458d25b5662ad35f431318e1afe86efa_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

458d25b5662ad35f431318e1afe86efa_JaffaCakes118
Size

25.6MB
MD5

458d25b5662ad35f431318e1afe86efa
SHA1

7b987094737097f8fa7d200676c966f7c57346ee
SHA256

77da4a9d6a2839ff9f22b417bb6e151cda938468b1e8a6e6b5096f0e20e35b44
SHA512

968eeb76797f5502cefac7fde2413ea3cbdf6869a7e247c84fa5911e2100f2adaa58527eaa0b634652a6de50fa0eb723c7a478ce7ed3364e61b09bc4b0376bcd
SSDEEP

786432:cmZcbp+3OIxbcsGnQRgFDNlolJFoijf/tHKB6BUxiq94CV:cmZcbsbxbcsaFJNKlcE/tH7UxSC

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/Cloud Security/BsrScan/symsrv.dll

Files

458d25b5662ad35f431318e1afe86efa_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:5c:48:51:64:ef:cb:70:c6:ac:eb:22:3f:00:cc:c1:a9:e3:a4:df
Signer

Actual PE Digest

4b:5c:48:51:64:ef:cb:70:c6:ac:eb:22:3f:00:cc:c1:a9:e3:a4:df

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/BHips.dll
.dll windows:5 windows x86 arch:x86

37f7fa6427379a6253a091175f81dc84

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d2:32:fd:06:b7:6a:a3:4a:be:27:1b:f5:b0:f7:50:65:a4:76:a1:24
Signer

Actual PE Digest

d2:32:fd:06:b7:6a:a3:4a:be:27:1b:f5:b0:f7:50:65:a4:76:a1:24

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

t:\i18nBavDefense\defense\output\pdb\BHips.pdb

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

fltlib

FilterConnectCommunicationPort
FilterSendMessage

kernel32

GetCurrentProcess
Sleep
MultiByteToWideChar
QueryDosDeviceW
GetWindowsDirectoryW
CreateFileA
GetFileSize
MapViewOfFile
UnmapViewOfFile
OpenProcess
WideCharToMultiByte
CopyFileW
GetExitCodeProcess
TerminateProcess
ReadFile
CreateFileW
Process32FirstW
CreateFileMappingW
DeviceIoControl
GetSystemInfo
GetModuleFileNameA
Process32NextW
WTSGetActiveConsoleSessionId
CreateToolhelp32Snapshot
LocalFree
CreateProcessW
SetEvent
HeapDestroy
HeapCreate
GetFileAttributesW
lstrlenW
GetStartupInfoW
CreateEventW
WaitForMultipleObjects
DeleteFileW
SetFileAttributesW
SetEndOfFile
GetTickCount
WriteFile
GlobalAlloc
GlobalFree
GetLocalTime
OpenThread
GetVersionExW
CloseHandle
GetCurrentProcessId
DisconnectNamedPipe
WriteFileEx
CreateNamedPipeW
ConnectNamedPipe
ReadFileEx
GetOverlappedResult
GetModuleHandleExW
WaitNamedPipeW
InterlockedDecrement
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SwitchToThread
VirtualAlloc
VirtualFree
CreateEventA
CreateSemaphoreA
InitializeCriticalSection
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
RaiseException
IsValidCodePage
GetOEMCP
IsValidLocale
EnumSystemLocalesA
GetACP
GetCPInfo
GetStdHandle
ExitProcess
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
ResumeThread
ExitThread
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapReAlloc
LCMapStringW
LCMapStringA
SetHandleCount
GetFileType
LockResource
CreateSemaphoreW
GetProcAddress
InterlockedExchange
GetPrivateProfileIntW
WritePrivateProfileStringW
ReleaseSemaphore
SizeofResource
TerminateThread
LoadLibraryW
IsBadReadPtr
GetProcessHeap
GetModuleHandleW
WaitForSingleObject
HeapFree
HeapAlloc
LoadResource
FreeLibrary
FindResourceW
FindResourceExW
CreateMutexW
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
GetLastError
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
SetNamedPipeHandleState
CreateThread
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetUserDefaultLCID
GetStringTypeW
SetFilePointer
FreeEnvironmentStringsA
InterlockedExchangeAdd
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleA
GetStringTypeA
GetLocaleInfoA
GetLocaleInfoW
LoadLibraryA

wtsapi32

WTSEnumerateSessionsW
WTSQueryUserToken
WTSFreeMemory

psapi

GetProcessImageFileNameW
GetModuleBaseNameW
GetModuleFileNameExW

user32

GetMessageW
DispatchMessageW
KillTimer
PeekMessageW
MsgWaitForMultipleObjectsEx
SetWindowLongW
CreateWindowExW
RegisterClassW
GetClassInfoW
PostMessageW
DefWindowProcW
PostQuitMessage
SendMessageW
SendMessageTimeoutW
GetWindowLongW
IsWindow
GetWindowThreadProcessId
FindWindowExW
SetTimer
DestroyWindow
TranslateMessage

advapi32

AdjustTokenPrivileges
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
RegSetValueExW
QueryServiceStatus
StartServiceW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
CreateServiceW
GetSecurityDescriptorDacl
RegQueryValueExW
FreeSid
RevertToSelf
SetEntriesInAclW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorOwner
RegOpenCurrentUser
AllocateAndInitializeSid
GetNamedSecurityInfoW
ImpersonateLoggedOnUser
LookupPrivilegeValueW
SetNamedSecurityInfoW
OpenProcessToken
RegCloseKey
RegOpenKeyExW

shell32

SHGetFolderPathW
ord165
CommandLineToArgvW

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance

oleaut32

SysFreeString

shlwapi

PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
StrRChrW

ntdll

RtlUnwind

Exports

Exports

BHips_AddProtectFilePath
BHips_AddProtectProcessDirPath
BHips_AddProtectProcessId
BHips_AddProtectProcessPath
BHips_AddProtectRegPath
BHips_Cleanup
BHips_DrvInst
BHips_DrvUninst
BHips_RegisterCallback
BHips_SetProtectOpt
BHips_Startup
BHips_StartupEx
CreateObject
_BHips_GetIEProtectPath@8

Sections

.text
Size: 478KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Communication.dll
.dll windows:5 windows x86 arch:x86

3497585ce6db5df6a70ba374e8670819

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:9c:fa:bb:b4:a7:01:c3:71:c8:32:35:e3:9c:5d:c5:0a:c6:0c:3f
Signer

Actual PE Digest

5e:9c:fa:bb:b4:a7:01:c3:71:c8:32:35:e3:9c:5d:c5:0a:c6:0c:3f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Communication.pdb

Imports

kernel32

FindResourceW
FindResourceExW
InterlockedIncrement
InterlockedDecrement
CloseHandle
CreateThread
SetEvent
WaitForSingleObject
GetModuleHandleW
GetModuleFileNameW
CreateFileW
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
GetTickCount
Sleep
WaitForMultipleObjects
CreateEventW
SetFilePointer
WriteFile
CreateToolhelp32Snapshot
Process32FirstW
SizeofResource
Process32NextW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
InterlockedCompareExchange
TerminateThread
ResetEvent
SwitchToThread
WideCharToMultiByte
GetLastError
GetProcessHeap
HeapFree
GetFileSize
ReadFile
SetLastError
HeapAlloc
LockResource
LoadResource
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
InterlockedExchange
GlobalFree
OpenProcess
GlobalAlloc
SetEndOfFile
InitializeCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
GetDriveTypeA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
GetTimeZoneInformation
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetModuleHandleA
GetStringTypeW
GetStringTypeA
LCMapStringA
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
GetCommandLineA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
RaiseException
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetFullPathNameW
GetCurrentDirectoryA
HeapSize
ExitProcess
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

advapi32

RevertToSelf
RegOpenCurrentUser
ImpersonateLoggedOnUser
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCloseKey
RegQueryValueExA

shell32

ord165
SHGetFolderPathW

ole32

CoCreateGuid

log

WriteLog

shlwapi

PathRemoveFileSpecW
PathAddBackslashW
PathIsDirectoryW
PathFileExistsW
PathFindExtensionW
PathAppendW

winhttp

WinHttpSetOption
WinHttpCloseHandle
WinHttpConnect
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpSetCredentials
WinHttpOpen
WinHttpOpenRequest

Exports

Exports

CreateObject
_DllMain@12

Sections

.text
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/DataReport.dll
.dll windows:5 windows x86 arch:x86

5de1f52184fd63af9a883aeced58adad

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

af:ca:3b:16:40:2b:98:2f:3f:d1:4f:7e:18:91:d4:21:92:73:10:e3
Signer

Actual PE Digest

af:ca:3b:16:40:2b:98:2f:3f:d1:4f:7e:18:91:d4:21:92:73:10:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\DataReport.pdb

Imports

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z
?GetInstance@CAPCDispatcher@@SAPAV1@XZ

kernel32

GetCurrentProcess
HeapFree
GetProcessHeap
OpenProcess
GetVersionExW
VerifyVersionInfoW
GetLastError
MoveFileW
GetLocalTime
Process32FirstW
ProcessIdToSessionId
Process32NextW
CreateToolhelp32Snapshot
GetCurrentThreadId
GetCurrentProcessId
CreateMutexW
CreateFileA
GlobalAlloc
WideCharToMultiByte
GlobalFree
DeviceIoControl
CreateProcessW
InitializeCriticalSectionAndSpinCount
Sleep
LeaveCriticalSection
OpenMutexW
EnterCriticalSection
DeleteCriticalSection
WriteFile
WaitForSingleObject
SetEvent
GetModuleHandleW
ResetEvent
CreateEventW
VirtualFree
VirtualAlloc
SetFilePointer
FlushFileBuffers
GetConsoleCP
VerSetConditionMask
CreateDirectoryW
HeapAlloc
GetPrivateProfileSectionW
DeleteFileW
CloseHandle
LockResource
GetPrivateProfileIntW
GetTempPathW
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
GetModuleFileNameW
ReadFile
SizeofResource
CopyFileW
GetPrivateProfileStringW
LoadResource
FindResourceW
FindResourceExW
GetFileSize
GetTempFileNameW
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
WritePrivateProfileStringW
GetPrivateProfileSectionNamesW
InitializeCriticalSection
GetEnvironmentStrings
GetConsoleMode
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
ExitProcess
HeapReAlloc
HeapDestroy
HeapCreate
LCMapStringW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InterlockedExchange
LCMapStringA
RaiseException
GetModuleFileNameA
GetStdHandle
SetLastError
TlsFree
TlsSetValue
LoadLibraryA
RtlUnwind
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsAlloc

user32

CallWindowProcW
GetMessageW
SetTimer
KillTimer
GetWindowLongW
SetWindowLongW
SendMessageTimeoutW
IsWindow
CreateWindowExW
PostMessageW
DispatchMessageW

advapi32

AdjustTokenPrivileges
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegCloseKey
RevertToSelf
RegEnumValueW
RegOpenCurrentUser
ImpersonateLoggedOnUser
LookupPrivilegeValueW
RegQueryInfoKeyW
RegSetValueExW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExW
GetUserNameW
OpenProcessToken
RegEnumKeyExW

shell32

SHGetFolderPathW
ord165
SHGetSpecialFolderPathW
SHFileOperationW

ole32

CoInitialize
CoUninitialize
CoCreateGuid

shlwapi

PathRenameExtensionW
PathFindExtensionW
SHDeleteValueW
PathRemoveExtensionW
PathAppendW
PathFileExistsW
PathAddBackslashW
PathRemoveFileSpecW
PathIsDirectoryW
SHSetValueW
SHGetValueW
PathFindFileNameW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wtsapi32

WTSEnumerateSessionsW
WTSQueryUserToken
WTSFreeMemory

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

psapi

GetModuleBaseNameW

winhttp

WinHttpConnect
WinHttpWriteData
WinHttpSendRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpOpen
WinHttpOpenRequest
WinHttpSetCredentials
WinHttpAddRequestHeaders
WinHttpReceiveResponse

Exports

Exports

RD_ReportValueEx
RD_SS
RD_SW
RD_W
RD_WS
RD_WW
ReportNow
Start
Stop
UploadAllNowAsync
UploadAllNowSync
UploadAllNowSyncRetry
UploadFile

Sections

.text
Size: 314KB - Virtual size: 314KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallCheck.dll
.dll windows:5 windows x86 arch:x86

e14a5d609009c08180e782ff86941f8c

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c7:9f:a6:a3:f1:c7:07:a6:ab:7c:70:72:7d:4a:42:ac:de:f9:7d:48
Signer

Actual PE Digest

c7:9f:a6:a3:f1:c7:07:a6:ab:7c:70:72:7d:4a:42:ac:de:f9:7d:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\InstallCheck.pdb

Imports

kernel32

GetModuleHandleW
LoadLibraryW
GetProcAddress
GetSystemInfo
GetVersionExW
GetCommandLineW
LocalFree
HeapSize
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetLastError
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind

user32

MessageBoxW

shell32

CommandLineToArgvW

Exports

Exports

CheckArgv
CheckSystem

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallUtility.dll
.dll windows:5 windows x86 arch:x86

889cc30b80162ad7afe793023e7ba129

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:48:7e:05:d5:53:a2:c0:f1:db:6d:94:87:82:d0:ce:a1:8a:18:8b
Signer

Actual PE Digest

14:48:7e:05:d5:53:a2:c0:f1:db:6d:94:87:82:d0:ce:a1:8a:18:8b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\InstallUtility.pdb

Imports

iphlpapi

GetAdaptersAddresses

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

psapi

GetProcessImageFileNameW
EnumProcessModules
GetModuleFileNameExW
GetModuleBaseNameW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

log

WriteLog

kernel32

CreateMutexW
TerminateProcess
ReleaseMutex
Sleep
CreateFileA
GlobalAlloc
WideCharToMultiByte
GlobalFree
DeviceIoControl
GetTickCount
WriteFile
GetVersionExW
GetLocalTime
GetWindowsDirectoryW
FindClose
LocalFree
QueryDosDeviceW
GetCurrentProcess
FindFirstFileW
FindNextFileW
GetTimeZoneInformation
GetPrivateProfileSectionW
GetCurrentThreadId
GetFileSize
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
WinExec
lstrlenW
InterlockedIncrement
InterlockedDecrement
LocalAlloc
GetTempFileNameW
IsBadReadPtr
HeapAlloc
GetProcessHeap
HeapFree
SetDllDirectoryW
CreateDirectoryW
WritePrivateProfileStringW
GetSystemDirectoryW
GetFullPathNameW
GetUserDefaultLangID
GetPrivateProfileSectionNamesW
GetSystemTime
CreateFileMappingW
Module32FirstW
Module32NextW
GetFileTime
FileTimeToSystemTime
GetLogicalDriveStringsW
RemoveDirectoryW
OpenEventW
SetEvent
GetCurrentDirectoryW
SetCurrentDirectoryW
ProcessIdToSessionId
GetVersion
SetFilePointer
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
CreateEventW
InitializeCriticalSectionAndSpinCount
OpenMutexW
FlushFileBuffers
MoveFileW
InterlockedExchangeAdd
InterlockedExchange
OpenThread
DisconnectNamedPipe
WriteFileEx
CreateNamedPipeW
ConnectNamedPipe
ReadFileEx
GetOverlappedResult
GetModuleHandleExW
CreateThread
WaitNamedPipeW
SetNamedPipeHandleState
InterlockedCompareExchange
TerminateThread
SwitchToThread
GetVersionExA
SetLastError
PeekNamedPipe
GetStdHandle
lstrlenA
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetModuleHandleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetFullPathNameA
SetStdHandle
QueryPerformanceCounter
GetCommandLineW
GetTempPathW
MultiByteToWideChar
MoveFileExW
CopyFileW
GetPrivateProfileIntW
CreateProcessW
OutputDebugStringW
GetCurrentProcessId
GetPrivateProfileStringW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
VerifyVersionInfoW
VerSetConditionMask
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleFileNameW
VirtualFree
GetSystemInfo
FreeLibrary
ReadFile
VirtualAlloc
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleW
DeleteFileW
GetProcAddress
LoadLibraryW
CreateFileW
CloseHandle
GetLastError
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
HeapSize
GetModuleFileNameA
ExitProcess
HeapDestroy
HeapCreate
RaiseException
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentDirectoryA
GetConsoleMode
LoadLibraryA
GetFileType
WaitForMultipleObjects
FormatMessageA
FileTimeToLocalFileTime
GetDriveTypeW
GetSystemTimeAsFileTime
UnhandledExceptionFilter
GetConsoleCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
FindFirstFileA
GetDriveTypeA
GetFileInformationByHandle
HeapReAlloc
ResumeThread
GetCommandLineA
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
SleepEx

user32

SetWindowPos
SetForegroundWindow
PostMessageW
AttachThreadInput
DestroyWindow
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
RegisterClassW
GetClassInfoW
DefWindowProcW
PostQuitMessage
FindWindowExW
SetTimer
wsprintfW
GetMessageW
KillTimer
GetWindowLongW
SetWindowLongW
SendMessageTimeoutW
IsWindow
CreateWindowExW
CallWindowProcW
DispatchMessageW
SendMessageW
GetForegroundWindow
GetWindowThreadProcessId
ShowWindow

advapi32

RevertToSelf
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
RegCloseKey
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA
RegQueryInfoKeyW
OpenProcessToken
DeleteService
ControlService
QueryServiceConfigW
ChangeServiceConfig2W
CreateServiceW
RegDeleteKeyW
RegEnumValueW
EnumServicesStatusW
RegCreateKeyExW
RegQueryValueW
RegOpenKeyW
RegOpenCurrentUser
RegEnumKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
StartServiceW
RegEnumKeyW
OpenServiceW
GetUserNameW
OpenSCManagerW
CloseServiceHandle
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
ImpersonateLoggedOnUser

shell32

SHGetSpecialFolderPathW
ShellExecuteW
CommandLineToArgvW
SHFileOperationW
ShellExecuteExW
ord165
SHGetFolderPathW

ole32

CoCreateInstance
CoUninitialize
CoCreateGuid
CoInitializeSecurity
CoInitialize

oleaut32

VarBstrCmp
SysAllocStringLen
VariantInit
SysStringLen
SysAllocStringByteLen
SysFreeString
VariantClear
SysAllocString

shlwapi

PathAppendW
PathIsDirectoryW
PathRemoveBackslashW
SHGetValueW
SHSetValueW
PathAddBackslashW
PathIsRelativeW
PathUnquoteSpacesW
PathIsUNCW
PathIsRootW
PathRemoveExtensionW
PathFindExtensionW
SHCopyKeyW
SHDeleteValueW
PathRemoveFileSpecW
PathFileExistsW
PathRenameExtensionW
PathFindFileNameW
StrStrIW

wldap32

ord33
ord30
ord60
ord26
ord41
ord79
ord143
ord50
ord22
ord35
ord32
ord200
ord46
ord211
ord27
ord301

ws2_32

WSACleanup
WSAStartup
gethostname
getsockopt
closesocket
WSASetLastError
socket
getaddrinfo
freeaddrinfo
ioctlsocket
listen
accept
recvfrom
bind
recv
setsockopt
getsockname
ntohs
htons
WSAGetLastError
connect
WSAIoctl
getpeername
send
__WSAFDIsSet
select
sendto

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

winhttp

WinHttpSetCredentials
WinHttpReceiveResponse
WinHttpSetOption
WinHttpSendRequest
WinHttpWriteData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpOpenRequest
WinHttpCreateUrl
WinHttpAddRequestHeaders

Exports

Exports

AddWaitExe
CheckArgv
CheckAutoParam
CheckInstallPath
CheckPathEverInstalled
CleanPreviousDataRemains
CleanRegRemains
ClearInstallDir
CloseAllComponentSubProcess
CompareVersion
ConvertOld2NewChannel
CreateUserProcess
DelayPromotion
DeleteEveryUserFile
DeleteHistoryDir
DeleteRunRegKey
DeleteSubRegKey
DeleteSvc
EnablePlugin
Exec
GetAVInstallDir
GetAllAndroidStoreInstalledVersion
GetAllAppStoreInstalledVersion
GetAndConvOldInstallChannel
GetAndSaveClientAddrInfo
GetAndroidStoreNextInstalledVersion
GetAppStoreNextInstalledVersion
GetAppStoreVersionCloseToCurrentInstall
GetArgv
GetChannelName
GetChannelStatisticUrl
GetCommonDocumentsDir
GetCurrentLangID
GetFR
GetFileCreatedTime
GetFileVersion
GetFormatPath
GetFullVersion
GetInstallCostedTime
GetInstallDir
GetInstalledVersion
GetInstalledVersionBySvc
GetLPDirect
GetModule
GetNewFeatures
GetNextInstalledVersion
GetNextNewerVersion
GetParentProcessInfo
GetRebootCommandLine
GetSelectLangID
GetString
GetTimeStr
GetTrackCode
GetUniqueUserID
GetUrl
GetUrlDefault
GetUseTime
GetVersionCloseToCurrentInstall
GetVersionValue
Init
InitAndroidStoreInstalledVersion
InitAppStoreInstalledVersion
InitInstalledVersion
InitReportData
Install
InstallDuplicateRecordTask
InstallRecallTask
InstallSvc
IsEnableReport
IsEverInstalled
IsIBDChannel
IsNewUpdate
IsNewerVersionInstalled
IsOfficialChannel
IsRepeatedPromotion
IsSamePath
IsUpdate
IsWin64
KillExe
KillExe2
KillInstall
KillProc
KillRundll32
Log
ModifyLink
MyLockFile
MyUnlockFile
NotifyAppStoreUIExit
NotifyUIExit
OpenBrowser
OpenURL
OpenURLWithRun
PostErrorInfo
PostUpdate
PreUpdate
ReleaseMemory
RemoveInstallDir
RemoveOutOfDateReportTask
RemoveWifiDrv
ReplaceString
ReportIncCount
ReportValue
ReportValueEx
RevertDelayPromotion
RunSetupW
SaveDirIniFile
SendReportData
SetTaskDescription
SetTopWindow
SetUpdateFileMapping
StartInstall
StartProtectDrv
StopProtectDrv
StopProtectSvc
StopSvc
TimeStr2Num
TransferRegData
TransferRegData2
UTF8Base64Encode
UUReport
UninstallProtectDrv
UnloadHook
UnregisterSecurityCenter
UpdateBugReportConfig
UpdateString
WaitAllExe
WaitExe
WriteAnsiFile
WriteFR
_OpenUrlW
_SendReportDataW
co_ebocy
regsvr64

Sections

.text
Size: 823KB - Virtual size: 823KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LogReporter.exe
.exe windows:5 windows x86 arch:x86

e346f319aee147d32246b4b31d5e61b5

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:82:81:ab:d1:a6:89:79:66:17:61:23:bb:2e:75:4e:b9:d1:9a:9c
Signer

Actual PE Digest

27:82:81:ab:d1:a6:89:79:66:17:61:23:bb:2e:75:4e:b9:d1:9a:9c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\LogReporter.pdb

Imports

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ
?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

CreateToolhelp32Snapshot
GetPrivateProfileIntW
GetPrivateProfileStringW
GetModuleFileNameW
lstrlenW
ReadFile
GetTempFileNameW
GetTempPathW
GetPrivateProfileSectionW
GetTimeZoneInformation
WriteFile
Sleep
GetLocalTime
GetWindowsDirectoryW
GetVersionExW
WTSGetActiveConsoleSessionId
OutputDebugStringW
GlobalMemoryStatusEx
ProcessIdToSessionId
GetSystemInfo
CreateMutexW
SystemTimeToTzSpecificLocalTime
GetCommandLineW
SetLastError
DebugBreak
VirtualProtect
GetVersion
IsBadCodePtr
IsBadReadPtr
GetModuleHandleExW
ExitThread
CreateDirectoryW
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
FlushInstructionCache
VirtualFree
CreateFileMappingA
LocalFree
LocalAlloc
InterlockedExchange
InterlockedCompareExchange
WritePrivateProfileStringW
SystemTimeToFileTime
GetFileSizeEx
CreateProcessW
ReadProcessMemory
VirtualQueryEx
InitializeCriticalSectionAndSpinCount
lstrlenA
HeapCreate
HeapAlloc
CreateEventW
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
GetCurrentThreadId
TerminateProcess
VirtualQuery
GetModuleFileNameA
ReleaseMutex
lstrcatA
GetThreadContext
OpenMutexW
DuplicateHandle
VirtualAlloc
OpenFileMappingW
OpenEventW
lstrcpyA
VirtualAllocEx
VirtualFreeEx
GetCurrentThread
VirtualProtectEx
WriteProcessMemory
GetProcessHeap
HeapFree
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
lstrcpyW
SetEndOfFile
SetFilePointer
GetPrivateProfileSectionNamesW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetDriveTypeA
WriteConsoleW
GetConsoleOutputCP
Process32FirstW
OpenProcess
Process32NextW
SetDllDirectoryW
InterlockedIncrement
GetCurrentProcess
GetExitCodeProcess
WaitForSingleObject
DeleteFileW
GetLastError
CopyFileW
GetCurrentProcessId
GetTickCount
VerifyVersionInfoW
VerSetConditionMask
FreeLibrary
LoadLibraryW
GetProcAddress
GetModuleHandleW
DeviceIoControl
LockResource
GlobalFree
MultiByteToWideChar
SizeofResource
WideCharToMultiByte
GlobalAlloc
LoadResource
FindResourceW
FindResourceExW
CreateFileA
FindClose
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
UnmapViewOfFile
CloseHandle
MoveFileW
FlushFileBuffers
ResetEvent
SetEvent
WriteConsoleA
IsDebuggerPresent
SetStdHandle
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
GetSystemTimeAsFileTime
LoadLibraryA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
GetCurrentDirectoryA
GetFullPathNameW
GetStdHandle
ExitProcess
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
HeapDestroy
HeapReAlloc
RtlUnwind
RaiseException
LCMapStringW
LCMapStringA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
GetCPInfo
CreateThread
UnhandledExceptionFilter

user32

GetThreadDesktop
CloseDesktop
OpenInputDesktop
wsprintfW
DispatchMessageW
CallWindowProcW
CreateWindowExW
IsWindow
SetTimer
SendMessageTimeoutW
SetWindowLongW
GetWindowLongW
KillTimer
PostMessageW
GetMessageW
GetUserObjectInformationA

advapi32

GetUserNameW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExA
RegQueryInfoKeyW
GetTokenInformation
AllocateAndInitializeSid
EqualSid
RevertToSelf
RegCloseKey
GetLengthSid
GetKernelObjectSecurity
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
CreateProcessAsUserW
DuplicateTokenEx
SetTokenInformation
RegEnumValueW
RegEnumKeyExW
RegSetValueExW
QueryServiceStatus
RegOpenUserClassesRoot
StartServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
LookupPrivilegeValueW
AdjustTokenPrivileges
ImpersonateLoggedOnUser
RegOpenCurrentUser
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
OpenProcessToken

shell32

SHFileOperationW
ord165
ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoCreateGuid
CoInitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantClear

log

WriteLog

shlwapi

SHSetValueW
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
PathFindFileNameW
PathAddBackslashW
SHGetValueW
PathUnquoteSpacesW
PathRemoveArgsW
StrTrimW
SHDeleteValueW
PathFindExtensionW
PathRemoveExtensionW
PathRenameExtensionW
PathAppendW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

iphlpapi

GetAdaptersAddresses

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

winhttp

WinHttpCreateUrl
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpSetOption
WinHttpOpen
WinHttpWriteData
WinHttpSetCredentials
WinHttpAddRequestHeaders

ws2_32

htonl
WSAStartup
WSACleanup

psapi

GetModuleInformation
GetModuleFileNameExW
GetModuleBaseNameW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

Sections

.text
Size: 490KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NewFeatures.txt
$PLUGINSDIR/PC_Faster_Setup_Mini.exe
.exe windows:5 windows x86 arch:x86

4a3b8f64b1e58fb549287a1fcc9d77d1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:f6:4e:ea:07:64:07:69:fb:46:e8:d2:f5:3f:a8:06:4c:3e:0e:d1
Signer

Actual PE Digest

73:f6:4e:ea:07:64:07:69:fb:46:e8:d2:f5:3f:a8:06:4c:3e:0e:d1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

p:\app\gensoft\security-client\pc-faster-minisetup\public\output\pdb\MiniSetup.pdb

Imports

kernel32

GetTempFileNameW
FindResourceExW
FindResourceW
LoadResource
CreateProcessW
WaitForSingleObject
GetModuleHandleW
VirtualFree
Sleep
SizeofResource
GetModuleFileNameW
WritePrivateProfileStringW
GetTempPathW
VirtualAlloc
LockResource
CloseHandle
DeleteFileW
CreateFileA
ReadFile
SetEndOfFile
LoadLibraryA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetStartupInfoW
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileW
InitializeCriticalSectionAndSpinCount
SetFilePointer
MultiByteToWideChar
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

shell32

ord165

shlwapi

PathRenameExtensionW
PathFindFileNameW
PathRemoveExtensionW
PathRemoveBackslashW
StrStrIW
PathFileExistsW

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 981KB - Virtual size: 980KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/config.ini
$PLUGINSDIR/log.dll
.dll windows:5 windows x86 arch:x86

1f1b4a93890829f1d8956b91e3836d9d

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fa:32:4e:fd:2f:c1:07:fb:7f:1d:25:78:6c:07:8f:29:fd:c2:71:48
Signer

Actual PE Digest

fa:32:4e:fd:2f:c1:07:fb:7f:1d:25:78:6c:07:8f:29:fd:c2:71:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\log.pdb

Imports

kernel32

InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
FileTimeToSystemTime
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetLastError
MoveFileW
WideCharToMultiByte
GetLocalTime
GetFileAttributesExW
QueryPerformanceFrequency
DeleteCriticalSection
GetCurrentThreadId
CloseHandle
DeleteFileW
LocalFree
WriteFile
OutputDebugStringW
SystemTimeToTzSpecificLocalTime
SetFilePointer
EnterCriticalSection
GetFileSize
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapFree
HeapAlloc
RaiseException
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
VirtualAlloc
LoadLibraryA
RtlUnwind
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CreateFileA

advapi32

GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorSacl

Exports

Exports

CloseLog
CreateLog
WriteData
WriteLog
WriteLogA
WriteVLog

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/log2.dll
.dll windows:5 windows x86 arch:x86

169553d9c0e80575142f16084137d7ac

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

68:4a:01:7a:5c:ee:96:cf:8e:b8:45:16:da:e6:ca:5d:8e:b5:ba:81
Signer

Actual PE Digest

68:4a:01:7a:5c:ee:96:cf:8e:b8:45:16:da:e6:ca:5d:8e:b5:ba:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\log2.pdb

Imports

kernel32

GetPrivateProfileStringW
CreateFileW
GetFileSize
GetPrivateProfileIntW
ReadFile
GetTempPathW
GetTempFileNameW
CopyFileW
VirtualAlloc
VirtualFree
Sleep
SetFilePointer
FlushFileBuffers
LocalFree
UnmapViewOfFile
ReleaseMutex
CreateFileMappingW
MapViewOfFile
CreateSemaphoreW
CreateEventW
CreateMutexW
WaitForMultipleObjects
ReleaseSemaphore
ResetEvent
SetEvent
GetCurrentThreadId
GetCurrentProcessId
SleepEx
QueueUserAPC
OpenFileMappingW
OpenMutexW
OpenSemaphoreW
Process32NextW
SetEndOfFile
GetStdHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcess
GetTickCount
GetLastError
OpenProcess
VerifyVersionInfoW
VerSetConditionMask
WriteFile
MoveFileExW
HeapFree
GetProcessHeap
HeapAlloc
DeleteFileW
SystemTimeToFileTime
GetSystemTime
TerminateThread
WaitForSingleObject
OutputDebugStringW
FindNextFileW
FindFirstFileW
GetLocalTime
FindClose
GetModuleFileNameW
CloseHandle
DeviceIoControl
LockResource
GlobalFree
MultiByteToWideChar
SizeofResource
WideCharToMultiByte
GlobalAlloc
LoadResource
FindResourceW
CreateFileA
CreateDirectoryW
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileSectionNamesW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
InterlockedExchange
FindResourceExW
OpenEventW
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
RaiseException
HeapDestroy
HeapReAlloc
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
LCMapStringW
ExitProcess
GetModuleFileNameA
HeapCreate
SetHandleCount
GetFileType

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegEnumValueW
RegEnumKeyExW
FreeSid
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
AllocateAndInitializeSid
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenCurrentUser
RevertToSelf
ImpersonateLoggedOnUser
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

shell32

ord165
SHGetFolderPathW
SHFileOperationW
SHGetSpecialFolderPathW

ole32

CoCreateGuid

shlwapi

PathRemoveFileSpecW
SHGetValueW
PathFindFileNameW
PathIsDirectoryW
PathFileExistsW
PathAppendW
PathAddBackslashW
PathRenameExtensionW
StrCpyW
PathRemoveExtensionW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wtsapi32

WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsW

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

Exports

Exports

??0CAPCDispatcher@@AAE@XZ
??1CAPCDispatcher@@AAE@XZ
??4CAPCDispatcher@@QAEAAV0@ABV0@@Z
?APCThreadEntry@CAPCDispatcher@@CGIPAX@Z
?CloudOPTAPCProc@CAPCDispatcher@@CGXK@Z
?ConfirmLogLevel@CAPCDispatcher@@AAEXXZ
?DelInstance@CAPCDispatcher@@SAXXZ
?GetCommonDocumentsDir@CAPCDispatcher@@CAHQA_W@Z
?GetInstance@CAPCDispatcher@@SAPAV1@XZ
?Init@CAPCDispatcher@@AAEHXZ
?IsLevelEnabled@CAPCDispatcher@@AAEHK@Z
?LogAPCProc@CAPCDispatcher@@CGXK@Z
?LogErrorInfoToFile@CAPCDispatcher@@AAEXPB_W@Z
?LogWorkItemProc@CAPCDispatcher@@CGKPAX@Z
?QueueItemData@CAPCDispatcher@@AAEHPAUIMemItem@@@Z
?ShutDown@CAPCDispatcher@@SAXXZ
?SwitchLogFile@CAPCDispatcher@@QAEHXZ
?UnInit@CAPCDispatcher@@AAEXXZ
?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z
?WriteOptLog@CAPCDispatcher@@QAEHW4OPTType@OptItem@@W4OPTAction@3@PB_W22@Z
?m_hSingletonMutex@CAPCDispatcher@@0PAXA
?m_pInstance@CAPCDispatcher@@0PAV1@A
StartLog
StopLog

Sections

.text
Size: 259KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/string.ini
$PLUGINSDIR/sysconfig.ini
$PLUGINSDIR/url.ini
$_41_/PC Faster/5.1.0.0/Dump/BugReportConfig.ini
$_41_/PC Faster/5.1.0.0/Dump/CrashReportModuleConf.ini
$_41_/PC Faster/5.1.0.0/config.ini
BHips.dll
.dll windows:5 windows x86 arch:x86

37f7fa6427379a6253a091175f81dc84

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d2:32:fd:06:b7:6a:a3:4a:be:27:1b:f5:b0:f7:50:65:a4:76:a1:24
Signer

Actual PE Digest

d2:32:fd:06:b7:6a:a3:4a:be:27:1b:f5:b0:f7:50:65:a4:76:a1:24

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

t:\i18nBavDefense\defense\output\pdb\BHips.pdb

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

fltlib

FilterConnectCommunicationPort
FilterSendMessage

kernel32

GetCurrentProcess
Sleep
MultiByteToWideChar
QueryDosDeviceW
GetWindowsDirectoryW
CreateFileA
GetFileSize
MapViewOfFile
UnmapViewOfFile
OpenProcess
WideCharToMultiByte
CopyFileW
GetExitCodeProcess
TerminateProcess
ReadFile
CreateFileW
Process32FirstW
CreateFileMappingW
DeviceIoControl
GetSystemInfo
GetModuleFileNameA
Process32NextW
WTSGetActiveConsoleSessionId
CreateToolhelp32Snapshot
LocalFree
CreateProcessW
SetEvent
HeapDestroy
HeapCreate
GetFileAttributesW
lstrlenW
GetStartupInfoW
CreateEventW
WaitForMultipleObjects
DeleteFileW
SetFileAttributesW
SetEndOfFile
GetTickCount
WriteFile
GlobalAlloc
GlobalFree
GetLocalTime
OpenThread
GetVersionExW
CloseHandle
GetCurrentProcessId
DisconnectNamedPipe
WriteFileEx
CreateNamedPipeW
ConnectNamedPipe
ReadFileEx
GetOverlappedResult
GetModuleHandleExW
WaitNamedPipeW
InterlockedDecrement
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SwitchToThread
VirtualAlloc
VirtualFree
CreateEventA
CreateSemaphoreA
InitializeCriticalSection
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
RaiseException
IsValidCodePage
GetOEMCP
IsValidLocale
EnumSystemLocalesA
GetACP
GetCPInfo
GetStdHandle
ExitProcess
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
ResumeThread
ExitThread
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapReAlloc
LCMapStringW
LCMapStringA
SetHandleCount
GetFileType
LockResource
CreateSemaphoreW
GetProcAddress
InterlockedExchange
GetPrivateProfileIntW
WritePrivateProfileStringW
ReleaseSemaphore
SizeofResource
TerminateThread
LoadLibraryW
IsBadReadPtr
GetProcessHeap
GetModuleHandleW
WaitForSingleObject
HeapFree
HeapAlloc
LoadResource
FreeLibrary
FindResourceW
FindResourceExW
CreateMutexW
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
GetLastError
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
SetNamedPipeHandleState
CreateThread
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetUserDefaultLCID
GetStringTypeW
SetFilePointer
FreeEnvironmentStringsA
InterlockedExchangeAdd
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleA
GetStringTypeA
GetLocaleInfoA
GetLocaleInfoW
LoadLibraryA

wtsapi32

WTSEnumerateSessionsW
WTSQueryUserToken
WTSFreeMemory

psapi

GetProcessImageFileNameW
GetModuleBaseNameW
GetModuleFileNameExW

user32

GetMessageW
DispatchMessageW
KillTimer
PeekMessageW
MsgWaitForMultipleObjectsEx
SetWindowLongW
CreateWindowExW
RegisterClassW
GetClassInfoW
PostMessageW
DefWindowProcW
PostQuitMessage
SendMessageW
SendMessageTimeoutW
GetWindowLongW
IsWindow
GetWindowThreadProcessId
FindWindowExW
SetTimer
DestroyWindow
TranslateMessage

advapi32

AdjustTokenPrivileges
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
RegSetValueExW
QueryServiceStatus
StartServiceW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
CreateServiceW
GetSecurityDescriptorDacl
RegQueryValueExW
FreeSid
RevertToSelf
SetEntriesInAclW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorOwner
RegOpenCurrentUser
AllocateAndInitializeSid
GetNamedSecurityInfoW
ImpersonateLoggedOnUser
LookupPrivilegeValueW
SetNamedSecurityInfoW
OpenProcessToken
RegCloseKey
RegOpenKeyExW

shell32

SHGetFolderPathW
ord165
CommandLineToArgvW

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance

oleaut32

SysFreeString

shlwapi

PathIsDirectoryW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
StrRChrW

ntdll

RtlUnwind

Exports

Exports

BHips_AddProtectFilePath
BHips_AddProtectProcessDirPath
BHips_AddProtectProcessId
BHips_AddProtectProcessPath
BHips_AddProtectRegPath
BHips_Cleanup
BHips_DrvInst
BHips_DrvUninst
BHips_RegisterCallback
BHips_SetProtectOpt
BHips_Startup
BHips_StartupEx
CreateObject
_BHips_GetIEProtectPath@8

Sections

.text
Size: 478KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BHipsConfig.ini
BProtectEx.sys
.sys windows:5 windows x86 arch:x86

9d5bc1128c2a09b831a5054cc7f5f033

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

83:dc:52:97:f6:29:5d:a9:66:ce:72:8b:b9:a3:71:35:fa:d7:b1:61
Signer

Actual PE Digest

83:dc:52:97:f6:29:5d:a9:66:ce:72:8b:b9:a3:71:35:fa:d7:b1:61

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

s:\i18nBavDefense\defense\output\pdb\BProtectEx.pdb

Imports

ntoskrnl.exe

ObfDereferenceObject
ExInitializeResourceLite
PsGetCurrentProcessId
_wcsupr
RtlUpcaseUnicodeChar
IoGetStackLimits
ExGetPreviousMode
ExDeletePagedLookasideList
PsGetVersion
ExInitializePagedLookasideList
IoGetTopLevelIrp
PsGetCurrentThreadId
DbgPrintEx
RtlCopyUnicodeString
ProbeForRead
RtlDowncaseUnicodeString
wcsncpy
wcsncat
RtlEqualUnicodeString
ObQueryNameString
IoFileObjectType
wcsstr
IoDeleteSymbolicLink
PsLookupProcessByProcessId
IoDeleteDevice
IoCreateFile
IofCompleteRequest
RtlCompareUnicodeString
ZwQueryInformationProcess
IoCreateSymbolicLink
IoCreateDevice
ObOpenObjectByPointer
KeClearEvent
ZwQuerySystemInformation
MmMapLockedPagesSpecifyCache
KeWaitForMultipleObjects
ExQueueWorkItem
IoThreadToProcess
RtlVolumeDeviceToDosName
_wcsnicmp
ZwReadFile
PsReferencePrimaryToken
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
ZwQueryObject
KeUnstackDetachProcess
ZwSetInformationFile
KeReleaseSemaphore
ExAllocatePool
KeGetCurrentThread
IoGetCurrentProcess
KeQueryTimeIncrement
RtlAppendUnicodeStringToString
ZwQueryVolumeInformationFile
ZwDuplicateObject
ZwOpenProcess
KeTickCount
ObfReferenceObject
MmIsAddressValid
ZwTerminateProcess
ZwQueryInformationFile
KeStackAttachProcess
PsLookupThreadByThreadId
ZwOpenKey
_wcsicmp
RtlWalkFrameChain
ZwCreateKey
RtlGetVersion
ZwSetValueKey
PsProcessType
ProbeForWrite
wcsrchr
NtClose
ZwQueryInformationToken
PsThreadType
PsGetThreadProcessId
MmHighestUserAddress
IoDriverObjectType
IoUnregisterShutdownNotification
ObReferenceObjectByName
wcschr
_vsnwprintf
IoGetDeviceObjectPointer
ExUnregisterCallback
ExRegisterCallback
ExCreateCallback
IoRegisterShutdownNotification
KeWaitForSingleObject
ObReferenceObjectByHandle
ExfInterlockedRemoveHeadList
KeInitializeEvent
ExfInterlockedInsertTailList
KeSetEvent
ExAcquireResourceExclusiveLite
InterlockedPushEntrySList
ZwClose
ZwCreateFile
InterlockedPopEntrySList
ExFreePoolWithTag
ExAllocatePoolWithTag
ExDeleteResourceLite
ExReleaseResourceLite
ExAcquireResourceSharedLite
KeEnterCriticalRegion
FsRtlIsNameInExpression
RtlInitUnicodeString
ZwQueryValueKey
KeLeaveCriticalRegion
memset
_aullrem
_allmul
_except_handler3
memcpy
_alldiv
_aullshr

hal

KfReleaseSpinLock
ExReleaseFastMutex
KfAcquireSpinLock
KeGetCurrentIrql
ExAcquireFastMutex

fltmgr.sys

FltGetStreamContext
FltSetInformationFile
FltGetDestinationFileNameInformation
FltCancelFileOpen
FltGetVolumeContext
FltSetVolumeContext
FltStartFiltering
FltRegisterFilter
FltBuildDefaultSecurityDescriptor
FltCloseCommunicationPort
FltUnregisterFilter
FltAllocateContext
FltReleaseContext
FltFreeSecurityDescriptor
FltGetVolumeProperties
FltGetDiskDeviceObject
FltCreateCommunicationPort
FltCloseClientPort
FltAllocateCallbackData
FltParseFileNameInformation
FltReleaseFileNameInformation
FltPerformSynchronousIo
FltGetFileNameInformation
FltFreeCallbackData
FltSetStreamContext

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BProtectEx64.sys
.sys windows:5 windows x64 arch:x64

f5469fd8a4f0f793227a9eca17e457c4

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:6b:00:a1:9f:9b:58:3b:9d:46:69:78:19:6d:a5:ef:44:fa:1d:94
Signer

Actual PE Digest

0e:6b:00:a1:9f:9b:58:3b:9d:46:69:78:19:6d:a5:ef:44:fa:1d:94

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

s:\i18nBavDefense\defense\output\pdb\BProtectEx64.pdb

Imports

ntoskrnl.exe

ObReferenceObjectByHandle
KeWaitForSingleObject
KeReleaseSemaphore
ExInterlockedRemoveHeadList
ObfDereferenceObject
ExInitializeResourceLite
PsGetCurrentProcessId
_wcsupr
RtlUpcaseUnicodeChar
IoGetStackLimits
ExGetPreviousMode
ExDeletePagedLookasideList
PsGetVersion
ExInitializePagedLookasideList
IoGetTopLevelIrp
PsGetCurrentThreadId
DbgPrintEx
RtlCopyUnicodeString
ProbeForRead
RtlDowncaseUnicodeString
wcsncpy
ObQueryNameString
IoFileObjectType
wcsstr
IoDeleteSymbolicLink
PsLookupProcessByProcessId
IoDeleteDevice
IoCreateFile
IofCompleteRequest
RtlCompareUnicodeString
ZwQueryInformationProcess
IoCreateSymbolicLink
IoCreateDevice
ObOpenObjectByPointer
KeClearEvent
ZwQuerySystemInformation
MmMapLockedPagesSpecifyCache
KeWaitForMultipleObjects
ExQueueWorkItem
IoThreadToProcess
RtlVolumeDeviceToDosName
_wcsnicmp
ZwReadFile
IoGetRelatedDeviceObject
PsReferencePrimaryToken
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
ZwQueryObject
KeUnstackDetachProcess
ZwSetInformationFile
ZwQueryValueKey
ExAllocatePool
IoGetCurrentProcess
KeQueryTimeIncrement
RtlAppendUnicodeStringToString
ZwQueryVolumeInformationFile
ZwDuplicateObject
IoFreeIrp
IoAllocateIrp
ZwOpenProcess
ObfReferenceObject
MmIsAddressValid
ZwTerminateProcess
ZwQueryInformationFile
KeStackAttachProcess
IofCallDriver
ZwOpenKey
_wcsicmp
RtlWalkFrameChain
ZwCreateKey
ZwSetValueKey
PsProcessType
wcsrchr
NtClose
ZwQueryInformationToken
ObRegisterCallbacks
ObUnRegisterCallbacks
PsSetCreateProcessNotifyRoutine
PsThreadType
ExReleaseFastMutex
ExAcquireFastMutex
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
VerSetConditionMask
CmRegisterCallbackEx
RtlVerifyVersionInfo
CmUnRegisterCallback
IoDriverObjectType
IoUnregisterShutdownNotification
ObReferenceObjectByName
_vsnwprintf
ExUnregisterCallback
ExRegisterCallback
ExCreateCallback
IoRegisterShutdownNotification
ExInterlockedInsertTailList
KeInitializeEvent
KeSetEvent
ExAcquireResourceExclusiveLite
ExQueryDepthSList
ZwClose
ZwCreateFile
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExFreePoolWithTag
ExAllocatePoolWithTag
ExDeleteResourceLite
ExReleaseResourceLite
ExAcquireResourceSharedLite
KeEnterCriticalRegion
FsRtlIsNameInExpression
RtlInitUnicodeString
KeLeaveCriticalRegion
__C_specific_handler

fltmgr.sys

FltGetStreamContext
FltSetInformationFile
FltGetDestinationFileNameInformation
FltCancelFileOpen
FltGetVolumeContext
FltSetVolumeContext
FltStartFiltering
FltRegisterFilter
FltBuildDefaultSecurityDescriptor
FltCloseCommunicationPort
FltUnregisterFilter
FltAllocateContext
FltReleaseContext
FltFreeSecurityDescriptor
FltGetVolumeProperties
FltGetDiskDeviceObject
FltCreateCommunicationPort
FltCloseClientPort
FltAllocateCallbackData
FltParseFileNameInformation
FltReleaseFileNameInformation
FltPerformSynchronousIo
FltGetFileNameInformation
FltFreeCallbackData
FltSetStreamContext

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 398B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BaiduStore.dll
.dll windows:5 windows x86 arch:x86

b060bce1d1ef2f5a159eafa419bbd1ee

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ad:48:e5:2f:1a:54:ef:d9:72:4c:29:ca:15:7c:1c:0d:50:b4:1e:7d
Signer

Actual PE Digest

ad:48:e5:2f:1a:54:ef:d9:72:4c:29:ca:15:7c:1c:0d:50:b4:1e:7d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\BaiduStore.pdb

Imports

datareport

RD_WS
RD_W
RD_WW

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z
?GetInstance@CAPCDispatcher@@SAPAV1@XZ

kernel32

LockResource
DeleteCriticalSection
InterlockedIncrement
GetTickCount
Sleep
GetTempFileNameW
GetFileSize
HeapAlloc
HeapFree
GetModuleHandleExW
GetModuleHandleW
GetProcessHeap
IsBadReadPtr
GetPrivateProfileStringW
InitializeCriticalSectionAndSpinCount
CopyFileW
GetVersionExW
ReadFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
WritePrivateProfileStringW
GetTempPathW
GetPrivateProfileIntW
OpenMutexW
GetLastError
GetLongPathNameW
CloseHandle
DeleteFileW
GetCurrentProcessId
WideCharToMultiByte
FormatMessageW
GetACP
InitializeCriticalSection
WaitForSingleObject
InterlockedExchangeAdd
InterlockedDecrement
InterlockedExchange
OpenThread
DisconnectNamedPipe
WriteFileEx
CreateNamedPipeW
ConnectNamedPipe
SetEvent
ReadFileEx
CreateEventW
GetOverlappedResult
CreateThread
WaitNamedPipeW
SetNamedPipeHandleState
GetCurrentThreadId
InterlockedCompareExchange
TerminateThread
ResetEvent
SwitchToThread
CreateFileA
GetModuleHandleA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
LoadLibraryA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
EnterCriticalSection
LeaveCriticalSection
SizeofResource
LoadResource
FindResourceW
FindResourceExW
VirtualAlloc
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
ExitProcess
GetModuleFileNameA
GetStdHandle
WriteFile
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RaiseException
HeapDestroy
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
ExitThread
ResumeThread
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetProcAddress

user32

PostMessageW
FindWindowExW
GetWindowThreadProcessId
PostQuitMessage
GetWindowLongW
SendMessageTimeoutW
IsWindow
DefWindowProcW
SendMessageW
GetClassInfoW
RegisterClassW
DestroyWindow
SetTimer
KillTimer
GetMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
SetWindowLongW
CreateWindowExW

advapi32

InitializeSecurityDescriptor
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW

shell32

ShellExecuteW
ord165
SHGetFolderPathW

ole32

CoInitializeSecurity
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SysAllocStringLen
SysFreeString
VarBstrCmp
SysAllocString
VariantClear
VariantInit

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathAddBackslashW
PathFileExistsW
PathAppendW
PathIsDirectoryW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Exports

Exports

??0Baidu_ListenData@@QAE@ABV0@@Z
??0Baidu_ListenData@@QAE@PB_W@Z
??0BdConfig@@QAE@ABV0@@Z
??0BdConfig@@QAE@XZ
??0CBaiduStoreMgr@@AAE@XZ
??0CBaiduStoreMgr@@QAE@ABV0@@Z
??1Baidu_ListenData@@UAE@XZ
??1BdConfig@@QAE@XZ
??1CBaiduStoreMgr@@QAE@XZ
??4Baidu_ListenData@@QAEAAV0@ABV0@@Z
??4BdConfig@@QAEAAV0@ABV0@@Z
??4CBaiduStoreMgr@@QAEAAV0@ABV0@@Z
??_7Baidu_ListenData@@6B@
?AddListenDataItem@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PAVBaidu_ListenData@@@Z
?CheckComponentExist@CBaiduStoreMgr@@QAEHPA_W@Z
?ClearPluginConfig@CBaiduStoreMgr@@IAEXXZ
?ClearTools@BdConfig@@QAEXXZ
?CloseKernelHandle@CBaiduStoreMgr@@QAEXXZ
?ConnectSubSvc@CBaiduStoreMgr@@QAEHPB_WH@Z
?CopyConfig2UserDIR@BdConfig@@QAEHXZ
?DeleteListenDataItem@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?DestroyInstance@CBaiduStoreMgr@@SAXXZ
?DoAutoRun@CBaiduStoreMgr@@QAEXH@Z
?DoCleanPreScan@CBaiduStoreMgr@@QAEXXZ
?DoExamCleanFixUp@CBaiduStoreMgr@@QAEXXZ
?DoExamCleanFixupStop@CBaiduStoreMgr@@QAEXXZ
?DoExamCleanScan@CBaiduStoreMgr@@QAEXXZ
?DoExamCleanScanStop@CBaiduStoreMgr@@QAEXXZ
?DoExamOptFixUp@CBaiduStoreMgr@@QAEXXZ
?DoExamOptFixUpStop@CBaiduStoreMgr@@QAEXXZ
?DoExamOptScan@CBaiduStoreMgr@@QAEXXZ
?DoExamOptScanStop@CBaiduStoreMgr@@QAEXXZ
?DoExamSysRepairFixUp@CBaiduStoreMgr@@QAEXXZ
?DoExamSysRepairScan@CBaiduStoreMgr@@QAEXXZ
?DoExitWindow@CBaiduStoreMgr@@QAEXXZ
?DoGetBootTime@CBaiduStoreMgr@@QAEXXZ
?DoGetDynamicSystemInfo@CBaiduStoreMgr@@QAEXXZ
?DoGetNetFlowInfo@CBaiduStoreMgr@@QAEXXZ
?DoGetStaticSystemInfo@CBaiduStoreMgr@@QAEXXZ
?DoGetWindowUpdateStatus@CBaiduStoreMgr@@QAEHXZ
?DoInitBootTime@CBaiduStoreMgr@@QAEXXZ
?DoKernelMessage@Baidu_ListenData@@UAEHIIJ@Z
?DoMonitorDevSize@CBaiduStoreMgr@@QAEXXZ
?DoMonitorDevTarySize@CBaiduStoreMgr@@QAEXXZ
?DoMonitorJunkClean@CBaiduStoreMgr@@QAEXXZ
?DoMonitorJunkScan@CBaiduStoreMgr@@QAEXXZ
?DoMonitorStartupItem@CBaiduStoreMgr@@QAEXXZ
?DoRestartWindow@CBaiduStoreMgr@@QAEXXZ
?DoShellExecute@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z
?EnableBdKernel2@CBaiduStoreMgr@@QAEXXZ
?EnableBdKernel@CBaiduStoreMgr@@QAEXXZ
?FindSubKrnHandle@CBaiduStoreMgr@@QAEHPB_WAAPAXAAH@Z
?GetBdConfig@CBaiduStoreMgr@@QAEPAVBdConfig@@XZ
?GetConfigPath@BdConfig@@AAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ
?GetKernelSafeHandle@CBaiduStoreMgr@@QAEPAXXZ
?GetPluginItemEnableStatus@CBaiduStoreMgr@@QAEHI@Z
?GetPluginItemFilePath@CBaiduStoreMgr@@QAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@I@Z
?GetShowBrowserJunkPopup@BdConfig@@QAEHXZ
?GetShowBundleSoftPopup@BdConfig@@QAEHXZ
?GetShowNewwarePopup@BdConfig@@QAEHXZ
?GetShowmalwarePopup@BdConfig@@QAEHXZ
?GetUpdateState@BdConfig@@QAEIXZ
?HandleKrnResponse@CBaiduStoreMgr@@IAEXPAUiarchive@@@Z
?InitKrnIPCClient@CBaiduStoreMgr@@QAEHK@Z
?InitResponseHandle@CBaiduStoreMgr@@IAEXPAX@Z
?InitSubKrnlHandle@CBaiduStoreMgr@@QAEHPB_W@Z
?InitSubResponseHandle@CBaiduStoreMgr@@IAEXPAX@Z
?IsConnectSubSvc@CBaiduStoreMgr@@QAEHPB_W@Z
?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z
?LoadConfig@BdConfig@@QAEXXZ
?OnChannelDown@CBaiduStoreMgr@@IAEXPA_W@Z
?OnKernelHandle@Baidu_ListenData@@UAEHPAX@Z
?OnKernelHandle@CBaiduStoreMgr@@QAEXPAX@Z
?OnSubChannelDown@CBaiduStoreMgr@@IAEXPA_W@Z
?OnWndMsg@Baidu_ListenData@@UAEHIIJ@Z
?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z
?PushTools@BdConfig@@QAEHV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?ReadPluginConfig@CBaiduStoreMgr@@IAEXXZ
?RecursiveStartNT6@CBaiduStoreMgr@@QAE_NPAUITaskFolder@@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAH@Z
?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z
?ReportIncCount@CBaiduStoreMgr@@QAEHKK@Z
?ReportState@CBaiduStoreMgr@@QAEHKK@Z
?ReportStateEx@CBaiduStoreMgr@@QAEHKPB_W@Z
?ReportValue@CBaiduStoreMgr@@QAEHKK@Z
?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z
?RestoreToDefault@BdConfig@@QAEXXZ
?SaveActivitys@BdConfig@@QAEXXZ
?SaveAutoRunConfig@BdConfig@@QAEXH@Z
?SaveBootTimeHelperPopup@BdConfig@@QAEXH@Z
?SaveBrowserJunkPopupTime@BdConfig@@QAEXK@Z
?SaveConfig@BdConfig@@QAEXXZ
?SaveHomeAutoScan@BdConfig@@QAEXK@Z
?SavePluginWarningTime@BdConfig@@QAEXK@Z
?SavePrivacyCleanTime@BdConfig@@QAEXK@Z
?SaveShowBigFilePopup@BdConfig@@QAEXH@Z
?SaveShowPlugPopup@BdConfig@@QAEXH@Z
?SaveShowmalwarePopup@BdConfig@@QAEXH@Z
?SaveSound@BdConfig@@QAEXH@Z
?SaveSparkClick@BdConfig@@QAEXH@Z
?SaveWeatherConfig@BdConfig@@QAEXXZ
?SendKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXKAAVCMsg@@@Z
?SetMainFrame@CBaiduStoreMgr@@QAEXPAUHWND__@@@Z
?StartNT6SchTasks@CBaiduStoreMgr@@QAE_NV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAH@Z
?UnloadComponent@CBaiduStoreMgr@@QAEXPA_W@Z
?UpdateConfig@BdConfig@@QAEXXZ
?UpdateSystemConfig@Baidu_ListenData@@UAEXXZ
?UpdateSystemConfig@CBaiduStoreMgr@@QAEXXZ
?m_pInstance@CBaiduStoreMgr@@2PAV1@A
?strDefaultTool@BdConfig@@0PAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@A

