConst
PL_HashTableRawRemove
PL_HashTableRemove
PL_InitArenaPool
PL_NewHashTable
libVersionPoint

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 514B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/rsa2048ca.cer
Plugins/CARoot/smime3.dll
.dll windows:5 windows x86 arch:x86

bee940391959a04bbe282d4c5f2a4e9a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nss3

SECKEY_CopyPublicKey
CERT_GetCertIssuerAndSN
CERT_DupCertificate
SECKEY_CreateSubjectPublicKeyInfo
SECKEY_DestroySubjectPublicKeyInfo
CERT_FindSubjectKeyIDExtension
PK11_FindPrivateKeyFromCert
SECKEY_CopyPrivateKey
CERT_DestroyCertificateList
CERT_VerifyCert
CERT_FindCertByDERCert
CERT_CertChainFromCert
CERT_DestroyCertList
CERT_DestroyCertArray
CERT_FilterCertListByUsage
CERT_AddCertToListTail
CERT_NewCertList
CERT_ImportCerts
CERT_FindCertByIssuerAndSN
CERT_FindCertBySubjectKeyID
CERT_GetCommonName
PK11_FortezzaHasKEA
CERT_SaveSMimeProfile
CERT_GetDefaultCertDB
CERT_CertListFromCert
SGN_Digest
SEC_SignData
SEC_GetSignatureAlgorithmOidTag
PK11_FortezzaMapSig
VFY_VerifyDigestDirect
VFY_VerifyDataDirect
HASH_GetHashObjectByOidTag
CERT_FindSMimeProfile
NSS_VersionCheck
NSS_Get_SECKEY_PrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToEncryptedPrivateKeyInfoTemplate
PK11_GenerateRandom
PK11_HashBuf
PK11_MakeKEAPubKey
PK11_DigestOp
PK11_DigestBegin
SEC_PKCS5GetKeyLength
SEC_PKCS5GetCryptoAlgorithm
NSS_Get_SECKEY_PointerToPrivateKeyInfoTemplate
PK11_GetInternalSlot
PK11_ReferenceSlot
PK11_PBEKeyGen
PK11_GetInternalKeySlot
PK11_IsInternal
SECKEY_DestroyEncryptedPrivateKeyInfo
SECKEY_CopyEncryptedPrivateKeyInfo
PK11_ExportEncryptedPrivateKeyInfo
SECKEY_DestroyPrivateKeyInfo
SECKEY_CopyPrivateKeyInfo
PK11_ExportPrivateKeyInfo
PK11_DestroyPBEParams
PK11_CreatePBEParams
PK11_SetSymKeyUserData
PK11_GetTokenName
PK11_TraverseCertsForSubjectInSlot
__CERT_DecodeDERCertificate
PK11_TraverseCertsForNicknameInSlot
PK11_FindKeyByDERCert
PK11_ImportDERCert
PK11_ImportCertForKeyToSlot
CERT_NewTempCertificate
CERT_IsRootDERCert
CERT_IsCADERCert
PK11_ImportPublicKey
PK11_ImportPrivateKeyInfo
PK11_ImportEncryptedPrivateKeyInfo
PK11_FindCertAndKeyByRecipientList
HASH_ResultLen
HASH_GetHashTypeByOidTag
PK11_UnwrapSymKey
CERT_ExtractPublicKey
NSS_Get_CERT_SetOfSignedCrlTemplate
PK11_FindBestKEAMatch
CERT_DestroyCertificate
SECKEY_DestroyPublicKey
PK11_FindKeyByAnyCert
PK11_PubDerive
SECKEY_DestroyPrivateKey
PK11_WrapSymKey
PK11_GetKeyLength
PK11_PubUnwrapSymKey
SECKEY_GetPublicKeyType
SECKEY_PublicKeyStrength
PK11_PubWrapSymKey
PK11_SetPasswordFunc
PK11_FindCertAndKeyByRecipientListNew
PK11_GetBestSlot
PK11_KeyGen
SEC_PKCS5IsAlgorithmPBEAlgTag
PK11_CreatePBEAlgorithmID
PK11_GenerateNewParam
PK11_ParamToAlgid
SEC_PKCS5IsAlgorithmPBEAlg
PK11_GetSymKeyUserData
PK11_GetPBECryptoMechanism
PK11_AlgtagToMechanism
PK11_ParamFromAlgid
PK11_GetBlockSize
PK11_GetSlotFromKey
PK11_IsHW
PK11_FreeSlot
PK11_CreateContextBySymKey
PK11_CipherOp
PK11_DestroyContext
PK11_FreeSymKey
PK11_ReferenceSymKey
PK11_GetKeyStrength
NSS_Get_CERT_TimeChoiceTemplate
NSS_Get_CERT_IssuerAndSNTemplate
PK11_DigestFinal

