2953032d3e8083333fbbe91041feddc0_NeikiAnalytics[.]exe

resource
unpack001/$PLUGINSDIR/InstallHelper.dll
unpack002/$PLUGINSDIR/InstallHelper.dll

2953032d3e8083333fbbe91041feddc0_NeikiAnalytics.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 61412215fb26d53852080768f435afcfa050319f0431cc1c4f0ac6e203eeb5e2
MD5 2953032d3e8083333fbbe91041feddc0
SHA1 82d01bd05f52dbc61256b9762e7bed31aaf97189
SHA512 8cb6f86eb9d9f5787940938e293cd17da4486c342ced77d4eae799c7532c35cd0575d803000d5799070c6ab516ac811aec9da3b1d236e61aa02e60be2e02f890
SSDEEP 49152:ycGccpccUccL7cc2ccOcc9cc4AcHc3+ck1VLiAAGlS8cPrNXjANND2bF1P01ILwf:ycGccpccUccL7cc2ccOcc9cc4AcHc3+X
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

9c:8f:ef:fe:57:66:e1:b8:b8:8d:70:47:03:9f:91:88:e5:c9:cd:ff

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Chains

Mar 24, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2012 - Feb 26, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

0

Major OS version

5

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/InstallHelper.dll

IMPHASH 757a207c0ddc255c868ab28404d88d9f
SHA256 53c9cd1bbb9c595708ff00297694492135202649066551a354f0f8475e4c41c8
MD5 e8f6633f06b6b7e576fd764f97fe8573
SHA1 d149d067c9d53bcb8d20ac006da581a8e43daf84
SHA512 9587c452cdb4c103bb9347eb7f0ff43759ff4b7ba53de2d9446807b24b954af1547c227df05069a91c49f39dbd181f5890784101d74727deeffcc032b01cc6ca
SSDEEP 1536:SVuz5s65BWFCGH1Z9guNrCPHbSQ9uv5tmQ:SIz5lfo53WPH2+uBtm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8105

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\work\code\svn\download\XFPlugin\nsis_server\NSIS\Plugins\InstallHelper.pdb

kernel32

lstrcpynW GlobalAlloc Process32FirstW lstrcmpiW Process32NextW CloseHandle CreateToolhelp32Snapshot OpenProcess MultiByteToWideChar lstrcpyW GlobalFree GetCurrentProcess TerminateProcess GetStringTypeW GetStringTypeA InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExA GetCurrentThreadId GetCommandLineA HeapFree HeapAlloc GetProcessHeap GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetProcAddress GetModuleHandleA ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc CreateFileA InitializeCriticalSection WriteFile GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers LoadLibraryA GetCPInfo GetOEMCP IsValidCodePage SetFilePointer SetEndOfFile ReadFile LCMapStringA LCMapStringW WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize

user32

MessageBoxW

advapi32

LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges

ole32

CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysStringLen SysAllocString

$_2_/BDDLBHO.dll

IMPHASH ab018333833945702479f4393a1806ea
SHA256 20a792f1c76588866a9e0667c4d74e4c8123a1a55eb0956b93fcdf3109c153e8
MD5 0f35053b980e7a3d93018c10928dd3ba
SHA1 28b6a54b5e0bb10b5bd24300f6f49090cef9c582
SHA512 491e084d130342f66071b279f904e7444e5c6363094025a11c010664c366420b23397cc19afc9a05f4c1209df709ab3ec4485278c559f2029cf77808c235e71e
SSDEEP 3072:9ncF6HYSDP6Aow6Dl6zXHyvuV3vQxKVwt9ow2G:1ceY2Pp6hkHyw3YxKVwoXG
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

PE Signature issue

Digest

e9:c7:3c:49:08:84:5f:ac:77:b4:79:d0:8f:1e:67:e0:79:ce:cf:50

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Chains

Feb 19, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2012 - Feb 26, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

0

Major OS version

4

Entry point

59574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\work\code\svn\download\XFPlugin\Downloader_Nsis\Release\install\BDDLBHO.pdb

kernel32

MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleHandleW SetThreadLocale GetThreadLocale FreeLibrary GetFileAttributesA GetProcAddress LoadLibraryW SetDllDirectoryW ExpandEnvironmentStringsA InterlockedDecrement InterlockedIncrement GetModuleFileNameW lstrcmpiW GetLastError DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetFileAttributesW lstrlenW SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW SetFilePointer CreateFileA ReadFile FlushFileBuffers SetStdHandle GetConsoleMode GetConsoleCP LoadLibraryA IsValidLocale InterlockedExchange GetACP GetLocaleInfoA GetVersionExA WideCharToMultiByte Sleep HeapAlloc HeapFree RtlUnwind HeapReAlloc GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA GetProcessHeap LCMapStringA LCMapStringW GetCPInfo VirtualFree VirtualAlloc HeapDestroy HeapCreate GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetOEMCP IsValidCodePage HeapSize SetHandleCount GetFileType GetStartupInfoA CloseHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA

user32

UnregisterClassA CharNextW

advapi32

RegSetValueExA RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegQueryValueExA

shell32

ShellExecuteW

ole32

CoTaskMemRealloc CoTaskMemFree StringFromGUID2 CoCreateInstance CoTaskMemAlloc

oleaut32

LoadRegTypeLi VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

$_2_/BDIEHelper.dll

IMPHASH 24afecf9ba80faee885a9520eacee7e5
SHA256 6b894c1f5de423d08f5f28bcb52c95589c1a474c75f90563606f440d9a668125
MD5 962928acbfb8223c419615ceb8baca5f
SHA1 574e3815ea8683c75a360a6b527d6e27eda68247
SHA512 d656838985cd0641e3e9f268059b5c2f30ef98411867eb28bceb268c0085d559d65a611d0429265e513d4b1e08dc77bcfed6cbb13c5be946dbebd8d05d428980
SSDEEP 3072:H6RB60OcWgk4tUEB5zLi87ief/uM8a7zYWKaqCZrg/vutegfJogtzmIbCCtd:g+cxtCEBtd/pgW7VSuaemoVd
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

PE Signature issue

Digest

41:c4:a6:99:ad:7f:c3:f5:9c:63:ee:2b:ce:d6:c3:37:ba:29:28:4e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Chains

Feb 19, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2012 - Feb 26, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

0

Major OS version

4

Entry point

92965

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\work\code\svn\download\XFPlugin\BDIEPlugin\BDIEHelper\Release\BDIEHelper01.pdb

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

kernel32

GetModuleHandleA GetModuleHandleW GetProcAddress GetFileAttributesW GetVersion RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetLastError lstrcmpiW LoadLibraryW SetLastError GetModuleFileNameW OutputDebugStringA LoadLibraryExW DisableThreadLibraryCalls InterlockedIncrement FreeLibrary SizeofResource LoadResource FindResourceW GetVersionExW DebugBreak OutputDebugStringW GetModuleFileNameA ProcessIdToSessionId GetCurrentProcessId Sleep HeapFree GetProcessHeap CloseHandle WaitForSingleObject CreateSemaphoreW ReleaseSemaphore CreateMutexW ReleaseMutex CreateEventW WaitForMultipleObjects EnumSystemLocalesA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoW GetLocaleInfoA GetConsoleMode GetConsoleCP lstrlenA lstrlenW InterlockedDecrement lstrcpynA WideCharToMultiByte MultiByteToWideChar SetEnvironmentVariableA InterlockedCompareExchange GetThreadLocale LocalFree CreateFileA SetFilePointer LoadLibraryA CompareStringW CompareStringA FlushFileBuffers IsValidLocale GetTimeZoneInformation WriteConsoleW InterlockedExchange SetConsoleCtrlHandler GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP GetCPInfo HeapSize GetCurrentThread GetConsoleOutputCP WriteConsoleA SetStdHandle HeapAlloc RtlUnwind HeapReAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA GetVersionExA FatalAppExitA VirtualFree VirtualAlloc HeapDestroy HeapCreate ExitProcess WriteFile GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree

user32

MsgWaitForMultipleObjects RegisterWindowMessageW GetForegroundWindow GetWindowThreadProcessId IsIconic ShowWindow AttachThreadInput SetForegroundWindow FindWindowExW CharNextW LoadStringW UnregisterClassA

advapi32

ConvertSidToStringSidW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW LookupAccountNameW

shell32

ShellExecuteW

ole32

CoTaskMemAlloc CoCreateInstance StringFromGUID2 CoTaskMemFree CoTaskMemRealloc

oleaut32

SysAllocStringLen SysFreeString CreateErrorInfo SetErrorInfo VariantInit VariantChangeType GetErrorInfo VariantClear LoadRegTypeLi VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysStringLen

shlwapi

PathFileExistsW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

$_2_/BaiduMiniDL.exe

IMPHASH aa9dce58b28ade196dbd4dd7503c2581
SHA256 f2bbf8e694843c144d0df7f26c27105ffff36a7bfbde39811f2740f2339e276f
MD5 1b5c78bd3dfb6f09903e4c48e5aa8e0d
SHA1 3921aa3cb3bae513896c449133d4cfe2c07a338d
SHA512 a9ac7bd7f8433a2f060eec9de29989044d5be96108fe8759b226f095bc68de4cc4467133e839cff6f01df31b7817d79bc84715fcc3374d4f3f2e22407c776446
SSDEEP 12288:clIonLbQxMVthPihCXTDxG2bd+p+cGccpccUccL7cc2ccOcc9cc4AcHc3+ck1H6:clIoLbQQXnZbdTcGccpccUccL7cc2ccu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

c0:d1:25:df:99:10:87:07:ce:d1:4e:23:03:03:a2:bc:73:17:d7:7f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Chains

Feb 19, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2012 - Feb 26, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

0

Major OS version

4

Entry point

287283

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\work\code\svn\download\GameDownloaderOld_Proj\NewDownload\bin\MiniGameDL.pdb

basic

?GetCrashCatcher@CrashCatcher@Utils@@YAPAVICrashCatcher@12@XZ ?Base64DecodeStr@Crypt@Base@@YAHPB_WPA_WHW4CodePage@@@Z ?CreateDirectoryNested@FileMisc@Base@@YAHPB_W@Z ?GetSpecialPath@FileMisc@Base@@YAHPA_WH@Z ?GetSysTempPath@FileMisc@Base@@YAHPA_WK@Z ?WToA@StringUtils@Base@@YAPADPB_WPADH@Z