Sections

.text
Size: 966KB - Virtual size: 965KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BavConfig.ini
BavData.dll
.dll windows:5 windows x86 arch:x86

f11d4807fb5dbc0666070953ae8f658d

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:cf:40:03:3b:09:68:01:f4:d1:bd:a5:4a:c0:3d:7a:b4:c6:39:85
Signer

Actual PE Digest

59:cf:40:03:3b:09:68:01:f4:d1:bd:a5:4a:c0:3d:7a:b4:c6:39:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVNCode\YaoJun\BavData\BavData\Release\BavData.pdb

Imports

kernel32

GetLastError
SystemTimeToFileTime
WriteFile
CloseHandle
MultiByteToWideChar
SetFilePointer
ReadFile
CreateFileW
DeviceIoControl
GetVolumeInformationW
FileTimeToLocalFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetFileAttributesW
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
GetModuleHandleA

user32

SendMessageW

Exports

Exports

CreateEngine
RecoverFile
ReleaseEngine
ScanLoseFile

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BdApiUtil.dll
.dll windows:5 windows x86 arch:x86

9e6ad255aaf843d3e420a71eb089bd5d

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:59:a5:5b:ad:1f:5b:50:90:e2:a3:8c:d0:7c:3b:f4:db:27:36:8b
Signer

Actual PE Digest

62:59:a5:5b:ad:1f:5b:50:90:e2:a3:8c:d0:7c:3b:f4:db:27:36:8b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

r:\i18nBavDefense\defense\output\pdb\BdApiUtil.pdb

Imports

kernel32

GetProcAddress
FreeLibrary
LoadLibraryW
GetSystemInfo
lstrlenA
OutputDebugStringA
GetFullPathNameA
LoadLibraryA
SetLastError
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
DeviceIoControl
CreateFileA
CloseHandle
GetCurrentProcess
GetLastError
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
HeapAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
SetStdHandle

advapi32

RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegCreateKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteKeyA

shlwapi

PathRemoveFileSpecA
PathAppendA
PathFileExistsA

ntdll

RtlFormatCurrentUserKeyPath
RtlFreeUnicodeString
RtlInitUnicodeString

Exports

Exports

BDCloseHandle
BDCreateFileW
BDCreateFileX
BDRegCloseKey
BDRegCreateKeyA
BDRegCreateKeyExA
BDRegCreateKeyExW
BDRegCreateKeyW
BDRegDeleteKeyA
BDRegDeleteKeyExA
BDRegDeleteKeyExW
BDRegDeleteKeyW
BDRegDeleteValueA
BDRegDeleteValueW
BDRegOpenKeyA
BDRegOpenKeyExA
BDRegOpenKeyExW
BDRegOpenKeyW
BDRegSetValueA
BDRegSetValueExA
BDRegSetValueExW
BDRegSetValueW
DeInitEngine
InitEngine

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bhbase.sys
.sys windows:5 windows x86 arch:x86

970f386b3876e7bd50b93b92760b7152

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fa:21:f4:2d:1a:81:c5:5e:0d:83:fa:31:3c:8f:c5:f6:ab:2e:fb:b0
Signer

Actual PE Digest

fa:21:f4:2d:1a:81:c5:5e:0d:83:fa:31:3c:8f:c5:f6:ab:2e:fb:b0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

p:\i18nBavDefense\defense\output\bin\Bhbase.pdb

Imports

ntoskrnl.exe

IoCreateDevice
_stricmp
ZwQuerySystemInformation
ExAllocatePoolWithTag
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
IoCreateSymbolicLink
PsGetCurrentProcessId
PsLookupProcessByProcessId
ObfDereferenceObject
KeStackAttachProcess
KeUnstackDetachProcess
InitSafeBootMode
PsGetVersion
KeInitializeTimer
KeSetTimer
KeWaitForSingleObject
KeCancelTimer
MmIsAddressValid
MmHighestUserAddress
PsSetCreateProcessNotifyRoutine
PsSetCreateThreadNotifyRoutine
PsSetLoadImageNotifyRoutine
MmGetSystemRoutineAddress
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
IofCompleteRequest
IoDeleteDevice
RtlInitUnicodeString
RtlEqualUnicodeString
memset
_except_handler3
memcpy

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 832B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 64B - Virtual size: 59B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 864B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 896B - Virtual size: 878B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BigFileCleaner.dat
.xml
Cloud Security/BCloudScan.exe
.exe windows:5 windows x86 arch:x86

758b7a30df28923fec857ddb6e61444f

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:7d:c2:58:22:95:df:89:67:db:c3:c7:73:4b:ea:83:49:0f:c2:b3
Signer

Actual PE Digest

5c:7d:c2:58:22:95:df:89:67:db:c3:c7:73:4b:ea:83:49:0f:c2:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\bavOutput\Pdb\Release\BCloudScan.pdb

Imports

shlwapi

PathAppendW
PathIsDirectoryW
PathFileExistsW
StrRChrW
StrStrIW
PathRenameExtensionW
PathAddBackslashW
PathFindFileNameW
PathAddExtensionW
SHDeleteKeyW
StrRetToStrW
PathRemoveFileSpecW
PathIsFileSpecW

log

CreateLog
WriteLog
CloseLog

psapi

EnumProcessModules
GetProcessImageFileNameW
GetModuleInformation
GetModuleFileNameExW

wtsapi32

WTSQueryUserToken
WTSOpenServerW
WTSEnumerateProcessesW
WTSCloseServer
WTSFreeMemory
WTSEnumerateSessionsW

userenv

ExpandEnvironmentStringsForUserW
CreateEnvironmentBlock
DestroyEnvironmentBlock

bavqv

?Bd_ReadFilePayloadInfo@@YAKPB_WPAKQA_WPAPAU_QUARANTINE_HEADER@@@Z
?Bd_ReleaseQHeader@@YAXPAPAU_QUARANTINE_HEADER@@@Z
?Bd_ReadFileBlock@@YAKPB_WKPAKPAX@Z

pdh

PdhAddCounterW
PdhCloseQuery
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhOpenQueryW

imm32

ImmDisableIME

kernel32

Sleep
SizeofResource
GetModuleFileNameW
GetTimeZoneInformation
MultiByteToWideChar
ResetEvent
LockResource
CreateEventW
GetCurrentThreadId
CloseHandle
GetFileSize
SetFilePointer
MapViewOfFile
UnmapViewOfFile
GetDriveTypeW
SetEndOfFile
CreateFileW
WritePrivateProfileStringW
GetPrivateProfileIntW
CreateFileMappingW
DeviceIoControl
GetVolumeInformationW
lstrlenA
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenW
InterlockedExchange
GetModuleHandleW
GetWindowsDirectoryW
FindFirstFileW
TryEnterCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentThread
OpenProcess
SetThreadPriority
FindClose
Process32FirstW
Process32NextW
GetThreadPriority
CreateToolhelp32Snapshot
QueryPerformanceFrequency
ResumeThread
CreateThread
GetLogicalDrives
GlobalAlloc
GlobalFree
CreateDirectoryW
InitializeCriticalSection
CreateProcessW
HeapAlloc
GetCurrentProcess
HeapFree
GetProcessHeap
IsBadReadPtr
GetExitCodeProcess
LocalAlloc
LocalFree
CreateMutexW
SetDllDirectoryW
HeapSetInformation
GetVersionExW
TerminateProcess
RaiseException
WaitForMultipleObjects
DeleteFileW
FindNextFileW
FreeLibrary
CopyFileW
ReadFile
GetFileSizeEx
GetLocalTime
GetFileAttributesExW
GetShortPathNameW
GetDiskFreeSpaceExW
MoveFileExW
QueryDosDeviceW
SetEvent
SetErrorMode
CreateRemoteThread
WaitNamedPipeW
WaitForMultipleObjectsEx
GetFileAttributesW
GetDiskFreeSpaceW
GetSystemInfo
DuplicateHandle
Module32NextW
InterlockedIncrement
GetCurrentProcessId
ProcessIdToSessionId
GetCommandLineW
SystemTimeToFileTime
WTSGetActiveConsoleSessionId
InterlockedCompareExchange
VirtualQueryEx
VirtualProtect
HeapCreate
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
InterlockedExchangeAdd
OpenThread
DisconnectNamedPipe
WriteFileEx
CreateNamedPipeW
ConnectNamedPipe
ReadFileEx
GetOverlappedResult
GetModuleHandleExW
SetNamedPipeHandleState
GetUserDefaultLCID
GetStringTypeExW
LCMapStringA
LCMapStringW
LoadLibraryA
GlobalMemoryStatusEx
GetEnvironmentVariableW
GetSystemDirectoryW
SetLastError
SwitchToThread
TerminateThread
SetStdHandle
GetModuleHandleA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
SetHandleCount
HeapSize
IsValidCodePage
GetOEMCP
IsDebuggerPresent
GetACP
ExitProcess
VirtualAlloc
GetModuleFileNameA
GetStdHandle
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStringTypeW
GetCPInfo
GetFileType
HeapReAlloc
RtlUnwind
GetCommandLineA
WaitForSingleObject
Module32FirstW
InterlockedDecrement
GetStringTypeA
GetLocaleInfoA
EnumSystemLocalesA
SystemTimeToTzSpecificLocalTime
LoadResource
FindResourceW
FindResourceExW
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CompareStringA
CompareStringW
UnhandledExceptionFilter
SetEnvironmentVariableA
GetSystemTimeAsFileTime
ExitThread
HeapDestroy
VirtualFree
DeleteCriticalSection
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetVersion
LoadLibraryW
WriteFile
ReadProcessMemory
MoveFileW

user32

DispatchMessageW
DefWindowProcW
UnregisterDeviceNotification
RegisterClassW
PostThreadMessageW
CreateWindowExW
RegisterDeviceNotificationW
LoadIconW
TranslateMessage
LoadCursorW
KillTimer
UnregisterClassW
PostQuitMessage
GetMessageW
DestroyWindow
FindWindowExW
GetWindowThreadProcessId
IsWindow
GetWindowLongW
SendMessageTimeoutW
SendMessageW
PostMessageW
GetClassInfoW
SetWindowLongW
MsgWaitForMultipleObjectsEx
PeekMessageW
SetTimer
GetSystemMetrics

gdi32

GetStockObject

advapi32

GetSecurityDescriptorSacl
GetSidSubAuthorityCount
GetSidSubAuthority
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegOpenKeyW
ConvertSidToStringSidW
IsValidSid
ImpersonateNamedPipeClient
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserW
GetTokenInformation
OpenThreadToken
OpenProcessToken
GetSidIdentifierAuthority
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegOpenCurrentUser
RevertToSelf
ImpersonateLoggedOnUser
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHGetSpecialFolderPathW
ShellExecuteW
ord165
SHGetDesktopFolder
SHGetFolderPathW

ole32

CoSetProxyBlanket
CoUninitialize
CoTaskMemFree
StringFromGUID2
CoInitializeSecurity
CoCreateInstance
CoInitialize

oleaut32

SysAllocString
SysStringLen
VariantClear
VariantInit
SysAllocStringLen
SysFreeString

ws2_32

gethostbyname
closesocket
inet_ntoa
socket
WSAStartup
WSACleanup
WSCEnumProtocols
WSCDeinstallProvider
WSCGetProviderPath
sendto
select
htonl

setupapi

CM_Get_Device_IDW
SetupDiEnumDeviceInterfaces
CM_Get_Parent
CM_Get_DevNode_Registry_PropertyW
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
CM_Enumerate_Classes
SetupDiSetClassInstallParamsW
CM_Get_Child
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
CM_Request_Device_EjectW
CM_Get_DevNode_Status
SetupDiCallClassInstaller

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

msi

ord217
ord173

crypt32

CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore
CryptMsgClose
CertCloseStore
CryptQueryObject
CryptMsgGetParam

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 535KB - Virtual size: 535KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Cloud Security/BavAs.dll
.dll windows:5 windows x86 arch:x86

d6260771d51fd6e850b6582e92b04bc7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/04/2012, 00:00

Not After

24/04/2015, 23:59

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:74:0a:34:18:ab:21:92:84:f2:92:22:dc:12:a1:36:73:9b:bf:e7
Signer

Actual PE Digest

63:74:0a:34:18:ab:21:92:84:f2:92:22:dc:12:a1:36:73:9b:bf:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavAs.pdb

Imports

log

WriteLog

kernel32

GetProcAddress
CloseHandle
CreateFileW
GetLastError
GetFileSizeEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetFileAttributesW
SetFileAttributesW
ReadFile
SetFilePointer
WriteFile
SetEndOfFile
MoveFileW
CopyFileW
MoveFileExW
lstrcmpA
lstrcpyA
DisableThreadLibraryCalls
GetModuleFileNameW
LoadLibraryW
GetModuleHandleW
lstrlenW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteFileW
GetStdHandle
VirtualAlloc
VirtualFree
InterlockedCompareExchange
Sleep
InterlockedExchange
MultiByteToWideChar
FreeLibrary
GetCurrentThreadId
CreateFileA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapFree
GetCommandLineA
RaiseException
RtlUnwind
HeapReAlloc
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
ExitProcess
HeapCreate
HeapDestroy
SetHandleCount
GetFileType
GetStartupInfoA
LCMapStringA
WideCharToMultiByte
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryA
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

advapi32

RegQueryValueExW
RegCloseKey
RegCreateKeyExW

shlwapi

PathRemoveFileSpecW

Exports

Exports

DllGetClassObject

Sections

.text
Size: 538KB - Virtual size: 537KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BavBase.dll
.dll windows:5 windows x86 arch:x86

57ffb09fd77b0c7b110f3e588d860658

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cd:a5:52:69:6f:8f:b1:a7:2f:dd:57:4e:34:25:e5:a4:02:0c:29:75
Signer

Actual PE Digest

cd:a5:52:69:6f:8f:b1:a7:2f:dd:57:4e:34:25:e5:a4:02:0c:29:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavBase.pdb

Imports

kernel32

GetPrivateProfileIntW
InterlockedCompareExchange
GetTimeZoneInformation
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
SetEvent
WaitForSingleObject
CloseHandle
GlobalFree
CreateFileW
DeviceIoControl
SetLastError
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetThreadPriority
GetCurrentThread
SetThreadPriority
GetTickCount
GetShortPathNameW
ReadFile
GetPrivateProfileStringW
GetCurrentProcess
TerminateProcess
IsBadReadPtr
Sleep
LoadLibraryW
FreeLibrary
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
lstrlenA
FindResourceExW
FindResourceW
SizeofResource
LockResource
LoadResource
DeleteCriticalSection
InitializeCriticalSection
CreateFileA
GetProcessHeap
SetEndOfFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetModuleHandleA
GetLocaleInfoW
LoadLibraryA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
GetLastError
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
SetFilePointer
LCMapStringW
HeapFree
ExitThread
GetCurrentThreadId
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetCommandLineA
GetFileAttributesW
HeapReAlloc
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
GetConsoleCP
GetConsoleMode
LCMapStringA

advapi32

RegQueryValueExW
RegCreateKeyExW
RegCloseKey

log

WriteLog

shlwapi

PathAddBackslashW
StrRChrW
PathAddExtensionW
PathFileExistsW
PathRemoveFileSpecW

Exports

Exports

DllGetClassObject

Sections

.text
Size: 215KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BavClean.dll
.dll windows:5 windows x86 arch:x86

dda27be3716324adaaeae29da8e9c164

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

92:7d:51:74:39:aa:4d:bf:7a:24:1b:7b:80:50:07:65:fe:25:51:14
Signer

Actual PE Digest

92:7d:51:74:39:aa:4d:bf:7a:24:1b:7b:80:50:07:65:fe:25:51:14

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavClean.pdb

Imports

log

WriteLog

bavqv

?Bd_Quarantine@@YAKPAU_QUARANTINE_HEADER@@PB_W@Z
?Bd_ReadQHeader@@YAKPAPAU_QUARANTINE_HEADER@@PB_W@Z
?Bd_Restore@@YAKPAPAU_QUARANTINE_HEADER@@PB_W@Z
?Bd_ReleaseQHeader@@YAXPAPAU_QUARANTINE_HEADER@@@Z

kernel32

InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
TerminateProcess
GetLongPathNameW
EnterCriticalSection
Process32FirstW
QueryDosDeviceW
Process32NextW
CreateToolhelp32Snapshot
DeleteCriticalSection
GetWindowsDirectoryW
FreeLibrary
GetCurrentProcess
GetVersionExW
DuplicateHandle
GetCurrentProcessId
MoveFileExW
GetFileAttributesW
SetFileAttributesW
OpenProcess
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
LoadLibraryA
GetTickCount
DeleteFileW
FindNextFileW
FindClose
GetProcAddress
InterlockedExchange
GetPrivateProfileIntW
lstrlenW
MultiByteToWideChar
GetTimeZoneInformation
GetModuleFileNameW
Sleep
LoadLibraryW
WideCharToMultiByte
GetPrivateProfileStringW
GetModuleHandleW
InterlockedCompareExchange
CreateDirectoryW
lstrlenA
GetStringTypeA
GetLocaleInfoA
FlushFileBuffers
FindFirstFileW
CloseHandle
DeviceIoControl
GetLastError
CreateFileW
SetStdHandle
ReadFile
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
ExitProcess
GetStartupInfoA
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
RaiseException
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MoveFileW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
HeapCreate
VirtualFree
VirtualAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
WriteFile
GetStdHandle
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
SetFilePointer
SetHandleCount
GetFileType

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
OpenProcessToken

shlwapi

StrRChrW
PathFileExistsW

psapi

GetProcessImageFileNameW

Exports

Exports

DllGetClassObject

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BavCns.dll
.dll windows:5 windows x86 arch:x86

9bf58e46251001533959120da4740032

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/04/2012, 00:00

Not After

24/04/2015, 23:59

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

30:b0:8e:c0:93:54:42:5e:aa:bc:1e:10:1c:56:71:bd:09:e9:1c:7b
Signer

Actual PE Digest

30:b0:8e:c0:93:54:42:5e:aa:bc:1e:10:1c:56:71:bd:09:e9:1c:7b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavCns.pdb

Imports

kernel32

InterlockedExchangeAdd
WaitForMultipleObjects
InitializeCriticalSection
ResetEvent
GetTickCount
ReadFile
GetModuleHandleW
GetVersionExW
GetSystemInfo
Sleep
GetCurrentProcess
TerminateProcess
GetLocalTime
GetConsoleCP
InterlockedCompareExchange
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
SetEvent
lstrlenA
GetLastError
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetStringTypeA
IsValidLocale
GetProcessHeap
CreateFileA
SetStdHandle
WriteConsoleW
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetConsoleMode
GetTimeZoneInformation
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
CreateEventW
WaitForSingleObject
CloseHandle
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
SetFilePointer
LoadLibraryA
GetModuleHandleA
CreateEventA
CreateThread
GetSystemTimeAsFileTime
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
ExitThread
GetCurrentThreadId
GetCommandLineA
GetFileAttributesW
HeapReAlloc
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FlushFileBuffers

user32

GetSystemMetrics

advapi32

RegQueryValueExW
RegCreateKeyExW
RegCloseKey

log

WriteLog

shlwapi

StrRChrW
PathFileExistsW

ws2_32

getpeername
ioctlsocket
connect
recvfrom
getsockname
shutdown
setsockopt
sendto
recv
bind
socket
closesocket
__WSAFDIsSet
htons
WSAGetLastError
select
inet_addr
ntohs
gethostbyname
WSACleanup
WSAStartup
ntohl
accept
listen
getsockopt
send

Exports

Exports

DllGetClassObject

Sections

.text
Size: 366KB - Virtual size: 365KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BavCommon.dll
.dll windows:5 windows x86 arch:x86

383347fe7694ad259fedd571470ddb47

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/04/2012, 00:00

Not After

24/04/2015, 23:59

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:a3:ba:95:8b:b7:7d:96:a4:7c:1f:d7:69:03:18:db:d0:5f:0f:63
Signer

Actual PE Digest

20:a3:ba:95:8b:b7:7d:96:a4:7c:1f:d7:69:03:18:db:d0:5f:0f:63

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavCommon.pdb

Imports

iphlpapi

GetIpForwardTable
GetAdaptersAddresses

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

VerSetConditionMask
VerifyVersionInfoW
GetCurrentProcessId
CopyFileW
MoveFileExW
DeleteFileW
GetExitCodeProcess
SetEndOfFile
GetProcessHeap
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
QueryDosDeviceW
CreateFileMappingA
GetSystemDirectoryW
ExpandEnvironmentStringsW
EnumResourceNamesW
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
lstrcmpA
GetFullPathNameW
CreateMutexW
ReleaseMutex
GetFileAttributesW
FindClose
RemoveDirectoryW
ProcessIdToSessionId
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileSectionNamesW
InitializeCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateDirectoryW
HeapFree
HeapAlloc
GetCurrentThreadId
WaitForSingleObject
LocalAlloc
IsWow64Process
GetNativeSystemInfo
GetFileAttributesExW
SetLastError
GetTickCount
UnmapViewOfFile
WriteFile
MapViewOfFile
CreateFileMappingW
SetFilePointer
GetFileInformationByHandle
FileTimeToSystemTime
ReadFile
GetFileSize
CreateFileW
DeviceIoControl
CreateFileA
GlobalFree
GlobalAlloc
Sleep
InterlockedCompareExchange
CloseHandle
lstrlenA
FindResourceExW
FindResourceW
SizeofResource
LockResource
LoadResource
GetLastError
WideCharToMultiByte
MultiByteToWideChar
LocalFree
SetProcessWorkingSetSize
GetCurrentProcess
GetProcessWorkingSetSize
GetVersionExW
GetSystemInfo
WTSGetActiveConsoleSessionId
SystemTimeToFileTime
GetLocalTime
GetTimeFormatW
GetDateFormatW
GetTimeFormatA
GetDateFormatA
GetStringTypeW
GetStringTypeA
RtlUnwind
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
HeapSize
GetModuleFileNameA
GetStdHandle
ExitProcess
RaiseException
GetModuleHandleA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapDestroy
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetTimeZoneInformation
GetCommandLineA
HeapReAlloc
GetFileAttributesA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
InterlockedExchange
DisableThreadLibraryCalls
LoadLibraryW
FreeLibrary
GetModuleFileNameW
GetProcAddress
GetModuleHandleW

user32

SetWindowPos
GetIconInfo
CloseDesktop
GetDC
CreateIconIndirect
OpenWindowStationW
OpenDesktopW
FindWindowW
ReleaseDC
GetSystemMetrics
GetWindowRect
IsWindow
BringWindowToTop
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
CloseWindowStation
ShowWindow
UpdateWindow
EnableWindow
IsWindowEnabled
SetForegroundWindow
GetDesktopWindow
DestroyIcon
PrivateExtractIconsW

gdi32

CreateCompatibleDC
DeleteDC
GetObjectW
DeleteObject
SetPixel
GetPixel
BitBlt
SelectObject
CreateBitmap

advapi32

EqualSid
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
GetUserNameW
LookupAccountNameW
ConvertSidToStringSidW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
SetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ImpersonateLoggedOnUser
GetTokenInformation
RegOpenUserClassesRoot
FreeSid
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
AllocateAndInitializeSid
QueryServiceStatus
DeleteService
ControlService
StartServiceW
OpenServiceW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
RevertToSelf
RegOpenCurrentUser

shell32

ExtractAssociatedIconW
ExtractIconExW
SHGetFileInfoW
ShellExecuteW
SHGetDesktopFolder
SHOpenFolderAndSelectItems
ord155
SHCreateDirectoryExW
ShellExecuteExW
SHGetSpecialFolderPathW
SHFileOperationW
SHGetFolderPathW

ole32

CoCreateGuid
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree

winhttp

WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpCrackUrl

psapi

GetProcessImageFileNameW
GetModuleFileNameExW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

shlwapi

PathUnquoteSpacesW
PathRemoveArgsW
PathFindFileNameW
PathRemoveFileSpecW
PathIsDirectoryW
PathFileExistsW
PathFileExistsA
StrFormatByteSizeW
StrFormatByteSize64A
PathFindExtensionW
PathIsRootW
PathIsNetworkPathW
PathAppendW

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

wintrust

WinVerifyTrust

crypt32

CertFindCertificateInStore
CryptDecodeObject
CertFreeCertificateContext
CryptQueryObject
CryptMsgGetParam
CertGetNameStringW
CertCloseStore
CryptMsgClose

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

Exports

Exports

AES_cbc_encrypt
AES_decrypt
AES_encrypt
AES_set_decrypt_key
AES_set_encrypt_key
AddFile
AdjustPriveleges
AtomCopyFileA
AtomCopyFileW
BavCommonInit
BavCommonUnInit
BdSignTimeToSystemTime
BinaryData2HexStr
BitmapFromIcon
BitmapFromIconEx
ByteToGBA
ByteToGBExA
ByteToGBExW
ByteToGBW
CLSIDToStringA
CLSIDToStringW
CalcElapsedTimeA
CalcElapsedTimeW
CalcFileMD5A
CalcFileMD5W
CalcStrMd5
CallSHGetImageList
ChangeWindowMessageFilter
CloseZip
CompareVersionExA
CompareVersionExW
ContinueService
ControlServiceInt
CreateGrayIcon
CreateNamedShareMemA
CreateNamedShareMemW
CreateShortCutA
CreateShortCutW
CreateZip
CreateZipBuf
CreateZipHandle
DecodeFromFileA
DecodeFromFileB
DecodeFromFileW
DeleteServiceInt
EnableFileEveryoneRWPrivilege
EncodeToFileA
EncodeToFileB
EncodeToFileW
ExtractFile
FindFileAndSelectA
FindFileAndSelectW
ForceBringWindowToTop
GetActiveDesktopToken
GetActiveUserSessionToken
GetAuthSignIssuerNameA
GetAuthSignIssuerNameW
GetAuthSignOwnerNameA
GetAuthSignOwnerNameW
GetAuthSignTimeA
GetAuthSignTimeW
GetBasePathA
GetBasePathW
GetBavInstallDirA
GetBavInstallDirW
GetCommonAppDataFolderA
GetCommonAppDataFolderW
GetCurrentDateTimeA
GetCurrentDateTimeW
GetCurrentLocaleNetTimeA
GetCurrentLocaleNetTimeW
GetCurrentUserSidA
GetCurrentUserSidW
GetDateTimeA
GetDateTimeW
GetDefaultBrowserInfo
GetDefaultBrowserInfoEx
GetFileCompanyNameA
GetFileCompanyNameW
GetFileIconA
GetFileIconW
GetFileLastWriteTimeStringA
GetFileLastWriteTimeStringW
GetFileLastWriteTimeTime64A
GetFileLastWriteTimeTime64W
GetFileProductDescA
GetFileProductDescW
GetFileProductNameA
GetFileProductNameExA
GetFileProductNameExW
GetFileProductNameW
GetFileProductVersionA
GetFileProductVersionW
GetFileSizeByNameA
GetFileSizeByNameExA
GetFileSizeByNameExW
GetFileSizeByNameW
GetFileVersionA
GetFileVersionW
GetGUIDForDllMainPatchA
GetGUIDForDllMainPatchW
GetInstallChannel
GetInstallChannelEx
GetInternetTime
GetLocalAppDataDirA
GetLocalAppDataDirW
GetLocalDateTimeA
GetLocalDateTimeW
GetLocaleDateTimeA
GetLocaleDateTimeW
GetNormalUniqueUserIDA
GetNormalUniqueUserIDW
GetNormalUniqueUserIDWOld
GetNumberOfProcessors
GetOSVer
GetOSVerStrA
GetOSVerStrW
GetParentPid
GetParentProcess
GetPathAppNameA
GetPathAppNameW
GetProcessPathByPid
GetProcessorNameString
GetServiceStatus
GetTaskbarEdge
GetUniqueUserIDA
GetUniqueUserIDOld
GetUniqueUserIDW
GetUserDataPathA
GetUserDataPathW
GetUserType
GetVersionInfo
GetVersionInfoEx
GetWindowRightBottom
HexStr2BinaryData
InstallService
IsAuthSignValidA
IsAuthSignValidW
IsFileExistA
IsFileExistW
IsFileRWAbleA
IsFileRWAbleW
IsFileReadAbleA
IsFileReadAbleW
IsFileWriteAbleA
IsFileWriteAbleW
IsNetWorkOKTried
IsReservedDevName
IsServiceInstall
IsSvcCanBeStop
IsUserLoggedOn
IsVistaOrAbove
IsWin64Os
MD5Final
MD5Init
MD5Transform
MD5Update
MinimizeMemory
MultiByte2WideChar
NoCardGetFileIconA
NoCardGetFileIconNoExceptA
NoCardGetFileIconNoExceptW
NoCardGetFileIconW
PathIsFile
PauseService
QueryServiceStatusInt
RegisterPowerSettingNotificationEx
ReleasePriveleges
RunExeA
RunExeW
SafeDelFileA
SafeDelFileW
SetObjectToLowIntegrity
SetRegKeySecurityA
SetRegKeySecurityW
SetTopWindow
ShellExecuteBDA
ShellExecuteBDW
ShowWindowAtRightBot
ShowWindowAtRightBotXY
ShowWindowAtRightBottom
ShowWindowAtRightSlide
SimpleXorEncrypt
StartAppActiveUser_Safe_Ex
StartAppForUser_Safe
StartServiceInt
StartUserAppInSrv
StopService
StringToTimetA
StringToTimetW
SystemTimeToStringA
SystemTimeToStringW
TimetToSystemTime
UnregisterPowerSettingNotificationEx
WTSQueryUserToken_Safe
WideChar2MultiByte
ZipAddBuf
ZipAddFile
ZipAddFolder
ZipAddHandle
ZipAddHandleLen
crc32
crypt_md5

Sections

.text
Size: 324KB - Virtual size: 323KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BavFi.dll
.dll windows:5 windows x86 arch:x86

39e9fccf933f9cc1793ed58cf4a9937f

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:9d:51:1c:5f:ef:71:94:1f:81:00:ba:2f:5a:85:f0:f4:6d:f7:15
Signer

Actual PE Digest

78:9d:51:1c:5f:ef:71:94:1f:81:00:ba:2f:5a:85:f0:f4:6d:f7:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavFi.pdb

Imports

kernel32

GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
RaiseException
GetLastError
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
WriteFile
GetStdHandle
GetModuleFileNameA
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
RtlUnwind
InitializeCriticalSectionAndSpinCount

Exports

Exports

DllGetClassObject
FastCheckerFileFormat

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BavPe.dll
.dll windows:5 windows x86 arch:x86

b9dbb474e56712beb61c6179c24b61fa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/04/2012, 00:00

Not After

24/04/2015, 23:59

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

57:b9:2e:c1:ac:aa:63:04:13:d4:77:d2:c8:42:7a:d3:d6:fa:4c:24
Signer

Actual PE Digest

57:b9:2e:c1:ac:aa:63:04:13:d4:77:d2:c8:42:7a:d3:d6:fa:4c:24

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavPe.pdb

Imports

log

WriteLog

kernel32

GetFileType
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RaiseException
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
HeapSize
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW

Exports

Exports

?CheckPeInfo@CBavPe@@UAEJW4_BAVPE_CHECK_INFO_TYPE@@PAU_BAVPE_DATA_INFO@@@Z
?FilePosToRVA@CBavPe@@UAEJIPAI@Z
?GetCloudSign@CBavPe@@UAEJQAI@Z
?GetDosHeader@CBavPe@@UAEJPAU_BAV_IMAGE_DOS_HEADER@@I@Z
?GetDosHeaderPtr@CBavPe@@UAEJAAPAU_BAV_IMAGE_DOS_HEADER@@@Z
?GetEntryPoint@CBavPe@@UAEIXZ
?GetFileMap@CBavPe@@UAEPAEXZ
?GetFileSize@CBavPe@@UAEIXZ
?GetFullPathNameW@CBavPe@@UAEPAGXZ
?GetHeapSize@CBavPe@@UAEIXZ
?GetImageBase@CBavPe@@UAEIXZ
?GetMD5@CBavPe@@UAEHPAE@Z
?GetMap@CBavPe@@UAEPAEXZ
?GetOverlayInfo@CBavPe@@UAEJAAPAEPAI@Z
?GetPeHeader@CBavPe@@UAEJPAU_BAV_IMAGE_NT_HEADERS32@@I@Z
?GetPeHeaderPtr@CBavPe@@UAEJAAPAU_BAV_IMAGE_NT_HEADERS32@@@Z
?GetPeInfo@CBavPe@@UAEJW4_BAVPE_GET_INFO_TYPE@@PAU_BAVPE_DATA_INFO@@@Z
?GetReservedHeapSize@CBavPe@@UAEIXZ
?GetReservedStackSize@CBavPe@@UAEIXZ
?GetSecIndexByOffset@CBavPe@@UAEJIAAH@Z
?GetSecIndexByRVA@CBavPe@@UAEJIAAH@Z
?GetSectionHeaderPtr@CBavPe@@UAEJAAPAU_BAV_IMAGE_SECTION_HEADER@@@Z
?GetSectionHeaderPtrSafe@CBavPe@@UAEJAAPAU_BAV_IMAGE_SECTION_HEADER@@@Z
?GetSectionHeaderSafe@CBavPe@@UAEJPAU_BAV_IMAGE_SECTION_HEADER@@I@Z
?GetSectionNum@CBavPe@@UAEHXZ
?GetSizeOfImage@CBavPe@@UAEIXZ
?GetStackSize@CBavPe@@UAEIXZ
?Init@CBavPe@@UAEJPAEIPAGH@Z
?IsSecurityDataOK@CBavPe@@UAEHXZ
?IsX64@CBavPe@@UAEHXZ
?LoadPE@CBavPe@@UAEJPAEI@Z
?RVAToFilePos@CBavPe@@UAEJIPAI@Z
?Read@CBavPe@@UAEJHPAEPAH@Z
?ReadByOffset@CBavPe@@UAEJHPAEHHPAH@Z
?RemoveLastSection@CBavPe@@UAEJXZ
?RestoreDosHdr@CBavPe@@UAEJPAU_BAV_IMAGE_DOS_HEADER@@I@Z
?RestorePeHeader@CBavPe@@UAEJPAU_BAV_IMAGE_NT_HEADERS32@@I@Z
?RestoreSectionHdr@CBavPe@@UAEJPAU_BAV_IMAGE_SECTION_HEADER@@I@Z
?Seek@CBavPe@@UAEJHHPAH@Z
?SetFileSize@CBavPe@@UAEJIH@Z
?SetImageBase@CBavPe@@UAEXI@Z
?SetPeInfo@CBavPe@@UAEJW4_BAVPE_SET_INFO_TYPE@@PAU_BAVPE_DATA_INFO@@@Z
?UnInit@CBavPe@@UAEXXZ
?Write@CBavPe@@UAEJHPAEPAH@Z
?WriteByOffset@CBavPe@@UAEJHPAEHHPAH@Z
DllGetClassObject
DllReleaseClassObject

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BavQv.dll
.dll windows:5 windows x86 arch:x86

137c2f21e38482ac76bafdcbdb74b740

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:dc:3f:b9:cc:52:e0:64:b7:81:5d:68:f2:0d:b9:81:8a:77:18:64
Signer

Actual PE Digest

4b:dc:3f:b9:cc:52:e0:64:b7:81:5d:68:f2:0d:b9:81:8a:77:18:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavQv.pdb

Imports

log

WriteLog

kernel32

CreateDirectoryW
CreateFileW
DeviceIoControl
ReadFile
CreateFileMappingW
MapViewOfFile
GetLastError
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryW
GetProcAddress
CloseHandle
CompareStringW
UnmapViewOfFile
GetCPInfo
CompareStringA
GetProcessHeap
GetSystemTimeAsFileTime
GetFileAttributesW
MoveFileW
GetCurrentThreadId
GetCommandLineA
HeapAlloc
HeapFree
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
WideCharToMultiByte
GetTimeZoneInformation
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
MultiByteToWideChar
WriteFile
GetConsoleCP
GetConsoleMode
RtlUnwind
SetEnvironmentVariableA
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetTimeFormatA
GetDateFormatA
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
VirtualAlloc
HeapSize
SetStdHandle
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
CreateFileA
SetEndOfFile

advapi32

RegQueryValueExW
RegCloseKey
RegCreateKeyExW

shlwapi

PathIsDirectoryW
PathRemoveFileSpecW

Exports

Exports

?Bd_Quarantine@@YAKPAU_QUARANTINE_HEADER@@PB_W@Z
?Bd_ReadFileBlock@@YAKPB_WKPAKPAX@Z
?Bd_ReadFilePayloadInfo@@YAKPB_WPAKQA_WPAPAU_QUARANTINE_HEADER@@@Z
?Bd_ReadFilePayloadSize@@YAKPB_WPAKPAPAU_QUARANTINE_HEADER@@@Z
?Bd_ReadQHeader@@YAKPAPAU_QUARANTINE_HEADER@@PB_W@Z
?Bd_ReleaseQHeader@@YAXPAPAU_QUARANTINE_HEADER@@@Z
?Bd_Restore@@YAKPAPAU_QUARANTINE_HEADER@@PB_W@Z
?Bd_RestoreEx@@YAKPAPAU_QUARANTINE_HEADER@@PB_W1@Z
?Bd_SetQFileRptStat@@YAKPB_WK@Z

Sections

.text
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BavScan.dll
.dll windows:5 windows x86 arch:x86

5388e674421a4bc22be9f19884b4f565

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:ba:a7:22:26:5a:1f:f4:b4:83:37:52:9d:ee:f6:c2:70:49:c6:72
Signer

Actual PE Digest

4d:ba:a7:22:26:5a:1f:f4:b4:83:37:52:9d:ee:f6:c2:70:49:c6:72

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavScan.pdb

Imports

shlwapi

StrRChrW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW

log

WriteLog

kernel32

GetPrivateProfileStringW
WideCharToMultiByte
Sleep
GetModuleFileNameW
GetTimeZoneInformation
MultiByteToWideChar
lstrlenW
ReleaseSemaphore
WritePrivateProfileStringW
GetPrivateProfileIntW
InterlockedExchange
FindClose
ResetEvent
CreateSemaphoreW
GetExitCodeThread
CreateEventW
FindNextFileW
CloseHandle
DeleteFileW
CreateThread
GetModuleHandleW
IsBadReadPtr
GetLocalTime
CreateFileW
DeviceIoControl
SetLastError
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetEvent
GetCurrentProcess
TerminateProcess
InitializeCriticalSection
GetTickCount
SetStdHandle
WriteConsoleW
InterlockedCompareExchange
WaitForSingleObject
CreateDirectoryW
MoveFileExW
lstrlenA
FindFirstFileW
DeleteCriticalSection
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryW
InterlockedDecrement
GetModuleHandleA
InterlockedIncrement
FreeLibrary
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
LoadLibraryA
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsBadCodePtr
CreateFileA
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetFilePointer
FlushFileBuffers
HeapFree
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetFileAttributesW
HeapReAlloc
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
ExitProcess
HeapSize
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode

advapi32

RegQueryValueExW
RegCreateKeyExW
RegCloseKey

Exports

Exports

DllGetClassObject

Sections

.text
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BavSig.dll
.dll windows:5 windows x86 arch:x86

e2fc45e7536d85fb92c37cbc3a9a9cdc

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

85:5b:b2:44:2f:d0:2c:4f:f8:ca:2e:66:c2:27:d3:4f:f3:61:84:42
Signer

Actual PE Digest

85:5b:b2:44:2f:d0:2c:4f:f8:ca:2e:66:c2:27:d3:4f:f3:61:84:42

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavSig.pdb

Imports

log

WriteLog

kernel32

EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
GetThreadPriority
GetCurrentThread
SetThreadPriority
Sleep
SetFilePointerEx
GetLastError
DeleteCriticalSection
CreateFileW
CloseHandle
GetFileSizeEx
GetPrivateProfileStringW
MoveFileExW
CopyFileW
DeleteFileW
InterlockedCompareExchange
InterlockedExchange
LoadLibraryW
GetProcAddress
InitializeCriticalSection
ReadFile
WriteFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
HeapFree
GetFileAttributesW
HeapReAlloc
HeapAlloc
RaiseException
RtlUnwind
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers

advapi32

RegQueryValueExW
RegCloseKey
RegCreateKeyExW

Exports

Exports

DllGetClassObject

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BavUa.dll
.dll windows:5 windows x86 arch:x86

0894ffa293e5d3bd37c3432a4268f9cc

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

99:31:bb:82:ff:93:75:15:c3:e6:12:60:d6:98:d4:72:d5:27:84:c3
Signer

Actual PE Digest

99:31:bb:82:ff:93:75:15:c3:e6:12:60:d6:98:d4:72:d5:27:84:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavUa.pdb

Imports

kernel32

AreFileApisANSI
GetFullPathNameW
GetFullPathNameA
GetTempFileNameW
SearchPathW
lstrlenA
CreateDirectoryW
SetFileTime
GetWindowsDirectoryA
CreateFileW
GetTempPathW
CreateDirectoryA
SetCurrentDirectoryA
GetLastError
GetCurrentDirectoryW
SetLastError
MoveFileW
RemoveDirectoryA
SearchPathA
SetFileAttributesA
GetTempFileNameA
MoveFileA
SetCurrentDirectoryW
RemoveDirectoryW
GetCurrentDirectoryA
CloseHandle
GetWindowsDirectoryW
DeleteFileW
GetTempPathA
SetFileAttributesW
DeleteFileA
FindFirstFileW
FindFirstFileA
FindClose
FindNextFileA
FindNextFileW
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
ReadFile
GetCurrentProcess
GetProcAddress
CompareFileTime
GetSystemInfo
FileTimeToDosDateTime
DosDateTimeToFileTime
SystemTimeToFileTime
GetSystemTime
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
FileTimeToLocalFileTime
GetStdHandle
WaitForMultipleObjects
VirtualFree
VirtualAlloc
GetVersionExA
WaitForSingleObject
SetEvent
CreateEventA
CreateSemaphoreA
ReleaseSemaphore
ResetEvent
LocalFileTimeToFileTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetModuleFileNameA
LoadLibraryA
FreeLibrary
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileA
DisableThreadLibraryCalls
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
HeapReAlloc
ExitThread
CreateThread
GetCommandLineA
RaiseException
RtlUnwind
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
HeapSize
ExitProcess
HeapCreate
HeapDestroy
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
SetStdHandle

user32

CharUpperA
CharLowerW
CharLowerA
CharUpperW
CharNextA
CharPrevExA

oleaut32

SysStringByteLen
SysFreeString
SysAllocStringByteLen
VariantCopy
VariantClear
SysAllocString

Exports

Exports

LoadUnarcCom

Sections

.text
Size: 1004KB - Virtual size: 1004KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BavVt.dll
.dll windows:5 windows x86 arch:x86

1109ebb2a0d7eac8ffba8ac432c8308c

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a5:88:99:67:24:de:74:f6:e2:a1:ad:43:53:92:fb:05:4f:93:a0:5d
Signer

Actual PE Digest

a5:88:99:67:24:de:74:f6:e2:a1:ad:43:53:92:fb:05:4f:93:a0:5d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavVt.pdb

Imports

wintrust

CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
WinVerifyTrustEx

crypt32

CertGetNameStringW

log

WriteLog

kernel32

WriteConsoleA
SetStdHandle
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetConsoleMode
GetConsoleCP
GetLastError
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
FlushFileBuffers
FreeLibrary
LoadLibraryW
GetSystemDirectoryW
LocalAlloc
LocalFree
CloseHandle
CreateFileW
GetWindowsDirectoryW
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedCompareExchange
Sleep
InterlockedExchange
SetFilePointer
GetProcAddress
GetModuleHandleW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetFileAttributesW
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW

user32

wsprintfW

advapi32

RegQueryValueExW
RegCloseKey
RegCreateKeyExW

Exports

Exports

DllGetClassObject

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BavWl.dll
.dll windows:5 windows x86 arch:x86

ee7c07cd5d86c5c802ad82bf1ec8d431

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7a:6d:28:ee:21:cb:14:89:55:5a:7d:8a:34:0c:7f:ad:88:a3:af:61
Signer

Actual PE Digest

7a:6d:28:ee:21:cb:14:89:55:5a:7d:8a:34:0c:7f:ad:88:a3:af:61

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavWl.pdb

Imports

log

WriteLog

kernel32

HeapCreate
WideCharToMultiByte
lstrlenW
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
CreateThread
SetEvent
WaitForSingleObject
GetModuleFileNameW
CreateFileW
CreateEventW
ResumeThread
FindFirstFileW
FindClose
DeleteFileW
DeleteFileA
GetPrivateProfileStringW
WriteFile
InterlockedExchange
MultiByteToWideChar
lstrlenA
GetPrivateProfileIntW
InterlockedCompareExchange
Sleep
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetTickCount
GetLocalTime
SetFilePointerEx
ReadFile
GetFileSizeEx
LoadLibraryW
GetProcAddress
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
RaiseException
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
RtlUnwind
LoadLibraryA
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

shlwapi

PathFileExistsW

Exports

Exports

DllGetClassObject

Sections

.text
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BsrScan/BavBsr.dll
.dll windows:5 windows x86 arch:x86

65607c094d99c9054d687112abbabcac

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/04/2012, 00:00

Not After

24/04/2015, 23:59

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8e:c1:69:ee:55:41:aa:b5:ca:82:33:27:4f:81:b6:ba:3d:8c:b1:98
Signer

Actual PE Digest

8e:c1:69:ee:55:41:aa:b5:ca:82:33:27:4f:81:b6:ba:3d:8c:b1:98

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\jenkins\workspace\av-green_5-1-1_workspace\btbsrscan\output\pdb\release\BavBsr.pdb

Imports

sfc

SfcIsFileProtected

iphlpapi

GetAdaptersAddresses

shlwapi

PathFileExistsW
PathIsFileSpecW
PathIsDirectoryW
PathRenameExtensionW
PathFindFileNameW
PathAppendW
PathRemoveFileSpecW

wtsapi32

WTSQueryUserToken

bavqv

?Bd_ReleaseQHeader@@YAXPAPAU_QUARANTINE_HEADER@@@Z
?Bd_RestoreEx@@YAKPAPAU_QUARANTINE_HEADER@@PB_W1@Z
?Bd_Quarantine@@YAKPAU_QUARANTINE_HEADER@@PB_W@Z

kernel32

CopyFileW
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
OpenProcess
TerminateProcess
GetFileSize
ExpandEnvironmentStringsW
GetSystemDirectoryW
GetEnvironmentVariableW
GetSystemInfo
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
DeviceIoControl
GlobalAlloc
GlobalFree
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
QueryDosDeviceW
GetLongPathNameW
InterlockedCompareExchange
GetCurrentProcess
SetFilePointerEx
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
GetSystemTime
lstrcpyW
lstrcatW
GetFileSizeEx
SetFilePointer
SetLastError
FileTimeToSystemTime
LocalFree
GetDiskFreeSpaceExW
VirtualAlloc
VirtualFree
MapViewOfFile
GetLocalTime
IsBadReadPtr
GetModuleHandleA
GetFileInformationByHandle
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
SetFileTime
InterlockedExchangeAdd
GetCurrentProcessId
OpenThread
HeapAlloc
GetProcessHeap
HeapFree
DisconnectNamedPipe
WriteFileEx
CreateNamedPipeW
ConnectNamedPipe
ReadFileEx
GetOverlappedResult
InitializeCriticalSectionAndSpinCount
GetModuleHandleExW
WaitNamedPipeW
SetNamedPipeHandleState
GetCurrentThreadId
SwitchToThread
OutputDebugStringW
WriteFile
FlushFileBuffers
QueryPerformanceFrequency
OutputDebugStringA
CreateEventA
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
WTSGetActiveConsoleSessionId
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
SetEndOfFile
Process32NextW
Process32FirstW
ProcessIdToSessionId
CreateFileA
GetFullPathNameW
GetFullPathNameA
TlsGetValue
UnlockFile
LockFile
TlsSetValue
GetTempPathW
LockFileEx
TlsAlloc
GetTempPathA
DeleteFileA
GetLocaleInfoA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapCreate
GetModuleFileNameA
GetStdHandle
ExitProcess
TlsFree
GetCPInfo
LCMapStringW
LCMapStringA
MoveFileW
LoadLibraryA
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReadFile
CreateFileW
FindNextFileW
FindClose
FindFirstFileW
DeleteFileW
CreateDirectoryW
GetPrivateProfileIntW
GetTimeZoneInformation
GetSystemDefaultLangID
GetVersionExW
VerifyVersionInfoW
VerSetConditionMask
GetNativeSystemInfo
GetWindowsDirectoryW
GetPrivateProfileStringW
GetModuleHandleW
lstrlenW
WideCharToMultiByte
Sleep
GetTickCount
LoadLibraryW
FreeLibrary
GetModuleFileNameW
GetProcAddress
TerminateThread
ResetEvent
CreateEventW
SetEvent
CreateThread
InterlockedExchange
lstrlenA
GetLastError
MultiByteToWideChar
ResumeThread
WaitForSingleObject
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
GetPrivateProfileSectionW
CreateMutexW
HeapDestroy
HeapReAlloc
GetFileAttributesA
MoveFileExW
ExitThread
RaiseException
HeapSize
GetACP

user32

PostMessageW
GetClassInfoW
RegisterClassW
CreateWindowExW
SetWindowLongW
MsgWaitForMultipleObjectsEx
PeekMessageW
TranslateMessage
DispatchMessageW
GetMessageW
KillTimer
SetTimer
DestroyWindow
DefWindowProcW
GetDesktopWindow
ExitWindowsEx
PostQuitMessage
SendMessageW
SendMessageTimeoutW
IsWindow
GetWindowLongW
wsprintfW
GetSystemMetrics
FindWindowExW
GetWindowThreadProcessId

advapi32

RegEnumKeyExW
RevertToSelf
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptDuplicateKey
CryptDeriveKey
CryptAcquireContextW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ImpersonateLoggedOnUser
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetAce
GetAclInformation
AddAce
InitializeAcl
EqualSid
IsValidSid
GetLengthSid
CopySid
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
FreeSid
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
AllocateAndInitializeSid
DeleteService
CreateServiceW
QueryServiceStatusEx
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegRestoreKeyW
RegSetValueExW
RegSaveKeyW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegCloseKey

shell32

SHGetPathFromIDListW
ShellExecuteW
SHGetFolderPathW
SHFileOperationW
SHGetSpecialFolderPathW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateGuid

oleaut32

SystemTimeToVariantTime
VariantClear
VariantInit
SysStringLen
SysAllocString
SysFreeString

ntdll

RtlSetLastWin32Error
RtlNtStatusToDosError
RtlFormatCurrentUserKeyPath
RtlFreeUnicodeString
RtlUnwind
ZwReadVirtualMemory
ZwQueryInformationProcess
ZwQuerySystemInformation
ZwTerminateProcess

userenv

ExpandEnvironmentStringsForUserW

imm32

ImmDisableIME

psapi

GetModuleBaseNameW
GetProcessImageFileNameW

wintrust

WinVerifyTrust

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

htons
__WSAFDIsSet
select
sendto
inet_ntoa
closesocket
WSAGetLastError
socket
WSCDeinstallProvider
WSCGetProviderPath
WSCEnumProtocols
WSACleanup
WSAStartup
getpeername
ioctlsocket
connect
getsockname
shutdown
setsockopt
recv
bind
inet_addr
getsockopt
listen
accept
ntohl
ntohs
gethostbyname
recvfrom
send

Exports

Exports

GetClassObject
_sqlite3_key_interop@12
_sqlite3_rekey_interop@12

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 420KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 126KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BsrScan/BsrScript.dll
.dll windows:5 windows x86 arch:x86

62157640b96a689e386572362099b24f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/04/2012, 00:00

Not After

24/04/2015, 23:59

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ad:9b:ae:35:e4:2c:81:4a:17:af:fd:cc:b2:d9:60:00:35:9f:5c
Signer

Actual PE Digest

2c:ad:9b:ae:35:e4:2c:81:4a:17:af:fd:cc:b2:d9:60:00:35:9f:5c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\jenkins\workspace\av-green_5-1-1_workspace\btbsrscan\output\pdb\Release\BsrScript.pdb

Imports

ntdll

RtlUnwind
ZwQuerySystemInformation
ZwQueryInformationThread
ZwQueryInformationProcess
ZwReadVirtualMemory

kernel32

GetModuleHandleA
LoadLibraryA
InterlockedIncrement
CreateThread
WaitForSingleObject
TlsAlloc
TlsFree
TlsSetValue
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetPrivateProfileStringW
OpenThread
Module32FirstW
Module32NextW
QueryDosDeviceW
GetSystemDirectoryW
GetTimeFormatA
GetDateFormatA
FreeLibrary
WTSGetActiveConsoleSessionId
LocalFree
FileTimeToSystemTime
VerSetConditionMask
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
HeapFree
HeapAlloc
GetProcessHeap
SetEndOfFile
ProcessIdToSessionId
SetLastError
SetFilePointer
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
GetACP
FlushFileBuffers
QueryPerformanceFrequency
OutputDebugStringA
FormatMessageA
GetModuleFileNameA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreatePipe
FileTimeToLocalFileTime
SystemTimeToFileTime
VirtualQuery
GetVersionExW
TlsGetValue
GetFileSize
TerminateProcess
GetFileAttributesW
RemoveDirectoryW
DeleteFileW
WriteFile
ReadFile
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
SetEnvironmentVariableA
lstrlenA
MultiByteToWideChar
LoadLibraryW
lstrlenW
WideCharToMultiByte
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetTickCount
Sleep
CloseHandle
GetLastError
ExpandEnvironmentStringsW
GetCurrentProcess
GetModuleHandleW
GetProcAddress
InterlockedCompareExchange
CreateDirectoryW
GetPrivateProfileIntW
GetModuleFileNameW
DisableThreadLibraryCalls
InterlockedExchange
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
VerifyVersionInfoW
CreateFileA
GetFileAttributesA
CompareStringW
CompareStringA
GetTimeZoneInformation
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
VirtualAlloc
VirtualFree
HeapCreate
GetStdHandle
IsValidCodePage
GetOEMCP
GetCPInfo
LCMapStringW
LCMapStringA
DeleteFileA
MoveFileA
DuplicateHandle
CreateProcessA
ExitProcess
MoveFileW
RaiseException
GetSystemTimeAsFileTime
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapSize
HeapReAlloc
HeapDestroy
InterlockedDecrement

user32

wsprintfW

advapi32

GetSecurityDescriptorSacl
GetAce
GetAclInformation
AddAce
InitializeAcl
EqualSid
IsValidSid
GetLengthSid
CopySid
SetSecurityDescriptorSacl
LookupPrivilegeValueW
AdjustTokenPrivileges
AllocateAndInitializeSid
GetNamedSecurityInfoW
SetEntriesInAclW
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
CloseServiceHandle
EnumServicesStatusW
OpenSCManagerW
RegSetValueExW
RegDeleteKeyW
RegQueryValueExW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteValueW
ImpersonateLoggedOnUser
RevertToSelf
RegCloseKey

shell32

SHGetSpecialFolderPathW

shlwapi

PathRemoveFileSpecW
PathAppendW
PathFindFileNameW
PathRenameExtensionW
PathIsDirectoryW
PathFileExistsW

userenv

ExpandEnvironmentStringsForUserW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetMappedFileNameW
GetProcessImageFileNameW

wtsapi32

WTSQueryUserToken

Exports

Exports

GetScriptEngine
InitScriptDll
ReleaseScriptInterface
UninitScriptDll

Sections

.text
Size: 620KB - Virtual size: 620KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BsrScan/bl.dat
Cloud Security/BsrScan/bsr_info.ini
Cloud Security/BsrScan/bsrbc.sys
.sys windows:6 windows x86 arch:x86

d42f69f12164fefb8225c424717a150a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/04/2012, 00:00

Not After

24/04/2015, 23:59

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:9e:d7:9b:af:00:5e:fd:af:cc:69:33:1b:28:da:5b:09:7d:62:6d
Signer

Actual PE Digest

4c:9e:d7:9b:af:00:5e:fd:af:cc:69:33:1b:28:da:5b:09:7d:62:6d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\code\btbsrscan\src\bsrbc\objfre_wxp_x86\i386\bsrbc.pdb

