067889c2f0bd160a63736d0a5cc1714d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

067889c2f0bd160a63736d0a5cc1714d_JaffaCakes118
Size

2.9MB
MD5

067889c2f0bd160a63736d0a5cc1714d
SHA1

cc5934c1b1cd065529bdedbadcc7208b527af18b
SHA256

9905cc59c53d07d49e9b6fd82b1153357f654b2c9055f9348a46bd4e2cad4c90
SHA512

28c37221d23ecf5fe0cfa67886bf3ce8c18b805e996d8770f208a119e8e14bf5013e2d8a9302b48f77c1f228a97f9a2d4f9a0e28237cc3fbc31d2e3b955a7e45
SSDEEP

49152:IscUGcVJipHCSwhJwROnEM0QwNPnEb77PDBGscNWkudgWDnpdLX2:1zVkpPYnEQ977PDBGsouxDpdy

Score

3^/10

Malware Config

Signatures

Unsigned PE 23 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/Processes.dll
unpack001/$PLUGINSDIR/Rfshdktp.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$SYSDIR/GdiPlus.dll
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/KmdUtil.exe
unpack002/$PLUGINSDIR/LangDLL.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/SandboxieBITS.exe
unpack002/SandboxieCrypto.exe
unpack002/SandboxieDcomLaunch.exe
unpack002/SandboxieEventSys.exe
unpack002/SandboxieRpcSs.exe
unpack002/SandboxieWUAU.exe
unpack002/SbieCtrl.exe
unpack002/SbieDll.dll
unpack002/SbieDllX.dll
unpack002/SbieDrv.sys
unpack002/SbieMsg.dll
unpack002/SbieSvc.exe
unpack002/Start.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/360se3/Shield/Install/360sandbox.exe	nsis_installer_1

Files

067889c2f0bd160a63736d0a5cc1714d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$3/data/ico/avc.360.cn.ico
$3/data/ico/dh.wan.360.cn.ico
$3/data/ico/hao.360.cn.ico
$3/data/ico/se.360.cn.ico
$3/data/ico/wan.360.cn.ico
$3/data/ico/www.baidu.com.ico
$3/data/ico/www.bing.com.ico
$3/data/ico/www.google.cn.ico
$3/data/ico/www.qihoo.com.ico
$3/data/ico/www.sogou.com.ico
$3/data/ico/www.youdao.com.ico
$3/data/ico/yahoo.cn.ico
$3/extensions/SafeCentral/esimple.ini
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

946eb0a1e85c9ade4acaf634eb5a64f1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetACP
GlobalFree
lstrcpynA
lstrcmpA
lstrlenA
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc

user32

SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
LoadIconA
SendMessageA
ShowWindow
GetDC

gdi32

CreateFontIndirectA
GetDeviceCaps
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 697B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/PageTypeSel.ini
$PLUGINSDIR/Processes.dll
.dll windows:4 windows x86 arch:x86

f5edecae12589e705677a6e272ad0394

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
FreeLibrary
OpenProcess
CloseHandle
TerminateProcess
GlobalFree
lstrcpyA
GetCommandLineA
GetVersionExA
ExitProcess
GetModuleHandleA
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
UnhandledExceptionFilter
DisableThreadLibraryCalls
WriteFile
SetFilePointer
HeapAlloc
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
SetStdHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
GetLocaleInfoA
VirtualProtect
GetSystemInfo

user32

FindWindowA
GetDesktopWindow
wsprintfA
UpdateWindow

Exports

Exports

FindDevice
FindProcess
KillProcess

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Rfshdktp.dll
.dll windows:4 windows x86 arch:x86

042f3c184e7c0923b6325ab1dc09aed7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shell32

SHGetSpecialFolderLocation
SHChangeNotify

Exports

Exports

refreshDesktop

Sections

.text
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 206B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$SYSDIR/GdiPlus.dll
.dll windows:5 windows x86 arch:x86

68a82f89c3fde2fdb45bbeddb19a9697

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

microsoftwindowsgdiplus-1.0.2600.3352-gdiplus.pdb

Imports

advapi32

RegOpenKeyW
RegOpenKeyA
RegCloseKey
RegEnumValueW
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegEnumKeyExA
RegEnumKeyExW
RegCreateKeyExA
RegSetValueExW
RegSetValueExA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegEnumValueA

gdi32

GetDIBColorTable
FillRgn
SetMiterLimit
CreateSolidBrush
StrokePath
GetGraphicsMode
SetPolyFillMode
FillPath
StrokeAndFillPath
PolyPolyline
GetNearestPaletteIndex
ExtTextOutA
GetTextCharsetInfo
TranslateCharsetInfo
PolylineTo
Polyline
LineTo
GetCurrentPositionEx
ArcTo
SetArcDirection
SelectClipPath
GetPath
CloseFigure
AbortPath
FlattenPath
WidenPath
BeginPath
Ellipse
AngleArc
PolyBezierTo
PolyBezier
RoundRect
PolyDraw
Pie
Chord
Arc
EndPath
OffsetClipRgn
GetRgnBox
CombineRgn
SetPaletteEntries
ResizePalette
ExcludeClipRect
MoveToEx
PlayEnhMetaFile
GetWinMetaFileBits
PlgBlt
BitBlt
OffsetViewportOrgEx
StretchBlt
ScaleViewportExtEx
ScaleWindowExtEx
CombineTransform
SetMapperFlags
CreatePen
CreateDIBitmap
CreatePatternBrush
ExtSelectClipRgn
GetBkMode
GetTextAlign
ModifyWorldTransform
ExtCreateRegion
CreateCompatibleBitmap
GetNearestColor
SetStretchBltMode
StretchDIBits
SetTextAlign
SetTextJustification
PolyPolygon
PlayMetaFileRecord
ExtCreatePen
GetWorldTransform
GetROP2
SetROP2
Rectangle
Polygon
IntersectClipRect
SetBrushOrgEx
GetClipRgn
SelectClipRgn
GetBkColor
GetTextColor
CreatePenIndirect
GetObjectW
DPtoLP
CreateDIBPatternBrushPt
ExtTextOutW
SetBitmapBits
SetDIBColorTable
CreateEnhMetaFileW
GdiComment
GetMetaFileW
GetMetaFileA
SaveDC
SetWindowOrgEx
SetViewportOrgEx
SetGraphicsMode
SetWorldTransform
GetEnhMetaFileW
GetEnhMetaFileA
GetEnhMetaFileBits
CopyEnhMetaFileA
CopyMetaFileA
DeleteMetaFile
GetEnhMetaFileHeader
SetMetaFileBitsEx
SetEnhMetaFileBits
CreateEnhMetaFileA
SetMapMode
SetViewportExtEx
SetWindowExtEx
PlayMetaFile
CloseEnhMetaFile
DeleteEnhMetaFile
SetMetaRgn
GetMetaFileBitsEx
EnumMetaFile
EnumEnhMetaFile
PlayEnhMetaFileRecord
RestoreDC
GetStockObject
CreateBitmap
SetTextColor
SetBkColor
SetBkMode
CreatePalette
GetSystemPaletteEntries
GetSystemPaletteUse
GetDeviceCaps
ExtEscape
GetObjectType
GetPixel
DeleteObject
SelectPalette
GetTextFaceA
GetTextMetricsA
GetTextFaceW
GetTextMetricsW
EnumFontFamiliesExA
EnumFontFamiliesExW
SelectObject
CreateFontIndirectW
CreateFontIndirectA
GetRegionData
DeleteDC
CreateDCA
CreateICA
CreateRectRgn
GetRandomRgn
LPtoDP
GetWindowExtEx
GetViewportExtEx
GetWindowOrgEx
GetViewportOrgEx
GetMapMode
SetICMMode
Escape
GetDCOrgEx
GetObjectA
GetCurrentObject
GetDIBits
CreateCompatibleDC
CreateDIBSection
RealizePalette
GetPaletteEntries
GdiFlush
PatBlt
CreateBrushIndirect
SetDIBits

kernel32

CreateSemaphoreA
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
InterlockedExchange
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
RaiseException
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
CloseHandle
WriteFile
CreateFileA
WaitForSingleObject
SetEvent
lstrcmpiA
CreateThread
CreateEventA
WideCharToMultiByte
MultiByteToWideChar
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCPInfo
VirtualQuery
RtlUnwind
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
GetCommandLineA
GetSystemInfo
HeapReAlloc
HeapFree
VirtualAlloc
IsValidLocale
ConvertDefaultLocale
GetLocaleInfoW
GetModuleFileNameW
GetModuleFileNameA
FindResourceA
LoadResource
LockResource
GetProfileIntA
GetProfileStringA
lstrcmpiW
IsDBCSLeadByteEx
LocalReAlloc
MulDiv
SetLastError
LocalAlloc
LocalFree
GetFileTime
SearchPathW
SearchPathA
GetOEMCP
InterlockedIncrement
LoadLibraryW
GetSystemDirectoryA
CreateFileMappingW
ReleaseSemaphore
GetProfileSectionA
CreateFileW
SetEndOfFile
SetFilePointer
ReadFile
UnlockFile
GetFileInformationByHandle
LockFile
FlushFileBuffers
GetLastError
VirtualFree
GlobalAlloc
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GlobalLock
GlobalSize
GlobalUnlock
GlobalFree
HeapCreate
GetModuleHandleA
GetSystemDirectoryW
GetWindowsDirectoryA
FreeLibrary
HeapDestroy
LoadLibraryA
GetVersionExA
GetACP
GetModuleHandleW
GetProcAddress
GetSystemDefaultLCID

ole32

CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal

user32

MsgWaitForMultipleObjects
LoadBitmapW
LoadBitmapA
wsprintfW
ReleaseDC
GetDC
wsprintfA
GetSysColor
UnregisterClassA
DestroyWindow
GetSystemMetrics
DefWindowProcA
CreateWindowExA
RegisterWindowMessageA
RegisterClassA
DispatchMessageA
TranslateMessage
PeekMessageA
GetClientRect
GetDesktopWindow
GetWindowRect
WindowFromDC
ClientToScreen
wvsprintfA
CreateIconIndirect
GetIconInfo
GetDCEx
GetWindowLongA
GetClassLongA
SystemParametersInfoA

Exports

Exports

GdipAddPathArc
GdipAddPathArcI
GdipAddPathBezier
GdipAddPathBezierI
GdipAddPathBeziers
GdipAddPathBeziersI
GdipAddPathClosedCurve
GdipAddPathClosedCurve2
GdipAddPathClosedCurve2I
GdipAddPathClosedCurveI
GdipAddPathCurve
GdipAddPathCurve2
GdipAddPathCurve2I
GdipAddPathCurve3
GdipAddPathCurve3I
GdipAddPathCurveI
GdipAddPathEllipse
GdipAddPathEllipseI
GdipAddPathLine
GdipAddPathLine2
GdipAddPathLine2I
GdipAddPathLineI
GdipAddPathPath
GdipAddPathPie
GdipAddPathPieI
GdipAddPathPolygon
GdipAddPathPolygonI
GdipAddPathRectangle
GdipAddPathRectangleI
GdipAddPathRectangles
GdipAddPathRectanglesI
GdipAddPathString
GdipAddPathStringI
GdipAlloc
GdipBeginContainer
GdipBeginContainer2
GdipBeginContainerI
GdipBitmapGetPixel
GdipBitmapLockBits
GdipBitmapSetPixel
GdipBitmapSetResolution
GdipBitmapUnlockBits
GdipClearPathMarkers
GdipCloneBitmapArea
GdipCloneBitmapAreaI
GdipCloneBrush
GdipCloneCustomLineCap
GdipCloneFont
GdipCloneFontFamily
GdipCloneImage
GdipCloneImageAttributes
GdipCloneMatrix
GdipClonePath
GdipClonePen
GdipCloneRegion
GdipCloneStringFormat
GdipClosePathFigure
GdipClosePathFigures
GdipCombineRegionPath
GdipCombineRegionRect
GdipCombineRegionRectI
GdipCombineRegionRegion
GdipComment
GdipCreateAdjustableArrowCap
GdipCreateBitmapFromDirectDrawSurface
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromHICON
GdipCreateBitmapFromResource
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateCachedBitmap
GdipCreateCustomLineCap
GdipCreateFont
GdipCreateFontFamilyFromName
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCreateFontFromLogfontW
GdipCreateFromHDC
GdipCreateFromHDC2
GdipCreateFromHWND
GdipCreateFromHWNDICM
GdipCreateHBITMAPFromBitmap
GdipCreateHICONFromBitmap
GdipCreateHalftonePalette
GdipCreateHatchBrush
GdipCreateImageAttributes
GdipCreateLineBrush
GdipCreateLineBrushFromRect
GdipCreateLineBrushFromRectI
GdipCreateLineBrushFromRectWithAngle
GdipCreateLineBrushFromRectWithAngleI
GdipCreateLineBrushI
GdipCreateMatrix
GdipCreateMatrix2
GdipCreateMatrix3
GdipCreateMatrix3I
GdipCreateMetafileFromEmf
GdipCreateMetafileFromFile
GdipCreateMetafileFromStream
GdipCreateMetafileFromWmf
GdipCreateMetafileFromWmfFile
GdipCreatePath
GdipCreatePath2
GdipCreatePath2I
GdipCreatePathGradient
GdipCreatePathGradientFromPath
GdipCreatePathGradientI
GdipCreatePathIter
GdipCreatePen1
GdipCreatePen2
GdipCreateRegion
GdipCreateRegionHrgn
GdipCreateRegionPath
GdipCreateRegionRect
GdipCreateRegionRectI
GdipCreateRegionRgnData
GdipCreateSolidFill
GdipCreateStreamOnFile
GdipCreateStringFormat
GdipCreateTexture
GdipCreateTexture2
GdipCreateTexture2I
GdipCreateTextureIA
GdipCreateTextureIAI
GdipDeleteBrush
GdipDeleteCachedBitmap
GdipDeleteCustomLineCap
GdipDeleteFont
GdipDeleteFontFamily
GdipDeleteGraphics
GdipDeleteMatrix
GdipDeletePath
GdipDeletePathIter
GdipDeletePen
GdipDeletePrivateFontCollection
GdipDeleteRegion
GdipDeleteStringFormat
GdipDisposeImage
GdipDisposeImageAttributes
GdipDrawArc
GdipDrawArcI
GdipDrawBezier
GdipDrawBezierI
GdipDrawBeziers
GdipDrawBeziersI
GdipDrawCachedBitmap
GdipDrawClosedCurve
GdipDrawClosedCurve2
GdipDrawClosedCurve2I
GdipDrawClosedCurveI
GdipDrawCurve
GdipDrawCurve2
GdipDrawCurve2I
GdipDrawCurve3
GdipDrawCurve3I
GdipDrawCurveI
GdipDrawDriverString
GdipDrawEllipse
GdipDrawEllipseI
GdipDrawImage
GdipDrawImageI
GdipDrawImagePointRect
GdipDrawImagePointRectI
GdipDrawImagePoints
GdipDrawImagePointsI
GdipDrawImagePointsRect
GdipDrawImagePointsRectI
GdipDrawImageRect
GdipDrawImageRectI
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipDrawLine
GdipDrawLineI
GdipDrawLines
GdipDrawLinesI
GdipDrawPath
GdipDrawPie
GdipDrawPieI
GdipDrawPolygon
GdipDrawPolygonI
GdipDrawRectangle
GdipDrawRectangleI
GdipDrawRectangles
GdipDrawRectanglesI
GdipDrawString
GdipEmfToWmfBits
GdipEndContainer
GdipEnumerateMetafileDestPoint
GdipEnumerateMetafileDestPointI
GdipEnumerateMetafileDestPoints
GdipEnumerateMetafileDestPointsI
GdipEnumerateMetafileDestRect
GdipEnumerateMetafileDestRectI
GdipEnumerateMetafileSrcRectDestPoint
GdipEnumerateMetafileSrcRectDestPointI
GdipEnumerateMetafileSrcRectDestPoints
GdipEnumerateMetafileSrcRectDestPointsI
GdipEnumerateMetafileSrcRectDestRect
GdipEnumerateMetafileSrcRectDestRectI
GdipFillClosedCurve
GdipFillClosedCurve2
GdipFillClosedCurve2I
GdipFillClosedCurveI
GdipFillEllipse
GdipFillEllipseI
GdipFillPath
GdipFillPie
GdipFillPieI
GdipFillPolygon
GdipFillPolygon2
GdipFillPolygon2I
GdipFillPolygonI
GdipFillRectangle
GdipFillRectangleI
GdipFillRectangles
GdipFillRectanglesI
GdipFillRegion
GdipFlattenPath
GdipFlush
GdipFree
GdipGetAdjustableArrowCapFillState
GdipGetAdjustableArrowCapHeight
GdipGetAdjustableArrowCapMiddleInset
GdipGetAdjustableArrowCapWidth
GdipGetAllPropertyItems
GdipGetBrushType
GdipGetCellAscent
GdipGetCellDescent
GdipGetClip
GdipGetClipBounds
GdipGetClipBoundsI
GdipGetCompositingMode
GdipGetCompositingQuality
GdipGetCustomLineCapBaseCap
GdipGetCustomLineCapBaseInset
GdipGetCustomLineCapStrokeCaps
GdipGetCustomLineCapStrokeJoin
GdipGetCustomLineCapType
GdipGetCustomLineCapWidthScale
GdipGetDC
GdipGetDpiX
GdipGetDpiY
GdipGetEmHeight
GdipGetEncoderParameterList
GdipGetEncoderParameterListSize
GdipGetFamily
GdipGetFamilyName
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipGetFontHeight
GdipGetFontHeightGivenDPI
GdipGetFontSize
GdipGetFontStyle
GdipGetFontUnit
GdipGetGenericFontFamilyMonospace
GdipGetGenericFontFamilySansSerif
GdipGetGenericFontFamilySerif
GdipGetHatchBackgroundColor
GdipGetHatchForegroundColor
GdipGetHatchStyle
GdipGetHemfFromMetafile
GdipGetImageAttributesAdjustedPalette
GdipGetImageBounds
GdipGetImageDecoders
GdipGetImageDecodersSize
GdipGetImageDimension
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImageFlags
GdipGetImageGraphicsContext
GdipGetImageHeight
GdipGetImageHorizontalResolution
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipGetImageThumbnail
GdipGetImageType
GdipGetImageVerticalResolution
GdipGetImageWidth
GdipGetInterpolationMode
GdipGetLineBlend
GdipGetLineBlendCount
GdipGetLineColors
GdipGetLineGammaCorrection
GdipGetLinePresetBlend
GdipGetLinePresetBlendCount
GdipGetLineRect
GdipGetLineRectI
GdipGetLineSpacing
GdipGetLineTransform
GdipGetLineWrapMode
GdipGetLogFontA
GdipGetLogFontW
GdipGetMatrixElements
GdipGetMetafileDownLevelRasterizationLimit
GdipGetMetafileHeaderFromEmf
GdipGetMetafileHeaderFromFile
GdipGetMetafileHeaderFromMetafile
GdipGetMetafileHeaderFromStream
GdipGetMetafileHeaderFromWmf
GdipGetNearestColor
GdipGetPageScale
GdipGetPageUnit
GdipGetPathData
GdipGetPathFillMode
GdipGetPathGradientBlend
GdipGetPathGradientBlendCount
GdipGetPathGradientCenterColor
GdipGetPathGradientCenterPoint
GdipGetPathGradientCenterPointI
GdipGetPathGradientFocusScales
GdipGetPathGradientGammaCorrection
GdipGetPathGradientPath
GdipGetPathGradientPointCount
GdipGetPathGradientPresetBlend
GdipGetPathGradientPresetBlendCount
GdipGetPathGradientRect
GdipGetPathGradientRectI
GdipGetPathGradientSurroundColorCount
GdipGetPathGradientSurroundColorsWithCount
GdipGetPathGradientTransform
GdipGetPathGradientWrapMode
GdipGetPathLastPoint
GdipGetPathPoints
GdipGetPathPointsI
GdipGetPathTypes
GdipGetPathWorldBounds
GdipGetPathWorldBoundsI
GdipGetPenBrushFill
GdipGetPenColor
GdipGetPenCompoundArray
GdipGetPenCompoundCount
GdipGetPenCustomEndCap
GdipGetPenCustomStartCap
GdipGetPenDashArray
GdipGetPenDashCap197819
GdipGetPenDashCount
GdipGetPenDashOffset
GdipGetPenDashStyle
GdipGetPenEndCap
GdipGetPenFillType
GdipGetPenLineJoin
GdipGetPenMiterLimit
GdipGetPenMode
GdipGetPenStartCap
GdipGetPenTransform
GdipGetPenUnit
GdipGetPenWidth
GdipGetPixelOffsetMode
GdipGetPointCount
GdipGetPropertyCount
GdipGetPropertyIdList
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipGetPropertySize
GdipGetRegionBounds
GdipGetRegionBoundsI
GdipGetRegionData
GdipGetRegionDataSize
GdipGetRegionHRgn
GdipGetRegionScans
GdipGetRegionScansCount
GdipGetRegionScansI
GdipGetRenderingOrigin
GdipGetSmoothingMode
GdipGetSolidFillColor
GdipGetStringFormatAlign
GdipGetStringFormatDigitSubstitution
GdipGetStringFormatFlags
GdipGetStringFormatHotkeyPrefix
GdipGetStringFormatLineAlign
GdipGetStringFormatMeasurableCharacterRangeCount
GdipGetStringFormatTabStopCount
GdipGetStringFormatTabStops
GdipGetStringFormatTrimming
GdipGetTextContrast
GdipGetTextRenderingHint
GdipGetTextureImage
GdipGetTextureTransform
GdipGetTextureWrapMode
GdipGetVisibleClipBounds
GdipGetVisibleClipBoundsI
GdipGetWorldTransform
GdipGraphicsClear
GdipImageForceValidation
GdipImageGetFrameCount
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageRotateFlip
GdipImageSelectActiveFrame
GdipInvertMatrix
GdipIsClipEmpty
GdipIsEmptyRegion
GdipIsEqualRegion
GdipIsInfiniteRegion
GdipIsMatrixEqual
GdipIsMatrixIdentity
GdipIsMatrixInvertible
GdipIsOutlineVisiblePathPoint
GdipIsOutlineVisiblePathPointI
GdipIsStyleAvailable
GdipIsVisibleClipEmpty
GdipIsVisiblePathPoint
GdipIsVisiblePathPointI
GdipIsVisiblePoint
GdipIsVisiblePointI
GdipIsVisibleRect
GdipIsVisibleRectI
GdipIsVisibleRegionPoint
GdipIsVisibleRegionPointI
GdipIsVisibleRegionRect
GdipIsVisibleRegionRectI
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipMeasureCharacterRanges
GdipMeasureDriverString
GdipMeasureString
GdipMultiplyLineTransform
GdipMultiplyMatrix
GdipMultiplyPathGradientTransform
GdipMultiplyPenTransform
GdipMultiplyTextureTransform
GdipMultiplyWorldTransform
GdipNewInstalledFontCollection
GdipNewPrivateFontCollection
GdipPathIterCopyData
GdipPathIterEnumerate
GdipPathIterGetCount
GdipPathIterGetSubpathCount
GdipPathIterHasCurve
GdipPathIterIsValid
GdipPathIterNextMarker
GdipPathIterNextMarkerPath
GdipPathIterNextPathType
GdipPathIterNextSubpath
GdipPathIterNextSubpathPath
GdipPathIterRewind
GdipPlayMetafileRecord
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipRecordMetafile
GdipRecordMetafileFileName
GdipRecordMetafileFileNameI
GdipRecordMetafileI
GdipRecordMetafileStream
GdipRecordMetafileStreamI
GdipReleaseDC
GdipRemovePropertyItem
GdipResetClip
GdipResetImageAttributes
GdipResetLineTransform
GdipResetPageTransform
GdipResetPath
GdipResetPathGradientTransform
GdipResetPenTransform
GdipResetTextureTransform
GdipResetWorldTransform
GdipRestoreGraphics
GdipReversePath
GdipRotateLineTransform
GdipRotateMatrix
GdipRotatePathGradientTransform
GdipRotatePenTransform
GdipRotateTextureTransform
GdipRotateWorldTransform
GdipSaveAdd
GdipSaveAddImage
GdipSaveGraphics
GdipSaveImageToFile
GdipSaveImageToStream
GdipScaleLineTransform
GdipScaleMatrix
GdipScalePathGradientTransform
GdipScalePenTransform
GdipScaleTextureTransform
GdipScaleWorldTransform
GdipSetAdjustableArrowCapFillState
GdipSetAdjustableArrowCapHeight
GdipSetAdjustableArrowCapMiddleInset
GdipSetAdjustableArrowCapWidth
GdipSetClipGraphics
GdipSetClipHrgn
GdipSetClipPath
GdipSetClipRect
GdipSetClipRectI
GdipSetClipRegion
GdipSetCompositingMode
GdipSetCompositingQuality
GdipSetCustomLineCapBaseCap
GdipSetCustomLineCapBaseInset
GdipSetCustomLineCapStrokeCaps
GdipSetCustomLineCapStrokeJoin