nssutil3

SEC_ASN1EncoderFinish_Util
SEC_ASN1EncoderClearStreaming_Util
SEC_ASN1EncoderClearTakeFromBuf_Util
SEC_ASN1EncoderSetNotifyProc_Util
SEC_ASN1EncoderSetStreaming_Util
SEC_ASN1EncoderStart_Util
SEC_ASN1EncoderSetTakeFromBuf_Util
SEC_ASN1EncoderClearNotifyProc_Util
NSS_Get_SEC_IntegerTemplate_Util
SEC_ASN1DecodeItem_Util
SEC_QuickDERDecodeItem_Util
SEC_ASN1DecodeInteger_Util
DER_DecodeTimeChoice_Util
PORT_Strdup_Util
DER_EncodeTimeChoice_Util
SECOID_CompareAlgorithmID_Util
SECITEM_ItemsAreEqual_Util
SECOID_FindOIDTag_Util
NSS_Get_sgn_DigestInfoTemplate_Util
SECITEM_ZfreeItem_Util
SGN_CreateDigestInfo_Util
PORT_UCS2_ASCIIConversion_Util
SGN_DestroyDigestInfo_Util
SECITEM_CompareItem_Util
PORT_Realloc_Util
PORT_UCS2_UTF8Conversion_Util
SGN_CopyDigestInfo_Util
DER_GetInteger_Util
NSS_Get_SEC_BMPStringTemplate_Util
PORT_ArenaStrdup_Util
SEC_ASN1DecoderClearNotifyProc_Util
PORT_ZFree_Util
SECITEM_DupItem_Util
ATOB_ConvertAsciiToItem_Util
ATOB_AsciiToData_Util
SEC_ASN1DecoderAbort_Util
SEC_ASN1EncoderAbort_Util
SEC_ASN1Encode_Util
SEC_ASN1EncoderUpdate_Util
SECOID_DestroyAlgorithmID_Util
PORT_NewArena_Util
PORT_FreeArena_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1DecoderSetFilterProc_Util
SEC_ASN1DecoderClearFilterProc_Util
SEC_ASN1DecoderStart_Util
SEC_ASN1DecoderSetNotifyProc_Util
SEC_ASN1DecoderUpdate_Util
SEC_ASN1DecoderFinish_Util
PORT_GetError_Util
PORT_Alloc_Util
SECITEM_FreeItem_Util
PORT_ZAlloc_Util
PORT_Free_Util
SECOID_CopyAlgorithmID_Util
SECOID_SetAlgorithmID_Util
SECOID_GetAlgorithmTag_Util
SECITEM_AllocItem_Util
SEC_ASN1EncodeItem_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_IA5StringTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
SECOID_FindOID_Util
PORT_SetError_Util
PORT_ArenaMark_Util
SECOID_FindOIDByTag_Util
SECITEM_CopyItem_Util
SECITEM_ArenaDupItem_Util
PORT_ArenaRelease_Util
PORT_ArenaUnmark_Util
NSS_Get_SEC_PointerToAnyTemplate_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_OctetStringTemplate_Util
NSS_Get_SEC_PointerToOctetStringTemplate_Util
NSS_Get_SEC_SetOfAnyTemplate_Util
PORT_ArenaGrow_Util
PORT_ArenaZAlloc_Util
PORT_ArenaAlloc_Util

libplc4

PL_strncasecmp

libnspr4

PR_Now

msvcr90

_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_initterm_e
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
memmove
strchr
memset
memcpy
__clean_type_info_names_internal