Imports

ntoskrnl.exe

ExFreePoolWithTag
ZwClose
ExAllocatePoolWithTag
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
ZwDeleteValueKey
ZwSetValueKey
RtlGetVersion
memset
memmove
IoDeleteSymbolicLink
IoCreateSymbolicLink
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
IoBuildSynchronousFsdRequest
KeInitializeEvent
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
MmGetSystemRoutineAddress
ZwWriteFile
KeQuerySystemTime
ZwQueryInformationFile
IoCreateFile
ZwSetInformationFile
_alldiv
PsTerminateSystemThread
PsSetCreateProcessNotifyRoutine
PsCreateSystemThread
_strnicmp
PsGetProcessImageFileName
PsLookupProcessByProcessId
IoRegisterBootDriverReinitialization
InitSafeBootMode
memcpy
ObQueryNameString
RtlCompareUnicodeString
RtlAppendUnicodeToString
InterlockedPopEntrySList
InterlockedPushEntrySList
IoGetStackLimits
_vsnwprintf
ExInitializeNPagedLookasideList
ZwLoadKey
ZwUnloadKey
KeSetEvent
ZwDeleteKey
ZwEnumerateKey
ExDeleteNPagedLookasideList
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
KeTickCount
KeBugCheckEx
RtlUnwind

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BsrScan/bsrbc64.sys
.sys windows:6 windows x64 arch:x64

45ef71b12c7c24d2cc8917845028a98e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/04/2012, 00:00

Not After

24/04/2015, 23:59

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:0c:a8:cb:23:a6:63:90:4a:62:7d:5e:00:25:20:db:26:70:65:81
Signer

Actual PE Digest

04:0c:a8:cb:23:a6:63:90:4a:62:7d:5e:00:25:20:db:26:70:65:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\code\btbsrscan\src\bsrbc\objfre_win7_amd64\amd64\bsrbc.pdb

Imports

ntoskrnl.exe

_strnicmp
ExAllocatePoolWithTag
IoDeleteSymbolicLink
ExFreePoolWithTag
PsGetProcessImageFileName
PsLookupProcessByProcessId
IoBuildSynchronousFsdRequest
IoGetRelatedDeviceObject
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoCreateFile
KeInitializeEvent
RtlGetVersion
ZwDeleteValueKey
ZwSetValueKey
PsSetCreateProcessNotifyRoutine
ZwSetInformationFile
IoFileObjectType
PsCreateSystemThread
IoRegisterBootDriverReinitialization
ZwQueryValueKey
PsTerminateSystemThread
InitSafeBootMode
ZwClose
ObReferenceObjectByHandle
KeWaitForSingleObject
IoCreateSymbolicLink
ObfDereferenceObject
ZwQueryInformationFile
ZwWriteFile
IofCallDriver
ZwOpenKey
RtlAppendUnicodeToString
ObQueryNameString
RtlCompareUnicodeString
ZwUnloadKey
ExInitializeNPagedLookasideList
IoGetStackLimits
KeSetEvent
ExpInterlockedPushEntrySList
ExpInterlockedPopEntrySList
_vsnwprintf
RtlAppendUnicodeStringToString
ExQueryDepthSList
ZwLoadKey
RtlCopyUnicodeString
ZwDeleteKey
ExDeleteNPagedLookasideList
ZwEnumerateKey
KeBugCheckEx
__C_specific_handler

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BsrScan/bsrconfig.ini
Cloud Security/BsrScan/cl.dat
Cloud Security/BsrScan/qy.dat
Cloud Security/BsrScan/sc.dat
Cloud Security/BsrScan/script_info.ini
Cloud Security/BsrScan/symsrv.dll
.dll windows:6 windows x86 arch:x86

66026dd065c0fdaacc7a099606dc55c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

symsrv.pdb

Imports

msvcrt

_onexit
__dllonexit
_adjust_fdiv
towlower
_purecall
wcsncmp
__unDName
isdigit
wcstol
bsearch
qsort
strchr
strncmp
??_V@YAXPAX@Z
_amsg_exit
_initterm
_XcptFilter
_fileno
_iob
_isatty
_write
__pioinfo
__badioinfo
_lseek
wctomb
_itoa
_snprintf
isleadbyte
__mb_cur_max
mbtowc
malloc
free
_errno
_wtoi64
_wcslwr
memcpy
strrchr
wcsstr
??3@YAXPAX@Z
??2@YAPAXI@Z
_stricmp
getenv
isspace
_wcsicmp
_wcsnicmp
wcschr
memset

kernel32

InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
GetVersion
GetSystemInfo
SetLastError
GetLastError
LocalAlloc
LocalReAlloc
LocalFree
CloseHandle
WriteFile
GetCurrentProcess
DebugBreak
LoadLibraryA
WaitForSingleObject
SetWaitableTimer
GetSystemTime
CreateThread
ReadFile
GetFileTime
GetFileSize
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
SetFilePointer
DeleteFileA
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetFileInformationByHandle
ReleaseMutex
GlobalFree
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedExchange
Sleep
InterlockedCompareExchange
OutputDebugStringA
RtlUnwind
FreeLibrary
CompareStringA
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
RaiseException
GetSystemTimeAsFileTime

advapi32

EqualSid
AllocateAndInitializeSid
FreeSid
GetTokenInformation
OpenProcessToken
RegCloseKey

Exports

Exports

EulaDlgProc
RunDllEntry
SymbolServer
SymbolServerByIndex
SymbolServerByIndexW
SymbolServerClose
SymbolServerDeltaName
SymbolServerDeltaNameW
SymbolServerGetIndexString
SymbolServerGetIndexStringW
SymbolServerGetOptions
SymbolServerGetSupplement
SymbolServerGetSupplementW
SymbolServerGetVersion
SymbolServerIsStore
SymbolServerIsStoreW
SymbolServerPing
SymbolServerPingW
SymbolServerSetOptions
SymbolServerSetOptionsW
SymbolServerStoreFile
SymbolServerStoreFileW
SymbolServerStoreSupplement
SymbolServerStoreSupplementW
SymbolServerW
httpCloseHandle
httpOpenFileHandle
httpOpenFileHandleW
httpQueryDataAvailable
httpReadFile

Sections

.text
Size: 294KB - Virtual size: 293KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/BsrScan/symsrv.yes
Cloud Security/Communication.dll
.dll windows:5 windows x86 arch:x86

521c639f5d0b3fb45403294f52ae9ebf

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:21:ee:52:b2:33:52:8c:de:06:3e:26:a1:8e:7c:eb:b1:a8:03:3e
Signer

Actual PE Digest

1e:21:ee:52:b2:33:52:8c:de:06:3e:26:a1:8e:7c:eb:b1:a8:03:3e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\Communication.pdb

Imports

log

WriteLog

kernel32

LeaveCriticalSection
DeleteCriticalSection
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
lstrlenA
InterlockedIncrement
InterlockedDecrement
CloseHandle
CreateThread
SetEvent
WaitForSingleObject
GetModuleHandleW
GetModuleFileNameW
CreateFileW
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
GetTickCount
Sleep
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetTimeZoneInformation
WaitForMultipleObjects
EnterCriticalSection
SetFilePointer
WriteFile
TlsGetValue
TlsSetValue
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
DisableThreadLibraryCalls
TlsAlloc
TlsFree
GetProcessHeap
HeapFree
GetFileSize
ReadFile
SetLastError
HeapAlloc
ResetEvent
SwitchToThread
TerminateThread
LoadLibraryW
GetProcAddress
GetLastError
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
GlobalFree
GlobalAlloc
InterlockedCompareExchange
SetEnvironmentVariableA
CreateEventW
GetModuleHandleA
CompareStringW
CompareStringA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
SetEndOfFile
CreateFileA
GetDriveTypeA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
GetStringTypeW
GetStringTypeA
RaiseException
InitializeCriticalSection
HeapDestroy
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
GetCommandLineA
GetFileAttributesW
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
HeapCreate
VirtualFree
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetFullPathNameW
GetCurrentDirectoryA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

advapi32

RegQueryValueExA
RevertToSelf
RegOpenCurrentUser
ImpersonateLoggedOnUser
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCloseKey
RegCreateKeyExW

ole32

CoCreateGuid

shlwapi

PathAddBackslashW
PathAppendW
PathFindExtensionW
PathFileExistsW
PathRemoveFileSpecW

winhttp

WinHttpSetCredentials
WinHttpReadData
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpWriteData
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpen

Exports

Exports

CreateObject
_DllMain@12

Sections

.text
Size: 253KB - Virtual size: 253KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/Data/ac.dat
Cloud Security/Data/ag.dat
Cloud Security/Data/bh.dat
Cloud Security/Data/bhr.dat
Cloud Security/Data/bhw.dat
Cloud Security/Data/fs.dat
Cloud Security/Data/qs.dat
Cloud Security/Data/tg.dat
Cloud Security/ReportComm.dll
.dll windows:5 windows x86 arch:x86

b23ce2f098153fafe9a2f08f045c3611

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/04/2012, 00:00

Not After

24/04/2015, 23:59

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3e:c1:a4:b6:21:92:4f:8c:47:8f:05:a7:9b:b3:17:43:1f:b9:d6:f4
Signer

Actual PE Digest

3e:c1:a4:b6:21:92:4f:8c:47:8f:05:a7:9b:b3:17:43:1f:b9:d6:f4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\ReportComm.pdb

Imports

iphlpapi

GetAdaptersAddresses

log

WriteLog

kernel32

FindResourceW
FindResourceExW
ReadFile
GetModuleHandleW
DeleteFileW
GetCurrentProcessId
GetTickCount
HeapFree
HeapAlloc
GetProcessHeap
SetEndOfFile
CreateFileA
DeviceIoControl
InitializeCriticalSection
LoadResource
LockResource
SizeofResource
GetCurrentProcess
GlobalFree
TerminateThread
ReleaseSemaphore
CreateSemaphoreW
SetEvent
SetFilePointer
WriteFile
CreateDirectoryW
ReleaseMutex
CreateMutexW
GetCurrentThreadId
CreateFileW
WaitForSingleObject
CloseHandle
LocalFree
InterlockedDecrement
GetModuleHandleA
GetProcAddress
GetLocalTime
GetTimeZoneInformation
Sleep
InterlockedCompareExchange
GetPrivateProfileIntW
GetPrivateProfileStringW
InitializeCriticalSectionAndSpinCount
SetLastError
GetModuleFileNameW
InterlockedIncrement
lstrlenA
GetLastError
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileSectionNamesW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
LoadLibraryA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
ExitProcess
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
ExitThread
CreateThread
GetCommandLineA
RaiseException
RtlUnwind
HeapReAlloc
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree

advapi32

RegEnumValueW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyExW
GetSecurityDescriptorOwner
SetNamedSecurityInfoW
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegEnumKeyExW

shell32

SHFileOperationW
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoCreateGuid

shlwapi

PathIsDirectoryW
PathFileExistsW
PathAppendW
PathFindFileNameW

winhttp

WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpenRequest
WinHttpOpen
WinHttpSetTimeouts
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData

Exports

Exports

CreateObject

Sections

.text
Size: 313KB - Virtual size: 313KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/ReportCommRetry.exe
.exe windows:5 windows x86 arch:x86

d62b762a1257213f52d6bdfc588068e2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/04/2012, 00:00

Not After

24/04/2015, 23:59

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fc:1a:ab:85:e3:b3:68:d4:b2:9d:5a:be:be:04:62:4d:78:7a:77:84
Signer

Actual PE Digest

fc:1a:ab:85:e3:b3:68:d4:b2:9d:5a:be:be:04:62:4d:78:7a:77:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\bavOutput\Pdb\Release\ReportCommRetry.pdb

Imports

kernel32

CopyFileW
ReadFile
CreateFileW
GetProcAddress
CreateEventW
LoadLibraryW
SetLastError
GetCurrentProcess
FreeLibrary
SetEndOfFile
SetFilePointer
GetFileSize
LocalFree
CloseHandle
ReleaseMutex
GetLastError
InterlockedExchange
GetPrivateProfileIntW
lstrlenW
MultiByteToWideChar
GetTimeZoneInformation
GetModuleFileNameW
Sleep
WideCharToMultiByte
GetPrivateProfileStringW
InterlockedCompareExchange
WaitForSingleObject
lstrlenA
DeleteFileW
CreateMutexW
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetConsoleCP
GetConsoleMode

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetNamedSecurityInfoW

shell32

SHGetFolderPathW

log

WriteLog
CreateLog

shlwapi

PathFileExistsW
PathAppendW

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/log.dll
.dll windows:5 windows x86 arch:x86

b06b122df694eca4827596adc838ca43

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7f:22:3d:f1:0f:cd:08:ec:fa:e5:71:ec:e1:88:e7:6c:db:4f:53:9b
Signer

Actual PE Digest

7f:22:3d:f1:0f:cd:08:ec:fa:e5:71:ec:e1:88:e7:6c:db:4f:53:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\log.pdb

Imports

kernel32

LeaveCriticalSection
CreateFileW
GetACP
MultiByteToWideChar
FlushFileBuffers
GetLastError
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
CloseHandle
DeleteFileW
LocalFree
WideCharToMultiByte
WriteFile
OutputDebugStringW
SetFilePointer
QueryPerformanceFrequency
GetFileSize
HeapFree
HeapAlloc
GetTimeFormatA
GetDateFormatA
MoveFileW
GetSystemTimeAsFileTime
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
GetTimeZoneInformation
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
GetCPInfo
GetOEMCP
IsValidCodePage
RaiseException
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
RtlUnwind
LoadLibraryA
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateFileA

advapi32

GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorSacl

Exports

Exports

CloseLog
CreateLog
WriteData
WriteLog
WriteLogA
WriteVLog

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/mm.dat
Cloud Security/nsc.ini
Cloud Security/nwi.dat
Cloud Security/sc.ini
Cloud Security/sl.dat
Cloud Security/sqlite.dll
.dll windows:5 windows x86 arch:x86

dda36a7c934f3550f7f33bb648da1215

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

80:7f:4a:59:14:cf:6f:fe:82:fd:2a:9d:8b:d4:88:ef:bc:5c:25:ad
Signer

Actual PE Digest

80:7f:4a:59:14:cf:6f:fe:82:fd:2a:9d:8b:d4:88:ef:bc:5c:25:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\sqlite.pdb

Imports

kernel32

GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
LockFile
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
VirtualAlloc
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
GetTimeZoneInformation
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetModuleHandleA

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strnicmp
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_write_debug

Sections

.text
Size: 451KB - Virtual size: 450KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Cloud Security/version.xml
.xml
Cloud Security/vn.dat
Cloud Security/vr.dat
CloudOPTClient.exe
.exe windows:5 windows x86 arch:x86

2d52a9bdf17cc1fb77b5e8a9049059c3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:ef:0f:ac:dc:f1:72:46:8b:3c:b5:ff:40:f7:cd:c2:32:10:40:da
Signer

Actual PE Digest

15:ef:0f:ac:dc:f1:72:46:8b:3c:b5:ff:40:f7:cd:c2:32:10:40:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\devdata\pcf\trunk\public\output\pdb\CloudOPTClient.pdb

Imports

kernel32

SystemTimeToFileTime
FindFirstFileW
FindNextFileW
FindClose
lstrlenW
WideCharToMultiByte
GetSystemTimeAsFileTime
GetTickCount
QueryDosDeviceW
DeviceIoControl
GlobalAlloc
GlobalFree
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
InterlockedIncrement
InterlockedDecrement
HeapDestroy
HeapFree
HeapCreate
HeapAlloc
LocalFree
CreateFileA
SetLastError
GetVersion
GetCurrentProcessId
ProcessIdToSessionId
DebugBreak
VirtualProtect
IsBadCodePtr
IsBadReadPtr
GetModuleHandleExW
ExitThread
CreateDirectoryW
GetCommandLineW
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
UnmapViewOfFile
MapViewOfFile
FlushInstructionCache
CreateFileMappingA
GetWindowsDirectoryW
LocalAlloc
InterlockedExchange
InterlockedCompareExchange
GetFileSizeEx
CreateProcessW
WTSGetActiveConsoleSessionId
WaitForSingleObject
VirtualQueryEx
InitializeCriticalSectionAndSpinCount
CreateFileMappingW
CreateEventW
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
GetCurrentThreadId
TerminateProcess
VirtualQuery
GetProcAddress
ReleaseMutex
CreateMutexW
lstrcatA
GetThreadContext
OpenMutexW
DuplicateHandle
OpenFileMappingW
OpenEventW
lstrcpyA
GetCurrentThread
VirtualProtectEx
WriteProcessMemory
GetProcessHeap
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
lstrcpyW
SetEndOfFile
GetStdHandle
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
LCMapStringW
GetModuleFileNameW
LCMapStringA
GetCPInfo
RtlUnwind
GetStartupInfoW
LoadLibraryW
GetModuleHandleW
lstrlenA
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
Sleep
WritePrivateProfileStringW
GetLocalTime
DeleteFileW
CopyFileW
GetTempFileNameW
GetTempPathW
MultiByteToWideChar
GetPrivateProfileIntW
GetPrivateProfileStringW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetLastError
GetCurrentProcess
OpenProcess
GetSystemDirectoryW
VerifyVersionInfoW
VerSetConditionMask
GetVersionExW
VirtualFree
VirtualAlloc
GetFileSize
SetFilePointer
WriteFile
ReadFile
IsDebuggerPresent
UnhandledExceptionFilter
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
RaiseException
HeapSize
HeapReAlloc
CreateFileW
CloseHandle
GetModuleFileNameA

user32

TranslateAcceleratorW
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
UpdateWindow
DialogBoxParamW
DestroyWindow
DefWindowProcW
SetTimer
KillTimer
BeginPaint
EndPaint
PostQuitMessage
EndDialog
GetWindowThreadProcessId
EnumWindows
GetTopWindow
GetMessageW
LoadStringW
ShowWindow
TranslateMessage
LoadAcceleratorsW
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
GetThreadDesktop

advapi32

RegEnumValueW
OpenProcessToken
LookupPrivilegeValueW
GetLengthSid
GetKernelObjectSecurity
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
CreateProcessAsUserW
DuplicateTokenEx
SetTokenInformation
GetTokenInformation
GetUserNameW
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenCurrentUser
RevertToSelf
ImpersonateLoggedOnUser
RegOpenKeyExW
AdjustTokenPrivileges

shell32

ord165
SHFileOperationW
SHGetFolderPathW
CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

CoCreateGuid

oleaut32

VariantClear

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathIsDirectoryW
SHSetValueW
SHGetValueW
PathFindExtensionW
PathFindFileNameW
PathAddBackslashW
PathAppendW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateSessionsW
WTSQueryUserToken
WTSFreeMemory

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

psapi

GetModuleInformation
GetProcessImageFileNameW
GetModuleFileNameExW

winhttp

WinHttpOpen
WinHttpSetCredentials
WinHttpReadData
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpWriteData
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpSetOption

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

Sections

.text
Size: 472KB - Virtual size: 471KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Communication.dll
.dll windows:5 windows x86 arch:x86

3497585ce6db5df6a70ba374e8670819

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:9c:fa:bb:b4:a7:01:c3:71:c8:32:35:e3:9c:5d:c5:0a:c6:0c:3f
Signer

Actual PE Digest

5e:9c:fa:bb:b4:a7:01:c3:71:c8:32:35:e3:9c:5d:c5:0a:c6:0c:3f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Communication.pdb

Imports

kernel32

FindResourceW
FindResourceExW
InterlockedIncrement
InterlockedDecrement
CloseHandle
CreateThread
SetEvent
WaitForSingleObject
GetModuleHandleW
GetModuleFileNameW
CreateFileW
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
GetTickCount
Sleep
WaitForMultipleObjects
CreateEventW
SetFilePointer
WriteFile
CreateToolhelp32Snapshot
Process32FirstW
SizeofResource
Process32NextW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
InterlockedCompareExchange
TerminateThread
ResetEvent
SwitchToThread
WideCharToMultiByte
GetLastError
GetProcessHeap
HeapFree
GetFileSize
ReadFile
SetLastError
HeapAlloc
LockResource
LoadResource
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
InterlockedExchange
GlobalFree
OpenProcess
GlobalAlloc
SetEndOfFile
InitializeCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
GetDriveTypeA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
GetTimeZoneInformation
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetModuleHandleA
GetStringTypeW
GetStringTypeA
LCMapStringA
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
GetCommandLineA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
RaiseException
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetFullPathNameW
GetCurrentDirectoryA
HeapSize
ExitProcess
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

advapi32

RevertToSelf
RegOpenCurrentUser
ImpersonateLoggedOnUser
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCloseKey
RegQueryValueExA

shell32

ord165
SHGetFolderPathW

ole32

CoCreateGuid

log

WriteLog

shlwapi

PathRemoveFileSpecW
PathAddBackslashW
PathIsDirectoryW
PathFileExistsW
PathFindExtensionW
PathAppendW

winhttp

WinHttpSetOption
WinHttpCloseHandle
WinHttpConnect
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpSetCredentials
WinHttpOpen
WinHttpOpenRequest

Exports

Exports

CreateObject
_DllMain@12

Sections

.text
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CrashReport.exe
.exe windows:5 windows x86 arch:x86

3cdbd323b5afb0e05c8e80099e3b150a

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

37:33:c5:43:26:d0:50:88:04:78:c7:63:90:4c:d4:2b:88:88:91:63
Signer

Actual PE Digest

37:33:c5:43:26:d0:50:88:04:78:c7:63:90:4c:d4:2b:88:88:91:63

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\jenkins\workspace\CrashTool_workspace\bavOutput\Pdb\Release\CrashReport.pdb

Imports

psapi

GetProcessMemoryInfo
QueryWorkingSet
GetModuleInformation
GetModuleFileNameExW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

FindNextFileW
FindFirstFileW
ReadProcessMemory
VirtualQueryEx
OpenThread
GetLocalTime
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GlobalMemoryStatus
Sleep
WideCharToMultiByte
ExpandEnvironmentStringsW
InterlockedExchange
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
ReadFile
MoveFileExW
GetFileSize
GetVolumeInformationW
GetDiskFreeSpaceExW
RemoveDirectoryW
SetFilePointer
GetLogicalDrives
GetDriveTypeW
DeviceIoControl
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCurrentProcessId
CreateMutexW
InterlockedCompareExchange
SystemTimeToFileTime
GetPrivateProfileStringW
GetFileSizeEx
WTSGetActiveConsoleSessionId
ProcessIdToSessionId
GetPrivateProfileIntW
InitializeCriticalSectionAndSpinCount
Module32NextW
VirtualProtect
Module32FirstW
HeapCreate
HeapAlloc
CreateEventW
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
LeaveCriticalSection
SetEndOfFile
CreateFileA
GetTimeZoneInformation
WriteFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetStringTypeW
EnterCriticalSection
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
SetConsoleCtrlHandler
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
GetModuleHandleA
GetModuleFileNameA
GetStdHandle
ExitProcess
FatalAppExitA
IsValidCodePage
GetOEMCP
GetACP
GetCurrentThread
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetCPInfo
LCMapStringW
LCMapStringA
GetFileAttributesW
GetSystemTimeAsFileTime
GetStartupInfoW
CreateThread
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
lstrlenA
CreateFileW
SetEvent
GetLastError
DeleteFileW
CreateProcessW
GetCommandLineW
LocalFree
GetNativeSystemInfo
IsWow64Process
lstrcmpiW
LoadLibraryExW
InitializeCriticalSection
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
GetCurrentProcess
GetLocaleInfoW
RaiseException
DeleteCriticalSection
OpenProcess
LoadLibraryW
WaitForSingleObject
CloseHandle
FreeLibrary
GetCurrentThreadId
GetProcAddress
FindResourceExW
GetVersionExW
MultiByteToWideChar
lstrlenW
GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
CompareStringA
CompareStringW
SetEnvironmentVariableA
FlushInstructionCache
TerminateProcess
GetStringTypeA

user32

TrackMouseEvent
GetFocus
PostMessageW
PostQuitMessage
SetCursor
ScreenToClient
GetCursorPos
LoadCursorW
UnregisterClassA
DispatchMessageW
EnumWindows
GetWindowThreadProcessId
UpdateLayeredWindow
GetWindowDC
GetWindowRect
DrawTextW
DestroyCursor
TranslateAcceleratorW
DefWindowProcW
SetWindowPos
MessageBeep
LoadStringW
SendMessageW
IsWindow
PtInRect
PeekMessageW
EnumChildWindows
GetClassNameW
GetWindowTextW
CharNextW
CreateWindowExW
GetClassInfoExW
LoadImageW
RegisterClassExW
LoadMenuW
LoadAcceleratorsW
DestroyWindow
ShowWindow
GetMessageW
TranslateMessage
SetTimer
CallWindowProcW
SetWindowLongW
LoadStringA
GetParent
GetWindow
MonitorFromWindow
MonitorFromPoint
GetMonitorInfoW
SetFocus
KillTimer
GetMenuItemInfoW
RemoveMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenuEx
DestroyMenu
ReleaseDC
CreatePopupMenu
MapWindowPoints
GetClientRect
SetWindowTextW
GetWindowLongW
InvalidateRect

gdi32

CreateDIBSection
CreateCompatibleDC
SelectObject
SetTextColor
SetBkMode
CreateCompatibleBitmap
SaveDC
GetBitmapBits
SetBitmapBits
RestoreDC
DeleteObject
DeleteDC
CreateFontW

advapi32

LookupPrivilegeValueW
RegQueryValueExW
AdjustTokenPrivileges
RevertToSelf
CreateProcessAsUserW
DuplicateTokenEx
SetTokenInformation
AllocateAndInitializeSid
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
QueryServiceStatus
DeleteService
ControlService
OpenServiceW
StartServiceW
OpenSCManagerW
CreateServiceW
CloseServiceHandle
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
OpenProcessToken
RegEnumValueW

shell32

SHFileOperationW
SHGetSpecialFolderPathW

ole32

CoInitializeSecurity
CoUninitialize
CoTaskMemRealloc
CoCreateGuid
CoTaskMemAlloc
CoCreateInstance
CoSetProxyBlanket
CoTaskMemFree
CoInitialize

oleaut32

VariantChangeType
GetErrorInfo
SysAllocStringByteLen
SysAllocString
CreateErrorInfo
SysStringLen
SetErrorInfo
VariantClear
SysFreeString
VariantInit
VarUI4FromStr

shlwapi

SHDeleteKeyW
PathFindFileNameW
PathRemoveExtensionW
PathAppendW
StrStrIW
PathRemoveFileSpecW
PathFileExistsW
PathIsDirectoryW
PathFindExtensionW
PathGetDriveNumberW
PathStripPathW

comctl32

InitCommonControlsEx

msimg32

GradientFill
AlphaBlend

iphlpapi

GetAdaptersAddresses
GetIpForwardTable

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

winhttp

WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpSetOption
WinHttpOpen
WinHttpReadData

Sections

.text
Size: 622KB - Virtual size: 622KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CrashReportConfig.ini
CrashUL.exe
.exe windows:5 windows x86 arch:x86

2bcad15580bacfaf8df8afc1d1acd471

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:fa:9a:13:c3:e8:74:ac:b1:3c:fb:bd:41:4a:db:58:9d:3e:75:66
Signer

Actual PE Digest

39:fa:9a:13:c3:e8:74:ac:b1:3c:fb:bd:41:4a:db:58:9d:3e:75:66

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\jenkins\workspace\CrashTool_workspace\bavOutput\Pdb\Release\CrashUL.pdb

Imports

winhttp

WinHttpOpen
WinHttpSetOption
WinHttpConnect
WinHttpCloseHandle
WinHttpReadData
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest

kernel32

LockResource
LoadResource
FindResourceW
FindResourceExW
CreateDirectoryA
FindFirstFileW
FindNextFileW
FindClose
DeleteFileA
InterlockedCompareExchange
ExpandEnvironmentStringsA
GetModuleFileNameA
InterlockedExchange
CopyFileW
CreateFileA
WriteFile
SetFilePointer
GetNativeSystemInfo
IsWow64Process
GetCurrentProcess
GetVersionExW
FileTimeToSystemTime
GetFileInformationByHandle
GetFileSize
ReadFile
GetLocalTime
SystemTimeToFileTime
GetTickCount
WritePrivateProfileStringW
GetPrivateProfileStringW
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
CreateDirectoryW
SizeofResource
DeviceIoControl
GetCurrentProcessId
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LoadLibraryA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
LCMapStringA
WideCharToMultiByte
lstrlenW
lstrlenA
MultiByteToWideChar
GetCommandLineW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSizeEx
CreateFileW
DeleteFileW
CreateEventW
GetLastError
CreateMutexW
CloseHandle
GetModuleFileNameW
Sleep
WaitForSingleObject
SetEvent
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
VirtualFree
HeapCreate
ExitProcess
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
GetModuleHandleW
GetSystemTimeAsFileTime
RtlUnwind
GetStartupInfoW
CreateThread
GetCurrentThreadId
ExitThread
GetFileAttributesW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InitializeCriticalSection
RaiseException
GetProcessHeap
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize

user32

RegisterClassExW
CreateWindowExW
LoadStringW
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
LoadIconW
PostMessageW
DestroyWindow
PostQuitMessage
EndPaint
BeginPaint
DefWindowProcW
LoadCursorW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCreateKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExA
RegSetValueExW
RegCloseKey

shell32

SHFileOperationA
SHGetFolderPathA
SHGetSpecialFolderPathW
SHFileOperationW

ole32

CoCreateGuid

shlwapi

PathRemoveFileSpecW
PathIsDirectoryA
PathAppendW
PathFindFileNameW
PathIsDirectoryW
SHDeleteKeyW
PathFileExistsW
PathAppendA
PathRemoveFileSpecA
PathFileExistsA

iphlpapi

GetAdaptersAddresses

Sections

.text
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DataFileList.xml
DataFileVer.xml
DataReport.dll
.dll windows:5 windows x86 arch:x86

5de1f52184fd63af9a883aeced58adad

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

af:ca:3b:16:40:2b:98:2f:3f:d1:4f:7e:18:91:d4:21:92:73:10:e3
Signer

Actual PE Digest

af:ca:3b:16:40:2b:98:2f:3f:d1:4f:7e:18:91:d4:21:92:73:10:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\DataReport.pdb

Imports

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z
?GetInstance@CAPCDispatcher@@SAPAV1@XZ

kernel32

GetCurrentProcess
HeapFree
GetProcessHeap
OpenProcess
GetVersionExW
VerifyVersionInfoW
GetLastError
MoveFileW
GetLocalTime
Process32FirstW
ProcessIdToSessionId
Process32NextW
CreateToolhelp32Snapshot
GetCurrentThreadId
GetCurrentProcessId
CreateMutexW
CreateFileA
GlobalAlloc
WideCharToMultiByte
GlobalFree
DeviceIoControl
CreateProcessW
InitializeCriticalSectionAndSpinCount
Sleep
LeaveCriticalSection
OpenMutexW
EnterCriticalSection
DeleteCriticalSection
WriteFile
WaitForSingleObject
SetEvent
GetModuleHandleW
ResetEvent
CreateEventW
VirtualFree
VirtualAlloc
SetFilePointer
FlushFileBuffers
GetConsoleCP
VerSetConditionMask
CreateDirectoryW
HeapAlloc
GetPrivateProfileSectionW
DeleteFileW
CloseHandle
LockResource
GetPrivateProfileIntW
GetTempPathW
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
GetModuleFileNameW
ReadFile
SizeofResource
CopyFileW
GetPrivateProfileStringW
LoadResource
FindResourceW
FindResourceExW
GetFileSize
GetTempFileNameW
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
WritePrivateProfileStringW
GetPrivateProfileSectionNamesW
InitializeCriticalSection
GetEnvironmentStrings
GetConsoleMode
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
ExitProcess
HeapReAlloc
HeapDestroy
HeapCreate
LCMapStringW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InterlockedExchange
LCMapStringA
RaiseException
GetModuleFileNameA
GetStdHandle
SetLastError
TlsFree
TlsSetValue
LoadLibraryA
RtlUnwind
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsAlloc

user32

CallWindowProcW
GetMessageW
SetTimer
KillTimer
GetWindowLongW
SetWindowLongW
SendMessageTimeoutW
IsWindow
CreateWindowExW
PostMessageW
DispatchMessageW

advapi32

AdjustTokenPrivileges
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegCloseKey
RevertToSelf
RegEnumValueW
RegOpenCurrentUser
ImpersonateLoggedOnUser
LookupPrivilegeValueW
RegQueryInfoKeyW
RegSetValueExW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExW
GetUserNameW
OpenProcessToken
RegEnumKeyExW

shell32

SHGetFolderPathW
ord165
SHGetSpecialFolderPathW
SHFileOperationW

ole32

CoInitialize
CoUninitialize
CoCreateGuid

shlwapi

PathRenameExtensionW
PathFindExtensionW
SHDeleteValueW
PathRemoveExtensionW
PathAppendW
PathFileExistsW
PathAddBackslashW
PathRemoveFileSpecW
PathIsDirectoryW
SHSetValueW
SHGetValueW
PathFindFileNameW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wtsapi32

WTSEnumerateSessionsW
WTSQueryUserToken
WTSFreeMemory

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

psapi

GetModuleBaseNameW

winhttp

WinHttpConnect
WinHttpWriteData
WinHttpSendRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpOpen
WinHttpOpenRequest
WinHttpSetCredentials
WinHttpAddRequestHeaders
WinHttpReceiveResponse

Exports

Exports

RD_ReportValueEx
RD_SS
RD_SW
RD_W
RD_WS
RD_WW
ReportNow
Start
Stop
UploadAllNowAsync
UploadAllNowSync
UploadAllNowSyncRetry
UploadFile

Sections

.text
Size: 314KB - Virtual size: 314KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DeepClean.exe
.exe windows:5 windows x86 arch:x86

e198149d26187c5bf0ba6736ef5a92ed

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d4:94:de:0f:d6:ba:f7:72:5b:5a:cf:ea:51:b8:1a:ba:ae:a8:eb:c6
Signer

Actual PE Digest

d4:94:de:0f:d6:ba:f7:72:5b:5a:cf:ea:51:b8:1a:ba:ae:a8:eb:c6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\DeepClean.pdb

Imports

directui

DirectUI_TreeEx_SetControlText
DirectUI_TreeEx_SetStaticLogo
DirectUI_GetControlRect
DirectUI_Static_SetLogoIcon
DirectUI_Button_GetCheck
DirectUI_Button_SetUnknown
DirectUI_TreeEx_EnableAnimate
DirectUI_TreeEx_SetControlTextEx
DirectUI_TreeEx_SetTooltipString
DirectUI_TreeEx_GetButtonCheck
DirectUI_TreeEx_SetButtonCheck
DirectUI_TreeEx_SetButtonUnknown
DirectUI_TreeEx_Select
DirectUI_TreeEx_InsertItem
DirectUI_TreeEx_SetFirstVisible
uiUpdateWindow
DirectUI_SubclassLayeredWindow
DirectUI_TreeEx_ChangeStyle
DirectUI_TreeEx_Expand
DirectUI_TreeEx_SetItemHeight
DirectUI_TreeEx_EnableChildControl
DirectUI_EnableAnimate
DirectUI_TreeEx_SetProgressPos
DirectUI_TreeEx_CreateControl
DirectUI_ListCtrl_SetStaticLogo
DirectUI_ListCtrl_ChangeStyle
DirectUI_TreeEx_DeleteItem
DirectUI_ListCtrl_GetItemCount
DirectUI_ListCtrl_DeleteItem
DirectUI_ListCtrl_SetItemSrcData
DirectUI_ListCtrl_DeleteAllItems
DirectUI_ListCtrl_GetItemSrcData
DirectUI_ListCtrl_GetButtonCheck
DirectUI_ListCtrl_SetButtonCheck
DirectUI_ListCtrl_EnableControl
DirectUI_Progress_EnableMoving
DirectUI_SetControlFocus
DirectUI_GetLanguageStyle
DirectUI_IsControlVisible
DirectUI_Progress_SetPos
DirectUI_AutoText_SetControlText
DirectUI_TreeEx_SetAutoTextItemTextEx
DirectUI_TreeEx_ShowControl
DirectUI_TreeEx_IsExpand
DirectUI_TreeEx_SetAutoTextItemText
DirectUI_EnableControl
DirectUI_SetControlText
DirectUI_SetControlPos
DirectUI_SetControlTextEx
DirectUI_CreateControl
DirectUI_DestroyControl
DirectUI_GetStringItem
DirectUI_ListCtrl_GetHeadCtrlId
DirectUI_ListCtrl_InsertColumn
DirectUI_ListCtrl_SetDrawItem
DirectUI_ListCtrl_SetTooltipString
DirectUI_ListCtrl_SetControlText
DirectUI_ListCtrl_ShowControl
DirectUI_HeaderCtrl_SetControlTextEx
DirectUI_GetSafeHwnd
DirectUI_SetLanguageStyle
DirectUI_SubclassWindow
DirectUI_UpdateSkin
DirectUI_LoadSkinResourceFromZIP
DirectUI_I18N_AddLanguageStyle
DirectUI_Button_SetCheck
DirectUI_GetVersion
DirectUI_ChangeStyle
DirectUI_TreeEx_DeleteAllItems
DirectUI_ShowControl

datareport

RD_W
Stop
Start
RD_WS

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z
?DelInstance@CAPCDispatcher@@SAXXZ
?GetInstance@CAPCDispatcher@@SAPAV1@XZ

baidustore

?ReportIncCount@CBaiduStoreMgr@@QAEHKK@Z
?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z
?DoShellExecute@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z
?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z
?OnKernelHandle@CBaiduStoreMgr@@QAEXPAX@Z
?ConnectSubSvc@CBaiduStoreMgr@@QAEHPB_WH@Z
?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z
?InitKrnIPCClient@CBaiduStoreMgr@@QAEHK@Z
?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ
??1Baidu_ListenData@@UAE@XZ
??0Baidu_ListenData@@QAE@PB_W@Z
?ReportState@CBaiduStoreMgr@@QAEHKK@Z
?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z

kernel32

LoadLibraryExW
FlushInstructionCache
LoadLibraryW
GetPrivateProfileIntW
OpenFileMappingW
GetTickCount
ExpandEnvironmentStringsW
GetVersionExW
GetProcessHeap
HeapFree
MulDiv
HeapAlloc
IsBadReadPtr
WideCharToMultiByte
WaitForSingleObject
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
VerifyVersionInfoW
VerSetConditionMask
WinExec
CreateProcessW
WaitForSingleObjectEx
WritePrivateProfileStringW
QueueUserAPC
DeviceIoControl
OpenEventW
SetEvent
FindFirstFileW
FindNextFileW
FindClose
RaiseException
CreateEventW
ResetEvent
TerminateThread
OpenJobObjectW
QueryInformationJobObject
GetLongPathNameW
GetSystemDirectoryW
Sleep
ReleaseMutex
CreateMutexW
lstrlenA
CreateDirectoryW
OpenProcess
QueueUserWorkItem
GetFileAttributesExW
GetVolumeInformationW
InitializeCriticalSectionAndSpinCount
GetDiskFreeSpaceExW
GetDriveTypeW
SystemTimeToFileTime
GetLogicalDriveStringsW
GetFileAttributesW
GetEnvironmentVariableW
GetSystemWindowsDirectoryW
WTSGetActiveConsoleSessionId
LocalFree
ProcessIdToSessionId
DebugBreak
VirtualProtect
GetVersion
IsBadCodePtr
GetModuleHandleExW
ExitThread
GetCommandLineW
GetModuleHandleA
VirtualFree
CreateFileMappingA
GetLocalTime
GetWindowsDirectoryW
LocalAlloc
InterlockedExchange
InterlockedCompareExchange
WriteFile
GetFileSizeEx
ReadProcessMemory
VirtualQueryEx
HeapCreate
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
TerminateProcess
VirtualQuery
GetModuleFileNameA
lstrcatA
GetThreadContext
OpenMutexW
DuplicateHandle
VirtualAlloc
lstrcpyA
VirtualAllocEx
VirtualFreeEx
GetCurrentThread
VirtualProtectEx
WriteProcessMemory
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
lstrcpyW
SetEndOfFile
SetFilePointer
UnhandledExceptionFilter
IsDebuggerPresent
CreateThread
GetStartupInfoW
HeapReAlloc
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapDestroy
ExitProcess
GetStdHandle
HeapSize
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryA
lstrcmpiW
InitializeCriticalSection
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SetLastError
FreeLibrary
GetTimeZoneInformation
GetPrivateProfileSectionW
lstrlenW
GetModuleHandleW
GetProcAddress
GetPrivateProfileStringW
GetCurrentProcess
GetCurrentProcessId
GetLastError
DeleteFileW
CopyFileW
GetTempFileNameW
GetTempPathW
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
ReadFile
GetFileSize
CloseHandle
CreateFileW
IsProcessorFeaturePresent
GetProcessTimes
RemoveDirectoryW

user32

MonitorFromPoint
GetMenuItemInfoW
RemoveMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenuEx
CreatePopupMenu
InvalidateRect
MessageBeep
CallWindowProcW
GetPropW
SetPropW
GetSystemMenu
EnableMenuItem
DeleteMenu
GetMenuState
DrawTextW
GetSystemMetrics
SetRect
GetDialogBaseUnits
DialogBoxIndirectParamW
GetDlgItem
DestroyMenu
PostQuitMessage
LoadStringA
TranslateAcceleratorW
SetWindowPlacement
GetWindowPlacement
RedrawWindow
GetCursor
GetAsyncKeyState
GetCursorPos
ClientToScreen
IsIconic
SystemParametersInfoW
GetActiveWindow
DialogBoxParamW
PrivateExtractIconsW
EnableWindow
CreateIconFromResource
CopyIcon
TrackPopupMenu
EnumWindows
DestroyIcon
EndDialog
PostMessageW
UpdateWindow
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetParent
GetClientRect
MapWindowPoints
SetWindowTextW
KillTimer
SetTimer
UpdateLayeredWindow
GetWindowLongW
GetWindowRect
IsWindow
OffsetRect
PtInRect
SetFocus
LoadImageW
LoadAcceleratorsW
LoadMenuW
LoadStringW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
PeekMessageW
TranslateMessage
DispatchMessageW
CharNextW
DefWindowProcW
DestroyWindow
GetMessageW
GetForegroundWindow
SetWindowPos
AttachThreadInput
SetForegroundWindow
ShowWindow
IsWindowVisible
SendMessageW
SetWindowLongW
GetWindowThreadProcessId
FindWindowW
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
GetThreadDesktop
UnregisterClassA

gdi32

BitBlt
CreateFontW
CreateICW
DeleteObject
DeleteDC
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

advapi32

SetTokenInformation
AdjustTokenPrivileges
RevertToSelf
LookupPrivilegeValueW
GetUserNameW
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegOpenKeyW
RegQueryValueW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
DuplicateTokenEx
CreateProcessAsUserW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetLengthSid
GetKernelObjectSecurity

shell32

ord165
CommandLineToArgvW
SHGetDesktopFolder
SHOpenFolderAndSelectItems
ShellExecuteW
ExtractIconExW
ShellExecuteExW
SHGetFileInfoW
SHFileOperationW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoTaskMemFree

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
PathIsRelativeW
SHGetValueW
SHSetValueW
StrCmpW
StrCmpIW
StrCpyNW
PathFindExtensionW
PathAddBackslashW
PathAppendW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory

winhttp

WinHttpCreateUrl

gdiplus

GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromFile
GdipCloneImage
GdipDeleteGraphics
GdipGetImageHeight
GdipCreatePen1
GdipDeletePen
GdipGetImageGraphicsContext
GdipGetDC
GdipReleaseDC
GdipSetSmoothingMode
GdipDrawArcI
GdipGraphicsClear
GdipDrawImageRectRectI
GdipGetImageWidth
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipGetImageEncoders

psapi

GetModuleInformation
GetModuleFileNameExW

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DeepOptimization.exe
.exe windows:5 windows x86 arch:x86

4cf014951d4c1bca1880698e04132357

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

96:a9:13:ef:c6:85:e8:fe:b9:23:ae:76:32:b6:63:98:61:88:14:11
Signer

Actual PE Digest

96:a9:13:ef:c6:85:e8:fe:b9:23:ae:76:32:b6:63:98:61:88:14:11

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\DeepOptimization.pdb

Imports

directui

DirectUI_CreateControl
DirectUI_EnableAnimate
DirectUI_GetStringLength
DirectUI_TreeCtrl_ChangeStyle
DirectUI_TreeCtrl_SetControlPos
DirectUI_TreeCtrl_GetControlRect
DirectUI_TreeCtrl_SetControlText
DirectUI_TreeCtrl_SetStaticLogo
DirectUI_ListCtrl_GetItemSrcDataEx
DirectUI_SetControlTextEx
DirectUI_TrackPopupMenu
DirectUI_ListCtrl_DeleteItem
DirectUI_ListCtrl_GetItemCount
DirectUI_GetControlRect
DirectUI_GetLanguageStyle
DirectUI_GetControlPos
DirectUI_HeaderCtrl_SetControlTextEx
DirectUI_ListCtrl_InsertColumn
DirectUI_SubclassLayeredWindow
DirectUI_SetControlPos
DirectUI_AutoText_SetControlTextEx
DirectUI_DestroyControl
DirectUI_TreeCtrl_IsExpand
DirectUI_TreeCtrl_ShowControl
DirectUI_TreeCtrl_DeleteItem
DirectUI_Progress_EnableMoving
DirectUI_TreeCtrl_DeleteAllItems
DirectUI_TreeCtrl_Expand
DirectUI_TreeCtrl_SetAutoTextItemTextEx
DirectUI_TreeCtrl_SetAutoTextItemText
DirectUI_TreeEx_SetItemHeight
DirectUI_TreeCtrl_InsertItem
DirectUI_ListCtrl_GetHeadCtrlId
DirectUI_ListCtrl_DeleteAllItems
DirectUI_ListCtrl_SetItemSrcData
DirectUI_ListCtrl_SetDrawItem
DirectUI_ListCtrl_SetStaticLogo
DirectUI_ListCtrl_SetButtonCheck
DirectUI_ListCtrl_ChangeStyle
DirectUI_ListCtrl_SetTooltipString
DirectUI_ListCtrl_SetControlTextEx
DirectUI_ListCtrl_SetControlText
DirectUI_ListCtrl_ShowControl
DirectUI_HeaderCtrl_SetItemWidth
DirectUI_HeaderCtrl_ShowControl
DirectUI_ListCtrl_GetItemSrcData
DirectUI_ListCtrl_GetButtonCheck
DirectUI_TreeCtrl_SetButtonCheck
DirectUI_TreeCtrl_GetButtonCheck
DirectUI_SetControlFocus
DirectUI_GetSafeHwnd
DirectUI_SetLanguageStyle
DirectUI_UpdateSkin
DirectUI_LoadSkinResourceFromZIP
DirectUI_GetVersion
DirectUI_I18N_AddLanguageStyle
DirectUI_Button_SetCheck
DirectUI_Static_SetLogoIcon
DirectUI_ShowControl
DirectUI_AutoText_SetControlText
DirectUI_SetControlText
DirectUI_GetStringItem
DirectUI_ListCtrl_SortItems
DirectUI_SubclassWindow

datareport

Start
Stop

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ
?DelInstance@CAPCDispatcher@@SAXXZ
?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

baidustore

??0Baidu_ListenData@@QAE@PB_W@Z
?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z
?ConnectSubSvc@CBaiduStoreMgr@@QAEHPB_WH@Z
?DoAutoRun@CBaiduStoreMgr@@QAEXH@Z
?SaveConfig@BdConfig@@QAEXXZ
?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z
?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z
?OnKernelHandle@CBaiduStoreMgr@@QAEXPAX@Z
?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ
?InitKrnIPCClient@CBaiduStoreMgr@@QAEHK@Z
?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z
??1Baidu_ListenData@@UAE@XZ

kernel32

InterlockedIncrement
InterlockedDecrement
lstrlenW
InitializeCriticalSection
FreeLibrary
LoadLibraryExW
lstrcmpiW
GetPrivateProfileIntW
ExpandEnvironmentStringsW
LoadLibraryW
MulDiv
Sleep
GetSystemDirectoryW
GetVersionExW
HeapFree
GetProcessHeap
IsBadReadPtr
HeapAlloc
GetSystemWindowsDirectoryW
GetEnvironmentVariableW
GetLongPathNameW
ProcessIdToSessionId
DebugBreak
VirtualProtect
IsWow64Process
GetVersion
IsBadCodePtr
GetModuleHandleExW
ExitThread
GetCurrentProcess
GetCommandLineW
GetModuleHandleA
VirtualFree
CreateFileMappingA
lstrcmpiA
WideCharToMultiByte
GetLocalTime
GetWindowsDirectoryW
GetDateFormatW
GetTimeFormatW
FormatMessageW
LocalFree
LocalAlloc
InterlockedExchange
InterlockedCompareExchange
WritePrivateProfileStringW
SystemTimeToFileTime
WriteFile
GetFileSizeEx
CreateProcessW
WTSGetActiveConsoleSessionId
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WaitForSingleObject
ReadProcessMemory
VirtualQueryEx
InitializeCriticalSectionAndSpinCount
lstrlenA
Module32NextW
Module32FirstW
HeapCreate
CreateEventW
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
TerminateProcess
VirtualQuery
GetModuleFileNameA
ReleaseMutex
CreateMutexW
lstrcatA
GetThreadContext
OpenMutexW
DuplicateHandle
VirtualAlloc
OpenFileMappingW
OpenEventW
lstrcpyA
VirtualAllocEx
VirtualFreeEx
GetCurrentThread
VirtualProtectEx
WriteProcessMemory
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
lstrcpyW
SetEndOfFile
SetFilePointer
HeapSize
HeapReAlloc
HeapDestroy
IsProcessorFeaturePresent
LoadLibraryA
IsDebuggerPresent
RtlUnwind
GetStartupInfoW
GetFileAttributesW
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
FlushInstructionCache
SetLastError
SetConsoleCtrlHandler
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
GetPrivateProfileStringW
GetTimeZoneInformation
GetPrivateProfileSectionW
CreateFileW
GetFileSize
ReadFile
GetModuleFileNameW
GetTempPathW
GetTempFileNameW
CopyFileW
DeleteFileW
DeleteCriticalSection
GetModuleHandleW
GetProcAddress
GetCurrentProcessId
CreateFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
CloseHandle
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
RaiseException
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetProcessTimes
CreateDirectoryW
UnhandledExceptionFilter

user32

CreatePopupMenu
TranslateAcceleratorW
SystemParametersInfoW
GetActiveWindow
ClientToScreen
PrivateExtractIconsW
DestroyIcon
MoveWindow
GetCursorPos
GetSystemMenu
EnableMenuItem
DeleteMenu
GetMenuState
SetPropW
GetPropW
DrawTextW
GetSystemMetrics
AppendMenuW
CreateDialogParamW
PostQuitMessage
LoadStringA
DialogBoxParamW
DestroyMenu
MessageBeep
PtInRect
SetRect
InvalidateRect
DialogBoxIndirectParamW
SetFocus
SetWindowPlacement
GetWindowPlacement
RedrawWindow
GetThreadDesktop
CharLowerBuffW
CharUpperBuffW
CloseDesktop
TrackPopupMenuEx
GetMenuItemCount
RemoveMenu
GetMenuItemInfoW
MonitorFromPoint
CharNextA
CharPrevA
CharUpperBuffA
CharLowerBuffA
UpdateLayeredWindow
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
KillTimer
SetTimer
OffsetRect
CallWindowProcW
GetWindowLongW
EndDialog
GetWindowRect
CharNextW
CreateWindowExW
GetClassInfoExW
LoadCursorW
LoadImageW
RegisterClassExW
LoadStringW
LoadMenuW
LoadAcceleratorsW
DestroyWindow
DefWindowProcW
OpenInputDesktop
GetUserObjectInformationA
GetDialogBaseUnits
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetWindowPos
IsWindowVisible
SetForegroundWindow
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
FindWindowW
PostMessageW
SetWindowLongW
GetDlgItem
SendMessageW
IsWindow
ShowWindow
SetWindowTextW
CharPrevW
UnregisterClassA

gdi32

CreateICW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
CreateFontW
DeleteObject

advapi32

FreeSid
RevertToSelf
CreateProcessAsUserW
DuplicateTokenEx
SetTokenInformation
OpenProcessToken
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueW
GetUserNameW
RegOpenKeyW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
GetKernelObjectSecurity

shell32

ord165
ExtractIconExW
SHGetFileInfoW
SHOpenFolderAndSelectItems
SHGetDesktopFolder
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoInitialize
CoCreateInstance

oleaut32

VarUI4FromStr
SysFreeString

shlwapi

PathFileExistsW
PathAddBackslashW
PathFindFileNameW
PathAppendW
PathIsDirectoryW
PathIsRelativeW
StrStrIW
SHGetValueW
SHDeleteKeyW
PathRemoveFileSpecW

comctl32

InitCommonControlsEx

gdiplus

GdipGetImageWidth
GdipGetImageHeight
GdipDisposeImage
GdipFree
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipAlloc
GdipDrawImageRectRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCloneImage

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

psapi

GetModuleFileNameExW
GetModuleInformation

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

winhttp

WinHttpReadData
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpSetOption
WinHttpOpen
WinHttpCloseHandle

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 277KB - Virtual size: 276KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DirectUI.dll
.dll windows:5 windows x86 arch:x86

3f49a59faf0407786a1064e7fbd81a19

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

91:81:3c:3d:59:1e:5a:15:d9:a4:ea:ac:65:e0:b4:f5:8d:f9:5b:01
Signer

Actual PE Digest

91:81:3c:3d:59:1e:5a:15:d9:a4:ea:ac:65:e0:b4:f5:8d:f9:5b:01

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

s:\app\gensoft\security-client\bdui\DirectUI_skia\bin\skia_unicode_release\DirectUI.pdb