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/setupbmp/Brower360.bmp
$TEMP/setupbmp/BrowerIe6.bmp
360se3/2.02Vista.reg
360se3/2.02XP.reg
360se3/360SEUP.dll
.dll regsvr32 windows:4 windows x86 arch:x86

d4d645168d0fea24205da6288a79dacf

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LockResource
SizeofResource
LoadResource
FindResourceW
GetTempFileNameW
GetTempPathW
DeleteFileW
WaitForSingleObject
GetModuleFileNameW
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetLastError
CloseHandle
WriteFile
InitializeCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
FlushFileBuffers
SetFilePointer
CreateFileW
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetEndOfFile
ReadFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

shell32

ShellExecuteExW

shlwapi

PathAppendW
PathRenameExtensionW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/360Start.exe
.exe windows:4 windows x86 arch:x86

5edeb3c34ec8e6a029096a4909594708

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CopyFileW
GetPrivateProfileStringW
GetCurrentProcess
WaitForSingleObject
GetExitCodeProcess
GetModuleFileNameW
GetShortPathNameW
FindClose
FindNextFileW
RemoveDirectoryW
FindFirstFileW
WriteFile
SetFilePointer
CreateFileW
GetLastError
CreateDirectoryW
InterlockedDecrement
GetVersionExW
TerminateProcess
ExitProcess
DeleteFileW
LoadLibraryA
GetStringTypeW
GetStringTypeA
SetStdHandle
FlushFileBuffers
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetFileType
GetStdHandle
SetHandleCount
ReadFile
HeapSize
HeapAlloc
HeapReAlloc
HeapFree
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
RtlUnwind
MultiByteToWideChar
GetPrivateProfileIntW
GetCurrentProcessId
GetTickCount
WritePrivateProfileStringW
lstrcatW
GetLongPathNameW
CreateToolhelp32Snapshot
SetEndOfFile
Module32FirstW
lstrcpyW
lstrlenW
WideCharToMultiByte
GetProcAddress
Sleep
CreateProcessW
CloseHandle
FreeLibrary

user32

BeginPaint
DrawTextW
ShowWindow
DialogBoxParamW
PostMessageW
FindWindowW
EndPaint
LoadIconW
GetDlgItem
SetWindowPos
CreateDialogParamW
EnableMenuItem
GetSystemMenu
IsWindow
DestroyWindow
SetTimer
DispatchMessageW
TranslateMessage
EndDialog
LoadStringW
MessageBoxW
GetWindowThreadProcessId
SendMessageW
GetDesktopWindow
PeekMessageW

gdi32

GetObjectW
CreateFontIndirectW
SetBkMode
SelectObject

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegLoadKeyW
RegOpenKeyExW
RegUnLoadKeyW
RegCloseKey
RegSaveKeyW

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHFileOperationW

comctl32

InitCommonControlsEx

shlwapi

SHSetValueW
SHGetValueW
SHDeleteValueW
SHDeleteKeyW
PathIsRootW
PathFileExistsW
StrStrW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

__360sta
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 152KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
360se3/360se.exe
.exe windows:4 windows x86 arch:x86

9f39e6901fe8b75c7214da5e9d24d20b

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

CoInternetCombineUrl
CoGetClassObjectFromURL
CoInternetGetSession
RegisterBindStatusCallback
RevokeBindStatusCallback
ObtainUserAgentString

psapi

GetProcessMemoryInfo
GetModuleInformation

kernel32

GetVersionExW
VirtualQuery
SetUnhandledExceptionFilter
SetErrorMode
VirtualFree
VirtualAlloc
CopyFileW
FindClose
FindNextFileW
FindFirstFileW
OpenEventW
GetShortPathNameW
GetFileSize
CreateDirectoryW
FreeResource
LockResource
GlobalLock
GlobalAlloc
SizeofResource
LoadResource
FindResourceW
MoveFileW
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
lstrcmpA
CreateThread
GetSystemTime
TlsGetValue
GetCurrentThread
HeapFree
HeapAlloc
HeapCreate
VirtualProtect
DeviceIoControl
GlobalUnlock
GlobalSize
LocalFree
GlobalFree
EnumResourceLanguagesW
GetVersion
LocalAlloc
GetSystemInfo
SetProcessWorkingSetSize
ExitProcess
GetWindowsDirectoryW
GetProcessHeap
GetProcessTimes
GetSystemTimeAsFileTime
GlobalDeleteAtom
GlobalAddAtomW
CompareFileTime
FlushInstructionCache
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
SetEndOfFile
SystemTimeToFileTime
WriteFile
SetWaitableTimer
WaitForMultipleObjects
CancelWaitableTimer
IsBadReadPtr
IsBadWritePtr
GetSystemDirectoryW
CreateFileW
ReadFile
WideCharToMultiByte
TerminateThread
SetLastError
GetStartupInfoA
GetModuleHandleA
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetLongPathNameW
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CloseHandle
TlsFree
GetCommandLineW
GetLastError
CreateMutexW
lstrlenA
MoveFileExW
GetTempFileNameW
GetTickCount
TlsAlloc
CreateEventW
OpenProcess
GetCurrentProcessId
SetFileAttributesW
GetFileAttributesW
ExpandEnvironmentStringsW
Sleep
InitializeCriticalSection
FreeLibrary
WaitForSingleObject
OpenThread
GetCurrentThreadId
RemoveDirectoryW
GetTempPathW
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateProcessW
DeleteFileW
GetPrivateProfileStringW
GetLocaleInfoW
ResetEvent
TlsSetValue
DuplicateHandle
WriteProcessMemory
VirtualAllocEx
lstrlenW
GetExitCodeProcess
ReadProcessMemory
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
ResumeThread
GetThreadContext
SetThreadContext
SuspendThread
SetFileTime
GetDiskFreeSpaceExW
CreateWaitableTimerW
SetFilePointer
VirtualFreeEx
MultiByteToWideChar

user32

RegisterClassExW
MonitorFromRect
AdjustWindowRectEx
IsHungAppWindow
LoadImageW
GetWindowModuleFileNameW
GetActiveWindow
SetWindowRgn
DialogBoxParamW
RemovePropW
SetPropW
GetWindowRgn
EndDialog
SetDlgItemTextW
SetFocus
EndPaint
FillRect
GetClientRect
MapWindowPoints
GetDesktopWindow
GetWindowRect
GetDlgItem
BeginPaint
CopyRect
GetCursorPos
ScreenToClient
ClientToScreen
GetKeyState
DestroyIcon
InflateRect
SetWindowPos
SetWindowLongW
GetWindowLongW
CreateWindowExW
IsWindow
SendMessageW
UnregisterHotKey
RegisterHotKey
SubtractRect
FindWindowW
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
GetClipboardData
GetKeyNameTextW
GetWindowTextLengthW
IntersectRect
EnumThreadWindows
MoveWindow
GetMenuItemID
GetMenuState
SetLayeredWindowAttributes
SetActiveWindow
SetWindowPlacement
GetGUIThreadInfo
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetSysColor
InsertMenuItemW
SetRectEmpty
TrackPopupMenu
TrackPopupMenuEx
SetMenuInfo
MenuItemFromPoint
CheckMenuRadioItem
LoadBitmapW
GetDoubleClickTime
GetSystemMenu
GetPropW
DestroyMenu
IsClipboardFormatAvailable
EnableMenuItem
GetSubMenu
LoadMenuW
KillTimer
GetMenu
GetFocus
InvalidateRect
SetTimer
LoadStringW
RegisterWindowMessageW
AllowSetForegroundWindow
GetWindowThreadProcessId
PtInRect
GetKeyboardLayout
EnumWindows
GetClassNameW
IsWindowVisible
IsDlgButtonChecked
DrawIcon
LoadIconW
DrawTextW
CheckDlgButton
ShowWindow
DestroyWindow
MessageBoxW
GetForegroundWindow
EnableWindow
GetAncestor
SetForegroundWindow
TranslateMessage
DispatchMessageW
PeekMessageW
SetParent
PostQuitMessage
GetWindow
AttachThreadInput
EndMenu
SendMessageTimeoutW
WaitForInputIdle
EqualRect
PostThreadMessageW
ReplyMessage
InSendMessageEx
CreateAcceleratorTableW
LoadAcceleratorsW
TranslateAcceleratorW
DestroyAcceleratorTable
GetMenuItemInfoW
EnumChildWindows
SetCursorPos
SetWindowTextW
GetWindowTextW
CallWindowProcW
PostMessageW
DefWindowProcW
ReleaseDC
GetDC
GetMenuStringW
ReleaseCapture
SetCapture
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsIconic
GetDlgItemTextW
MapVirtualKeyW
keybd_event
GetMessagePos
RegisterClipboardFormatW
CreatePopupMenu
InsertMenuW
SetMenuItemInfoW
FindWindowExW
LoadCursorW
SetCursor
TrackMouseEvent
UpdateWindow
IsChild
CharNextW
GetWindowDC
WindowFromPoint
GetWindowPlacement
SystemParametersInfoW
GetMessageW
ActivateKeyboardLayout
SetClassLongW
GetParent
GetSystemMetrics
DeleteMenu
RemoveMenu
CheckMenuItem
IsZoomed
MsgWaitForMultipleObjects
OffsetRect
DrawIconEx
CopyAcceleratorTableW
IsMenu
GetMenuItemCount

gdi32

FillRgn
RoundRect
SetPixel
CreatePolygonRgn
CreateRoundRectRgn
GetStockObject
SetBkMode
CreateRectRgnIndirect
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
SetBitmapBits
CreateDIBSection
SetTextColor
CreateSolidBrush
StretchBlt
DeleteDC
CombineRgn
SetStretchBltMode
Rectangle
CreatePen
CreateFontIndirectW
GetObjectW
GetBitmapBits
LineTo
MoveToEx
GetDeviceCaps
GetDIBits
EnumFontsW
GetTextMetricsW
CreateRectRgn

comdlg32

GetSaveFileNameW
ChooseColorW
GetOpenFileNameW

advapi32

RegCreateKeyW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
RegGetKeySecurity
GetTokenInformation
CopySid
RegSetKeySecurity
RegQueryInfoKeyW
RegEnumKeyW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegDeleteKeyW

shell32

ord680
SHChangeNotify
ShellExecuteExW
SHFileOperationW
ExtractIconExW
SHGetSpecialFolderPathW
SHGetMalloc
ShellExecuteW
SHGetFolderPathW
SHGetFileInfoW
SHAppBarMessage
SHGetPathFromIDListW
SHBrowseForFolderW
Shell_NotifyIconW
DragQueryFileW
SHGetSpecialFolderLocation
SHGetDesktopFolder

ole32

CLSIDFromString
OleRun
CLSIDFromProgID
PropVariantClear
OleSetContainedObject
ReleaseStgMedium
CoMarshalInterface
GetHGlobalFromStream
OleDraw
OleCreate
OleInitialize
OleUninitialize
CoGetClassObject
CreateStreamOnHGlobal
CoUnmarshalInterface
CoCreateGuid
StringFromCLSID
CoTaskMemFree
CoGetMalloc
CoInitialize
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject
CoCreateInstance
RevokeDragDrop
OleDuplicateData
DoDragDrop
RegisterDragDrop

oleaut32

SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocStringLen
SysStringLen
VariantClear
SysAllocString
SafeArrayCreateVector
SysFreeString

shlwapi

UrlGetPartW
SHGetValueW
StrStrIA
PathIsDirectoryW
PathCombineW
PathIsURLW
PathFileExistsW
StrStrIW
SHStrDupW
SHDeleteKeyW
SHSetValueW
SHDeleteValueW
PathGetDriveNumberW
PathFindExtensionW
PathFindFileNameW
PathFindFileNameA
StrCmpIW
PathRemoveFileSpecW
UrlEscapeW
PathIsRootW
UrlCanonicalizeW
StrStrW
PathMatchSpecW
PathIsUNCW
StrRetToBufW
SHEnumKeyExW
UrlUnescapeW
UrlIsOpaqueW