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

Exports

Exports

CERT_ConvertAndDecodeCertificate
CERT_DecodeCertFromPackage
CERT_DecodeCertPackage
NSSSMIME_VersionCheck
NSS_CMSContentInfo_GetBulkKey
NSS_CMSContentInfo_GetBulkKeySize
NSS_CMSContentInfo_GetContent
NSS_CMSContentInfo_GetContentEncAlgTag
NSS_CMSContentInfo_GetContentTypeTag
NSS_CMSContentInfo_SetBulkKey
NSS_CMSContentInfo_SetContent
NSS_CMSContentInfo_SetContentEncAlg
NSS_CMSContentInfo_SetContent_Data
NSS_CMSContentInfo_SetContent_DigestedData
NSS_CMSContentInfo_SetContent_EncryptedData
NSS_CMSContentInfo_SetContent_EnvelopedData
NSS_CMSContentInfo_SetContent_SignedData
NSS_CMSDEREncode
NSS_CMSDecoder_Cancel
NSS_CMSDecoder_Finish
NSS_CMSDecoder_Start
NSS_CMSDecoder_Update
NSS_CMSDigestContext_Cancel
NSS_CMSDigestContext_FinishMultiple
NSS_CMSDigestContext_FinishSingle
NSS_CMSDigestContext_StartMultiple
NSS_CMSDigestContext_StartSingle
NSS_CMSDigestContext_Update
NSS_CMSDigestedData_Create
NSS_CMSDigestedData_Destroy
NSS_CMSDigestedData_GetContentInfo
NSS_CMSEncoder_Cancel
NSS_CMSEncoder_Finish
NSS_CMSEncoder_Start
NSS_CMSEncoder_Update
NSS_CMSEncryptedData_Create
NSS_CMSEncryptedData_Destroy
NSS_CMSEncryptedData_GetContentInfo
NSS_CMSEnvelopedData_AddRecipient
NSS_CMSEnvelopedData_Create
NSS_CMSEnvelopedData_Destroy
NSS_CMSEnvelopedData_GetContentInfo
NSS_CMSMessage_ContentLevel
NSS_CMSMessage_ContentLevelCount
NSS_CMSMessage_Copy
NSS_CMSMessage_Create
NSS_CMSMessage_CreateFromDER
NSS_CMSMessage_Destroy
NSS_CMSMessage_GetContent
NSS_CMSMessage_GetContentInfo
NSS_CMSMessage_IsEncrypted
NSS_CMSMessage_IsSigned
NSS_CMSRecipientInfo_Create
NSS_CMSRecipientInfo_CreateFromDER
NSS_CMSRecipientInfo_CreateNew
NSS_CMSRecipientInfo_CreateWithSubjKeyID
NSS_CMSRecipientInfo_CreateWithSubjKeyIDFromCert
NSS_CMSRecipientInfo_Destroy
NSS_CMSRecipientInfo_Encode
NSS_CMSRecipientInfo_GetCertAndKey
NSS_CMSRecipientInfo_UnwrapBulkKey
NSS_CMSRecipientInfo_WrapBulkKey
NSS_CMSSignedData_AddCertChain
NSS_CMSSignedData_AddCertList
NSS_CMSSignedData_AddCertificate
NSS_CMSSignedData_AddDigest
NSS_CMSSignedData_AddSignerInfo
NSS_CMSSignedData_Create
NSS_CMSSignedData_CreateCertsOnly
NSS_CMSSignedData_Destroy
NSS_CMSSignedData_GetContentInfo
NSS_CMSSignedData_GetDigestAlgs
NSS_CMSSignedData_GetSignerInfo
NSS_CMSSignedData_HasDigests
NSS_CMSSignedData_ImportCerts