Imports

comctl32

ImageList_Create
ImageList_Destroy
ord17

riched20

ord4

kernel32

GlobalMemoryStatusEx
GetSystemInfo
VirtualProtect
LoadLibraryA
VirtualQuery
GetModuleHandleA
OutputDebugStringA
GetFileInformationByHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSizeEx
TlsGetValue
TlsAlloc
TlsSetValue
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCurrentDirectoryA
GetFullPathNameA
InitializeCriticalSectionAndSpinCount
InterlockedExchange
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetLocalTime
SetHandleCount
GetPriorityClass
HeapDestroy
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
TlsFree
GetFileType
SetStdHandle
CreateDirectoryA
GetFileAttributesA
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
ExitProcess
RtlUnwind
GetCommandLineA
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
WriteConsoleA
GetConsoleOutputCP
GetStartupInfoA
OpenProcess
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
OpenFileMappingW
GetProcessTimes
GetSystemTimeAsFileTime
GetTickCount
DeleteCriticalSection
InitializeCriticalSection
CreateFileA
LocalFileTimeToFileTime
GetCurrentDirectoryW
ReadFile
GetFileAttributesW
CreateDirectoryW
SystemTimeToFileTime
SetFilePointer
GetVersion
CloseHandle
GetStdHandle
CreateFileW
Sleep
WriteFile
GetModuleHandleW
IsBadCodePtr
LocalFree
LocalAlloc
LockResource
GetLongPathNameW
GetModuleFileNameW
SizeofResource
LoadResource
FindResourceW
FreeResource
GetVersionExW
EnterCriticalSection
SetLastError
RaiseException
FlushInstructionCache
LeaveCriticalSection
GetCurrentProcess
GlobalReAlloc
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
GetModuleFileNameA
MulDiv
WideCharToMultiByte
GetCurrentThreadId
GetLastError
MultiByteToWideChar
DebugBreak
GetCurrentProcessId
FindNextFileW
FindClose
OutputDebugStringW
lstrlenA
FindFirstFileW
GetProcAddress
lstrlenW
InterlockedDecrement
InterlockedIncrement
GetLocaleInfoA

user32

DrawIcon
GetClassLongW
GetMenu
GetMenuState
GetDlgItem
SetMenu
BeginDeferWindowPos
EndDeferWindowPos
GetWindow
GetMessageW
IsWindowEnabled
DispatchMessageW
GetMessagePos
GetKeyState
CreateCaret
SetCaretPos
CharUpperW
SetWindowRgn
IsMenu
MenuItemFromPoint
GetMenuItemRect
SystemParametersInfoW
GetMenuItemCount
UpdateWindow
UpdateLayeredWindow
IsIconic
IsZoomed
MonitorFromWindow
GetMonitorInfoW
LoadCursorFromFileW
DestroyCursor
GetWindowTextLengthW
GetFocus
TrackMouseEvent
FrameRect
EnableWindow
GetWindowDC
GetUpdateRect
SetScrollRange
GetScrollRange
GetScrollInfo
SetScrollPos
EnableScrollBar
ShowScrollBar
SetScrollInfo
GetScrollPos
GetMenuItemInfoW
GetSystemMetrics
GetClassInfoExW
RegisterClassExW
GetWindowTextW
InvalidateRgn
GetSystemMenu
UnhookWindowsHookEx
SetWindowsHookExW
RedrawWindow
CallNextHookEx
SetWindowTextW
EndPaint
BeginPaint
GetClassNameW
RegisterWindowMessageW
DeferWindowPos
DrawIconEx
GetIconInfo
CallWindowProcW
RegisterClassW
ClientToScreen
HideCaret
ShowCaret
GetDesktopWindow
GetSysColor
EqualRect
GetWindowRect
GetParent
DefWindowProcW
MoveWindow
SetWindowLongW
SetWindowPos
LoadCursorW
GetCursorPos
ScreenToClient
WindowFromPoint
InflateRect
SetRect
GetWindowLongW
MessageBeep
SetTimer
RemovePropW
KillTimer
SetPropW
ShowWindow
DestroyIcon
DestroyWindow
SetCursor
SetCapture
GetClientRect
SetFocus
SetRectEmpty
GetCapture
UnionRect
InvalidateRect
IsWindow
CreateWindowExW
ReleaseCapture
SendMessageW
CopyRect
IsRectEmpty
PtInRect
IsWindowVisible
CharNextW
TrackPopupMenu
PostMessageW
IsDialogMessageA
IsDialogMessageW
GetPropW
DrawTextW
GetDC
OffsetRect
IntersectRect
ReleaseDC
LoadStringW
SystemParametersInfoA
GetWindowInfo
SetMenuItemInfoW
UnregisterClassA

gdi32

SetTextColor
GetTextMetricsW
GetTextExtentPoint32W
GetObjectW
AddFontResourceExW
GetDeviceCaps
RestoreDC
SaveDC
CreateFontIndirectW
ExtCreateRegion
CombineRgn
CreateCompatibleDC
CreateDIBSection
DeleteDC
SetDIBitsToDevice
BitBlt
GetTextExtentPointW
CreateSolidBrush
CreatePen
CreateRectRgn
SetStretchBltMode
Rectangle
CreateCompatibleBitmap
StretchBlt
CreateRectRgnIndirect
CreateFontW
ExcludeClipRect
GetStockObject
ExtTextOutW
SetBkColor
OffsetRgn
GetGlyphOutlineW
GetFontData
GetTextMetricsA
GetOutlineTextMetricsA
CreateFontIndirectA
RemoveFontMemResourceEx
GetGlyphIndicesW
GetGlyphOutlineA
GdiFlush
SetWorldTransform
SetTextAlign
SetGraphicsMode
GetTextExtentPointI
GetTextFaceA
GetFontUnicodeRanges
EnumFontFamiliesExA
AddFontMemResourceEx
GetCharABCWidthsA
SelectClipRgn
SelectObject
DeleteObject
SetBkMode

advapi32

RegQueryValueExA
RegOpenKeyExW
RegCloseKey

ole32

CoCreateGuid

oleaut32

SysStringLen

shlwapi

PathFileExistsW
PathAppendW

imm32

ImmReleaseContext

psapi

GetProcessMemoryInfo

usp10

ScriptItemize
ScriptShape
ScriptFreeCache

Exports

Exports

??0?$UIGuard@VUILock@@@@QAE@ABV0@@Z
??0?$UIGuard@VUILock@@@@QAE@ABVUILock@@@Z
??1?$UIGuard@VUILock@@@@UAE@XZ
??_7?$UIGuard@VUILock@@@@6B@
?Release@?$UIGuard@VUILock@@@@QBEXXZ
DirectUI_AddFontsResource
DirectUI_AddImageItem
DirectUI_AutoText_GetControlText
DirectUI_AutoText_SetControlText
DirectUI_AutoText_SetControlTextEx
DirectUI_Button_GetCheck
DirectUI_Button_SetCheck
DirectUI_Button_SetUnknown
DirectUI_ChangeStyle
DirectUI_ComboBox_AddString
DirectUI_ComboBox_GetCurSel
DirectUI_ComboBox_GetItemText
DirectUI_ComboBox_ResetContent
DirectUI_ComboBox_SetCurSel
DirectUI_ComboBox_SetStaticLogo
DirectUI_CreateControl
DirectUI_DeleteImageItem
DirectUI_DestroyControl
DirectUI_Edit_GetSrcText
DirectUI_Edit_SetMarkText
DirectUI_Edit_SetMarkTextColor
DirectUI_Edit_SetSrcText
DirectUI_Edit_SetSrcTextColor
DirectUI_EnableAero
DirectUI_EnableAnimate
DirectUI_EnableControl
DirectUI_GetControlPos
DirectUI_GetControlRect
DirectUI_GetControlStyle
DirectUI_GetControlText
DirectUI_GetItemImage
DirectUI_GetItemText
DirectUI_GetLanguageStyle
DirectUI_GetLastErrorCode
DirectUI_GetSafeHwnd
DirectUI_GetStringItem
DirectUI_GetStringLength
DirectUI_GetStringRect
DirectUI_GetVersion
DirectUI_HeaderCtrl_InsertItem
DirectUI_HeaderCtrl_SetControlText
DirectUI_HeaderCtrl_SetControlTextEx
DirectUI_HeaderCtrl_SetItemWidth
DirectUI_HeaderCtrl_ShowControl
DirectUI_I18N_AddLanguageStyle
DirectUI_I18N_FindCloseResItem
DirectUI_I18N_FindFirstResItem
DirectUI_I18N_FindNextResItem
DirectUI_I18N_SetCurrentI18NResItem
DirectUI_I18N_SetResConfig
DirectUI_Invalidate
DirectUI_IsControlEnabled
DirectUI_IsControlVisible
DirectUI_Layout_AnimateShow
DirectUI_ListCtrl_ChangeStyle
DirectUI_ListCtrl_DeleteAllItems
DirectUI_ListCtrl_DeleteItem
DirectUI_ListCtrl_EnableAnimate
DirectUI_ListCtrl_EnableControl
DirectUI_ListCtrl_EnsureVisible
DirectUI_ListCtrl_GetButtonCheck
DirectUI_ListCtrl_GetButtonUnknown
DirectUI_ListCtrl_GetControlRect
DirectUI_ListCtrl_GetHeadCtrlHwnd
DirectUI_ListCtrl_GetHeadCtrlId
DirectUI_ListCtrl_GetItemCount
DirectUI_ListCtrl_GetItemSrcData
DirectUI_ListCtrl_GetItemSrcDataEx
DirectUI_ListCtrl_GetItemStyle
DirectUI_ListCtrl_InsertColumn
DirectUI_ListCtrl_InsertDrawItem
DirectUI_ListCtrl_SetAutoTextItemText
DirectUI_ListCtrl_SetAutoTextItemTextEx
DirectUI_ListCtrl_SetButtonCheck
DirectUI_ListCtrl_SetButtonLogo
DirectUI_ListCtrl_SetButtonLogoImage
DirectUI_ListCtrl_SetButtonLogoImageBuffer
DirectUI_ListCtrl_SetButtonUnknown
DirectUI_ListCtrl_SetControlText
DirectUI_ListCtrl_SetControlTextEx
DirectUI_ListCtrl_SetDrawItem
DirectUI_ListCtrl_SetItemCount
DirectUI_ListCtrl_SetItemSrcData
DirectUI_ListCtrl_SetStaticLogo
DirectUI_ListCtrl_SetStaticLogoImage
DirectUI_ListCtrl_SetStaticLogoImageBuffer
DirectUI_ListCtrl_SetTooltipString
DirectUI_ListCtrl_SetTooltipStringEx
DirectUI_ListCtrl_ShowControl
DirectUI_ListCtrl_SortItems
DirectUI_LoadBackupXml
DirectUI_LoadSkinResourceFromFolder
DirectUI_LoadSkinResourceFromRes
DirectUI_LoadSkinResourceFromZIP
DirectUI_LoadSkinResourceFromZipEx
DirectUI_MoveEx
DirectUI_Progress_EnableMoving
DirectUI_Progress_GetPos
DirectUI_Progress_SetPos
DirectUI_Progress_SetRange
DirectUI_RichEdit_Clear
DirectUI_RichEdit_InsertText
DirectUI_RichEdit_SetLayeredWindow
DirectUI_RichEdit_SetReadOnly
DirectUI_ScrollBar_GetPageSize
DirectUI_ScrollBar_GetPos
DirectUI_ScrollBar_GetRange
DirectUI_ScrollBar_SetPageSize
DirectUI_ScrollBar_SetPos
DirectUI_ScrollBar_SetRange
DirectUI_SetAeroAttribute
DirectUI_SetAnimateCurFrameIndex
DirectUI_SetClipRgn
DirectUI_SetControlAlpha
DirectUI_SetControlFocus
DirectUI_SetControlPos
DirectUI_SetControlText
DirectUI_SetControlTextEx
DirectUI_SetErrorCallbackFunction
DirectUI_SetLanguageStyle
DirectUI_SetLayeredWindowAlpha
DirectUI_SetMenuItemLogo
DirectUI_SetScrollBarSkin
DirectUI_SetTooltipString
DirectUI_SetTooltipStringEx
DirectUI_SetWindowTitleHeight
DirectUI_ShowControl
DirectUI_Slider_GetPage
DirectUI_Slider_GetPos
DirectUI_Slider_GetSize
DirectUI_Slider_SetPage
DirectUI_Slider_SetPos
DirectUI_Slider_SetRange
DirectUI_Slider_SetSize
DirectUI_SrcollText_EnableScroll
DirectUI_Static_SetLogoIcon
DirectUI_Static_SetLogoImage
DirectUI_Static_SetLogoImageBuffer
DirectUI_Static_SetLogoImageId
DirectUI_SubclassLayeredWindow
DirectUI_SubclassWindow
DirectUI_TrackPopupMenu
DirectUI_TreeCtrl_ChangeStyle
DirectUI_TreeCtrl_DeleteAllItems
DirectUI_TreeCtrl_DeleteItem
DirectUI_TreeCtrl_EnableAnimate
DirectUI_TreeCtrl_EnableChildControl
DirectUI_TreeCtrl_EnableControl
DirectUI_TreeCtrl_Expand
DirectUI_TreeCtrl_GetAutoTextItemText
DirectUI_TreeCtrl_GetButtonCheck
DirectUI_TreeCtrl_GetButtonUnknown
DirectUI_TreeCtrl_GetControlRect
DirectUI_TreeCtrl_GetControlText
DirectUI_TreeCtrl_GetItemStyle
DirectUI_TreeCtrl_GetProgressPos
DirectUI_TreeCtrl_InsertItem
DirectUI_TreeCtrl_IsExpand
DirectUI_TreeCtrl_Select
DirectUI_TreeCtrl_SetAutoTextItemText
DirectUI_TreeCtrl_SetAutoTextItemTextEx
DirectUI_TreeCtrl_SetButtonCheck
DirectUI_TreeCtrl_SetButtonUnknown
DirectUI_TreeCtrl_SetControlPos
DirectUI_TreeCtrl_SetControlText
DirectUI_TreeCtrl_SetControlTextEx
DirectUI_TreeCtrl_SetItemState
DirectUI_TreeCtrl_SetProgressPos
DirectUI_TreeCtrl_SetStaticLogo
DirectUI_TreeCtrl_SetTooltipString
DirectUI_TreeCtrl_ShowControl
DirectUI_TreeEx_ChangeStyle
DirectUI_TreeEx_CreateControl
DirectUI_TreeEx_DeleteAllItems
DirectUI_TreeEx_DeleteItem
DirectUI_TreeEx_DestroyControl
DirectUI_TreeEx_EnableAnimate
DirectUI_TreeEx_EnableChildControl
DirectUI_TreeEx_EnableControl
DirectUI_TreeEx_EnableSrcollTextScroll
DirectUI_TreeEx_Expand
DirectUI_TreeEx_GetAutoTextItemText
DirectUI_TreeEx_GetButtonCheck
DirectUI_TreeEx_GetButtonUnknown
DirectUI_TreeEx_GetControlRect
DirectUI_TreeEx_GetControlText
DirectUI_TreeEx_GetItemStyle
DirectUI_TreeEx_GetProgressPos
DirectUI_TreeEx_InsertItem
DirectUI_TreeEx_IsControlVisible
DirectUI_TreeEx_IsExpand
DirectUI_TreeEx_Select
DirectUI_TreeEx_SetAutoTextItemShow
DirectUI_TreeEx_SetAutoTextItemText
DirectUI_TreeEx_SetAutoTextItemTextEx
DirectUI_TreeEx_SetButtonCheck
DirectUI_TreeEx_SetButtonLogo
DirectUI_TreeEx_SetButtonLogoImage
DirectUI_TreeEx_SetButtonLogoImageBuffer
DirectUI_TreeEx_SetButtonSelectMode
DirectUI_TreeEx_SetButtonUnknown
DirectUI_TreeEx_SetControlPos
DirectUI_TreeEx_SetControlText
DirectUI_TreeEx_SetControlTextEx
DirectUI_TreeEx_SetFirstVisible
DirectUI_TreeEx_SetItemHeight
DirectUI_TreeEx_SetProgressPos
DirectUI_TreeEx_SetStaticLogo
DirectUI_TreeEx_SetStaticLogoImage
DirectUI_TreeEx_SetStaticLogoImageBuffer
DirectUI_TreeEx_SetTooltipString
DirectUI_TreeEx_SetTopItem
DirectUI_TreeEx_ShowControl
DirectUI_UnclassWindow
DirectUI_Uninstall
DirectUI_UpdateSkin
UICtrlIdInItem
UIFindItemcInfoByText
UIFindItemsControl
UIFinishRecordPerformance
UIFreeHITEMC
UIFreeItemcInfo
UIGetButtonCheck
UIGetComboItemButtonCheck
UIGetComboItemCount
UIGetComboItemText
UIGetControlText
UIGetControlType
UIGetItemHITEMC
UIGetItemHandle
UIGetListColumnCount
UIGetListItemButtonCheck
UIGetListItemText
UIGetListRowCount
UIGetMaxScrollPos
UIGetRecordPerformance
UIGetScrollPos
UIGetTreeItemButtonCheck
UIGetTreeItemText
UIHasNextItem
UIHitTestListCtrlItem
UIHitTestTreeItem
UIInitAniRunInfo
UIIsComboBox
UIIsElementEnable
UIIsElementFocus
UIIsElementVisible
UIIsListCtrl
UIIsTreeCtrl
UIIsTreeItem
UIPauseAnimate
UIResetHITEMC
UIResumeAnimate
UIScrollToBegin
UIScrollToEnd
UISetButtonCheck
UISetComboItemButtonCheck
UISetElementEnable
UISetElementFocus
UISetElementVisible
UISetListItemButtonCheck
UISetScrollPos
UISetTreeItemButtonCheck
UIStartAnimate
UIStartAnimateFromList
UIStartAnimateFromTree
UIStartRecordPerformance
UIStopAnimate
UIStopAnimateByControl
uiChangeElemStyle
uiCloseHwnd
uiComboBoxAddString
uiComboBoxClear
uiComboBoxGetCurSel
uiComboBoxGetItemText
uiComboBoxSetCurSel
uiComboBoxSetStaticLogo
uiDeleteElem
uiDeleteElemById
uiEditSetMarkText
uiElemIsEnable
uiElemIsFocus
uiElemIsVisible
uiFindChildElem
uiFindElem
uiFindElemInTreeItem
uiFindRenderElem
uiFreeElem
uiGetButtonCheck
uiGetChildCount
uiGetChildElem
uiGetColumn
uiGetColumnInElem
uiGetElemAttri
uiGetElemPosition
uiGetElemRenderRect
uiGetElemText
uiGetElemTypeName
uiGetHwndHostHwnd
uiGetMaxScrollPos
uiGetResId
uiGetRichText
uiGetScrollPos
uiHElemToReal
uiInsertElem
uiInsertElemDirectly
uiInvalidateRect
uiIsLogicalElem
uiIsValidHElem
uiMoveElemTo
uiMoveElemToById
uiRemoveElem
uiRenderToMemory
uiRootElem
uiScrollToBegin
uiScrollToEnd
uiSetButtonCheck
uiSetElemAttri
uiSetElemEnable
uiSetElemFocus
uiSetElemLogo
uiSetElemLogoByData
uiSetElemLogoByImage
uiSetElemPosition
uiSetElemText
uiSetElemVisible
uiSetHwndHostHwnd
uiSetRichMarkColor
uiSetRichMarkText
uiSetRichText
uiSetRichTextColor
uiSetScrollPos
uiSetVListCtrlCb
uiSubClassWindow
uiUpdateVListCtrl
uiUpdateWindow

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 261KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EnumModules.exe
.exe windows:5 windows x64 arch:x64

f78cbdd577c5625a8fab0469bb25225c

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d1:f0:c8:36:35:00:7b:18:b8:12:25:14:2f:fd:5d:e5:fb:61:5d:08
Signer

Actual PE Digest

d1:f0:c8:36:35:00:7b:18:b8:12:25:14:2f:fd:5d:e5:fb:61:5d:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

u:\app\gensoft\security-client\pc-faster\public\output\pdb\EnumModules.pdb

Imports

kernel32

Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
WideCharToMultiByte
MultiByteToWideChar
CreateToolhelp32Snapshot
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetModuleFileNameW
CloseHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetLastError
HeapFree
HeapAlloc
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapReAlloc
FlushFileBuffers

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FasterNow.exe
.exe windows:5 windows x86 arch:x86

f34a0656a70c0628754a00443dd1c351

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bf:b6:7d:ed:5c:37:64:43:a8:59:c9:8d:8e:b1:59:3c:10:c8:9d
Signer

Actual PE Digest

51:bf:b6:7d:ed:5c:37:64:43:a8:59:c9:8d:8e:b1:59:3c:10:c8:9d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\FasterNow.pdb

Imports

directui

DirectUI_Static_SetLogoIcon
DirectUI_Button_SetCheck
uiUpdateWindow
UIScrollToBegin
DirectUI_GetStringItem
DirectUI_SubclassWindow
DirectUI_TreeEx_DeleteAllItems
DirectUI_TreeEx_DeleteItem
DirectUI_TreeEx_InsertItem
DirectUI_TreeEx_CreateControl
DirectUI_TreeEx_SetItemHeight
DirectUI_TreeEx_IsExpand
DirectUI_TreeEx_Expand
DirectUI_TreeEx_SetStaticLogo
DirectUI_TreeEx_SetButtonUnknown
DirectUI_TreeEx_SetButtonCheck
DirectUI_TreeEx_GetButtonUnknown
DirectUI_LoadSkinResourceFromZIP
DirectUI_TreeEx_SetTooltipString
DirectUI_TreeEx_SetControlTextEx
DirectUI_TreeEx_GetControlText
DirectUI_TreeEx_SetControlText
DirectUI_TreeEx_ShowControl
DirectUI_TreeEx_ChangeStyle
DirectUI_AutoText_SetControlText
DirectUI_TrackPopupMenu
DirectUI_EnableControl
DirectUI_SetLayeredWindowAlpha
DirectUI_SetLanguageStyle
DirectUI_SubclassLayeredWindow
DirectUI_EnableAnimate
DirectUI_SetControlTextEx
DirectUI_SetControlText
DirectUI_SetControlPos
DirectUI_GetControlRect
DirectUI_ChangeStyle
DirectUI_IsControlVisible
DirectUI_ShowControl
DirectUI_I18N_AddLanguageStyle
DirectUI_GetVersion
DirectUI_UpdateSkin
DirectUI_TreeEx_GetButtonCheck

datareport

RD_WW
RD_WS
RD_W
Stop
Start

gdiplus

GdipCreateMatrix
GdiplusShutdown
GdiplusStartup
GdipDeleteMatrix
GdipTranslateMatrix
GdipFree
GdipAlloc
GdipRotateMatrix
GdipCreateFromHDC
GdipDeleteGraphics
GdipDisposeImage
GdipSetWorldTransform
GdipGetWorldTransform
GdipDrawImageRectI
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreatePath
GdipDeletePath
GdipAddPathPieI
GdipDeleteRegion
GdipCreateRegion
GdipGetClip
GdipSetClipRegion
GdipSetClipPath
GdipDrawImageRectRectI
GdipGraphicsClear

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ
?DelInstance@CAPCDispatcher@@SAXXZ
?WriteOptLog@CAPCDispatcher@@QAEHW4OPTType@OptItem@@W4OPTAction@3@PB_W22@Z
?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

UnmapViewOfFile
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
GetLastError
GetTickCount
GetCurrentProcess
GetPrivateProfileStringW
GetTimeZoneInformation
GetPrivateProfileSectionW
CreateFileW
GetFileSize
OpenFileMappingW
MapViewOfFile
lstrlenW
SetLastError
CreateFileMappingW
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
ReadFile
GetTempFileNameW
CopyFileW
DeleteFileW
lstrcmpiW
RaiseException
LoadLibraryExW
GetCommandLineW
FlushInstructionCache
CreateProcessW
GetPrivateProfileIntW
GlobalMemoryStatusEx
GetSystemTime
WritePrivateProfileStringW
GetShortPathNameW
TerminateThread
InitializeCriticalSectionAndSpinCount
CreateEventW
SetEvent
SetThreadPriority
GetCurrentThread
WaitForSingleObject
GetLogicalDrives
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
OpenProcess
LoadLibraryW
WinExec
SetPriorityClass
QueryDosDeviceW
Sleep
Process32FirstW
Process32NextW
InterlockedExchange
TerminateProcess
DeviceIoControl
SetProcessWorkingSetSize
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
InterlockedExchangeAdd
SystemTimeToFileTime
CreateDirectoryW
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
LocalAlloc
LocalFree
WTSGetActiveConsoleSessionId
GlobalAlloc
GlobalFree
ResetEvent
WriteFile
lstrlenA
OutputDebugStringW
ProcessIdToSessionId
DebugBreak
VirtualProtect
GetVersion
IsBadCodePtr
IsBadReadPtr
GetModuleHandleExW
ExitThread
GetModuleHandleA
VirtualFree
CreateFileMappingA
GetLocalTime
GetWindowsDirectoryW
InterlockedCompareExchange
GetFileSizeEx
VirtualQueryEx
HeapCreate
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
VirtualQuery
GetModuleFileNameA
ReleaseMutex
CreateMutexW
lstrcatA
GetThreadContext
OpenMutexW
DuplicateHandle
VirtualAlloc
OpenEventW
lstrcpyA
VirtualProtectEx
WriteProcessMemory
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
lstrcpyW
SetEndOfFile
SetFilePointer
HeapDestroy
HeapReAlloc
HeapSize
LoadLibraryA
IsProcessorFeaturePresent
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetModuleFileNameW
CreateThread
GetStartupInfoW
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
GetModuleHandleW
DeleteCriticalSection
InitializeCriticalSection
GetProcAddress
GetVersionExW
LeaveCriticalSection
EnterCriticalSection
ExpandEnvironmentStringsW
LockResource
GetLongPathNameW
GetCurrentDirectoryW
GetTempPathW
GetFileAttributesW
SizeofResource
GetSystemDirectoryW
GetSystemWindowsDirectoryW
LoadResource
FindResourceW
SetErrorMode
FindResourceExW
GetEnvironmentVariableW
TlsSetValue
TlsFree
ExitProcess
GetStdHandle
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
CreateFileA
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetProcessTimes
CreateToolhelp32Snapshot

user32

SetCapture
SystemParametersInfoW
InvalidateRect
RedrawWindow
UpdateWindow
PostQuitMessage
SetWindowTextW
GetParent
DefWindowProcW
OffsetRect
KillTimer
SetTimer
SetFocus
SendMessageW
GetWindowLongW
WindowFromPoint
GetShellWindow
GetDesktopWindow
MoveWindow
GetSystemMetrics
EmptyClipboard
IsWindow
CreateWindowExW
MonitorFromPoint
GetMonitorInfoW
BringWindowToTop
GetTopWindow
OpenClipboard
ReleaseCapture
FindWindowExW
IsHungAppWindow
LoadCursorW
GetClassInfoExW
RegisterClassExW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
CharNextW
CloseClipboard
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
RegisterWindowMessageW
IsWindowVisible
DestroyWindow
SetWindowLongW
SetForegroundWindow
SetWindowPos
PtInRect
ClientToScreen
GetCursorPos
IntersectRect
EqualRect
EnumDisplayMonitors
CallWindowProcW
PrivateExtractIconsW
UpdateLayeredWindow
EnumWindows
GetCapture
CopyRect
UnionRect
ScreenToClient
CreatePopupMenu
AppendMenuW
FindWindowW
DestroyMenu
ShowWindow
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
GetThreadDesktop
GetWindowRect
UnregisterClassA

gdi32

CreateICW
DeleteDC
SelectObject
CreateCompatibleBitmap
DeleteObject
CreateCompatibleDC

advapi32

SetTokenInformation
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
EnumServicesStatusExW
RegEnumKeyW
RegOpenCurrentUser
RevertToSelf
ImpersonateLoggedOnUser
GetUserNameW
QueryServiceConfigW
ControlService
QueryServiceStatusEx
StartServiceW
QueryServiceConfig2W
OpenServiceW
EnumDependentServicesW
OpenSCManagerW
CloseServiceHandle
RegQueryValueW
RegOpenKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
CreateProcessAsUserW
FreeSid
AllocateAndInitializeSid
GetKernelObjectSecurity
GetLengthSid
DuplicateTokenEx

shell32

ShellExecuteW
ShellExecuteExW
SHOpenFolderAndSelectItems
SHGetDesktopFolder
SHGetFolderPathW
ord165
CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
IIDFromString
CoInitialize

oleaut32

VarUI4FromStr

psapi

GetModuleInformation
GetModuleFileNameExW
EmptyWorkingSet
GetProcessMemoryInfo
GetProcessImageFileNameW

iphlpapi

GetIfTable

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory

shlwapi

PathQuoteSpacesW
SHDeleteValueW
SHSetValueW
PathRemoveArgsW
SHGetValueW
StrFormatByteSizeW
PathIsDirectoryW
StrToIntW
PathIsRelativeW
PathAddBackslashW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
PathFindFileNameW
PathRemoveExtensionW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

pdh

PdhOpenQueryW
PdhLookupPerfNameByIndexW
PdhAddCounterW
PdhCollectQueryData
PdhEnumObjectItemsW
PdhCloseQuery
PdhRemoveCounter
PdhGetFormattedCounterValue

rpcrt4

RpcStringFreeW
UuidFromStringW
UuidToStringW

winhttp

WinHttpCreateUrl

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

Sections

.text
Size: 651KB - Virtual size: 651KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Feedback.dll
.dll windows:5 windows x86 arch:x86

3ec398029b8e998bc9df72b3bf775c77

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

de:80:12:f2:ca:34:36:78:b3:16:1f:fe:bf:3d:69:77:da:db:f3:7c
Signer

Actual PE Digest

de:80:12:f2:ca:34:36:78:b3:16:1f:fe:bf:3d:69:77:da:db:f3:7c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Feedback.pdb

Imports

kernel32

Process32FirstW
CreateToolhelp32Snapshot
VerifyVersionInfoW
VerSetConditionMask
GetPrivateProfileStringW
GetStdHandle
WinExec
OutputDebugStringW
GetPrivateProfileIntW
GetTickCount
ReadFile
GetFileSize
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
GetTempPathW
GetLocalTime
FileTimeToSystemTime
SetFilePointer
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingW
SystemTimeToFileTime
UnmapViewOfFile
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
Process32NextW
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetModuleHandleA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
ExitProcess
HeapCreate
GetCPInfo
LCMapStringW
LCMapStringA
GetCommandLineA
CreateThread
ResumeThread
ExitThread
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
CreateFileW
WriteFile
WideCharToMultiByte
CloseHandle
GlobalHandle
GlobalFree
LoadLibraryExW
FreeLibrary
GlobalLock
GlobalUnlock
MulDiv
lstrcmpW
SetLastError
lstrlenA
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
GlobalAlloc
GetCurrentProcess
FlushInstructionCache
SizeofResource
lstrcmpiW
GetModuleHandleW
GetProcAddress
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
Sleep
CreateDirectoryW
GetModuleFileNameW
FindResourceExW
FindResourceW
LoadResource
LockResource

user32

GetDC
GetSystemMetrics
InflateRect
PtInRect
GetWindowLongW
SetWindowLongW
SetWindowPos
GetParent
SetCapture
ShowWindow
ReleaseDC
GetActiveWindow
MessageBoxW
DialogBoxParamW
WindowFromPoint
GetForegroundWindow
keybd_event
EnableWindow
EnumWindows
MoveWindow
SendMessageW
GetCapture
EndDialog
SetCursor
LoadCursorW
GetMessagePos
GetWindowRect
IsWindowVisible
ReleaseCapture
GetDesktopWindow
GetWindow
GetTopWindow
CharNextW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
DefWindowProcW
UnregisterClassA
GetSysColor
GetWindowThreadProcessId
FindWindowExW
SetForegroundWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
BringWindowToTop
CreateDialogIndirectParamW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
RegisterClassExW
GetClassInfoExW
IsWindow
SetFocus
GetFocus
DestroyAcceleratorTable
BeginPaint
EndPaint
CallWindowProcW
FillRect
GetClassNameW
IsChild
RedrawWindow
InvalidateRgn
InvalidateRect
ScreenToClient
ClientToScreen
GetClientRect
PostQuitMessage
MapDialogRect
DestroyWindow
SetWindowContextHelpId
GetDlgItem
SendDlgItemMessageW
CreateWindowExW

gdi32

BitBlt
SelectObject
CreateCompatibleBitmap
DeleteDC
GetDIBits
GetDeviceCaps
CreateSolidBrush
GetObjectW
GetStockObject
CreateCompatibleDC
DeleteObject

comdlg32

CommDlgExtendedError
GetOpenFileNameW

advapi32

RegQueryValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyW
RegSetValueW

shell32

ShellExecuteW
ord165
SHGetFolderPathW

ole32

OleUninitialize
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
OleInitialize

oleaut32

LoadRegTypeLi
SysFreeString
SysStringLen
SysAllocString
VarUI4FromStr
LoadTypeLi
VariantInit
VariantClear
DispCallFunc
OleCreateFontIndirect
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen

directui

DirectUI_I18N_AddLanguageStyle
DirectUI_GetControlRect
DirectUI_GetVersion
DirectUI_SetControlPos
DirectUI_LoadSkinResourceFromZIP
DirectUI_UpdateSkin
DirectUI_SetControlText
DirectUI_ShowControl
DirectUI_SubclassWindow
DirectUI_Static_SetLogoImageBuffer

shlwapi

PathAppendW
PathRemoveFileSpecW
PathIsRelativeW
PathFindExtensionW
PathIsDirectoryW
StrStrIW

gdiplus

GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDisposeImage
GdipFree
GdipAlloc

wininet

InternetConnectW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenW

Exports

Exports

?CreateFeedbackDialog@feedback@baidu@@YAKW4ProductId@12@PB_W11W4LanguageId@12@1P6AJ1PAUtagVARIANT@@33@Z1111PAPB_W@Z
?FeedbackDialogExecScript@feedback@baidu@@YAJPB_WPAUtagVARIANT@@@Z
?QueryReply@feedback@baidu@@YAKKKPB_W0AAH1W4LanguageId@12@PA_WIAA_N@Z
?QueryReply@feedback@baidu@@YAKW4ProductId@12@W4LanguageId@12@PB_WPA_WI@Z
?SubmitFeedback@feedback@baidu@@YAKW4ProductId@12@PB_W11W4LanguageId@12@111K111AAH3PA_WI111PAPB_W@Z
test

Sections

.text
Size: 304KB - Virtual size: 304KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fonts/HelveticaNeueLTPro-Th.otf
HomeRank.dat
.xml
I18N/1028/BCloud/BCloud.bskin
.7z
skin.xml
skin/fastantivirus/cloudscan_down.png
.png
skin/fastantivirus/cloudscan_hover.png
.png
skin/fastantivirus/cloudscan_normal.png
.png
skin/fastantivirus/reportBg.png
.png
skin/fastantivirus/res_total_million.png
.png
I18N/1028/BaiduSafe/BaiduSafe.bskin
.7z
skin.xml
.xml
skin/cleaner/guide_text.png
.png
skin/home/result_atRisk.png
.png
skin/mainframe/bc_update.bmp
skin/mainframe/btn_NF_down.png
.png
skin/mainframe/btn_NF_hover.png
.png
skin/mainframe/btn_NF_normal.png
.png
skin/mainframe/feedback_bear.png
.png
skin/mainframe/junk_text_compelete.png
.png
skin/mainframe/set_usb_wnd.png
.png
skin/optimizer/btn_fb_down.png
.png
skin/optimizer/btn_fb_hover.png
.png
skin/optimizer/btn_fb_normal.png
.png
skin/optimizer/btn_tw_down.png
.png
skin/optimizer/btn_tw_hover.png
.png
skin/optimizer/btn_tw_normal.png
.png
skin/optimizer/item_bad_hover.png
.png
skin/optimizer/item_perfect_hover.png
.png
skin/tools/Internet-faster.png
.png
skin/tools/Windows-faster.png
.png
I18N/1028/BugReporter/BugReporter.bskin
.7z
skin.xml
I18N/1028/PcfTray/PcfTray.bskin
.7z
skin.xml
.xml
skin/bc_update.bmp
skin/btn_NF_down.png
.png
skin/btn_NF_hover.png
.png
skin/btn_NF_normal.png
.png
skin/feedback_bear.png
.png
skin/junk_text_compelete.png
.png
skin/pic.png
.png
I18N/1028/common/common.bskin
.7z
skin.xml
I18N/1028/feedback/feedback.bskin
.7z
skin.xml
.xml
skin/mainframe/feedback_bear.png
.png
skin/mainframe/feedback_ok.png
.png
skin/mainframe/feedback_welcome.png
.png
skin/mainframe/tips_bg_taiwan.png
.png
I18N/1028/lang.ini
I18N/1028/nsis_install/nsis_install.bskin
.7z
skin.xml
.xml
skin/K1.png
.png
skin/K2.png
.png
skin/T1.png
.png
skin/T2.png
.png
I18N/1028/popups/popups.bskin
.7z
skin.xml
.xml
skin/lottery_bk.png
.png
I18N/1028/screensnpashot/screensnpashot.bskin
.7z
I18N/1028/tools/BigFileCleaner/BigFileCleaner.bskin
.7z
I18N/1028/tools/FasterNow/FasterNow.bskin
.7z
I18N/1028/tools/WifiSharing/WifiSharing.bskin
.7z
I18N/1028/update/update.bskin
.7z
I18N/1033/BCloud/BCloud.bskin
.7z
I18N/1033/BaiduSafe/BaiduSafe.bskin
.7z
I18N/1033/BugReporter/BugReporter.bskin
.7z
I18N/1033/PcfTray/PcfTray.bskin
.7z
I18N/1033/common/common.bskin
.7z
I18N/1033/feedback/feedback.bskin
.7z
I18N/1033/lang.ini
I18N/1033/nsis_install/nsis_install.bskin
.7z
I18N/1033/popups/popups.bskin
.7z
I18N/1033/screensnpashot/screensnpashot.bskin
.7z
I18N/1033/tools/BigFileCleaner/BigFileCleaner.bskin
.7z
I18N/1033/tools/FasterNow/FasterNow.bskin
.7z
I18N/1033/tools/WifiSharing/WifiSharing.bskin
.7z
I18N/1033/update/update.bskin
.7z
I18N/1046/BCloud/BCloud.bskin
.7z
I18N/1046/BaiduSafe/BaiduSafe.bskin
.7z
I18N/1046/BugReporter/BugReporter.bskin
.7z
I18N/1046/PcfTray/PcfTray.bskin
.7z
I18N/1046/common/common.bskin
.7z
I18N/1046/feedback/feedback.bskin
.7z
I18N/1046/lang.ini
I18N/1046/nsis_install/nsis_install.bskin
.7z
I18N/1046/popups/popups.bskin
.7z
I18N/1046/screensnpashot/screensnpashot.bskin
.7z
I18N/1046/sound/clean.wav
I18N/1046/sound/startup.wav
I18N/1046/sound/update.wav
I18N/1046/tools/BigFileCleaner/BigFileCleaner.bskin
.7z
I18N/1046/tools/FasterNow/FasterNow.bskin
.7z
I18N/1046/tools/WifiSharing/WifiSharing.bskin
.7z
I18N/1046/update/update.bskin
.7z
I18N/1054/BCloud/BCloud.bskin
.7z
I18N/1054/BaiduSafe/BaiduSafe.bskin
.7z
I18N/1054/BugReporter/BugReporter.bskin
.7z
I18N/1054/PcfTray/PcfTray.bskin
.7z
I18N/1054/common/common.bskin
.7z
I18N/1054/feedback/feedback.bskin
.7z
I18N/1054/lang.ini
I18N/1054/nsis_install/nsis_install.bskin
.7z
I18N/1054/popups/popups.bskin
.7z
I18N/1054/screensnpashot/screensnpashot.bskin
.7z
I18N/1054/tools/BigFileCleaner/BigFileCleaner.bskin
.7z
I18N/1054/tools/FasterNow/FasterNow.bskin
.7z
I18N/1054/tools/WifiSharing/WifiSharing.bskin
.7z
I18N/1054/update/update.bskin
.7z
I18N/1057/BCloud/BCloud.bskin
.7z
I18N/1057/BaiduSafe/BaiduSafe.bskin
.7z
I18N/1057/BugReporter/BugReporter.bskin
.7z
I18N/1057/PcfTray/PcfTray.bskin
.7z
I18N/1057/common/common.bskin
.7z
I18N/1057/feedback/feedback.bskin
.7z
I18N/1057/lang.ini
I18N/1057/nsis_install/nsis_install.bskin
.7z
I18N/1057/popups/popups.bskin
.7z
I18N/1057/screensnpashot/screensnpashot.bskin
.7z
I18N/1057/tools/BigFileCleaner/BigFileCleaner.bskin
.7z
I18N/1057/tools/FasterNow/FasterNow.bskin
.7z
I18N/1057/tools/WifiSharing/WifiSharing.bskin
.7z
I18N/1057/update/update.bskin
.7z
I18N/3082/BCloud/BCloud.bskin
.7z
I18N/3082/BaiduSafe/BaiduSafe.bskin
.7z
I18N/3082/BugReporter/BugReporter.bskin
.7z
I18N/3082/PcfTray/PcfTray.bskin
.7z
I18N/3082/common/common.bskin
.7z
I18N/3082/feedback/feedback.bskin
.7z
I18N/3082/lang.ini
I18N/3082/nsis_install/nsis_install.bskin
.7z
I18N/3082/popups/popups.bskin
.7z
I18N/3082/screensnpashot/screensnpashot.bskin
.7z
I18N/3082/tools/BigFileCleaner/BigFileCleaner.bskin
.7z
I18N/3082/tools/FasterNow/FasterNow.bskin
.7z
I18N/3082/tools/WifiSharing/WifiSharing.bskin
.7z
I18N/3082/update/update.bskin
.7z
LogReporter.exe
.exe windows:5 windows x86 arch:x86

e346f319aee147d32246b4b31d5e61b5

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:82:81:ab:d1:a6:89:79:66:17:61:23:bb:2e:75:4e:b9:d1:9a:9c
Signer

Actual PE Digest

27:82:81:ab:d1:a6:89:79:66:17:61:23:bb:2e:75:4e:b9:d1:9a:9c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\LogReporter.pdb

Imports

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ
?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

CreateToolhelp32Snapshot
GetPrivateProfileIntW
GetPrivateProfileStringW
GetModuleFileNameW
lstrlenW
ReadFile
GetTempFileNameW
GetTempPathW
GetPrivateProfileSectionW
GetTimeZoneInformation
WriteFile
Sleep
GetLocalTime
GetWindowsDirectoryW
GetVersionExW
WTSGetActiveConsoleSessionId
OutputDebugStringW
GlobalMemoryStatusEx
ProcessIdToSessionId
GetSystemInfo
CreateMutexW
SystemTimeToTzSpecificLocalTime
GetCommandLineW
SetLastError
DebugBreak
VirtualProtect
GetVersion
IsBadCodePtr
IsBadReadPtr
GetModuleHandleExW
ExitThread
CreateDirectoryW
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
FlushInstructionCache
VirtualFree
CreateFileMappingA
LocalFree
LocalAlloc
InterlockedExchange
InterlockedCompareExchange
WritePrivateProfileStringW
SystemTimeToFileTime
GetFileSizeEx
CreateProcessW
ReadProcessMemory
VirtualQueryEx
InitializeCriticalSectionAndSpinCount
lstrlenA
HeapCreate
HeapAlloc
CreateEventW
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
GetCurrentThreadId
TerminateProcess
VirtualQuery
GetModuleFileNameA
ReleaseMutex
lstrcatA
GetThreadContext
OpenMutexW
DuplicateHandle
VirtualAlloc
OpenFileMappingW
OpenEventW
lstrcpyA
VirtualAllocEx
VirtualFreeEx
GetCurrentThread
VirtualProtectEx
WriteProcessMemory
GetProcessHeap
HeapFree
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
lstrcpyW
SetEndOfFile
SetFilePointer
GetPrivateProfileSectionNamesW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetDriveTypeA
WriteConsoleW
GetConsoleOutputCP
Process32FirstW
OpenProcess
Process32NextW
SetDllDirectoryW
InterlockedIncrement
GetCurrentProcess
GetExitCodeProcess
WaitForSingleObject
DeleteFileW
GetLastError
CopyFileW
GetCurrentProcessId
GetTickCount
VerifyVersionInfoW
VerSetConditionMask
FreeLibrary
LoadLibraryW
GetProcAddress
GetModuleHandleW
DeviceIoControl
LockResource
GlobalFree
MultiByteToWideChar
SizeofResource
WideCharToMultiByte
GlobalAlloc
LoadResource
FindResourceW
FindResourceExW
CreateFileA
FindClose
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
UnmapViewOfFile
CloseHandle
MoveFileW
FlushFileBuffers
ResetEvent
SetEvent
WriteConsoleA
IsDebuggerPresent
SetStdHandle
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
GetSystemTimeAsFileTime
LoadLibraryA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
GetCurrentDirectoryA
GetFullPathNameW
GetStdHandle
ExitProcess
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
HeapDestroy
HeapReAlloc
RtlUnwind
RaiseException
LCMapStringW
LCMapStringA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
GetCPInfo
CreateThread
UnhandledExceptionFilter

user32

GetThreadDesktop
CloseDesktop
OpenInputDesktop
wsprintfW
DispatchMessageW
CallWindowProcW
CreateWindowExW
IsWindow
SetTimer
SendMessageTimeoutW
SetWindowLongW
GetWindowLongW
KillTimer
PostMessageW
GetMessageW
GetUserObjectInformationA

advapi32

GetUserNameW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExA
RegQueryInfoKeyW
GetTokenInformation
AllocateAndInitializeSid
EqualSid
RevertToSelf
RegCloseKey
GetLengthSid
GetKernelObjectSecurity
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
CreateProcessAsUserW
DuplicateTokenEx
SetTokenInformation
RegEnumValueW
RegEnumKeyExW
RegSetValueExW
QueryServiceStatus
RegOpenUserClassesRoot
StartServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
LookupPrivilegeValueW
AdjustTokenPrivileges
ImpersonateLoggedOnUser
RegOpenCurrentUser
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
OpenProcessToken

shell32

SHFileOperationW
ord165
ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoCreateGuid
CoInitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantClear

log

WriteLog

shlwapi

SHSetValueW
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
PathFindFileNameW
PathAddBackslashW
SHGetValueW
PathUnquoteSpacesW
PathRemoveArgsW
StrTrimW
SHDeleteValueW
PathFindExtensionW
PathRemoveExtensionW
PathRenameExtensionW
PathAppendW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

iphlpapi

GetAdaptersAddresses

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

winhttp

WinHttpCreateUrl
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpSetOption
WinHttpOpen
WinHttpWriteData
WinHttpSetCredentials
WinHttpAddRequestHeaders

ws2_32

htonl
WSAStartup
WSACleanup

psapi

GetModuleInformation
GetModuleFileNameExW
GetModuleBaseNameW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

Sections

.text
Size: 490KB - Virtual size: 489KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NSISInstall.exe
.exe windows:5 windows x86 arch:x86

122ff507bb5b8f3540db5492d9f3dc2c

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a8:93:eb:ff:c7:94:ed:22:a4:21:13:ff:29:c7:64:7c:ca:94:d5:33
Signer

Actual PE Digest

a8:93:eb:ff:c7:94:ed:22:a4:21:13:ff:29:c7:64:7c:ca:94:d5:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\NSISInstall.pdb

Imports

installutility

GetString
CheckPathEverInstalled
GetCurrentLangID
CheckInstallPath

directui

DirectUI_SubclassWindow
DirectUI_Progress_EnableMoving
DirectUI_SetLanguageStyle
DirectUI_AutoText_SetControlText
DirectUI_UpdateSkin
DirectUI_LoadSkinResourceFromZIP
DirectUI_I18N_AddLanguageStyle
DirectUI_Edit_SetSrcText
DirectUI_GetVersion
DirectUI_ShowControl
DirectUI_SetControlText
DirectUI_SetControlPos
DirectUI_SetControlTextEx
DirectUI_CreateControl
DirectUI_DestroyControl
DirectUI_GetStringItem
DirectUI_SubclassLayeredWindow
DirectUI_Progress_SetPos
DirectUI_Button_GetCheck
DirectUI_Button_SetCheck

log

WriteLog

kernel32

GetDiskFreeSpaceExW
CreateProcessW
GetVersionExW
GetCurrentProcess
FlushInstructionCache
InitializeCriticalSection
FreeLibrary
lstrcmpiW
LoadLibraryExW
InterlockedDecrement
InterlockedIncrement
GetCommandLineW
CreateFileMappingW
MapViewOfFile
LocalFree
OpenFileMappingW
UnmapViewOfFile
ExitProcess
lstrlenA
GetTimeZoneInformation
WriteFile
SetEvent
ResetEvent
CreateEventW
SetFilePointer
FlushFileBuffers
InterlockedExchangeAdd
InterlockedExchange
OpenThread
DisconnectNamedPipe
WriteFileEx
CreateNamedPipeW
ConnectNamedPipe
ReadFileEx
GetOverlappedResult
GetModuleHandleExW
CreateThread
WaitNamedPipeW
SetNamedPipeHandleState
GetTickCount
InterlockedCompareExchange
TerminateThread
SwitchToThread
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetDriveTypeA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetModuleHandleA
GetLocaleInfoW
SetStdHandle
GetStringTypeW
GetStringTypeA
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
HeapCreate
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCurrentDirectoryA
GetFullPathNameW
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
ResumeThread
ExitThread
GetSystemTimeAsFileTime
GetStartupInfoW
RtlUnwind
FindFirstFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetDriveTypeW
HeapSize
HeapReAlloc
HeapDestroy
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
RaiseException
GetCurrentThreadId
CreateFileA
FindResourceExW
FindResourceW
LoadResource
WideCharToMultiByte
SizeofResource
MultiByteToWideChar
VerSetConditionMask
VerifyVersionInfoW
WinExec
OpenMutexW
IsBadReadPtr
GetCurrentProcessId
HeapAlloc
lstrlenW
InitializeCriticalSectionAndSpinCount
HeapFree
GetProcessHeap
Sleep
OpenProcess
ExpandEnvironmentStringsW
OutputDebugStringW
SetLastError
GetPrivateProfileIntW
GetPrivateProfileStringW
GetModuleHandleW
MulDiv
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
VirtualFree
GetModuleFileNameW
ReadFile
VirtualAlloc
GetLastError
CreateFileW
IsValidLocale
CloseHandle
LockResource

user32

GetWindowLongW
SetWindowLongW
SetWindowPos
SetWindowTextW
UnregisterClassA
GetAsyncKeyState
ScreenToClient
SetCursor
SendMessageTimeoutW
GetClientRect
DefWindowProcW
CreateWindowExW
SendMessageW
IsWindow
GetWindowTextLengthW
GetWindowTextW
EnableWindow
CallWindowProcW
ShowWindow
FindWindowExW
GetWindowThreadProcessId
GetClassInfoW
RegisterClassW
BeginPaint
EndPaint
DrawTextW
TrackMouseEvent
InvalidateRect
MapWindowPoints
GetParent
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
BringWindowToTop
SetActiveWindow
DestroyWindow
KillTimer
SetTimer
EndDialog
GetPropW
SetPropW
IsWindowEnabled
MsgWaitForMultipleObjectsEx
LoadImageW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
MonitorFromPoint
GetMenuItemInfoW
RemoveMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenuEx
DestroyMenu
CreatePopupMenu
PeekMessageW
MessageBeep
SetFocus
PostQuitMessage
LoadStringA
LoadStringW
DialogBoxParamW
LoadCursorW
GetClassInfoExW
RegisterClassExW
TranslateAcceleratorW
IsWindowVisible
GetActiveWindow
ClientToScreen
PtInRect
PostMessageW
UpdateLayeredWindow
GetDesktopWindow
DialogBoxIndirectParamW
GetDialogBaseUnits
SetRect
OffsetRect
GetSystemMetrics
GetMenuState
DeleteMenu
EnableMenuItem
GetSystemMenu

gdi32

SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
CreateSolidBrush
DeleteDC
CreateFontW
GetObjectW
CreateDIBSection
RoundRect
CreatePen
SetBkMode
SetTextColor
BitBlt

advapi32

RegQueryValueExW
RegOpenKeyW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
RegQueryValueW

shell32

SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathW
CommandLineToArgvW
SHGetSpecialFolderPathW
ord165
ShellExecuteW

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathIsDirectoryW
PathIsRelativeW
PathStripToRootW
SHGetValueW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

winhttp

WinHttpCreateUrl

winmm

timeBeginPeriod
timeKillEvent
timeEndPeriod
timeSetEvent
timeGetDevCaps

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 268KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NewUpdater.exe
.exe windows:5 windows x86 arch:x86

ce8cf05e10ab022d7afa6ba8a1d5e43c

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a0:34:7c:9c:cb:72:93:a3:35:74:6f:c6:89:9c:09:ff:f5:8e:ca:31
Signer

Actual PE Digest

a0:34:7c:9c:cb:72:93:a3:35:74:6f:c6:89:9c:09:ff:f5:8e:ca:31

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\NewUpdater.pdb

Imports

directui

DirectUI_GetStringItem
DirectUI_SetLanguageStyle
DirectUI_AutoText_SetControlText
DirectUI_LoadSkinResourceFromZIP
DirectUI_UpdateSkin
DirectUI_I18N_AddLanguageStyle
DirectUI_Progress_GetPos
DirectUI_Progress_SetPos
DirectUI_SetControlText
DirectUI_GetVersion
DirectUI_SubclassWindow
DirectUI_ShowControl

datareport

Stop
Start
RD_WS
RD_W

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z
?GetInstance@CAPCDispatcher@@SAPAV1@XZ

kernel32

GetPrivateProfileStringW
GetProcAddress
GetModuleHandleW
GlobalMemoryStatusEx
lstrlenW
GetPrivateProfileSectionW
GetTimeZoneInformation
GetPrivateProfileIntW
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
InitializeCriticalSection
FreeLibrary
lstrcmpiW
RaiseException
LoadLibraryExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetCommandLineW
FlushInstructionCache
SetLastError
GetVersionExW
ExpandEnvironmentStringsW
GetTickCount
WaitForSingleObject
LoadLibraryW
WritePrivateProfileStringW
CreateProcessW
GetExitCodeProcess
OpenFileMappingW
TerminateProcess
MoveFileExW
ProcessIdToSessionId
DebugBreak
VirtualProtect
GetVersion
IsBadCodePtr
IsBadReadPtr
GetModuleHandleExW
ExitThread
CreateDirectoryW
GetModuleHandleA
VirtualFree
CreateFileMappingA
WideCharToMultiByte
GetLocalTime
GetWindowsDirectoryW
LocalAlloc
InterlockedExchange
InterlockedCompareExchange
SystemTimeToFileTime
WriteFile
GetFileSizeEx
WTSGetActiveConsoleSessionId
GetCurrentProcessId
VirtualQueryEx
InitializeCriticalSectionAndSpinCount
lstrlenA
HeapCreate
HeapAlloc
CreateEventW
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
VirtualQuery
GetModuleFileNameA
ReleaseMutex
CreateMutexW
lstrcatA
GetThreadContext
OpenMutexW
DuplicateHandle
VirtualAlloc
OpenEventW
lstrcpyA
VirtualAllocEx
VirtualFreeEx
GetCurrentThread
VirtualProtectEx
WriteProcessMemory
GetProcessHeap
HeapFree
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
lstrcpyW
SetEndOfFile
SetFilePointer
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStdHandle
ExitProcess
RtlUnwind
IsDebuggerPresent
TlsAlloc
UnhandledExceptionFilter
GetStartupInfoW
CreateThread
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
TlsSetValue
TlsFree
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
DeleteFileW
CopyFileW
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetTempFileNameW
GetTempPathW
GetModuleFileNameW
ReadFile
GetFileSize
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetCurrentProcess
VerSetConditionMask
VerifyVersionInfoW
CreateToolhelp32Snapshot
Process32FirstW
CloseHandle
OpenProcess
GetLastError
Process32NextW
MultiByteToWideChar
LocalFree
ReadProcessMemory

user32

CreatePopupMenu
TrackPopupMenuEx
AppendMenuW
GetMenuItemCount
RemoveMenu
InvalidateRect
PtInRect
DestroyMenu
LoadStringA
LoadStringW
TranslateAcceleratorW
GetThreadDesktop
CloseDesktop
GetUserObjectInformationA
GetMenuItemInfoW
MonitorFromPoint
CallWindowProcW
SetWindowTextW
PostQuitMessage
KillTimer
SetFocus
CreateWindowExW
LoadCursorW
GetClassInfoExW
LoadImageW
RegisterClassExW
DestroyWindow
OpenInputDesktop
MessageBeep
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
FindWindowW
MoveWindow
CharNextW
SetLayeredWindowAttributes
IsWindow
PostMessageW
UpdateWindow
RedrawWindow
SendMessageW
GetForegroundWindow
SetForegroundWindow
AttachThreadInput
ShowWindow
SetTimer
GetDesktopWindow
GetShellWindow
GetSystemMetrics
WindowFromPoint
SetWindowLongW
IsWindowVisible
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
SetWindowPos
GetWindowThreadProcessId
UnregisterClassA

advapi32

RegOpenKeyExW
GetLengthSid
GetKernelObjectSecurity
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RevertToSelf
CreateProcessAsUserW
DuplicateTokenEx
SetTokenInformation
GetTokenInformation
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteValueW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
OpenProcessToken
RegQueryValueExW
RegDeleteKeyW
RegQueryInfoKeyW

shell32

ord165
SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteW
SHFileOperationW
SHGetFolderPathW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW
PathFileExistsW
PathRemoveFileSpecW
PathAppendW
PathIsDirectoryW
PathIsRelativeW
PathAddBackslashW

comctl32

InitCommonControlsEx

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateSessionsW
WTSQueryUserToken
WTSFreeMemory

psapi

GetModuleInformation
GetModuleFileNameExW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

Sections

.text
Size: 289KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PCFApiUtil.sys
.sys windows:5 windows x86 arch:x86

cf7bd7f3c7dd9e7a5896e8f5fd9559f1

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:b2:81:02:a1:43:6c:9d:c1:3f:a6:8b:b7:28:e3:c6:ae:28:64:43
Signer

Actual PE Digest

2c:b2:81:02:a1:43:6c:9d:c1:3f:a6:8b:b7:28:e3:c6:ae:28:64:43

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

r:\i18nBavDefense\defense\output\pdb\PCFApiUtil.pdb

Imports

ntoskrnl.exe

CmRegisterCallback
IoCreateSymbolicLink
IoCreateDevice
CmUnRegisterCallback
DbgPrint
RtlCompareMemory
MmIsAddressValid
_stricmp
mbstowcs
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwMapViewOfSection
ExGetPreviousMode
ZwQuerySystemInformation
IoFreeMdl
MmMapLockedPagesSpecifyCache
_vsnprintf
NtClose
ZwClose
ObReferenceObjectByHandle
MmProbeAndLockPages
MmUnlockPages
strrchr
ObfDereferenceObject
ZwCreateSection
ZwOpenFile
IoAllocateMdl
ZwOpenKey
ExQueueWorkItem
ProbeForRead
RtlVolumeDeviceToDosName
PsLookupProcessByProcessId
ZwQuerySymbolicLinkObject
_wcsnicmp
ZwReadFile
KeSetEvent
RtlAppendUnicodeToString
IoCreateFile
KeInitializeEvent
ZwQueryObject
ZwOpenSymbolicLinkObject
ZwSetInformationFile
ObQueryNameString
IoFileObjectType
ZwCreateFile
PsGetVersion
RtlAppendUnicodeStringToString
KeWaitForSingleObject
IoFreeIrp
IoAllocateIrp
ZwQueryInformationProcess
ObfReferenceObject
PsGetCurrentThreadId
PsGetCurrentProcessId
RtlCopyUnicodeString
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
IofCallDriver
_vsnwprintf
ZwCreateKey
ZwDeleteValueKey
ZwSetValueKey
ZwUnmapViewOfSection
KeServiceDescriptorTable
ZwDeleteKey
ObOpenObjectByName
ExNotifyCallback
ExCreateCallback
DbgPrintEx
NtBuildNumber
SeDeleteObjectAuditAlarm
MmUserProbeAddress
wcschr
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
ObInsertObject
IoGetDeviceObjectPointer
RtlUpperChar
RtlPrefixUnicodeString
IoReleaseVpbSpinLock
RtlEqualUnicodeString
PsSetCreateProcessNotifyRoutine
IofCompleteRequest
MmGetSystemRoutineAddress
IoDeleteDevice
RtlInitUnicodeString
KeGetCurrentThread
IoDeleteSymbolicLink
_except_handler3
memcpy
_aullrem
_allmul
memset
_aullshr

hal

KeGetCurrentIrql

fltmgr.sys

FltEnumerateInstances
FltEnumerateFilters
FltObjectDereference
FltGetFilterInformation

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 992B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 960B - Virtual size: 948B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 864B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PCFApiUtil64.sys
.sys windows:5 windows x64 arch:x64

55fe93131c6adfb99e4cfe4fe3c87e4e

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ab:76:fe:cb:a0:f5:0b:65:f9:d3:94:67:f4:e5:c3:49:ff:9b:fd:9b
Signer