wininet

InternetTimeToSystemTimeW
FindFirstUrlCacheEntryW
DeleteUrlCacheEntryW
UnlockUrlCacheEntryFileW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryA
DeleteUrlCacheEntryA
UnlockUrlCacheEntryFileA
FindNextUrlCacheEntryA
FindCloseUrlCache
InternetGetConnectedState
InternetCanonicalizeUrlW
CreateUrlCacheEntryW
CommitUrlCacheEntryW
InternetSetStatusCallbackA
HttpOpenRequestA
InternetOpenA
CommitUrlCacheEntryA
CreateUrlCacheEntryA
RetrieveUrlCacheEntryStreamA
UnlockUrlCacheEntryStream
InternetSetCookieW
InternetOpenW
InternetGetCookieW
InternetGetCookieExW
HttpAddRequestHeadersA
GetUrlCacheEntryInfoW
HttpQueryInfoW
FtpGetFileSize
HttpOpenRequestW
HttpSendRequestExW
InternetConnectW
InternetSetOptionA
InternetSetStatusCallbackW
InternetCloseHandle
InternetReadFileExA
InternetReadFile
HttpEndRequestW
FtpOpenFileW
InternetWriteFile
InternetGetLastResponseInfoW
FtpCommandW
InternetQueryOptionW
InternetSetOptionW
InternetCrackUrlW
InternetSetCookieExW

winmm

waveOutWrite
midiStreamClose
midiStreamOut

dsound

ord1

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

msvcrt

_wtol
_snprintf
toupper
isalnum
sprintf
iswalpha
wcspbrk
_ltow
_ftol
_wcsicmp
time
_wtoi
_beginthreadex
wcsrchr
_ui64tow
??2@YAPAXI@Z
wcschr
_itow
isalpha
_wcsnicmp
wcscpy
wcscat
wcsncmp
wcscmp
wcsstr
wcslen
_purecall
_snwprintf
__CxxFrameHandler
wcsncat
_wtoi64
_stricmp
fclose
fread
ftell
fseek
fopen
_wfopen
fwrite
wcsncpy
memmove
free
malloc
strstr
_except_handler3
mktime
localtime
fflush
wcstok
qsort
vswprintf
iswdigit
strncpy
strncmp
wcstod
iswspace
strrchr
fputs
swscanf
fputws
fwprintf
_strlwr
strncat
_CIpow
towlower
_ismbslead
fprintf
_strnicmp
fgets
rewind
_atoi64
realloc
exit
scanf
printf
memset
memcpy
_CxxThrowException
__dllonexit
_onexit
?terminate@@YAXXZ
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_controlfp
swprintf
_exit

gdiplus

GdipSetImageAttributesGamma
GdipSetImageAttributesColorMatrix
GdipSaveImageToFile
GdiplusShutdown
GdiplusStartup
GdipFree
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipAlloc
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromStream
GdipSetInterpolationMode
GdipDrawImageRectRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipGetImageEncoders
GdipGetImageEncodersSize

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

netapi32

Netbios

comctl32

ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Remove
ImageList_Draw
ImageList_GetIcon
ImageList_GetImageCount
ImageList_AddMasked
InitCommonControlsEx
ImageList_Duplicate
ImageList_SetBkColor
ImageList_DrawEx
ImageList_GetIconSize
ImageList_Create

Sections

.text
Size: 680KB - Virtual size: 679KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 962KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.taihang
Size: 184KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 480KB - Virtual size: 479KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
360se3/360se_ie.ico
360se3/Shield/Install/360SafeModuleSkin/360SESS.ico
360se3/Shield/Install/360SafeModuleSkin/SKIN.INI
360se3/Shield/Install/360SafeModuleSkin/borderbottom.png
.png
360se3/Shield/Install/360SafeModuleSkin/borderleft.png
.png
360se3/Shield/Install/360SafeModuleSkin/borderright.png
.png
360se3/Shield/Install/360SafeModuleSkin/menuhilight.png
.png
360se3/Shield/Install/360SafeModuleSkin/preview.png
.png
360se3/Shield/Install/360SafeModuleSkin/sidebartoolbg.png
.png
360se3/Shield/Install/360SafeModuleSkin/srcollbar.png
.png
360se3/Shield/Install/360SafeModuleSkin/tab_new.png
.png
360se3/Shield/Install/360SafeModuleSkin/tabbar.png
.png
360se3/Shield/Install/360sandbox.exe
.exe windows:4 windows x86 arch:x86

73b73e00f465fa1a2a3bf6377a40219b

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:3b:f8:85:49:64:12:20:7e:cb:70:ac:fa:c6:75:5b
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

24/11/2006, 00:00

Not After

23/11/2008, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=Secure Application Development,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
CloseHandle
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
MulDiv
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetCommandLineA

user32

ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
FindWindowExA

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

57354bdeea3dfae6e948101add87501a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
GetPrivateProfileIntA
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
MultiByteToWideChar
GlobalAlloc

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
MapWindowPoints
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadIconA

gdi32

SetTextColor
GetObjectA
SelectObject
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
CreateCompatibleDC

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 954B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallType.ini
$PLUGINSDIR/KmdUtil.exe
.exe windows:5 windows x86 arch:x86

312f0dc2e58fdfdb86d144b0679baa25

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\work\sbie\apps\kmdutil\obj\i386\KmdUtil.pdb

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
exit
_cexit
_XcptFilter
_exit
_c_exit
memset
wcslen
_wcsicmp
_wcsnicmp
wcscpy
_acmdln
wcscat
swprintf

advapi32

StartServiceW
RegSetValueExW
CreateServiceW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
OpenServiceW
DeleteService
ControlService
OpenSCManagerW
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
RegCreateKeyExW

kernel32

GetCommandLineW
Sleep
FormatMessageW
CloseHandle
GetCurrentProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetLastError
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA

user32

MessageBoxW

ntdll

NtClose
NtUnloadDriver
NtDeviceIoControlFile
RtlInitUnicodeString
NtOpenFile

shell32

CommandLineToArgvW

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

2db813254ea8b4d2a92d703ecb659f39

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpynA
lstrcmpA
lstrlenA
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc

user32

SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
LoadIconA
SendMessageA
ShowWindow
GetDC

gdi32

CreateFontIndirectA
GetDeviceCaps
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 681B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Warning.ini
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
LICENSE.TXT
SandboxieBITS.exe
.exe windows:5 windows x86 arch:x86

4a0846323fde3c7a4fcf9b9218bf0c8c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\work\sbie\apps\com\bits\obj\i386\SandboxieBITS.pdb

Imports

msvcrt

__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_except_handler3
_cexit
_XcptFilter
_exit
_c_exit
_controlfp
_wcsicmp
swprintf
wcscpy
wcslen
exit

advapi32

AccessCheckByType
DuplicateTokenEx
SetThreadToken
StartServiceCtrlDispatcherW

kernel32

ExitProcess
LoadLibraryW
TerminateProcess
CreateThread
SetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
HeapAlloc
GetProcessHeap
GetCurrentProcess
SetEvent
OpenEventW
GetProcAddress
CloseHandle
OpenProcess
Sleep

user32

wsprintfW
MessageBoxW

ole32

CoImpersonateClient

wtsapi32

WTSQueryUserToken

sbiedll

_SbieApi_EnumProcessEx@16
_SbieDll_Hook@12
_SbieApi_QueryConf@20
_SbieApi_QueryProcess@20

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SandboxieCrypto.exe
.exe windows:5 windows x86 arch:x86

4b8c9b37f6da2ffd863704179986d92f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\work\sbie\apps\com\crypto\obj\i386\SandboxieCrypto.pdb

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_initterm
_wcsicmp
swprintf
wcslen
wcscpy

advapi32

AccessCheckByType
StartServiceCtrlDispatcherW

kernel32

TerminateProcess
ExitProcess
GetProcAddress
CreateThread
SetLastError
QueryPerformanceCounter
CloseHandle
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
HeapAlloc
GetProcessHeap
GetCurrentProcess
SetEvent
OpenEventW
LoadLibraryW
OpenProcess
Sleep

user32

MessageBoxW
wsprintfW

sbiedll

_SbieApi_EnumProcessEx@16
_SbieDll_Hook@12
_SbieApi_QueryConf@20
_SbieApi_QueryProcess@20

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SandboxieDcomLaunch.exe
.exe windows:5 windows x86 arch:x86

d14e09a640f15cbab22fa9a80c180352

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\work\sbie\apps\com\dcomlaunch\obj\i386\SandboxieDcomLaunch.pdb

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_initterm
_wcsicmp
swprintf
wcslen
wcscpy
wcscmp

advapi32

GetTokenInformation
SetServiceStatus
RegisterServiceCtrlHandlerW
RegisterServiceCtrlHandlerExW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
StartServiceW
ControlService
StartServiceCtrlDispatcherW
QueryServiceStatusEx
OpenProcessToken
ConvertSidToStringSidW

kernel32

SuspendThread
GetCurrentThread
TerminateProcess
ExitProcess
CreateFileMappingW
GetProcAddress
CreateThread
SetLastError
QueryPerformanceCounter
CloseHandle
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
HeapAlloc
GetProcessHeap
GetCurrentProcess
SetEvent
OpenEventW
LoadLibraryW
OpenProcess
LocalFree
HeapFree
GetLastError
Sleep

user32

MessageBoxW
wsprintfW

ntdll

NtSetInformationProcess
RtlAdjustPrivilege

sbiedll

_SbieApi_EnumProcessEx@16
_SbieDll_IsBoxedService@4
_SbieDll_Hook@12
_SbieApi_QueryConf@20
_SbieApi_QueryProcess@20

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SandboxieEventSys.exe
.exe windows:5 windows x86 arch:x86

4b8c9b37f6da2ffd863704179986d92f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\work\sbie\apps\com\eventsys\obj\i386\SandboxieEventSys.pdb

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_initterm
_wcsicmp
swprintf
wcslen
wcscpy

advapi32

AccessCheckByType
StartServiceCtrlDispatcherW

kernel32

TerminateProcess
ExitProcess
GetProcAddress
CreateThread
SetLastError
QueryPerformanceCounter
CloseHandle
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
HeapAlloc
GetProcessHeap
GetCurrentProcess
SetEvent
OpenEventW
LoadLibraryW
OpenProcess
Sleep

user32

MessageBoxW
wsprintfW

sbiedll

_SbieApi_EnumProcessEx@16
_SbieDll_Hook@12
_SbieApi_QueryConf@20
_SbieApi_QueryProcess@20

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SandboxieRpcSs.exe
.exe windows:5 windows x86 arch:x86

be520d1f80f3efb9dd14c287f83e5eef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\work\sbie\apps\com\rpcss\obj\i386\SandboxieRpcSs.pdb

Imports

msvcrt

__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
__p__fmode
_cexit
_XcptFilter
_exit
_c_exit
__set_app_type
_except_handler3
_controlfp
_wcsicmp
swprintf
exit
wcslen
wcscpy
wcscmp

advapi32

GetTokenInformation
SetServiceStatus
RegisterServiceCtrlHandlerW
RegisterServiceCtrlHandlerExW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
StartServiceW
ControlService
StartServiceCtrlDispatcherW
QueryServiceStatusEx
OpenProcessToken
ConvertSidToStringSidW

kernel32

SuspendThread
GetCurrentThread
TerminateProcess
ExitProcess
CreateFileMappingW
GetProcAddress
CreateThread
SetLastError
QueryPerformanceCounter
HeapFree
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
HeapAlloc
GetProcessHeap
GetCurrentProcess
SetEvent
OpenEventW
LoadLibraryW
CloseHandle
LocalFree
OpenProcess
GetLastError
Sleep

user32

wsprintfW
MessageBoxW

ntdll

NtSetInformationProcess
RtlAdjustPrivilege

ws2_32

listen
bind
WSAStartup

sbiedll

_SbieApi_EnumProcessEx@16
_SbieDll_IsBoxedService@4
_SbieDll_Hook@12
_SbieApi_QueryConf@20
_SbieApi_QueryProcess@20

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SandboxieWUAU.exe
.exe windows:5 windows x86 arch:x86

8d791d3feb0c687c8d8698d0c7aac411

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\work\sbie\apps\com\wuau\obj\i386\SandboxieWUAU.pdb

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_initterm
_wcsicmp
swprintf
wcslen
wcscpy

advapi32

AccessCheckByType
StartServiceCtrlDispatcherW

kernel32

TerminateProcess
GetVersionExW
LoadLibraryW
GetProcAddress
CreateThread
QueryPerformanceCounter
CloseHandle
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetProcessHeap
GetCurrentProcess
SetEvent
OpenEventW
Sleep
ExitProcess
HeapAlloc
OpenProcess
SetLastError

user32

MessageBoxW
wsprintfW

sbiedll

_SbieApi_EnumProcessEx@16
_SbieDll_Hook@12
_SbieApi_QueryConf@20
_SbieApi_QueryProcess@20

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SbieCtrl.exe
.exe windows:5 windows x86 arch:x86

a47ee88d4d2cfab54a1710b017d5e098

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\work\sbie\apps\control\obj\i386\SbieCtrl.pdb

Imports

mfc42u

ord6024
ord2756
ord926
ord2634
ord3312
ord5426
ord4704
ord5977
ord1165
ord1662
ord2644
ord5949
ord6563
ord5945
ord6193
ord3356
ord5947
ord3090
ord3658
ord3621
ord2406
ord3566
ord1634
ord1633
ord5781
ord4215
ord2576
ord3649
ord2430
ord2858
ord1637
ord1143
ord2854
ord2371
ord6051
ord1768
ord5286
ord3393
ord4418
ord3728
ord567
ord810
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6168
ord5869
ord5785
ord5790
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord3591
ord640
ord6190
ord6017
ord323
ord4266
ord4532
ord2115
ord3282
ord3291
ord6266
ord3909
ord1084
ord4688
ord3749
ord5142
ord3016
ord4847
ord6376
ord2078
ord326
ord4270
ord3737
ord818
ord2144
ord5856
ord773
ord772
ord5603
ord5602
ord500
ord5677
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord3396
ord4616
ord3733
ord561
ord815
ord2613
ord5568
ord2910
ord4237
ord4718
ord2715
ord2382
ord3054
ord5094
ord5097
ord4461
ord4298
ord3345
ord5006
ord975
ord5468
ord3398
ord2874
ord2873
ord4146
ord4072
ord5278
ord2641
ord1658
ord4430
ord5248
ord4421
ord3618
ord674
ord3865
ord2455
ord491
ord4219
ord2447
ord2550
ord366
ord1105
ord291
ord910
ord2574
ord4396
ord3635
ord693
ord2857
ord4238
ord697
ord395
ord4181
ord6896
ord3281
ord3905
ord6688
ord686
ord3991
ord2445
ord2088
ord384
ord2092
ord5625
ord3431
ord2855
ord3397
ord3716
ord795
ord2567
ord4390
ord3569
ord609
ord1764
ord6362
ord2405
ord2016
ord4214
ord2573
ord4395
ord3634
ord692
ord6316
ord2769
ord3084
ord5639
ord2070
ord2091
ord2108
ord4282
ord4279
ord1644
ord6238
ord913
ord700
ord398
ord6279
ord6278
ord3434
ord2776
ord909
ord3638
ord696
ord3930
ord394
ord5586
ord3430
ord4180
ord1172
ord3568
ord5706
ord860
ord283
ord5871
ord4128
ord4292
ord2746
ord2836
ord2099
ord4199
ord5446
ord6390
ord5436
ord6379
ord613
ord3490
ord4078
ord1834
ord289
ord3688
ord3614
ord2705
ord3995
ord6004
ord2579
ord4400
ord3389
ord3724
ord804
ord6777
ord4254
ord1900
ord1683
ord2520
ord5284
ord4433
ord2046
ord4425
ord771
ord497
ord2400
ord6868
ord2606
ord6655
ord4120
ord3470
ord3285
ord3298
ord5845
ord2876
ord6451
ord2877
ord6437
ord1258
ord2111
ord1761
ord4709
ord2629
ord1230
ord5784
ord472
ord755
ord470
ord2036
ord2440
ord1569
ord768
ord4253
ord414
ord3979
ord713
ord3657
ord5817
ord5600
ord5855
ord924
ord5617
ord4124
ord6654
ord539
ord501
ord1083
ord536
ord4273
ord941
ord715
ord415
ord5597
ord5616
ord1081
ord1008
ord925
ord1085
ord2757
ord6565
ord5605
ord2010
ord3694
ord4829
ord5283
ord4371
ord4352
ord4942
ord4970
ord4899
ord5154
ord5156
ord5155
ord823
ord3798
ord5679
ord4272
ord2755
ord4197
ord542
ord5618
ord802
ord3087
ord927
ord6195
ord540
ord2810
ord535
ord6211
ord3871
ord922
ord940
ord825
ord2637
ord324
ord538
ord537
ord800
ord942
ord861
ord858
ord641
ord3592
ord4419
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5276
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4370
ord5261
ord4229
ord2859
ord3133
ord1135
ord4294
ord5830

msvcrt

wcsrchr
wcscmp
__CxxFrameHandler
_wtoi64
_wcsicmp
wcschr
_wcsnicmp
malloc
wcscat
free
memcpy
memset
wcscpy
_wtoi
wcslen
_controlfp
?terminate@@YAXXZ
_onexit
__dllonexit
exit
time
wcsstr
wcsncpy
towlower
memmove
atof
strchr
toupper
_purecall
__RTDynamicCast
_c_exit
_exit
_XcptFilter
_cexit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
??1type_info@@UAE@XZ

advapi32

CloseEventLog
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegOpenKeyW
RegEnumValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
ReadEventLogW
OpenEventLogW

kernel32

LockResource
GlobalAlloc
GlobalLock
GlobalFree
DeleteFileW
InterlockedIncrement
InterlockedDecrement
GetModuleHandleW
Sleep
CopyFileW
LoadResource
MapViewOfFile
CreateFileMappingW
RemoveDirectoryW
CreateDirectoryW
WriteFile
GetTempPathW
CreateProcessW
GetProcAddress
GetProcessTimes
LoadLibraryW
FreeLibrary
SizeofResource
FindResourceW
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
InitializeCriticalSection
LocalAlloc
LocalFree
HeapFree
GetProcessHeap
CloseHandle
GetFileTime
GetLastError
CreateFileW
GetCurrentProcessId
CreateThread
ProcessIdToSessionId
HeapAlloc
GetVersionExW
CreateMutexW
OpenMutexW
GetCommandLineW
WaitForSingleObject
TerminateProcess
OpenProcess
GetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
GetSystemWindowsDirectoryW
GetDriveTypeW
UnmapViewOfFile
GetModuleFileNameW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GlobalUnlock
GetStartupInfoW