NSS_CMSSignedData_SetDigestValue
NSS_CMSSignedData_SetDigests
NSS_CMSSignedData_SignerInfoCount
NSS_CMSSignedData_VerifyCertsOnly
NSS_CMSSignedData_VerifySignerInfo
NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSMIMECaps
NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSigningTime
NSS_CMSSignerInfo_Create
NSS_CMSSignerInfo_CreateWithSubjKeyID
NSS_CMSSignerInfo_Destroy
NSS_CMSSignerInfo_GetCertList
NSS_CMSSignerInfo_GetSignerCommonName
NSS_CMSSignerInfo_GetSignerEmailAddress
NSS_CMSSignerInfo_GetSigningCertificate
NSS_CMSSignerInfo_GetSigningTime
NSS_CMSSignerInfo_GetVerificationStatus
NSS_CMSSignerInfo_GetVersion
NSS_CMSSignerInfo_IncludeCerts
NSS_CMSUtil_VerificationStatusToString
NSS_SMIMESignerInfo_SaveSMIMEProfile
NSS_SMIMEUtil_FindBulkAlgForRecipients
SECMIME_DecryptionAllowed
SEC_PKCS12AddCertAndKey
SEC_PKCS12AddCertOrChainAndKey
SEC_PKCS12AddPasswordIntegrity
SEC_PKCS12CreateExportContext
SEC_PKCS12CreatePasswordPrivSafe
SEC_PKCS12CreateUnencryptedSafe
SEC_PKCS12DecoderFinish
SEC_PKCS12DecoderGetCerts
SEC_PKCS12DecoderImportBags
SEC_PKCS12DecoderIterateInit
SEC_PKCS12DecoderIterateNext
SEC_PKCS12DecoderSetTargetTokenCAs
SEC_PKCS12DecoderStart
SEC_PKCS12DecoderUpdate
SEC_PKCS12DecoderValidateBags
SEC_PKCS12DecoderVerify
SEC_PKCS12DecryptionAllowed
SEC_PKCS12DestroyExportContext
SEC_PKCS12EnableCipher
SEC_PKCS12Encode
SEC_PKCS12IsEncryptionAllowed
SEC_PKCS12SetPreferredCipher
SEC_PKCS7AddCertificate
SEC_PKCS7AddRecipient
SEC_PKCS7AddSigningTime
SEC_PKCS7ContainsCertsOrCrls
SEC_PKCS7ContentIsEncrypted
SEC_PKCS7ContentIsSigned
SEC_PKCS7ContentType
SEC_PKCS7CopyContentInfo
SEC_PKCS7CreateCertsOnly
SEC_PKCS7CreateData
SEC_PKCS7CreateEncryptedData
SEC_PKCS7CreateEnvelopedData
SEC_PKCS7CreateSignedData
SEC_PKCS7DecodeItem
SEC_PKCS7DecoderAbort
SEC_PKCS7DecoderFinish
SEC_PKCS7DecoderStart
SEC_PKCS7DecoderUpdate
SEC_PKCS7DecryptContents
SEC_PKCS7DestroyContentInfo
SEC_PKCS7Encode
SEC_PKCS7EncodeItem
SEC_PKCS7EncoderAbort
SEC_PKCS7EncoderFinish
SEC_PKCS7EncoderStart
SEC_PKCS7EncoderUpdate
SEC_PKCS7GetCertificateList
SEC_PKCS7GetContent
SEC_PKCS7GetEncryptionAlgorithm
SEC_PKCS7GetSignerCommonName
SEC_PKCS7GetSignerEmailAddress
SEC_PKCS7GetSigningTime
SEC_PKCS7IncludeCertChain
SEC_PKCS7IsContentEmpty
SEC_PKCS7SetContent
SEC_PKCS7VerifyDetachedSignature
SEC_PKCS7VerifySignature