Actual PE Digest

ab:76:fe:cb:a0:f5:0b:65:f9:d3:94:67:f4:e5:c3:49:ff:9b:fd:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

r:\i18nBavDefense\defense\output\pdb\PCFApiUtil64.pdb

Imports

ntoskrnl.exe

IofCompleteRequest
PsGetVersion
CmRegisterCallback
IoCreateSymbolicLink
IoCreateDevice
CmUnRegisterCallback
DbgPrint
RtlCompareMemory
MmIsAddressValid
_stricmp
mbstowcs
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwMapViewOfSection
ExGetPreviousMode
ZwQuerySystemInformation
IoFreeMdl
MmMapLockedPagesSpecifyCache
_vsnprintf
NtClose
ZwClose
ObReferenceObjectByHandle
MmProbeAndLockPages
MmUnlockPages
strrchr
ObfDereferenceObject
ZwCreateSection
ZwOpenFile
IoAllocateMdl
ZwOpenKey
ExQueueWorkItem
ProbeForRead
RtlVolumeDeviceToDosName
PsLookupProcessByProcessId
ZwQuerySymbolicLinkObject
_wcsnicmp
ZwReadFile
KeSetEvent
RtlAppendUnicodeToString
IoCreateFile
KeInitializeEvent
ZwQueryObject
ZwOpenSymbolicLinkObject
wcslen
ZwSetInformationFile
ObQueryNameString
PsSetCreateProcessNotifyRoutine
ZwCreateFile
RtlAppendUnicodeStringToString
KeWaitForSingleObject
IoFreeIrp
IoAllocateIrp
ZwQueryInformationProcess
ObfReferenceObject
PsGetCurrentThreadId
PsGetCurrentProcessId
RtlCopyUnicodeString
ZwTerminateProcess
ZwQueryInformationFile
ObOpenObjectByPointer
IofCallDriver
_vsnwprintf
ZwCreateKey
ZwDeleteValueKey
ZwSetValueKey
ZwUnmapViewOfSection
ZwDeleteKey
ObOpenObjectByName
ExNotifyCallback
ExCreateCallback
DbgPrintEx
NtBuildNumber
SeDeleteObjectAuditAlarm
MmUserProbeAddress
wcschr
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
ObInsertObject
IoGetDeviceObjectPointer
RtlUpperChar
RtlPrefixUnicodeString
IoReleaseVpbSpinLock
RtlEqualUnicodeString
MmGetSystemRoutineAddress
IoDeleteDevice
RtlInitUnicodeString
IoFileObjectType
IoDeleteSymbolicLink
__C_specific_handler

fltmgr.sys

FltEnumerateInstances
FltEnumerateFilters
FltObjectDereference
FltGetFilterInformation

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 864B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PCFHelper.exe
.exe windows:5 windows x86 arch:x86

f353d92eefe0c498e37f5786efa4f0fb

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

28:0b:10:50:74:ed:cd:d9:dd:52:7e:ae:15:b7:da:de:21:45:e2:23
Signer

Actual PE Digest

28:0b:10:50:74:ed:cd:d9:dd:52:7e:ae:15:b7:da:de:21:45:e2:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PCFHelper.pdb

Imports

datareport

Start
Stop
RD_WS

log2

?DelInstance@CAPCDispatcher@@SAXXZ
?WriteOptLog@CAPCDispatcher@@QAEHW4OPTType@OptItem@@W4OPTAction@3@PB_W22@Z
?GetInstance@CAPCDispatcher@@SAPAV1@XZ
?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

GetModuleHandleExW
WaitForSingleObject
CopyFileW
GetExitCodeProcess
GetTempPathW
GetPrivateProfileIntW
CreateFileMappingW
DeleteFileW
GetEnvironmentVariableW
SetErrorMode
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetFileAttributesW
GetCurrentDirectoryW
GetLongPathNameW
ExpandEnvironmentStringsW
LoadLibraryW
FreeLibrary
MoveFileExW
CreateFileA
GlobalAlloc
GlobalFree
DeviceIoControl
GetDriveTypeW
SystemTimeToFileTime
CreateDirectoryW
FileTimeToSystemTime
SetFileAttributesW
SetLastError
InterlockedDecrement
TerminateProcess
WriteFile
SetDllDirectoryW
InterlockedIncrement
OutputDebugStringW
GetLocalTime
GetWindowsDirectoryW
DebugBreak
VirtualProtect
GetVersion
IsBadCodePtr
IsBadReadPtr
ExitThread
GetModuleHandleA
FlushInstructionCache
VirtualFree
CreateFileMappingA
InterlockedExchange
InterlockedCompareExchange
ReadProcessMemory
VirtualQueryEx
InitializeCriticalSectionAndSpinCount
lstrlenA
HeapCreate
CreateEventW
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
VirtualQuery
GetModuleFileNameA
ReleaseMutex
CreateMutexW
lstrcatA
GetThreadContext
OpenMutexW
DuplicateHandle
VirtualAlloc
OpenFileMappingW
OpenEventW
lstrcpyA
VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
WriteProcessMemory
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
lstrcpyW
SetEndOfFile
SetFilePointer
CreateThread
GetFileInformationByHandle
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetTempFileNameW
GetCommandLineW
Sleep
FormatMessageA
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
GetVersionExA
SleepEx
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
GetTickCount
GetCurrentThread
DeleteCriticalSection
InitializeCriticalSection
LocalFree
FindNextFileW
LocalAlloc
FindClose
GetFileSizeEx
CreateFileW
ReadFile
GetProcessHeap
HeapFree
GetCurrentProcess
HeapAlloc
FindFirstFileW
GetShortPathNameW
GetCurrentProcessId
CloseHandle
CreateToolhelp32Snapshot
WTSGetActiveConsoleSessionId
Process32NextW
ProcessIdToSessionId
Process32FirstW
GetProcAddress
GetLastError
VerifyVersionInfoW
GetVersionExW
OpenProcess
GetModuleHandleW
VerSetConditionMask
GetPrivateProfileSectionW
LockResource
WritePrivateProfileStringW
lstrlenW
MultiByteToWideChar
GetTimeZoneInformation
GetModuleFileNameW
WritePrivateProfileSectionW
SizeofResource
WideCharToMultiByte
GetPrivateProfileStringW
LoadResource
FindResourceW
FindResourceExW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetFullPathNameA
GetDriveTypeA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FindFirstFileA
LoadLibraryA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetStringTypeA
GetCurrentDirectoryA
GetFullPathNameW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringA
LCMapStringW
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetStdHandle
ExitProcess
HeapDestroy
RaiseException
RtlUnwind
HeapReAlloc
GetStartupInfoW
GetCPInfo
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
GetPrivateProfileSectionNamesW
CreateProcessW

user32

SetForegroundWindow
IsWindowVisible
GetThreadDesktop
CloseDesktop
GetUserObjectInformationA
OpenInputDesktop
ShowWindow

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
OpenProcessToken
GetUserNameW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
GetLengthSid
GetKernelObjectSecurity
AllocateAndInitializeSid
FreeSid
SetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
QueryServiceConfigW
EnumServicesStatusW
QueryServiceConfig2W
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegEnumKeyW
DuplicateTokenEx
CreateProcessAsUserW
AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertSidToStringSidW
GetTokenInformation
RegEnumKeyExW
RevertToSelf
RegEnumValueW
RegOpenCurrentUser
RegDeleteValueW
ImpersonateLoggedOnUser
RegCreateKeyExW

shell32

SHFileOperationW
ShellExecuteExW
CommandLineToArgvW
SHGetSpecialFolderPathW
ord165
SHGetFolderPathW

ole32

CoTaskMemFree
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoCreateGuid
CoInitializeSecurity
CoInitialize
CoInitializeEx

oleaut32

VariantClear
VarBstrCmp
SysAllocString
SysStringLen
SysFreeString
SysAllocStringLen
VariantInit

shlwapi

PathRemoveBackslashW
PathAddBackslashW
PathIsURLW
SHGetValueW
PathIsDirectoryW
PathFindFileNameW
PathAppendW
PathRemoveFileSpecW
PathFileExistsW

wldap32

ord200
ord32
ord35
ord22
ord46
ord143
ord41
ord26
ord60
ord30
ord79
ord33
ord27
ord301
ord211
ord50

ws2_32

WSACleanup
WSAStartup
getsockopt
gethostname
getaddrinfo
freeaddrinfo
ioctlsocket
listen
accept
recvfrom
sendto
select
__WSAFDIsSet
send
getpeername
WSAIoctl
connect
WSAGetLastError
htons
ntohs
getsockname
setsockopt
recv
bind
socket
WSASetLastError
closesocket

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken

iphlpapi

GetAdaptersAddresses

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

winhttp

WinHttpCreateUrl

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

psapi

GetModuleInformation
EnumProcessModules
GetProcessMemoryInfo
GetModuleFileNameExW

Sections

.text
Size: 888KB - Virtual size: 887KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PCFPopups.exe
.exe windows:5 windows x86 arch:x86

736032bfd5f3e6ce02545f8156252a9e

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:23:c5:34:c9:10:2b:c9:aa:87:31:22:7a:24:ed:29:87:77:c4:b7
Signer

Actual PE Digest

51:23:c5:34:c9:10:2b:c9:aa:87:31:22:7a:24:ed:29:87:77:c4:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PCFPopups.pdb

Imports

directui

DirectUI_MoveEx
DirectUI_GetLanguageStyle
DirectUI_GetControlPos
DirectUI_IsControlVisible
DirectUI_Invalidate
DirectUI_TreeEx_InsertItem
DirectUI_TreeEx_CreateControl
DirectUI_TreeEx_SetItemHeight
DirectUI_TreeEx_SetStaticLogoImage
DirectUI_CreateControl
DirectUI_DestroyControl
DirectUI_Static_SetLogoImage
DirectUI_GetControlText
DirectUI_ChangeStyle
DirectUI_TreeCtrl_Select
DirectUI_TreeCtrl_SetStaticLogo
DirectUI_TreeCtrl_ChangeStyle
DirectUI_GetSafeHwnd
DirectUI_SetLanguageStyle
DirectUI_AutoText_SetControlText
DirectUI_LoadSkinResourceFromZIP
DirectUI_I18N_AddLanguageStyle
DirectUI_GetVersion
DirectUI_GetStringItem
DirectUI_TreeCtrl_DeleteAllItems
DirectUI_TreeCtrl_InsertItem
DirectUI_TreeCtrl_SetControlText
DirectUI_GetControlRect
DirectUI_GetStringLength
DirectUI_SubclassLayeredWindow
DirectUI_Progress_SetPos
DirectUI_EnableAnimate
DirectUI_SetControlTextEx
DirectUI_Static_SetLogoIcon
DirectUI_EnableControl
DirectUI_SetControlPos
DirectUI_ShowControl
DirectUI_SetTooltipString
DirectUI_SetControlText
uiUpdateWindow
DirectUI_Button_SetCheck
DirectUI_SubclassWindow
DirectUI_Button_GetCheck
DirectUI_UpdateSkin

datareport

Stop
Start
RD_W
RD_WS

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z
?GetInstance@CAPCDispatcher@@SAPAV1@XZ
?DelInstance@CAPCDispatcher@@SAXXZ

kernel32

ReleaseMutex
lstrcmpiW
LoadLibraryExW
CreateEventW
OutputDebugStringW
SystemTimeToFileTime
lstrcmpW
GetSystemDirectoryW
InitializeCriticalSectionAndSpinCount
TerminateThread
GetLocalTime
WritePrivateProfileStringW
GlobalUnlock
GlobalLock
MulDiv
CreateDirectoryW
WriteFile
FlushFileBuffers
SetFilePointer
SetEndOfFile
GetStartupInfoW
GetExitCodeProcess
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
GetEnvironmentVariableW
SetErrorMode
GetSystemWindowsDirectoryW
GetFileAttributesW
GetCurrentDirectoryW
LocalAlloc
DebugBreak
VirtualProtect
GetVersion
IsBadCodePtr
GetModuleHandleExW
ExitThread
GetCommandLineW
GetWindowsDirectoryW
GetModuleHandleA
VirtualFree
CreateFileMappingA
InterlockedExchange
InterlockedCompareExchange
GetFileSizeEx
ReadProcessMemory
VirtualQueryEx
lstrlenA
HeapCreate
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
TerminateProcess
VirtualQuery
GetModuleFileNameA
lstrcatA
GetThreadContext
OpenMutexW
DuplicateHandle
VirtualAlloc
OpenEventW
lstrcpyA
VirtualAllocEx
VirtualFreeEx
GetCurrentThread
VirtualProtectEx
WriteProcessMemory
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
lstrcpyW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
CloseHandle
GetFileSize
GetProcessTimes
IsProcessorFeaturePresent
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
GetLocaleInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetStringTypeA
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
LCMapStringA
ExitProcess
HeapDestroy
LCMapStringW
IsValidCodePage
GetOEMCP
GetStdHandle
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
HeapReAlloc
GetCPInfo
CreateThread
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
LoadLibraryA
ReadFile
GetTempPathW
GetTempFileNameW
CopyFileW
DeleteFileW
Process32NextW
OpenProcess
GetModuleFileNameW
GetPrivateProfileStringW
GetPrivateProfileIntW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GlobalMemoryStatusEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
Sleep
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
RaiseException
FlushInstructionCache
GetLastError
GetVersionExW
GetLongPathNameW
FindFirstFileW
FileTimeToSystemTime
Process32FirstW
CreateToolhelp32Snapshot
VerifyVersionInfoW
VerSetConditionMask
GetProcAddress
CreateMutexW
InterlockedIncrement
WaitForSingleObject
LoadLibraryW
FreeLibrary
QueueUserAPC
MoveFileExW
GetFileAttributesExW
FindFirstFileExW
FindNextFileW
GlobalFree
GetPrivateProfileSectionNamesW
CreateFileA
InterlockedDecrement
GetACP
FormatMessageW
CreateProcessW
GetSystemTime
WinExec
ExpandEnvironmentStringsW
GetTickCount
GetTimeZoneInformation
GetPrivateProfileSectionW
lstrlenW
LocalFree
OpenFileMappingW
IsBadReadPtr
HeapAlloc
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetModuleHandleW
InitializeCriticalSection
HeapFree
GetProcessHeap
DeleteCriticalSection
DeviceIoControl
GlobalAlloc
FindClose

user32

CreateIconFromResource
PrivateExtractIconsW
MessageBoxW
TrackMouseEvent
GetWindowTextLengthW
GetWindowTextW
BeginPaint
EndPaint
GetFocus
GetClassNameW
GetSysColor
CreateAcceleratorTableW
ClientToScreen
SetCapture
ReleaseCapture
FillRect
InvalidateRgn
GetDC
DestroyAcceleratorTable
SetRect
OffsetRect
UpdateLayeredWindow
ReleaseDC
ScreenToClient
GetMessagePos
TranslateMessage
DispatchMessageW
GetThreadDesktop
CloseDesktop
IsWindowVisible
RegisterWindowMessageW
SendMessageW
GetWindowLongW
SetWindowLongW
WindowFromPoint
GetWindowThreadProcessId
GetShellWindow
GetDesktopWindow
UnregisterClassA
MoveWindow
GetSystemMetrics
GetWindowRect
IsWindow
FindWindowW
GetUserObjectInformationA
OpenInputDesktop
IsChild
CharNextW
SetTimer
ShowWindow
AttachThreadInput
SetForegroundWindow
SetWindowPos
GetForegroundWindow
RedrawWindow
UpdateWindow
PostMessageW
KillTimer
SetLayeredWindowAttributes
GetMessageW
MonitorFromPoint
GetMenuItemInfoW
RemoveMenu
DefWindowProcW
SetWindowTextW
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
CallWindowProcW
DestroyIcon
LoadImageW
LoadStringW
DestroyWindow
MapWindowPoints
GetClientRect
GetMenuItemCount
AppendMenuW
TrackPopupMenuEx
GetParent
GetMonitorInfoW
MonitorFromWindow
GetWindow
wsprintfW
GetDlgItem
CreateDialogParamW
SendMessageTimeoutW
InvalidateRect
DialogBoxParamW
GetActiveWindow
EndDialog
SetFocus
SetCursor
ReplyMessage
LoadStringA
PostQuitMessage
DestroyMenu
MessageBeep
PeekMessageW
PtInRect
CreatePopupMenu

gdi32

CreateICW
CreateCompatibleBitmap
CreateSolidBrush
GetStockObject
GetObjectW
GetDeviceCaps
CreateCompatibleDC
DeleteObject
DeleteDC
BitBlt
SelectObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegEnumValueW
RegQueryValueExW
RegCloseKey
RegOpenKeyW
RegOpenKeyExW
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCreateKeyW
GetTokenInformation
RegQueryValueW
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegDeleteValueW
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
GetUserNameW
OpenEventLogW
ReadEventLogW
CloseEventLog
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceConfigW
QueryServiceConfig2W
SetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetKernelObjectSecurity
GetLengthSid

shell32

SHFileOperationW
ExtractIconExW
DuplicateIcon
ord165
SHGetFolderPathW
SHGetFileInfoW
ShellExecuteW
SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteExW

ole32

OleInitialize
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
CreateStreamOnHGlobal
StringFromGUID2
OleUninitialize
CoInitializeEx
CoGetClassObject
CoInitializeSecurity
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
OleLockRunning

oleaut32

SysFreeString
VarUI4FromStr
SysAllocString
VariantClear
SysStringLen
VariantInit
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
SysAllocStringLen
DispCallFunc

baidustore

??0Baidu_ListenData@@QAE@PB_W@Z
??1Baidu_ListenData@@UAE@XZ
?DoMonitorDevSize@CBaiduStoreMgr@@QAEXXZ
?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ
?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z
?SaveShowBigFilePopup@BdConfig@@QAEXH@Z
?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z
?SaveSound@BdConfig@@QAEXH@Z
?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z
?InitKrnIPCClient@CBaiduStoreMgr@@QAEHK@Z
?CloseKernelHandle@CBaiduStoreMgr@@QAEXXZ
?OnKernelHandle@CBaiduStoreMgr@@QAEXPAX@Z
?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z
?ConnectSubSvc@CBaiduStoreMgr@@QAEHPB_WH@Z
?LoadConfig@BdConfig@@QAEXXZ
?DoShellExecute@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z
?SaveShowPlugPopup@BdConfig@@QAEXH@Z
?SaveShowmalwarePopup@BdConfig@@QAEXH@Z
?SaveWeatherConfig@BdConfig@@QAEXXZ
?SaveBootTimeHelperPopup@BdConfig@@QAEXH@Z
?SaveActivitys@BdConfig@@QAEXXZ
?ReportStateEx@CBaiduStoreMgr@@QAEHKPB_W@Z

shlwapi

StrCpyNW
SHGetValueW
PathFindExtensionW
StrStrIW
SHDeleteValueW
StrCmpNW
StrCmpIW
StrStrW
StrCmpNIW
StrCmpW
PathIsRelativeW
PathFindFileNameW
PathAddBackslashW
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
PathAppendW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpConnect
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpSetOption
WinHttpReadData
WinHttpSetCredentials
WinHttpOpen
WinHttpCreateUrl
WinHttpAddRequestHeaders
WinHttpQueryHeaders

psapi

GetModuleFileNameExW
GetModuleInformation

gdiplus

GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdiplusShutdown
GdiplusStartup
GdipSetWorldTransform
GdipSetSmoothingMode
GdipCreateBitmapFromGraphics
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateFromHDC
GdipAddPathStringI
GdipDeletePath
GdipCreatePath
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipCreatePen1
GdipDisposeImage
GdipCreateSolidFill
GdipCloneBrush
GdipDeleteMatrix
GdipCreateMatrix2
GdipAlloc
GdipFree
GdipCreateBitmapFromFile
GdipGetImageRawFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipLoadImageFromFile
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipDrawImageRectRect
GdipFillPath
GdipGraphicsClear
GdipSetInterpolationMode
GdipDrawPath
GdipDeleteBrush

winmm

PlaySoundW

msi

ord217
ord173

userenv

ExpandEnvironmentStringsForUserW
DestroyEnvironmentBlock
CreateEnvironmentBlock

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 376KB - Virtual size: 375KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PCFTray.exe
.exe windows:5 windows x86 arch:x86

d523aa3794530e1c7b9ea23152927547

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:97:0a:bd:7a:5e:6a:63:39:82:4e:ac:94:b8:d9:18:06:fd:56:e5
Signer

Actual PE Digest

56:97:0a:bd:7a:5e:6a:63:39:82:4e:ac:94:b8:d9:18:06:fd:56:e5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PCFTray.pdb

Imports

directui

DirectUI_SubclassWindow
DirectUI_UpdateSkin
DirectUI_SubclassLayeredWindow
DirectUI_AutoText_SetControlText
DirectUI_SetControlText
DirectUI_ChangeStyle
DirectUI_SetLanguageStyle
DirectUI_LoadSkinResourceFromZIP
DirectUI_GetStringItem
DirectUI_Button_SetCheck
DirectUI_Button_GetCheck
DirectUI_TrackPopupMenu
DirectUI_SetControlTextEx
DirectUI_ShowControl

datareport

RD_W
Start
Stop

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z
?GetInstance@CAPCDispatcher@@SAPAV1@XZ
?DelInstance@CAPCDispatcher@@SAXXZ

sqlite

sqlite3_close
sqlite3_errmsg16
sqlite3_column_text16
sqlite3_column_count
sqlite3_busy_timeout
sqlite3_open16
sqlite3_free
sqlite3_prepare16
sqlite3_finalize
sqlite3_step

kernel32

GetTimeZoneInformation
lstrcmpiW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
GetDriveTypeW
InterlockedCompareExchange
InterlockedExchange
HeapAlloc
GetProcessHeap
HeapFree
QueryDosDeviceW
GetVolumeInformationW
GetDiskFreeSpaceExW
LocalAlloc
WriteFile
OutputDebugStringW
IsWow64Process
FindFirstFileW
FindNextFileW
FindClose
QueueUserWorkItem
SystemTimeToFileTime
GetFileSizeEx
VirtualQueryEx
lstrlenA
GetWindowsDirectoryW
DebugBreak
VirtualProtect
GetVersion
IsBadCodePtr
IsBadReadPtr
GetModuleHandleExW
ExitThread
CreateDirectoryW
GetCommandLineW
GetModuleHandleA
VirtualFree
CreateFileMappingA
HeapCreate
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
SetEndOfFile
SetFilePointer
VirtualQuery
GetModuleFileNameA
lstrcatA
GetThreadContext
DuplicateHandle
VirtualAlloc
OpenEventW
lstrcpyA
GetCurrentThread
VirtualProtectEx
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
lstrcpyW
GetPrivateProfileSectionW
FindResourceW
LoadResource
GetSystemWindowsDirectoryW
GetSystemDirectoryW
SizeofResource
SwitchToThread
ResetEvent
SetNamedPipeHandleState
DeleteFileW
GetOverlappedResult
ReadFileEx
ConnectNamedPipe
CreateNamedPipeW
WriteFileEx
DisconnectNamedPipe
OpenThread
InterlockedExchangeAdd
GetProcessTimes
GetPrivateProfileSectionNamesW
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FlushFileBuffers
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
GetFileType
SetHandleCount
GetStdHandle
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetStartupInfoW
ResumeThread
GetSystemTimeAsFileTime
CreateThread
IsDebuggerPresent
UnhandledExceptionFilter
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
GetShortPathNameW
GetFileAttributesW
GetTempPathW
GetCurrentDirectoryW
GetLongPathNameW
LockResource
ExpandEnvironmentStringsW
GetLastError
GetVersionExW
FindResourceExW
GetEnvironmentVariableW
WaitNamedPipeW
CopyFileW
CreateFileA
GetTempFileNameW
ReadFile
GetFileSize
CreateFileW
CreateMutexW
InterlockedDecrement
InterlockedIncrement
WTSGetActiveConsoleSessionId
ProcessIdToSessionId
FlushInstructionCache
RaiseException
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
WritePrivateProfileStringW
TerminateProcess
GetCurrentThreadId
SystemTimeToTzSpecificLocalTime
GetLocalTime
CreateProcessW
OpenMutexW
WaitForMultipleObjects
TerminateThread
SetEvent
CreateEventW
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
GetTickCount
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
SetLastError
Sleep
FreeLibrary
GetPrivateProfileIntW
LoadLibraryW
GetModuleHandleW
GetProcAddress
GetPrivateProfileStringW
GetCurrentProcessId
GetModuleFileNameW
GetCurrentProcess
VerSetConditionMask
VerifyVersionInfoW
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
InitializeCriticalSection
ReleaseMutex
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
lstrlenW
LocalFree
CloseHandle
DeviceIoControl
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
SetErrorMode

user32

GetWindowLongW
UpdateLayeredWindow
FindWindowExW
SetWindowLongW
SetFocus
DestroyWindow
IsWindowVisible
ShowWindow
OffsetRect
GetWindowThreadProcessId
MoveWindow
GetSystemMetrics
GetWindowRect
FindWindowW
IsWindow
UnregisterClassA
GetClassInfoW
MsgWaitForMultipleObjectsEx
KillTimer
SetTimer
LoadStringW
LoadImageW
DestroyIcon
LoadIconW
SendMessageW
SetWindowPos
DefWindowProcW
LoadCursorW
CreateWindowExW
DialogBoxParamW
EndDialog
SetWindowTextW
MapWindowPoints
GetClientRect
GetParent
GetMonitorInfoW
MonitorFromWindow
GetWindow
PostMessageW
RegisterWindowMessageW
EnumWindows
PostQuitMessage
PeekMessageW
TranslateMessage
DispatchMessageW
SendMessageTimeoutW
GetCursorPos
OpenInputDesktop
GetUserObjectInformationA
SetActiveWindow
SetForegroundWindow
CloseDesktop
GetThreadDesktop
GetDesktopWindow
AttachThreadInput
GetForegroundWindow
GetActiveWindow
MsgWaitForMultipleObjects
CreatePopupMenu
DestroyMenu
AppendMenuW
RegisterClassExW
LoadStringA
CallWindowProcW
MessageBeep
PtInRect
InvalidateRect
TrackPopupMenuEx
GetMenuItemCount
RemoveMenu
GetMenuItemInfoW
MonitorFromPoint
CharNextW
GetMessageW
RegisterClassW
SystemParametersInfoW
GetWindowTextW
GetWindowTextLengthW
GetIconInfo
PostThreadMessageW
UnregisterDeviceNotification
RegisterDeviceNotificationW
UnregisterClassW
GetClassInfoExW

gdi32

GetDIBits
GetObjectW
GetStockObject
CreateICW
DeleteObject
DeleteDC
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
ImpersonateLoggedOnUser
RegOpenCurrentUser
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RevertToSelf
GetTokenInformation
RegNotifyChangeKeyValue
RegEnumKeyExW
GetUserNameW
RegDeleteValueW
RegDeleteKeyW
RegEnumValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
AllocateAndInitializeSid
RegQueryInfoKeyW
FreeSid
CheckTokenMembership
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceConfig2W
SetServiceStatus
EnumServicesStatusW
RegisterServiceCtrlHandlerW
QueryServiceConfigW
RegEnumKeyW
SetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetKernelObjectSecurity
GetLengthSid

shell32

SHGetFolderLocation
ShellExecuteW
CommandLineToArgvW
SHQueryRecycleBinW
ShellExecuteExW
ExtractIconW
SHFileOperationW
SHGetFolderPathW
ord165
Shell_NotifyIconW
SHGetSpecialFolderPathW
SHGetFileInfoW

ole32

CoInitialize
CoInitializeEx
CoCreateGuid
CoSetProxyBlanket
CoInitializeSecurity
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocStringLen
VariantInit
VariantClear
SysStringLen
SysAllocString
VarUI4FromStr

baidustore

?InitKrnIPCClient@CBaiduStoreMgr@@QAEHK@Z
?SaveActivitys@BdConfig@@QAEXXZ
??1Baidu_ListenData@@UAE@XZ
??0Baidu_ListenData@@QAE@PB_W@Z
?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ
?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z
?UpdateSystemConfig@CBaiduStoreMgr@@QAEXXZ
?ReportIncCount@CBaiduStoreMgr@@QAEHKK@Z
?UpdateConfig@BdConfig@@QAEXXZ
?CloseKernelHandle@CBaiduStoreMgr@@QAEXXZ
?EnableBdKernel@CBaiduStoreMgr@@QAEXXZ
?EnableBdKernel2@CBaiduStoreMgr@@QAEXXZ
?SavePluginWarningTime@BdConfig@@QAEXK@Z
?DoMonitorDevSize@CBaiduStoreMgr@@QAEXXZ
?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z
?ConnectSubSvc@CBaiduStoreMgr@@QAEHPB_WH@Z
?DoMonitorStartupItem@CBaiduStoreMgr@@QAEXXZ
?DoShellExecute@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z
?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z
?SaveConfig@BdConfig@@QAEXXZ
?DoAutoRun@CBaiduStoreMgr@@QAEXH@Z
?SaveAutoRunConfig@BdConfig@@QAEXH@Z
?OnKernelHandle@CBaiduStoreMgr@@QAEXPAX@Z
?ReportStateEx@CBaiduStoreMgr@@QAEHKPB_W@Z
?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z
?SaveBrowserJunkPopupTime@BdConfig@@QAEXK@Z
?IsConnectSubSvc@CBaiduStoreMgr@@QAEHPB_W@Z
?SavePrivacyCleanTime@BdConfig@@QAEXK@Z
?DoMonitorDevTarySize@CBaiduStoreMgr@@QAEXXZ
?LoadConfig@BdConfig@@QAEXXZ

psapi

GetModuleFileNameExW
GetModuleInformation
GetProcessImageFileNameW

iphlpapi

GetAdaptersAddresses

wtsapi32

WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsW

shlwapi

SHDeleteKeyW
PathFindExtensionW
StrStrIW
StrStrW
PathAddBackslashW
SHDeleteValueW
SHSetValueW
SHGetValueW
StrCmpW
PathIsRelativeW
PathIsDirectoryW
PathAppendW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

gdiplus

GdipLoadImageFromFileICM
GdipDrawImageRectRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipFree
GdipAlloc
GdipDisposeImage
GdiplusShutdown
GdiplusStartup
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipLoadImageFromFile
GdipCreateFromHDC

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

feedback

?QueryReply@feedback@baidu@@YAKW4ProductId@12@W4LanguageId@12@PB_WPA_WI@Z

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
CM_Get_Device_IDW
CM_Get_DevNode_Registry_PropertyW
CM_Get_Parent
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo

crypt32

CryptMsgClose
CertCloseStore
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CertFreeCertificateContext

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 386KB - Virtual size: 386KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PCFaster.exe
.exe windows:5 windows x86 arch:x86

fa43a753e531a03e4cd459a9c2656216

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8c:c0:cd:92:f0:85:55:93:bd:78:d4:6f:cd:b6:19:9d:89:31:96:16
Signer

Actual PE Digest

8c:c0:cd:92:f0:85:55:93:bd:78:d4:6f:cd:b6:19:9d:89:31:96:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PCFaster.pdb

Imports

directui

DirectUI_SetTooltipStringEx
DirectUI_GetControlStyle
DirectUI_GetSafeHwnd
DirectUI_SubclassLayeredWindow
DirectUI_TreeEx_DeleteAllItems
DirectUI_TreeEx_InsertItem
DirectUI_TreeEx_CreateControl
DirectUI_TreeEx_SetItemHeight
DirectUI_TreeEx_SetStaticLogoImage
DirectUI_TreeEx_SetButtonCheck
DirectUI_TreeEx_SetControlText
DirectUI_TreeEx_ChangeStyle
DirectUI_Invalidate
DirectUI_SetLanguageStyle
uiUpdateWindow
DirectUI_CreateControl
DirectUI_DestroyControl
DirectUI_UpdateSkin
DirectUI_LoadSkinResourceFromZIP
DirectUI_I18N_AddLanguageStyle
DirectUI_Progress_SetPos
DirectUI_Progress_SetRange
DirectUI_EnableAnimate
DirectUI_TrackPopupMenu
DirectUI_GetControlRect
DirectUI_GetControlText
DirectUI_ChangeStyle
DirectUI_IsControlVisible
DirectUI_GetStringLength
DirectUI_Edit_GetSrcText
DirectUI_Edit_SetMarkText
DirectUI_Edit_SetSrcText
DirectUI_ComboBox_AddString
DirectUI_SubclassWindow
DirectUI_GetStringItem
DirectUI_Button_SetCheck
DirectUI_Button_GetCheck
DirectUI_ComboBox_SetCurSel
DirectUI_ComboBox_GetCurSel
DirectUI_GetLanguageStyle
DirectUI_EnableControl
DirectUI_SetControlTextEx
DirectUI_SetControlText
DirectUI_SetControlPos
DirectUI_GetVersion
DirectUI_GetControlPos
DirectUI_ShowControl

datareport

RD_W
Stop
Start

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z
?DelInstance@CAPCDispatcher@@SAXXZ
?GetInstance@CAPCDispatcher@@SAPAV1@XZ

kernel32

SetFilePointer
MoveFileExW
CreateProcessW
GetFileAttributesW
CreateSemaphoreW
OpenMutexW
GetExitCodeThread
ReleaseSemaphore
DebugBreak
VirtualProtect
GetVersion
IsBadCodePtr
IsBadReadPtr
GetModuleHandleExW
ExitThread
CreateDirectoryW
GetCommandLineW
InterlockedExchange
InterlockedCompareExchange
SystemTimeToFileTime
GetLocalTime
GetFileSizeEx
ReadProcessMemory
VirtualQueryEx
lstrlenA
GetWindowsDirectoryW
GetModuleHandleA
VirtualFree
CreateFileMappingA
LocalAlloc
HeapCreate
HeapAlloc
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
VirtualQuery
GetModuleFileNameA
lstrcatA
GetThreadContext
DuplicateHandle
VirtualAlloc
lstrcpyA
VirtualAllocEx
VirtualFreeEx
GetCurrentThread
VirtualProtectEx
WriteProcessMemory
CreateRemoteThread
IsBadWritePtr
SetEndOfFile
lstrcpyW
GetShortPathNameW
GetACP
FindClose
InterlockedIncrement
GetFileAttributesExW
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetCurrentDirectoryA
GetFullPathNameA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
LCMapStringW
LCMapStringA
GetCPInfo
FindFirstFileA
GetDriveTypeA
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
RtlUnwind
GetStartupInfoW
ResumeThread
CreateThread
IsDebuggerPresent
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetProcessTimes
GetPrivateProfileSectionNamesW
IsProcessorFeaturePresent
HeapSize
HeapReAlloc
HeapDestroy
FormatMessageA
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetFileType
LoadLibraryA
GetStdHandle
PeekNamedPipe
GetVersionExA
SleepEx
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
lstrlenW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateMutexW
CloseHandle
WaitForSingleObject
ReleaseMutex
InitializeCriticalSection
CreateFileW
GetFileSize
ReadFile
MultiByteToWideChar
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetModuleFileNameW
WriteFile
WTSGetActiveConsoleSessionId
ProcessIdToSessionId
IsWow64Process
WritePrivateProfileStringW
CreateEventW
SetEvent
OpenEventW
TerminateProcess
GetFullPathNameW
MulDiv
ExpandEnvironmentStringsW
GetTickCount
LoadLibraryW
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
LocalFree
DeviceIoControl
GlobalFree
GlobalAlloc
CreateFileA
GetExitCodeProcess
WinExec
OpenFileMappingW
GetLongPathNameW
IsValidLocale
GetPrivateProfileIntW
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
HeapFree
GetProcessHeap
LoadLibraryExW
lstrcmpiW
Sleep
FreeLibrary
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
RaiseException
GetTempPathW
GetTempFileNameW
CopyFileW
DeleteFileW
GetLastError
GetVersionExW
GetCurrentProcess
GetPrivateProfileStringW
GetProcAddress
GetModuleHandleW
GetPrivateProfileSectionW
GetTimeZoneInformation
FlushInstructionCache
SetLastError
GetCurrentThreadId

user32

MonitorFromPoint
MoveWindow
FindWindowW
GetMenuItemCount
GetForegroundWindow
GetCursorPos
PtInRect
ReplyMessage
UnregisterClassA
SetWindowPos
MapWindowPoints
GetClientRect
TrackPopupMenuEx
InvalidateRect
GetThreadDesktop
CloseDesktop
GetUserObjectInformationA
OpenInputDesktop
ClientToScreen
ScreenToClient
TranslateAcceleratorW
CreatePopupMenu
DestroyMenu
AppendMenuW
LoadStringW
LoadStringA
CallWindowProcW
MessageBeep
SetWindowLongW
GetMenuItemInfoW
GetParent
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindowLongW
GetWindow
SendMessageW
DestroyWindow
DefWindowProcW
RegisterWindowMessageW
CharNextW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
LoadImageW
DialogBoxParamW
SetWindowTextW
PostMessageW
IsWindow
RemoveMenu
SetForegroundWindow
PostQuitMessage
DialogBoxIndirectParamW
GetDialogBaseUnits
SetRect
DrawTextW
GetMenuState
DeleteMenu
EnableMenuItem
GetSystemMenu
SetPropW
GetPropW
OffsetRect
ShowWindow
IsWindowVisible
FindWindowExW
UpdateLayeredWindow
ReleaseDC
GetWindowDC
SetTimer
KillTimer
GetActiveWindow
EndDialog
SetFocus
GetSystemMetrics
GetDesktopWindow
GetWindowThreadProcessId
IsIconic
AttachThreadInput

gdi32

CreateFontW
CreateICW
DeleteObject
DeleteDC
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenProcessToken
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegDeleteValueW
RegQueryValueW
RegOpenKeyW
GetUserNameW
RevertToSelf
RegOpenCurrentUser
ImpersonateLoggedOnUser
RegEnumValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
SetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetKernelObjectSecurity
GetLengthSid
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
CryptGetHashParam

shell32

ShellExecuteW
ShellExecuteExW
ord165
SHGetFolderPathW
CommandLineToArgvW
SHFileOperationW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear
VarUI4FromStr

baidustore

?GetPluginItemEnableStatus@CBaiduStoreMgr@@QAEHI@Z
?DoRestartWindow@CBaiduStoreMgr@@QAEXXZ
?DoShellExecute@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z
?RestoreToDefault@BdConfig@@QAEXXZ
?SaveShowPlugPopup@BdConfig@@QAEXH@Z
?SaveShowBigFilePopup@BdConfig@@QAEXH@Z
?SaveConfig@BdConfig@@QAEXXZ
?ReportState@CBaiduStoreMgr@@QAEHKK@Z
?UpdateSystemConfig@CBaiduStoreMgr@@QAEXXZ
?SaveSound@BdConfig@@QAEXH@Z
?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z
??0Baidu_ListenData@@QAE@PB_W@Z
?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z
?GetShowmalwarePopup@BdConfig@@QAEHXZ
??1BdConfig@@QAE@XZ
??0BdConfig@@QAE@XZ
?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ
?DoAutoRun@CBaiduStoreMgr@@QAEXH@Z
??1Baidu_ListenData@@UAE@XZ
?ReportIncCount@CBaiduStoreMgr@@QAEHKK@Z
?SaveSparkClick@BdConfig@@QAEXH@Z
?ReportStateEx@CBaiduStoreMgr@@QAEHKPB_W@Z
?ConnectSubSvc@CBaiduStoreMgr@@QAEHPB_WH@Z
?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z
?OnKernelHandle@CBaiduStoreMgr@@QAEXPAX@Z
?GetPluginItemFilePath@CBaiduStoreMgr@@QAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@I@Z
?EnableBdKernel@CBaiduStoreMgr@@QAEXXZ
?InitKrnIPCClient@CBaiduStoreMgr@@QAEHK@Z
?CloseKernelHandle@CBaiduStoreMgr@@QAEXXZ
?UpdateConfig@BdConfig@@QAEXXZ
?GetUpdateState@BdConfig@@QAEIXZ

shlwapi

StrCmpIW
PathRemoveExtensionW
SHGetValueW
PathRemoveFileSpecW
PathAddBackslashW
PathFindFileNameW
PathFileExistsW
PathAppendW
PathIsDirectoryW
PathIsRelativeW
PathRemoveBackslashW
SHSetValueW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

winhttp

WinHttpCreateUrl
WinHttpCloseHandle

gdiplus

GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipDrawImageRectRectI
GdipDrawImageRectI
GdipDrawImageRect
GdipGraphicsClear
GdipGetWorldTransform
GdipSetWorldTransform
GdipDeleteGraphics
GdipCloneImage
GdipDisposeImage
GdipRotateMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC

powrprof

CallNtPowerInformation

winmm

PlaySoundW

wldap32

ord301
ord211
ord46
ord200
ord32
ord35
ord22
ord50
ord143
ord41
ord26
ord60
ord30
ord79
ord33
ord27

ws2_32

gethostname
getaddrinfo
freeaddrinfo
ioctlsocket
listen
accept
recvfrom
sendto
select
__WSAFDIsSet
send
getpeername
WSAIoctl
connect
WSAGetLastError
htons
ntohs
getsockname
setsockopt
recv
bind
socket
WSASetLastError
closesocket
getsockopt
WSAStartup
WSACleanup

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

psapi

EnumProcessModules
GetModuleFileNameExW
GetModuleInformation

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PCFasterFeedback.exe
.exe windows:5 windows x86 arch:x86

1d1fd45aba33ed4661503fef5af8cf5d

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

83:76:89:77:77:9a:8c:32:d4:3e:fe:05:7d:fe:0a:b1:28:7b:3b:77
Signer

Actual PE Digest

83:76:89:77:77:9a:8c:32:d4:3e:fe:05:7d:fe:0a:b1:28:7b:3b:77

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PCFasterFeedback.pdb

Imports

kernel32

GetTempFileNameW
CopyFileW
DeleteFileW
WaitForSingleObject
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
lstrlenA
GetCurrentProcess
GetVersionExW
GetProcAddress
GetModuleHandleW
GetSystemInfo
GlobalMemoryStatusEx
GetLocalTime
GetLogicalDriveStringsW
VirtualAlloc
GetDriveTypeW
GetDiskFreeSpaceExW
VirtualFree
InterlockedDecrement
ReadFile
MultiByteToWideChar
WinExec
GetPrivateProfileIntW
GetFileSize
CreateFileW
GetPrivateProfileStringW
FindNextFileW
FindFirstFileW
GetLastError
VerifyVersionInfoW
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
CreateFileA
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
VerSetConditionMask
GetModuleFileNameW
FindClose
LCMapStringA
GetModuleHandleA
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
LoadLibraryA
CloseHandle
GetTempPathW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
Sleep
InterlockedExchange
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
GetPrivateProfileSectionW
CreateMutexW
SetFilePointer
CreateDirectoryW
WriteFile
DeviceIoControl
GetCurrentProcessId
GetWindowsDirectoryW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
ExitThread
GetCurrentThreadId
CreateThread
GetStartupInfoW
RtlUnwind
GetSystemTimeAsFileTime
HeapCreate
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetStdHandle
GetModuleFileNameA
lstrlenW

user32

GetSystemMetrics

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyW
RegQueryValueW
RegQueryInfoKeyW
RegEnumValueW
RegCloseKey

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
ShellExecuteW
ord165
SHFileOperationW

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
CoCreateGuid
CoCreateInstance

oleaut32

VariantClear
VariantInit
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString

log

WriteLog

feedback

?CreateFeedbackDialog@feedback@baidu@@YAKW4ProductId@12@PB_W11W4LanguageId@12@1P6AJ1PAUtagVARIANT@@33@Z1111PAPB_W@Z
?FeedbackDialogExecScript@feedback@baidu@@YAJPB_WPAUtagVARIANT@@@Z

shlwapi

PathFindFileNameW
SHRegGetValueW
PathFileExistsW
PathAppendW
PathAddBackslashW
PathRemoveFileSpecW
PathIsDirectoryW
StrFormatByteSizeW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

powrprof

CallNtPowerInformation

Sections

.text
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PCFasterSvc.exe
.exe windows:5 windows x86 arch:x86

79fc39bc6839416a3cc717455bb9bfd6

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a7:fb:8c:0d:de:c4:64:c5:37:3a:9b:a9:7a:98:1e:ff:ae:6a:c1:ed
Signer

Actual PE Digest

a7:fb:8c:0d:de:c4:64:c5:37:3a:9b:a9:7a:98:1e:ff:ae:6a:c1:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PCFasterSvc.pdb

Imports

datareport

Stop
RD_WW
RD_W
Start

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z
StopLog
?GetInstance@CAPCDispatcher@@SAPAV1@XZ
StartLog
?DelInstance@CAPCDispatcher@@SAXXZ

kernel32

GetFileAttributesW
GetFileSizeEx
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
ExitThread
HeapSize
HeapReAlloc
GetStartupInfoW
RtlUnwind
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
GetModuleFileNameA
LCMapStringA
LCMapStringW
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetStringTypeA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
InterlockedExchangeAdd
DisconnectNamedPipe
WriteFileEx
CreateNamedPipeW
ConnectNamedPipe
ReadFileEx
GetOverlappedResult
WaitNamedPipeW
SetNamedPipeHandleState
SwitchToThread
IsBadCodePtr
CreateDirectoryW
GetLocalTime
GetWindowsDirectoryW
VirtualQueryEx
FlushInstructionCache
CreateFileMappingA
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualQuery
lstrcatA
GetThreadContext
OpenMutexW
OpenFileMappingW
lstrcpyA
VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
WriteProcessMemory
CreateRemoteThread
GetExitCodeThread
lstrcpyW
GetLocaleInfoW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryA
GetVersionExA
DuplicateHandle
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
GlobalAddAtomW
GlobalFlags
lstrcmpW
GetModuleHandleA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedDecrement
SystemTimeToFileTime
lstrcmpA
GlobalLock
GlobalUnlock
FormatMessageW
GetSystemInfo
IsWow64Process
ReadProcessMemory
GetCurrentThread
Thread32Next
Thread32First
GetVersion
ResumeThread
CheckRemoteDebuggerPresent
UnmapViewOfFile
LoadLibraryExW
MapViewOfFile
CreateFileMappingW
OutputDebugStringW
GetExitCodeProcess
TerminateProcess
TryEnterCriticalSection
ReleaseMutex
GetCurrentProcess
SetLastError
GetLongPathNameW
GetModuleHandleW
ProcessIdToSessionId
GetCurrentProcessId
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerW
WritePrivateProfileStringW
OpenEventW
CreateProcessW
TerminateThread
CreateThread
CreateEventW
SetEvent
ResetEvent
GetModuleHandleExW
WTSGetActiveConsoleSessionId
VerSetConditionMask
VerifyVersionInfoW
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
HeapFree
GetProcessHeap
HeapAlloc
IsBadReadPtr
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeCriticalSection
IsBadWritePtr
OpenThread
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
VirtualProtect
DebugBreak
lstrlenA
LoadLibraryW
InterlockedExchange
InterlockedCompareExchange
GetPrivateProfileIntW
lstrlenW
GetProcAddress
GetVersionExW
GetLastError
LocalFree
FreeLibrary
CreateMutexW
DeviceIoControl
GlobalFree
WideCharToMultiByte
GlobalAlloc
FindResourceExW
CreateFileA
GetCommandLineW
Sleep
InterlockedIncrement
GetTickCount
GetTimeZoneInformation
GetPrivateProfileSectionW
GetPrivateProfileStringW
DeleteFileW
CopyFileW
GetTempFileNameW
GetTempPathW
GetModuleFileNameW
ReadFile
GetFileSize
CreateFileW
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
CloseHandle
GetStringTypeW

user32

SetMenu
SetForegroundWindow
GetClientRect
PostMessageW
GetClassInfoExW
GetClassInfoW
AdjustWindowRectEx
CallWindowProcW
GetMenu
SystemParametersInfoA
IsIconic
GetWindowPlacement
CopyRect
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
GetKeyState
ValidateRect
SetWindowPos
SetWindowLongW
IsWindow
GetFocus
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameW
PtInRect
SetWindowTextW
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
UnhookWindowsHookEx
LoadCursorW
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
GetWindowTextW
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjects
CreateWindowExW
RegisterClassW
DefWindowProcW
SendMessageW
GetWindowThreadProcessId
FindWindowExW
RegisterWindowMessageW
ExitWindowsEx
MapWindowPoints
GetMessagePos
GetMessageTime
DestroyWindow
GetTopWindow
GetForegroundWindow
RemovePropW
GetPropW
SetPropW
GetClassLongW
GetCapture
WinHelpW
LoadIconW
PostQuitMessage
CheckMenuItem
EnableMenuItem
ModifyMenuW
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
DestroyMenu
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
GetThreadDesktop
MsgWaitForMultipleObjectsEx
SendMessageTimeoutW
KillTimer
SetTimer
GetDlgItem

gdi32

GetStockObject
CreateBitmap
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
GetDeviceCaps

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
SetSecurityDescriptorSacl
GetKernelObjectSecurity
SetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
StartServiceW
OpenServiceW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
MakeAbsoluteSD
GetSecurityDescriptorControl
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetAclInformation
AddAce
InitializeAcl
IsValidSid
GetLengthSid
CopySid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
GetUserNameW
RegDeleteValueW
RegOpenUserClassesRoot
RevertToSelf
RegSetValueExW
RegCreateKeyExW
RegOpenCurrentUser
ImpersonateLoggedOnUser
OpenProcessToken
RegOpenKeyW
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl

shell32

CommandLineToArgvW
ord165
SHGetFolderPathW

ole32

CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoInitialize
CoTaskMemFree

oleaut32

VariantChangeType
SysFreeString
SysAllocStringLen
VariantInit
VariantClear
SysStringLen
SysAllocString

shlwapi

StrStrIA
StrStrIW
PathUnquoteSpacesW
PathRemoveArgsW
SHGetValueW
SHDeleteValueW
PathIsDirectoryW
PathAppendW
SHDeleteKeyW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
PathAddBackslashW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken

psapi

GetModuleFileNameExW
GetModuleInformation

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

oleacc

CreateStdAccessibleObject
LresultFromObject

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 275KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/Plugin.Antivirus/Plugin_Antivirus.dll
.dll windows:5 windows x86 arch:x86

fef9cf5cc574cabe78e2cb57c510250f

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f7:5f:24:02:54:44:fb:b6:f2:b9:7d:b9:24:b2:ec:f9:de:80:ac:b7
Signer

Actual PE Digest

f7:5f:24:02:54:44:fb:b6:f2:b9:7d:b9:24:b2:ec:f9:de:80:ac:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\jenkins\workspace\av-green_5-1-1_workspace\bavOutput\Pdb\Release\Plugin_FastAntivirus.pdb

Imports

log

WriteLog

directui

DirectUI_EnableAnimate
DirectUI_TreeCtrl_SetControlPos
DirectUI_TreeCtrl_ShowControl
DirectUI_Progress_SetPos
DirectUI_GetStringLength
DirectUI_TreeCtrl_DeleteItem
DirectUI_TreeCtrl_GetControlText
DirectUI_SetControlText
DirectUI_Button_SetUnknown
DirectUI_GetControlRect
DirectUI_AutoText_GetControlText
DirectUI_TreeCtrl_ChangeStyle
DirectUI_TreeCtrl_SetControlTextEx
DirectUI_TreeCtrl_SetButtonCheck
DirectUI_TreeCtrl_EnableChildControl
DirectUI_TreeCtrl_DeleteAllItems
DirectUI_TreeCtrl_InsertItem
DirectUI_TreeCtrl_SetTooltipString
DirectUI_TreeCtrl_SetControlText
DirectUI_SetControlTextEx
DirectUI_AutoText_SetControlTextEx
DirectUI_SetScrollBarSkin
DirectUI_EnableControl
DirectUI_TreeCtrl_SetAutoTextItemText
DirectUI_TreeCtrl_SetAutoTextItemTextEx
DirectUI_MoveEx
DirectUI_ShowControl
DirectUI_Progress_SetRange
DirectUI_AutoText_SetControlText
DirectUI_SubclassWindow
DirectUI_LoadSkinResourceFromZIP
DirectUI_ChangeStyle
DirectUI_SetTooltipStringEx
DirectUI_SetTooltipString
DirectUI_GetLanguageStyle
DirectUI_GetControlPos
DirectUI_SetControlPos
DirectUI_GetControlText
DirectUI_Button_GetCheck
DirectUI_IsControlVisible
DirectUI_TreeCtrl_Select
DirectUI_TreeCtrl_GetButtonCheck
DirectUI_Button_SetCheck
DirectUI_GetStringItem
DirectUI_GetSafeHwnd

kernel32

EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
CloseHandle
DeviceIoControl
CreateFileW
GetCurrentProcessId
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
GetDateFormatW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CreateProcessW
FreeLibrary
CreateDirectoryW
SetLastError
GetCurrentThreadId
RaiseException
FlushInstructionCache
GetCurrentProcess
SystemTimeToFileTime
GetTimeFormatW
GetLocalTime
GetProcAddress
LoadLibraryW
SetEndOfFile
WriteFile
SetFilePointer
SetErrorMode
GetModuleHandleW
ReadFile
FindResourceExW
LoadResource
DeleteFileW
GetTempPathW
IsBadReadPtr
WaitForSingleObject
InterlockedExchangeAdd
InterlockedDecrement
OpenThread
HeapAlloc
GetProcessHeap
HeapFree
DisconnectNamedPipe
WriteFileEx
CreateNamedPipeW
ConnectNamedPipe
DeleteCriticalSection
ReadFileEx
CreateEventW
GetOverlappedResult
GetModuleHandleExW
CreateThread
WaitNamedPipeW
SetNamedPipeHandleState
GetTickCount
ResetEvent
SwitchToThread
TerminateThread
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleA
GetModuleFileNameA
GetStdHandle
ExitProcess
WriteConsoleW
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetCPInfo
LCMapStringW
LCMapStringA
ResumeThread
GetCommandLineA
GetFileAttributesW
GetDateFormatA
GetTimeFormatA
ExitThread
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InitializeCriticalSection
HeapSize
HeapReAlloc
HeapDestroy
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
SetEvent
InitializeCriticalSectionAndSpinCount
LockResource
SizeofResource
FindResourceW
lstrlenA
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
WritePrivateProfileStringW
GetPrivateProfileStringW
GetTimeZoneInformation
GetLastError
InterlockedCompareExchange
InterlockedExchange
Sleep
GetPrivateProfileIntW
GetModuleFileNameW
CopyFileW
CreateFileA
InterlockedIncrement
FreeEnvironmentStringsA
GetConsoleMode
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetStringTypeA
SetEnvironmentVariableA
CompareStringW
SetStdHandle
GetLocaleInfoW
GetStringTypeW
CompareStringA

user32

UnregisterClassA
DestroyWindow
GetMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
RegisterClassW
GetClassInfoW
PostQuitMessage
SendMessageTimeoutW
GetWindowThreadProcessId
MoveWindow
ExitWindowsEx
GetDlgItem
GetParent
GetClientRect
MapWindowPoints
EndDialog
LoadBitmapW
FindWindowExW
SetWindowPos
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
RegisterWindowMessageW
RegisterClassExW
LoadCursorW
GetClassInfoExW
CreateWindowExW
CallWindowProcW
GetWindowLongW
SetWindowLongW
DialogBoxParamW
DefWindowProcW
GetScrollRange
SetScrollPos
GetActiveWindow
SendMessageW
KillTimer
SetWindowTextW
SetTimer
IsWindow
PostMessageW
ShowWindow

gdi32

DeleteObject

comdlg32

GetSaveFileNameW

advapi32

SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW

ole32

CoInitialize
CoUninitialize

shlwapi

SHRegGetValueW
PathAddExtensionW
SHGetValueW
PathFileExistsW
PathAddBackslashW
PathRemoveFileSpecW
PathIsDirectoryW

winhttp

WinHttpOpen
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl

Exports

Exports

CreatePluginItem
DestroyPluginItem

Sections

.text
Size: 491KB - Virtual size: 491KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/Plugin.Antivirus/res/res.bskin
.7z
Plugins/Plugin.Cleaner/CleanerEngine.dll
.dll windows:5 windows x86 arch:x86

0c3b173b75b94a1fc563b1e05750f047

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:76:43:ff:3f:e6:a1:16:f9:e4:e8:66:6b:04:1f:da:86:9b:14:16
Signer

Actual PE Digest

54:76:43:ff:3f:e6:a1:16:f9:e4:e8:66:6b:04:1f:da:86:9b:14:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\CleanerEngine.pdb

Imports

sqlite

sqlite3_column_bytes
sqlite3_column_text
sqlite3_open
sqlite3_exec
sqlite3_prepare
sqlite3_column_name16
sqlite3_step
sqlite3_finalize
sqlite3_prepare16
sqlite3_column_blob
sqlite3_column_int
sqlite3_open16
sqlite3_busy_timeout
sqlite3_bind_blob
sqlite3_column_text16
sqlite3_errmsg16
sqlite3_column_count
sqlite3_close
sqlite3_free