gdi32

GetCurrentObject
SetTextColor
GetClipBox
CreateFontIndirectW
CreateSolidBrush
GetObjectW
CreatePen
GetTextMetricsW
SetPixel
GetPixel
Rectangle
CreatePatternBrush
GetStockObject
Ellipse
BitBlt
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
PatBlt
LPtoDP
DPtoLP
GetWindowExtEx
GetViewportExtEx
GetMapMode
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GetTextExtentPoint32W
DeleteObject
GetTextColor

user32

DestroyCursor
GetWindowLongW
SendMessageW
UnhookWindowsHookEx
SetCursor
ReleaseCapture
GetParent
CallNextHookEx
PostMessageW
IsWindowVisible
PtInRect
EnumChildWindows
WindowFromPoint
CallWindowProcW
SetWindowsHookExW
SetCapture
SetWindowLongW
SetWindowPos
MoveWindow
GetDC
CreateWindowExW
SetFocus
ScreenToClient
GetDlgItem
SetWindowTextW
ShowWindow
GetDlgCtrlID
LoadBitmapW
SendDlgItemMessageW
MessageBoxW
EnableWindow
SetTimer
CopyRect
EnableMenuItem
LoadCursorW
LoadMenuW
BeginPaint
EndPaint
UpdateWindow
InvalidateRect
TabbedTextOutW
DrawTextW
GrayStringW
GetMessagePos
GetWindowThreadProcessId
KillTimer
SetForegroundWindow
DispatchMessageW
TranslateMessage
GetMessageW
LoadIconW
MsgWaitForMultipleObjects
PeekMessageW
RegisterWindowMessageW
RegisterClassExW
DefWindowProcW
SystemParametersInfoW
FindWindowW
CreatePopupMenu
DeleteMenu
AppendMenuW
SetMenuDefaultItem
GetMenuItemCount
GetMenuItemID
GetMenuStringW
InsertMenuW
ModifyMenuW
GetMenu
PostQuitMessage
GetCursorPos
wsprintfW
GetSystemMetrics
GetKeyState
FindWindowExW
DestroyIcon
EnumWindows
DrawStateW
GetSysColor
GetMenuItemInfoW
GetMenuItemRect
GetClassNameW
SetMenuItemInfoW
IsMenu
IsRectEmpty
GetDesktopWindow
IsWindow
GetSysColorBrush
GetIconInfo
GetWindowRect
GetClientRect
ClientToScreen
OffsetRect
GetWindowDC
SetRect
InvertRect
ReleaseDC
GetSubMenu
GetWindow

ntdll

NtCreateFile
NtQueryDirectoryFile

psapi

GetModuleFileNameExW

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
Shell_NotifyIconW
ShellExecuteW
ShellExecuteExW
SHFileOperationW
ord165
DragQueryFileW
SHGetFolderPathW
ExtractIconExW

comctl32

ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Draw
ImageList_GetIcon
ImageList_GetImageCount
ImageList_Remove
ImageList_GetImageInfo

comdlg32

GetOpenFileNameW

gdiplus

GdipDisposeImage
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream

wininet

InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW

ole32

CreateStreamOnHGlobal
CoTaskMemFree
CoInitialize
CoCreateInstance

sbiedll

_SbieApi_FreeReply@4
_SbieApi_GetVersion@4
_SbieDll_StartSbieDrv@4
_SbieDll_FormatMessage0@4
_SbieDll_FormatMessage1@8
_SbieApi_KillProcess@4
_SbieApi_EnumBoxes@8
_SbieApi_ReloadConf@4
_SbieApi_QueryBoxPath@28
_SbieApi_QueryConf@20
_SbieDll_TranslateNtToDosPath@4
_SbieDll_GetAllUsersPath@0
_SbieDll_GetUserPath@0
_SbieDll_GetDrivePath@4
_SbieApi_EnumProcessEx@16
_SbieApi_QueryProcess@20
_SbieDll_GetBoxFilePath@8
_SbieApi_CallServer@4
_SbieDll_StartSbieSvc@4
_SbieApi_GetWork@12
_SbieApi_SetLicense@8
_SbieApi_GetLicense@4
_SbieDll_FormatMessage@8
_SbieDll_FormatMessage2@12
_SbieDll_CanElevateOnVista@0
_SbieDll_DeviceChange@8
_SbieApi_DisableForceProcess@8
_SbieDll_RunFromHome@16
_SbieDll_GetLanguage@4

Sections

.text
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 500KB - Virtual size: 500KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SbieDll.dll
.dll windows:5 windows x86 arch:x86

9723b08c5881e2538c90d7020dff66e9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\work\sbie\core\dll\obj\i386\SbieDll.pdb

Imports

ntdll

NtAssignProcessToJobObject
LdrGetProcedureAddress
RtlCreateProcessParameters
NtDeviceIoControlFile
_vsnprintf
NtRegisterThreadTerminatePort
NtRequestWaitReplyPort
NtAdjustPrivilegesToken
RtlFreeAnsiString
NtQuerySecurityObject
NtDuplicateObject
NtOpenThread
NtOpenProcess
NtQuerySystemInformation
RtlUnwind
NtQueryVirtualMemory
LdrLoadDll
NtLoadDriver
LdrUnloadDll
NtDeleteKey
NtEnumerateKey
NtEnumerateValueKey
NtQueryMultipleValueKey
NtNotifyChangeKey
NtNotifyChangeMultipleKeys
NtSaveKey
NtSetInformationKey
NtCreatePort
NtConnectPort
NtCreateEvent
NtOpenEvent
NtCreateMutant
NtOpenMutant
NtCreateSemaphore
NtOpenSemaphore
NtCreateSection
NtOpenSection
RtlInitString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
strchr
sprintf
_stricmp
RtlUnicodeStringToAnsiString
strncmp
wcsncmp
_wtoi
NtQueryAttributesFile
NtSetInformationFile
NtCreateNamedPipeFile
NtCreateMailslotFile
NtFsControlFile
RtlGetCurrentDirectory_U
RtlGetFullPathName_U
NtDeleteFile
towlower
NtReadFile
NtWriteFile
NtQueryInformationToken
RtlConvertSidToUnicodeString
NtQueryObject
RtlCompareUnicodeString
NtQueryInformationFile
NtCreateFile
NtQueryFullAttributesFile
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
memmove
RtlQueryRegistryValues
NtOpenDirectoryObject
NtSetInformationProcess
NtOpenFile
_wcsicmp
NtQueryDirectoryFile
wcscmp
wcsncpy
RtlCompareMemory
wcschr
_wcslwr
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
NtProtectVirtualMemory
wcsrchr
wcsstr
NtDeleteValueKey
NtQueryValueKey
NtQueryKey
NtOpenKey
wcscpy
wcscat
RtlInitUnicodeString
NtCreateKey
swprintf
NtSetValueKey
wcslen
NtOpenProcessToken
NtPrivilegeCheck
NtClose
NtSetSecurityObject
_wcsnicmp

kernel32

CreateMutexW
CreateFileMappingW
ReleaseMutex
GetWindowsDirectoryW
HeapDestroy
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
OpenProcess
CreateFileA
FindResourceExW
FormatMessageW
QueueUserWorkItem
GetLongPathNameW
GetFullPathNameW
OpenFileMappingW
MapViewOfFile
CreateThread
GetSystemWindowsDirectoryW
WinExec
CreateProcessA
GetCurrentDirectoryW
GetEnvironmentStringsW
InterlockedIncrement
InterlockedDecrement
GetTickCount
Sleep
CreateEventW
OpenEventW
HeapFree
GetProcessHeap
HeapAlloc
OutputDebugStringW
VirtualFree
RaiseException
SleepEx
GetCommandLineW
LoadLibraryW
FreeLibrary
FindResourceW
FindResourceA
LoadResource
LockResource
OpenThread
GetThreadTimes
GlobalAddAtomW
WideCharToMultiByte
GetModuleFileNameW
SetConsoleTitleA
SetConsoleTitleW
GetVolumeInformationW
GetCurrentThread
QueueUserAPC
CreateFileW
GetSystemTimeAsFileTime
GetCurrentThreadId
InterlockedExchange
SetEvent
InterlockedCompareExchange
TlsGetValue
TlsSetValue
TlsAlloc
InitializeCriticalSection
DisableThreadLibraryCalls
GetCurrentProcessId
GetCurrentProcess
EnterCriticalSection
VirtualAlloc
LeaveCriticalSection
VirtualProtect
ExitProcess
GetModuleHandleW
ExpandEnvironmentStringsW
CreateProcessW
WaitForSingleObject
CloseHandle
SetLastError
LocalAlloc
LocalFree
GetProcAddress
GetLastError
HeapCreate

Exports

Exports

SbieApi_Log
SbieApi_LogEx
_SbieApi_CallServer@4
_SbieApi_CallZero@4
_SbieApi_CreateDirOrLink@8
_SbieApi_DisableForceProcess@8
_SbieApi_DuplicateObject@20
_SbieApi_EnumBoxes@8
_SbieApi_EnumProcessEx@16
_SbieApi_FreeReply@4
_SbieApi_GetInjectSaveArea@12
_SbieApi_GetLicense@4
_SbieApi_GetSetDeviceMap@4
_SbieApi_GetVersion@4
_SbieApi_GetWork@12
_SbieApi_HookTramp@8
_SbieApi_KillProcess@4
_SbieApi_PortName@0
_SbieApi_QueryBoxPath@28
_SbieApi_QueryConf@20
_SbieApi_QueryPathList@12
_SbieApi_QueryProcess@20
_SbieApi_QueryProcessPath@28
_SbieApi_ReloadConf@4
_SbieApi_RenameFile@16
_SbieApi_SetLicense@8
_SbieApi_SetUserName@8
_SbieApi_StartProcess@16
_SbieDll_AssocQueryCommand@4
_SbieDll_AssocQueryProgram@4
_SbieDll_CanElevateOnVista@0
_SbieDll_DeviceChange@8
_SbieDll_FormatMessage0@4
_SbieDll_FormatMessage1@8
_SbieDll_FormatMessage2@12
_SbieDll_FormatMessage@8
_SbieDll_GetAllUsersPath@0
_SbieDll_GetBoxFilePath@8
_SbieDll_GetDrivePath@4
_SbieDll_GetHandlePath@12
_SbieDll_GetLanguage@4
_SbieDll_GetUserPath@0
_SbieDll_Hook@12
_SbieDll_InitPStore@0
_SbieDll_InitProcess@0
_SbieDll_IsBoxedService@4
_SbieDll_IsDirectory@4
_SbieDll_IsWow64@0
_SbieDll_RunFromHome@16
_SbieDll_StartCOM@0
_SbieDll_StartSbieDrv@4
_SbieDll_StartSbieSvc@4
_SbieDll_TranslateNtToDosPath@4

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieDllX.dll
.dll windows:5 windows x86 arch:x86

9723b08c5881e2538c90d7020dff66e9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\work\sbie\core\dll\obj\i386\SbieDll.pdb

Imports

ntdll

NtAssignProcessToJobObject
LdrGetProcedureAddress
RtlCreateProcessParameters
NtDeviceIoControlFile
_vsnprintf
NtRegisterThreadTerminatePort
NtRequestWaitReplyPort
NtAdjustPrivilegesToken
RtlFreeAnsiString
NtQuerySecurityObject
NtDuplicateObject
NtOpenThread
NtOpenProcess
NtQuerySystemInformation
RtlUnwind
NtQueryVirtualMemory
LdrLoadDll
NtLoadDriver
LdrUnloadDll
NtDeleteKey
NtEnumerateKey
NtEnumerateValueKey
NtQueryMultipleValueKey
NtNotifyChangeKey
NtNotifyChangeMultipleKeys
NtSaveKey
NtSetInformationKey
NtCreatePort
NtConnectPort
NtCreateEvent
NtOpenEvent
NtCreateMutant
NtOpenMutant
NtCreateSemaphore
NtOpenSemaphore
NtCreateSection
NtOpenSection
RtlInitString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
strchr
sprintf
_stricmp
RtlUnicodeStringToAnsiString
strncmp
wcsncmp
_wtoi
NtQueryAttributesFile
NtSetInformationFile
NtCreateNamedPipeFile
NtCreateMailslotFile
NtFsControlFile
RtlGetCurrentDirectory_U
RtlGetFullPathName_U
NtDeleteFile
towlower
NtReadFile
NtWriteFile
NtQueryInformationToken
RtlConvertSidToUnicodeString
NtQueryObject
RtlCompareUnicodeString
NtQueryInformationFile
NtCreateFile
NtQueryFullAttributesFile
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
memmove
RtlQueryRegistryValues
NtOpenDirectoryObject
NtSetInformationProcess
NtOpenFile
_wcsicmp
NtQueryDirectoryFile
wcscmp
wcsncpy
RtlCompareMemory
wcschr
_wcslwr
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
NtProtectVirtualMemory
wcsrchr
wcsstr
NtDeleteValueKey
NtQueryValueKey
NtQueryKey
NtOpenKey
wcscpy
wcscat
RtlInitUnicodeString
NtCreateKey
swprintf
NtSetValueKey
wcslen
NtOpenProcessToken
NtPrivilegeCheck
NtClose
NtSetSecurityObject
_wcsnicmp

kernel32

CreateMutexW
CreateFileMappingW
ReleaseMutex
GetWindowsDirectoryW
HeapDestroy
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
OpenProcess
CreateFileA
FindResourceExW
FormatMessageW
QueueUserWorkItem
GetLongPathNameW
GetFullPathNameW
OpenFileMappingW
MapViewOfFile
CreateThread
GetSystemWindowsDirectoryW
WinExec
CreateProcessA
GetCurrentDirectoryW
GetEnvironmentStringsW
InterlockedIncrement
InterlockedDecrement
GetTickCount
Sleep
CreateEventW
OpenEventW
HeapFree
GetProcessHeap
HeapAlloc
OutputDebugStringW
VirtualFree
RaiseException
SleepEx
GetCommandLineW
LoadLibraryW
FreeLibrary
FindResourceW
FindResourceA
LoadResource
LockResource
OpenThread
GetThreadTimes
GlobalAddAtomW
WideCharToMultiByte
GetModuleFileNameW
SetConsoleTitleA
SetConsoleTitleW
GetVolumeInformationW
GetCurrentThread
QueueUserAPC
CreateFileW
GetSystemTimeAsFileTime
GetCurrentThreadId
InterlockedExchange
SetEvent
InterlockedCompareExchange
TlsGetValue
TlsSetValue
TlsAlloc
InitializeCriticalSection
DisableThreadLibraryCalls
GetCurrentProcessId
GetCurrentProcess
EnterCriticalSection
VirtualAlloc
LeaveCriticalSection
VirtualProtect
ExitProcess
GetModuleHandleW
ExpandEnvironmentStringsW
CreateProcessW
WaitForSingleObject
CloseHandle
SetLastError
LocalAlloc
LocalFree
GetProcAddress
GetLastError
HeapCreate

Exports

Exports

SbieApi_Log
SbieApi_LogEx
_SbieApi_CallServer@4
_SbieApi_CallZero@4
_SbieApi_CreateDirOrLink@8
_SbieApi_DisableForceProcess@8
_SbieApi_DuplicateObject@20
_SbieApi_EnumBoxes@8
_SbieApi_EnumProcessEx@16
_SbieApi_FreeReply@4
_SbieApi_GetInjectSaveArea@12
_SbieApi_GetLicense@4
_SbieApi_GetSetDeviceMap@4
_SbieApi_GetVersion@4
_SbieApi_GetWork@12
_SbieApi_HookTramp@8
_SbieApi_KillProcess@4
_SbieApi_PortName@0
_SbieApi_QueryBoxPath@28
_SbieApi_QueryConf@20
_SbieApi_QueryPathList@12
_SbieApi_QueryProcess@20
_SbieApi_QueryProcessPath@28
_SbieApi_ReloadConf@4
_SbieApi_RenameFile@16
_SbieApi_SetLicense@8
_SbieApi_SetUserName@8
_SbieApi_StartProcess@16
_SbieDll_AssocQueryCommand@4
_SbieDll_AssocQueryProgram@4
_SbieDll_CanElevateOnVista@0
_SbieDll_DeviceChange@8
_SbieDll_FormatMessage0@4
_SbieDll_FormatMessage1@8
_SbieDll_FormatMessage2@12
_SbieDll_FormatMessage@8
_SbieDll_GetAllUsersPath@0
_SbieDll_GetBoxFilePath@8
_SbieDll_GetDrivePath@4
_SbieDll_GetHandlePath@12
_SbieDll_GetLanguage@4
_SbieDll_GetUserPath@0
_SbieDll_Hook@12
_SbieDll_InitPStore@0
_SbieDll_InitProcess@0
_SbieDll_IsBoxedService@4
_SbieDll_IsDirectory@4
_SbieDll_IsWow64@0
_SbieDll_RunFromHome@16
_SbieDll_StartCOM@0
_SbieDll_StartSbieDrv@4
_SbieDll_StartSbieSvc@4
_SbieDll_TranslateNtToDosPath@4

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieDrv.sys
.sys windows:5 windows x86 arch:x86

941583abe4e5e1c967bb33cb486b15b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\work\sbie\core\drv\obj\i386\SbieDrv.pdb