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/softokn3.dll
.dll .ps1 windows:5 windows x86 arch:x86 polyglot

3c7e3bcaece3a242721e345b7dfe12ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

sqlite3

sqlite3_bind_text
sqlite3_bind_int
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_step
sqlite3_column_int
sqlite3_prepare_v2
sqlite3_bind_blob
sqlite3_reset
sqlite3_finalize
sqlite3_open
sqlite3_busy_timeout
sqlite3_close
sqlite3_free
sqlite3_mprintf
sqlite3_exec

nssutil3

SECITEM_CompareItem_Util
PORT_Strdup_Util
SECOID_FindOIDByMechanism
SEC_QuickDERDecodeItem_Util
SGN_DecodeDigestInfo
SGN_CreateDigestInfo_Util
DER_Encode_Util
SGN_DestroyDigestInfo_Util
PORT_GetError_Util
UTIL_SetForkState
SECOID_Shutdown
SECOID_Init
SECITEM_HashCompare
DER_SetUInteger
PORT_ArenaAlloc_Util
PORT_ArenaGrow_Util
PORT_Realloc_Util
SECOID_GetAlgorithmTag_Util
SEC_ASN1DecodeItem_Util
DER_GetInteger_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SECOID_SetAlgorithmID_Util
SECOID_CopyAlgorithmID_Util
SECOID_DestroyAlgorithmID_Util
SECITEM_DupItem_Util
SECITEM_AllocItem_Util
PORT_ZFree_Util
SECITEM_ZfreeItem_Util
PORT_ZAlloc_Util
SECITEM_FreeItem_Util
PORT_NewArena_Util
PORT_ArenaZAlloc_Util
SECITEM_CopyItem_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
PORT_SetError_Util
PORT_Alloc_Util
PORT_Free_Util
PORT_FreeArena_Util

libplc4

PL_strcasecmp
PL_strncasecmp

libplds4

PL_HashTableDestroy
PL_HashTableRemove
PL_NewHashTable
PL_HashTableAdd
PL_HashTableLookupConst
PL_HashTableEnumerateEntries
PL_CompareValues
PL_HashTableLookup

libnspr4

PR_CallOnce
PR_SetError
PR_Free
PR_Delete
PR_Rename
PR_smprintf
PR_NewMonitor
PR_DestroyMonitor
PR_Now
PR_EnterMonitor
PR_GetCurrentThread
PR_ExitMonitor
PR_snprintf
PR_GetEnv
PR_LoadLibraryWithFlags
PR_GetDirectorySeparator
PR_GetLibraryFilePathname
PR_Unlock
PR_Lock
PR_UnloadLibrary
PR_FindFunctionSymbol
PR_AtomicDecrement
PR_DestroyLock
PR_smprintf_free
PR_Sleep
PR_AtomicIncrement
PR_NewLock
PR_SecondsToInterval
PR_Access
PR_IntervalNow
PR_MillisecondsToInterval

msvcr90

_close
_fdopen
_open
_strdup
_chmod
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
strncpy
isspace
strstr
strchr
fprintf
fopen
fclose
fgets
strncmp
fwrite
fputs
strncat
malloc
free
sprintf
memcpy
strrchr
atoi
isdigit
islower
isupper
memset

kernel32

QueryPerformanceCounter
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
InterlockedExchange
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter

Exports

Exports

C_GetFunctionList
FC_GetFunctionList
NSC_GetFunctionList
NSC_ModuleDBFunc

Sections

.text
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/sqlite3.dll
.dll windows:5 windows x86 arch:x86

903a9ed01f660affdd1454447faccc91

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr90

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
memmove
strncmp
atoi
memcpy
memset
realloc
free
malloc
_localtime64_s

kernel32

SetFilePointer
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedExchange
CreateFileW
CreateFileA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetFullPathNameW
GetFullPathNameA
FormatMessageW
FormatMessageA
LocalFree
GetTempPathW
GetTempPathA
LockFileEx
GetSystemTimeAsFileTime
GetSystemTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
FreeLibrary
Sleep
InitializeCriticalSection
InterlockedCompareExchange
DeleteCriticalSection
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
AreFileApisANSI
CloseHandle
ReadFile
GetLastError
WriteFile
SetEndOfFile
FlushFileBuffers
GetFileSize
UnlockFile
LockFile
GetFileAttributesA
DeleteFileA
GetFileAttributesW
DeleteFileW
LoadLibraryA
LoadLibraryW
GetProcAddress