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

comctl32

InitCommonControlsEx _TrackMouseEvent

report

?ReleaseReportMgr@Report@@YAXPAVIReportMgr@1@@Z ?GetReportMgr@Report@@YAPAVIReportMgr@1@XZ

kernel32

LockResource LoadResource GetLastError FindResourceW IsBadReadPtr OutputDebugStringW TerminateThread SetEvent ResetEvent CreateEventW Sleep SetEnvironmentVariableA CompareStringW CompareStringA GetFullPathNameA GetDriveTypeA ReadFile SetEndOfFile GetTimeZoneInformation CreateFileA SetFilePointer WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW LoadLibraryA SetConsoleCtrlHandler GetCurrentProcessId GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA VirtualAlloc VirtualFree HeapCreate HeapDestroy SetCurrentDirectoryA GetCurrentDirectoryA GetFullPathNameW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA FatalAppExitA FlushFileBuffers GetConsoleMode GetConsoleCP GetStdHandle WriteFile ExitProcess HeapSize IsValidCodePage GetOEMCP GetACP SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA GetStringTypeW GetStringTypeA GetCPInfo LCMapStringW LCMapStringA HeapReAlloc GetStartupInfoW GetProcessHeap HeapAlloc GetVersionExA CreateThread ExitThread HeapFree GetSystemTimeAsFileTime CreateDirectoryW GetDriveTypeW FileTimeToLocalFileTime FileTimeToSystemTime FindClose RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess RaiseException InterlockedExchange InterlockedCompareExchange InterlockedDecrement InterlockedIncrement GetThreadLocale FindFirstFileW ExpandEnvironmentStringsW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId SizeofResource FreeResource GlobalLock GlobalUnlock LoadLibraryW GetProcAddress FreeLibrary WaitForSingleObject MultiByteToWideChar DeleteFileW CopyFileW GetVersionExW GetFileAttributesW GetModuleFileNameW GlobalAlloc GlobalFree GetCurrentThread CreateFileW DeviceIoControl CloseHandle SetThreadLocale GetPrivateProfileIntW GetPrivateProfileStringW lstrcpynW lstrlenW lstrcatW WideCharToMultiByte GetModuleHandleW GetModuleFileNameA GetLocalTime

user32

IsIconic ShowWindow LoadCursorW WindowFromPoint SendMessageTimeoutW SendMessageW DispatchMessageW TranslateMessage FindWindowA UpdateWindow SetRect MessageBoxW LoadImageW EndDialog CreateDialogParamW DialogBoxParamW EnumThreadWindows DrawIcon GetMessageW IsZoomed GetWindowRect GetClassNameW DrawAnimatedRects EnumChildWindows FindWindowW PostMessageW SetForegroundWindow DestroyWindow PostQuitMessage IsWindow FlashWindow SetWindowPos CallWindowProcW SetWindowTextW RegisterWindowMessageW EndPaint GetClientRect BeginPaint EnableWindow GetDlgItem IsDlgButtonChecked SetDlgItemInt GetDlgItemInt SetDlgItemTextW SetFocus CheckDlgButton SendDlgItemMessageW GetDlgItemTextW SetTimer KillTimer LoadIconW DestroyMenu TrackPopupMenu GetCursorPos GetSubMenu LoadMenuW FindWindowExW PtInRect ReleaseDC GetDC DrawTextW OffsetRect InflateRect SetWindowRgn GetActiveWindow RedrawWindow GetClassInfoExW GetSystemMetrics DrawIconEx GetSystemMenu GetMenuState GetWindowTextW SetCursor IsWindowVisible GetClassInfoW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx GetWindow SystemParametersInfoW MapWindowPoints DrawFocusRect GetParent ClientToScreen DefWindowProcW RegisterClassExW SetWindowLongW GetWindowLongW IntersectRect CreateWindowExW InvalidateRect GetWindowDC GetCapture SetCapture ScreenToClient ReleaseCapture

gdi32

CreateFontIndirectW CreateSolidBrush CombineRgn CreateRoundRectRgn CreateRectRgn ExcludeClipRect CreateDIBSection GetClipBox CreateCompatibleBitmap StretchBlt CreateCompatibleDC BitBlt DeleteDC Rectangle SetBkColor ExtTextOutW CreateRectRgnIndirect SelectClipRgn RoundRect MoveToEx CreatePen LineTo SelectObject GetTextExtentPoint32W GetStockObject DeleteObject SetTextColor SetBkMode

advapi32

RegCloseKey MapGenericMask RevertToSelf OpenThreadToken ImpersonateSelf GetFileSecurityW RegSetValueExW RegOpenKeyW RegDeleteValueW RegDeleteKeyW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW AccessCheck

shell32

SHBrowseForFolderW Shell_NotifyIconW ShellExecuteExW ExtractIconExW SHGetSpecialFolderPathW ShellExecuteW SHGetPathFromIDListW SHGetMalloc

ole32

CoMarshalInterThreadInterfaceInStream CoUninitialize CoGetInterfaceAndReleaseStream CreateStreamOnHGlobal CLSIDFromProgID CoLoadLibrary CoFreeLibrary CoInitializeEx

oleaut32

SysAllocStringByteLen SysAllocString SysFreeString SysStringLen

shlwapi

wnsprintfW

gdiplus

GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipLoadImageFromFileICM GdipLoadImageFromFile GdipCloneImage GdipCloneBrush GdipCloneBitmapAreaI GdipCreateFont GdipDrawImageRectRectI GdipDrawString GdipCreateFromHDC GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipCreateSolidFill GdipBitmapUnlockBits GdipGetPropertyItemSize GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromHICON GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipDeleteFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDeleteGraphics GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteBrush GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipGetPropertyItem GdipDrawImageRectI GdipLoadImageFromStreamICM GdipBitmapLockBits

$_2_/Basic.dll

IMPHASH 1de3f519a06d8c888dfb8e63b37093bf
SHA256 7d0b68fa571ab446ce2622c220644bfe7f61f72020e70bbdb138458b0dd06ce1
MD5 68126329883772fc76c11c9330d59f10
SHA1 9bb01572084607ceeb11525b14eb187b91acec8d
SHA512 d8a9bd76bd7ef9a739b4249725a8abb48c5c89487470386b488af4f0a0a5fcaed08ee86167bae041d770fdcd9992ea820a7395daceb5070b240c0f2412e21b13
SSDEEP 6144:LpI+a0pZIsSuBszVmc2pL7NgiNuWmlzSYW0brAmIolnClveTB6kxixTZ5uP:FIsZ0Ac2p3rNuWKZX3nClveTST3uP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

17:b2:c3:d4:a3:05:5b:a3:c9:e8:5e:9d:df:9e:00:4f:3d:95:90:c7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Chains

Feb 19, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2012 - Feb 26, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

0

Major OS version

4

Entry point

206168

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\work\code\svn\download\GameDownloaderOld_Proj\NewDownload\bin\basic.pdb

psapi

GetModuleFileNameExW EnumProcessModules EnumProcesses GetModuleBaseNameW

iphlpapi

GetIpForwardTable

wininet

InternetCrackUrlW

kernel32

GetFileTime ReadFile SetFilePointer LoadResource LockResource SizeofResource FindResourceW FindResourceExW MoveFileExW DeleteFileW GlobalLock GlobalUnlock CopyFileW GetCurrentDirectoryW GlobalAlloc RemoveDirectoryW GetCurrentProcess GetWindowsDirectoryW WriteFile GetModuleHandleW GetProcessHeap HeapAlloc HeapFree ExpandEnvironmentStringsW GetSystemDirectoryW GetTempPathW Sleep GetTickCount GetSystemInfo GetComputerNameW GetVersionExW GetDriveTypeW LoadLibraryW CreateFileA CreateFileMappingW MapViewOfFile UnmapViewOfFile DeviceIoControl InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection VirtualAlloc VirtualFree FileTimeToLocalFileTime FileTimeToDosDateTime GetFileSizeEx DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime GetBinaryTypeW IsBadReadPtr GetSystemWow64DirectoryW GetSystemWindowsDirectoryW MoveFileW DebugBreak WaitForSingleObject CreateMutexW ReleaseMutex SetFileAttributesW lstrlenW GetCommandLineW SetUnhandledExceptionFilter TlsAlloc GetCurrentProcessId GetCurrentThreadId SetErrorMode CreateEventW SearchPathW DuplicateHandle CreateProcessW WaitForMultipleObjects TerminateProcess ExitProcess TlsGetValue TlsSetValue GetProcessTimes GetSystemTime SystemTimeToFileTime GlobalMemoryStatusEx RaiseException VirtualAllocEx OpenProcess lstrcmpiW GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount GetCurrentDirectoryA GetFullPathNameW GetModuleFileNameA GetStdHandle HeapCreate HeapDestroy HeapSize SetLastError LoadLibraryA TlsFree GetModuleHandleA IsValidCodePage GetOEMCP GetACP GetTimeZoneInformation LCMapStringW LCMapStringA RtlUnwind GetVersionExA GetCommandLineA HeapReAlloc GetSystemTimeAsFileTime GetFileAttributesW CloseHandle CreateFileW lstrcpynW lstrcpynA CreateDirectoryW FreeLibrary InterlockedIncrement GetProcAddress SetEndOfFile GetDriveTypeA FindClose FindNextFileW FindFirstFileW GetFileSize GetModuleFileNameW FormatMessageW IsDBCSLeadByte GetCPInfo FileTimeToSystemTime WideCharToMultiByte MultiByteToWideChar GetLastError CompareStringA CompareStringW SetEnvironmentVariableA GetThreadLocale GetStringTypeW EnumSystemLocalesA IsValidLocale InterlockedDecrement QueryPerformanceCounter IsDebuggerPresent UnhandledExceptionFilter InterlockedExchange GetLocaleInfoW SetStdHandle FlushFileBuffers WriteConsoleA GetUserDefaultLCID GetLocaleInfoA WriteConsoleW GetConsoleOutputCP GetStringTypeA

user32

GetParent GetWindowLongW SystemParametersInfoW MessageBoxW SetWindowLongW EnableWindow FindWindowExW SetWindowTextW SendMessageW SetWindowPos GetClientRect SetActiveWindow SetForegroundWindow ExitWindowsEx GetWindowRect GetWindowTextW GetClassNameW GetDesktopWindow IsWindowVisible IsWindow GetSystemMetrics EnumWindows IsIconic LoadBitmapW LoadImageW SetClipboardData CloseClipboard EmptyClipboard OpenClipboard DestroyIcon ShowWindow UnregisterClassA

gdi32

CreateDCW GetObjectW DeleteDC DeleteObject GetDeviceCaps

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegCreateKeyExW RegOpenKeyExA RegQueryValueExA RegDeleteValueW AdjustTokenPrivileges LookupPrivilegeValueW RegEnumValueW GetUserNameW FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl GetLengthSid AllocateAndInitializeSid OpenProcessToken SetFileSecurityW RegQueryValueExW RegOpenKeyExW RegCloseKey RegDeleteKeyW

shell32

SHCreateDirectoryExW ShellExecuteExW ShellExecuteW SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetDesktopFolder SHBrowseForFolderW SHGetSpecialFolderPathW SHGetFolderPathW DuplicateIcon