Imports

ntoskrnl.exe

_except_handler3
ProbeForWrite
wcslen
ZwClose
ZwSetEvent
ZwOpenEvent
RtlInitUnicodeString
wcsncpy
ExRaiseStatus
IoCreateDevice
IoDeleteDevice
wcscpy
RtlFreeUnicodeString
memmove
wcschr
wcscat
_wcsicmp
KeDelayExecutionThread
RtlQueryRegistryValues
_itow
_wcsnicmp
ExFreePoolWithTag
ExAllocatePoolWithTag
RtlUnicodeStringToInteger
swprintf
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwQueryInformationFile
ZwCreateFile
PsGetVersion
ObfDereferenceObject
ObReferenceObjectByHandle
wcsrchr
ZwQueryValueKey
ZwOpenKey
ZwAdjustPrivilegesToken
ZwDuplicateToken
ZwOpenProcessToken
ZwOpenProcess
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ZwSetInformationFile
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
MmGetSystemRoutineAddress
KeGetCurrentThread
PsLookupThreadByThreadId
ZwQuerySystemInformation
ZwOpenThread
ZwAllocateVirtualMemory
PsGetCurrentProcessId
ExGetPreviousMode
KeSetTargetProcessorDpc
KeSetImportanceDpc
KeInitializeDpc
KeQueryActiveProcessors
PsGetCurrentThreadId
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
MmBuildMdlForNonPagedPool
KeServiceDescriptorTable
ZwYieldExecution
ZwAccessCheckAndAuditAlarm
RtlCompareMemory
wcstombs
IoCreateFile
ZwReadFile
wcsstr
_wcslwr
ZwCreateDirectoryObject
ZwQueryInformationProcess
ZwCreateSymbolicLinkObject
wcscmp
ZwLoadKey
ZwUnloadKey
ZwSetValueKey
KeQuerySystemTime
ZwCreateKey
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
DbgPrint
ObOpenObjectByName
ObQueryNameString
RtlCaptureStackBackTrace
PsSetLoadImageNotifyRoutine
PsSetCreateProcessNotifyRoutine
RtlIntegerToUnicodeString
PsLookupProcessByProcessId
_alldiv
SeTokenIsAdmin
PsReferencePrimaryToken
IoGetCurrentProcess
wcsncmp
ZwQueryInformationToken
ZwFreeVirtualMemory
IoGetRequestorProcessId
ZwSetInformationProcess
NtDuplicateObject
SeSinglePrivilegeCheck
IoThreadToProcess
RtlConvertSidToUnicodeString
ZwOpenThreadToken
ProbeForRead
KeBugCheckEx
KeInsertQueueDpc
IofCompleteRequest

hal

KfLowerIrql
KeGetCurrentIrql
KfRaiseIrql

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieMsg.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\work\sbie\core\msg\obj\i386\SbieMsg.pdb

Sections

.text
Size: 512B - Virtual size: 151B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SbieSvc.exe
.exe windows:5 windows x86 arch:x86

aa16ef9f63cd36b30c4afc0004a63842

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\work\sbie\core\svc\obj\i386\SbieSvc.pdb

Imports

msvcrt

??3@YAXPAX@Z
wcsstr
wcscat
wcscpy
??2@YAPAXI@Z
wcscmp
_wcslwr
towlower
_wcsnicmp
wcschr
wcsrchr
_wcsicmp
_except_handler3
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
wcslen

advapi32

OpenEventLogW
CreateProcessAsUserW
EnumServicesStatusW
QueryServiceConfigW
QueryServiceConfig2W
QueryServiceStatusEx
CloseServiceHandle
StartServiceW
OpenThreadToken
CheckTokenMembership
FreeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertStringSidToSidW
LookupAccountSidW
RevertToSelf
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetEntriesInAclW
SetSecurityDescriptorDacl
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
OpenSCManagerW
OpenServiceW
ControlService
ReportEventW

kernel32

LocalFree
LeaveCriticalSection
FlushFileBuffers
EnterCriticalSection
InitializeCriticalSection
GetVersionExW
GetWindowsDirectoryW
DeleteFileW
SetEndOfFile
WriteFile
CopyFileW
OpenProcess
GetTickCount
SetFileAttributesW
GetFileAttributesW
HeapReAlloc
ProcessIdToSessionId
GetSystemWindowsDirectoryW
CancelIo
GetProcAddress
LoadLibraryW
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateThread
SleepEx
InterlockedCompareExchange
VirtualAlloc
ExitProcess
RaiseException
VirtualFree
OutputDebugStringW
GetLastError
QueueUserWorkItem
Sleep
GetCommandLineW
CloseHandle
HeapAlloc
GetProcessHeap
GetCurrentProcess
HeapFree
SetLastError
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
HeapDestroy
HeapCreate
WaitForMultipleObjects
TerminateThread
WaitForSingleObject
SetEvent
InterlockedExchange
CreateEventW
SetThreadPriority
GetCurrentThread
InterlockedIncrement
TerminateProcess
CreateFileW
GetTempPathW
GetSystemTimeAsFileTime
GetFileTime
GetStartupInfoA

user32

wsprintfW

ntdll

NtOpenThreadToken
NtOpenProcessToken
NtQueryInformationToken
NtFilterToken
NtDuplicateToken
NtSetInformationThread
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
NtQueryFullAttributesFile
NtSetInformationFile
NtClose
NtCompleteConnectPort
NtQueryDirectoryFile
NtCreateFile
NtQueryInformationFile
NtWriteFile
NtReadFile
NtLoadDriver
RtlInitUnicodeString
NtCreatePort
NtReplyWaitReceivePort
NtImpersonateClientOfPort
NtAcceptConnectPort

setupapi

SetupDiClassNameFromGuidExW
SetupDiBuildClassInfoList
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
SetupDiDestroyDeviceInfoList
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoList
CM_Get_Device_Interface_ListA
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeA
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_Alias_ExW

crypt32

CryptProtectData
CryptUnprotectData

wintrust

CryptCATAdminCalcHashFromFileHandle

ole32

CoTaskMemFree

sbiedll

SbieApi_Log
_SbieApi_PortName@0
SbieApi_LogEx
_SbieApi_CallZero@4
_SbieApi_EnumProcessEx@16
_SbieApi_SetUserName@8
_SbieApi_GetVersion@4
_SbieApi_GetWork@12
_SbieApi_QueryConf@20
_SbieDll_RunFromHome@16
_SbieApi_ReloadConf@4
_SbieApi_QueryProcess@20
_SbieApi_QueryProcessPath@28

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Start.exe
.exe windows:5 windows x86 arch:x86

7e2cb18418150632b82571e4227a4418

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\work\sbie\apps\start\obj\i386\Start.pdb

Imports

advapi32

SetThreadToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CreateProcessAsUserW

kernel32

ExpandEnvironmentStringsW
HeapAlloc
GetProcessHeap
ExitProcess
GetCommandLineW
MapViewOfFile
FindClose
FindNextFileW
FindFirstFileW
HeapDestroy
HeapCreate
HeapFree
GetSystemWindowsDirectoryW
GetFullPathNameW
GetSystemTimeAsFileTime
GetExitCodeProcess
WaitForSingleObject
GetModuleFileNameW
RemoveDirectoryW
CreateProcessW
GetModuleHandleW
OpenMutexW
CloseHandle
Sleep
GetStdHandle
WriteFile
SetLastError
GetLastError
LocalFree
FormatMessageW

gdi32

SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
PatBlt
SetBkColor
SetTextColor
GetObjectW
CreateFontIndirectW

user32

SetMenuInfo
MessageBoxW
wsprintfW
SetTimer
SendMessageW
SetWindowPos
EndDialog
SetFocus
ShowWindow
SendDlgItemMessageW
KillTimer
EnableWindow
GetSysColorBrush
GetSysColor
GetDlgItem
DialogBoxParamW
LoadImageW
CreateWindowExW
GetWindowInfo
GetWindowRect
SetWindowTextW
GetWindowTextW
GetClientRect
GetDesktopWindow
DestroyIcon
DrawIconEx
GetDC
CreateMenu
GetMenuItemCount
InsertMenuItemW
DestroyWindow
DestroyMenu
TrackPopupMenu
CreatePopupMenu

ntdll

NtQueryVirtualMemory
_chkstk
_wcsnicmp
strlen
wcscpy
RtlUnwind
NtTerminateThread
NtQueryInformationFile
NtCreateFile
NtSetInformationFile
RtlNtStatusToDosError
wcscmp
wcscat
iswctype
_wcsicmp
wcsncmp
_wtoi
wcsrchr
memmove
wcslen
memcpy
wcsncpy
RtlInitUnicodeString
NtOpenDirectoryObject
NtQueryObject
NtClose
strcmp
memset
towlower
sprintf
NtTerminateProcess

shlwapi

SHAutoComplete
AssocQueryStringW

shell32

SHGetFolderPathW
ExtractIconExW
ShellExecuteExW

ole32

CoTaskMemFree
CoInitialize
CoCreateInstance

comdlg32

GetOpenFileNameW

comctl32

InitCommonControlsEx

sbiedll

_SbieDll_StartCOM@0
SbieApi_Log
_SbieApi_GetSetDeviceMap@4
_SbieApi_StartProcess@16
_SbieDll_InitProcess@0
_SbieApi_QueryProcess@20
_SbieDll_RunFromHome@16
_SbieDll_FormatMessage0@4
_SbieApi_CallServer@4
_SbieDll_StartSbieSvc@4
_SbieDll_StartSbieDrv@4
_SbieApi_QueryConf@20
_SbieApi_FreeReply@4
_SbieApi_EnumProcessEx@16
_SbieApi_SetLicense@8
_SbieDll_FormatMessage@8
_SbieDll_GetLanguage@4
_SbieDll_CanElevateOnVista@0
_SbieApi_KillProcess@4
_SbieApi_ReloadConf@4
_SbieDll_FormatMessage1@8
_SbieDll_InitPStore@0
_SbieDll_IsDirectory@4
_SbieDll_GetBoxFilePath@8
_SbieApi_EnumBoxes@8

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
360se3/Shield/Sandboxie.ini
360se3/Skin/IE6/NoTraceBtn_Down.png
.png
360se3/Skin/IE6/NoTraceBtn_Up.png
.png
360se3/Skin/IE6/address.png
.png
360se3/Skin/IE6/backward.png
.png
360se3/Skin/IE6/bg_sidebar_mini.png
.png
360se3/Skin/IE6/bg_sidebar_tool.png
.png
360se3/Skin/IE6/bg_sidepanel.png
.png
360se3/Skin/IE6/bg_sidetoolbar.png
.png
360se3/Skin/IE6/chevron.png
.png
360se3/Skin/IE6/crash.png
.png
360se3/Skin/IE6/dropdown.png
.png
360se3/Skin/IE6/edit.png
.png
360se3/Skin/IE6/favorites.png
.png
360se3/Skin/IE6/findbaritem.png
.png
360se3/Skin/IE6/forward.png
.png
360se3/Skin/IE6/gesture.bmp
360se3/Skin/IE6/go.png
.png
360se3/Skin/IE6/go1.png
.png
360se3/Skin/IE6/history.png
.png
360se3/Skin/IE6/home.png
.png
360se3/Skin/IE6/ico/fav_add.ico
360se3/Skin/IE6/ico/fav_bar.ico
360se3/Skin/IE6/ico/fav_directory.ico
360se3/Skin/IE6/ico/fav_net_login.ico
360se3/Skin/IE6/ico/fav_net_nologin.ico
360se3/Skin/IE6/ico/fav_root.ico
360se3/Skin/IE6/ico/fav_sidebar.ico
360se3/Skin/IE6/ico/fav_url.ico
360se3/Skin/IE6/ico/search.ico
360se3/Skin/IE6/ico/theworld.ico
360se3/Skin/IE6/img_lock.png
.png
360se3/Skin/IE6/img_progress.png
.png
360se3/Skin/IE6/mask.png
.png
360se3/Skin/IE6/menu_hilight.png
.png
360se3/Skin/IE6/menuicon.png
.png
360se3/Skin/IE6/menumask.png
.png
360se3/Skin/IE6/navihistory.png
.png
360se3/Skin/IE6/new.png
.png
360se3/Skin/IE6/pagebar.png
.png
360se3/Skin/IE6/preview.png
.png
360se3/Skin/IE6/private.png
.png
360se3/Skin/IE6/rebar.png
.png
360se3/Skin/IE6/rebar_grip.png
.png
360se3/Skin/IE6/refresh.png
.png
360se3/Skin/IE6/refresh_combine.png
.png
360se3/Skin/IE6/restore.png
.png
360se3/Skin/IE6/scrollbg.png
.png
360se3/Skin/IE6/scrollgauge.png
.png
360se3/Skin/IE6/search.png
.png
360se3/Skin/IE6/searcharrow.png
.png
360se3/Skin/IE6/searchbox.png
.png
360se3/Skin/IE6/sep.png
.png
360se3/Skin/IE6/sidebar2.png
.png
360se3/Skin/IE6/sidebarbg.png
.png
360se3/Skin/IE6/sidebarpanel.png
.png
360se3/Skin/IE6/sidebartoolbg.png
.png
360se3/Skin/IE6/sideclose.png
.png
360se3/Skin/IE6/sidemask.png
.png
360se3/Skin/IE6/sidemenu.png
.png
360se3/Skin/IE6/sidemini.png
.png
360se3/Skin/IE6/sideols.png
.png
360se3/Skin/IE6/sizestatus.png
.png
360se3/Skin/IE6/skin.ini
360se3/Skin/IE6/srcollbar.png
.png
360se3/Skin/IE6/statusbar.png
.png
360se3/Skin/IE6/statusitem.png
.png
360se3/Skin/IE6/stop.png
.png
360se3/Skin/IE6/stop_combine.png
.png
360se3/Skin/IE6/tab_close.png
.png
360se3/Skin/IE6/tab_close2.png
.png
360se3/Skin/IE6/tab_color.png
.png
360se3/Skin/IE6/tab_drag.png
.png
360se3/Skin/IE6/tab_new.png
.png
360se3/Skin/IE6/tab_progress.png
.png
360se3/Skin/IE6/tabbar.png
.png
360se3/Skin/IE6/tabbutton.png
.png
360se3/Skin/IE6/tabbutton3.png
.png
360se3/Skin/IE6/tabitem.png
.png
360se3/Skin/IE6/thumb.png
.png
360se3/Skin/IE6/title_close.png
.png
360se3/Skin/IE6/title_cus.png
.png
360se3/Skin/IE6/title_max.png
.png
360se3/Skin/IE6/title_max2.png
.png
360se3/Skin/IE6/title_min.png
.png
360se3/Skin/IE6/titlebar.png
.png
360se3/Skin/IE6/titlebarmax.png
.png
360se3/Skin/IE6/tool.png
.png
360se3/UnInst360SE.exe.nsis
360se3/extensions/ExtAddons/ExtAddons.dll
.dll windows:4 windows x86 arch:x86

a0e5e2ae9750cfcb6ca3756fe26523a4

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetGetLastResponseInfoW
InternetWriteFile
FtpOpenFileW
FtpCommandW
InternetReadFile
InternetReadFileExA
InternetCloseHandle
InternetSetStatusCallbackW
InternetQueryOptionW
InternetSetOptionW
HttpEndRequestW
InternetSetOptionA
InternetCrackUrlW
InternetConnectW
InternetOpenW
HttpSendRequestExW
HttpOpenRequestW
FtpGetFileSize
HttpQueryInfoW
InternetGetConnectedState

urlmon

ObtainUserAgentString

shlwapi

SHDeleteKeyW
SHEnumKeyExW
SHGetValueW
PathIsRootW
PathFileExistsW
PathCombineW
PathFindFileNameW
StrStrIW
PathGetDriveNumberW

kernel32

GetTempPathW
lstrlenW
MultiByteToWideChar
lstrlenA
SetWaitableTimer
CreateWaitableTimerW
SystemTimeToFileTime
SetEndOfFile
SetFilePointer
CreateFileW
GetDiskFreeSpaceExW
SetFileTime
ReadFile
WriteFile
DeleteFileW
DisableThreadLibraryCalls
GetModuleFileNameW
InitializeCriticalSection
lstrcatW
lstrcpyW
VirtualAlloc
RemoveDirectoryW
VirtualFree
GetPrivateProfileIntW
InterlockedIncrement
InterlockedDecrement
GetShortPathNameW
FindClose
FindNextFileW
SetFileAttributesW
GetFileAttributesW
FindFirstFileW
CreateDirectoryW
SearchPathW
GetVersionExW
GlobalFree
GlobalUnlock
FreeResource
LockResource
GlobalLock
GlobalAlloc
SizeofResource
GetTempFileNameW
FindResourceW
MoveFileW
MoveFileExW
FreeLibrary
GetProcAddress
LoadLibraryW
HeapFree
HeapAlloc
GetProcessHeap
GetVersion
GetCurrentThreadId
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
CloseHandle
GetCurrentProcess
CreateEventW
SetEvent
Sleep
WaitForSingleObject
TlsSetValue
IsBadWritePtr
IsBadReadPtr
CancelWaitableTimer
WaitForMultipleObjects
GetTickCount
GetLastError
ResetEvent
LoadResource

user32

IsWindowVisible
GetMessagePos
InsertMenuW
CreatePopupMenu
RegisterClassExW
GetScrollPos
SetScrollPos
GetKeyState
CallWindowProcW
CheckRadioButton
InflateRect
EnableWindow
RedrawWindow
RegisterClipboardFormatW
SubtractRect
MonitorFromWindow
GetMonitorInfoW
SetWindowPlacement
GetWindowPlacement
MessageBoxW
DrawEdge
CreateWindowExW
GetSysColor
LoadBitmapW
SetFocus
SetRectEmpty
GetPropW
DestroyIcon
PtInRect
SetCursor
TrackMouseEvent
RemovePropW
DefWindowProcW
FillRect
GetWindowTextW
CopyRect
ClientToScreen
GetDC
DrawTextW
ReleaseDC
SetPropW
SetWindowLongW
UpdateWindow
LoadImageW
EqualRect
ReleaseCapture
SetCapture
WindowFromPoint
GetAncestor
IsZoomed
GetMenu
MenuItemFromPoint
GetMenuInfo
GetWindowLongW
GetParent
LoadStringW
PostThreadMessageW
GetClientRect
GetDesktopWindow
GetMessageW
ShowWindow
SetForegroundWindow
IsWindow
DestroyWindow
DestroyMenu
GetMenuItemCount
PostMessageW
SendMessageW
InvalidateRect
SetDlgItemTextW
SetWindowTextW
GetDlgItem
GetWindowRect
SetWindowPos
IsDlgButtonChecked
EndDialog
BeginPaint
ScreenToClient
LoadIconW
DrawIcon
EndPaint
DialogBoxParamW
UnhookWindowsHookEx
SetWindowsHookExW
GetClassNameW
CallNextHookEx
GetWindowDC
OffsetRect
SetMenuInfo
SetMenuItemInfoW
TrackPopupMenuEx
GetCursorPos
TrackPopupMenu
GetMenuItemInfoW
LoadCursorW

gdi32

GetTextMetricsW
CreateRectRgnIndirect
CombineRgn
FillRgn
EnumFontsW
Rectangle
MoveToEx
LineTo
SetBkColor
CreateCompatibleBitmap
CreateDIBSection
CreateCompatibleDC
BitBlt
DeleteDC
CreateSolidBrush
SetBkMode
SetTextColor
GetStockObject
GetObjectW
CreateFontIndirectW
SelectObject
CreatePen
DeleteObject

advapi32

RegCloseKey
RegOpenKeyW
RegOpenKeyExW

shell32

DragQueryFileW
ExtractIconExW
SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal
RegisterDragDrop
CoUninitialize
CoCreateInstance
CoInitialize
OleInitialize
OleUninitialize
ReleaseStgMedium
OleDuplicateData
DoDragDrop

oleaut32

SysAllocString
SysFreeString

msvcrt

malloc
fclose
free
fread
ftell
fseek
_wfopen
fwrite
wcslen
memcpy
strlen
strcpy
memset
__CxxFrameHandler
_beginthreadex
wcsncpy
wcscpy
_ui64tow
wcsstr
time
_wcsnicmp
_wtol
_ftol
wcsncat
_wtoi64
wcscmp
memcmp
_wcsicmp
??2@YAPAXI@Z
wcscat
swprintf
_except_handler3
_wtoi
swscanf
wcsrchr
strcat
_snprintf
wcschr
fwprintf
memmove
iswspace
realloc
wcsncmp
_purecall
__dllonexit
_onexit
?terminate@@YAXXZ
_initterm
_adjust_fdiv
_snwprintf