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z
?GetInstance@CAPCDispatcher@@SAPAV1@XZ

kernel32

MultiByteToWideChar
VerifyVersionInfoW
GetLastError
GetProcAddress
EnterCriticalSection
FindClose
Process32FirstW
LockResource
RemoveDirectoryW
Process32NextW
WTSGetActiveConsoleSessionId
QueueUserWorkItem
FindNextFileW
CreateToolhelp32Snapshot
DeleteCriticalSection
CloseHandle
GetSystemTime
HeapReAlloc
GetTickCount
HeapDestroy
HeapCreate
HeapSize
IsBadWritePtr
OpenThread
VirtualProtect
GetCurrentThreadId
DebugBreak
GetEnvironmentVariableW
SetErrorMode
GetSystemWindowsDirectoryW
GetFileAttributesW
GetTempPathW
GetCurrentDirectoryW
GetLongPathNameW
ExpandEnvironmentStringsW
GetDriveTypeW
SystemTimeToFileTime
GetLogicalDriveStringsW
CreateDirectoryW
GetModuleHandleW
FileTimeToSystemTime
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
DeleteFileW
SetFileAttributesW
GetVolumeInformationW
GetVersionExW
SetLastError
LocalFree
GetCurrentProcess
WaitForSingleObject
SetEvent
ResetEvent
CreateEventW
MapViewOfFile
UnmapViewOfFile
CreateFileW
CreateFileMappingW
WriteFile
GetModuleFileNameW
ReadFile
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
IsWow64Process
GetFileSize
TerminateThread
WritePrivateProfileStringW
VirtualFree
VirtualAlloc
GetLocalTime
GetPrivateProfileIntW
InterlockedExchange
InterlockedExchangeAdd
GetWindowsDirectoryW
lstrlenW
OutputDebugStringW
SetCurrentDirectoryW
GetNativeSystemInfo
ProcessIdToSessionId
DeviceIoControl
GetCurrentProcessId
lstrlenA
SystemTimeToTzSpecificLocalTime
CreateJobObjectW
AssignProcessToJobObject
QueryInformationJobObject
ResumeThread
GetFullPathNameW
TerminateProcess
SetEnvironmentVariableW
SetHandleInformation
GetConsoleOutputCP
OpenFileMappingW
CreatePipe
GetModuleHandleExW
Module32FirstW
Module32NextW
FormatMessageW
InterlockedCompareExchange
SetFilePointer
CreateFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetCPInfo
ExitProcess
GetCommandLineA
RtlUnwind
LCMapStringW
LCMapStringA
GetStringTypeW
CompareStringA
CompareStringW
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
SizeofResource
Sleep
LoadLibraryW
WideCharToMultiByte
GetSystemDirectoryW
OpenProcess
InitializeCriticalSection
GetPrivateProfileStringW
IsBadReadPtr
GetProcessHeap
HeapFree
InterlockedDecrement
MoveFileExW
VerSetConditionMask
InterlockedIncrement
HeapAlloc
LoadResource
FreeLibrary
FindResourceW
FindResourceExW
FindFirstFileW
GetStdHandle
GetModuleFileNameA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LoadLibraryA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleHandleA
GetLocaleInfoW
WriteConsoleA
WriteConsoleW
SetStdHandle
SetEndOfFile
SetEnvironmentVariableA
RaiseException
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
SetConsoleOutputCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetTimeZoneInformation

user32

SetTimer
GetMessageW
PostMessageW
GetWindowLongW
SetWindowLongW
IsWindow
CreateWindowExW
CallWindowProcW
DispatchMessageW

advapi32

CreateProcessAsUserW
RegOpenKeyW
RegSetValueExW
RegEnumKeyExW
GetLengthSid
AddAce
RegSetKeySecurity
FreeSid
RegEnumValueW
AllocateAndInitializeSid
InitializeAcl
RegDeleteValueW
RegGetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryInfoKeyW
CopySid
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
RegQueryValueExW
RegEnumKeyW
RegDeleteKeyW
RegCreateKeyExW
ConvertSidToStringSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupAccountNameW
GetUserNameW
ControlService
ChangeServiceConfigW
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
RegCloseKey
RegOpenKeyExW
RevertToSelf
RegOpenCurrentUser
ImpersonateLoggedOnUser
RegOpenUserClassesRoot
OpenProcessToken

shell32

ShellExecuteW
SHGetFolderPathW
SHGetSpecialFolderPathW
ord165

ole32

CoInitialize
CoInitializeEx
CoUninitialize
CoCreateInstance
CLSIDFromString

oleaut32

SysFreeString
SysAllocString

psapi

GetModuleFileNameExW
EnumProcessModules
GetModuleBaseNameW

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken

shlwapi

PathIsDirectoryW
PathRemoveFileSpecW
SHGetValueW
PathFindFileNameW
PathFileExistsW
PathAppendW
PathAddBackslashW
PathFindExtensionW
StrStrIW
SHDeleteValueW
SHDeleteKeyW
PathIsFileSpecW
StrCpyNW
StrCmpIW
StrCmpW
StrCmpNIW
PathRemoveExtensionW
StrCpyW
StrStrW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

userenv

ExpandEnvironmentStringsForUserW
DestroyEnvironmentBlock
CreateEnvironmentBlock

rpcrt4

UuidFromStringW

msi

ord217
ord173

Exports

Exports

CreateObject
_DllMain@12

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 385KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/Plugin.Cleaner/Data/0002.MyPCBackup.rul
Plugins/Plugin.Cleaner/Data/0003.VuuPC.rul
Plugins/Plugin.Cleaner/Data/0004.iLivid.rul
Plugins/Plugin.Cleaner/Data/0005.TornTV.rul
Plugins/Plugin.Cleaner/Data/0006.UpdateChecker.rul
Plugins/Plugin.Cleaner/Data/0008.UnderTheSea.rul
Plugins/Plugin.Cleaner/Data/0010.Martview.rul
Plugins/Plugin.Cleaner/Data/0011.CdCoverCreator.rul
Plugins/Plugin.Cleaner/Data/0012.TheWeatherChannelApp.rul
Plugins/Plugin.Cleaner/Data/0013.FreeKeylogger.rul
Plugins/Plugin.Cleaner/Data/0014.Smadav96.rul
Plugins/Plugin.Cleaner/Data/0016.AutorunEater.rul
Plugins/Plugin.Cleaner/Data/0017.USBGuardian.rul
Plugins/Plugin.Cleaner/Data/0018.AbsoluteShieldfileshredder.rul
Plugins/Plugin.Cleaner/Data/0019.AlfaAutorunKiller.rul
Plugins/Plugin.Cleaner/Data/0021.MP3Rocket.rul
Plugins/Plugin.Cleaner/Data/0022.AnimatorDV.rul
Plugins/Plugin.Cleaner/Data/0024.VideoDownloadConvert.rul
Plugins/Plugin.Cleaner/Data/0025.SpeedBitVideoDownloader.rul
Plugins/Plugin.Cleaner/Data/0026.KaraFun.rul
Plugins/Plugin.Cleaner/Data/0029.FreeRARExtractFrog.rul
Plugins/Plugin.Cleaner/Data/0031.KCSoftwaresSUMo.rul
Plugins/Plugin.Cleaner/Data/0032.FreeMouseAutoClicker.rul
Plugins/Plugin.Cleaner/Plugin_Cleaner.dll
.dll windows:5 windows x86 arch:x86

03f4bf35a757d09dff7b72a43f19f1e0

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f4:41:7e:23:da:e5:67:dc:bf:b3:cd:19:a1:6c:ae:c2:29:8d:a3:b7
Signer

Actual PE Digest

f4:41:7e:23:da:e5:67:dc:bf:b3:cd:19:a1:6c:ae:c2:29:8d:a3:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Plugin_Cleaner.pdb

Imports

baidustore

??0Baidu_ListenData@@QAE@PB_W@Z
??1Baidu_ListenData@@UAE@XZ
?IsConnectSubSvc@CBaiduStoreMgr@@QAEHPB_W@Z
?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z
?SaveSparkClick@BdConfig@@QAEXH@Z
?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ
?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z
?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z
?ReportStateEx@CBaiduStoreMgr@@QAEHKPB_W@Z

directui

DirectUI_TreeEx_Expand
DirectUI_TreeEx_ChangeStyle
DirectUI_Progress_GetPos
DirectUI_AutoText_SetControlTextEx
DirectUI_TreeEx_IsExpand
DirectUI_TreeEx_ShowControl
UIStartAnimateFromTree
DirectUI_TreeEx_SetButtonCheck
DirectUI_ShowControl
uiUpdateWindow
DirectUI_TreeEx_SetControlTextEx
DirectUI_IsControlVisible
DirectUI_TreeEx_InsertItem
DirectUI_TreeEx_EnableControl
DirectUI_TreeEx_SetStaticLogoImage
DirectUI_Progress_SetRange
DirectUI_TreeEx_DeleteItem
DirectUI_AutoText_SetControlText
DirectUI_TreeEx_SetControlText
DirectUI_SetControlPos
DirectUI_TreeEx_SetAutoTextItemTextEx
DirectUI_TreeEx_GetControlText
DirectUI_GetControlStyle
DirectUI_TreeEx_SetItemHeight
DirectUI_EnableControl
DirectUI_SetControlText
DirectUI_TreeEx_IsControlVisible
DirectUI_TreeEx_GetItemStyle
DirectUI_TreeEx_DeleteAllItems
DirectUI_ChangeStyle
DirectUI_Static_SetLogoImage
DirectUI_TreeEx_SetProgressPos
DirectUI_SubclassWindow
DirectUI_AddFontsResource
DirectUI_LoadSkinResourceFromZIP
DirectUI_SetControlTextEx
UISetScrollPos
UIInitAniRunInfo
DirectUI_Progress_SetPos
DirectUI_GetControlText
DirectUI_AutoText_GetControlText
UIGetScrollPos
DirectUI_EnableAnimate
DirectUI_GetControlRect
DirectUI_TreeEx_GetAutoTextItemText
DirectUI_TreeEx_SetAutoTextItemText
DirectUI_TreeEx_GetButtonCheck

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ
?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

GetTickCount
GetPrivateProfileStringW
SizeofResource
Sleep
GetVersionExW
WaitForSingleObject
GetExitCodeProcess
GetFileAttributesW
GetModuleFileNameW
WritePrivateProfileStringW
FlushInstructionCache
RaiseException
GetPrivateProfileIntW
VerifyVersionInfoW
GetLastError
GetCurrentProcess
GetProcAddress
EnterCriticalSection
Process32FirstW
CreateFileMappingW
LockResource
Process32NextW
OpenFileMappingW
CreateToolhelp32Snapshot
GetCurrentThreadId
FindAtomW
CloseHandle
LoadLibraryW
HeapAlloc
HeapFree
GetProcessHeap
IsBadReadPtr
WideCharToMultiByte
GetModuleHandleW
DeleteFileW
InitializeCriticalSection
DeleteCriticalSection
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetUserDefaultLCID
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetTimeZoneInformation
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
lstrlenW
GetLogicalDrives
VerSetConditionMask
CreateProcessW
LoadResource
FindResourceW
FindResourceExW
UnmapViewOfFile
MapViewOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetLastError
LeaveCriticalSection
GetACP
GetCPInfo
LCMapStringW
MultiByteToWideChar
LCMapStringA
RtlUnwind
GetCommandLineA
IsDebuggerPresent
ReadFile
CreateFileA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CreateThread
ExitThread
GetSystemTimeAsFileTime
InterlockedExchange
InterlockedDecrement
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
SetFilePointer
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
HeapDestroy
HeapReAlloc
HeapSize
InterlockedCompareExchange
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedIncrement

user32

LoadCursorW
GetClassInfoExW
RegisterClassExW
CreateWindowExW
CallWindowProcW
DefWindowProcW
GetWindowRect
SetForegroundWindow
GetParent
GetClientRect
GetWindowLongW
MonitorFromWindow
EndDialog
SetWindowPos
ShowWindow
FindWindowExW
MapWindowPoints
GetMonitorInfoW
GetWindow
SetTimer
PostMessageW
KillTimer
DialogBoxParamW
FindWindowW
InvalidateRect
SetWindowLongW
IsWindow
SendMessageW
SetWindowTextW
UnregisterClassA

advapi32

RegQueryValueExW
RegOpenKeyW
GetTraceLoggerHandle
TraceEvent
UnregisterTraceGuids
RegOpenKeyExW
GetTraceEnableLevel
RegCloseKey
RegisterTraceGuidsW
RegDeleteValueW
GetTraceEnableFlags

shell32

ShellExecuteW
ord165
SHGetDesktopFolder
SHOpenFolderAndSelectItems
SHGetFolderPathW
ShellExecuteExW
SHChangeNotify

ole32

CoTaskMemFree

shlwapi

PathRemoveFileSpecW
PathFileExistsW
SHGetValueW
PathAppendW
PathIsRelativeW
PathIsDirectoryW

gdiplus

GdiplusStartup
GdiplusShutdown

Exports

Exports

CreatePluginItem
DestroyPluginItem

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 233KB - Virtual size: 233KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/Plugin.Cleaner/Rules/1045.AccuWeather.rul
Plugins/Plugin.Cleaner/Rules/1046.appbario12.rul
Plugins/Plugin.Cleaner/Rules/1047.A180Darts.rul
Plugins/Plugin.Cleaner/Rules/1048.MixiDjV30.rul
Plugins/Plugin.Cleaner/Rules/1049.SocialSearchBar.rul
Plugins/Plugin.Cleaner/Rules/1050.SolidSavings.rul
Plugins/Plugin.Cleaner/Rules/1051.SavingsApp.rul
Plugins/Plugin.Cleaner/Rules/1052.TigerSavings.rul
Plugins/Plugin.Cleaner/Rules/1053.SupremeSavings.rul
Plugins/Plugin.Cleaner/Rules/1054.CouponCaddy.rul
Plugins/Plugin.Cleaner/Rules/1055.WhiteSmoke.rul
Plugins/Plugin.Cleaner/Rules/1056.WhiteSmkeUSNew.rul
Plugins/Plugin.Cleaner/Rules/1056.whitesmokeusnew.rul
Plugins/Plugin.Cleaner/Rules/1057.TrustWorthy.rul
Plugins/Plugin.Cleaner/Rules/1058.ScenicReflections.rul
Plugins/Plugin.Cleaner/Rules/1060.LuckySavings.rul
Plugins/Plugin.Cleaner/Rules/1061.SearchProtect.rul
Plugins/Plugin.Cleaner/Rules/1062.OnlineRadioPlayerRecorderToolbar.rul
Plugins/Plugin.Cleaner/Rules/1063.SnapDo.rul
Plugins/Plugin.Cleaner/Rules/1064.Webblog.rul
Plugins/Plugin.Cleaner/Rules/1065.DeltaToolbar.rul
Plugins/Plugin.Cleaner/Rules/1066.avery.rul
Plugins/Plugin.Cleaner/Rules/1067.SearchAssistant.rul
Plugins/Plugin.Cleaner/Rules/1068.AppBario2.rul
Plugins/Plugin.Cleaner/Rules/1070.IMVUToolbar.rul
Plugins/Plugin.Cleaner/Rules/1072.MyHomepage.rul
Plugins/Plugin.Cleaner/Rules/1074.CodecPerformer.rul
Plugins/Plugin.Cleaner/Rules/1076.SavingsAddon.rul
Plugins/Plugin.Cleaner/Rules/1077.BrowserCompanion.rul
Plugins/Plugin.Cleaner/Rules/1081.Funmoods.rul
Plugins/Plugin.Cleaner/Rules/1082.PricePeep.rul
Plugins/Plugin.Cleaner/Rules/1083.PriceGong.rul
Plugins/Plugin.Cleaner/Rules/1085.facesmooch.rul
Plugins/Plugin.Cleaner/Rules/1086.DownloadEnergyToolbar.rul
Plugins/Plugin.Cleaner/Rules/1087.MediaFinder.rul
Plugins/Plugin.Cleaner/Rules/1088.yontooToolbar.rul
Plugins/Plugin.Cleaner/Rules/1089.DVDVideoSoftToolbar.rul
Plugins/Plugin.Cleaner/Rules/1090.DVDVideoSoftToolbar.rul
Plugins/Plugin.Cleaner/Rules/1093.BittorrentBar_FRToolbar.rul
Plugins/Plugin.Cleaner/Rules/1094.BittorrentBar_DEToolbar.rul
Plugins/Plugin.Cleaner/Rules/1095.DigiModeToolbar.rul
Plugins/Plugin.Cleaner/Rules/1097.NCH FRToolbar.rul
Plugins/Plugin.Cleaner/Rules/1098.NewYorkYankeesToolbar.rul
Plugins/Plugin.Cleaner/Rules/1099.SearchDeals.rul
Plugins/Plugin.Cleaner/Rules/1101.VAFMusic.rul
Plugins/Plugin.Cleaner/Rules/1102.FastFreeConverter.rul
Plugins/Plugin.Cleaner/Rules/1104.SavepathDeals.rul
Plugins/Plugin.Cleaner/Rules/1105.FreeYoutubeDownload.rul
Plugins/Plugin.Cleaner/Rules/1106.GetSavin.rul
Plugins/Plugin.Cleaner/Rules/1107.TVGenie.rul
Plugins/Plugin.Cleaner/Rules/1108.SmartSuggestor.rul
Plugins/Plugin.Cleaner/Rules/1110.BrowseForTheCause.rul
Plugins/Plugin.Cleaner/Rules/1111.Vuze.rul
Plugins/Plugin.Cleaner/Rules/1112.SaveValet.rul
Plugins/Plugin.Cleaner/Rules/1113.SpyGuard.rul
Plugins/Plugin.Cleaner/Rules/1114.ST-Eng7.rul
Plugins/Plugin.Cleaner/Rules/1115.Qwiklinx.rul
Plugins/Plugin.Cleaner/Rules/1116.NewVeoh.rul
Plugins/Plugin.Cleaner/Rules/1117.RewardsArcade.rul
Plugins/Plugin.Cleaner/Rules/1118.A2ZLyrics.rul
Plugins/Plugin.Cleaner/Rules/1121.KeyBar.rul
Plugins/Plugin.Cleaner/Rules/1122.Mysearchdial.rul
Plugins/Plugin.Cleaner/Rules/1124.MagicDesktopENToolbar.rul
Plugins/Plugin.Cleaner/Rules/1125.NCH_ENToolbar.rul
Plugins/Plugin.Cleaner/Rules/1126.Hao123SearchRemovalTool.rul
Plugins/Plugin.Cleaner/Rules/1127.BSPlayerControlBar.rul
Plugins/Plugin.Cleaner/Rules/1128.EasyTVBar.rul
Plugins/Plugin.Cleaner/Rules/1129.HamInfoBar.rul
Plugins/Plugin.Cleaner/Rules/1130.PhotoJoyBar.rul
Plugins/Plugin.Cleaner/Rules/1131.SocialSearchBar.rul
Plugins/Plugin.Cleaner/Rules/1132.SerifBar.rul
Plugins/Plugin.Cleaner/Rules/1133.Mp3TubeToolbar.rul
Plugins/Plugin.Cleaner/Rules/1134.ooVoo.rul
Plugins/Plugin.Cleaner/Rules/1136.AF_HSS.rul
Plugins/Plugin.Cleaner/Rules/1137.TVersityBar.rul
Plugins/Plugin.Cleaner/Rules/1138.MapsBar.rul
Plugins/Plugin.Cleaner/Rules/1139.RecipesBar.rul
Plugins/Plugin.Cleaner/Rules/1140.BroderbundBar.rul
Plugins/Plugin.Cleaner/Rules/1141.GameMasterToolbar.rul
Plugins/Plugin.Cleaner/Rules/1142.KeyBar1.13.rul
Plugins/Plugin.Cleaner/Rules/1143.BrowserPlus2.rul
Plugins/Plugin.Cleaner/Rules/1144.WiseConvertB2.rul
Plugins/Plugin.Cleaner/Rules/1145.FreeSoundRecorder.rul
Plugins/Plugin.Cleaner/Rules/1146.BrotherSoftExtremeToolbar.rul
Plugins/Plugin.Cleaner/Rules/1147.EntrustedToolbar.rul
Plugins/Plugin.Cleaner/Rules/1148.KeyBar1.8.rul
Plugins/Plugin.Cleaner/Rules/1150.DealSlider.rul
Plugins/Plugin.Cleaner/Rules/1151.NinjaSavings.rul
Plugins/Plugin.Cleaner/Rules/1152.DealCola.rul
Plugins/Plugin.Cleaner/Rules/1153.TubeDimmer.rul
Plugins/Plugin.Cleaner/Rules/1155.CouponChaser.rul
Plugins/Plugin.Cleaner/Rules/1157.AppsHat.rul
Plugins/Plugin.Cleaner/Rules/1158.UnfriendCheck.rul
Plugins/Plugin.Cleaner/Rules/1161.Linksicle.rul
Plugins/Plugin.Cleaner/Rules/1162.TidyNetwork.rul
Plugins/Plugin.Cleaner/Rules/1163.BubbleDock.rul
Plugins/Plugin.Cleaner/Rules/1164.RecordChecker.rul
Plugins/Plugin.Cleaner/Rules/1165.SavingsScout.rul
Plugins/Plugin.Cleaner/Rules/1166.SpyAlert.rul
Plugins/Plugin.Cleaner/Rules/1167.KingTranslate.rul
Plugins/Plugin.Cleaner/Rules/1168.LessTabs.rul
Plugins/Plugin.Cleaner/Rules/1169.LoadTubes.rul
Plugins/Plugin.Cleaner/Rules/1170.Alawar_Ask_brch.rul
Plugins/Plugin.Cleaner/Rules/1172.AskPartnerNetwork.rul
Plugins/Plugin.Cleaner/Rules/1175.SySaver.rul
Plugins/Plugin.Cleaner/Rules/1176.AutoLyrics.rul
Plugins/Plugin.Cleaner/Rules/1178.IminentToolbar.rul
Plugins/Plugin.Cleaner/Rules/1178.iminettoolbar.rul
Plugins/Plugin.Cleaner/Rules/1179.FilesFrogUpdateChecker.rul
Plugins/Plugin.Cleaner/Rules/1180.TNT2-ide.rul
Plugins/Plugin.Cleaner/Rules/1181.Highlightly.rul
Plugins/Plugin.Cleaner/Rules/1183.SuperfishWindowShopper.rul
Plugins/Plugin.Cleaner/Rules/1185.InstantSavingsApp.rul
Plugins/Plugin.Cleaner/Rules/1187.Strongvault.rul
Plugins/Plugin.Cleaner/Rules/1188.InfoAtoms.rul
Plugins/Plugin.Cleaner/Rules/1189.JollyWallet.rul
Plugins/Plugin.Cleaner/Rules/1195.WProtectManager.rul
Plugins/Plugin.Cleaner/Rules/1196.V9Toolbar.rul
Plugins/Plugin.Cleaner/Rules/1197.Desk365.rul
Plugins/Plugin.Cleaner/Rules/1198.SaveClicker.rul
Plugins/Plugin.Cleaner/Rules/1199.freevenpro.rul
Plugins/Plugin.Cleaner/Rules/1200.shopperpro.rul
Plugins/Plugin.Cleaner/Rules/1202.hqvideo.rul
Plugins/Plugin.Cleaner/Rules/1204.flvplayer.rul
Plugins/Plugin.Cleaner/Rules/1205.hdtotals.rul
Plugins/Plugin.Cleaner/Rules/1206.easydeals.rul
Plugins/Plugin.Cleaner/Rules/1207.hdshop.rul
Plugins/Plugin.Cleaner/Rules/1208.plushd.rul
Plugins/Plugin.Cleaner/Rules/1209.Torntv.rul
Plugins/Plugin.Cleaner/Rules/1211.surfandkeep.rul
Plugins/Plugin.Cleaner/Rules/1212.freeven.rul
Plugins/Plugin.Cleaner/Rules/1213.ZenDeals.rul
Plugins/Plugin.Cleaner/Rules/1214.CouponServer.rul
Plugins/Plugin.Cleaner/Rules/1216.BuzzSearch.rul
Plugins/Plugin.Cleaner/Rules/1217.CouponSamurai.rul
Plugins/Plugin.Cleaner/Rules/1218.ExcellentCoupons.rul
Plugins/Plugin.Cleaner/Rules/1219.ScorpionSaver.rul
Plugins/Plugin.Cleaner/Rules/1220.WonderBrowse.rul
Plugins/Plugin.Cleaner/Rules/1224.Monetomi.rul
Plugins/Plugin.Cleaner/Rules/1226.quiknowledge.rul
Plugins/Plugin.Cleaner/Rules/1227.radsteroids.rul
Plugins/Plugin.Cleaner/Rules/1228.couponclipster.rul
Plugins/Plugin.Cleaner/Rules/1231.babylon.rul
Plugins/Plugin.Cleaner/Rules/1232.555.in.th.rul
Plugins/Plugin.Cleaner/Rules/1236.utorrentcontrol_v2.rul
Plugins/Plugin.Cleaner/Rules/1237.utorrentcontrol.rul
Plugins/Plugin.Cleaner/Rules/1238.crawler.rul
Plugins/Plugin.Cleaner/Rules/1239.fileconverter.rul
Plugins/Plugin.Cleaner/Rules/1240.shares.rul
Plugins/Plugin.Cleaner/Rules/1241.certified.rul
Plugins/Plugin.Cleaner/Rules/1242.utorrentcontrolv6.rul
Plugins/Plugin.Cleaner/Rules/1244.systweak.rul
Plugins/Plugin.Cleaner/Rules/1245.winloadnew.rul
Plugins/Plugin.Cleaner/Rules/1246.vuzeremote.rul
Plugins/Plugin.Cleaner/Rules/1247.cleaner.rul
Plugins/Plugin.Cleaner/Rules/1248.hotspotshieldelite.rul
Plugins/Plugin.Cleaner/Rules/1249.searchsnacks.rul
Plugins/Plugin.Cleaner/Rules/1250.bsplayerb2.rul
Plugins/Plugin.Cleaner/Rules/1251.freeonlineradioplayerrecorderdm.rul
Plugins/Plugin.Cleaner/Rules/1252.2shared.rul
Plugins/Plugin.Cleaner/Rules/1253.toggleen.rul
Plugins/Plugin.Cleaner/Rules/1254.xfinty.rul
Plugins/Plugin.Cleaner/Rules/1255.pupnukeit.rul
Plugins/Plugin.Cleaner/Rules/1256.flashenhancer.rul
Plugins/Plugin.Cleaner/Rules/1257.blockandsurf.rul
Plugins/Plugin.Cleaner/Rules/1258.moviestoolbar.rul
Plugins/Plugin.Cleaner/Rules/1259.rockturner.rul
Plugins/Plugin.Cleaner/Rules/1260.snt.rul
Plugins/Plugin.Cleaner/Rules/1262.appmarket.rul
Plugins/Plugin.Cleaner/Rules/1263.Pconverter.rul
Plugins/Plugin.Cleaner/Rules/1265.welovegames.rul
Plugins/Plugin.Cleaner/Rules/1266.nvstech.rul
Plugins/Plugin.Cleaner/Rules/1267.bitlord.rul
Plugins/Plugin.Cleaner/Rules/1268.freemium.rul
Plugins/Plugin.Cleaner/Rules/1269.superfast.rul
Plugins/Plugin.Cleaner/Rules/1270.swirlz.rul
Plugins/Plugin.Cleaner/Rules/1271.cricbuzz.rul
Plugins/Plugin.Cleaner/Rules/1272.marioforever.rul
Plugins/Plugin.Cleaner/Rules/1273.connect.rul
Plugins/Plugin.Cleaner/Rules/1274.guffins.rul
Plugins/Plugin.Cleaner/Rules/1276.ipumper.rul
Plugins/Plugin.Cleaner/Rules/1277.mysavings.rul
Plugins/Plugin.Cleaner/Rules/1278.makemebabies.rul
Plugins/Plugin.Cleaner/Rules/1279.searchme.rul
Plugins/Plugin.Cleaner/Rules/1280.sweettunes.rul
Plugins/Plugin.Cleaner/Rules/1281.searchflybar.rul
Plugins/Plugin.Cleaner/Rules/1284.totalrecipesearch.rul
Plugins/Plugin.Cleaner/Rules/1285.midicair.rul
Plugins/Plugin.Cleaner/Rules/1286.messengerplusbr.rul
Plugins/Plugin.Cleaner/Rules/1287.dictionaryboss.rul
Plugins/Plugin.Cleaner/Rules/1288.iwin.rul
Plugins/Plugin.Cleaner/Rules/1291.oople.rul
Plugins/Plugin.Cleaner/Rules/1292.findr.rul
Plugins/Plugin.Cleaner/Rules/1293.sitesimple.rul
Plugins/Plugin.Cleaner/Rules/1296.savingsbull.rul
Plugins/Plugin.Cleaner/Rules/1297.freeride.rul
Plugins/Plugin.Cleaner/Rules/1307.runescape.rul
Plugins/Plugin.Cleaner/Rules/1308.complitly.rul
Plugins/Plugin.Cleaner/Rules/1310.trustloke.rul
Plugins/Plugin.Cleaner/Rules/1311.faceless.rul
Plugins/Plugin.Cleaner/Rules/1312.costmin.rul
Plugins/Plugin.Cleaner/Rules/1313.rawcoupon.rul
Plugins/Plugin.Cleaner/Rules/1314.wiseconvert.rul
Plugins/Plugin.Cleaner/Rules/1315.reversoes.rul
Plugins/Plugin.Cleaner/Rules/1316.radiojazz.rul
Plugins/Plugin.Cleaner/Rules/1318.reverso.rul
Plugins/Plugin.Cleaner/Rules/1319.protected.rul
Plugins/Plugin.Cleaner/Rules/1320.vafmusic9.rul
Plugins/Plugin.Cleaner/Rules/1321.searchflybar5.rul
Plugins/Plugin.Cleaner/Rules/1322.realorestudios.rul
Plugins/Plugin.Cleaner/Rules/1324.shoppingchip.rul
Plugins/Plugin.Cleaner/Rules/1325.safesaver.rul
Plugins/Plugin.Cleaner/Rules/1326.somoto.rul
Plugins/Plugin.Cleaner/Rules/1327.saversplanet.rul
Plugins/Plugin.Cleaner/Rules/1328.reganam.rul
Plugins/Plugin.Cleaner/Rules/1330.casualgaming.rul
Plugins/Plugin.Cleaner/Rules/1331.sweetpacks.rul
Plugins/Plugin.Cleaner/Rules/1333.searchfly5428.rul
Plugins/Plugin.Cleaner/Rules/1334.searchelf.rul
Plugins/Plugin.Cleaner/Rules/1335.claro.rul
Plugins/Plugin.Cleaner/Rules/1336.clipgrab.rul
Plugins/Plugin.Cleaner/Rules/1337.wiseconverte1.rul
Plugins/Plugin.Cleaner/Rules/1338.dealboat.rul
Plugins/Plugin.Cleaner/Rules/1339.arcaderush.rul
Plugins/Plugin.Cleaner/Rules/1340.searchspin.rul
Plugins/Plugin.Cleaner/Rules/1341.jobnetworks.rul
Plugins/Plugin.Cleaner/Rules/1342.iuserbar.rul
Plugins/Plugin.Cleaner/Rules/1343.ytbyclickb2.rul
Plugins/Plugin.Cleaner/Rules/1344.orytegames.rul
Plugins/Plugin.Cleaner/Rules/1345.tcadeltona.rul
Plugins/Plugin.Cleaner/Rules/1346.badgehelp.rul
Plugins/Plugin.Cleaner/Rules/1347.pandora.rul
Plugins/Plugin.Cleaner/Rules/1348.sitefinder.rul
Plugins/Plugin.Cleaner/Rules/1349.hottraxradio.rul
Plugins/Plugin.Cleaner/Rules/1350.fifabario.rul
Plugins/Plugin.Cleaner/Rules/1351.viraltrafficfrenzy.rul
Plugins/Plugin.Cleaner/Rules/1352.flybuys.rul
Plugins/Plugin.Cleaner/Rules/1353.stardoll.rul
Plugins/Plugin.Cleaner/Rules/1354.tvjeeves.rul
Plugins/Plugin.Cleaner/Rules/1355.slingo.rul
Plugins/Plugin.Cleaner/Rules/1356.tvbario.rul
Plugins/Plugin.Cleaner/Rules/1357.kb1thm.rul
Plugins/Plugin.Cleaner/Rules/1358.mundotool.rul
Plugins/Plugin.Cleaner/Rules/1359.programascom.rul
Plugins/Plugin.Cleaner/Rules/1360.searchqu.rul
Plugins/Plugin.Cleaner/Rules/1361.streampinoy.rul
Plugins/Plugin.Cleaner/Rules/1362.trinilocal.rul
Plugins/Plugin.Cleaner/Rules/1363.suptab.rul
Plugins/Plugin.Cleaner/Rules/1364.gamewrangler.rul
Plugins/Plugin.Cleaner/Rules/1365.iwinstore.rul
Plugins/Plugin.Cleaner/Rules/1366.taxanswersfree.rul
Plugins/Plugin.Cleaner/Rules/1367.bonzuma.rul
Plugins/Plugin.Cleaner/Rules/1368.ofertilandiatop.rul
Plugins/Plugin.Cleaner/Rules/1369.realplayer.rul
Plugins/Plugin.Cleaner/Rules/1370.rally.rul
Plugins/Plugin.Cleaner/Rules/1371.nexusradio.rul
Plugins/Plugin.Cleaner/Rules/1372.searchpage.rul
Plugins/Plugin.Cleaner/Rules/1373.sweetim.rul
Plugins/Plugin.Cleaner/Rules/1374.incredibar.rul
Plugins/Plugin.Cleaner/Rules/1375.searchresults.rul
Plugins/Plugin.Cleaner/Rules/1376.widgi.rul
Plugins/Plugin.Cleaner/Rules/1377.webalta.rul
Plugins/Plugin.Cleaner/Rules/1378.my.rul
Plugins/Plugin.Cleaner/Rules/1380.bocai.rul
Plugins/Plugin.Cleaner/Rules/1384.coupongenies.rul
Plugins/Plugin.Cleaner/Rules/1385.perfilunico.rul
Plugins/Plugin.Cleaner/Rules/1386.ytd.rul
Plugins/Plugin.Cleaner/Rules/1387.ecuadortv.rul
Plugins/Plugin.Cleaner/Rules/1388.sunriseradio.rul
Plugins/Plugin.Cleaner/Rules/1389.jhoos.rul
Plugins/Plugin.Cleaner/Rules/1390.thoosje.rul
Plugins/Plugin.Cleaner/Rules/1391.spesoft.rul
Plugins/Plugin.Cleaner/Rules/1392.wkrk.rul
Plugins/Plugin.Cleaner/Rules/1394.omgmusic.rul
Plugins/Plugin.Cleaner/Rules/1395.twinkl.rul
Plugins/Plugin.Cleaner/Rules/1396.bringmesports.rul
Plugins/Plugin.Cleaner/Rules/1397.utilitychest.rul
Plugins/Plugin.Cleaner/Rules/1398.retrogamer.rul
Plugins/Plugin.Cleaner/Rules/1399.pangnradio.rul
Plugins/Plugin.Cleaner/Rules/1400.appbario13.rul
Plugins/Plugin.Cleaner/Rules/1401.tidynetwork.rul
Plugins/Plugin.Cleaner/Rules/1402.legendaryreviews.rul
Plugins/Plugin.Cleaner/Rules/1403.isearch.rul
Plugins/Plugin.Cleaner/Rules/1404.quizulous.rul
Plugins/Plugin.Cleaner/Rules/1405.myfreestuff.rul
Plugins/Plugin.Cleaner/Rules/1406.wiseconvert.rul
Plugins/Plugin.Cleaner/Rules/1407.mefogames.rul
Plugins/Plugin.Cleaner/Rules/1408.quixley.rul
Plugins/Plugin.Cleaner/Rules/1409.mininova.rul
Plugins/Plugin.Cleaner/Rules/1410.freewinturbo.rul
Plugins/Plugin.Cleaner/Rules/1411.falcosoftware.rul
Plugins/Plugin.Cleaner/Rules/1412.pchelpsoft.rul
Plugins/Plugin.Cleaner/Rules/1413.playgames.rul
Plugins/Plugin.Cleaner/Rules/1415.phpnukedu.rul
Plugins/Plugin.Cleaner/Rules/1416.topix.rul
Plugins/Plugin.Cleaner/Rules/1417.nectar.rul
Plugins/Plugin.Cleaner/Rules/1419.miniclipr0.rul
Plugins/Plugin.Cleaner/Rules/1420.myjobs.rul
Plugins/Plugin.Cleaner/Rules/1421.bundlore.rul
Plugins/Plugin.Cleaner/Rules/1422.estaciodesa.rul
Plugins/Plugin.Cleaner/Rules/1423.yourtvlive.rul
Plugins/Plugin.Cleaner/Rules/1424.browserplus.rul
Plugins/Plugin.Cleaner/Rules/1425.worldnetradio.rul
Plugins/Plugin.Cleaner/Rules/1426.mapit.rul
Plugins/Plugin.Cleaner/Rules/1427.manualsforall.rul
Plugins/Plugin.Cleaner/Rules/1428.trustyworthy.rul
Plugins/Plugin.Cleaner/Rules/1429.webgoradio.rul
Plugins/Plugin.Cleaner/Rules/1430.couponalert.rul
Plugins/Plugin.Cleaner/Rules/1431.tvkosova.rul
Plugins/Plugin.Cleaner/Rules/1433.homegain.rul
Plugins/Plugin.Cleaner/Rules/1453.betterads.rul
Plugins/Plugin.Cleaner/Rules/1467.linkey.rul
Plugins/Plugin.Cleaner/Rules/1483.kurulum.rul
Plugins/Plugin.Cleaner/Rules/1487.eazel.rul
Plugins/Plugin.Cleaner/Rules/1489.desktopdating.rul
Plugins/Plugin.Cleaner/Rules/1491.dlsecure.rul
Plugins/Plugin.Cleaner/Rules/1496.recfree.rul
Plugins/Plugin.Cleaner/Rules/1499.mixchats.rul
Plugins/Plugin.Cleaner/Rules/1503.sparklebox.rul
Plugins/Plugin.Cleaner/Rules/1509.marketamerica.rul
Plugins/Plugin.Cleaner/Rules/1514.orange.rul
Plugins/Plugin.Cleaner/Rules/1525.levelup.rul
Plugins/Plugin.Cleaner/Rules/1532.suddenlink.rul
Plugins/Plugin.Cleaner/Rules/1536.calculator.rul
Plugins/Plugin.Cleaner/Rules/1544.bandoo.rul
Plugins/Plugin.Cleaner/Rules/1560.dynamo.rul
Plugins/Plugin.Cleaner/Rules/1563.limewire.rul
Plugins/Plugin.Cleaner/Rules/1570.buzzdock.rul
Plugins/Plugin.Cleaner/Rules/1576.rihanna.rul
Plugins/Plugin.Cleaner/Rules/1577.websearch.rul
Plugins/Plugin.Cleaner/Rules/1586.flvrunner.rul
Plugins/Plugin.Cleaner/Rules/1587.weatherblink.rul
Plugins/Plugin.Cleaner/Rules/1595.speedtest.rul
Plugins/Plugin.Cleaner/Rules/1596.movie.rul
Plugins/Plugin.Cleaner/Rules/1600.clearthink.rul
Plugins/Plugin.Cleaner/Rules/1601.togglemark.rul
Plugins/Plugin.Cleaner/Rules/1602.meteoroids.rul
Plugins/Plugin.Cleaner/Rules/1603.musicsearch.rul
Plugins/Plugin.Cleaner/Rules/1604.yawtix.rul
Plugins/Plugin.Cleaner/Rules/1605.gooternet.rul
Plugins/Plugin.Cleaner/Rules/1612.slicksavings.rul
Plugins/Plugin.Cleaner/Rules/1613.podoweb.rul
Plugins/Plugin.Cleaner/Rules/1615.dolphindeals.rul
Plugins/Plugin.Cleaner/Rules/1617.portalmore.rul
Plugins/Plugin.Cleaner/Rules/1620.smarterpower.rul
Plugins/Plugin.Cleaner/Rules/1622.tvwzard.rul
Plugins/Plugin.Cleaner/Rules/1627.findopolis.rul
Plugins/Plugin.Cleaner/Rules/1628.focusbase.rul
Plugins/Plugin.Cleaner/Rules/1629.adanak.rul
Plugins/Plugin.Cleaner/Rules/1632.sense.rul
Plugins/Plugin.Cleaner/Rules/1635.2algeria.rul
Plugins/Plugin.Cleaner/Rules/1638.splitcam.rul
Plugins/Plugin.Cleaner/Rules/1639.speedapps.rul
Plugins/Plugin.Cleaner/Rules/1652.internetsc.rul
Plugins/Plugin.Cleaner/Rules/1658.wifi.rul
Plugins/Plugin.Cleaner/Rules/1659.iwebar.rul
Plugins/Plugin.Cleaner/Rules/1664.clip.rul
Plugins/Plugin.Cleaner/Rules/1672.absolutistgames.rul
Plugins/Plugin.Cleaner/Rules/1673.mediabar.rul
Plugins/Plugin.Cleaner/Rules/1674.softsearch.rul
Plugins/Plugin.Cleaner/Rules/1675.spam.rul
Plugins/Plugin.Cleaner/Rules/1676.egames.rul
Plugins/Plugin.Cleaner/Rules/1677.sunrisebrowse.rul
Plugins/Plugin.Cleaner/Rules/1678.snipsmart.rul
Plugins/Plugin.Cleaner/Rules/1679.shareaza.rul
Plugins/Plugin.Cleaner/Rules/1680.searchmodule.rul
Plugins/Plugin.Cleaner/Rules/1681.valueapps.rul
Plugins/Plugin.Cleaner/Rules/1682.opti.rul
Plugins/Plugin.Cleaner/Rules/1683.vmn.rul
Plugins/Plugin.Cleaner/Rules/1684.vlcplus.rul
Plugins/Plugin.Cleaner/Rules/1685.nettock.rul
Plugins/Plugin.Cleaner/Rules/1686.koyotesoft.rul
Plugins/Plugin.Cleaner/Rules/1688.rockresult.rul
Plugins/Plugin.Cleaner/Rules/1689.youtubedownloader.rul
Plugins/Plugin.Cleaner/Rules/1691.infotrigger.rul
Plugins/Plugin.Cleaner/Rules/1693.allgenius.rul
Plugins/Plugin.Cleaner/Rules/1694.dealvault.rul
Plugins/Plugin.Cleaner/Rules/1695.searchmaven.rul
Plugins/Plugin.Cleaner/Rules/1698.gohd.rul
Plugins/Plugin.Cleaner/Rules/1699.savingsexplorer.rul
Plugins/Plugin.Cleaner/Rules/1700.gamingwonderland.rul
Plugins/Plugin.Cleaner/Rules/1702.search.rul
Plugins/Plugin.Cleaner/Rules/1703.facemoods.rul
Plugins/Plugin.Cleaner/Rules/1704.gamesbara.rul
Plugins/Plugin.Cleaner/Rules/1706.kmplayer.rul
Plugins/Plugin.Cleaner/Rules/1707.foxit.rul
Plugins/Plugin.Cleaner/Rules/1708.object.rul
Plugins/Plugin.Cleaner/Rules/1710.frostwire.rul
Plugins/Plugin.Cleaner/Rules/1711.virtualdj.rul
Plugins/Plugin.Cleaner/Rules/1713.apn.rul
Plugins/Plugin.Cleaner/Rules/1715.trusted.rul
Plugins/Plugin.Cleaner/Rules/1716.bkkzaka.rul
Plugins/Plugin.Cleaner/Rules/1717.magix.rul
Plugins/Plugin.Cleaner/Rules/1718.2yourface.rul
Plugins/Plugin.Cleaner/Rules/1719.dizzyding.rul
Plugins/Plugin.Cleaner/Rules/1720.bflix.rul
Plugins/Plugin.Cleaner/Rules/1721.attnet.rul
Plugins/Plugin.Cleaner/Rules/1722.etype.rul
Plugins/Plugin.Cleaner/Rules/1723.fastsearch.rul
Plugins/Plugin.Cleaner/Rules/1724.krabweb.rul
Plugins/Plugin.Cleaner/Rules/1725.ib.rul
Plugins/Plugin.Cleaner/Rules/1726.termtutor.rul
Plugins/Plugin.Cleaner/Rules/1727.mywebface.rul
Plugins/Plugin.Cleaner/Rules/1728.orbitdownloader.rul
Plugins/Plugin.Cleaner/Rules/1730.cantataweb.rul
Plugins/Plugin.Cleaner/Rules/1732.unfriendapp.rul
Plugins/Plugin.Cleaner/Rules/1736.klippal.rul
Plugins/Plugin.Cleaner/Rules/1737.walla.rul
Plugins/Plugin.Cleaner/Rules/1739.pagerage.rul
Plugins/Plugin.Cleaner/Rules/1740.alnaddy.rul
Plugins/Plugin.Cleaner/Rules/1741.mapsgalaxy.rul
Plugins/Plugin.Cleaner/Rules/1742.mipony.rul
Plugins/Plugin.Cleaner/Rules/1743.zoo.rul
Plugins/Plugin.Cleaner/Rules/1745.radiorage.rul
Plugins/Plugin.Cleaner/Rules/1747.shopathome.rul
Plugins/Plugin.Cleaner/Rules/1748.glarysoft.rul
Plugins/Plugin.Cleaner/Rules/1749.marineaquariumlite.rul
Plugins/Plugin.Cleaner/Rules/1752.getitfree.rul
Plugins/Plugin.Cleaner/Rules/1753.expatshield.rul
Plugins/Plugin.Cleaner/Rules/1754.groovorio.rul
Plugins/Plugin.Cleaner/Rules/1755.reminder.rul
Plugins/Plugin.Cleaner/Rules/1756.fliptoast.rul
Plugins/Plugin.Cleaner/Rules/1757.allmyweb.rul
Plugins/Plugin.Cleaner/Rules/1758.goat.rul
Plugins/Plugin.Cleaner/Rules/1760.cox.rul
Plugins/Plugin.Cleaner/Rules/1761.evernoteweb.rul
Plugins/Plugin.Cleaner/Rules/1762.tracker.rul
Plugins/Plugin.Cleaner/Rules/1765.imtranslator.rul
Plugins/Plugin.Cleaner/Rules/1768.photobucket.rul
Plugins/Plugin.Cleaner/Rules/1769.veohwebplayer.rul
Plugins/Plugin.Cleaner/Rules/1774.magentic.rul
Plugins/Plugin.Cleaner/Rules/1784.mumbojumbo.rul
Plugins/Plugin.Cleaner/Rules/1785.openoffice.rul
Plugins/Plugin.Cleaner/Rules/1786.savin.rul
Plugins/Plugin.Cleaner/Rules/1787.videoconverter.rul
Plugins/Plugin.Cleaner/Rules/1788.aff.rul
Plugins/Plugin.Cleaner/Rules/1789.searchvortex.rul
Plugins/Plugin.Cleaner/Rules/1790.frameddisplay.rul
Plugins/Plugin.Cleaner/Rules/1791.commonshare.rul
Plugins/Plugin.Cleaner/Rules/1793.freelunchdesign.rul
Plugins/Plugin.Cleaner/Rules/1794.innoapp.rul
Plugins/Plugin.Cleaner/Rules/1795.freemaketb.rul
Plugins/Plugin.Cleaner/Rules/1796.scour.rul
Plugins/Plugin.Cleaner/Rules/1797.24x7.rul
Plugins/Plugin.Cleaner/Rules/1798.consumerinput.rul
Plugins/Plugin.Cleaner/Rules/1799.goassave.rul
Plugins/Plugin.Cleaner/Rules/1800.netassistant.rul
Plugins/Plugin.Cleaner/Rules/1801.weboptimizer.rul
Plugins/Plugin.Cleaner/Rules/1802.classicstart.rul
Plugins/Plugin.Cleaner/Rules/1803.alureon.rul
Plugins/Plugin.Cleaner/Rules/1804.newplayer.rul
Plugins/Plugin.Cleaner/Rules/1805.dashbar.rul
Plugins/Plugin.Cleaner/Rules/1806.hm.rul
Plugins/Plugin.Cleaner/Rules/1807.istbar.rul
Plugins/Plugin.Cleaner/Rules/1808.brasssearch.rul
Plugins/Plugin.Cleaner/Rules/1809.veevo.rul
Plugins/Plugin.Cleaner/Rules/1811.resultsbay.rul
Plugins/Plugin.Cleaner/Rules/1812.setaga.rul
Plugins/Plugin.Cleaner/Rules/1813.neurowise.rul
Plugins/Plugin.Cleaner/Rules/1814.advanceelite.rul
Plugins/Plugin.Cleaner/Rules/1815.localstrike.rul
Plugins/Plugin.Cleaner/Rules/1816.ttessab.rul
Plugins/Plugin.Cleaner/Rules/1817.adaware.rul
Plugins/Plugin.Cleaner/Rules/1818.heroicplay.rul
Plugins/Plugin.Cleaner/Rules/1819.heyoya.rul
Plugins/Plugin.Cleaner/Rules/1820.daily.rul
Plugins/Plugin.Cleaner/Rules/1821.kingthink.rul
Plugins/Plugin.Cleaner/Rules/1822.ezsearching.rul
Plugins/Plugin.Cleaner/Rules/1823.searchscout.rul
Plugins/Plugin.Cleaner/Rules/1824.zsearch.rul
Plugins/Plugin.Cleaner/Rules/1825.locator.rul
Plugins/Plugin.Cleaner/Rules/1826.platamoose.rul
Plugins/Plugin.Cleaner/Rules/1827.allsearch.rul
Plugins/Plugin.Cleaner/Rules/1828.searchweb.rul
Plugins/Plugin.Cleaner/Rules/1829.brownbark.rul
Plugins/Plugin.Cleaner/Rules/1830.surfslide.rul
Plugins/Plugin.Cleaner/Rules/1831.lampylighty.rul
Plugins/Plugin.Cleaner/Rules/1832.techgile.rul
Plugins/Plugin.Cleaner/Rules/1833.xenotixkeylogx.rul
Plugins/Plugin.Cleaner/Rules/1834.infininet.rul
Plugins/Plugin.Cleaner/Rules/1835.mossnet.rul
Plugins/Plugin.Cleaner/Rules/1836.socialextras.rul
Plugins/Plugin.Cleaner/Rules/1839.enterdigital.rul
Plugins/Plugin.Cleaner/Rules/1840.radrater.rul
Plugins/Plugin.Cleaner/Rules/1841.smileyswelove.rul
Plugins/Plugin.Cleaner/Rules/1842.plumoweb.rul
Plugins/Plugin.Cleaner/Rules/1843.browsestudio.rul
Plugins/Plugin.Cleaner/Rules/1844.boxrock.rul
Plugins/Plugin.Cleaner/Rules/1845.appenable.rul
Plugins/Plugin.Cleaner/Rules/1846.besttv.rul
Plugins/Plugin.Cleaner/Rules/1848.clickcaption.rul
Plugins/Plugin.Cleaner/Rules/1849.easydiscountpro.rul
Plugins/Plugin.Cleaner/Rules/1850.shopforrewards.rul
Plugins/Plugin.Cleaner/Rules/1853.videodimmer.rul
Plugins/Plugin.Cleaner/Rules/1854.cinemaxme.rul
Plugins/Plugin.Cleaner/Rules/1855.pricesparrow.rul
Plugins/Plugin.Cleaner/Rules/1856.bang5tao.rul
Plugins/Plugin.Cleaner/Rules/1857.ciuvo.rul
Plugins/Plugin.Cleaner/Rules/1858.hotspotshield.rul
Plugins/Plugin.Cleaner/Rules/1859.browsers.rul
Plugins/Plugin.Cleaner/Rules/1860.blekkosearch.rul
Plugins/Plugin.Cleaner/Rules/1861.wolfram.rul
Plugins/Plugin.Cleaner/Rules/1862.doughgo.rul
Plugins/Plugin.Cleaner/Rules/1863.applid.rul
Plugins/Plugin.Cleaner/Rules/1864.geforce.rul
Plugins/Plugin.Cleaner/Rules/1865.pcdoctor.rul
Plugins/Plugin.Cleaner/Rules/1866.ytbal.rul
Plugins/Plugin.Cleaner/Rules/1867.tornplustv.rul
Plugins/Plugin.Cleaner/Rules/1868.clickmovie.rul
Plugins/Plugin.Cleaner/Rules/1869.thehdvid.rul
Plugins/Plugin.Cleaner/Rules/1870.gosave.rul
Plugins/Plugin.Cleaner/Rules/1871.notification.rul
Plugins/Plugin.Cleaner/Rules/1872.wordproser.rul
Plugins/Plugin.Cleaner/Rules/1873.onlysearch.rul
Plugins/Plugin.Cleaner/Rules/1874.cineplus.rul
Plugins/Plugin.Cleaner/Rules/1875.stubborn.rul
Plugins/Plugin.Cleaner/Rules/1876.mysearchs.rul
Plugins/Plugin.Cleaner/Rules/1877.sm23sm.rul
Plugins/Plugin.Cleaner/Rules/1879.foxpro.rul
Plugins/Plugin.Cleaner/Rules/1880.easydeals.rul
Plugins/Plugin.Cleaner/Rules/1881.sourceapp.rul
Plugins/Plugin.Cleaner/Rules/1882.holdpage.rul
Plugins/Plugin.Cleaner/Rules/1883.icinema.rul
Plugins/Plugin.Cleaner/Rules/1884.thegophoto.rul
Plugins/Plugin.Cleaner/Rules/1886.browserapp.rul
Plugins/Plugin.Cleaner/Rules/1887.hdquality.rul
Plugins/Plugin.Cleaner/Rules/1889.cinplus.rul
Plugins/Plugin.Cleaner/Rules/1890.mediaplayersvideos.rul
Plugins/Plugin.Cleaner/Rules/1891.radiocanyon.rul
Plugins/Plugin.Cleaner/Rules/1892.pandoratv.rul
Plugins/Plugin.Cleaner/Rules/1909.vonteera.rul
Plugins/Plugin.Cleaner/Rules/1910.youshahd.rul
Plugins/Plugin.Cleaner/Rules/85Play_Games.rul
Plugins/Plugin.Cleaner/Rules/Aflamster.rul
Plugins/Plugin.Cleaner/Rules/Ask.rul
Plugins/Plugin.Cleaner/Rules/BrowserDefender.rul.bak
Plugins/Plugin.Cleaner/Rules/BrowserProtect.rul
Plugins/Plugin.Cleaner/Rules/CouponCompanion.rul
Plugins/Plugin.Cleaner/Rules/CouponDropDown.rul
Plugins/Plugin.Cleaner/Rules/Deal Spy.rul
Plugins/Plugin.Cleaner/Rules/Dealio.rul.bak
Plugins/Plugin.Cleaner/Rules/Deals.rul
Plugins/Plugin.Cleaner/Rules/Genieo.rul
Plugins/Plugin.Cleaner/Rules/GiantSavings.rul
Plugins/Plugin.Cleaner/Rules/IWantThis.rul
Plugins/Plugin.Cleaner/Rules/Inbox.rul
Plugins/Plugin.Cleaner/Rules/InternetHelper.rul
Plugins/Plugin.Cleaner/Rules/MixiDJ.rul
Plugins/Plugin.Cleaner/Rules/MyWebSearch.rul
Plugins/Plugin.Cleaner/Rules/RebateInformer.rul
Plugins/Plugin.Cleaner/Rules/SearchAmong.rul
Plugins/Plugin.Cleaner/Rules/ShoppingSidekick.rul
Plugins/Plugin.Cleaner/Rules/StartNow.rul
Plugins/Plugin.Cleaner/Rules/Tuvaro.rul
Plugins/Plugin.Cleaner/Rules/VDownloader_Ask.rul
Plugins/Plugin.Cleaner/Rules/VidSaver.rul
Plugins/Plugin.Cleaner/Rules/WhiteSmokeToolBar.rul
Plugins/Plugin.Cleaner/Rules/Yontoo.rul
Plugins/Plugin.Cleaner/Rules/appbario7.rul
Plugins/Plugin.Cleaner/Rules/oovoo.rul
Plugins/Plugin.Cleaner/Rules/searchya.rul
Plugins/Plugin.Cleaner/Rules/uTorrentBar.rul
Plugins/Plugin.Cleaner/Rules/uTorrentControl.rul
Plugins/Plugin.Cleaner/Rules/webcake.rul
Plugins/Plugin.Cleaner/SoftIcons/10004.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10014.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10017.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10021.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10023.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10027.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10032.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10041.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10045.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10063.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10065.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10067.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10092.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10095.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10123.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10129.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10134.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10149.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10174.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10192.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10203.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10230.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10495.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10531.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10535.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10549.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10620.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10684.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10886.png
.png
Plugins/Plugin.Cleaner/SoftIcons/10945.png
.png
Plugins/Plugin.Cleaner/SoftIcons/11248.png
.png
Plugins/Plugin.Cleaner/SoftIcons/11321.png
.png
Plugins/Plugin.Cleaner/SoftIcons/11351.png
.png
Plugins/Plugin.Cleaner/SoftIcons/11355.png
.png
Plugins/Plugin.Cleaner/SoftIcons/11452.png
.png
Plugins/Plugin.Cleaner/plugins.db
.xml
Plugins/Plugin.Cleaner/res/res.bskin
.7z
Plugins/Plugin.Cleaner/t1.db
.xml
Plugins/Plugin.Cleaner/t2.db
.xml
Plugins/Plugin.Cleaner/t3.db
Plugins/Plugin.Cleaner/t4.db
Plugins/Plugin.Cleaner/t5.db
Plugins/Plugin.Facebook/Plugin_Facebook.dll
.dll windows:5 windows x86 arch:x86

3cc7266e3aeea2c50249cc8db721b4f6

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:5f:13:d4:0f:d8:d5:30:18:fb:6a:ef:df:b9:38:31:97:80:46:36
Signer