ole32

StgIsStorageFile CoInitialize CoUninitialize StgOpenStorage StgCreateDocfile CreateStreamOnHGlobal CoCreateInstance

oleaut32

OleCreatePictureIndirect SysStringLen SysAllocStringLen

shlwapi

PathFileExistsW PathIsDirectoryW PathRemoveFileSpecW StrCpyNW StrRChrW StrStrIW PathAppendW PathFindFileNameW StrRChrIW PathAddBackslashW PathFindExtensionW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

netapi32

Netbios

??0?$EnableIntrusive@VCConfig@Config@Utils@@@@QAE@XZ ??0CConfig@Config@Utils@@QAE@XZ ??0CShortcut@FileMisc@Base@@QAE@ABV012@@Z ??0CShortcut@FileMisc@Base@@QAE@H@Z ??0CShortcut@FileMisc@Base@@QAE@PB_WH@Z ??0CWin64Helper@Win64Helper@Base@@QAE@XZ ??0CWow64FsRedrt@Win64Helper@Base@@QAE@XZ ??0FileDefaultIconPicker@FileMisc@Base@@QAE@XZ ??0IShortcut@FileMisc@Base@@QAE@ABV012@@Z ??0IShortcut@FileMisc@Base@@QAE@XZ ??0md5_engine@Base@@QAE@XZ ??1CConfig@Config@Utils@@MAE@XZ ??1CShortcut@FileMisc@Base@@UAE@XZ ??1CWin64Helper@Win64Helper@Base@@QAE@XZ ??1CWow64FsRedrt@Win64Helper@Base@@QAE@XZ ??1FileDefaultIconPicker@FileMisc@Base@@QAE@XZ ??4CShortcut@FileMisc@Base@@QAEAAV012@ABV012@@Z ??4CWin64Helper@Win64Helper@Base@@QAEAAV012@ABV012@@Z ??4CWow64FsRedrt@Win64Helper@Base@@QAEAAV012@ABV012@@Z ??4FileDefaultIconPicker@FileMisc@Base@@QAEAAV012@ABV012@@Z ??4IShortcut@FileMisc@Base@@QAEAAV012@ABV012@@Z ??4tagLANGANDCODEPAGE@@QAEAAU0@ABU0@@Z ??_7CConfig@Config@Utils@@6B@ ??_7CShortcut@FileMisc@Base@@6B@ ??_7IShortcut@FileMisc@Base@@6B@ ??_FCShortcut@FileMisc@Base@@QAEXXZ ?AToBSTR@StringUtils@Base@@YAPA_WABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?AToBSTR@StringUtils@Base@@YAPA_WPBDI@Z ?AToUTF8@StringUtils@Base@@YAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@DV?$allocator@D@std@@@4@@Z ?AToW@StringUtils@Base@@YAPA_WABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_WH@Z ?AToW@StringUtils@Base@@YAPA_WPBDIPA_WH@Z ?AToW@StringUtils@Base@@YAPA_WPBDPA_WH@Z ?AToW@StringUtils@Base@@YAPB_WPBDHPA_WHK@Z ?AToW@StringUtils@Base@@YAPB_WPBDPA_WHK@Z ?ActivePopupChild@SysMisc@Base@@YAPAUHWND__@@PAU3@@Z ?AddFileToZip@ZipUnZip@Base@@YAHPAXPB_W1@Z ?AddMemoryToZip@ZipUnZip@Base@@YAHPAXPB_W0H@Z ?AddRef@CConfig@Config@Utils@@UAGKXZ ?AddZipMemoryToZip@ZipUnZip@Base@@YAHPAXPB_W0HH@Z ?BSTRToA@StringUtils@Base@@YAPADQA_WPADH@Z ?BSTRToW@StringUtils@Base@@YAPA_WQA_WPA_WH@Z ?Base64Decode@Crypt@Base@@YAHPBEHPAEPAH@Z ?Base64DecodeStr@Crypt@Base@@YAHPB_WPA_WHW4CodePage@@@Z ?Base64Encode@Crypt@Base@@YAHPBEHPAEPAH@Z ?Base64EncodeStr@Crypt@Base@@YAHPB_WPA_WHW4CodePage@@@Z ?BuildEveryoneSD@FileMisc@Base@@YAPAXKPAX@Z ?ByteToHexA@StringUtils@Base@@YAHEPADH@Z ?ByteToHexW@StringUtils@Base@@YAHEPA_WH@Z ?BytesToStringW@StringUtils@Base@@YAHPBEIPA_WH@Z ?CRC32@MD5@Base@@YGKPBEHK@Z ?CRC32@MD5@Base@@YGKPB_WK@Z ?CheckFullScreenWindow@SysMisc@Base@@YAHAAHPAPAUHWND__@@@Z ?Close@CWow64FsRedrt@Win64Helper@Base@@QAEHXZ ?CloseZip@ZipUnZip@Base@@YAXPAX_N@Z ?CloseZipFile@ZipUnZip@Base@@YAXPAX@Z ?Compress@ZipUnZip@Base@@YAHPBXHPAXHAAK@Z ?CopyFilePath@FileMisc@Base@@YAXPB_W@Z ?CopyFilePath@FileMisc@Base@@YAXV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?CopyFileW@FileMisc@Base@@YAHPB_W0H@Z ?CopyTextToClipboard@SysMisc@Base@@YAHPB_W@Z ?CreateDir@FileMisc@Base@@YAHPB_W@Z ?CreateDirectoryNested@FileMisc@Base@@YAHPB_W@Z ?CreateFileNoRedirect@CWin64Helper@Win64Helper@Base@@QAEPAXPB_WKKPAU_SECURITY_ATTRIBUTES@@KKPAX@Z ?CreateShortCut@FileMisc@Base@@YAHPB_W00000HGH@Z ?CreateZip@ZipUnZip@Base@@YAPAXPB_W_N@Z ?CreateZipFile@ZipUnZip@Base@@YAPAXPB_W@Z ?DecryptBuffer@CConfig@Config@Utils@@AAEHPAEK@Z ?DeleteFileAfterReboot@FileMisc@Base@@YAXPA_W@Z ?DeleteFileEx@FileMisc@Base@@YAHPB_W@Z ?DeleteFileNoRedirect@CWin64Helper@Win64Helper@Base@@QAEHPB_W@Z ?DirSelectDlg@SysMisc@Base@@YAHPAUHWND__@@PA_WHPAUHICON__@@HPB_W333IPAH@Z ?DirSelectDlgSimple@SysMisc@Base@@YAHPAUHWND__@@PA_WHPAUHICON__@@PB_W3@Z ?DisableFileRedirect@CWin64Helper@Win64Helper@Base@@QAEHXZ ?DllGetVersion@FileMisc@Base@@YAHPB_WAAU_DLLVERSIONINFO@@@Z ?EncryptBuffer@CConfig@Config@Utils@@AAEHPAEK@Z ?EnumFileOfDir@FileMisc@Base@@YAHPB_WAAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@HPA_W@Z ?EnumFolderOfDir@FileMisc@Base@@YAHPB_WAAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z ?FileGetDefaultIcon@FileDefaultIconPicker@FileMisc@Base@@SAPAUHICON__@@PB_W@Z ?FileSelectDlg@SysMisc@Base@@YAHPA_WPB_W11HPAUHWND__@@1@Z ?FlushDNS@SysMisc@Base@@YAHXZ ?ForbidLoadLibrarySearchCurrentDirectory@Library@Base@@YAXXZ ?FormatFileSize@FileMisc@Base@@YAHKPA_WK@Z ?FormatString@StringUtils@Base@@YAHPADHPBDZZ ?FormatString@StringUtils@Base@@YAHPA_WHPB_WZZ ?FormatString@StringUtils@Base@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDZZ ?FormatString@StringUtils@Base@@YAXAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_WZZ ?FormatToSysTime@StringUtils@Base@@YAHPAU_SYSTEMTIME@@PBU_FILETIME@@@Z ?FormatToSysTime@StringUtils@Base@@YAHPAU_SYSTEMTIME@@PB_J@Z ?GetAccountStorePath@Misc@Utils@@YAHPA_W_K@Z ?GetAllAccessSecurityAttributes@SysMisc@Base@@YAPBU_SECURITY_ATTRIBUTES@@XZ ?GetAllAccessSecurityAttributesEx@SysMisc@Base@@YAHAAU_SECURITY_ATTRIBUTES@@AAU_SECURITY_DESCRIPTOR@@@Z ?GetAppdataFolderNotWithSlash@Misc@Utils@@YAPB_WXZ ?GetArgs@CShortcut@FileMisc@Base@@UAEHPA_WH@Z ?GetBitmapSize@FileMisc@Base@@YAHIPAJ0@Z ?GetBitmapSize@FileMisc@Base@@YAHPAUHBITMAP__@@PAJ1@Z ?GetBufferMd5@MD5@Base@@YGHPBEHPAE@Z ?GetBufferMd5@MD5@Base@@YGHPBEHPA_W@Z ?GetBufferMd5A@MD5@Base@@YGHPBEHPAD@Z ?GetBufferMd5W@MD5@Base@@YGHPBEHPA_W@Z ?GetBuildVer@Misc@Utils@@YAIXZ ?GetCommonCfgContext@CConfig@Config@Utils@@AAEJPB_WPAXKPAK@Z ?GetComputerNameW@SysMisc@Base@@YAHPA_WK@Z ?GetCrashCatcher@CrashCatcher@Utils@@YAPAVICrashCatcher@12@XZ ?GetCurFile@CShortcut@FileMisc@Base@@UAEHPA_WH@Z ?GetCurPEVersionA@FileMisc@Base@@YAHPADHPB_W@Z ?GetCurPathRootPath@FileMisc@Base@@YAHPA_WKK@Z ?GetCurrentProcessPath@FileMisc@Base@@YAHPA_WK@Z ?GetDefaultBrowser@SysMisc@Base@@YAHPA_WPAK@Z ?GetDesc@CShortcut@FileMisc@Base@@UAEHPA_WH@Z ?GetDir@CShortcut@FileMisc@Base@@UAEHPA_WH@Z ?GetDrTempFile@FileMisc@Base@@YAHPA_WHPB_W1@Z ?GetDstVersionByStr@Misc@Utils@@YAIABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?GetExeFileName@Misc@Utils@@YAPB_WXZ ?GetExeFolderNotWithSlash@Misc@Utils@@YAPB_WXZ ?GetFileInfo@FileMisc@Base@@YAHPB_WPA_W11@Z ?GetFileMD5@MD5@Base@@YGHPB_WPAE@Z ?GetFileMD5@MD5@Base@@YGHPB_WPA_W@Z ?GetFileMD5A@MD5@Base@@YGHPBDPAD@Z ?GetFileMD5A@MD5@Base@@YGHPBDPAE@Z ?GetFileMD5W@MD5@Base@@YGHPB_WPAE@Z ?GetFileMD5W@MD5@Base@@YGHPB_WPA_W@Z ?GetFileSingleInfo@FileMisc@Base@@YAHPB_W0PA_WPAH@Z ?GetFileSizeEx@FileMisc@Base@@YAKPB_W@Z ?GetFileSizeWow64@Win64Helper@Base@@YG_KPB_W@Z ?GetFileTimeFlex@FileMisc@Base@@YAHPB_WPAU_FILETIME@@11@Z ?GetFileVerInfoA@FileMisc@Base@@YAHPBDPADH@Z ?GetFileVerInfoW@FileMisc@Base@@YAHPB_WPA_WH@Z ?GetFileVersion@FileMisc@Base@@YAHPB_WAAI111@Z ?GetFolderSize@FileMisc@Base@@YA_KPB_WPAK1@Z ?GetGuid@GUID@Base@@YGHPAEH@Z ?GetGuid@GUID@Base@@YGHPA_WH@Z ?GetGuidA@GUID@Base@@YGHPADH@Z ?GetGuidW@GUID@Base@@YGHPA_WH@Z ?GetHotKey@CShortcut@FileMisc@Base@@UAEHPAG@Z ?GetIEFullPath@SysMisc@Base@@YAHPA_WPAK@Z ?GetIEHistoryPath@FileMisc@Base@@YAHPA_WK@Z ?GetIETempPath@FileMisc@Base@@YAHPA_WK@Z ?GetIEVersion@FileMisc@Base@@YAJXZ ?GetIco@CShortcut@FileMisc@Base@@UAEHPA_WHPAH@Z ?GetIcon@FileMisc@Base@@YAPAUHICON__@@HI@Z ?GetInstallDir@Misc@Utils@@YAHPA_WK@Z ?GetInstallRegPath@Misc@Utils@@YAHPAPAUHKEY__@@PA_WK@Z ?GetInstallVer@Misc@Utils@@YAHPADK@Z ?GetInstallVer@Misc@Utils@@YAHPA_WK@Z ?GetKeyRedirectInfo@CWin64Helper@Win64Helper@Base@@QAEHPAUHKEY__@@PB_WAAI@Z ?GetLastErrorMessage@StringUtils@Base@@YAHKPA_WH@Z ?GetList@CShortcut@FileMisc@Base@@UAEHPAPAU_ITEMIDLIST@@@Z ?GetLocalPath@FileMisc@Base@@YAHPA_WPAK@Z ?GetMainPath@FileMisc@Base@@YAHPA_WKH@Z ?GetMaxCharSize@StringUtils@Base@@YAHXZ ?GetModuleDirectory@Misc@Utils@@YAPA_WPA_WH@Z ?GetModuleFileNameW@FileMisc@Base@@YAHPA_WKPAUHINSTANCE__@@@Z ?GetNativeSystemDir@CWin64Helper@Win64Helper@Base@@QAEIPA_WI@Z ?GetNumberVerFromStringVer@FileMisc@Base@@YAHPAI000PB_W@Z ?GetOSVersion@SysMisc@Base@@YAHAAI0@Z ?GetOSVersion@SysMisc@Base@@YAJXZ ?GetOSVersionEx@SysMisc@Base@@YAJAAK0@Z ?GetPEVersion@FileMisc@Base@@YAHPAI000PB_W@Z ?GetPath@CShortcut@FileMisc@Base@@UAEHPA_WHPAU_WIN32_FIND_DATAW@@K@Z ?GetProcessorsCount@SysMisc@Base@@YAKXZ ?GetRealPathInX64@Win64Helper@Base@@YGHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_WH@Z ?GetScreenSize@SysMisc@Base@@YAJH@Z ?GetShortCutInfo@FileMisc@Base@@YAHPB_WPA_W1111PAHPAG2@Z ?GetShow@CShortcut@FileMisc@Base@@UAEHPAH@Z ?GetSoftID@Misc@Utils@@YAIXZ ?GetSpecialPath@FileMisc@Base@@YAHPA_WH@Z ?GetStorePath@Misc@Utils@@YAHPA_W@Z ?GetSupplyID@Misc@Utils@@YAHAAH@Z ?GetSysTempPath@FileMisc@Base@@YAHPA_WK@Z ?GetSystemDirectoryW@FileMisc@Base@@YAHPA_WK@Z ?GetUserNameW@SysMisc@Base@@YAHPA_WK@Z ?GetUserStorePath@Misc@Utils@@YAHPA_W@Z ?GetWindowsVersion@SysMisc@Base@@YAHAAKPA_WH@Z ?GetWow64Dir@CWin64Helper@Win64Helper@Base@@QAEIPA_WI@Z ?GuidToStringA@StringUtils@Base@@YAHU_GUID@@PADH@Z ?GuidToStringW@StringUtils@Base@@YAHU_GUID@@PA_WH@Z ?Init@CConfig@Config@Utils@@UAEHHPB_W@Z ?Init@CConfig@Config@Utils@@UAGJPAX@Z ?Init@CShortcut@FileMisc@Base@@IAEHXZ ?Init@CWin64Helper@Win64Helper@Base@@QAEHXZ ?Init@CWow64FsRedrt@Win64Helper@Base@@QAEHXZ ?Is64BitModule2@CWin64Helper@Win64Helper@Base@@QAEHPB_W@Z ?Is64BitModule@CWin64Helper@Win64Helper@Base@@QAEHPB_W@Z ?Is64BitWindows@CWin64Helper@Win64Helper@Base@@QAEHXZ ?IsChange@CShortcut@FileMisc@Base@@UAEHXZ ?IsDirectoryExist@FileMisc@Base@@YAHPB_W@Z ?IsFileChangable@FileMisc@Base@@YAHPB_W@Z ?IsFileExist@FileMisc@Base@@YAHPB_W@Z ?IsFileUsing@FileMisc@Base@@YAHPB_W@Z ?IsFsRedirectEnabled@CWin64Helper@Win64Helper@Base@@QAEHXZ ?IsFullScreenWnd@SysMisc@Base@@YAHPAUHWND__@@@Z ?IsInternetOK@SysMisc@Base@@YAHXZ ?IsKeyRedirect@CWin64Helper@Win64Helper@Base@@QAEHPAUHKEY__@@PB_W@Z ?IsNetWorkOK@SysMisc@Base@@YAHXZ ?IsOSNeedElevate@SysMisc@Base@@YAHXZ ?IsPEFile@FileMisc@Base@@YAHPB_W@Z ?IsPathDir@FileMisc@Base@@YAHPB_WAAH@Z ?IsPathFile@FileMisc@Base@@YAHPB_WAAH@Z ?IsPathString@FileMisc@Base@@YAHPB_W@Z ?IsValidChar@StringUtils@Base@@YAH_W@Z ?IsValidEmail@StringUtils@Base@@YAHPB_W@Z ?IsVistaSystem@SysMisc@Base@@YAHXZ ?IsWin64Native@CWin64Helper@Win64Helper@Base@@QAEHXZ ?IsWoW64Process@CWin64Helper@Win64Helper@Base@@QAEHXZ ?IsX64System@Win64Helper@Base@@YGHAAH@Z ?Load@CShortcut@FileMisc@Base@@UAEHPB_W@Z ?LoadIconWithSize@FileMisc@Base@@YAPAUHICON__@@IHHPAUHINSTANCE__@@@Z ?Md5ToString@MD5@Base@@YGXPBEPA_W@Z ?Md5ToStringA@MD5@Base@@YGXPBEPAD@Z ?Md5ToStringW@MD5@Base@@YGXPBEPA_W@Z ?ModifyShortCut@FileMisc@Base@@YAHPB_W000000HGH@Z ?MoveCompressedDataToMemory@ZipUnZip@Base@@YAHPB_WAAV?$vector@UZipCompressedData@@V?$allocator@UZipCompressedData@@@std@@@std@@@Z ?MoveDirectory@FileMisc@Base@@YAHPB_W0@Z ?MoveFileExNoRedirect@CWin64Helper@Win64Helper@Base@@QAEHPB_W0K@Z ?MoveFileNoRedirect@CWin64Helper@Win64Helper@Base@@QAEHPB_W0@Z ?MultiByteToUnicode@StringUtils@Base@@YGPA_WPA_WPBDH@Z ?MultiByteToUnicode@StringUtils@Base@@YGPA_WPA_WPBDHI@Z ?Open@CWow64FsRedrt@Win64Helper@Base@@QAEHXZ ?OpenRecycle@FileMisc@Base@@YAHXZ ?OpenURL@SysMisc@Base@@YAHPB_W@Z ?PathFileExistsInX64@Win64Helper@Base@@YGHPB_W@Z ?PathIsRedirected@CWin64Helper@Win64Helper@Base@@QAEHPB_W@Z ?PowerOff@SysMisc@Base@@YAXXZ ?RC4Decrypt@Crypt@Base@@YGHPBEHPAEH0H@Z ?RC4Encrypt@Crypt@Base@@YGHPBEHPAEH0H@Z ?Read@CConfig@Config@Utils@@UAEHPB_WPAXKPAK@Z ?ReadInternal@CConfig@Config@Utils@@AAEHPB_WPAXKPAK@Z ?RebootComputer@SysMisc@Base@@YAHXZ ?RegCreateKeyExNoRedirect@CWin64Helper@Win64Helper@Base@@QAEJPAUHKEY__@@PB_WKPA_WKKPAU_SECURITY_ATTRIBUTES@@PAPAU4@PAK@Z ?RegDeleteKeyNoRedirect@CWin64Helper@Win64Helper@Base@@QAEJPAUHKEY__@@PB_W@Z ?RegOpenKeyExNoRedirect@CWin64Helper@Win64Helper@Base@@QAEJPAUHKEY__@@PB_WKKPAPAU4@@Z ?Release@CConfig@Config@Utils@@UAGKXZ ?RemoveCompatibleMode@SysMisc@Base@@YAHPB_W@Z ?ReplaceString@StringUtils@Base@@YAIAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@1@Z ?Resolve@CShortcut@FileMisc@Base@@UAEHPAUHWND__@@K@Z ?RevertFileRedirect@CWin64Helper@Win64Helper@Base@@QAEHXZ ?SafeLoadLibrary@Library@Base@@YAPAUHINSTANCE__@@PB_WH@Z ?Save@CShortcut@FileMisc@Base@@UAEHPB_WH@Z ?SaveCompleted@CShortcut@FileMisc@Base@@UAEHPB_W@Z ?SaveIconToFile@FileMisc@Base@@YAHPAUHICON__@@PB_W@Z ?SetArgs@CShortcut@FileMisc@Base@@UAEHPB_W@Z ?SetAutoSave@CShortcut@FileMisc@Base@@UAEHH@Z ?SetClientSize@SysMisc@Base@@YAXPAUHWND__@@HH@Z ?SetCommonCfgContext@CConfig@Config@Utils@@AAEJPB_WPAXKPAK@Z ?SetConfigFilePath@CConfig@Config@Utils@@AAEJPA_WH@Z ?SetConfigRootDir@CConfig@Config@Utils@@CAXPB_W@Z ?SetDesc@CShortcut@FileMisc@Base@@UAEHPB_W@Z ?SetDir@CShortcut@FileMisc@Base@@UAEHPB_W@Z ?SetFileSecurityW@FileMisc@Base@@YAHPB_WK@Z ?SetHistoryPath@FileMisc@Base@@YAHPB_W@Z ?SetHotKey@CShortcut@FileMisc@Base@@UAEHG@Z ?SetIco@CShortcut@FileMisc@Base@@UAEHPB_WH@Z ?SetIconDefault@FileDefaultIconPicker@FileMisc@Base@@SAXPAUHICON__@@00@Z ?SetInternetCachePath@FileMisc@Base@@YAHPB_W@Z ?SetList@CShortcut@FileMisc@Base@@UAEHPBU_ITEMIDLIST@@@Z ?SetPath@CShortcut@FileMisc@Base@@UAEHPB_W@Z ?SetRelPath@CShortcut@FileMisc@Base@@UAEHPB_W@Z ?SetShow@CShortcut@FileMisc@Base@@UAEHH@Z ?SetSpecailFolderPath@FileMisc@Base@@YAHHPB_W@Z ?SplitStringW@StringUtils@Base@@YAHPB_W_WPA_WKPAKI@Z ?Sprintf@StringUtils@Base@@YAHPADHPBDZZ ?Sprintf@StringUtils@Base@@YAHPA_WHPB_WZZ ?Strcat@StringUtils@Base@@YAHPADHPBD@Z ?Strcat@StringUtils@Base@@YAHPA_WHPB_W@Z ?Strcpy@StringUtils@Base@@YAHPADHPBD@Z ?Strcpy@StringUtils@Base@@YAHPA_WHPB_W@Z ?StringToBytesW@StringUtils@Base@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAEI@Z ?StringToDate@StringUtils@Base@@YAHPB_WAA_J@Z ?StringToGuid@StringUtils@Base@@YAHPB_WPAU_GUID@@@Z ?StringToMd5@MD5@Base@@YGXPB_WPAE@Z ?StripLeading@StringUtils@Base@@YAPA_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_WPA_WH@Z ?StripTrailing@StringUtils@Base@@YAPA_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_WPA_WH@Z ?Strlen@StringUtils@Base@@YAHPBD@Z ?Strlen@StringUtils@Base@@YAHPB_W@Z ?Strncpy@StringUtils@Base@@YAHPADHPBDH@Z ?Strncpy@StringUtils@Base@@YAHPA_WHPB_WH@Z ?TeaDecrypt4bytesAFrame@Crypt@Base@@YAXPAF0@Z ?TeaDecryptCBC2@Crypt@Base@@YAHPBEH0PAEPAH@Z ?TeaDecryptCBC2Len@Crypt@Base@@YAHPBEH0@Z ?TeaDecryptCBC@Crypt@Base@@YAHPBEH0PAEPAH@Z ?TeaDecryptECB@Crypt@Base@@YAXPBE0PAE@Z ?TeaEncrypt4bytesAFrame@Crypt@Base@@YAXPAF0@Z ?TeaEncryptCBC2@Crypt@Base@@YAXPBEH0PAEPAH@Z ?TeaEncryptCBC2Len@Crypt@Base@@YAHH@Z ?TeaEncryptCBC@Crypt@Base@@YAXPBEH0PAEPAH@Z ?TeaEncryptECB@Crypt@Base@@YAXPBE0PAE@Z ?ToLowerA@StringUtils@Base@@YAPADABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PADH@Z ?ToLowerW@StringUtils@Base@@YAPA_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_WH@Z ?ToUpperA@StringUtils@Base@@YAPADABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PADH@Z ?ToUpperW@StringUtils@Base@@YAPA_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_WH@Z ?TrimString@StringUtils@Base@@YAIABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_WH_W@Z ?UTF8AToW@StringUtils@Base@@YAPA_WABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_WH@Z ?UTF8ToA@StringUtils@Base@@YAPADABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PADH@Z ?UTF8WToA@StringUtils@Base@@YAHPB_WAAV?$vector@DV?$allocator@D@std@@@std@@@Z ?UnInit@CConfig@Config@Utils@@UAGJPAX@Z ?Uncompress@ZipUnZip@Base@@YAXPBXHPAXHPAK@Z ?UnicodeToMultiByte@StringUtils@Base@@YGPADPADPB_WH@Z ?UnicodeToMultiByte@StringUtils@Base@@YGPADPADPB_WHI@Z ?Uninit@CShortcut@FileMisc@Base@@IAEHXZ ?Uninit@CWin64Helper@Win64Helper@Base@@QAEHXZ ?Uninit@CWow64FsRedrt@Win64Helper@Base@@QAEHXZ ?UnzipFileToDisk@ZipUnZip@Base@@YAHPB_W0@Z ?ViewFileFolderProperties@FileMisc@Base@@YAHPB_W@Z ?Vsprintf@StringUtils@Base@@YAHPADHPBD0@Z ?Vsprintf@StringUtils@Base@@YAHPA_WHPB_WPAD@Z ?WToA@StringUtils@Base@@YAPADABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PADH@Z ?WToA@StringUtils@Base@@YAPADPB_WIPADH@Z ?WToA@StringUtils@Base@@YAPADPB_WPADH@Z ?WToA@StringUtils@Base@@YAPBDPB_WHPADHK@Z ?WToA@StringUtils@Base@@YAPBDPB_WPADHK@Z ?WToBSTR@StringUtils@Base@@YAPA_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?Wildcmp@StringUtils@Base@@YAHPB_W0H@Z ?Write@CConfig@Config@Utils@@UAEHPB_WPAXK@Z ?WriteInternal@CConfig@Config@Utils@@AAEHPB_WPAXK@Z ?ZipCompress@ZipUnZip@Base@@YAHPAXPB_W_N@Z ?ZipExtract@ZipUnZip@Base@@YAHPAXPB_WK@Z ?add_ref@?$EnableIntrusive@VCConfig@Config@Utils@@@@QAEJXZ ?dec_ref@?$EnableIntrusive@VCConfig@Config@Utils@@@@QAEJXZ ?digest@md5_engine@Base@@QAEXPBXIPAX@Z ?final@md5_engine@Base@@QAEXPAX@Z ?init@md5_engine@Base@@QAEXXZ ?m_pFileDefaultIconPickerStub@FileDefaultIconPicker@FileMisc@Base@@0PAVFileDefaultIconPickerStub@123@A ?process_block@md5_engine@Base@@AAEXPAY0EA@$$CBE@Z ?ref_count@?$EnableIntrusive@VCConfig@Config@Utils@@@@QBEJXZ ?s_tszConfigRootDir@CConfig@Config@Utils@@0PA_WA ?update@md5_engine@Base@@QAEXPBXI@Z ?zAddFileToZip@ZipUnZip@Base@@YAHPAXPB_W1_N@Z ?zUnzipFileToDisk@ZipUnZip@Base@@YAHPAXPB_W1@Z