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

gdiplus

GdiplusStartup
GdiplusShutdown
GdipFree
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipAlloc
GdipLoadImageFromStream
GdipDeleteGraphics
GdipSetInterpolationMode
GdipDrawImageRectRectI
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight

comctl32

ImageList_AddMasked
ImageList_Create
ImageList_DrawEx
ImageList_GetImageInfo
ImageList_Destroy
InitCommonControlsEx
ImageList_Draw
ImageList_GetImageCount

Exports

Exports

Ext_GetExtensionInfo
Ext_GetExtensionType
Ext_Init
Ext_UnInit
Frame_onFontChange
Frame_onSkinChange

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 829KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/ExtAdfilter/ExtAdfilter.dll
.dll regsvr32 windows:4 windows x86 arch:x86

d11be5a97a22bcbd902c791a4d2a0638

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSARecv
recv
send
closesocket
connect

urlmon

CoInternetCombineUrl

shlwapi

StrStrW
PathMatchSpecW
PathFileExistsW
StrStrIW

wininet

InternetCrackUrlW

kernel32

WriteProcessMemory
ReadProcessMemory
VirtualProtect
GetCurrentProcess
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetTickCount
lstrlenW
Sleep
InterlockedIncrement
InterlockedDecrement
MoveFileW
GetModuleFileNameW
CreateDirectoryW
MultiByteToWideChar
lstrlenA
DeleteFileW
OpenProcess
GetCurrentProcessId
SetFileAttributesW
GetFileAttributesW
LocalFree
MoveFileExW

user32

CharNextW
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
InsertMenuW
LoadMenuW
GetSubMenu
CheckMenuItem
EnableMenuItem
DestroyMenu
ClientToScreen
ReplyMessage
IsDlgButtonChecked
EndDialog
CheckDlgButton
SendMessageW
ShowWindow
SetForegroundWindow
GetDesktopWindow
DialogBoxParamW
LoadStringW
GetCursorPos
ScreenToClient
LoadCursorW
SetCursor
GetClassNameW
GetKeyState
IsWindow
IsChild
GetDlgItem

shell32

SHGetSpecialFolderPathW

oleaut32

SysAllocString
SysFreeString

msvcrt

wcscat
wcsrchr
memcpy
??2@YAPAXI@Z
_snwprintf
__CxxFrameHandler
_ftol
_wtoi
wcscmp
_wcsicmp
_wcsnicmp
wcslen
vswprintf
_except_handler3
memset
wcstod
iswspace
fclose
wcsncpy
iswdigit
malloc
memmove
free
fwrite
fread
ftell
fseek
_wfopen
fwprintf
_CxxThrowException
__dllonexit
_onexit
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
wcsstr
memcmp
strlen
swprintf

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Ext_GetExtensionCLSID
Ext_GetExtensionInfo
Ext_GetExtensionType
Ext_Init
Frame_onCreate

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.taihang
Size: 4KB - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/ExtBlankPage/ExtBlankPage.dll
.dll .js windows:4 windows x86 arch:x86 polyglot

996a0078f2f46c5b3444c073bdb6aa98

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

UrlEscapeW

kernel32

GetShortPathNameW
GetModuleFileNameW
InterlockedIncrement
lstrlenW
InterlockedDecrement
DisableThreadLibraryCalls

user32

DestroyMenu
LoadStringW

oleaut32

SysFreeString

msvcrt

_initterm
free
_onexit
__dllonexit
_adjust_fdiv
malloc
_snwprintf
__CxxFrameHandler
wcslen
??3@YAXPAX@Z
??2@YAPAXI@Z
memmove
wcsstr

Exports

Exports

Ext_GetExtensionInfo
Ext_GetExtensionType
Ext_Init
Ext_UnInit
Frame_onCreate

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/ExtDownload/ExtDownload.dll
.dll windows:4 windows x86 arch:x86

916b73610bdb848a07d90ae139bf1035

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

urlmon

CoInternetCombineUrl
ObtainUserAgentString

wininet

InternetGetLastResponseInfoW
InternetWriteFile
FtpOpenFileW
HttpEndRequestW
InternetReadFile
FtpCommandW
InternetCloseHandle
InternetSetStatusCallbackW
InternetSetOptionA
HttpSendRequestExW
InternetConnectW
InternetQueryOptionW
InternetSetOptionW
InternetReadFileExA
InternetCrackUrlW
HttpOpenRequestW
FtpGetFileSize
HttpQueryInfoW
GetUrlCacheEntryInfoW
InternetOpenW

kernel32

DeleteFileW
InterlockedDecrement
MoveFileExW
MoveFileW
GetSystemDirectoryW
InterlockedIncrement
GetModuleFileNameW
lstrcmpiW
CopyFileW
GlobalUnlock
GlobalLock
GlobalAlloc
DisableThreadLibraryCalls
GetCurrentProcessId
InitializeCriticalSection
WriteFile
OpenProcess
ReadProcessMemory
GetShortPathNameW
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
GlobalFree
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceW
LocalFree
GetWindowsDirectoryW
HeapFree
HeapAlloc
GetProcessHeap
GetVersion
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
FlushInstructionCache
ReadFile
SetFileTime
GetDiskFreeSpaceExW
CreateFileW
SetFilePointer
SetEndOfFile
SystemTimeToFileTime
CreateWaitableTimerW
SetWaitableTimer
lstrlenA
MultiByteToWideChar
lstrlenW
GetTempPathW
GetTempFileNameW
ResetEvent
GetLastError
GetTickCount
WaitForMultipleObjects
CancelWaitableTimer
IsBadReadPtr
IsBadWritePtr
TlsSetValue
WaitForSingleObject
Sleep
SetEvent
CreateEventW
GetCurrentProcess
CloseHandle
WideCharToMultiByte

user32

MonitorFromWindow
GetMonitorInfoW
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
TrackMouseEvent
ClientToScreen
UpdateWindow
GetParent
CharNextW
PeekMessageW
TranslateMessage
DispatchMessageW
GetAncestor
GetMenuItemInfoW
InsertMenuW
RegisterClipboardFormatW
MoveWindow
GetWindowLongW
SetWindowLongW
InSendMessageEx
ReplyMessage
IsWindowVisible
CharUpperW
LoadMenuW
GetSubMenu
EnableMenuItem
GetKeyState
CallWindowProcW
SetRectEmpty
TrackPopupMenu
TrackPopupMenuEx
SetMenuItemInfoW
SetMenuInfo
RegisterClassExW
GetMessagePos
PtInRect
LoadCursorW
SetCursor
InflateRect
DestroyIcon
CreatePopupMenu
InsertMenuItemW
GetCursorPos
DestroyMenu
GetDlgItemTextW
CopyRect
FillRect
DrawEdge
SetWindowPlacement
GetWindowPlacement
KillTimer
DestroyWindow
InvalidateRect
GetSysColor
SetForegroundWindow
GetPropW
GetWindowTextW
SetFocus
EnableWindow
SetPropW
CheckRadioButton
RemovePropW
CreateWindowExW
SetTimer
LoadBitmapW
SetWindowTextW
DefWindowProcW
LoadStringW
MessageBoxW
IsWindow
PostMessageW
SetDlgItemTextW
GetDlgItem
ShowWindow
CheckDlgButton
SendMessageW
GetDC
DrawTextW
ReleaseDC
GetClientRect
GetWindowRect
SetWindowPos
GetDesktopWindow
MapWindowPoints
IsDlgButtonChecked
EndDialog
BeginPaint
ScreenToClient
LoadIconW
DrawIcon
EndPaint
DialogBoxParamW
LoadImageW
EqualRect
ReleaseCapture
SetCapture
WindowFromPoint
IsZoomed
GetMenu
MenuItemFromPoint
UnhookWindowsHookEx
SetWindowsHookExW
GetClassNameW
CallNextHookEx
GetWindowDC
OffsetRect
GetMenuItemCount

gdi32

CreateCompatibleDC
Rectangle
CreatePen
GetObjectW
SetBkMode
SetTextColor
FillRgn
MoveToEx
LineTo
EnumFontsW
CreateFontIndirectW
GetStockObject
CreateCompatibleBitmap
SelectObject
CreateSolidBrush
BitBlt
DeleteDC
CreateDIBSection
GetTextMetricsW
CreateRectRgnIndirect
CombineRgn
DeleteObject

shell32

DragQueryFileW
ShellExecuteW
SHFileOperationW
SHGetMalloc
SHGetDesktopFolder
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
ExtractIconExW
SHGetFileInfoW

ole32

CoUninitialize
CoCreateInstance
CoInitialize
RevokeDragDrop
ReleaseStgMedium
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
CoTaskMemFree
OleDuplicateData
DoDragDrop
RegisterDragDrop

oleaut32

SysFreeString
SysAllocString
SafeArrayCreateVector

msvcrt

wcsstr
_ui64tow
wcscpy
_beginthreadex
wcslen
_snwprintf
towlower
fwprintf
swscanf
_except_handler3
fprintf
_strnicmp
fgets
rewind
realloc
wcsncmp
_CxxThrowException
__dllonexit
_onexit
?terminate@@YAXXZ
_initterm
_adjust_fdiv
wcsncpy
??2@YAPAXI@Z
time
_wtol
_ftol
wcsncat
_wtoi64
wcscmp
_wcsicmp
_purecall
__CxxFrameHandler
_itow
_wtoi
wcsftime
towupper
gmtime
wcscat
wcsrchr
wcspbrk
_i64tow
localtime
_ltow
memmove
free
_wcsnicmp
malloc
vswprintf
??1type_info@@UAE@XZ
swprintf
iswdigit
wcschr
_snprintf
fclose
fread
ftell
fseek
_wfopen
fwrite
iswspace

shlwapi

PathIsDirectoryW
PathCombineW
PathFindFileNameW
PathIsURLW
PathFindExtensionW
SHGetValueW
PathMatchSpecW
PathFileExistsW
PathIsRootW
StrStrW
UrlEscapeW
StrRetToBufW
PathGetDriveNumberW
StrStrIW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

gdiplus

GdipCreateImageAttributes
GdipAlloc
GdipDisposeImageAttributes
GdipFree
GdipGetImageWidth
GdipLoadImageFromStream
GdipSetInterpolationMode
GdipDrawImageRectRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipGetImageHeight
GdiplusShutdown

comctl32

ImageList_Duplicate
ImageList_Draw
InitCommonControlsEx
ImageList_GetImageInfo
ImageList_DrawEx
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create
ImageList_AddMasked
ImageList_Remove

Exports

Exports

Ext_ExecContextMenu
Ext_GetExtensionInfo
Ext_GetExtensionType
Ext_Init
Ext_InitContextMenu
Ext_UnInit
Extension_OnEnable
Extension_OnUnInstall
Frame_ShowDownloadManager
Frame_onCreate
Frame_onFontChange
Frame_onSkinChange

Sections

.text
Size: 208KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SimpleW
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/ExtPages/ExtPages.dll
.dll .js windows:4 windows x86 arch:x86 polyglot

2cc24dafd3668c20a7eb1c7d7ece1f60

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
GetShortPathNameW
GetModuleFileNameW
lstrcpyW
lstrcpynW
CreateProcessW
lstrcatW
GetPrivateProfileSectionW
lstrlenW
GetPrivateProfileIntW

shell32

SHGetSpecialFolderPathW

shlwapi

UrlEscapeW
StrStrIW
PathRemoveExtensionW

msvcrt

wcslen
_adjust_fdiv
malloc
_initterm
free
wcscat
wcsrchr
memset
_snwprintf
wcschr
_wcsnicmp
__CxxFrameHandler

Exports

Exports

Ext_GetExtensionInfo
Ext_GetExtensionType
Ext_Init

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 324KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/ExtProxy/ExtProxy.dll
.dll windows:4 windows x86 arch:x86

19ce870c2b4bc3f42de0bbca628b864b

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WideCharToMultiByte
InterlockedIncrement
MultiByteToWideChar
GetCurrentProcess
TerminateProcess
ExitProcess
VirtualQuery
HeapFree
HeapAlloc
SetEndOfFile
GetProcAddress
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
CreateDirectoryW
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ReadFile
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
LeaveCriticalSection
MoveFileExW
MoveFileW
LoadLibraryA
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
CreateFileW
SetFilePointer
WriteFile
CloseHandle
lstrlenW
InterlockedDecrement
GetFileAttributesW
SetFileAttributesW
DeleteFileW
GetModuleFileNameW
GetShortPathNameW
GetCurrentThread
HeapSize
HeapReAlloc
GetVersion
GetCommandLineA
RtlUnwind
SetLastError
VirtualAlloc
SuspendThread
SetThreadContext
GetThreadContext
FlushInstructionCache
ResumeThread
VirtualProtect
GetCurrentThreadId
InterlockedCompareExchange

user32

SetWindowPos
SetDlgItemTextW
SetFocus
GetWindowTextW
SendMessageW
GetDlgItem
ClientToScreen
LoadMenuW
GetSubMenu
GetMenuItemCount
DeleteMenu
CheckMenuItem
LoadStringW
DestroyMenu
GetDlgItemTextW
EndDialog
DialogBoxParamW
GetDesktopWindow

wininet

InternetConnectA
InternetSetOptionA

shlwapi

PathIsRootW
PathFindFileNameW
PathFileExistsW

Exports

Exports

Ext_GetExtensionCLSID
Ext_GetExtensionInfo
Ext_GetExtensionType
Ext_Init
Ext_UnInit

Sections

.text
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.taihang
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/ExtSuggest/ExtSuggest.dll
.dll windows:4 windows x86 arch:x86

1f05463c56adbc8918c083988fe4fc5b

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetShortPathNameW
GetModuleFileNameW
FindClose
FindNextFileW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
FindFirstFileW
GetFileSize
CreateDirectoryW
SearchPathW
InterlockedDecrement
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemTime
InterlockedIncrement
LockResource
SizeofResource
LoadResource
FindResourceW
GetCurrentThreadId
GetVersionExW
SetProcessWorkingSetSize
TerminateProcess
ExitProcess
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
VirtualQuery
MoveFileExW
GetWindowsDirectoryW
CopyFileW
FileTimeToLocalFileTime
GetFileTime
LoadLibraryExW
SetErrorMode
HeapFree
HeapAlloc
GetProcessHeap
DuplicateHandle
GetSystemInfo
GetProcessTimes
GetSystemTimeAsFileTime
LocalFree
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
FlushInstructionCache
GetModuleHandleW
MultiByteToWideChar
lstrlenA
CloseHandle
GetCurrentProcess
CreateEventW
SetEvent
Sleep
WaitForSingleObject
TlsSetValue
IsBadWritePtr
IsBadReadPtr
CancelWaitableTimer
WaitForMultipleObjects
GetTickCount
GetLastError
ResetEvent
GetTempFileNameW
GetTempPathW
lstrlenW
SetWaitableTimer
CreateWaitableTimerW
SystemTimeToFileTime
SetEndOfFile
SetFilePointer
CreateFileW
GetDiskFreeSpaceExW
SetFileTime
ReadFile
WriteFile
TlsFree
TlsAlloc
DeleteFileW
WriteProcessMemory
VirtualAllocEx
OpenProcess
ReadProcessMemory
VirtualFreeEx
GetCurrentProcessId
InitializeCriticalSection
WideCharToMultiByte

user32

IsWindowVisible
SendMessageW
DrawTextW
GetSystemMetrics
MapVirtualKeyW
GetKeyNameTextW
GetDesktopWindow
LoadStringW
CharNextW
CreateWindowExW
EndPaint
FillRect
OpenClipboard
GetClientRect
BeginPaint
OffsetRect
GetWindowDC
DefWindowProcW
SetCursor
LoadCursorW
PtInRect
PostQuitMessage
InvalidateRect
GetDC
ReleaseDC
PostMessageW
MoveWindow
SetWindowTextW
SetFocus
ScreenToClient
GetMessagePos
InflateRect
CallNextHookEx
GetWindowRect
SetWindowPos
UnhookWindowsHookEx
SetWindowsHookExW
CloseClipboard
GetClipboardData
GetWindowLongW
IsWindow
IsChild
IsZoomed
TrackMouseEvent
SetWindowLongW
UnregisterClassW
RegisterClassExW
GetWindowThreadProcessId
SubtractRect
FindWindowExW
SetRect
PeekMessageW
TranslateMessage
DispatchMessageW
ShowWindow
FindWindowW
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
CopyRect
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
GetParent

gdi32

CreatePen
GetStockObject
Rectangle
CreateSolidBrush
SetTextColor
DeleteObject
CreateFontIndirectW
EnumFontsW
SelectObject
GetTextExtentPoint32W