Actual PE Digest

59:5f:13:d4:0f:d8:d5:30:18:fb:6a:ef:df:b9:38:31:97:80:46:36

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Plugin_Facebook.pdb

Imports

directui

DirectUI_LoadSkinResourceFromZIP
DirectUI_Progress_SetPos
DirectUI_GetControlText
DirectUI_EnableAnimate
DirectUI_Static_SetLogoImage
DirectUI_GetControlPos
DirectUI_ShowControl
DirectUI_Progress_SetRange
DirectUI_SetControlPos
DirectUI_GetLanguageStyle
DirectUI_EnableControl
DirectUI_SetControlText
DirectUI_GetVersion
DirectUI_SubclassWindow

kernel32

lstrcmpiW
GetTimeZoneInformation
GetPrivateProfileSectionW
GlobalFree
GlobalHandle
GetFileSize
ReadFile
CreateFileW
GetTempPathW
GetProcAddress
GetModuleHandleW
LoadLibraryExW
FreeLibrary
CloseHandle
WinExec
CreateFileMappingW
VerifyVersionInfoW
GetPrivateProfileIntW
WideCharToMultiByte
GetPrivateProfileStringW
WaitForSingleObject
VerSetConditionMask
UnmapViewOfFile
MapViewOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetCurrentThreadId
GetStringTypeA
InterlockedExchange
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
RtlUnwind
TlsFree
TlsSetValue
DeleteCriticalSection
LockResource
EnterCriticalSection
SetLastError
GetLastError
RaiseException
FlushInstructionCache
GlobalUnlock
lstrlenW
MultiByteToWideChar
lstrcmpW
GetModuleFileNameW
MulDiv
LeaveCriticalSection
SizeofResource
GlobalAlloc
InitializeCriticalSection
GlobalLock
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
LoadResource
FindResourceW
FindResourceExW
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
CreateThread
ResumeThread
ExitThread
HeapSize
HeapReAlloc
HeapDestroy
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
FlushFileBuffers
SetFilePointer
CreateEventW
SetEvent
GetProcessHeap
HeapFree
HeapAlloc
VirtualAlloc
VirtualFree
CreateFileA
GetModuleHandleA
WriteFile
GetCurrentProcessId
Sleep
InitializeCriticalSectionAndSpinCount
lstrlenA
GetStringTypeW

user32

MoveWindow
RedrawWindow
UnregisterClassA
GetMessageW
DispatchMessageW
SetWindowLongW
GetDlgItem
ReleaseDC
GetClassNameW
GetWindowTextW
GetWindowLongW
InvalidateRect
RegisterClassExW
SetWindowContextHelpId
GetDC
GetClassInfoExW
BeginPaint
SetFocus
CreateAcceleratorTableW
GetClientRect
LoadCursorW
InvalidateRgn
GetParent
GetFocus
SetCapture
IsChild
FillRect
RegisterWindowMessageW
CharNextW
MapDialogRect
ScreenToClient
DestroyAcceleratorTable
GetWindowTextLengthW
DestroyWindow
ClientToScreen
EndPaint
GetMonitorInfoW
EnableWindow
MapWindowPoints
EndDialog
MonitorFromWindow
GetWindow
DialogBoxParamW
DefWindowProcW
CallWindowProcW
SetWindowTextW
SendMessageW
ReleaseCapture
CreateWindowExW
IsWindow
ShowWindow
SetWindowPos
GetSysColor
GetDesktopWindow
SendDlgItemMessageW
KillTimer
PostMessageW
GetWindowRect
CreateDialogIndirectParamW
GetActiveWindow
SetCursor
SetTimer

gdi32

SelectObject
CreateSolidBrush
GetStockObject
GetObjectW
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
GetDeviceCaps
DeleteDC
BitBlt

advapi32

RegOpenKeyW
RegQueryValueExW
RegCreateKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueW

shell32

ShellExecuteW
SHGetFolderPathW
ord165

ole32

CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
StringFromGUID2
OleLockRunning
OleUninitialize
CoGetClassObject
CoTaskMemAlloc
CoTaskMemRealloc
OleInitialize
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree

oleaut32

SysFreeString
SysAllocString
DispCallFunc
SysStringLen
VariantClear
LoadTypeLi
VariantInit
SysAllocStringLen
OleCreateFontIndirect
VarUI4FromStr
LoadRegTypeLi

log

WriteLog

shlwapi

PathFindExtensionW
PathIsDirectoryW
StrStrIW
PathAppendW
PathRenameExtensionW
PathIsRelativeW
PathFindFileNameW
PathRemoveFileSpecW

gdiplus

GdipSaveImageToFile
GdipGetImageWidth
GdipCloneImage
GdiplusShutdown
GdipFree
GdipCreateBitmapFromFileICM
GdipGetImageHeight
GdipAlloc
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromFile
GdipGetImageEncoders
GdiplusStartup

winhttp

WinHttpCreateUrl

wininet

HttpQueryInfoW
InternetCloseHandle
HttpOpenRequestW
InternetSetOptionW
HttpSendRequestW
InternetConnectW
InternetReadFile
InternetOpenW
InternetSetCookieW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

Exports

Exports

CreatePluginItem
DestroyPluginItem

Sections

.text
Size: 281KB - Virtual size: 281KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/Plugin.Facebook/res/res.bskin
.7z
Plugins/Plugin.HomeEx/Plugin_HomeEx.dll
.dll windows:5 windows x86 arch:x86

fb4ce372cb880d7b707249ee8d8dda99

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:b8:ee:df:fd:61:53:65:fd:50:12:bb:d0:19:2c:b6:68:fa:e2:fe
Signer

Actual PE Digest

7e:b8:ee:df:fd:61:53:65:fd:50:12:bb:d0:19:2c:b6:68:fa:e2:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Plugin_HomeEx.pdb

Imports

baidustore

?SaveActivitys@BdConfig@@QAEXXZ
?IsConnectSubSvc@CBaiduStoreMgr@@QAEHPB_W@Z
?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z
?DoShellExecute@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z
?LoadConfig@BdConfig@@QAEXXZ
?DoExamSysRepairScan@CBaiduStoreMgr@@QAEXXZ
?DoExamOptFixUp@CBaiduStoreMgr@@QAEXXZ
?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z
?SaveSparkClick@BdConfig@@QAEXH@Z
?DoExamCleanFixupStop@CBaiduStoreMgr@@QAEXXZ
?DoExamCleanScanStop@CBaiduStoreMgr@@QAEXXZ
?DoExamCleanFixUp@CBaiduStoreMgr@@QAEXXZ
?DoExamCleanScan@CBaiduStoreMgr@@QAEXXZ
??1Baidu_ListenData@@UAE@XZ
??0Baidu_ListenData@@QAE@PB_W@Z
?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ
?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z
?DoExamOptScan@CBaiduStoreMgr@@QAEXXZ

directui

DirectUI_TreeEx_SetStaticLogo
DirectUI_TreeEx_SetStaticLogoImage
DirectUI_TreeEx_Expand
DirectUI_GetStringItem
DirectUI_DestroyControl
DirectUI_CreateControl
uiUpdateWindow
UISetScrollPos
UIInitAniRunInfo
UIStartAnimateFromTree
DirectUI_TreeEx_SetButtonCheck
DirectUI_TreeEx_GetControlText
DirectUI_ChangeStyle
DirectUI_SetControlText
DirectUI_SetControlTextEx
DirectUI_Static_SetLogoImage
DirectUI_AutoText_SetControlText
DirectUI_AutoText_SetControlTextEx
DirectUI_TreeEx_ShowControl
DirectUI_TreeEx_SetControlText
DirectUI_TreeEx_SetControlTextEx
DirectUI_TreeEx_SetAutoTextItemText
DirectUI_TreeEx_IsExpand
DirectUI_TreeEx_SetItemHeight
DirectUI_TreeEx_InsertItem
DirectUI_TreeEx_DeleteAllItems
DirectUI_SubclassWindow
DirectUI_AutoText_GetControlText
DirectUI_LoadSkinResourceFromZIP
DirectUI_AddFontsResource
DirectUI_IsControlVisible
DirectUI_GetControlRect
DirectUI_GetControlPos
DirectUI_GetVersion
DirectUI_SetControlPos
DirectUI_EnableControl
DirectUI_GetLanguageStyle
DirectUI_EnableAnimate
DirectUI_Button_GetCheck
DirectUI_Button_SetCheck
DirectUI_Progress_SetPos
DirectUI_TreeEx_ChangeStyle
DirectUI_ShowControl
DirectUI_TreeEx_GetItemStyle

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ
?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

FreeLibrary
WideCharToMultiByte
lstrlenW
MulDiv
VerSetConditionMask
VerifyVersionInfoW
GetLastError
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetPrivateProfileStringW
MapViewOfFile
GetFileSize
WinExec
GetLogicalDrives
GetSystemDirectoryW
MultiByteToWideChar
ReadFile
GetTempPathW
GetTempFileNameW
CopyFileW
DeleteFileW
GetExitCodeProcess
GetFileAttributesW
AddAtomW
WritePrivateProfileStringW
GetTimeFormatW
GetDateFormatW
OutputDebugStringW
GetLongPathNameW
GetCurrentProcessId
OpenFileMappingW
InitializeCriticalSection
CreateEventW
GetLocaleInfoA
GetLocaleInfoW
LoadLibraryA
RtlUnwind
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
SetFilePointer
GetConsoleMode
GetConsoleCP
InterlockedExchange
GetStartupInfoA
GetFileType
SetHandleCount
GetStringTypeW
GetStringTypeA
LCMapStringA
LCMapStringW
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
ExitProcess
GetModuleFileNameA
GetStdHandle
WriteFile
HeapSize
HeapReAlloc
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetCommandLineA
GetCPInfo
InterlockedDecrement
CreateThread
SetEvent
OpenEventW
SystemTimeToFileTime
CreateFileMappingW
DeleteCriticalSection
GetPrivateProfileIntW
WaitForSingleObject
IsBadReadPtr
UnmapViewOfFile
HeapFree
GetProcessHeap
HeapAlloc
FlushInstructionCache
RaiseException
SetLastError
GetCurrentProcess
GetTickCount
GetCurrentThreadId
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
Sleep
GetModuleHandleW
GetProcAddress
LoadLibraryW
CreateProcessW
CloseHandle
GetVersionExW
InterlockedCompareExchange
IsProcessorFeaturePresent
GetProcessTimes
InterlockedIncrement
CreateFileW
ResumeThread
ExitThread
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InitializeCriticalSectionAndSpinCount
GetUserDefaultLCID
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
CreateFileA
GetModuleHandleA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

user32

DialogBoxParamW
GetActiveWindow
TrackMouseEvent
KillTimer
SetTimer
DialogBoxIndirectParamW
GetDialogBaseUnits
DrawTextW
GetMenuState
DeleteMenu
EnableMenuItem
GetSystemMenu
SetPropW
GetPropW
GetSystemMetrics
FindWindowW
DestroyIcon
PrivateExtractIconsW
OffsetRect
InflateRect
SetRect
IsWindow
CallWindowProcW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
DefWindowProcW
EndDialog
PostMessageW
MonitorFromWindow
GetMonitorInfoW
GetParent
GetClientRect
MapWindowPoints
SetWindowTextW
SendMessageW
GetWindowLongW
SetWindowLongW
GetWindowRect
SetWindowPos
ShowWindow
GetWindow
UnregisterClassA

gdi32

DeleteObject
DeleteDC
SelectObject
CreateCompatibleDC
CreateFontW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryValueW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent
OpenProcessToken
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetTokenInformation

shell32

ShellExecuteW
SHGetFolderPathW
SHGetFileInfoW
ExtractIconExW
ord165
SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteExW

ole32

CoInitialize
CoUninitialize
CoCreateInstance

shlwapi

PathAppendW
PathIsRelativeW
PathRemoveFileSpecW
PathAddBackslashW
PathIsDirectoryW
PathFindFileNameW
SHGetValueW
PathFileExistsW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winhttp

WinHttpCreateUrl

sensapi

IsNetworkAlive

Exports

Exports

CreatePluginItem
DestroyPluginItem

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 294KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/Plugin.HomeEx/res/res.bskin
.7z
Plugins/Plugin.Optimizer/Plugin_OptimizerEx.dll
.dll windows:5 windows x86 arch:x86

2ade46a4a62a5d58223142f088f56e6d

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c0:cc:e9:cf:0e:2c:e2:12:4d:bc:61:bc:cb:81:0a:d6:b0:6f:df:96
Signer

Actual PE Digest

c0:cc:e9:cf:0e:2c:e2:12:4d:bc:61:bc:cb:81:0a:d6:b0:6f:df:96

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Plugin_OptimizerEx.pdb

Imports

baidustore

?SaveConfig@BdConfig@@QAEXXZ
?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z
?DoAutoRun@CBaiduStoreMgr@@QAEXH@Z
?ReportIncCount@CBaiduStoreMgr@@QAEHKK@Z
??0Baidu_ListenData@@QAE@PB_W@Z
??1Baidu_ListenData@@UAE@XZ
?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ
?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z
?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z

directui

DirectUI_ListCtrl_SetStaticLogo
DirectUI_ListCtrl_SetItemSrcData
DirectUI_ListCtrl_GetItemCount
DirectUI_HeaderCtrl_SetControlTextEx
DirectUI_ListCtrl_GetItemSrcData
DirectUI_ListCtrl_SetDrawItem
DirectUI_ListCtrl_SetButtonCheck
DirectUI_ListCtrl_GetButtonCheck
DirectUI_ListCtrl_InsertColumn
DirectUI_ListCtrl_DeleteItem
DirectUI_ListCtrl_GetHeadCtrlId
DirectUI_EnableControl
DirectUI_GetSafeHwnd
DirectUI_ListCtrl_SetControlText
DirectUI_ListCtrl_SetTooltipString
UIInitAniRunInfo
DirectUI_Progress_SetPos
uiInvalidateRect
DirectUI_EnableAnimate
DirectUI_GetControlRect
DirectUI_TreeEx_GetAutoTextItemText
DirectUI_TreeEx_GetButtonCheck
DirectUI_TreeEx_Expand
DirectUI_TreeEx_GetControlRect
DirectUI_TreeEx_IsExpand
DirectUI_TreeEx_CreateControl
UIStartAnimateFromTree
DirectUI_TreeEx_SetButtonCheck
DirectUI_TreeEx_SetControlPos
DirectUI_CreateControl
DirectUI_IsControlVisible
DirectUI_AutoText_SetControlText
DirectUI_SetControlPos
DirectUI_DestroyControl
DirectUI_TreeEx_SetAutoTextItemTextEx
DirectUI_LoadSkinResourceFromZIP
DirectUI_TreeEx_IsControlVisible
DirectUI_TreeEx_SetTooltipString
DirectUI_TreeEx_EnableChildControl
DirectUI_Progress_EnableMoving
DirectUI_TreeEx_SetStaticLogo
DirectUI_SubclassWindow
DirectUI_TreeEx_SetAutoTextItemText
DirectUI_SetControlTextEx
DirectUI_GetControlText
DirectUI_AutoText_GetControlText
DirectUI_TreeEx_ChangeStyle
DirectUI_TreeEx_ShowControl
DirectUI_ShowControl
DirectUI_TreeEx_SetControlTextEx
DirectUI_TreeEx_InsertItem
DirectUI_TreeEx_DeleteItem
DirectUI_TreeEx_SetControlText
DirectUI_TreeEx_GetControlText
DirectUI_Static_SetLogoIcon
DirectUI_TreeEx_SetItemHeight
DirectUI_SetControlText
DirectUI_TreeEx_DeleteAllItems
DirectUI_GetStringItem
DirectUI_ChangeStyle

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ
?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

SetLastError
EnterCriticalSection
GetCurrentThreadId
CloseHandle
DeleteFileW
CreateThread
MapViewOfFile
FreeResource
CreateProcessW
GetPrivateProfileStringW
GetVersionExW
MulDiv
WritePrivateProfileStringW
GetPrivateProfileIntW
DeviceIoControl
OpenFileMappingW
FindAtomW
GetProcAddress
FlushFileBuffers
LoadLibraryExW
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
lstrlenW
lstrcmpiW
DeleteCriticalSection
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
RaiseException
SetHandleCount
ExitProcess
HeapCreate
GetCurrentProcessId
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
GetStdHandle
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetCPInfo
LCMapStringW
WideCharToMultiByte
LCMapStringA
RtlUnwind
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedExchange
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
GetLocaleInfoA
FlushInstructionCache
CreateFileW
GetModuleFileNameW
LeaveCriticalSection
Sleep
WriteFile
GetFileType
GetCurrentProcess
GetLastError
LoadLibraryW
GetSystemDirectoryW
IsBadReadPtr
GetProcessHeap
GetModuleHandleW
HeapFree
HeapAlloc
FreeLibrary
LockResource
SizeofResource
LoadResource
FindResourceW
FindResourceExW
MultiByteToWideChar
UnmapViewOfFile
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
SetFilePointer
ReadFile
CreateFileA
SetStdHandle
GetLocaleInfoW
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

user32

CharNextW
IsWindow
ClientToScreen
GetSystemMenu
SetTimer
DrawTextW
KillTimer
DialogBoxIndirectParamW
DeleteMenu
DialogBoxParamW
SetPropW
OffsetRect
SetRect
EnableMenuItem
GetMenuState
SendMessageTimeoutW
GetActiveWindow
GetSystemMetrics
GetPropW
GetDialogBaseUnits
UpdateLayeredWindow
ScreenToClient
LoadCursorW
GetClassInfoExW
GetDC
RegisterClassExW
ReleaseDC
ShowWindow
CreateWindowExW
IsWindowVisible
CallWindowProcW
DefWindowProcW
PrivateExtractIconsW
PostMessageW
GetParent
GetClientRect
MonitorFromWindow
MapWindowPoints
DestroyIcon
GetMonitorInfoW
GetWindow
GetWindowRect
GetDlgItem
SetWindowLongW
EndDialog
SetWindowPos
SendMessageW
SetWindowTextW
GetWindowLongW
UnregisterClassA

gdi32

CreateFontW
DeleteDC
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

advapi32

RegOpenKeyW
RegCloseKey
RegSetValueExW
OpenProcessToken
GetTokenInformation
GetTraceEnableFlags
GetTraceLoggerHandle
TraceEvent
UnregisterTraceGuids
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegisterTraceGuidsW
GetTraceEnableLevel
RegOpenKeyExW
RegQueryValueExW

shell32

ord165
SHGetFolderPathW
ExtractIconExW
SHGetFileInfoW

ole32

CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathAppendW
PathRemoveFileSpecW
StrStrIW
PathIsRelativeW
PathIsDirectoryW
PathFileExistsW

gdiplus

GdipReleaseDC
GdipSaveImageToFile
GdipGetDC
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipGetImageWidth
GdipCloneImage
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDrawImageRectI
GdipDeleteGraphics
GdipGetImageHeight
GdipFree

Exports

Exports

CreatePluginItem
DestroyPluginItem

Sections

.text
Size: 918KB - Virtual size: 918KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/Plugin.Optimizer/SysOpt/optlist.dat
Plugins/Plugin.Optimizer/SysOpt/optrec.5.1.def.db
Plugins/Plugin.Optimizer/SysOpt/optrec.6.0.def.db
Plugins/Plugin.Optimizer/SysOpt/optrec.6.1.def.db
Plugins/Plugin.Optimizer/SysOpt/optrec.6.2.def.db
Plugins/Plugin.Optimizer/SysOptEngine.dll
.dll windows:5 windows x86 arch:x86

5c6e20d3be0fc7950105988df442c9ad

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:55:16:b0:7e:46:f4:58:b0:5c:6e:b7:9b:2b:d0:af:25:58:89:c0
Signer

Actual PE Digest

02:55:16:b0:7e:46:f4:58:b0:5c:6e:b7:9b:2b:d0:af:25:58:89:c0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\SysOptEngine.pdb

Imports

sqlite

sqlite3_column_name16
sqlite3_step
sqlite3_finalize
sqlite3_prepare16
sqlite3_open16
sqlite3_busy_timeout
sqlite3_column_text16
sqlite3_errmsg16
sqlite3_column_count
sqlite3_bind_text16
sqlite3_close
sqlite3_changes
sqlite3_reset
sqlite3_free

datareport

RD_W
RD_WS

bdapiutil

BDRegOpenKeyExW
BDRegSetValueExW
BDRegCloseKey
BDRegDeleteValueW

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ
?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z
?WriteOptLog@CAPCDispatcher@@QAEHW4OPTType@OptItem@@W4OPTAction@3@PB_W22@Z

kernel32

LeaveCriticalSection
CreateFileW
MultiByteToWideChar
GetProcAddress
EnterCriticalSection
LockResource
DeleteCriticalSection
CloseHandle
DeleteFileW
ExpandEnvironmentStringsW
FreeLibrary
GetProcessTimes
LoadLibraryW
FileTimeToSystemTime
DeviceIoControl
LocalFree
VerSetConditionMask
GetPrivateProfileStringW
OpenProcess
GetModuleFileNameW
VerifyVersionInfoW
GetLastError
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
MoveFileExW
GetEnvironmentVariableW
SetErrorMode
WaitForSingleObject
GetSystemDirectoryW
GetFileAttributesW
GetTempPathW
GetCurrentDirectoryW
GetLongPathNameW
FindFirstFileW
GetVersionExW
FindClose
FindNextFileW
SetFileAttributesW
SetLastError
LocalAlloc
GetCurrentProcess
WTSGetActiveConsoleSessionId
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
TerminateProcess
GlobalMemoryStatusEx
SetEvent
ResetEvent
CreateEventW
GetDateFormatA
GetTimeFormatA
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ReadFile
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
HeapFree
HeapAlloc
LoadResource
FindResourceW
FindResourceExW
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
SizeofResource
Sleep
WideCharToMultiByte
InitializeCriticalSection
WriteFile
IsBadReadPtr
GetProcessHeap
GetTickCount
CreateDirectoryW
GetModuleHandleW
RaiseException
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetModuleHandleA
LoadLibraryA
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
lstrlenA
GetSystemWindowsDirectoryW
ExitProcess
VirtualAlloc
VirtualFree
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
HeapDestroy
HeapReAlloc
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
LCMapStringA
RtlUnwind
GetCommandLineA
GetCurrentThreadId
CreateThread
ResumeThread
ExitThread
InterlockedIncrement

user32

CreateWindowExW
SetWindowLongW
GetWindowLongW
CallWindowProcW
GetMessageW
DispatchMessageW
IsWindow
PostMessageW

advapi32

RegDeleteValueW
RegOpenUserClassesRoot
AdjustTokenPrivileges
LookupPrivilegeValueW
QueryServiceConfigW
EnumServicesStatusW
ChangeServiceConfigW
QueryServiceConfig2W
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
RegEnumValueW
OpenProcessToken
RegCreateKeyExW
RegEnumKeyW
RevertToSelf
RegOpenCurrentUser
ImpersonateLoggedOnUser
RegQueryValueExW
RegSetValueExW
RegisterTraceGuidsW
RegCloseKey
GetTraceEnableLevel
RegOpenKeyExW
UnregisterTraceGuids
TraceEvent
SetSecurityDescriptorDacl
GetTraceLoggerHandle
InitializeSecurityDescriptor
CreateProcessAsUserW
GetTraceEnableFlags

shell32

SHGetFolderPathW
ord43
CommandLineToArgvW
SHGetSpecialFolderPathW
ord165
ShellExecuteExW

ole32

CoInitializeEx
CoSetProxyBlanket
CoTaskMemFree
CoInitializeSecurity
CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocStringLen
VariantInit
VariantClear
SysStringLen
SysAllocString

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

shlwapi

PathIsDirectoryW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
SHDeleteValueW
SHGetValueW
PathAppendW
PathAddBackslashW
SHSetValueW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Exports

Exports

CreateObject
_DllMain@12

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 279KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/Plugin.Optimizer/res/res.bskin
.7z
Plugins/PluginConfig.xml
PopupConfig.ini
PopupTip.exe
.exe windows:5 windows x86 arch:x86

3f1877284f342df14beb6318f0ac10ba

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8f:1d:83:5f:25:a9:e1:92:59:c5:6c:52:71:22:80:8d:fa:3f:a7:70
Signer

Actual PE Digest

8f:1d:83:5f:25:a9:e1:92:59:c5:6c:52:71:22:80:8d:fa:3f:a7:70

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PopupTip.pdb

Imports

webclient

_CreateWebClient@16
_DeleteWebClient@4
_GetMainSafeHwnd@4

kernel32

GetProcAddress
EnterCriticalSection
CreateFileMappingW
LockResource
DeleteCriticalSection
GetCurrentThreadId
ReleaseMutex
CloseHandle
CreateFileA
CreateFileW
GetFileSize
ReadFile
SetLastError
GetCurrentProcess
GetCurrentProcessId
GetVersionExW
ProcessIdToSessionId
GetTempPathW
GetTempFileNameW
CopyFileW
DeleteFileW
DebugBreak
VirtualProtect
GetVersion
IsBadCodePtr
IsBadReadPtr
GetModuleHandleExW
ExitThread
CreateDirectoryW
GetCommandLineW
GetModuleHandleA
FlushInstructionCache
VirtualFree
Sleep
CreateFileMappingA
GetLocalTime
GetWindowsDirectoryW
LocalFree
LocalAlloc
InterlockedExchange
InterlockedCompareExchange
WritePrivateProfileStringW
SystemTimeToFileTime
WriteFile
GetFileSizeEx
CreateProcessW
WTSGetActiveConsoleSessionId
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ReadProcessMemory
VirtualQueryEx
InitializeCriticalSectionAndSpinCount
lstrlenA
HeapCreate
HeapAlloc
CreateEventW
AddVectoredExceptionHandler
GetLastError
RemoveVectoredExceptionHandler
TerminateProcess
VirtualQuery
GetModuleFileNameA
LoadLibraryW
lstrcatA
GetThreadContext
OpenMutexW
DuplicateHandle
VirtualAlloc
OpenFileMappingW
OpenEventW
lstrcpyA
VirtualAllocEx
VirtualFreeEx
GetCurrentThread
VirtualProtectEx
WriteProcessMemory
GetProcessHeap
HeapFree
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
lstrcpyW
SetEndOfFile
SetFilePointer
GetStdHandle
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
UnhandledExceptionFilter
HeapSize
HeapReAlloc
HeapDestroy
ExitProcess
LCMapStringA
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetPrivateProfileIntW
RaiseException
lstrlenW
MultiByteToWideChar
GetModuleFileNameW
LeaveCriticalSection
SizeofResource
WideCharToMultiByte
InitializeCriticalSection
GetPrivateProfileStringW
GetModuleHandleW
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
FindResourceExW
UnmapViewOfFile
MapViewOfFile
CreateMutexW
lstrcmpiW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetTickCount
GetSystemTimeAsFileTime
GetStringTypeA
GetConsoleCP
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
SetUnhandledExceptionFilter

user32

OpenInputDesktop
CloseDesktop
GetThreadDesktop
DestroyWindow
GetMessageW
SetForegroundWindow
TranslateMessage
PeekMessageW
SetWindowTextW
DefWindowProcW
DispatchMessageW
CharNextW
GetSystemMetrics
GetUserObjectInformationA

advapi32

GetTokenInformation
GetLengthSid
GetKernelObjectSecurity
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RevertToSelf
CreateProcessAsUserW
DuplicateTokenEx
SetTokenInformation
OpenProcessToken
RegCreateKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
GetUserNameW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW

shell32

SHGetFolderPathW
CommandLineToArgvW
ord165

ole32

CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoInitialize
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VarUI4FromStr

log

WriteLog

shlwapi

PathAddBackslashW
PathFileExistsW
PathAppendW
PathFindFileNameW
PathIsDirectoryW
PathRemoveFileSpecW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

psapi

GetModuleFileNameExW
GetModuleInformation

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

Sections

.text
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ProgramFileList.xml
ReportCommPCF.dll
.dll windows:5 windows x86 arch:x86

89a62d8c9ff8e33cb69820a72c659e88

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:10:87:e8:13:e2:4c:a2:34:6d:19:02:f6:3a:c9:40:f4:98:87:63
Signer

Actual PE Digest

16:10:87:e8:13:e2:4c:a2:34:6d:19:02:f6:3a:c9:40:f4:98:87:63

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\jenkins\workspace\ReportComm_workspace\BavOutput\Pdb\Release\ReportCommPCF.pdb

Imports

iphlpapi

GetAdaptersAddresses

kernel32

ReadFile
GetModuleHandleW
DeleteFileW
GetCurrentProcessId
GetTickCount
HeapFree
HeapAlloc
GetProcessHeap
SetEndOfFile
CreateFileA
DeviceIoControl
InitializeCriticalSection
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
WritePrivateProfileStringW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetCurrentProcess
GlobalFree
TerminateThread
ReleaseSemaphore
CreateSemaphoreW
SetFilePointer
WriteFile
CreateDirectoryW
ReleaseMutex
CreateMutexW
GetCurrentThreadId
CreateFileW
LocalFree
InterlockedDecrement
GetModuleHandleA
GetProcAddress
CreateEventW
GetLocalTime
GetTimeZoneInformation
Sleep
InterlockedCompareExchange
GetPrivateProfileIntW
GetPrivateProfileStringW
InitializeCriticalSectionAndSpinCount
SetLastError
GetModuleFileNameW
WaitForSingleObject
SetEvent
CloseHandle
InterlockedIncrement
lstrlenA
GetLastError
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
FlushFileBuffers
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
GetStdHandle
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
ExitProcess
HeapSize
LoadLibraryA
IsValidLocale
EnumSystemLocalesA
DeleteCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetSystemTimeAsFileTime
GetCommandLineA
RaiseException
RtlUnwind
HeapReAlloc
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetUserDefaultLCID

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegEnumValueW
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetSecurityDescriptorOwner
SetNamedSecurityInfoW
GetSecurityDescriptorDacl
RegCloseKey

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
SHFileOperationW

ole32

CoCreateGuid

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathUnquoteSpacesW
PathFileExistsW
PathIsDirectoryW
PathAppendW

winhttp

WinHttpReadData
WinHttpQueryDataAvailable
WinHttpCrackUrl
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpSetTimeouts
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryHeaders
WinHttpConnect

Exports

Exports

CreateObject

Sections

.text
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ReportCommRetryPCF.exe
.exe windows:5 windows x86 arch:x86

1325920fb30432ba9c7f872d7cda3d98

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:63:0e:81:ca:fd:ad:14:de:9c:00:70:bd:23:f5:88:8d:4e:fb:93
Signer

Actual PE Digest

6b:63:0e:81:ca:fd:ad:14:de:9c:00:70:bd:23:f5:88:8d:4e:fb:93

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\jenkins\workspace\ReportComm_workspace\bavOutput\Pdb\Release\ReportCommRetryPCF.pdb

Imports

kernel32

GetCurrentProcess
GetVersionExW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetCommandLineW
GetProfileIntW
OpenProcess
Process32NextW
ProcessIdToSessionId
Process32FirstW
CreateToolhelp32Snapshot
WTSGetActiveConsoleSessionId
VirtualProtect
GetLocalTime
GetCurrentProcessId
HeapCreate
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
GetModuleHandleW
CreateProcessW
GetCurrentThreadId
TerminateProcess
AddVectoredExceptionHandler
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WritePrivateProfileStringW
SystemTimeToFileTime
WriteFile
ReadProcessMemory
VirtualQueryEx
UnmapViewOfFile
InitializeCriticalSectionAndSpinCount
MapViewOfFile
CreateFileMappingW
GetFileSizeEx
SetLastError
DeleteFileW
CreateEventW
GetProcAddress
CreateFileW
ReadFile
CopyFileW
LoadLibraryW
FreeLibrary
SetEndOfFile
SetFilePointer
GetFileSize
LocalFree
CloseHandle
ReleaseMutex
GetLastError
InterlockedExchange
GetPrivateProfileIntW
lstrlenW
MultiByteToWideChar
GetTimeZoneInformation
GetModuleFileNameW
Sleep
WideCharToMultiByte
GetPrivateProfileStringW
InterlockedCompareExchange
CreateMutexW
WaitForSingleObject
lstrlenA
HeapAlloc
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
LoadLibraryA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
ExitProcess
VirtualAlloc
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
UnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
VirtualFree

advapi32

RegSetValueExW
RegCreateKeyExW
RevertToSelf
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetSecurityDescriptorDacl
RegCloseKey
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetNamedSecurityInfoW
RegQueryValueExW

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW
PathAppendW
PathUnquoteSpacesW
PathRemoveFileSpecW

version

VerQueryValueW

psapi

GetModuleInformation
GetModuleFileNameExW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory

Sections

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SdkConfig.ini
USBDeskBandHelper64.exe
.exe windows:5 windows x64 arch:x64

43bb2b2dffb0b1457a7237aec16a6658

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:20:e5:b7:96:02:78:fa:3c:1e:fd:72:58:23:40:4e:be:d9:a3:7b
Signer

Actual PE Digest

3c:20:e5:b7:96:02:78:fa:3c:1e:fd:72:58:23:40:4e:be:d9:a3:7b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\USBDeskBandHelper64.pdb

Imports

kernel32

GetModuleFileNameW
FreeLibrary
LoadLibraryW
GetCurrentProcess
GetVersionExW
GetProcAddress
Sleep
GetLongPathNameW
GlobalFindAtomW
GlobalAddAtomW
GetModuleHandleW
WaitForSingleObject
CreateProcessW
CloseHandle
RaiseException
FlushFileBuffers
CreateFileA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetStartupInfoW
GetLastError
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlPcToFileHeader

advapi32

RegOpenKeyW
RegCloseKey
RegQueryValueW

shell32

SHLoadInProc

ole32

StringFromGUID2
CoUninitialize
CoInitialize
CoCreateInstance

shlwapi

PathAppendW
PathRemoveFileSpecW

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Uninstall.exe
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c5:b0:30:c6:fc:64:be:7a:57:37:08:57:34:a4:7b:a4:57:27:54:76
Signer

Actual PE Digest

c5:b0:30:c6:fc:64:be:7a:57:37:08:57:34:a4:7b:a4:57:27:54:76

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Updater.exe
.exe windows:5 windows x86 arch:x86

43d17e460e43ed82f6087c3e9d5f1f52

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

96:78:48:9c:7c:29:b1:86:9c:d2:d1:21:93:e9:8d:89:d4:02:ec:42
Signer

Actual PE Digest

96:78:48:9c:7c:29:b1:86:9c:d2:d1:21:93:e9:8d:89:d4:02:ec:42

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Updater.pdb

Imports

log

CreateLog
CloseLog
WriteLog

kernel32

IsDebuggerPresent
ExitThread
GetDriveTypeW
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwind
RaiseException
HeapSize
VirtualProtect
VirtualAlloc
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetCurrentDirectoryA
GetConsoleCP
GetConsoleMode
LCMapStringW
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetDriveTypeA
SetEnvironmentVariableA
DebugBreak
GetVersion
IsBadCodePtr
IsBadReadPtr
GetModuleHandleExW
FlushInstructionCache
CreateFileMappingA
InterlockedCompareExchange
ReadProcessMemory
SetUnhandledExceptionFilter
CreateFileMappingW
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
ReleaseMutex
lstrcatA
GetThreadContext
OpenMutexW
lstrcpyA
VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
WriteProcessMemory
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
lstrcpyW
SetEvent
GetModuleHandleW
LoadLibraryW
GetProcAddress
GetSystemInfo
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleFileNameW
DeleteFileW
MultiByteToWideChar
ReadFile
GetFileSize
CloseHandle
CreateFileW
CopyFileW
GetTempFileNameW
GetTempPathW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetTimeZoneInformation
GetLastError
WaitForSingleObject
GlobalFree
InterlockedIncrement
CreateEventW
SetDllDirectoryW
FreeLibrary
WriteFile
CreateProcessW
ResetEvent
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
OpenProcess
DuplicateHandle
OpenEventW
OpenFileMappingW
UnhandledExceptionFilter
GetStartupInfoW
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
GetVolumeInformationW
FindFirstFileW
FindClose
UnlockFile
LockFile
FlushFileBuffers
GlobalFlags
GetModuleHandleA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedDecrement
FileTimeToSystemTime
GetThreadLocale
lstrlenA
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
FreeResource
SetLastError
GlobalLock
GlobalUnlock
MulDiv
GlobalMemoryStatusEx
OutputDebugStringW
lstrlenW
GetWindowsDirectoryW
MoveFileW
DeviceIoControl
GlobalAlloc
FindResourceExW
GetPrivateProfileSectionNamesW
CreateFileA
CreateMutexW
ExitProcess
SetErrorMode
GetSystemDirectoryW
TerminateProcess
GetFullPathNameW
WTSGetActiveConsoleSessionId
MoveFileExW
GetPrivateProfileIntW
CreateThread
LocalFileTimeToFileTime
GetCurrentDirectoryW
GetFileAttributesW
SetFileTime
SystemTimeToFileTime
GetLocalTime
ProcessIdToSessionId
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThread
GetVersionExW
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCommandLineW
SetFilePointer
LocalFree
FormatMessageW
Sleep
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
GetTickCount
WritePrivateProfileStringW
VerSetConditionMask
VerifyVersionInfoW
GetExitCodeProcess
CreateDirectoryW
EnumResourceNamesW
SetEndOfFile
WideCharToMultiByte
VirtualQueryEx

user32

BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
LoadCursorW
GetSysColorBrush
SetCursor
TranslateMessage
ValidateRect
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
DestroyMenu
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
EndPaint
GetClassLongW
GetClassNameW
RemovePropW
SetFocus
GetWindowTextW
GetLastActivePopup
DispatchMessageW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
TrackPopupMenu
GetKeyState
SetMenu
UpdateWindow
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
PtInRect
GetMenu
SetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowRect
GetSystemMetrics
GetWindow
InvalidateRect
SetCapture
ReleaseCapture
CharNextW
IsRectEmpty
SetRect
CopyAcceleratorTableW
InvalidateRgn
ReleaseDC
GetDC
GetNextDlgGroupItem
MessageBeep
CharUpperW
UnregisterClassW
RegisterClipboardFormatW
GetThreadDesktop
CloseDesktop
GetUserObjectInformationA
OpenInputDesktop
SendMessageTimeoutW
GetClientRect
CopyRect
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetPropW
FindWindowExW
GetMessageW
PostThreadMessageW
GetInputState
GetWindowPlacement
GetWindowInfo
GetForegroundWindow
wsprintfW
SetForegroundWindow
GetCursorPos
AppendMenuW
CreatePopupMenu
IsIconic
IsWindowVisible
KillTimer
SetTimer
SetPropW
LoadImageW
EnableWindow
GetWindowThreadProcessId
PostMessageW
SendMessageW
IsWindow
GetFocus

gdi32

ExtSelectClipRgn
DeleteDC
GetStockObject
ScaleWindowExtEx
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
ExtTextOutW
CreateBitmap
GetObjectW
SetBkColor
SetTextColor
GetClipBox
CreateRectRgnIndirect
GetDeviceCaps

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegQueryValueExA
RegQueryInfoKeyW
GetLengthSid
GetKernelObjectSecurity
SetTokenInformation
RegQueryValueW
RegOpenKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteValueW
GetUserNameW
EqualSid
QueryServiceStatus
RegEnumKeyW
RegOpenUserClassesRoot
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
DuplicateTokenEx
CreateProcessAsUserW
RevertToSelf
GetTokenInformation
FreeSid
AllocateAndInitializeSid
ControlService
StartServiceW
OpenServiceW
CloseServiceHandle
OpenSCManagerW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
ImpersonateLoggedOnUser
RegOpenCurrentUser
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey

shell32

ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW
CommandLineToArgvW
SHGetFolderPathW
SHFileOperationW
SHGetSpecialFolderPathW
ord165

comctl32

ord17

shlwapi

StrToIntW
PathIsDirectoryW
PathCombineW
PathAppendW
PathRemoveFileSpecW
PathAddBackslashW
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
PathRemoveExtensionW
SHGetValueW
SHSetValueW
PathUnquoteSpacesW
PathRemoveArgsW
PathStripToRootW
PathIsUNCW
SHDeleteValueW
PathRenameExtensionW
PathRemoveBackslashW

oledlg

OleUIBusyW

ole32

CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoInitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoCreateGuid

oleaut32

OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
VariantClear
SysAllocString
SysFreeString
SysStringLen
SysAllocStringLen
VariantChangeType
VariantInit

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wtsapi32

WTSEnumerateSessionsW
WTSQueryUserToken
WTSFreeMemory

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

winhttp

WinHttpQueryHeaders
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpSetCredentials
WinHttpWriteData
WinHttpCreateUrl
WinHttpOpen
WinHttpConnect
WinHttpCrackUrl

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

psapi

GetModuleInformation
GetModuleFileNameExW
EnumProcessModules
GetModuleBaseNameW

ws2_32

WSAStartup
WSACleanup
htonl

Sections

.text
Size: 948KB - Virtual size: 948KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WeatherMini.exe
.exe windows:5 windows x86 arch:x86

038676c821a6a1977f60126d34f42066

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

03/02/2015, 00:00

Not After

03/03/2026, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

33:b6:f5:65:ed:70:52:f8:a3:93:6b:7d:48:c8:20:56
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09/02/2015, 00:00

Not After

09/02/2016, 23:59

Subject

CN=ShenZhen Enode Techology co\,.Ltd,OU=Security,O=ShenZhen Enode Techology co\,.Ltd,L=ShenZhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9f:d1:c0:64:af:ec:0f:0b:26:19:f4:b2:c7:62:50:25:97:f2:24:cb
Signer

Actual PE Digest

9f:d1:c0:64:af:ec:0f:0b:26:19:f4:b2:c7:62:50:25:97:f2:24:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

p:\app\gensoft\softmgr\weathertool\Release\WeatherTool_Mini_Silent.pdb

Imports

wininet

InternetOpenUrlW
InternetOpenW
HttpQueryInfoW
InternetCrackUrlW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
InternetQueryOptionW
InternetSetOptionW
InternetCloseHandle
InternetReadFile
InternetConnectW

psapi

GetProcessImageFileNameW

kernel32

FlushFileBuffers
LockFile
UnlockFile
DuplicateHandle
FindClose
GetVolumeInformationW
GetFullPathNameW
SetErrorMode
FileTimeToLocalFileTime
GetFileSizeEx
GetFileTime
GetStartupInfoW
HeapFree
HeapAlloc
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetSystemTimeAsFileTime
HeapReAlloc
ExitThread
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
GlobalFlags
GetModuleHandleA
FileTimeToSystemTime
GetThreadLocale
lstrlenA
InterlockedIncrement
InterlockedDecrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
WritePrivateProfileStringW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
GetConsoleCP
GetLocalTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateDirectoryW
DeviceIoControl
LoadLibraryA
lstrcmpW
GetVersionExA
FreeResource
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
lstrlenW
MulDiv
SetLastError
GetCurrentProcess
FindFirstFileW
FindNextFileW
CreateMutexW
GetTempPathW
SleepEx
ReadFile
ExitProcess
VerSetConditionMask
VerifyVersionInfoW
WideCharToMultiByte
GetCommandLineW
CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
GetCurrentProcessId
LoadLibraryW
MultiByteToWideChar
GetExitCodeProcess
OpenProcess
GetFileAttributesW
FreeLibrary
GetModuleFileNameW
GetVersionExW
CreateEventW
CreateThread
Sleep
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetCurrentThreadId
WaitForSingleObject
TerminateThread
SetFilePointer
WriteFile
SetEndOfFile
FormatMessageW
LocalFree
GetTickCount
GetModuleHandleW
GetProcAddress
DeleteFileW
CreateFileW
GetFileSize
GetLastError
CloseHandle
FindResourceW
LoadResource
LockResource
SizeofResource
UnregisterWaitEx
RegisterWaitForSingleObject
FindResourceExW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
HeapCreate

user32

SetCapture
DestroyMenu
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
LoadCursorW
GetSysColorBrush
SetWindowContextHelpId
MapDialogRect
GetWindowThreadProcessId
SetCursor
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
PostQuitMessage
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
ReleaseDC
GetDC
LoadIconW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetTopWindow
ReleaseCapture
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetMenu
SetForegroundWindow
UpdateWindow
GetClientRect
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CharUpperW
CharNextW
IsRectEmpty
SetRect
CopyAcceleratorTableW
InvalidateRect
InvalidateRgn
GetNextDlgGroupItem
GetSysColor
AdjustWindowRectEx
MessageBeep
UnregisterClassW
RegisterClipboardFormatW
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
GetMenu
SetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
PostMessageW
LoadStringW
wsprintfW
GetDlgItem
LoadImageW
SetPropW
EnableWindow
IsWindowVisible
IsIconic
SendMessageW
FindWindowW
PostThreadMessageW
UnhookWindowsHookEx
RegisterWindowMessageW

gdi32

RectVisible
GetStockObject
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
GetObjectW
SetBkColor
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
SetTextColor
GetClipBox
GetDeviceCaps
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
CreateBitmap
CreateRectRgnIndirect
TextOutW

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegDeleteKeyW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW

shell32

SHFileOperationW
ShellExecuteW
Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteExW
ord165
SHGetSpecialFolderPathW

comctl32

ord17

shlwapi

StrStrIW
StrStrA
PathFileExistsW
PathAppendW
PathCombineW
PathRemoveExtensionW
StrStrIA
PathRenameExtensionW
PathStripPathW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathIsDirectoryW

oledlg

OleUIBusyW

ole32

CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoTaskMemFree
CoInitialize
CoCreateGuid
CoTaskMemAlloc
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SysStringLen
SysFreeString
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpWriteData
WinHttpSendRequest
WinHttpSetOption
WinHttpOpenRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpReceiveResponse

Sections

.text
Size: 520KB - Virtual size: 520KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 367KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WebClient.dll
.dll windows:5 windows x86 arch:x86

95405bf9fc58b72d0583bed1b0abdef6

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ab:96:f8:9c:70:89:40:b1:2d:3b:a7:69:b9:ce:ac:a2:48:4c:d5:c6
Signer

Actual PE Digest

ab:96:f8:9c:70:89:40:b1:2d:3b:a7:69:b9:ce:ac:a2:48:4c:d5:c6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\WebClient.pdb

Imports

directui

DirectUI_ShowControl
DirectUI_SubclassWindow
DirectUI_LoadSkinResourceFromZIP
DirectUI_UpdateSkin
DirectUI_SetLanguageStyle

kernel32

EnterCriticalSection
GetLocalTime
Process32FirstW
OpenThread
LockResource
GlobalMemoryStatusEx
Process32NextW
CreateToolhelp32Snapshot
GetCurrentThreadId
WinExec
CloseHandle
GetCurrentProcessId
ExpandEnvironmentStringsW
MapViewOfFile
UnmapViewOfFile
CreateProcessW
WaitForSingleObject
GetModuleHandleW
GetExitCodeProcess
GetStartupInfoW
GetProcAddress
OpenFileMappingW
OutputDebugStringW
CreateFileA
GlobalAlloc
GlobalFree
DeviceIoControl
LocalAlloc
SetLastError
GetLastError
VerifyVersionInfoW
GetPrivateProfileIntW
RaiseException
FlushInstructionCache
SetThreadPriority
lstrlenW
MultiByteToWideChar
GetModuleFileNameW
CreateDirectoryW
WritePrivateProfileStringW
GetPrivateProfileSectionNamesW
Thread32Next
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InterlockedExchange
FreeLibrary
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
LCMapStringW
LCMapStringA
LeaveCriticalSection
SizeofResource
Sleep
WideCharToMultiByte
Thread32First
OpenProcess
GetPrivateProfileStringW
GetModuleHandleExW
GetCurrentProcess
VerSetConditionMask
LoadResource
FindResourceW
FindResourceExW
lstrcmpW
InterlockedDecrement
LoadLibraryW
GetModuleFileNameA
ExitProcess
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
GetCommandLineA
GetSystemTimeAsFileTime
GetStdHandle
GetFileType
WriteConsoleW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapReAlloc
HeapDestroy
InitializeCriticalSection
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
CreateMutexW
FlushFileBuffers
SetFilePointer
InterlockedIncrement
CreateEventW
SetEvent
GetProcessHeap
HeapFree
HeapAlloc
VirtualAlloc
VirtualFree
WriteFile
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetPrivateProfileSectionW
DeleteFileW
CreateFileW

user32

AttachThreadInput
GetShellWindow
GetWindowThreadProcessId
DefWindowProcW
CallWindowProcW
GetPropW
SetWindowTextW
UpdateWindow
SendMessageW
IsWindowVisible
GetSystemMetrics
UnhookWindowsHookEx
UnregisterClassA
GetMessageW
DispatchMessageW
SetWindowsHookExW
CreateWindowExW
IsWindow
ShowWindow
SetLayeredWindowAttributes
SetWindowPos
GetDesktopWindow
GetClientRect
RedrawWindow
FindWindowExW
SetCapture
MessageBoxW
ReleaseCapture
GetMessagePos
DestroyWindow
SetTimer
GetWindowRect
PostQuitMessage
LoadImageW
PostMessageW
KillTimer
SetForegroundWindow
GetParent
OffsetRect
LoadCursorW
CallNextHookEx
WindowFromPoint
GetClassInfoExW
SetPropW
GetForegroundWindow
RegisterClassExW
GetWindowLongW
SystemParametersInfoW
GetDlgItem
SetWindowLongW

advapi32

LookupPrivilegeValueW
RegEnumValueW
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
RegEnumKeyExW
RegOpenKeyExW
RevertToSelf
RegOpenCurrentUser
ImpersonateLoggedOnUser
RegQueryValueW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
OpenProcessToken

shell32

SHGetFolderPathW
ord165
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderPathW

ole32

CoCreateGuid
CoInitialize
OleCreate
StgCreateDocfile
OleInitialize
CoUninitialize

oleaut32

SysFreeString
SysStringByteLen
VariantInit
SysAllocStringByteLen
VariantClear
SysAllocString

log

WriteLog

shlwapi

PathIsDirectoryW
PathIsRelativeW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathFindFileNameW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

winhttp

WinHttpCreateUrl

Exports

Exports

GetWebBrowser2
_CreateWebClient@16
_DeleteWebClient@4
_GetMainSafeHwnd@4

Sections

.text
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiFiDeskBand.dll
.dll regsvr32 windows:5 windows x86 arch:x86

075e4040f83a96b86f664569f666c7c5

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:b3:12:53:e6:a1:15:25:08:8b:ca:7c:e1:e7:a5:be:a5:97:84:d2
Signer

Actual PE Digest

2b:b3:12:53:e6:a1:15:25:08:8b:ca:7c:e1:e7:a5:be:a5:97:84:d2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

p:\app\gensoft\security-client\pc-faster\public\output\pdb\WiFiDeskBand.pdb

Imports

kernel32

FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetLocaleInfoA
LoadLibraryA
RtlUnwind
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
GetEnvironmentStringsW
GlobalDeleteAtom
GlobalFindAtomW
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
OpenEventW
SetEvent
CreateEventW
WaitForSingleObject
CreateFileMappingW
SetLastError
MapViewOfFile
GetLastError
UnmapViewOfFile
LocalFree
GetStringTypeW
CloseHandle
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
ExitProcess
Sleep
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree

user32

DestroyIcon
SendMessageTimeoutW
GetSystemMetrics
RegisterWindowMessageW
LoadImageW
ShowWindow
FindWindowW
SetFocus
CallNextHookEx
GetWindowTextW
SetWindowsHookExW
UnhookWindowsHookEx
DestroyMenu
TrackPopupMenu
GetCursorPos
SetMenuItemBitmaps
SetMenuDefaultItem
AppendMenuW
CreatePopupMenu
EndPaint
GetClientRect
BeginPaint
TrackMouseEvent
InvalidateRect
UpdateWindow
RegisterClassExW
LoadCursorW
LoadIconW
DefWindowProcW
GetPropW
GetIconInfo
UnregisterClassW
DestroyWindow
DrawIconEx
FillRect
GetSysColor
SetPropW
SetTimer
PostMessageW
CreateWindowExW

gdi32

GetObjectW
CreateSolidBrush
CreateDCW
DeleteObject
DeleteDC
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW

ole32

StringFromGUID2
CoCreateInstance

shlwapi

SHDeleteKeyW
ord219

uxtheme

DrawThemeParentBackground
CloseThemeData
OpenThemeData
DrawThemeBackground

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
StartHook
StopHook
WaitHook

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiFiDeskBand64.dll
.dll regsvr32 windows:5 windows x64 arch:x64

c9e5ebe1077448e7bc0f9321310e8456

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a8:67:e1:91:ce:48:f3:9b:7a:ab:7a:d9:8c:0f:2b:06:90:9d:77:e5
Signer

Actual PE Digest

a8:67:e1:91:ce:48:f3:9b:7a:ab:7a:d9:8c:0f:2b:06:90:9d:77:e5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

p:\app\gensoft\security-client\pc-faster\public\output\pdb\WiFiDeskBand64.pdb

Imports

kernel32

CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
GetStringTypeA
FlushFileBuffers
MultiByteToWideChar
LCMapStringA
GetLocaleInfoA
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
HeapSetInformation
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
GlobalDeleteAtom
GlobalFindAtomW
GetModuleFileNameW
OpenEventW
SetEvent
CreateEventW
WaitForSingleObject
CreateFileMappingW
SetLastError
MapViewOfFile
GetLastError
UnmapViewOfFile
LocalFree
LCMapStringW
CloseHandle
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
ExitProcess
GetProcAddress
GetModuleHandleW
Sleep
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FlsAlloc
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RaiseException
RtlPcToFileHeader
RtlUnwindEx
WriteFile
GetStdHandle
GetModuleFileNameA
EncodePointer
DecodePointer
FlsGetValue
FlsFree

user32

LoadImageW
RegisterWindowMessageW
ShowWindow
SendMessageTimeoutW
DestroyIcon
GetSystemMetrics
GetClientRect
SetFocus
CallNextHookEx
GetWindowTextW
SetWindowsHookExW
UnhookWindowsHookEx
DestroyMenu
TrackPopupMenu
GetCursorPos
SetMenuItemBitmaps
SetMenuDefaultItem
AppendMenuW
CreatePopupMenu
EndPaint
CreateWindowExW
BeginPaint
TrackMouseEvent
InvalidateRect
UpdateWindow
RegisterClassExW
LoadCursorW
LoadIconW
DefWindowProcW
GetPropW
GetIconInfo
UnregisterClassW
DestroyWindow
DrawIconEx
FillRect
GetSysColor
SetPropW
SetTimer
PostMessageW
FindWindowW

gdi32

GetObjectW
CreateSolidBrush
CreateDCW
DeleteObject
DeleteDC
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW
SetSecurityInfo
GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW

ole32

StringFromGUID2
CoCreateInstance

shlwapi

SHDeleteKeyW
ord219

uxtheme

CloseThemeData
DrawThemeParentBackground
OpenThemeData
DrawThemeBackground

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
StartHook
StopHook
WaitHook

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WiFiMac.dat
WiFiNpc.dat
WifiDrv/Cert/root.cer
WifiDrv/LWFDrv/Win7/amd64/ndisrd.cat
WifiDrv/LWFDrv/Win7/amd64/ndisrd.sys
.sys windows:6 windows x64 arch:x64

4c4c24a188af43b4db0ba86b8188ba73

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

55:6d:ad:9f:ec:2f:a8:66:fc:63:97:74:df:a4:e9:45
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/07/2013, 00:00

Not After

02/08/2015, 23:59

Subject

CN=Mainline Net Holdings Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Mainline Net Holdings Limited,L=Road Town,ST=Tortola,C=VG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

85:d5:11:c0:86:48:3f:ba:cc:a5:a7:22:c5:b7:99:08:96:4d:fb:4e
Signer

Actual PE Digest

85:d5:11:c0:86:48:3f:ba:cc:a5:a7:22:c5:b7:99:08:96:4d:fb:4e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\projects\SVN\WinpkFilter\kernel\bin\lwf\win7\amd64\ndisrd.pdb

Imports

ntoskrnl.exe

KeBugCheckEx
KeDelayExecutionThread
RtlUnicodeStringToAnsiString
RtlQueryRegistryValues
IofCompleteRequest
MmMapLockedPagesSpecifyCache
RtlInitUnicodeString
RtlAssert
RtlTimeFieldsToTime
KeSetEvent
DbgPrint
ExEventObjectType
__C_specific_handler
ObReferenceObjectByHandle
ExFreePoolWithTag
ExAllocatePoolWithTag
ObfDereferenceObject
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc

ndis.sys

NdisGetDeviceReservedExtension
NdisFSendNetBufferLists
NdisAllocateNetBufferList
NdisFCancelOidRequest
NdisFOidRequestComplete
NdisFOidRequest
NdisFreeCloneOidRequest
NdisAllocateCloneOidRequest
NdisFCancelSendNetBufferLists
NdisFNetPnPEvent
NdisFDevicePnPEventNotify
NdisFIndicateStatus
NdisFIndicateReceiveNetBufferLists
NdisFSendNetBufferListsComplete
NdisFReturnNetBufferLists
NdisFSetAttributes
NdisFDeregisterFilterDriver
NdisFRegisterFilterDriver
NdisFreeNetBufferList
NdisFreeNetBufferListPool
NdisFreeMemory
NdisAllocateMemoryWithTagPriority
NdisRegisterDeviceEx
NdisDeregisterDeviceEx
NdisCloseConfiguration
NdisOpenConfigurationEx
NdisAllocateNetBufferListPool

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WifiDrv/LWFDrv/Win7/i386/ndisrd.cat
WifiDrv/LWFDrv/Win7/i386/ndisrd.sys
.sys windows:6 windows x86 arch:x86

fa4f5425da4152f019a8b7c0099629af

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

55:6d:ad:9f:ec:2f:a8:66:fc:63:97:74:df:a4:e9:45
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/07/2013, 00:00

Not After

02/08/2015, 23:59

Subject

CN=Mainline Net Holdings Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Mainline Net Holdings Limited,L=Road Town,ST=Tortola,C=VG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ef:ae:4c:0a:a2:c0:29:de:4a:17:af:3c:b2:fb:c4:d7:31:fe:9e:f4
Signer

Actual PE Digest

ef:ae:4c:0a:a2:c0:29:de:4a:17:af:3c:b2:fb:c4:d7:31:fe:9e:f4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\projects\SVN\WinpkFilter\kernel\bin\lwf\win7\i386\ndisrd.pdb

Imports

ntoskrnl.exe

RtlUnwind
KeBugCheckEx
KeTickCount
KeDelayExecutionThread
RtlUnicodeStringToAnsiString
RtlQueryRegistryValues
IofCompleteRequest
MmMapLockedPagesSpecifyCache
RtlInitUnicodeString
RtlAssert
_alldiv
KeQuerySystemTime
RtlTimeFieldsToTime
KeSetEvent
DbgPrint
ExEventObjectType
memset
ObReferenceObjectByHandle
memcpy
ExFreePoolWithTag
ExAllocatePoolWithTag
ObfDereferenceObject

hal

KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql

ndis.sys

NdisFOidRequestComplete
NdisFOidRequest
NdisFreeCloneOidRequest
NdisAllocateCloneOidRequest
NdisFCancelSendNetBufferLists
NdisFNetPnPEvent
NdisFDevicePnPEventNotify
NdisFIndicateStatus
NdisFIndicateReceiveNetBufferLists
NdisFCancelOidRequest
NdisFReturnNetBufferLists
NdisFSetAttributes
NdisFDeregisterFilterDriver
NdisFRegisterFilterDriver
NdisFreeNetBufferList
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisOpenConfigurationEx
NdisCloseConfiguration
NdisAllocateNetBufferList
NdisFSendNetBufferLists
NdisFSendNetBufferListsComplete
NdisFreeMemory
NdisAllocateMemoryWithTagPriority
NdisRegisterDeviceEx
NdisDeregisterDeviceEx
NdisGetDeviceReservedExtension

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WifiDrv/LWFDrv/Win8/i386/ndisrd.cat
WifiDrv/LWFDrv/Win8/i386/ndisrd.sys
.sys windows:6 windows x86 arch:x86

ee0857fa167050b445764734b6548b2c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

55:6d:ad:9f:ec:2f:a8:66:fc:63:97:74:df:a4:e9:45
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/07/2013, 00:00

Not After

02/08/2015, 23:59

Subject

CN=Mainline Net Holdings Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Mainline Net Holdings Limited,L=Road Town,ST=Tortola,C=VG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3b:3c:85:a1:d5:04:b6:dc:c6:da:3e:5a:52:16:e2:ad:1e:85:10:18
Signer

Actual PE Digest

3b:3c:85:a1:d5:04:b6:dc:c6:da:3e:5a:52:16:e2:ad:1e:85:10:18

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\projects\SVN\WinpkFilter\kernel\bin\lwf\win8\i386\ndisrd.pdb

Imports

ntoskrnl.exe

RtlUnwind
KeDelayExecutionThread
RtlUnicodeStringToAnsiString
MmGetSystemRoutineAddress
RtlQueryRegistryValues
IofCompleteRequest
MmMapLockedPagesSpecifyCache
RtlInitUnicodeString
RtlAssert
_alldiv
KeQuerySystemTime
RtlTimeFieldsToTime
KeSetEvent
DbgPrint
ExEventObjectType
memset
ObReferenceObjectByHandle
memcpy
ExFreePoolWithTag
ExAllocatePoolWithTag
ObfDereferenceObject
KeInitializeSpinLock

hal

KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql

ndis.sys

NdisFOidRequestComplete
NdisFOidRequest
NdisFreeCloneOidRequest
NdisAllocateCloneOidRequest
NdisFCancelSendNetBufferLists
NdisFNetPnPEvent
NdisFDevicePnPEventNotify
NdisFIndicateStatus
NdisFIndicateReceiveNetBufferLists
NdisFCancelOidRequest
NdisFReturnNetBufferLists
NdisFSetAttributes
NdisFDeregisterFilterDriver
NdisFRegisterFilterDriver
NdisFreeNetBufferList
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisOpenConfigurationEx
NdisCloseConfiguration
NdisGetDeviceReservedExtension
NdisAllocateNetBufferList
NdisFSendNetBufferLists
NdisFSendNetBufferListsComplete
NdisFreeMemory
NdisAllocateMemoryWithTagPriority
NdisRegisterDeviceEx
NdisDeregisterDeviceEx

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WifiDrv/LWFDrv/Win8/i386/ndisrd_lwf.inf
WifiDrv/LWFDrv/ndisrd_lwf.inf
WifiDrv/Setup/amd64/certinst.exe
.exe windows:5 windows x64 arch:x64

8467e11ef11d14f98738f4971c36ae50

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f4:6b:08:8a:e2:12:fc:c4:4b:a5:d6:ed:d3:ea:a0:e2:2d:c5:18:5e
Signer

Actual PE Digest

f4:6b:08:8a:e2:12:fc:c4:4b:a5:d6:ed:d3:ea:a0:e2:2d:c5:18:5e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\Project\WinpkFilter\setup\amd64\certinst.pdb

Imports

crypt32

CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CertCloseStore
CertOpenStore

kernel32

TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetLastError
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapReAlloc
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileA

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WifiDrv/Setup/amd64/snetcfg.exe
.exe windows:5 windows x64 arch:x64

3ec6bd316a73f2d096b8713b29c83ddf

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:76:a0:d4:59:fc:ca:e0:04:b3:9c:51:1c:78:b1:95:3a:64:fb:5d
Signer

Actual PE Digest

3d:76:a0:d4:59:fc:ca:e0:04:b3:9c:51:1c:78:b1:95:3a:64:fb:5d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

p:\app\gensoft\security-client\pc-faster\public\output\pdb\snetcfg64.pdb

Imports

setupapi

SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupCopyOEMInfW
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiRemoveDevice
CM_Get_DevNode_Status
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsW

newdev

UpdateDriverForPlugAndPlayDevicesW

log64

WriteLog
CreateLog
CloseLog

shlwapi

PathRenameExtensionW

kernel32

EncodePointer
CreateFileW
SetStdHandle
SetFilePointer
WriteConsoleW
CloseHandle
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
Sleep
GetModuleFileNameW
GetCurrentDirectoryW
GetLastError
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
GetVersionExW
RtlUnwindEx
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
RtlPcToFileHeader
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetCurrentThreadId
FlsAlloc
LCMapStringW
OutputDebugStringA
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoW
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW

user32

UnregisterClassA

ole32

CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoUninitialize

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WifiDrv/Setup/i386/certinst.exe
.exe windows:5 windows x86 arch:x86

604c2b22bc19670884108e615f9b73cc

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

dc:d6:ff:de:13:64:76:d5:ff:67:50:c8:f4:85:4b:e0:db:0b:c5:39
Signer

Actual PE Digest

dc:d6:ff:de:13:64:76:d5:ff:67:50:c8:f4:85:4b:e0:db:0b:c5:39

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Project\WinpkFilter\setup\i386\certinst.pdb

Imports

crypt32

CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CertCloseStore
CertOpenStore

kernel32

TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
RtlUnwind
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileA

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WifiDrv/Setup/i386/snetcfg.exe
.exe .ps1 windows:5 windows x86 arch:x86 polyglot

0277e93b8f7d107b9e1f1fbd1c97c10a

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:1a:4b:06:fe:98:0b:73:1f:e6:85:e1:05:01:1b:52:ab:9a:b2:19
Signer

Actual PE Digest

39:1a:4b:06:fe:98:0b:73:1f:e6:85:e1:05:01:1b:52:ab:9a:b2:19

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

p:\app\gensoft\security-client\pc-faster\public\output\pdb\snetcfg.pdb

Imports

setupapi

SetupDiGetDeviceInstanceIdW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupCopyOEMInfW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiRemoveDevice
CM_Get_DevNode_Status

newdev

UpdateDriverForPlugAndPlayDevicesW

log

CloseLog
WriteLog
CreateLog

shlwapi

PathRenameExtensionW

kernel32

TlsSetValue
CreateFileA
SetStdHandle
SetFilePointer
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CloseHandle
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LoadLibraryExA
GetModuleFileNameW
GetCurrentDirectoryW
GetLastError
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleW
GetSystemInfo
VirtualQuery
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringA
LCMapStringW
OutputDebugStringA
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
Sleep

user32

UnregisterClassA

ole32

CoUninitialize
CoTaskMemFree
CoInitializeEx
CoCreateInstance

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WifiHotspot.exe
.exe windows:5 windows x86 arch:x86

47e9de2cdf8b847ac1825e994b069fd7

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f2:1f:36:04:9d:5f:72:4f:96:3f:40:94:16:5c:3e:cd:a6:e4:64:38
Signer

Actual PE Digest

f2:1f:36:04:9d:5f:72:4f:96:3f:40:94:16:5c:3e:cd:a6:e4:64:38

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\security-client\trunk\pc-faster\public\output\pdb\WifiHotspot.pdb

Imports

directui

DirectUI_TreeEx_InsertItem
DirectUI_TreeEx_CreateControl
DirectUI_TreeEx_SetItemHeight
DirectUI_TreeEx_IsExpand
DirectUI_TreeEx_Expand
DirectUI_TreeEx_SetStaticLogoImage
DirectUI_TreeEx_SetAutoTextItemText
DirectUI_TreeEx_SetControlText
DirectUI_TreeEx_ShowControl
uiFindElem
uiFreeElem
DirectUI_ListCtrl_InsertDrawItem
DirectUI_TreeEx_DeleteItem
uiUpdateWindow
DirectUI_Edit_SetSrcText
DirectUI_ComboBox_AddString
DirectUI_ListCtrl_InsertColumn
DirectUI_ListCtrl_SetDrawItem
DirectUI_ListCtrl_ChangeStyle
DirectUI_ListCtrl_SetControlText
DirectUI_ListCtrl_SetStaticLogo
DirectUI_Button_SetCheck
DirectUI_Button_GetCheck
DirectUI_ComboBox_SetCurSel
DirectUI_Static_SetLogoImage
DirectUI_GetSafeHwnd
DirectUI_SetLanguageStyle
DirectUI_I18N_AddLanguageStyle
UIScrollToBegin
DirectUI_LoadSkinResourceFromZIP
DirectUI_AutoText_SetControlText
DirectUI_EnableAnimate
DirectUI_TrackPopupMenu
DirectUI_GetLanguageStyle
DirectUI_EnableControl
DirectUI_SetTooltipString
DirectUI_GetControlPos
DirectUI_GetControlRect
DirectUI_GetControlText
DirectUI_GetControlStyle
DirectUI_ChangeStyle
DirectUI_IsControlVisible
DirectUI_ShowControl
DirectUI_SetControlText
DirectUI_SetControlPos
DirectUI_SetControlTextEx
DirectUI_SubclassWindow
DirectUI_GetStringItem
DirectUI_UpdateSkin
DirectUI_GetVersion

kernel32

GetFileAttributesW
lstrcpynW
lstrcatW
SetErrorMode
FormatMessageW
SetFilePointerEx
FlushFileBuffers
GetFileSizeEx
TerminateThread
SetEndOfFile
SetFilePointer
CreateFileA
SetHandleInformation
GetFullPathNameW
GetStdHandle
CreatePipe
DuplicateHandle
CreateDirectoryW
lstrlenA
ReadFile
WriteFile
CreateFileW
ExpandEnvironmentStringsW
GetTickCount
OpenFileMappingW
LocalFree
IsValidLocale
CreateEventW
WideCharToMultiByte
WinExec
GetPrivateProfileStringW
GetPrivateProfileIntW
DeleteFileW
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
GlobalAlloc
GlobalFree
GetVersionExW
VerSetConditionMask
GetDriveTypeA
WriteConsoleW
GetConsoleOutputCP
VerifyVersionInfoW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
GetExitCodeProcess
GetFileAttributesA
GetStartupInfoA
SetHandleCount
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
GetStartupInfoW
SetConsoleCtrlHandler
CreateProcessA
DeleteFileA
CreateDirectoryA
GetFileType
SetStdHandle
ResumeThread
CreateThread
IsDebuggerPresent
UnhandledExceptionFilter
FileTimeToLocalFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetProcessTimes
GetWindowsDirectoryW
SetCurrentDirectoryA
CopyFileA
GetModuleFileNameA
GetSystemInfo
LocalAlloc
ResetEvent
WaitForSingleObject
CreateProcessW
GlobalAddAtomW
GlobalFindAtomW
GetLongPathNameW
Sleep
GetSystemDirectoryW
LoadLibraryW
FlushInstructionCache
GetLocalTime
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryExW
RaiseException
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
lstrlenW
GetCurrentProcess
MultiByteToWideChar
InterlockedIncrement
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SetLastError
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
FreeLibrary
GetLastError
GetDriveTypeW
GetPrivateProfileSectionNamesW
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
QueryPerformanceCounter
QueryPerformanceFrequency
GetTimeFormatA
GetDateFormatA
GetSystemTime
SetCurrentDirectoryW
WaitForMultipleObjects
MoveFileW
DeviceIoControl
lstrcpyW
GetExitCodeThread
IsBadWritePtr
CreateRemoteThread
HeapFree
GetProcessHeap
WriteProcessMemory
VirtualProtectEx
GetCurrentThread
VirtualFreeEx
VirtualAllocEx
lstrcpyA
OpenEventW
VirtualAlloc
OpenMutexW
GetThreadContext
lstrcatA
CreateMutexW
ReleaseMutex
VirtualQuery
TerminateProcess
RemoveVectoredExceptionHandler
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
HeapAlloc
RemoveDirectoryA
HeapCreate
InitializeCriticalSectionAndSpinCount
VirtualQueryEx
ReadProcessMemory
WTSGetActiveConsoleSessionId
SystemTimeToFileTime
InterlockedCompareExchange
InterlockedExchange
CreateFileMappingA
VirtualFree
GetModuleHandleA
GetModuleFileNameW
GetProcAddress
GetCommandLineW
ExitThread
GetModuleHandleExW
IsBadReadPtr
IsBadCodePtr
VirtualProtect
DebugBreak
RemoveDirectoryW
SetFileTime
FindClose
FindNextFileW
FindFirstFileW
MoveFileExW
SetFileAttributesW
GetFileAttributesExW
SetEvent
WritePrivateProfileStringW
GetTimeZoneInformation
GetPrivateProfileSectionW
GetTempPathW
GetTempFileNameW
CopyFileW
GetFileSize
ProcessIdToSessionId
GetVersion
GetModuleHandleW
WriteConsoleA

user32

TrackPopupMenuEx
EnumWindows
SendMessageTimeoutW
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
GetThreadDesktop
GetWindowThreadProcessId
SetWindowLongW
IsWindowVisible
ShowWindow
FindWindowW
IsWindow
GetWindowRect
GetWindowLongW
UpdateLayeredWindow
SendMessageW
SetFocus
SetTimer
KillTimer
PostMessageW
ExitWindowsEx
SetWindowTextW
MapWindowPoints
GetClientRect
GetParent
GetMonitorInfoW
MonitorFromWindow
GetWindow
InvalidateRect
GetLastInputInfo
GetCursorPos
SetForegroundWindow
AttachThreadInput
SetWindowPos
GetForegroundWindow
DestroyWindow
RedrawWindow
SetActiveWindow
SetCursor
ClientToScreen
EnableWindow
TranslateAcceleratorW
CreatePopupMenu
DestroyMenu
DefWindowProcW
AppendMenuW
RegisterWindowMessageW
CharNextW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
RegisterClassExW
GetClassInfoExW
LoadCursorW
LoadStringW
LoadStringA
PostQuitMessage
CallWindowProcW
GetMenuItemCount
GetMenuItemInfoW
MessageBeep
RemoveMenu
MonitorFromPoint
PrivateExtractIconsW
FindWindowExW
CreateWindowExW
LoadImageW
PtInRect
OffsetRect
UnregisterClassA
GetWindowTextLengthW
wsprintfW
GetDlgItem
EndDialog
DialogBoxParamW
CreateDialogParamW
SystemParametersInfoW
GetWindowTextW
EnumChildWindows
MoveWindow
GetSystemMetrics
DestroyIcon

gdi32

CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
CreateICW
CreateCompatibleDC

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

CheckTokenMembership
RegOpenKeyExA
SetSecurityDescriptorSacl
RegQueryValueExA
RegEnumValueW
GetLengthSid
GetKernelObjectSecurity
CreateProcessAsUserW
DuplicateTokenEx
SetTokenInformation
GetTokenInformation
GetUserNameW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyW
RegQueryValueW
RevertToSelf
RegQueryValueExW
RegOpenCurrentUser
ImpersonateLoggedOnUser
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
ChangeServiceConfigW
StartServiceW
QueryServiceStatus
CloseServiceHandle
AllocateAndInitializeSid
FreeSid

shell32

SHBrowseForFolderW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetSpecialFolderPathA
DragFinish
DragQueryFileW
SHGetSpecialFolderPathW
ExtractIconExW
ShellExecuteExA
SHFileOperationW
SHCreateDirectoryExW
ShellExecuteExW
ShellExecuteW
SHGetFolderPathW
SHLoadInProc
SHGetFolderPathA
SHGetMalloc
ord165

ole32

CoCreateGuid
CLSIDFromString
CoInitializeEx
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CoSetProxyBlanket

oleaut32

VariantChangeType
VariantInit
VariantClear
SysAllocString
SysFreeString
VarUdateFromDate
SafeArrayPutElement
SafeArrayCreate
VarUI4FromStr
SysStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime

log

WriteLogA
CloseLog
CreateLog
WriteLog

shlwapi

PathFindFileNameW
PathIsRelativeW
PathRenameExtensionW
PathAddBackslashW
PathRemoveFileSpecA
PathFileExistsA
wnsprintfW
PathFindFileNameA
PathIsDirectoryA
SHDeleteValueW
SHGetValueW
PathFindExtensionW
PathRemoveExtensionW
SHSetValueW
PathAppendA
PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
PathAppendW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

iphlpapi

IcmpCloseHandle
IcmpCreateFile
SendARP
CreateIpNetEntry
IcmpSendEcho
GetIpNetTable
GetAdaptersInfo
GetBestInterface
GetAdaptersAddresses
GetIfEntry
GetNetworkParams
GetIfTable
SetIpNetEntry

rpcrt4

UuidToStringW
UuidCreate
UuidFromStringA
UuidToStringA
RpcStringFreeA
RpcStringFreeW

gdiplus

GdipGetImageHeight
GdipGetImageWidth
GdiplusStartup
GdiplusShutdown
GdipFree
GdipAlloc
GdipCreateMatrix
GdipCloneImage
GdipTranslateMatrix
GdipRotateMatrix
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetWorldTransform
GdipGetWorldTransform
GdipGraphicsClear
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDeleteMatrix
GdipDrawImageRectRectI
GdipDrawImageRectI

winhttp

WinHttpSendRequest
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpWriteData
WinHttpSetCredentials
WinHttpSetOption
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpOpen
WinHttpCreateUrl

setupapi

SetupDiSetClassInstallParamsW
SetupDiRemoveDevice
SetupDiDestroyDeviceInfoList
CM_Get_DevNode_Status
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiCallClassInstaller
SetupDiEnumDeviceInfo

feedback

?QueryReply@feedback@baidu@@YAKW4ProductId@12@W4LanguageId@12@PB_WPA_WI@Z

ws2_32

socket
bind
listen
getsockname
connect
htonl
gethostbyname
inet_ntoa
WSAGetLastError
getpeername
ntohs
getsockopt
recv
send
recvfrom
select
__WSAFDIsSet
WSAStartup
shutdown
htons
ioctlsocket
closesocket
sendto
WSACleanup
setsockopt
inet_addr
ntohl
WSASocketW
WSAIoctl
accept

psapi

GetModuleFileNameExW
GetModuleBaseNameW
GetModuleInformation

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
config.ini
data/LinkCensor.dat
data/mn.dat
data/rl.dat
data/sbr2.dat
data/site/api/querydownload.cpp
data/site/index.html
data/site/static/css/common.css
data/site/static/img/bg.png
.png
data/site/static/img/close-tips.png
.png
data/site/static/img/download-icon.png
.png
data/site/static/img/header-bg.png
.png
data/site/static/img/icon-add.png
.png
data/site/static/img/icon-file.png
.png
data/site/static/img/icon-pic.png
.png
data/site/static/img/icon-right.png
.png
data/site/static/img/loading.png
.png
data/site/static/img/logo.png
.png
data/site/static/img/pic-upload.png
.png
data/site/static/img/star.png
.png
data/site/static/js/download.js
.js
data/site/static/js/upload.js
.js
data/site/static/js/zepto.min.js
.js
data/site/tool/1028/download.html
.js
data/site/tool/1028/upload.html
.js
data/site/tool/1033/download.html
.js
data/site/tool/1033/upload.html
.js
data/site/tool/1046/download.html
.js
data/site/tool/1046/upload.html
.js
data/site/tool/1054/download.html
.js
data/site/tool/1054/upload.html
.js
data/site/tool/1057/download.html
.js
data/site/tool/1057/upload.html
.js
data/site/tool/3082/download.html
.js
data/site/tool/3082/upload.html
.js
dbghelp.dll
.dll windows:6 windows x86 arch:x86

adf9759800fcd48cc981a4db72368f41

Code Sign

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/07/2012, 20:50

Not After

26/10/2013, 20:50

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:49:55:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:45

Not After

10/01/2013, 20:55

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e1:de:fd:03:98:61:30:2f:aa:d4:b4:a2:d1:b9:4d:8b:8b:56:1f:34:6e:55:7d:7f:ef:be:29:c4:f7:c0:9c:54
Signer

Actual PE Digest

e1:de:fd:03:98:61:30:2f:aa:d4:b4:a2:d1:b9:4d:8b:8b:56:1f:34:6e:55:7d:7f:ef:be:29:c4:f7:c0:9c:54

Digest Algorithm

sha256

PE Digest Matches

true

de:fc:c6:f8:4b:ea:ce:14:08:26:e6:73:a5:87:88:48:68:4d:ac:a3
Signer

Actual PE Digest

de:fc:c6:f8:4b:ea:ce:14:08:26:e6:73:a5:87:88:48:68:4d:ac:a3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dbghelp.pdb

Imports

msvcrt

_lseeki64
_write
_isatty
__pioinfo
__badioinfo
_read
ferror
wctomb
_itoa
_snprintf
_iob
__mb_cur_max
mbtowc
_fileno
isleadbyte
_onexit
__dllonexit
_unlock
_lock
memset
memcpy
_ismbblead
_initterm
_amsg_exit
_XcptFilter
memmove
__CxxFrameHandler
_errno
iswspace
calloc
_wcsdup
towlower
tolower
_wcslwr
_wctime
time
_ltoa
_strnicmp
_purecall
ctime
malloc
strncmp
isspace
_stricmp
free
_strlwr
_vsnwprintf
iswprint
fprintf
fflush
atol
fclose
iswdigit
__unDName
bsearch
fread
fseek
_wfsopen
wcstoul
strchr
_wfullpath
_wgetenv
_chsize
_close
_get_osfhandle
_open_osfhandle
ftell
_mbscmp
_memicmp
wcsrchr
strstr
_wcsicmp
_wcsnicmp
qsort
iswxdigit
wcsncmp
wcsstr
wcschr
??3@YAXPAX@Z
??2@YAPAXI@Z
_wsopen
memcmp

kernel32

InitializeCriticalSectionAndSpinCount
DeviceIoControl
GetFileType
CopyFileExW
SetFileAttributesW
LCMapStringW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExA
FormatMessageW
GetModuleHandleW
FlushViewOfFile
MapViewOfFileEx
LocalFree
VirtualFree
GetVersion
RtlUnwind
InterlockedCompareExchange
InterlockedExchange
GetThreadSelectorEntry
TerminateThread
CreateThread
HeapCreate
HeapDestroy
VirtualQueryEx
GetThreadTimes
GetThreadPriority
GetPriorityClass
GetThreadContext
ResumeThread
SuspendThread
CreateFileMappingA
GetSystemInfo
LoadLibraryA
Sleep
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlCaptureContext
GetTickCount
GetCurrentThreadId
QueryPerformanceCounter
ReadProcessMemory
SetLastError
FindClose
GetLastError
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
CreateFileA
GetFileSize
ReadFile
CloseHandle
TlsGetValue
TlsSetValue
FreeLibrary
TlsAlloc
TlsFree
GetVersionExA
InitializeCriticalSection
GetProcessHeap
DeleteCriticalSection
HeapReAlloc
HeapAlloc
HeapFree
IsDBCSLeadByte
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcess
UnmapViewOfFile
CreateDirectoryA
VirtualAlloc
VirtualProtect
DuplicateHandle
MapViewOfFile
GetModuleHandleA
GetCurrentProcessId
OpenProcess
WriteFile
OutputDebugStringA
SetErrorMode
GetFileAttributesA
DelayLoadFailureHook

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumDirTreeW
EnumerateLoadedModules
EnumerateLoadedModules64
EnumerateLoadedModulesEx
EnumerateLoadedModulesExW
EnumerateLoadedModulesW64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindDebugInfoFileExW
FindExecutableImage
FindExecutableImageEx
FindExecutableImageExW
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
SearchTreeForFileW
StackWalk
StackWalk64
StackWalkEx
SymAddSourceStream
SymAddSourceStreamA
SymAddSourceStreamW
SymAddSymbol
SymAddSymbolW
SymAddrIncludeInlineTrace
SymCleanup
SymCompareInlineTrace
SymDeleteSymbol
SymDeleteSymbolW
SymEnumLines
SymEnumLinesW
SymEnumProcesses
SymEnumSourceFileTokens
SymEnumSourceFiles
SymEnumSourceFilesW
SymEnumSourceLines
SymEnumSourceLinesW
SymEnumSym
SymEnumSymbols
SymEnumSymbolsEx
SymEnumSymbolsExW
SymEnumSymbolsForAddr
SymEnumSymbolsForAddrW
SymEnumSymbolsW
SymEnumTypes
SymEnumTypesByName
SymEnumTypesByNameW
SymEnumTypesW
SymEnumerateModules
SymEnumerateModules64
SymEnumerateModulesW64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindDebugInfoFile
SymFindDebugInfoFileW
SymFindExecutableImage
SymFindExecutableImageW
SymFindFileInPath
SymFindFileInPathW
SymFromAddr
SymFromAddrW
SymFromIndex
SymFromIndexW
SymFromInlineContext
SymFromInlineContextW
SymFromName
SymFromNameW
SymFromToken
SymFromTokenW
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetHomeDirectoryW
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromAddrW64
SymGetLineFromInlineContext
SymGetLineFromInlineContextW
SymGetLineFromName
SymGetLineFromName64
SymGetLineFromNameW64
SymGetLineNext
SymGetLineNext64
SymGetLineNextW64
SymGetLinePrev
SymGetLinePrev64
SymGetLinePrevW64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOmapBlockBase
SymGetOmaps
SymGetOptions
SymGetScope
SymGetScopeW
SymGetSearchPath
SymGetSearchPathW
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileFromTokenW
SymGetSourceFileToken
SymGetSourceFileTokenW
SymGetSourceFileW
SymGetSourceVarFromToken
SymGetSourceVarFromTokenW
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetSymbolFile
SymGetSymbolFileW
SymGetTypeFromName
SymGetTypeFromNameW
SymGetTypeInfo
SymGetTypeInfoEx
SymGetUnwindInfo
SymInitialize
SymInitializeW
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymLoadModuleExW
SymMatchFileName
SymMatchFileNameW
SymMatchString
SymMatchStringA
SymMatchStringW
SymNext
SymNextW
SymPrev
SymPrevW
SymQueryInlineTrace
SymRefreshModuleList
SymRegisterCallback
SymRegisterCallback64
SymRegisterCallbackW64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSearchW
SymSetContext
SymSetHomeDirectory
SymSetHomeDirectoryW
SymSetOptions
SymSetParentWindow
SymSetScopeFromAddr
SymSetScopeFromIndex
SymSetScopeFromInlineContext
SymSetSearchPath
SymSetSearchPathW
SymSrvDeltaName
SymSrvDeltaNameW
SymSrvGetFileIndexInfo
SymSrvGetFileIndexInfoW
SymSrvGetFileIndexString
SymSrvGetFileIndexStringW
SymSrvGetFileIndexes
SymSrvGetFileIndexesW
SymSrvGetSupplement
SymSrvGetSupplementW
SymSrvIsStore
SymSrvIsStoreW
SymSrvStoreFile
SymSrvStoreFileW
SymSrvStoreSupplement
SymSrvStoreSupplementW
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnDecorateSymbolNameW
UnmapDebugInformation
WinDbgExtensionDllInit
block
chksym
dbghelp
dh
fptr
homedir
inlinedbg
itoldyouso
lmi
lminfo
omap
optdbgdump
optdbgdumpaddr
srcfiles
stack_force_ebp
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 1010KB - Virtual size: 1010KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dynamic/PluginHome/rocket.bskin
.7z
dynamic/ResultRecommend/config.txt
dynamic/WorldCup/server.txt
dynamic/data.bns
fn.dat
liveupdate.exe
.exe windows:5 windows x86 arch:x86

21779acfe85e87a0d148e76c24c5f4bd

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:51:1b:92:3c:aa:b8:d0:80:9d:83:65:df:c3:a6:82:61:e9:f0:54
Signer

Actual PE Digest

3a:51:1b:92:3c:aa:b8:d0:80:9d:83:65:df:c3:a6:82:61:e9:f0:54

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\liveupdate.pdb

Imports

kernel32

GetPrivateProfileStringW
GetTimeZoneInformation
GetPrivateProfileSectionW
GetPrivateProfileIntW
GetTempPathW
GetTempFileNameW
CopyFileW
DeleteFileW
WriteFile
InterlockedIncrement
GetModuleHandleW
GetProcAddress
SetLastError
GetVersionExW
ProcessIdToSessionId
DebugBreak
VirtualProtect
GetVersion
IsBadCodePtr
IsBadReadPtr
GetModuleHandleExW
ExitThread
CreateDirectoryW
GetCommandLineW
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
UnmapViewOfFile
MapViewOfFile
FlushInstructionCache
VirtualFree
Sleep
CreateFileMappingA
lstrlenW
GetWindowsDirectoryW
LocalFree
LocalAlloc
InterlockedExchange
InterlockedCompareExchange
WritePrivateProfileStringW
SystemTimeToFileTime
GetFileSizeEx
CreateProcessW
WTSGetActiveConsoleSessionId
WaitForSingleObject
ReadProcessMemory
VirtualQueryEx
InitializeCriticalSectionAndSpinCount
lstrlenA
CreateFileMappingW
HeapCreate
CreateEventW
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
GetCurrentThreadId
TerminateProcess
VirtualQuery
GetModuleFileNameA
ReleaseMutex
LoadLibraryW
lstrcatA
GetThreadContext
Process32NextW
DuplicateHandle
VirtualAlloc
OpenFileMappingW
OpenEventW
lstrcpyA
VirtualAllocEx
VirtualFreeEx
GetCurrentThread
VirtualProtectEx
WriteProcessMemory
CreateRemoteThread
IsBadWritePtr
GetExitCodeThread
lstrcpyW
SetEndOfFile
SetFilePointer
GetPrivateProfileSectionNamesW
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
LoadResource
GetStringTypeA
GetConsoleMode
Process32FirstW
CreateToolhelp32Snapshot
FindNextFileW
FindFirstFileW
GetCurrentProcess
GetTickCount
OpenProcess
VerifyVersionInfoW
VerSetConditionMask
FindClose
ReadFile
DeviceIoControl
CreateFileA
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
GlobalAlloc
GetLocalTime
GetCurrentProcessId
GetModuleFileNameW
CreateMutexW
GetLastError
GetProcessHeap
HeapFree
HeapAlloc
GetFileSize
CreateFileW
CloseHandle
FindResourceExW
FindResourceW
SizeofResource
GetConsoleCP
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
ExitProcess
LCMapStringW
LCMapStringA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
GetCPInfo
RtlUnwind
GetStartupInfoW
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
HeapSize
HeapReAlloc
HeapDestroy
RaiseException
LockResource
OpenMutexW

user32

GetLastInputInfo
PostQuitMessage
SetTimer
EndPaint
BeginPaint
DefWindowProcW
DestroyWindow
UpdateWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
LoadIconW
ShowWindow
TranslateMessage
GetUserObjectInformationA
DispatchMessageW
GetMessageW
KillTimer
OpenInputDesktop
CloseDesktop
GetThreadDesktop

advapi32

RegOpenCurrentUser
SetSecurityDescriptorDacl
GetLengthSid
GetKernelObjectSecurity
AllocateAndInitializeSid
FreeSid
RegEnumKeyExW
CreateProcessAsUserW
DuplicateTokenEx
SetTokenInformation
GetTokenInformation
GetUserNameW
RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
RevertToSelf
ImpersonateLoggedOnUser
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegEnumValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
InitializeSecurityDescriptor

shell32

SHFileOperationW
SHGetSpecialFolderPathW
SHGetFolderPathW
ord165

ole32

CoCreateGuid

log

CloseLog
CreateLog
WriteLog

shlwapi

PathAppendW
PathRemoveFileSpecW
StrCpyW
PathFileExistsW
PathIsDirectoryW
PathAddBackslashW
SHGetValueW
SHSetValueW
SHDeleteValueW
PathIsDirectoryEmptyW
PathFindExtensionW
PathFindFileNameW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

iphlpapi

GetAdaptersAddresses

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

winhttp

WinHttpOpenRequest
WinHttpConnect
WinHttpSendRequest
WinHttpWriteData
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpCloseHandle
WinHttpSetOption
WinHttpReceiveResponse
WinHttpSetCredentials
WinHttpReadData
WinHttpQueryHeaders

psapi

GetModuleInformation
GetModuleFileNameExW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

Sections

.text
Size: 362KB - Virtual size: 361KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
log.dll
.dll windows:5 windows x86 arch:x86

1f1b4a93890829f1d8956b91e3836d9d

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fa:32:4e:fd:2f:c1:07:fb:7f:1d:25:78:6c:07:8f:29:fd:c2:71:48
Signer

Actual PE Digest

fa:32:4e:fd:2f:c1:07:fb:7f:1d:25:78:6c:07:8f:29:fd:c2:71:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\log.pdb

Imports

kernel32

InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
FileTimeToSystemTime
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetLastError
MoveFileW
WideCharToMultiByte
GetLocalTime
GetFileAttributesExW
QueryPerformanceFrequency
DeleteCriticalSection
GetCurrentThreadId
CloseHandle
DeleteFileW
LocalFree
WriteFile
OutputDebugStringW
SystemTimeToTzSpecificLocalTime
SetFilePointer
EnterCriticalSection
GetFileSize
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapFree
HeapAlloc
RaiseException
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
VirtualAlloc
LoadLibraryA
RtlUnwind
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CreateFileA

advapi32

GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorSacl

Exports

Exports

CloseLog
CreateLog
WriteData
WriteLog
WriteLogA
WriteVLog

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
log2.dll
.dll windows:5 windows x86 arch:x86

169553d9c0e80575142f16084137d7ac

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

68:4a:01:7a:5c:ee:96:cf:8e:b8:45:16:da:e6:ca:5d:8e:b5:ba:81
Signer

Actual PE Digest

68:4a:01:7a:5c:ee:96:cf:8e:b8:45:16:da:e6:ca:5d:8e:b5:ba:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\log2.pdb

Imports

kernel32

GetPrivateProfileStringW
CreateFileW
GetFileSize
GetPrivateProfileIntW
ReadFile
GetTempPathW
GetTempFileNameW
CopyFileW
VirtualAlloc
VirtualFree
Sleep
SetFilePointer
FlushFileBuffers
LocalFree
UnmapViewOfFile
ReleaseMutex
CreateFileMappingW
MapViewOfFile
CreateSemaphoreW
CreateEventW
CreateMutexW
WaitForMultipleObjects
ReleaseSemaphore
ResetEvent
SetEvent
GetCurrentThreadId
GetCurrentProcessId
SleepEx
QueueUserAPC
OpenFileMappingW
OpenMutexW
OpenSemaphoreW
Process32NextW
SetEndOfFile
GetStdHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcess
GetTickCount
GetLastError
OpenProcess
VerifyVersionInfoW
VerSetConditionMask
WriteFile
MoveFileExW
HeapFree
GetProcessHeap
HeapAlloc
DeleteFileW
SystemTimeToFileTime
GetSystemTime
TerminateThread
WaitForSingleObject
OutputDebugStringW
FindNextFileW
FindFirstFileW
GetLocalTime
FindClose
GetModuleFileNameW
CloseHandle
DeviceIoControl
LockResource
GlobalFree
MultiByteToWideChar
SizeofResource
WideCharToMultiByte
GlobalAlloc
LoadResource
FindResourceW
CreateFileA
CreateDirectoryW
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileSectionNamesW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
InterlockedExchange
FindResourceExW
OpenEventW
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
RaiseException
HeapDestroy
HeapReAlloc
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
LCMapStringW
ExitProcess
GetModuleFileNameA
HeapCreate
SetHandleCount
GetFileType

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegEnumValueW
RegEnumKeyExW
FreeSid
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
AllocateAndInitializeSid
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenCurrentUser
RevertToSelf
ImpersonateLoggedOnUser
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

shell32

ord165
SHGetFolderPathW
SHFileOperationW
SHGetSpecialFolderPathW

ole32

CoCreateGuid

shlwapi

PathRemoveFileSpecW
SHGetValueW
PathFindFileNameW
PathIsDirectoryW
PathFileExistsW
PathAppendW
PathAddBackslashW
PathRenameExtensionW
StrCpyW
PathRemoveExtensionW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wtsapi32

WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsW

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

Exports

Exports

??0CAPCDispatcher@@AAE@XZ
??1CAPCDispatcher@@AAE@XZ
??4CAPCDispatcher@@QAEAAV0@ABV0@@Z
?APCThreadEntry@CAPCDispatcher@@CGIPAX@Z
?CloudOPTAPCProc@CAPCDispatcher@@CGXK@Z
?ConfirmLogLevel@CAPCDispatcher@@AAEXXZ
?DelInstance@CAPCDispatcher@@SAXXZ
?GetCommonDocumentsDir@CAPCDispatcher@@CAHQA_W@Z
?GetInstance@CAPCDispatcher@@SAPAV1@XZ
?Init@CAPCDispatcher@@AAEHXZ
?IsLevelEnabled@CAPCDispatcher@@AAEHK@Z
?LogAPCProc@CAPCDispatcher@@CGXK@Z
?LogErrorInfoToFile@CAPCDispatcher@@AAEXPB_W@Z
?LogWorkItemProc@CAPCDispatcher@@CGKPAX@Z
?QueueItemData@CAPCDispatcher@@AAEHPAUIMemItem@@@Z
?ShutDown@CAPCDispatcher@@SAXXZ
?SwitchLogFile@CAPCDispatcher@@QAEHXZ
?UnInit@CAPCDispatcher@@AAEXXZ
?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z
?WriteOptLog@CAPCDispatcher@@QAEHW4OPTType@OptItem@@W4OPTAction@3@PB_W22@Z
?m_hSingletonMutex@CAPCDispatcher@@0PAXA
?m_pInstance@CAPCDispatcher@@0PAV1@A
StartLog
StopLog

Sections

.text
Size: 259KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
log64.dll
.dll windows:5 windows x64 arch:x64

2bc54f94d0056c15ea653553144e41f1

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f8:92:f9:74:7a:da:e2:ac:4f:95:40:7c:32:af:c6:1c:27:7e:9f:02
Signer

Actual PE Digest

f8:92:f9:74:7a:da:e2:ac:4f:95:40:7c:32:af:c6:1c:27:7e:9f:02

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\log64.pdb

Imports

kernel32

InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
FileTimeToSystemTime
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetLastError
MoveFileW
WideCharToMultiByte
GetLocalTime
GetFileAttributesExW
QueryPerformanceFrequency
DeleteCriticalSection
GetCurrentThreadId
CloseHandle
DeleteFileW
LocalFree
WriteFile
OutputDebugStringW
SystemTimeToTzSpecificLocalTime
SetFilePointer
EnterCriticalSection
GetFileSize
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
Sleep
HeapSize
GetModuleHandleW
GetProcAddress
ExitProcess
RtlUnwindEx
GetStdHandle
GetModuleFileNameA
HeapFree
HeapAlloc
RaiseException
RtlPcToFileHeader
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LoadLibraryA
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CreateFileA

advapi32

GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorSacl

Exports

Exports

CloseLog
CreateLog
WriteData
WriteLog
WriteLogA
WriteVLog

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
skin/PcfTray/PcfTray.bskin
.7z
skin/Scattered/FasterNow/fast_big_animate.png
.png
skin/Scattered/FasterNow/fast_big_outer_circel.png
.png
skin/Scattered/FasterNow/fast_small_animate.png
.png
skin/Scattered/FasterNow/fast_small_circel.png
.png
skin/Scattered/FasterNow/memory_circle.png
.png
skin/Scattered/FasterNow/memory_circle_point.png
.png
skin/Scattered/GameFaster/handle.png
.png
skin/Scattered/GameFaster/restore_mask.png
.png
skin/Scattered/MainFrame/shadow.png
.png
skin/Scattered/MainFrame/splash_light.png
.png
skin/Scattered/MainFrame/tool_box.png
.png
skin/Scattered/NetworkSpeedTester/bk_downloading.png
.png
skin/Scattered/NetworkSpeedTester/bk_uploading.png
.png
skin/Scattered/NetworkSpeedTester/clock_hand.png
.png
skin/Scattered/NetworkSpeedTester/connect_circle.png
.png
skin/Scattered/NetworkSpeedTester/download_circle.png
.png
skin/Scattered/NetworkSpeedTester/download_light.png
.png
skin/Scattered/NetworkSpeedTester/map_BR.png
.png
skin/Scattered/NetworkSpeedTester/map_EG.png
.png
skin/Scattered/NetworkSpeedTester/map_ID.png
.png
skin/Scattered/NetworkSpeedTester/map_TH.png
.png
skin/Scattered/NetworkSpeedTester/upload_circle.png
.png
skin/Scattered/NetworkSpeedTester/upload_light.png
.png
skin/Scattered/PluginHome/rocket.bskin
.7z
skin/Scattered/PluginOptimizer/img_circle.png
.png
skin/Scattered/WifiSharing/device_icon/Alcatel_off.png
.png
skin/Scattered/WifiSharing/device_icon/Alcatel_on.png
.png
skin/Scattered/WifiSharing/device_icon/BBK_off.png
.png
skin/Scattered/WifiSharing/device_icon/BBK_on.png
.png
skin/Scattered/WifiSharing/device_icon/BlackBerry_off.png
.png
skin/Scattered/WifiSharing/device_icon/BlackBerry_on.png
.png
skin/Scattered/WifiSharing/device_icon/DafaultPC_off.png
.png
skin/Scattered/WifiSharing/device_icon/DafaultPC_on.png
.png
skin/Scattered/WifiSharing/device_icon/DafaultPhone_off.png
.png
skin/Scattered/WifiSharing/device_icon/DafaultPhone_on.png
.png
skin/Scattered/WifiSharing/device_icon/Gionee_off.png
.png
skin/Scattered/WifiSharing/device_icon/Gionee_on.png
.png
skin/Scattered/WifiSharing/device_icon/Google_off.png
.png
skin/Scattered/WifiSharing/device_icon/Google_on.png
.png
skin/Scattered/WifiSharing/device_icon/HTC_off.png
.png
skin/Scattered/WifiSharing/device_icon/HTC_on.png
.png
skin/Scattered/WifiSharing/device_icon/Huawei_off.png
.png
skin/Scattered/WifiSharing/device_icon/Huawei_on.png
.png
skin/Scattered/WifiSharing/device_icon/LG_off.png
.png
skin/Scattered/WifiSharing/device_icon/LG_on.png
.png
skin/Scattered/WifiSharing/device_icon/Lenovo_off.png
.png
skin/Scattered/WifiSharing/device_icon/Lenovo_on.png
.png
skin/Scattered/WifiSharing/device_icon/MEIZU_off.png
.png
skin/Scattered/WifiSharing/device_icon/MEIZU_on.png
.png
skin/Scattered/WifiSharing/device_icon/Microsoft_off.png
.png
skin/Scattered/WifiSharing/device_icon/Microsoft_on.png
.png
skin/Scattered/WifiSharing/device_icon/Motorola_off.png
.png
skin/Scattered/WifiSharing/device_icon/Motorola_on.png
.png
skin/Scattered/WifiSharing/device_icon/NEC_off.png
.png
skin/Scattered/WifiSharing/device_icon/NEC_on.png
.png
skin/Scattered/WifiSharing/device_icon/Nokia_off.png
.png
skin/Scattered/WifiSharing/device_icon/Nokia_on.png
.png
skin/Scattered/WifiSharing/device_icon/OPPO_off.png
.png
skin/Scattered/WifiSharing/device_icon/OPPO_on.png
.png
skin/Scattered/WifiSharing/device_icon/Palm_off.png
.png
skin/Scattered/WifiSharing/device_icon/Palm_on.png
.png
skin/Scattered/WifiSharing/device_icon/Philips_off.png
.png
skin/Scattered/WifiSharing/device_icon/Philips_on.png
.png
skin/Scattered/WifiSharing/device_icon/SHARP_off.png
.png
skin/Scattered/WifiSharing/device_icon/SHARP_on.png
.png
skin/Scattered/WifiSharing/device_icon/SONY_off.png
.png
skin/Scattered/WifiSharing/device_icon/SONY_on.png
.png
skin/Scattered/WifiSharing/device_icon/Samsung_off.png
.png
skin/Scattered/WifiSharing/device_icon/Samsung_on.png
.png
skin/Scattered/WifiSharing/device_icon/SonyEric_off.png
.png
skin/Scattered/WifiSharing/device_icon/SonyEric_on.png
.png
skin/Scattered/WifiSharing/device_icon/TCL_off.png
.png
skin/Scattered/WifiSharing/device_icon/TCL_on.png
.png
skin/Scattered/WifiSharing/device_icon/Xiaomi_off.png
.png
skin/Scattered/WifiSharing/device_icon/Xiaomi_on.png
.png
skin/Scattered/WifiSharing/device_icon/Yulong_off.png
.png
skin/Scattered/WifiSharing/device_icon/Yulong_on.png
.png
skin/Scattered/WifiSharing/device_icon/ZTE_off.png
.png
skin/Scattered/WifiSharing/device_icon/ZTE_on.png
.png
skin/Scattered/WifiSharing/device_icon/apple_off.png
.png
skin/Scattered/WifiSharing/device_icon/apple_on.png
.png
skin/Scattered/WifiSharing/loading.png
.png
skin/Scattered/boottime/citys.txt
skin/Scattered/boottime/littleboy.png
.png
skin/Scattered/boottime/logo/system/1.png
.png
skin/Scattered/boottime/logo/system/10.png
.png
skin/Scattered/boottime/logo/system/11.png
.png
skin/Scattered/boottime/logo/system/12.png
.png
skin/Scattered/boottime/logo/system/13.png
.png
skin/Scattered/boottime/logo/system/14.png
.png
skin/Scattered/boottime/logo/system/15.png
.png
skin/Scattered/boottime/logo/system/2.png
.png
skin/Scattered/boottime/logo/system/3.png
.png
skin/Scattered/boottime/logo/system/4.png
.png
skin/Scattered/boottime/logo/system/5.png
.png
skin/Scattered/boottime/logo/system/6.png
.png
skin/Scattered/boottime/logo/system/7.png
.png
skin/Scattered/boottime/logo/system/8.png
.png
skin/Scattered/boottime/logo/system/9.png
.png
skin/Scattered/boottime/weather/big/cloud.png
.png
skin/Scattered/boottime/weather/big/cloudy.png
.png
skin/Scattered/boottime/weather/big/foggy.png
.png
skin/Scattered/boottime/weather/big/lightning.png
.png
skin/Scattered/boottime/weather/big/rainy.png
.png
skin/Scattered/boottime/weather/big/snow.png
.png
skin/Scattered/boottime/weather/big/sunny.png
.png
skin/Scattered/boottime/weather/small/cloud.png
.png
skin/Scattered/boottime/weather/small/cloudy.png
.png
skin/Scattered/boottime/weather/small/foggy.png
.png
skin/Scattered/boottime/weather/small/lightning.png
.png
skin/Scattered/boottime/weather/small/rainy.png
.png
skin/Scattered/boottime/weather/small/snow.png
.png
skin/Scattered/boottime/weather/small/sunny.png
.png
skin/common/common.bskin
.7z
skin/feedback/browser/lang/en/en.bskin
.7z
skin/feedback/browser/lang/es/es.bskin
.7z
skin/feedback/browser/lang/id/id.bskin
.7z
skin/feedback/browser/lang/pt/pt.bskin
.7z
skin/feedback/browser/lang/th/th.bskin
.7z
skin/feedback/browser/lang/zh-hk/zh-hk.bskin
.7z
skin/feedback/browser/main/main.bskin
.7z
skin/feedback/screenshot/main/main.bskin
.7z
skin/skin_boottime/skin_boottime.bskin
.7z
skin/skin_crashreporter/skin_crashreporter.bskin
.7z
skin/skin_default/skin_default.bskin
.7z
skin/skin_frame/skin_frame.bskin
.7z
skin/skin_homepage/skin_homepage.bskin
.7z
skin/skin_ieprotect/skin_ieprotect.bskin
.7z
skin/skin_junkclean/skin_junkclean.bskin
.7z
skin/skin_popup/skin_popup.bskin
.7z
skin/skin_webclient/skin_webclient.bskin
.7z
skin/tools/BaiduWifiSharing/BaiduWifiSharing.bskin
.7z
skin/tools/DeepClean/res/res.bskin
.7z
skin/tools/DeepOptimization/res/res.bskin
.7z
skin/tools/FasterNow/FasterNow.bskin
.7z
skin/tools/NSISInstall/NSISInstall.bskin
.7z
skin/tools/common/common.bskin
.7z
skin/tools/skin_feedback/skin_feedback.bskin
.7z
skin/tools/skin_update/skin_update.bskin
.7z
skin/tools/skin_upgrade/skin_upgrade.bskin
.7z
sqlite.dll
.dll windows:5 windows x86 arch:x86

dda36a7c934f3550f7f33bb648da1215

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9f:71:3d:cc:96:c2:b9:48:2b:a0:cc:30:47:bd:6c:e5:e3:6c:89:8b
Signer

Actual PE Digest

9f:71:3d:cc:96:c2:b9:48:2b:a0:cc:30:47:bd:6c:e5:e3:6c:89:8b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

p:\app\gensoft\security-client\pc-faster\public\output\pdb\sqlite.pdb

Imports

kernel32

GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
LockFile
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
VirtualAlloc
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
GetTimeZoneInformation
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetModuleHandleA

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strnicmp
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_write_debug

Sections

.text
Size: 505KB - Virtual size: 505KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sysconfig.ini
update.dll
.dll windows:5 windows x86 arch:x86

69d500ea3d436c4132a5cfa79a9f08d1

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/03/2015, 00:00

Not After

25/03/2016, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f8:d7:0e:7e:9e:29:f0:49:05:81:3a:5a:e8:8d:81:9d:1c:4d:46:7a
Signer

Actual PE Digest

f8:d7:0e:7e:9e:29:f0:49:05:81:3a:5a:e8:8d:81:9d:1c:4d:46:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\update.pdb

Imports

kernel32

FindResourceExW
SetFilePointerEx
SetFileTime
WriteFile
FlushFileBuffers
GetFileSizeEx
SetFilePointer
GetVersionExW
CopyFileW
DeleteFileW
GetFileAttributesExW
GetModuleHandleW
LoadLibraryW
GetProcAddress
FindClose
GetModuleFileNameW
VerSetConditionMask
VerifyVersionInfoW
OpenProcess
GetCurrentProcess
FindFirstFileW
FindNextFileW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetTempPathW
GetTempFileNameW
GetSystemInfo
WaitForSingleObject
MoveFileExW
CreateDirectoryW
CreateEventW
TerminateThread
ResetEvent
FindResourceW
SetEvent
SetFileAttributesW
Sleep
RemoveDirectoryW
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemDirectoryW
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
InterlockedExchange
InitializeCriticalSection
GetCurrentThreadId
FormatMessageW
LocalFree
SetEndOfFile
FreeLibrary
InterlockedIncrement
SetErrorMode
GetTimeZoneInformation
GetPrivateProfileSectionW
LoadResource
LockResource
SizeofResource
DeviceIoControl
GlobalFree
GlobalAlloc
CreateFileA
GetLocalTime
FileTimeToSystemTime
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
lstrlenA
ReadFile
GetFileSize
CloseHandle
GetLastError
CreateFileW
DeleteCriticalSection
EnterCriticalSection
CreateMutexW
GetPrivateProfileSectionNamesW
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
LeaveCriticalSection
ResumeThread
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetLocaleInfoW
GetFullPathNameA
SetStdHandle
GetModuleHandleA
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetCurrentDirectoryA
GetFullPathNameW
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
VirtualFree
HeapCreate
GetModuleFileNameA
InterlockedDecrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
FindFirstFileA
GetDriveTypeA
GetFileInformationByHandle
RtlUnwind
ExitProcess
GetCommandLineA
FileTimeToLocalFileTime
MoveFileW
CreateThread
ExitThread
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
FormatMessageA
ExpandEnvironmentStringsA
GetTickCount
WaitForMultipleObjects
GetFileType
LoadLibraryA
GetStdHandle
PeekNamedPipe
CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
IsDebuggerPresent
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetDiskFreeSpaceExW
GetVolumeInformationW
OpenFileMappingW
GetDriveTypeW
SleepEx
GetVersionExA
SetLastError

user32

wsprintfW
FindWindowW
SendMessageW

advapi32

RegQueryValueExW
RegEnumValueW
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegOpenCurrentUser
RevertToSelf
ImpersonateLoggedOnUser
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey

shell32

ord165
SHFileOperationW
SHGetSpecialFolderPathW

log

WriteLog

shlwapi

PathGetDriveNumberW
PathFindExtensionW
PathAddBackslashW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
PathFindFileNameW
PathStripPathW
PathIsDirectoryW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsW

iphlpapi

GetAdaptersAddresses
GetIpForwardTable

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

wininet

InternetOpenW
HttpQueryInfoW
HttpOpenRequestW
InternetSetOptionW
HttpAddRequestHeadersW
HttpSendRequestW
InternetCrackUrlW
InternetConnectW
InternetReadFile
InternetCreateUrlW
InternetCloseHandle

winhttp

WinHttpOpen
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser

ws2_32

WSACleanup
WSAStartup
getsockopt
closesocket
gethostname
getaddrinfo
freeaddrinfo
WSASetLastError
socket
bind
recv
setsockopt
getsockname
ntohs
htons
connect
WSAIoctl
getpeername
send
ioctlsocket
listen
__WSAFDIsSet
select
sendto
recvfrom
accept
WSAGetLastError

wldap32

ord27
ord301
ord33
ord46
ord79
ord30
ord60
ord26
ord41
ord143
ord50
ord22
ord35
ord32
ord211
ord200

ole32

CoCreateGuid

Exports

Exports

DllGetClassObject

Sections

.text
Size: 879KB - Virtual size: 879KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
update_config.xml
url.ini
version.xml

Sharing

General

Malware Config

Signatures

Files

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5cCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

4b:5c:48:51:64:ef:cb:70:c6:ac:eb:22:3f:00:cc:c1:a9:e3:a4:dfSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 1.8MB

.rsrc Size: 79KB - Virtual size: 79KB

37f7fa6427379a6253a091175f81dc84

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5cCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

d2:32:fd:06:b7:6a:a3:4a:be:27:1b:f5:b0:f7:50:65:a4:76:a1:24Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

fltlib

kernel32

wtsapi32

psapi

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ntdll

Exports

Exports

Sections

.text Size: 478KB - Virtual size: 478KB

.rdata Size: 114KB - Virtual size: 114KB

.data Size: 11KB - Virtual size: 22KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 26KB - Virtual size: 25KB

3497585ce6db5df6a70ba374e8670819

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5cCertificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

4b:5c:48:51:64:ef:cb:70:c6:ac:eb:22:3f:00:cc:c1:a9:e3:a4:df
Signer

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 1.8MB

.rsrc
Size: 79KB - Virtual size: 79KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

d2:32:fd:06:b7:6a:a3:4a:be:27:1b:f5:b0:f7:50:65:a4:76:a1:24
Signer

.text
Size: 478KB - Virtual size: 478KB

.rdata
Size: 114KB - Virtual size: 114KB

.data
Size: 11KB - Virtual size: 22KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 26KB - Virtual size: 25KB

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5e:9c:fa:bb:b4:a7:01:c3:71:c8:32:35:e3:9c:5d:c5:0a:c6:0c:3f
Signer

.text
Size: 217KB - Virtual size: 216KB

.rdata
Size: 57KB - Virtual size: 57KB

.data
Size: 7KB - Virtual size: 14KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 12KB

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

af:ca:3b:16:40:2b:98:2f:3f:d1:4f:7e:18:91:d4:21:92:73:10:e3
Signer

.text
Size: 314KB - Virtual size: 314KB

.rdata
Size: 91KB - Virtual size: 91KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 18KB - Virtual size: 17KB

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c
Certificate