$_2_/BugReport.exe

IMPHASH 8c079918f03177c71ce7077540009e0c
SHA256 25b2ce910fb6ed97fafe156f5fdc390db01f50199550d51b4238d4fb7031bae0
MD5 d5d03edcc5d7224b7f81855277fef8e6
SHA1 990f4cb87bf7e082da390a02ffd7def04f49efde
SHA512 4c80b9d79f6f5a75faab64595aa56029b0b6d70ccb7c06a5aea219c22cf0260c34a8e5af24799e1b30a2da783f531181112a32761154bc1431743128cdc5fe2a
SSDEEP 6144:Myk7i0iyIFdMoGVubVzKf7G2hxcGccpccUccL7cc2ccOcc9cc4VcbcoHcIyO:Myk79ixFyoGMBOf7fDcGccpccUccL7cY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

fd:32:d3:53:36:4f:26:aa:76:e2:28:f4:fc:ac:25:10:e8:c5:1f:40

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Chains

Feb 19, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2012 - Feb 26, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

0

Major OS version

4

Entry point

95149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\work\code\svn\download\GameDownloaderOld_Proj\NewDownload\bin\BugReport.pdb

basic

?Release@CConfig@Config@Utils@@UAGKXZ ?AddRef@CConfig@Config@Utils@@UAGKXZ ?Init@CConfig@Config@Utils@@UAEHHPB_W@Z ?Write@CConfig@Config@Utils@@UAEHPB_WPAXK@Z ?Read@CConfig@Config@Utils@@UAEHPB_WPAXKPAK@Z ??0CConfig@Config@Utils@@QAE@XZ ??1CConfig@Config@Utils@@MAE@XZ ?GetFileMD5@MD5@Base@@YGHPB_WPAE@Z ?Md5ToStringA@MD5@Base@@YGXPBEPAD@Z ?Init@CConfig@Config@Utils@@UAGJPAX@Z ?Compress@ZipUnZip@Base@@YAHPBXHPAXHAAK@Z ?CreateZip@ZipUnZip@Base@@YAPAXPB_W_N@Z ?ZipCompress@ZipUnZip@Base@@YAHPAXPB_W_N@Z ?CloseZip@ZipUnZip@Base@@YAXPAX_N@Z ?GetBufferMd5@MD5@Base@@YGHPBEHPAE@Z ?SafeLoadLibrary@Library@Base@@YAPAUHINSTANCE__@@PB_WH@Z ?GetInstallVer@Misc@Utils@@YAHPADK@Z ?GetSoftID@Misc@Utils@@YAIXZ ?GetSupplyID@Misc@Utils@@YAHAAH@Z ?add_ref@?$EnableIntrusive@VCConfig@Config@Utils@@@@QAEJXZ ?UnInit@CConfig@Config@Utils@@UAGJPAX@Z ?UnicodeToMultiByte@StringUtils@Base@@YGPADPADPB_WHI@Z ?dec_ref@?$EnableIntrusive@VCConfig@Config@Utils@@@@QAEJXZ

dbghelp

SymGetModuleInfo SymSetOptions SymInitialize SymGetSymFromAddr SymLoadModule SymGetLineFromAddr64 SymCleanup

psapi

GetModuleFileNameExW GetModuleFileNameExA

comctl32

ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx

kernel32

QueryPerformanceCounter GetSystemTimeAsFileTime GetConsoleCP SetStdHandle VirtualQueryEx ReadProcessMemory GetThreadSelectorEntry FindFirstFileW FindNextFileW FindClose ExpandEnvironmentStringsW GetTempPathW CreateDirectoryW GetCurrentThreadId GetCurrentProcessId GetTickCount DeleteFileW CreateFileW ReadFile SetFilePointer CloseHandle WriteProcessMemory FindResourceExW GetVersionExW SizeofResource LockResource FindResourceW WideCharToMultiByte LoadResource GetProcessId OpenThread LocalAlloc GetModuleFileNameW LocalFree GetProcAddress GetModuleHandleW CreateFileA MultiByteToWideChar SetEndOfFile WaitForSingleObject HeapAlloc CreateEventW GetProcessHeap VirtualProtect HeapFree GetFileSize OpenProcess SetDllDirectoryW SetCurrentDirectoryW WriteConsoleA CreateProcessW InterlockedDecrement InterlockedIncrement GlobalFree GlobalAlloc GlobalLock GlobalUnlock InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection Sleep InterlockedCompareExchange InterlockedExchange GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetStartupInfoA GetFileType SetHandleCount HeapCreate VirtualAlloc VirtualFree LoadLibraryA LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetCPInfo GetModuleFileNameA GetStdHandle SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue RtlUnwind GetStartupInfoW ExitProcess GetModuleHandleA CreateThread GetLastError ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess GetConsoleOutputCP WriteConsoleW WriteFile SetEvent TerminateProcess GetThreadLocale GetLocaleInfoA GetACP GetVersionExA RaiseException HeapSize HeapReAlloc HeapDestroy FlushFileBuffers GetStringTypeA GetStringTypeW

user32

SetWindowLongW CallWindowProcW ClientToScreen EndPaint FillRect BeginPaint DrawIconEx SetWindowTextW GetWindow SetWindowPos LoadImageW SendMessageW LoadIconW SetClipboardData GetKeyState EmptyClipboard OpenClipboard RegisterClipboardFormatW SetDlgItemTextW SendDlgItemMessageW ShowWindow GetWindowRect GetDlgItem DialogBoxParamW GetParent GetClassNameW GetWindowThreadProcessId EnumWindows GetGuiResources EnumChildWindows CloseClipboard ScreenToClient EndDialog UnregisterClassA

gdi32

SetBkColor DeleteObject CreateSolidBrush

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

shell32

SHGetDesktopFolder ShellExecuteW SHGetFileInfoW ord155 SHBindToParent

ole32

OleInitialize OleUninitialize DoDragDrop

oleaut32

SysAllocStringByteLen SysStringByteLen SysStringLen SysAllocString SysFreeString

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

$_2_/Protocol.dll

IMPHASH 4b7ed67d7c93435256b59aac300f544e
SHA256 34a223dcc8ca4c834a5918a8d7626b1c4d16205b65e5c82e83fd0f2966be8856
MD5 6416ec89c15c7e82f746645bf59b70de
SHA1 c611dde65206c03913acb5177f428eb226cd4ac7
SHA512 8842335663c9357576620cd3b1c631c76d14675b7a9e7a6f48afe3b443a37b307daa6d6650e00bec2e670da2c921fc0c53988daf73b900a63c17671d4a0b723a
SSDEEP 12288:PDbawEwafhH53KXmdHPUEdLgs+0VQZqf0Ao0HkTy6OJW+6foUSTMcoCa:PDbgpH53Kk4ZqcF+km6ODPTMcPa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

6d:fa:d5:be:c3:44:b1:a7:06:c9:6c:cf:a5:06:ca:1d:86:d0:d8:b7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Chains

Feb 19, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2012 - Feb 26, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

0

Major OS version

4

Entry point

279005

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\work\code\svn\download\GameDownloaderOld_Proj\NewDownload\bin\Protocol.pdb

basic

?IsX64System@Win64Helper@Base@@YGHAAH@Z ?GetGuidA@GUID@Base@@YGHPADH@Z ?TeaDecryptCBC2@Crypt@Base@@YAHPBEH0PAEPAH@Z ?TeaEncryptCBC2Len@Crypt@Base@@YAHH@Z ?TeaDecryptCBC2Len@Crypt@Base@@YAHPBEH0@Z ?TeaEncryptCBC2@Crypt@Base@@YAXPBEH0PAEPAH@Z ?GetOSVersionEx@SysMisc@Base@@YAJAAK0@Z

kernel32

CreateEventA WaitForSingleObject SetEvent CloseHandle TlsGetValue GetLastError InterlockedExchange InterlockedExchangeAdd TlsAlloc InterlockedIncrement InterlockedDecrement TlsFree PostQueuedCompletionStatus LeaveCriticalSection EnterCriticalSection QueueUserAPC DeleteCriticalSection TlsSetValue SetLastError SetWaitableTimer SleepEx TerminateThread Sleep CreateIoCompletionPort InterlockedCompareExchange InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus CreateEventW WaitForMultipleObjects CreateWaitableTimerW GetProcessHeap HeapAlloc HeapFree GetTickCount GetModuleFileNameA VirtualQuery CompareStringW CompareStringA SetEndOfFile CreateFileW CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetTimeZoneInformation GetLocaleInfoW LoadLibraryA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetCurrentDirectoryA GetFullPathNameA SetFilePointer FlushFileBuffers ReadFile GetStartupInfoA GetFileType SetHandleCount WideCharToMultiByte InitializeCriticalSection MultiByteToWideChar GetSystemTimeAsFileTime ReleaseSemaphore GetCurrentThreadId GetCurrentProcessId OpenEventA ResetEvent ResumeThread SystemTimeToFileTime CreateWaitableTimerA LocalFree FormatMessageA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetCurrentProcess IsDebuggerPresent ExitThread CreateThread FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA GetCommandLineA GetVersionExA RaiseException RtlUnwind LCMapStringA LCMapStringW GetCPInfo GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle HeapSize GetACP GetOEMCP IsValidCodePage HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode SetEnvironmentVariableA

ws2_32

WSARecv closesocket getsockname connect bind WSAGetLastError setsockopt ioctlsocket WSASend listen getaddrinfo inet_addr WSASocketW __WSAFDIsSet WSASetLastError shutdown accept getsockopt WSAStartup WSACleanup freeaddrinfo select

winmm

timeGetTime

Name

.text

Size

396KB

Virtual Size

392KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_2_/Report.dll

IMPHASH f65d6eff01b3756a977b22c277c47d4a
SHA256 63442dbc6be0ce4aa233ae265f15fea2d3dcbd09ee5799bb58ac49450cffdea2
MD5 ccaa1fdca4d505fe683f63ea031eebf8
SHA1 d966a8053260376fc27451184aa6d1ab0f8f8ad0
SHA512 3f3a3f2c90b16f33626f8f40c375df18e1b1f10c639f3979981f2591447afb04ee281e8b75b364afbb72657b76fc3003096bc652da799a3b6ebb8a75f11bc299
SSDEEP 3072:t4WEV9tHjj+WSjDE6hm5mDLaG77R7k6byY7/4YtPrJm:t2fulmqNJgJq/pE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

38:69:37:aa:98:1a:09:70:6a:1b:34:de:aa:1b:65:06:c6:12:01:d0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Chains

Feb 19, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2012 - Feb 26, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

0

Major OS version

4

Entry point

54177

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\work\code\svn\download\GameDownloaderOld_Proj\NewDownload\bin\Report.pdb

basic

?Init@CConfig@Config@Utils@@UAEHHPB_W@Z ?Write@CConfig@Config@Utils@@UAEHPB_WPAXK@Z ?Read@CConfig@Config@Utils@@UAEHPB_WPAXKPAK@Z ?UnInit@CConfig@Config@Utils@@UAGJPAX@Z ?Init@CConfig@Config@Utils@@UAGJPAX@Z ?Release@CConfig@Config@Utils@@UAGKXZ ?AddRef@CConfig@Config@Utils@@UAGKXZ ?dec_ref@?$EnableIntrusive@VCConfig@Config@Utils@@@@QAEJXZ ?add_ref@?$EnableIntrusive@VCConfig@Config@Utils@@@@QAEJXZ ??0CConfig@Config@Utils@@QAE@XZ ??1CConfig@Config@Utils@@MAE@XZ ?SafeLoadLibrary@Library@Base@@YAPAUHINSTANCE__@@PB_WH@Z ?GetInstallVer@Misc@Utils@@YAHPADK@Z ?GetSoftID@Misc@Utils@@YAIXZ ?GetSupplyID@Misc@Utils@@YAHAAH@Z ?GetUserStorePath@Misc@Utils@@YAHPA_W@Z

kernel32

InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventW CloseHandle WaitForSingleObject GetTickCount WideCharToMultiByte InterlockedIncrement InterlockedDecrement GetProcAddress FreeLibrary GetModuleFileNameW CreateFileW GetFileSize ReadFile ExpandEnvironmentStringsW ResetEvent SetFilePointer SetEvent WriteFile SetEndOfFile UnhandledExceptionFilter Sleep InterlockedCompareExchange CreateFileA TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime ExitThread GetCurrentThreadId GetLastError CreateThread GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap RaiseException RtlUnwind GetStdHandle GetModuleFileNameA GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetConsoleCP GetConsoleMode FlushFileBuffers VirtualAlloc HeapReAlloc LoadLibraryA GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar GetLocaleInfoA GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW

shlwapi

PathRemoveFileSpecW

$_2_/Update.dll

IMPHASH 80873e216fac0fe7a21da3530b33bb73
SHA256 94935fd52f2f773554a0d45883402e2f3f4262407d2019a224a2f7098a80fb55
MD5 0b4ec5096bb07a8fe94ae440bea6013c
SHA1 999c229783ab50709698fc0727850181fd5f22d7
SHA512 4402eb6a8c00a138d020e51b8cf81c98f0415d9ebd16f0c4742be70a79eb40354ea7027f5e29e8b22ff68e9a5d15d66561173c993ea722b90a930931e3a76ecc
SSDEEP 6144:IjqtYecNTs+uh0sgf4lG74VLbTZDc2fixPt:PtYecNT5u64GmHleV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

d8:31:e7:a6:98:52:73:3d:7e:2c:75:8f:0e:a0:65:1b:ab:98:46:4c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Chains

Feb 19, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2012 - Feb 26, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

0

Major OS version

4

Entry point

141615

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\work\code\svn\download\GameDownloaderOld_Proj\NewDownload\bin\CloudControl.pdb

basic

?Read@CConfig@Config@Utils@@UAEHPB_WPAXKPAK@Z ?UnInit@CConfig@Config@Utils@@UAGJPAX@Z ?Init@CConfig@Config@Utils@@UAGJPAX@Z ??0CConfig@Config@Utils@@QAE@XZ ?Release@CConfig@Config@Utils@@UAGKXZ ?Write@CConfig@Config@Utils@@UAEHPB_WPAXK@Z ?AddRef@CConfig@Config@Utils@@UAGKXZ ?dec_ref@?$EnableIntrusive@VCConfig@Config@Utils@@@@QAEJXZ ?add_ref@?$EnableIntrusive@VCConfig@Config@Utils@@@@QAEJXZ ?GetInstallVer@Misc@Utils@@YAHPADK@Z ?GetSupplyID@Misc@Utils@@YAHAAH@Z ?Init@CConfig@Config@Utils@@UAEHHPB_W@Z ??1CConfig@Config@Utils@@MAE@XZ ?Base64EncodeStr@Crypt@Base@@YAHPB_WPA_WHW4CodePage@@@Z

protocol

CreateAuroraService InitProductParam SetServiceUrl

kernel32

ResumeThread GetFileAttributesW MultiByteToWideChar ExpandEnvironmentStringsW CloseHandle CreateEventW PostQueuedCompletionStatus TlsFree TlsAlloc SetEvent GetLastError SystemTimeToFileTime InterlockedExchange InterlockedDecrement InterlockedExchangeAdd EnterCriticalSection LeaveCriticalSection WaitForSingleObject HeapFree WaitForMultipleObjects DeleteCriticalSection InitializeCriticalSectionAndSpinCount TerminateThread QueueUserAPC CreateEventA CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus InterlockedCompareExchange HeapAlloc SetLastError TlsGetValue GetProcessHeap TlsSetValue InitializeCriticalSection Sleep CreateWaitableTimerA ExitThread InterlockedIncrement ResetEvent OpenEventA ReleaseSemaphore FormatMessageA WideCharToMultiByte TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA GetVersionExA RaiseException RtlUnwind HeapReAlloc LCMapStringA LCMapStringW GetCPInfo GetStringTypeA GetStringTypeW HeapDestroy HeapCreate VirtualFree VirtualAlloc GetModuleHandleA GetProcAddress HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer LoadLibraryA GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA LocalFree CreateThread

advapi32

RegOpenKeyExW RegQueryValueExW

shell32

ShellExecuteW

ws2_32

WSACleanup WSAStartup

Name

.text

Size

240KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_2_/Update.exe

IMPHASH dc290de1c09a46fa61f2a29547f22312
SHA256 ce6a20b8975b8026e477bda7193c3f6b54e3df56df585325fe1e51c77756e16b
MD5 0c5e6f7da122baf24bdcc88931074c04
SHA1 21d768bad61e936fa1ceb2694522ad5136730fe3
SHA512 a124da120f15be55b9f1777a682c8fb18505ff3076acaa84d1dbc80062017c5ccc3ecfd9ff1e94e89a0c386e34addf029c8efdcf3fa6e18102a07de1508e290c
SSDEEP 1536:Bzeb40mPNf9wMnUAit1K40XrcGccpccUccL7cc2ccOcc9cc4AcHc3+ck1WJA:BzebCNnUAit1K40bcGccpccUccL7cc2X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

7c:e5:1c:ec:c1:d8:05:90:02:63:2b:bf:40:64:4a:73:c5:f9:6a:dc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Chains

Feb 19, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2012 - Feb 26, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

0

Major OS version

4

Entry point

4790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\work\code\svn\download\GameDownloaderOld_Proj\NewDownload\bin\Update.pdb

$_2_/config.ini

SHA256 71f84f6a0f2848e5b51380808ac102eab741e9d55f5cc8b21a65f2b53d41286e
MD5 26bcef869d69507949ca423a1b1029f5
SHA1 8fe5e407db804a73629d23817ee9b788194f15fe
SHA512 370bc7a081b75c0452027bcc6770391f8c7f50a4de14b317dc0ab2c15f2f5b020eef066662fc3ab3fd4f781ee4b765928cfa84c97be46f56fe1ea7bef20b9d90
MD5 SHA1 SHA512

$_2_/dl.dll

IMPHASH 01028d90a68cce5b4b4f2b26eab7d522
SHA256 109cdc7ab3650386d91803bc38a6ae6b061a182ff57105ec00be641e9a70f17e
MD5 ba7f2f6a04d1e8afe0990be4656faeb5
SHA1 3d522057cf25ec9d7f34a49dd4ec68a6fb50753b
SHA512 62c54388bfdb8d4de9702fdfebc26bf40bca1a92a8ad2949b012a4a671fc01d6c1c927203938d36f11e6e0b0ec4f39b489f12f68cd3b57d006c45238eccf9d35
SSDEEP 24576:Xhl3h4ZKoUPkJLeu7m7s0odioXk8EZNCDkXTX0lENq0lroU3OFXleTyYJz1:PGZKoU3jYdLXk841DYE0QrXexleTHJz1
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

PE Signature issue

Digest

f5:df:47:f7:cf:58:35:db:c8:f5:ff:ca:db:ca:0b:58:aa:0f:7a:29

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Chains

Jan 22, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2012 - Feb 26, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

0

Major OS version

4

Entry point

1430628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\vcoutput\NewCom\ReleaseStatic\xdownload\dl.pdb

ws2_32

recv send inet_addr gethostbyname bind sendto socket recvfrom setsockopt __WSAFDIsSet WSAGetLastError WSAStartup WSACleanup gethostname ioctlsocket closesocket inet_ntoa ntohl ntohs htonl connect accept WSASetLastError select getpeername getsockname listen htons

kernel32

SetEnvironmentVariableA GetDriveTypeA SetEndOfFile InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection Sleep GetTickCount CloseHandle FindClose FindFirstFileW GetFileAttributesW CreateEventA SetEvent ResetEvent WaitForSingleObject TerminateThread DeleteFileW MultiByteToWideChar InterlockedDecrement InterlockedIncrement InterlockedExchangeAdd lstrlenA ReleaseSemaphore GetCurrentThreadId OpenEventA WaitForMultipleObjects MoveFileW CreateFileW CopyFileA GetDiskFreeSpaceExA GetLogicalDrives InterlockedExchange OpenMutexA GetLastError CreateMutexA ReleaseMutex CopyFileW DeleteFileA ReadFile GetFileSize CreateFileA RemoveDirectoryW Process32Next Process32First CreateToolhelp32Snapshot GetProcessTimes OpenProcess WideCharToMultiByte lstrlenW RaiseException lstrcmpiA IsDBCSLeadByte FreeLibrary SizeofResource LoadResource FindResourceA LoadLibraryExA GetModuleHandleA GetModuleFileNameA DisableThreadLibraryCalls SetThreadLocale GetThreadLocale GetLocaleInfoW WriteConsoleW SetFilePointerEx GetVolumeInformationA CreateSemaphoreA GetConsoleOutputCP WriteConsoleA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetLocaleInfoA SetStdHandle GetTimeZoneInformation GetFullPathNameW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType GetStdHandle SetHandleCount IsValidCodePage GetOEMCP GetACP GetVersionExA GetModuleFileNameW Module32Next Module32First GetCurrentProcessId GetCurrentThread GlobalFree GlobalAlloc GetCurrentDirectoryA GetTempPathA FlushFileBuffers WriteFile SetFilePointer GetVolumeInformationW GetProcAddress MapViewOfFileEx CreateFileMappingA UnmapViewOfFile LockResource FindResourceExA CompareStringA CompareStringW GetFileSizeEx FileTimeToDosDateTime FileTimeToLocalFileTime GetFileTime GetFileAttributesA FindNextFileA FindFirstFileA DeviceIoControl LoadLibraryA GetSystemDirectoryA SetFileAttributesA HeapFree GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind ExitThread CreateThread FileTimeToSystemTime HeapAlloc VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc GetCommandLineA GetProcessHeap GetDriveTypeW CreateDirectoryW LCMapStringA LCMapStringW GetCPInfo ExitProcess HeapDestroy HeapCreate VirtualFree TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize

user32

CharNextA UnregisterClassA

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegEnumValueA IsTextUnicode RegCreateKeyA RegOpenKeyA GetFileSecurityW ImpersonateSelf OpenThreadToken RevertToSelf MapGenericMask AccessCheck RegQueryValueExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA

shell32

SHGetSpecialFolderPathA

ole32

CoFreeLibrary CoInitialize CoCreateGuid CoUninitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree StringFromGUID2 CoCreateInstance OleRun

oleaut32

SafeArrayDestroy SafeArrayPutElement GetErrorInfo RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysStringLen VarUI4FromStr SysFreeString SysStringByteLen SysAllocStringByteLen VariantChangeType VariantClear VariantInit SafeArrayCreateVector SafeArrayCreate

psapi

GetProcessMemoryInfo

netapi32

NetApiBufferFree Netbios NetWkstaTransportEnum

wininet

InternetOpenUrlA InternetCloseHandle InternetReadFile InternetOpenA

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

204KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

84KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_2_/image/buttonPath.png

SHA256 e06a763a9a4f7e7f892371b7b0d8d75a646585f7e94afe96c64b34d067f89471
MD5 556c3293e239354ae8d4512626627500
SHA1 e6c1ff2b818e605ac193c54bb6a6fdcd381788f5
SHA512 e65845941d2ba177ef2d050109a9440d04c490c2ad82b5f34c5f825fb274ebf101852d89c142e05c82c3774a354b6ffcbf3225cb64b56e4bdf6d68ccb72fae0a
MD5 SHA1 SHA512

$_2_/image/close.png

SHA256 657bc0eac3efda11154ed7459cbe6be18bfd35a57dfc74de1462beee927758f1
MD5 b3135d97cfb54651847910382a8a932f
SHA1 66c114ef8fce8d49651be3bd3580d277c27bb342
SHA512 a6a9c8dec951550fb5906adf73535421d20d89210f8ca5cd32b4e5ac737c4161496864495e2fe916bfdeac5bf18ab77940a7edeaec9969eedde60e45edbea78b
MD5 SHA1 SHA512

$_2_/image/config.png

SHA256 49054a271dee8fa537abbabdf51ff9ff344730f9b220e2836ef5a413a55acc06
MD5 870a7927e4162c105f1088961f302bf5
SHA1 780584cdb540356bf5750818503c95c0f1b8b5af
SHA512 ecee075be135ae09ad68cc921c9ef63528758a79080f7414e183a9a405269b50c25322d1e508aeb08a9ae60d91e85fc5c465e954900dc38b86224197322f7df5
MD5 SHA1 SHA512

$_2_/image/download.png

SHA256 a764be59fc441edcf556cbdfa8a88c2a61d85755dec568033181cec259de80a9
MD5 8cec8cd49cc6ab2407b208734f894ee0
SHA1 26fe0bd4adf364ac3368650827198b3f0bc434b2
SHA512 fb0cd310e9a4bd20c25aba7c9b42e6d96fe61a3a423b9131ba039409bee02c19ce54fafbe96327de000e02923ad0fcb47fb3f16ed212a38c52df15c0c4370a61
MD5 SHA1 SHA512

$_2_/image/error.png

SHA256 5d02a4d8d5369c5510b6e48381662915850ba71f4bcf463e49f11112da4d55fd
MD5 cb296e6c32e6c1cf3417cfaefd507cdf
SHA1 68087748339614ff078270b613375a27d8c21c37
SHA512 d5f215f266e12042f3bdc057edc9c91ee1fee46d215cba99f8980569759e1cce758d1a458c46b9affa3a5efe0149f5234be30267879df62eb0eeb269f6a5c81b
MD5 SHA1 SHA512

$_2_/image/loading.png

SHA256 949f346fb21087d2f39ff02b2eab49f4b298480e013e84efc34a134f7666dd1b
MD5 bbdd7761a126f4d08ffdf7bc24d4ebc1
SHA1 dfef5e0b1fe35e090446c2e1f73a50cb64e9f125
SHA512 14d4e70df23b3058f5e67d91fc9d31222faf1057f2efa97c43c0e866f1fe831c22752a178a6f851637a355f06204d1d1ac60cefdb220e6e91a388af6165a53fe
MD5 SHA1 SHA512

$_2_/image/logo.png

SHA256 ad801e96ea10f05a704329a685d9743eb364eec2766689ef115415f5bdc0a30d
MD5 eb9c7029a97b82489d568505f2d6ef07
SHA1 397b2d40a174b4ecbb789f6db5a983e593da2cc4
SHA512 d9ec79d732bcd1a377a61bf9aeed2dd18e17710dc920f548085e6207e1a0a39718cfae6c875b28f2e04a2720593b9763141a5f93b95a9732be89a0a7fe60d664
MD5 SHA1 SHA512

$_2_/image/mainbnd.png

SHA256 c6d6eccd6de98a2c728b8a5276eb9eff8ee118aee22b2b04426c5fd3ef273998
MD5 7df626695c6d6a89a11cf5a283364df3
SHA1 28d29b2d7c3216d9d906fd58e2ffa0cee95adfa6
SHA512 413b7c77813163adc1be77ba646b6e19c6dc55302861b2ee13b311cdebb723e2b774b7b74228cbd3f30cc4690e0fe1f4100540f812b1aa8b43acc7011e6d8bb5
MD5 SHA1 SHA512

$_2_/image/min.png

SHA256 85ccfff45347ae28d8e86f55b7f55481e024eadd0e8164725723d80191a93833
MD5 923b44bc2d6c32bbf987d8e454c1b9c9
SHA1 e353390e66c7796f038439bbcb3154d2d172f881
SHA512 9c2a96fc7d96c89544126312e61b05604c7e15830777999e8e552800356eaa08f894376d1367dbbfcc314898cc4a3907f36b568b57ab531702bb6c5c82e0bbe6
MD5 SHA1 SHA512

$_2_/image/path.png

SHA256 e7f035cb1bc7c2b0961eefc2c4ad80252efda45ae4279b28f1287a1e7feede34
MD5 9ab2c49c8358224707492f661219504d
SHA1 dbd27803ecd4117d85844bf434319788cb078ea9
SHA512 48416191cc4da9ab8becbb96a498959f4768d173a7103fc9427503695f11ab382a355e7de1fa64a29f40bd5ebcf4e66201c7c5416adb0cfd0773446640f4ea03
SSDEEP 384:B50w1i9ydpw2A1ir1TeWQQ5K0tpOZ0+gpelo6TQQ7GvdvgbT5HSyX144OXS1CbOB:Dvicpwr1oTe7Iwgp/3ML3p2G94qdvqjO
MD5 SHA1 SHA512 SSDEEP

$_2_/image/pause.png

SHA256 07600e1f3ca1b55d0ae1253d88db0d57e75380a735db1f7b33b5fd3ecfb14e8d
MD5 c0b9c4a8d9cac7a62783bbe117e56bce
SHA1 bf078e083bd87a3507e81a62f6f2108b3e4f2295
SHA512 511c8eedc1b5afe821f6932735746af6000e3e6fd5943cd2134dff8b31129cff4184d963fbfc74064cf7677d0873cabb2fec9bacc3e93a3716c34a97ca2deed2
MD5 SHA1 SHA512

$_2_/image/progressbar_bk.png

SHA256 e39b1f8c487b20fe81f4cadded3dd225df0352b8b3beb9f18b9571179e9dcf86
MD5 952624e2c93702a3d85067b3976d0737
SHA1 6664c57c2939cd5e098ac97f83b427e85c03e9dd
SHA512 d62e7dbdaf74f76608203619645511e7b166fdf62b6d7769cedf5d1395ac022bf3b3d9720984f2e78bbc21292d9734a846e5f33288f15839402cc02b4a8c0084
MD5 SHA1 SHA512

$_2_/image/softlogo.png

SHA256 019bb4ef81de698251f1d76643bac2cff8bb832766e03bba749d14715bc5b24d
MD5 805915e2e8578ab10a22e438cc88bd7e
SHA1 9c854d56f58acd23abd610a5521c1820999e0b24
SHA512 4d61911424858b052f58ac736db499100fd984b13866534286755f223e0c9fef79f7a5b0df99fc00f0c135dcbb83da21628ab8760082aa576f7078a0ecc5b0fc
SSDEEP 96:GOZfdBVB0l4In2ubP/LXYt0BQpBQps+8/j5x2n8Sv2qCSlNUIlhKNUKt+zgbVZkt:FZfdBVBuhnxP/DBQpBnndx2n8S5l4uKs
MD5 SHA1 SHA512 SSDEEP

$_2_/npBDDLPlug.dll

IMPHASH 94f77ebb746c9ef1a3ebdc0aee83fd70
SHA256 8362db330edb99033607dc4b44c98f452badce729aeb70428b7ed282e7a5a1bb
MD5 59668ca31b6ce3f48b2ac98c032a024d
SHA1 9dd62b48e968d02047e29b7a04257945c042691e
SHA512 b6b908fbeeab40cc16a333eea4e774251a1adf41d22b63c2fab46d323354fd446791c08bdea048f7002c012a14716f3e17868add3873172ca274473e4f554ec1
SSDEEP 1536:Bf+HmZCb+TRQXQotbhbQCVI9gOY0Bs2oLmpaAxdntg/RmEIulo:BGHTac6paAxxtg5NI9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

06:80:4b:be:dd:e4:7a:aa:2f:ba:1a:3c:87:4d:e8:fd:27:e3:3f:a2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Chains

Feb 19, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2012 - Feb 26, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

0

Major OS version

4

Entry point

22360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\work\code\svn\download\XFPlugin\Downloader_Nsis\Release\install\npBDDLPlug.pdb

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

kernel32

lstrcpynA MultiByteToWideChar WideCharToMultiByte InterlockedExchange GetLastError FindResourceA CloseHandle FreeLibrary LoadResource Sleep GetProcAddress SizeofResource FindResourceExA GetCurrentThreadId OutputDebugStringA LoadLibraryA GetModuleFileNameA GetStringTypeW GetStringTypeA GetConsoleMode GetConsoleCP SetFilePointer InitializeCriticalSection RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetThreadLocale LockResource HeapFree LCMapStringW LCMapStringA IsValidCodePage GetOEMCP CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FlushFileBuffers GetLocaleInfoA GetACP HeapAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapReAlloc VirtualAlloc GetModuleHandleA GetCommandLineA GetVersionExA GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection HeapDestroy HeapCreate VirtualFree DeleteCriticalSection ExitProcess WriteFile GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapSize GetCPInfo

user32

SetForegroundWindow GetForegroundWindow GetWindowThreadProcessId IsIconic ShowWindow RegisterWindowMessageA AttachThreadInput FindWindowExA SetWindowLongA DefWindowProcA UnregisterClassA

shell32

ShellExecuteW

shlwapi

PathFileExistsA

$_2_/uninstaller.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 6fef0ce7b8a97f818c0156386acbcde1783c9b1cb16d1c7ffc08e3919fdd8f74
MD5 05608ae6e2722d380f583f31404fd031
SHA1 e3786a5c5bc31d177f9e4ee53969f8350b67bdd0
SHA512 85040c2847ce25d9c4acb2d8688559f0d13b105a22df42e6dc43a8d7e8c2b325d74d015faf4c2812fe06a124708421c513505548c27ba7213bf9ba823649de44
SSDEEP 3072:FweqOYEUXPnY8cGccpccUccL7cc2ccOcc9cc4LIAUG7rA2ZiL8duo69B:qEUXA8cGccpccUccL7cc2ccOcc9cc4Fc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

ba:e0:ad:11:6f:02:cc:5f:65:38:18:f3:a9:39:9e:7a:bc:91:7f:cc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Chains

Feb 19, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2012 - Feb 26, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

0

Major OS version

5

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/InstallHelper.dll

IMPHASH 757a207c0ddc255c868ab28404d88d9f
SHA256 53c9cd1bbb9c595708ff00297694492135202649066551a354f0f8475e4c41c8
MD5 e8f6633f06b6b7e576fd764f97fe8573
SHA1 d149d067c9d53bcb8d20ac006da581a8e43daf84
SHA512 9587c452cdb4c103bb9347eb7f0ff43759ff4b7ba53de2d9446807b24b954af1547c227df05069a91c49f39dbd181f5890784101d74727deeffcc032b01cc6ca
SSDEEP 1536:SVuz5s65BWFCGH1Z9guNrCPHbSQ9uv5tmQ:SIz5lfo53WPH2+uBtm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8105

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\work\code\svn\download\XFPlugin\nsis_server\NSIS\Plugins\InstallHelper.pdb

kernel32

lstrcpynW GlobalAlloc Process32FirstW lstrcmpiW Process32NextW CloseHandle CreateToolhelp32Snapshot OpenProcess MultiByteToWideChar lstrcpyW GlobalFree GetCurrentProcess TerminateProcess GetStringTypeW GetStringTypeA InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExA GetCurrentThreadId GetCommandLineA HeapFree HeapAlloc GetProcessHeap GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetProcAddress GetModuleHandleA ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc CreateFileA InitializeCriticalSection WriteFile GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers LoadLibraryA GetCPInfo GetOEMCP IsValidCodePage SetFilePointer SetEndOfFile ReadFile LCMapStringA LCMapStringW WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize

user32

MessageBoxW

advapi32

LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges

ole32

CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysStringLen SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2953032d3e8083333fbbe91041feddc0_NeikiAnalytics.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallHelper.dll

kernel32

user32

advapi32

ole32

oleaut32

generic

$_2_/BDDLBHO.dll

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic

$_2_/BDIEHelper.dll

PE Signature issue

version

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wtsapi32

generic

$_2_/BaiduMiniDL.exe

PE Signature issue

basic

version

comctl32

report

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

generic

$_2_/Basic.dll

PE Signature issue

psapi

iphlpapi

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

version

netapi32

generic

$_2_/BugReport.exe

PE Signature issue

basic