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

InitializeSecurityDescriptor
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
GetTokenInformation
CopySid
RegSetKeySecurity
RegQueryInfoKeyW
RegEnumKeyW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAce
AdjustTokenPrivileges
SetSecurityDescriptorDacl
FreeSid
RegOpenKeyExW
RegGetKeySecurity
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
RegSetValueExW
RegOpenKeyW
RegQueryValueExW

shell32

SHAppBarMessage
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderPathW
SHGetFileInfoW
SHGetSpecialFolderLocation
SHFileOperationW
SHFreeNameMappings

ole32

CoCreateInstance
CoTaskMemFree
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize

oleaut32

SysAllocString
VariantClear
SysFreeString

shlwapi

UrlEscapeW
StrStrW
PathIsURLW
PathIsRootW
PathFindExtensionW
StrCmpIW
PathCombineW
PathFileExistsW
StrStrIW
PathGetDriveNumberW
SHGetValueW

wininet

InternetReadFile
CreateUrlCacheEntryW
InternetCrackUrlW
InternetSetOptionW
FtpCommandW
GetUrlCacheEntryInfoW
CommitUrlCacheEntryW
InternetGetConnectedState
HttpQueryInfoW
FtpGetFileSize
HttpOpenRequestW
HttpSendRequestExW
InternetOpenW
InternetConnectW
InternetSetOptionA
InternetSetStatusCallbackW
InternetCloseHandle
InternetReadFileExA
InternetQueryOptionW
HttpEndRequestW
FtpOpenFileW
InternetWriteFile
InternetGetLastResponseInfoW

psapi

GetProcessMemoryInfo

urlmon

ObtainUserAgentString

wintrust

CryptCATAdminEnumCatalogFromHash
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminReleaseCatalogContext

msvcrt

_beginthreadex
isalnum
sprintf
strcpy
memcpy
strstr
strlen
strtok
wcsncpy
_wfopen
fseek
ftell
??2@YAPAXI@Z
fread
fclose
wcslen
swprintf
_snwprintf
__CxxFrameHandler
memset
_ui64tow
wcsstr
time
_wtol
_ftol
wcsncat
_wtoi64
wcscmp
memcmp
_wcsicmp
wcscat
wcspbrk
wcsrchr
wcschr
_wcsnicmp
strncpy
strrchr
_except_handler3
free
fwrite
malloc
fputs
memmove
swscanf
iswspace
towlower
towupper
_ismbslead
_purecall
abs
fprintf
_strnicmp
fgets
rewind
__dllonexit
_onexit
_initterm
_adjust_fdiv
wcscpy

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

comctl32

ImageList_Remove
ImageList_Duplicate
InitCommonControlsEx

Exports

Exports

Ext_GetExtensionInfo
Ext_GetExtensionType
Ext_Init

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 804KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/Favorites/Favorites.dll
.dll windows:4 windows x86 arch:x86

12694388d244788528b24b2420adbe7a

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

urlmon

ObtainUserAgentString

wininet

InternetSetStatusCallbackW
InternetSetOptionA
InternetConnectW
InternetOpenW
HttpSendRequestExW
HttpOpenRequestW
FtpGetFileSize
HttpQueryInfoW
InternetCloseHandle
InternetCrackUrlW
InternetSetOptionW
InternetQueryOptionW
FtpCommandW
InternetGetLastResponseInfoW
InternetWriteFile
HttpAddRequestHeadersW
HttpSendRequestW
InternetReadFileExA
InternetReadFile
HttpEndRequestW
FtpOpenFileW

shlwapi

PathIsDirectoryW
PathFindExtensionW
PathIsRootW
PathCombineW
PathIsURLW
PathGetDriveNumberW
StrStrIW
PathFindFileNameW
StrCmpW
StrCmpIW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
StrToIntW
StrStrIA

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHAppBarMessage
ShellExecuteW
ExtractIconExW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFileInfoW
SHFileOperationW
SHGetSpecialFolderPathW

kernel32

WideCharToMultiByte
MultiByteToWideChar
lstrlenA
CloseHandle
ReadFile
SetFilePointer
GetLastError
CreateFileW
GetModuleFileNameW
lstrlenW
WritePrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
CopyFileW
GetPrivateProfileStringW
SetEvent
CreateEventW
DeleteFileW
lstrcmpA
CreateDirectoryW
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
GetTempFileNameW
GetTickCount
GetTempPathW
ResetEvent
GetPrivateProfileIntW
lstrcatW
FindResourceW
DeleteCriticalSection
CreateMutexW
WaitForMultipleObjects
GetCurrentProcess
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
CreateThread
CreateIoCompletionPort
SetLastError
GetFileAttributesW
PostQueuedCompletionStatus
SetThreadPriority
GetThreadPriority
GetCurrentThread
ReadDirectoryChangesW
GetQueuedCompletionStatus
Sleep
TlsSetValue
IsBadWritePtr
IsBadReadPtr
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerW
SystemTimeToFileTime
SetEndOfFile
GetDiskFreeSpaceExW
SetFileTime
WriteFile
lstrcpynW
lstrcpyW
GetVersionExW
MulDiv
FlushInstructionCache
GetCurrentThreadId
GetProcAddress
lstrcmpiW
DisableThreadLibraryCalls
HeapDestroy
GetLongPathNameW
FindClose
FindNextFileW
FindFirstFileW
GetShortPathNameW
RemoveDirectoryW
SetFileAttributesW
ExitThread
MoveFileExW
GetSystemTime
lstrcmpiA
ExpandEnvironmentStringsW
SwitchToThread
GetExitCodeThread
LoadLibraryW
WritePrivateProfileStructW
GetLocalTime
GlobalFree
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LoadResource
GlobalAlloc
GlobalLock
GlobalUnlock
FreeResource
lstrcpyA
TerminateThread
SuspendThread
InitializeCriticalSection

user32

SetPropW
RemovePropW
LoadIconW
RegisterClipboardFormatW
GetWindowThreadProcessId
GetDesktopWindow
GetWindow
MapWindowPoints
AppendMenuW
CheckMenuItem
CreateMenu
IsWindowEnabled
InflateRect
IntersectRect
SystemParametersInfoW
GetWindowDC
SetCursor
DrawEdge
FillRect
GetSysColor
SetRect
MonitorFromPoint
GetMonitorInfoW
GetDlgCtrlID
ReleaseCapture
SetCapture
GetCapture
SetRectEmpty
UpdateWindow
IsRectEmpty
InsertMenuW
GetMessagePos
TrackPopupMenu
SetActiveWindow
GetFocus
SetLayeredWindowAttributes
ShowWindow
ClientToScreen
EqualRect
MoveWindow
CreatePopupMenu
DestroyMenu
GetKeyState
SetFocus
BringWindowToTop
ShowCursor
LoadCursorW
wsprintfW
RegisterClassExW
GetPropW
SetWindowTextW
DestroyIcon
PtInRect
PeekMessageW
TranslateMessage
DispatchMessageW
MessageBeep
PostMessageW
CreateWindowExW
RegisterClassW
DestroyWindow
IsWindow
MsgWaitForMultipleObjects
InSendMessageEx
IsWindowVisible
RedrawWindow
TrackMouseEvent
GetCursorPos
LoadMenuW
GetSubMenu
KillTimer
SubtractRect
DeleteMenu
EndDialog
ReplyMessage
MessageBoxW
GetMessageW
PostThreadMessageW
LoadStringW
GetWindowLongW
SetWindowLongW
ReleaseDC
GetDlgItem
GetDC
GetSystemMetrics
CallWindowProcW
GetWindowRect
GetParent
ScreenToClient
BeginPaint
GetClientRect
SendMessageW
GetWindowTextW
OffsetRect
DrawTextW
EndPaint
InvalidateRect
SetWindowPos
DefWindowProcW
EnableWindow
SetDlgItemTextW
DialogBoxParamW
SetTimer
IsMenu
SetMenuInfo
GetMenuInfo
GetMenuItemInfoW
SetWindowRgn
MonitorFromWindow
EmptyClipboard
SetClipboardData
OpenClipboard
CloseClipboard
CheckDlgButton
GetDlgItemInt
SetDlgItemInt
DrawIcon
CopyRect
WindowFromPoint
SetForegroundWindow
PostQuitMessage
RemoveMenu
GetClassInfoExW
GetMenuItemCount
FindWindowW

gdi32

RoundRect
EndPath
PathToRegion
TextOutW
CreateSolidBrush
SetBkColor
ExtTextOutW
CreateFontIndirectW
SaveDC
StretchBlt
RestoreDC
GetClipBox
MoveToEx
LineTo
CreateBitmap
CreatePatternBrush
PatBlt
CreatePen
BitBlt
DeleteObject
CreateCompatibleBitmap
SetViewportOrgEx
SetTextColor
GetObjectW
GetStockObject
GetTextMetricsW
CreateCompatibleDC
SelectObject
SetBkMode
BeginPath
DeleteDC

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken

ole32

CreateStreamOnHGlobal
CoUninitialize
CoCreateInstance
CoInitialize
ReleaseStgMedium
CoTaskMemFree
OleDuplicateData
DoDragDrop
RegisterDragDrop

oleaut32

SafeArrayCreateVector
SysAllocString
VariantClear
SystemTimeToVariantTime
SysFreeString
SafeArrayAccessData
SafeArrayDestroy

comctl32

_TrackMouseEvent
ImageList_LoadImageW
ImageList_Destroy
ImageList_GetIconSize
ImageList_EndDrag
ImageList_BeginDrag
ImageList_DragMove
ImageList_Remove
ImageList_GetImageCount
ImageList_DragEnter
ImageList_Draw
ImageList_DragShowNolock
ImageList_ReplaceIcon
ImageList_Duplicate
ImageList_GetIcon

msvcp60

??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB

gdiplus

GdipDeleteGraphics
GdipDrawImageRectRect
GdipCreateFromHDC
GdipAlloc
GdipFree
GdipDisposeImage
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight

msvcrt

realloc
wcspbrk
ftell
fseek
fprintf
abs
free
_wcsdup
_except_handler3
malloc
wcstok
_wmakepath
_wsplitpath
_ui64tow
wcsstr
_wcsnicmp
qsort
strtok
_wtoi
memcmp
_purecall
strcmp
wcsncpy
fgets
time
wcscmp
_beginthreadex
atoi
swprintf
wcschr
wcscat
_filelength
fread
strstr
strncpy
__CxxFrameHandler
memcpy
??2@YAPAXI@Z
strlen
wcslen
strcpy
_wtol
_ftol
_wtoi64
sprintf
memset
_snwprintf
_snprintf
printf
fclose
fwrite
_wfopen
wcscpy
memmove
_vsnprintf
_itow
iswspace
__dllonexit
_onexit
_initterm
_adjust_fdiv
wcsrchr
_wcsicmp
wcsncat
atof
_waccess

Exports

Exports

?MD5Default@@YAXPBDIPAE@Z
?MD5Segment@@YAXPBDIPAEI@Z
?MD5String@@YAXPBDPAEI@Z
Ext_GetExtensionInfo
Ext_GetExtensionType
Ext_Init
Ext_UnInit
Fav_ExportItemToFolder
Fav_GetFavCount
Fav_GetFavStyle
Fav_GetFavoritePath
Fav_ImportFav
Fav_ReLoadFav
UpdateConfig

Sections

.text
Size: 274KB - Virtual size: 274KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 830KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/MiniSearchBar/MiniSearchBar.dll
.dll regsvr32 windows:4 windows x86 arch:x86

9e76d2e8fd33d94716f11a7a0a879d6e

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadResource
SizeofResource
FindResourceW
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
CloseHandle
FlushFileBuffers
GetUserDefaultLCID
GlobalAlloc
GetLocaleInfoA
IsValidCodePage
IsValidLocale
LoadLibraryW
LCMapStringW
LCMapStringA
Sleep
GetStringTypeW
GetStringTypeA
FreeLibrary
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
UnhandledExceptionFilter
MultiByteToWideChar
SetFilePointer
GlobalLock
GlobalUnlock
FreeResource
HeapCreate
GetVersionExW
GetSystemInfo
HeapAlloc
EnumSystemLocalesA
GetModuleFileNameW
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetStdHandle
GetProcAddress
SetHandleCount
GetCurrentThread
GetLastError
SetEnvironmentVariableA
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
RtlUnwind
DisableThreadLibraryCalls
lstrlenW
lstrcpyW
GetCurrentProcessId
VirtualFreeEx
ReadProcessMemory
OpenProcess
VirtualAllocEx
SetConsoleCtrlHandler
WriteProcessMemory
HeapFree
HeapReAlloc
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
VirtualFree
VirtualAlloc
IsBadWritePtr
FatalAppExitA

user32

EndPaint
GetDlgCtrlID
FillRect
GetDlgItem
GetWindowTextW
CallWindowProcW
GetWindow
ShowWindow
FrameRect
SetFocus
DefWindowProcW
SetWindowPos
CharLowerW
SetForegroundWindow
BeginPaint
CreateDialogParamW
SetWindowLongW
CreateWindowExW
SendMessageW
GetDC
SetWindowTextW
InvalidateRect
GetParent
GetClientRect

gdi32

DeleteDC
SetBkMode
CreateSolidBrush
SelectObject
DeleteObject
CreatePen
RoundRect
CreateCompatibleDC

ole32

CreateStreamOnHGlobal

oleaut32

SysFreeString
LoadRegTypeLi
SysAllocString
SysAllocStringLen
VariantClear
SysStringLen

comctl32

_TrackMouseEvent

gdiplus

GdipDeleteGraphics
GdipDrawImageRectRect
GdipCreateFromHDC
GdipGetImageWidth
GdipLoadImageFromStream
GdipAlloc
GdipFree
GdipDisposeImage
GdipCloneImage
GdipGetImageHeight

atl

ord32
ord30
ord58
ord57
ord18
ord15
ord16
ord21
ord31

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Ext_GetExtensionCLSID
Ext_GetExtensionInfo
Ext_GetExtensionType
Ext_Init

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/SafeCentral/SafeCentral.dll
.dll regsvr32 windows:4 windows x86 arch:x86

85bc5312362a91fd3471309869c2940e

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetThreadPriority
CreateThread
TerminateThread
SuspendThread
Sleep
GetCurrentProcessId
GetCurrentThreadId
DeviceIoControl
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetPrivateProfileStringW
FlushInstructionCache
GetCurrentProcess
LockResource
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
lstrcpyA
InitializeCriticalSection
GetTempPathW
TlsGetValue
TlsSetValue
TlsAlloc
GetTickCount
CopyFileW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
CreateDirectoryW
CreateFileW
GetLastError
CloseHandle
GetVersionExW
LoadLibraryW
GetProcAddress
GetCommandLineW
GetModuleFileNameW
WinExec
WritePrivateProfileStringW
GetPrivateProfileIntW
FindResourceW
SizeofResource
LoadResource
GlobalAlloc
GlobalLock
GlobalUnlock
FreeResource
lstrcpynW
lstrcpyW
lstrcatW
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
GetShortPathNameW

user32

GetWindowTextW
EndPaint
OffsetRect
GetClientRect
SendMessageW
EnableWindow
SetWindowTextW
GetWindowLongA
SetFocus
MessageBoxW
RemovePropW
SetPropW
InvalidateRect
MoveWindow
ClientToScreen
IsWindowVisible
SetWindowRgn
DestroyWindow
CallWindowProcA
IsWindowUnicode
SetWindowLongA
CreateWindowExW
IsWindow
LoadStringW
LoadBitmapW
ShowWindow
SetCapture
GetCursorPos
ReleaseCapture
LoadCursorW
SetCursor
PostMessageW
wsprintfW
GetWindowLongW
SetWindowLongW
ReleaseDC
GetDlgItem
GetDC
GetSystemMetrics
CallWindowProcW
GetWindowRect
GetParent
ScreenToClient
BeginPaint
DrawTextW
SetWindowPos
DefWindowProcW
GetPropW

gdi32

PathToRegion
EndPath
LineTo
MoveToEx
RoundRect
BeginPath
CreateCompatibleBitmap
DeleteDC
SetBkMode
SelectObject
CreateCompatibleDC
GetTextMetricsW
CreateFontIndirectW
DeleteObject
SetTextColor
BitBlt
StretchBlt

shell32

CommandLineToArgvW
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal

oleaut32

LoadRegTypeLi
VariantCopy
VariantChangeType
VariantClear
SysStringLen
VariantInit
SysAllocString
SysFreeString

atl

ord43
ord23
ord30
ord58
ord32
ord57
ord18
ord16
ord15
ord31
ord45
ord44
ord21

comctl32

_TrackMouseEvent

urlmon

CoInternetGetSession

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1_Lockit@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??0_Lockit@std@@QAE@XZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@IIABV?$allocator@G@1@@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB

wininet

HttpQueryInfoW
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetReadFile

shlwapi

PathIsRootW
PathFileExistsW
SHGetValueW
StrStrIW
StrRStrIW
PathFindExtensionW
StrCmpW
StrCmpIW
PathFindFileNameW

msvcrt

sscanf
memset
wcslen
wcsrchr
??2@YAPAXI@Z
wcsstr
swprintf
_wtoi
memcpy
wcschr
__CxxFrameHandler
wcsncpy
sprintf
fopen
fseek
fgetc
fclose
wcscmp
_snwprintf
rand
fwrite
_wfopen
_itow
time
_waccess
wcscpy
strcat
strncpy
_snprintf
strcpy
srand
_wcsnicmp
strlen
_wcsicmp
memcmp
_wcslwr
_strlwr
strncat
_purecall
free
__dllonexit
_onexit
_initterm
malloc
_adjust_fdiv
wcscat

gdiplus

GdipCreateFromHDC
GdipDeleteGraphics
GdipAlloc
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDisposeImage
GdipFree
GdipDrawImageRectRect

setupapi

SetupIterateCabinetW

netapi32

Netbios

Exports

Exports

?MD5Default@@YAXPBDIPAE@Z
?MD5Segment@@YAXPBDIPAEI@Z
?MD5String@@YAXPBDPAEI@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DoCopyUrllib
Ext_GetExtensionCLSID
Ext_GetExtensionInfo
Ext_GetExtensionType
Ext_Init
Ext_UnInit
GetLastURLs

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.360se_h
Size: 4KB - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/SafeCentral/urlproc.dll
.dll regsvr32 windows:4 windows x86 arch:x86

9e242178fe91e5cfeb5ebb0765c38e9a

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnterCriticalSection
MapViewOfFileEx
CreateFileMappingW
UnmapViewOfFile
GetPrivateProfileSectionW
GetFileAttributesExW
OpenFileMappingW
MultiByteToWideChar
lstrlenA
lstrlenW
DebugBreak
OutputDebugStringW
InterlockedDecrement
DisableThreadLibraryCalls
LeaveCriticalSection
GetShortPathNameW
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrcmpiW
lstrcpynW
HeapDestroy
DeleteCriticalSection
InterlockedIncrement
GetLastError
CreateFileW
GetFileTime
GetFileSize
ReadFile
SetFilePointer
CloseHandle
InterlockedExchange
InitializeCriticalSection
Sleep

user32

CharNextW
wvsprintfW

advapi32

RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VarUI4FromStr

msvcrt

_except_handler3
_adjust_fdiv
_initterm
realloc
_purecall
sscanf
toupper
isxdigit
free
strrchr
memcpy
malloc
??2@YAPAXI@Z
__CxxFrameHandler
memset
memcmp
wcslen
iswdigit
_wtoi
strlen
strstr
strncmp
strncpy
atoi

shlwapi

PathFileExistsW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARE
Size: 4KB - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/UICenter/UICenter.dll
.dll regsvr32 windows:4 windows x86 arch:x86