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_complete
sqlite3_complete16
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_module
sqlite3_data_count
sqlite3_db_handle
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_exec
sqlite3_expired
sqlite3_extended_result_codes
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_load_extension
sqlite3_malloc
sqlite3_mprintf
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_realloc
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_rollback_hook
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_sleep
sqlite3_snprintf
sqlite3_step
sqlite3_thread_cleanup
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vmprintf

Sections

.text
Size: 344KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CARoot/ssl3.dll
.dll windows:5 windows x86 arch:x86

4e98c9f942a3754c37d443bc06f85e72

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nss3

CERT_DupCertList
SECKEY_CacheStaticFlags
PK11_MapSignKeyType
PK11_CopyTokenPrivKeyToSessionPrivKey
PK11_ReferenceSlot
CERT_DistNamesFromCertList
CERT_DupDistNames
CERT_DestroyCertificate
CERT_FreeNicknames
CERT_CheckCertValidTimes
CERT_GetCertNicknames
PK11_FindKeyByAnyCert
CERT_FindUserCertByUsage
CERT_FindCertByName
PK11_VerifyKeyOK
PK11_ReferenceSymKey
PK11_GetBestKeyLength
PK11_SaveContextAlloc
PK11_DigestKey
PK11_RestoreContext
PK11_CreateDigestContext
PK11_Derive
CERT_GetSSLCACerts
PK11_GetSlotFromKey
PK11_SymKeyFromHandle
SECMOD_LookupSlot
PK11_IsPresent
PK11_GetSlotSeries
PK11_GetSlotID
PK11_GetModuleID
PK11_NeedLogin
PK11_IsLoggedIn
PK11_DigestBegin
PK11_DigestOp
PK11_DigestFinal
PK11_CreateContextBySymKey
PK11_IVFromParam
PK11_CipherOp
PK11_ParamFromIV
PK11_DestroyContext
PK11_HashBuf
DSAU_DecodeDerSig
PK11_Verify
PK11_SignatureLen
PK11_Sign
DSAU_EncodeDerSigWithLen
PK11_Finalize
CERT_FreeDistNames
NSS_RegisterShutdown
NSS_VersionCheck
VFY_CreateContext
VFY_Begin
VFY_Update
VFY_End
VFY_DestroyContext
SGN_NewContext
SGN_Begin
SGN_Update
SGN_End
SGN_DestroyContext
PK11_PubEncryptRaw
PK11_PubDecryptRaw
PK11_GetBestSlot
__PK11_CreateContextByRawKey
HASH_GetHashObject
CERT_VerifyCertName
CERT_NameToAscii
SECKEY_CopyPrivateKey
CERT_NewTempCertificate
SECKEY_UpdateCertPQG
CERT_VerifyCertNow
PK11_UnwrapSymKeyWithFlags
PK11_ImportSymKey
SECKEY_PublicKeyStrengthInBits
SECKEY_CreateDHPrivateKey
PK11_PubDerive
CERT_DupCertificate
CERT_CertChainFromCert
PK11_GetSlotFromPrivateKey
PK11_GetInternalSlot
PK11_GetKeyData
CERT_DestroyCertificateList
SECKEY_CreateRSAPrivateKey
SECKEY_DestroyPrivateKey
PK11_GetCurrentWrapIndex
PK11_GetWrapKey
PK11_GetBestWrapMechanism
PK11_SetWrapKey
PK11_GetMechanism
PK11_FreeSymKey
PK11_WrapSymKey
PK11_GenerateRandom
PK11_TokenExists
CERT_ExtractPublicKey
SECKEY_GetPrivateKeyType
PK11_GetPrivateModulusLen
PK11_GetBestSlotMultiple
PK11_KeyGen
PK11_FreeSlot
SECKEY_PublicKeyStrength
PK11_PubWrapSymKey
PK11_PrivDecryptPKCS1
PK11_PubUnwrapSymKey
SECKEY_DestroyPublicKey
PK11_DeriveWithFlags
PK11_ExtractKeyValue
CERT_GetDefaultCertDB

nssutil3

SECITEM_DupItem_Util
DER_Lengths_Util
NSSRWLock_New_Util
NSSRWLock_Destroy_Util
ATOB_AsciiToData_Util
BTOA_DataToAscii_Util
NSS_PutEnv_Util
SECITEM_Hash
SECOID_GetAlgorithmTag_Util
PORT_Realloc_Util
SECITEM_AllocItem_Util
SECITEM_ZfreeItem_Util
NSS_SecureMemcmp
PORT_ArenaAlloc_Util
PORT_NewArena_Util
PORT_ArenaZAlloc_Util
PORT_GetError_Util
PORT_FreeArena_Util
PORT_ZAlloc_Util
SECITEM_CopyItem_Util
PORT_Strdup_Util
SECITEM_CompareItem_Util
NSSRWLock_LockRead_Util
NSSRWLock_UnlockRead_Util
NSSRWLock_LockWrite_Util
NSSRWLock_UnlockWrite_Util
PORT_Free_Util
PORT_Alloc_Util
SECITEM_FreeItem_Util
PORT_SetError_Util
PORT_ZFree_Util

libplc4

PL_strdup

libnspr4

PR_FindFunctionSymbol
PR_UnloadLibrary
PR_GetLibraryFilePathname
PR_Free
PR_GetDirectorySeparator
PR_LoadLibraryWithFlags
PR_Now
PR_Close
PR_NewMonitor
PR_CreateIOLayerStub
PR_PushIOLayer
PR_GetUniqueIdentity
PR_GetDefaultIOMethods
PR_GetSocketOption
PR_ConvertIPv4AddrToIPv6
PR_SetError
PR_DestroyMonitor
PR_GetIdentitiesLayer
PR_EmulateAcceptRead
PR_EmulateSendFile
PR_ImportFileMapFromString
PR_ExportFileMapAsString
PR_smprintf
PR_OpenAnonFileMap
PR_smprintf_free
PR_MemMap
PR_MemUnmap
PR_CloseFileMap
PR_StringToNetAddr
PR_CallOnce
PR_CallOnceWithArg
PR_PopIOLayer
PR_GetCurrentThread
PR_ExitMonitor
PR_Sleep
PR_EnterMonitor
PR_GetError
PR_NewLock
PR_Lock
PR_Unlock
PR_DestroyLock
PR_GetEnv

msvcr90

_crt_debugger_hook
__clean_type_info_names_internal
__CppXcptFilter
__dllonexit
_lock
_onexit
_except_handler4_common
_adjust_fdiv
_amsg_exit
_initterm_e
memcpy
memmove
memset
_getpid
strstr
_time64
strchr
getenv
strrchr
malloc
free
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_unlock
_initterm

kernel32

GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentThreadId
WaitForSingleObject
ReleaseMutex
CloseHandle
CreateMutexA
GetLastError
GetSystemTimeAsFileTime

Exports

Exports

NSSSSL_VersionCheck
NSS_CmpCertChainWCANames
NSS_FindCertKEAType
NSS_GetClientAuthData
NSS_SetDomesticPolicy
NSS_SetExportPolicy
NSS_SetFrancePolicy
SSL_AuthCertificate
SSL_AuthCertificateHook
SSL_BadCertHook
SSL_CanBypass
SSL_CertDBHandleSet
SSL_CipherPolicyGet
SSL_CipherPolicySet
SSL_CipherPrefGet
SSL_CipherPrefGetDefault
SSL_CipherPrefSet
SSL_CipherPrefSetDefault
SSL_ClearSessionCache
SSL_ConfigMPServerSIDCache
SSL_ConfigSecureServer
SSL_ConfigServerSessionIDCache
SSL_ConfigServerSessionIDCacheWithOpt
SSL_DataPending
SSL_ForceHandshake
SSL_ForceHandshakeWithTimeout
SSL_GetChannelInfo
SSL_GetCipherSuiteInfo
SSL_GetClientAuthDataHook
SSL_GetImplementedCiphers
SSL_GetMaxServerCacheLocks
SSL_GetNegotiatedHostInfo
SSL_GetNumImplementedCiphers
SSL_GetSessionID
SSL_GetStatistics
SSL_HandshakeCallback
SSL_HandshakeNegotiatedExtension
SSL_ImplementedCiphers
SSL_ImportFD
SSL_InheritMPServerSIDCache
SSL_InvalidateSession
SSL_LocalCertificate
SSL_NumImplementedCiphers
SSL_OptionGet
SSL_OptionGetDefault
SSL_OptionSet
SSL_OptionSetDefault
SSL_PeerCertificate
SSL_PreencryptedFileToStream
SSL_PreencryptedStreamToFile
SSL_ReHandshake
SSL_ReHandshakeWithTimeout
SSL_ReconfigFD
SSL_ResetHandshake
SSL_RestartHandshakeAfterCertReq
SSL_RestartHandshakeAfterServerCert
SSL_RevealCert
SSL_RevealPinArg
SSL_RevealURL
SSL_SNISocketConfigHook
SSL_SecurityStatus
SSL_SetMaxServerCacheLocks
SSL_SetPKCS11PinArg
SSL_SetSockPeerID
SSL_SetTrustAnchors
SSL_SetURL
SSL_ShutdownServerSessionIDCache

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
log/$SYSDIR/FindDLL.dll
.dll windows:4 windows x86 arch:x86

22a80766aab97d5b80bc30aaad66029f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Documents and Settings\IBM\桌面\FindDLL\release\FindDLL.pdb

Imports

psapi

GetModuleBaseNameA
EnumProcesses
EnumProcessModules

shlwapi

StrStrIA

kernel32

GetModuleFileNameA
HeapSize
OpenProcess
CloseHandle
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetLastError
ExitProcess
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
WriteFile
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind

Exports

Exports

FindModules

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

4c:f8:0a:29:62:f1:de:b7:8a:5a:88:89:67:37:f8:92Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

1f:4c:43:c6:70:0e:4c:81:c9:44:2b:63:01:18:c7:57Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9eCertificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

19:b5:f1:4c:c2:7a:6d:af:54:33:93:a5:0d:15:ba:27:e2:91:a0:a0:2b:d7:7b:fb:e5:fd:b4:fa:9d:6e:91:e7Signer

a8:48:78:2f:fd:72:65:26:c7:53:eb:19:00:62:e4:a7:20:1e:23:74Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 112KB

.rsrc Size: 11KB - Virtual size: 10KB

099c0646ea7282d232219f8807883be0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

8f:53:aa:de:d5:c0:5d:a1:db:ac:7e:46:c0:53:85:bb:45:6b:82:80:9f:78:9f:a0:0b:56:2b:a4:86:bd:fd:b8Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

4c:f8:0a:29:62:f1:de:b7:8a:5a:88:89:67:37:f8:92
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

1f:4c:43:c6:70:0e:4c:81:c9:44:2b:63:01:18:c7:57
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

19:b5:f1:4c:c2:7a:6d:af:54:33:93:a5:0d:15:ba:27:e2:91:a0:a0:2b:d7:7b:fb:e5:fd:b4:fa:9d:6e:91:e7
Signer

a8:48:78:2f:fd:72:65:26:c7:53:eb:19:00:62:e4:a7:20:1e:23:74
Signer

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 112KB

.rsrc
Size: 11KB - Virtual size: 10KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

8f:53:aa:de:d5:c0:5d:a1:db:ac:7e:46:c0:53:85:bb:45:6b:82:80:9f:78:9f:a0:0b:56:2b:a4:86:bd:fd:b8
Signer

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 52KB

.rsrc
Size: 14KB - Virtual size: 13KB

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 728B

.reloc
Size: 1024B - Virtual size: 560B

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 1024B - Virtual size: 741B

.rdata
Size: 1024B - Virtual size: 673B

.data
Size: 512B - Virtual size: 88B

.reloc
Size: 512B - Virtual size: 190B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

70:53:18:ce:1f:ad:ce:ac:d3:0d:87:06:05:25:e1:51
Certificate