92f46f9eedaf6bdf5c474c8cf90eec6e

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameW
GetCurrentProcessId
VirtualFreeEx
ReadProcessMemory
CreateProcessW
DisableThreadLibraryCalls
GetVersionExW
lstrcmpW
OpenProcess
VirtualAllocEx
WriteProcessMemory
lstrlenW
GetCommandLineW
lstrcpyW

user32

GetActiveWindow
LoadIconW
MessageBoxW
PostMessageW
ClientToScreen
AppendMenuW
CreatePopupMenu
DestroyIcon
DestroyMenu
GetMenuItemInfoW

advapi32

RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

shell32

ShellExecuteW

oleaut32

SysFreeString

comctl32

ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Create

atl

ord21
ord16
ord15
ord18
ord57

shlwapi

StrStrIW
StrCmpW
PathRemoveFileSpecW
PathFindFileNameW

msvcrt

wcslen
wcsrchr
??2@YAPAXI@Z
_onexit
swprintf
wcscpy
free
_except_handler3
?terminate@@YAXXZ
_initterm
malloc
_adjust_fdiv
__dllonexit
_wcsicmp
_waccess
__CxxFrameHandler

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Ext_GetExtensionInfo
Ext_GetExtensionType
Ext_Init

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/onlinefav/onlinefav.dll
.dll regsvr32 windows:4 windows x86 arch:x86

df3c0af8716ad9758afcb4e6248d843d

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindFirstFileW
lstrcpyW
FindNextFileW
GetPrivateProfileStringW
FreeLibrary
GetProcAddress
LoadLibraryW
Sleep
MultiByteToWideChar
CreateDirectoryW
WideCharToMultiByte
LoadLibraryA
GetOEMCP
FindClose
GetCPInfo
LCMapStringW
LCMapStringA
VirtualAlloc
VirtualFree
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
UnhandledExceptionFilter
GetModuleFileNameW
GetCurrentProcess
FlushInstructionCache
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WritePrivateProfileStringW
InitializeCriticalSection
InterlockedDecrement
OutputDebugStringW
DebugBreak
lstrlenA
InterlockedIncrement
DisableThreadLibraryCalls
lstrlenW
GetTempPathW
lstrcatW
GetTickCount
GetACP
GetStringTypeW
GetStringTypeA
SetFilePointer
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
InterlockedExchange
GetLastError
GetVersionExW
CloseHandle
RtlUnwind
RaiseException
ResumeThread
CreateThread
TlsSetValue
TlsGetValue
ExitThread
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
GetFileAttributesW
ExitProcess
TerminateProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsAlloc
TlsFree
SetLastError
ReadFile
WriteFile
IsBadWritePtr

user32

wsprintfW
wvsprintfW
CharNextW
LoadStringW

shell32

SHFileOperationW
SHGetSpecialFolderPathW

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

DispCallFunc
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString

atl

ord32
ord31
ord30
ord58
ord57
ord18
ord15
ord16
ord21
ord23

wininet

InternetOpenUrlW
InternetCrackUrlW
InternetConnectW
InternetReadFile
InternetCloseHandle
HttpSendRequestW
InternetOpenW
HttpOpenRequestW

shlwapi

PathFindExtensionW
StrCmpW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Ext_GetExtensionCLSID
Ext_GetExtensionInfo
Ext_GetExtensionType
Ext_Init
Ext_UnInit

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/pluginbar/pluginbar.dll
.dll windows:4 windows x86 arch:x86

344e123b8af98e131397a18849664e37

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcessId
DisableThreadLibraryCalls
GetLastError
GetModuleFileNameW
lstrlenW
lstrcmpiW
VirtualFreeEx
Sleep
WinExec
CloseHandle
WaitForSingleObject
CreateProcessW
MultiByteToWideChar
ReadProcessMemory
OpenProcess
VirtualAllocEx
WideCharToMultiByte
WriteProcessMemory

user32

ClientToScreen
CheckMenuItem
SendMessageW
PeekMessageW
DispatchMessageW
ShowWindow
SetForegroundWindow
MessageBoxW
CreatePopupMenu
DestroyMenu
LoadImageW
DestroyIcon
GetParent
AppendMenuW

msvcp60

?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ

shlwapi

StrStrW
StrCmpW

msvcrt

_initterm
free
malloc
atoi
_adjust_fdiv
wcstok
__dllonexit
_onexit
sprintf
_snprintf
wcslen
wcscpy
memset
??2@YAPAXI@Z
__CxxFrameHandler
wcsrchr
fclose
fread
_filelength
_wfopen
swprintf

comctl32

ImageList_Create
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Destroy

Exports

Exports

CreatePluginBar
Ext_GetExtensionInfo
Ext_GetExtensionType
Ext_Init
Ext_UnInit

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/extensions/pluginbar/pocket.htm
360se3/extensions/pluginbar/screener.exe
.exe windows:4 windows x86 arch:x86

8343d2478bb66186edb053db51cc1f6f

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

5c:d0:ce:76:ad:95:ee:77:79:41:cb:5b:5e:c2:a8:c9
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

11/07/2008, 00:00

Not After

11/07/2009, 23:59

Subject

CN=PhoenixStudio.org,OU=Class 3 - for Microsoft Authenticode Signing,O=Beijing Shengjing Wanwei Technology Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
WideCharToMultiByte
SetFilePointer
GetFileType
GetStdHandle
SetHandleCount
GetLastError
IsBadWritePtr
VirtualAlloc
GetProcAddress
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
GetOEMCP
GetACP
GetCPInfo
HeapSize
GetCurrentProcess
TerminateProcess
HeapReAlloc
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
RtlUnwind
HeapAlloc
HeapFree
GetLocalTime
GetSystemTime
GetTimeZoneInformation
LoadLibraryA
CompareStringA
CompareStringW
GlobalFree
LocalFree
lstrlenA
MultiByteToWideChar
InterlockedDecrement
CreateFileA
WriteFile
CloseHandle
LocalAlloc
MulDiv
FindResourceA
LoadResource
LockResource
SizeofResource
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
FreeResource
OutputDebugStringA
GetProfileIntA
VirtualFree
SetEnvironmentVariableA

user32

ScreenToClient
PtInRect
GetDCEx
TrackMouseEvent
GetDlgItem
GetDesktopWindow
InflateRect
EqualRect
GetCapture
GetSystemMetrics
ReleaseDC
DrawTextA
GetMessagePos
SetDlgItemTextA
GetDC
SetCursor
InvalidateRect
SetRect
EndDialog
OffsetRect
CopyRect
ReleaseCapture
SetForegroundWindow
SetFocus
SetCapture
MapWindowPoints
FillRect
DefWindowProcA
LoadMenuA
GetSubMenu
GetCursorPos
TrackPopupMenu
DestroyMenu
RegisterWindowMessageA
DestroyWindow
LoadImageA
DestroyIcon
PostQuitMessage
CreateWindowExA
ShowWindow
UpdateWindow
LoadIconA
RegisterClassExA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
GetParent
GetWindowRect
PeekMessageA
DispatchMessageA
TranslateMessage
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsRectEmpty
MessageBoxA
LoadStringA
SendMessageA
DialogBoxParamA
BeginPaint
EndPaint
LoadCursorA
GetClientRect
SetWindowPos

gdi32

GetStockObject
SetBkMode
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
CreatePen
CreateSolidBrush
SelectObject
Rectangle
DeleteObject
CreatePatternBrush
PatBlt
UnrealizeObject
SetROP2
SetWindowOrgEx
SetViewportOrgEx
SetMapMode
SaveDC
GetDeviceCaps
GetObjectA
GetDIBits
RestoreDC
BitBlt
CreateBitmap

comdlg32

GetSaveFileNameA

shell32

Shell_NotifyIconA

ole32

CreateStreamOnHGlobal

oleaut32

SysAllocStringLen
SysFreeString
OleLoadPicture

gdiplus

GdipCloneImage
GdipDisposeImage
GdipFree
GdipAlloc
GdipLoadImageFromStream
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
360se3/seext.dll
.dll windows:4 windows x86 arch:x86

8e3e99dba9af4dc74f93c1983be3ce97

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetPrivateProfileStringW
DeleteFileW
WritePrivateProfileStringW
lstrcmpW
ExpandEnvironmentStringsW
GetPrivateProfileIntW
lstrlenW
GetModuleFileNameW
lstrcpyW
lstrcatW
lstrcmpiW
SetEnvironmentVariableW
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
ReadFile
SetEndOfFile
Sleep
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
UnhandledExceptionFilter
CreateFileW
FlushFileBuffers
GetCommandLineA
GetVersion
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetLastError
CloseHandle
WriteFile
InitializeCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
SetFilePointer
HeapAlloc
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
VirtualAlloc
HeapReAlloc
IsBadWritePtr
FatalAppExitA
RtlUnwind
SetStdHandle
SetEnvironmentVariableA

advapi32

RegDeleteValueW
RegQueryValueExW
RegOpenKeyW
RegSetValueExW
RegCloseKey
RegEnumKeyW

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
ShellExecuteW

ole32

CoInitialize
CoCreateInstance
CoUninitialize

wininet

HttpQueryInfoW
InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetCloseHandle

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

shlwapi

StrStrW
SHDeleteKeyW
StrToIntW
PathFileExistsW
PathRemoveFileSpecW

Exports

Exports

CheckLatestVer
DisableBHO
Get360SEPath
Get360SEVersion
SetIECoreDefault

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360se3/sefix.exe
.exe windows:4 windows x86 arch:x86

5cfb4d8f9685723a13af8e492aa53208

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord3820
ord3074
ord4075
ord4621
ord4418
ord3716
ord795
ord1634
ord567
ord3621
ord3658
ord2406
ord6195
ord4282
ord4279
ord4270
ord5871
ord2371
ord4667
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord3733
ord561
ord815
ord5261
ord4370
ord4847
ord4992
ord3826
ord6048
ord1767
ord5276
ord4419
ord3592
ord617
ord2506
ord641
ord2637
ord6211
ord2078
ord326
ord5208
ord296
ord2613
ord1131
ord4215
ord2576
ord3649
ord2430
ord2566
ord4390
ord3567
ord4229
ord1143
ord324
ord2362
ord2294
ord6213
ord4142
ord6237
ord755
ord2746
ord470
ord3087
ord6330
ord4219
ord2634
ord4294
ord6266
ord1637
ord4197
ord927
ord3566
ord609
ord1197
ord3825
ord3397
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1768
ord4073
ord6051
ord3614
ord6655
ord538
ord942
ord2910
ord5568
ord2756
ord4273
ord4272
ord925
ord922
ord940
ord537
ord861
ord858
ord540
ord860
ord800
ord1165
ord4704
ord825
ord1569

msvcrt

_controlfp
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
__CxxFrameHandler
_itow
swprintf
wcscmp
wcslen
_snwprintf
memset
_wtoi
wcstok
wcsrchr
wcsftime
localtime
time
_exit

kernel32

GetFileAttributesW
GetPrivateProfileSectionNamesW
lstrlenW
lstrcatW
lstrcpyW
WritePrivateProfileSectionW
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetLastError
GetTickCount
DeleteFileW
TerminateProcess
OpenProcess
lstrcmpiW
Process32FirstW
CreateToolhelp32Snapshot
GetVersionExW
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
GetModuleHandleW
GetStartupInfoW
Sleep
CopyFileW
FreeLibrary
GetProcAddress
GetModuleFileNameW
LoadLibraryW
WaitForSingleObject
CreateThread
CreateDirectoryW
lstrcpynW
ExpandEnvironmentStringsW
CreateProcessW
Process32NextW
CloseHandle
GetCurrentThreadId

user32

PeekMessageW
InsertMenuW
CreatePopupMenu
PostMessageW
InvalidateRect
CloseDesktop
SetThreadDesktop
CreateDesktopW
GetThreadDesktop
FindWindowW
GetWindowThreadProcessId
FindWindowExW
GetMenuStringW
MessageBoxW
EnableWindow
SetCursor
RedrawWindow
GetSysColor
LoadIconW
GetDlgItem
SendMessageW
EndDialog
GetPropW
SetPropW
RemovePropW
DialogBoxParamW
AppendMenuW
GetWindowRect
IsWindowVisible
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
DrawEdge
DispatchMessageW
LoadCursorW
GetMenuItemCount

gdi32

CreateSolidBrush
GetStockObject
GetObjectW
CreateFontIndirectW
DeleteObject

advapi32

RegOpenKeyW
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyW
RegCloseKey
RegSetValueExW

shell32

SHFileOperationW
ShellExecuteW
SHChangeNotify
SHGetSpecialFolderPathW

ole32

CoInitialize
CoUninitialize
CoCreateInstance

shlwapi

SHDeleteKeyW
PathRemoveFileSpecW
PathFileExistsW
StrStrIW

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 208KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
360se3/seup.exe
.exe windows:4 windows x86 arch:x86

aed8dca196876b9e68a7b1c5060d066a

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLongPathNameW
GetExitCodeProcess
GetPrivateProfileIntW
InterlockedDecrement
GetPrivateProfileStringW
DeleteFileW
GetCurrentProcess
GetTickCount
WritePrivateProfileStringW
GetTempPathW
lstrcpynW
GetShortPathNameW
RemoveDirectoryW
ReadFile
GetLastError
CreateFileW
CreateEventW
SetEvent
TlsSetValue
IsBadWritePtr
IsBadReadPtr
CancelWaitableTimer
WaitForMultipleObjects
ResetEvent
GetTempFileNameW
SetWaitableTimer
CreateWaitableTimerW
SystemTimeToFileTime
GetDiskFreeSpaceExW
SetFileTime
SetEndOfFile
SetFilePointer
WriteFile
FindClose
FindNextFileW
SetFileAttributesW
GetFileAttributesW
GetVersionExW
CreateDirectoryW
GetSystemTime
DeviceIoControl
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetPrivateProfileSectionNamesW
GlobalMemoryStatusEx
GetSystemInfo
GetWindowsDirectoryW
GetModuleFileNameW
lstrcpyW
lstrcatW
GetStartupInfoA
GetModuleHandleA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
FreeLibrary
lstrlenA
MultiByteToWideChar
MoveFileExW
CopyFileW
WaitForSingleObject
lstrlenW
WideCharToMultiByte
LoadLibraryW
GetProcAddress
Sleep
CreateProcessW
CloseHandle
FindFirstFileW

user32

GetSystemMetrics
LoadImageW
IsWindowEnabled
LoadStringW
GetDesktopWindow
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
IsWindow
FindWindowExW
RegisterClassExW
LoadCursorW
DefWindowProcW
KillTimer
MessageBoxW
SetDlgItemTextW
SetWindowTextW
EnableWindow
GetDlgItem
SendMessageW
ShowWindow
PostMessageW
FindWindowW
UnregisterClassW
DialogBoxParamW
EndDialog
wsprintfW
CharNextW
LoadIconW
PostThreadMessageW
PeekMessageW
DestroyWindow
PostQuitMessage
GetForegroundWindow
CreateDialogParamW
RemovePropW
SetPropW
SetWindowPos
GetPropW

gdi32

CreateFontIndirectW
GetObjectW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegUnLoadKeyW
RegCloseKey
RegSaveKeyW
LookupPrivilegeValueW
RegLoadKeyW
AdjustTokenPrivileges
OpenProcessToken

shell32

SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW

ole32

CoCreateInstance
OleCreate
CoUninitialize
OleInitialize
OleUninitialize
CoInitialize

oleaut32

SysAllocString
SysFreeString

shlwapi

StrStrW
PathIsRootW
PathCombineW
PathRemoveExtensionW
StrStrIW
SHDeleteKeyW
SHDeleteValueW
SHSetValueW
SHGetValueW
PathFileExistsW
PathGetDriveNumberW
PathFindFileNameW

wininet

HttpSendRequestExW
HttpOpenRequestW
InternetCloseHandle
InternetConnectW
InternetOpenW
HttpEndRequestW
InternetSetOptionW
InternetQueryOptionW
FtpCommandW
InternetGetConnectedState
GetUrlCacheEntryInfoW
CreateUrlCacheEntryW
FtpOpenFileW
InternetGetLastResponseInfoW
InternetWriteFile
InternetCrackUrlW
InternetReadFile
InternetReadFileExA
InternetSetStatusCallbackW
InternetSetOptionA
FtpGetFileSize
HttpQueryInfoW
CommitUrlCacheEntryW

urlmon

ObtainUserAgentString

comctl32

InitCommonControlsEx

msvcp60

??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?_Refcnt@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEAAEPBG@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Xlen@std@@YAXXZ
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB

msvcrt

fprintf
_wtoi64
_ftol
_wtol
time
_ui64tow
isalnum
sprintf
_beginthreadex
wcsncpy
_wcsnicmp
wcscmp
_wfopen
fseek
_strnicmp
fgets
rewind
__dllonexit
_onexit
_exit
ftell
??2@YAPAXI@Z
fread
_XcptFilter
exit
_acmdln
__getmainargs
__setusermatherr
_adjust_fdiv
__p__fmode
__set_app_type
_except_handler3
_controlfp
_stricmp
fgetws
fclose
fwrite
wcschr
wcsstr
wcsncat
_itow
_wtoi
wcscat
_waccess
strncpy
strncmp
wcsrchr
_snwprintf
wcscpy
__CxxFrameHandler
_wcsicmp
wcslen
vswprintf
swprintf
iswdigit
_snprintf
memmove
swscanf
wcsncmp
free
malloc
_ltow
fwprintf
_strlwr
strncat
iswspace
_initterm
__p__commode

setupapi

SetupIterateCabinetW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

netapi32

Netbios

Sections

.text
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 429KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
360se3/urls.dat

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:ddCertificate

Extended Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 76KB

.rsrc Size: 6KB - Virtual size: 6KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 1012B

946eb0a1e85c9ade4acaf634eb5a64f1

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 697B

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 352B

.reloc Size: 512B - Virtual size: 264B

f5edecae12589e705677a6e272ad0394

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 23KB - Virtual size: 22KB

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 76KB

.rsrc
Size: 6KB - Virtual size: 6KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 1012B

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 697B

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 264B

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 2KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 512B - Virtual size: 84B

.rdata
Size: 512B - Virtual size: 206B

.data
Size: - Virtual size: 20B

.reloc
Size: 512B - Virtual size: 48B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 496B

.text
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 40KB - Virtual size: 40KB

Shared
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 72KB - Virtual size: 70KB

.reloc
Size: 32KB - Virtual size: 30KB

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate