SmartClient[.]zip | Triage™

resource
unpack001/SmartClient/AVApis.dll
unpack001/SmartClient/BCNetSDK.dll
unpack001/SmartClient/BCP2P_API.dll
unpack001/SmartClient/DevMiddleware.dll
unpack001/SmartClient/EnCodeQr.dll
unpack001/SmartClient/IOTCAPIs.dll
unpack001/SmartClient/Language.dll
unpack001/SmartClient/Live555.dll
unpack001/SmartClient/OnvifPC.dll
unpack001/SmartClient/RDTApis.dll
unpack001/SmartClient/RemoteConfig.dll
unpack001/SmartClient/SmartClient.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$SYSDIR/pthreadVC.dll
unpack001/SmartClient/hi_VoiceEngine.dll
unpack001/SmartClient/playctrl.dll
unpack001/SmartClient/sqlite3.dll
unpack001/SmartClient/unins000.exe

resource	yara_rule
static1/unpack001/SmartClient/WinPcap.exe	nsis_installer_1
static1/unpack001/SmartClient/WinPcap.exe	nsis_installer_2

SmartClient.zip

SHA256 25512356b45d1f25c9f5e1ebfd53005773f95a6354c12aa9e8801f764daf215f
MD5 d5d4a884cea57f126bf49a20414005fa
SHA1 1990a9bda008632bb83c912c85ba911c56a96dfc
SHA512 f78c6ed13cd29d20a192e5bd30c0216311415f2f310cbe568a53392c569ae81093259c4ead2a1aea04d57975e1104a8c3a3d263d5af81de4c8e3772b2705f6de
SSDEEP 393216:qMlG/dXOeKQo/QralUaSoMoFL2Ry/dt1o7m7pqsq76qq:qMQ/pjYSkFbb1xMszqq
MD5 SHA1 SHA512 SSDEEP

SmartClient/AVApis.dll

IMPHASH a17f3419f7613498fa4dc8de924e8104
SHA256 cacba528cb5623f3a00cec8af23ac0cb5b158aee27c2356e9e1f6d541568169f
MD5 99ecd1c9fa16f3f8d8f5716e7df79d6e
SHA1 4cec30c77982a0079406281b137da8244242fa4d
SHA512 0854842c982b09501e18966565c94cc99d1e7db8dbf16fcb7e79337fff2b0d5252c22de1e690e44ef3f9ebc15d20375d1854e0aefab735bf9d0fcdb2ebe1447e
SSDEEP 1536:thjJGbRe+6SeljSJo7X32k32JPnRJ4Gtrg:TjJGtJ2A402Gtr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

30276

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

Sleep DeleteCriticalSection GetSystemTimeAsFileTime InitializeCriticalSection EnterCriticalSection LeaveCriticalSection HeapAlloc GetLastError HeapFree WideCharToMultiByte GetTimeZoneInformation GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InterlockedDecrement GetCPInfo TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId RtlUnwind LoadLibraryA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetACP GetOEMCP SetFilePointer GetConsoleCP GetConsoleMode HeapSize GetLocaleInfoA CompareStringA CompareStringW SetEnvironmentVariableA FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CloseHandle CreateFileA

iotcapis

IOTC_Session_Channel_ON IOTC_Session_Set_Channel_RcvCb IOTC_Session_Check RT IOTC_Session_Write IOTC_Session_Channel_OFF

SmartClient/BCNetSDK.dll

IMPHASH 5a31ef96b5d2ccf4e4e69dd07be303b5
SHA256 f642470d350dccec3ecaa68420b3dcd4886bd19c2e073774128a74cbd6badd6c
MD5 1e7f4018e45adec1e6c9dc0065d99ad0
SHA1 2d8eb16f458bc2cf01f63669d39fbd66c94664ad
SHA512 b4acce49d04e443a5ca4b404464dcd07eb71b1e0efe620c1654975b8afb261e9602b1bf929a7dbeab2e8ea1adf940f80b775c3ad9369486e39738116585bf105
SSDEEP 12288:Hl7m0UITAICxWP0Q58H9jV7aqJYjvz7a1NIakWZe5rO/5i8OUT5NmywyzoN3yefz:Hli0UgPCxWPsD7aE5io9NmyLzoN3yO3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

322881

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wsock32

ioctlsocket select WSACleanup setsockopt socket WSAStartup inet_addr gethostbyname gethostname send closesocket getsockopt __WSAFDIsSet connect inet_ntoa WSAGetLastError recv htons

kernel32

SetStdHandle LoadLibraryA Sleep GetTimeZoneInformation GetLocalTime GetModuleFileNameA GetModuleHandleA CloseHandle CreateMutexA CreateEventA ReleaseMutex WaitForSingleObject SetEvent OutputDebugStringA GlobalAlloc MoveFileA FindNextFileA FindFirstFileA InitializeCriticalSectionAndSpinCount GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FlushFileBuffers GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA GetStartupInfoA GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP WideCharToMultiByte HeapSize GetCurrentDirectoryA CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetStringTypeA GetStringTypeW SetEnvironmentVariableA GetLocaleInfoA SetEndOfFile GetProcessHeap CompareStringA TlsSetValue TlsAlloc TlsGetValue SetFilePointer ReadFile MultiByteToWideChar GetStdHandle WriteFile ExitProcess CompareStringW FreeEnvironmentStringsW GetFullPathNameA InterlockedDecrement SetLastError InterlockedIncrement GetProcAddress GetModuleHandleW GetSystemTimeAsFileTime HeapAlloc RtlUnwind GetLastError FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA GetFileAttributesA HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException ExitThread ResumeThread CreateThread DeleteFileA GetCurrentThreadId GetCommandLineA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapCreate HeapDestroy TlsFree

playctrl

PlayM4_GetPort PlayM4_SetVolume PlayM4_OpenStream _PlayM4_SetToolbarHeight@8 PlayM4_Play PlayM4_Stop PlayM4_CloseStream PlayM4_FreePort PlayM4_PlaySound PlayM4_StopSound PlayM4_GetPlayPos PlayM4_SetPlayPos PlayM4_OneByOne PlayM4_Slow PlayM4_Fast PlayM4_Pause _PlayM4_ZoomInOut@24 PlayM4_ConvertToBmpFile PlayM4_CaptureImage _PlayM4_GetImageSize@12 PlayM4_RigisterDrawFun _PlayM4_SetDisMode@8 PlayM4_InputData PlayM4_SetStreamOpenMode

iotcapis

IOTC_Connect_ByUID IOTC_Session_Close IOTC_Connect_Stop IOTC_DeInitialize IOTC_Set_Max_Session_Number IOTC_Initialize2

bcp2p_api

BCP2P_Check_Buffer BCP2P_Write BCP2P_ConnectByServer BCP2P_Read BCP2P_ForceClose BCP2P_DeInitialize BCP2P_GetAPIVersion BCP2P_Initialize BCP2P_NetworkDetect

rdtapis

RDT_Write RDT_Create RDT_Read RDT_Destroy RDT_DeInitialize RDT_Initialize

netapi32

Netbios

iphlpapi

GetAdaptersInfo

wpcap

pcap_freealldevs pcap_findalldevs_ex

shlwapi

StrStrIA

BC_CHECK_RECFILE_Is_Del BC_CapturePicture BC_CheckIpLanOrWan BC_Cleanup BC_CloseSound BC_ExportConfigFile BC_FindDVRLog BC_FindFile BC_FindFrame BC_FindLogClose BC_FindNextLog BC_FormatDisk BC_GetAlarmOut BC_GetChannelState BC_GetConfig BC_GetConfigNoCallBack BC_GetDownload_Pos BC_GetFileByTime BC_GetFile_ByName BC_GetLastError BC_GetLogFile BC_GetLogFilePercent BC_GetNetThroughOut BC_GetSDKVersion BC_GetSubStreamWH BC_GetUserConfig BC_Get_ExportFilePercent BC_Get_RecfileSchedule BC_H264toAVI BC_ImportConfigFile BC_Init BC_Login BC_Logout BC_OpenSound BC_PTZControl BC_PTZTrack BC_PlayBackByName BC_PlayBackCaptureFile BC_PlayBackControl BC_PlayBackSaveData BC_RealPlay BC_RegisterFileFind BC_RegisterGetFile BC_RegisterGetFileByName BC_RegisterGetFileByTime BC_RegisterGetRespone BC_RegisterLoginRespone BC_RegisterPlayBack BC_RegisterPreviewRespone BC_RegisterRecFileDate BC_RegisterSeek BC_RegisterSetRespone BC_RegisterStarAlarm BC_RegisterStopAlarm BC_Register_TestPrinfCallBack BC_RigisterDrawFun BC_SaveRealData BC_SetAlarmOut BC_SetConfig BC_SetConnectTime BC_SetDVRChannelChangeCallBack_V30 BC_SetDigitZoom BC_SetDisMode BC_SetExceptionCallBack BC_SetMessageCallBack BC_SetPartingSize BC_SetPlayBack BC_SetRealDataCallBack BC_SetToolbarHeight BC_StartAlarmChannel BC_StartManualRecord BC_StartVoiceCom BC_StopAlarmChannel BC_StopGetFileByTime BC_StopManualRecord BC_StopPlayBack BC_StopPlayBackSave BC_StopPlayBack_V20 BC_StopRealPlay BC_StopRealPlay_V20 BC_StopSaveRealData BC_StopVoiceCom BC_Stop_GetFile BC_UpdateChannelEnc BC_Upgrade BC_Volume Bc_Responedproc Bc_ResponedprocV20 Bc_SessionCallBack_Connect Bc_SessionCallBack_Responed Bc_SessionCallBack_ResponedV20 NET_DVR_CaptureJPEGPicture NET_DVR_CloseSound NET_DVR_GetPTZCruise NET_DVR_GetPTZProtocol NET_DVR_GetRealPlayerIndex NET_DVR_H264toAVI NET_DVR_OpenSound NET_DVR_PTZControl NET_DVR_PTZCruise NET_DVR_PTZPreset NET_DVR_PTZTrack NET_DVR_PlayBackByName NET_DVR_PlayBackCaptureFile NET_DVR_PlayBackControl NET_DVR_PlayBackSaveData NET_DVR_RealPlay_V30 NET_DVR_SaveRealData_V30 NET_DVR_SetPlayDataCallBack NET_DVR_SetPlayerBufNumber NET_DVR_SetRealDataCallBack NET_DVR_SetVoiceComClientVolume NET_DVR_StartDVRRecord NET_DVR_StartVoiceCom_V30 NET_DVR_StopDVRRecord NET_DVR_StopPlayBack NET_DVR_StopPlayBackSave NET_DVR_StopRealPlay NET_DVR_StopSaveRealData NET_DVR_StopVoiceCom NET_DVR_Volume TalkDataCallBack _BC_ExportConfigFileContinueV10 _BC_ExportConfigFileContinueV20 _BC_FindFileContinueV10 _BC_FindFileContinueV20 _BC_GetAdminAbility _BC_GetConfigContinueV10 _BC_GetConfigContinueV20 _BC_GetFileByNameContinueV10 _BC_GetFileByNameContinueV20 _BC_GetFileByTimeContinueV10 _BC_GetFileByTimeContinueV20 _BC_GetLogContinueV10 _BC_GetLogContinueV20 _BC_GetManAlarmOutContinueV10 _BC_GetManAlarmOutContinueV20 _BC_GetRecFileDateContinueV10 _BC_GetRecFileDateV20 _BC_GetUserAbility _BC_GetUserAbilityContinueV20 _BC_GetUserCfgContinueV20 _BC_ImportContinueV10 _BC_ImportContinueV20 _BC_LoginContinueV10 _BC_LogoutContinueV10 _BC_LogoutContinueV20 _BC_PlayBackContinueV10 _BC_PlayBackContinueV20 _BC_PreviewContinueV10 _BC_PreviewContinueV20 _BC_PtzTrackContinueV10 _BC_SeekContinueV10 _BC_SeekContinueV20 _BC_SetConfigContinueV10 _BC_SetConfigContinueV20 _BC_SetConfigMultiContinueV10 _BC_SetManAlarmOutContinueV10 _BC_SetManAlarmOutContinueV20 _BC_SetNetExtContinueV10 _BC_SetNetExtContinueV20 _BC_SetUserAbilityContinueV20 _BC_StarAlarmContinueV10 _BC_StarAlarmContinueV20 _BC_StopAlarmContinueV10 _BC_StopAlarmContinueV20 _BC_StopGetFileByNameContinueV10 _BC_StopGetFileByNameContinueV20 _BC_StopGetFileByTimeContinueV10 _BC_StopGetFileByTimeContinueV20 _BC_StopPlayBackContinueV10 _BC_StopPlayBackContinueV20 _BC_UpgradeContinueV10 _BC_UpgradeContinueV20 net_callback_main

SmartClient/BCP2P_API.dll

IMPHASH a96b27ea10160797cb46e84f42c4c120
SHA256 906e449775c58ff095ffe8fcf04af7f152b481ed09c261802aff3f82c66e10a8
MD5 f481d080f6f86ccdfb59bc349e092903
SHA1 9da75ebe1be17618884f15a74b0e75efa10497e2
SHA512 ca119c9b119b901309f6635d990090fc5033582ddb4e355f651d558d230d13d6c369f6118c683db658b1bf38caaec7f9db9f564fce66bfc9ab556a1db94ac779
SSDEEP 1536:Gb5H6AwyZwMDEE6ozEyEQFKwDXCcOOmfgC9TRQ0v+jZL4Si2ZoP2YtRk/MfUSg7t:GRnZjDtUXYOOg+BYI2XUotHM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

44887

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

setsockopt gethostbyname htonl recvfrom inet_addr select sendto __WSAFDIsSet ntohl connect getsockname closesocket inet_ntoa WSACleanup htons bind WSAStartup ntohs socket

iphlpapi

GetAdaptersAddresses GetAdaptersInfo

kernel32

TerminateProcess SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA HeapSize GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA FlushFileBuffers SetStdHandle CreateFileA CreateThread CreateMutexW Sleep WaitForSingleObject ReleaseMutex CloseHandle GetTickCount HeapAlloc HeapFree GetProcessHeap GetSystemTimeAsFileTime GetLastError GetCurrentThreadId GetCommandLineA GetVersionExA HeapDestroy HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetModuleHandleA GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA RtlUnwind WideCharToMultiByte GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId InitializeCriticalSection LoadLibraryA SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar ReadFile

SmartClient/DevMiddleware.dll

IMPHASH eaa0e193c7618359ed83d939e8b257c2
SHA256 cf31b9dac64eaa8fdf416393124662277959f9b36791d73f02d15324754e32ad
MD5 332721416401b18701d61cbdd2e4219b
SHA1 492f2b5ccf8711941f4030753275b2b826f6a7b4
SHA512 119472fa11ce0446e35adb762ace890371d9165e78aadd420eed2739a5cd57ad077da8389116db4e49b1dc5c0ff4cbd99d14b5fdcb2d5d21d847e08a2f8580ef
SSDEEP 1536:z6ZZXuvN/abSABwLcILEx1mRWfZL+OoBDxyfvdzFqzAf5MQBxr0n0KAcD/DWXdoL:z6zuFTLO1nMk1zFFL8JzDWtoReGJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

26544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\release version\NvrBranch_V2.0-20150617\RemoteCofig DevMiddleware\bin\DevMiddleware.pdb

playctrl

PlayM4_CloseStream PlayM4_InputData PlayM4_OpenStream PlayM4_PlaySound PlayM4_StopSound PlayM4_SetVolume PlayM4_GetPlayPos PlayM4_SetPlayPos PlayM4_ConvertToBmpFile PlayM4_CaptureImage PlayM4_OneByOneBack PlayM4_OneByOne PlayM4_Slow PlayM4_Fast PlayM4_Pause PlayM4_Stop PlayM4_Play PlayM4_SetStreamOpenMode PlayM4_CloseFile PlayM4_OpenFile PlayM4_GetPort PlayM4_FreePort

bcnetsdk

BC_GetChannelState BC_UpdateChannelEnc BC_SetMessageCallBack BC_RegisterSeek BC_RegisterPlayBack BC_RegisterRecFileDate BC_RegisterGetFileByName BC_RegisterGetFileByTime BC_RegisterFileFind BC_RegisterSetRespone BC_RegisterGetRespone BC_RegisterPreviewRespone BC_RegisterLoginRespone BC_SetDVRChannelChangeCallBack_V30 BC_SetExceptionCallBack BC_CHECK_RECFILE_Is_Del BC_SetPartingSize BC_Cleanup BC_Init BC_StopVoiceCom BC_FindNextLog BC_FindLogClose BC_FindDVRLog BC_StartAlarmChannel BC_StopAlarmChannel BC_SetConfig BC_GetConfig BC_GetLastError BC_GetConfigNoCallBack BC_GetSubStreamWH BC_Upgrade BC_ExportConfigFile BC_ImportConfigFile BC_GetLogFile BC_GetLogFilePercent BC_Get_ExportFilePercent BC_GetNetThroughOut BC_PTZControl BC_PTZTrack BC_RealPlay BC_StopRealPlay BC_CapturePicture BC_RigisterDrawFun BC_SetDisMode BC_StartVoiceCom BC_OpenSound BC_CloseSound BC_Volume BC_SaveRealData BC_StopSaveRealData BC_SetDigitZoom BC_FindFile BC_PlayBackByName BC_PlayBackControl BC_StopPlayBack BC_SetPlayBack BC_Get_RecfileSchedule BC_PlayBackCaptureFile BC_H264toAVI BC_GetDownload_Pos BC_GetFile_ByName BC_Stop_GetFile BC_GetFileByTime BC_StopGetFileByTime BC_Login BC_Logout BC_StartManualRecord BC_StopManualRecord

kernel32

GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA LCMapStringW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA CloseHandle FlushFileBuffers GetModuleHandleA GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep ExitProcess SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize LoadLibraryA GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount

??0CDevRemoteFileDownloader@@QAE@ABV0@@Z ??0CDevRemoteFileDownloader@@QAE@PAVIDevUserLogin@@@Z ??0CDevRemoteFileDownloader@@QAE@PAVIDevUserLogin@@JPAUTIME@@1PAD@Z ??0CDevRemoteFileDownloader@@QAE@PAVIDevUserLogin@@PAD1@Z ??0CDevRemoteFileFinder@@QAE@ABV0@@Z ??0CDevRemoteFileFinder@@QAE@PAVIDevUserLogin@@PAUtagSearchEventCondition@@@Z ??0CDevRemoteFileFinder@@QAE@PAVIDevUserLogin@@PAUtagSearchFileCondition@@@Z ??0CDevRemotePlayback@@QAE@ABV0@@Z ??0CDevRemotePlayback@@QAE@PAVIDevUserLogin@@PAUHWND__@@@Z ??0CDevRemotePlayback@@QAE@PAVIDevUserLogin@@PAUHWND__@@JPAUTIME@@2@Z ??0CRLGlobal@@QAE@XZ ??1CDevRemoteFileDownloader@@UAE@XZ ??1CDevRemoteFileFinder@@UAE@XZ ??1CDevRemotePlayback@@UAE@XZ ??1CRLGlobal@@QAE@XZ ??4CDevAlarmFactory@@QAEAAV0@ABV0@@Z ??4CDevConfigFactory@@QAEAAV0@ABV0@@Z ??4CDevCtlPtzFactory@@QAEAAV0@ABV0@@Z ??4CDevLocalPlaybackFactory@@QAEAAV0@ABV0@@Z ??4CDevOnvifFactory@@QAEAAV0@ABV0@@Z ??4CDevPreviewFactory@@QAEAAV0@ABV0@@Z ??4CDevRemoteFileDownloader@@QAEAAV0@ABV0@@Z ??4CDevRemoteFileDownloaderFactory@@QAEAAV0@ABV0@@Z ??4CDevRemoteFileFinder@@QAEAAV0@ABV0@@Z ??4CDevRemoteFileFinderFactory@@QAEAAV0@ABV0@@Z ??4CDevRemotePlayback@@QAEAAV0@ABV0@@Z ??4CDevRemotePlaybackFactory@@QAEAAV0@ABV0@@Z ??4CDevUserLoginFactory@@QAEAAV0@ABV0@@Z ??4CRLGlobal@@QAEAAV0@ABV0@@Z ??_7CDevRemoteFileDownloader@@6B@ ??_7CDevRemoteFileFinder@@6B@ ??_7CDevRemotePlayback@@6B@ ?Check_RecFile_Is_Del@CRLGlobal@@SAHPAD@Z ?Cleanup@CRLGlobal@@SAHXZ ?CreateDevAlarm@CDevAlarmFactory@@SAPAVIDevAlarm@@PAVIDevUserLogin@@@Z ?CreateDevConfig@CDevConfigFactory@@SAPAVIDevConfig@@PAVIDevUserLogin@@@Z ?CreateDevCtlPtz@CDevCtlPtzFactory@@SAPAVIDevCtlPtz@@PAVIDevUserLogin@@JPAVIDevPreview@@@Z ?CreateDevCtlPtz@CDevCtlPtzFactory@@SAPAVIDevCtlPtz@@PAVIDevUserLogin@@PAVIDevPreview@@@Z ?CreateDevLocalPlayback@CDevLocalPlaybackFactory@@SAPAVIDevLocalPlayback@@PAVIDevUserLogin@@@Z ?CreateDevOnvif@CDevOnvifFactory@@SAPAVIDevOnvif@@H@Z ?CreateDevPreview@CDevPreviewFactory@@SAPAVIDevPreview@@PAVIDevUserLogin@@J@Z ?CreateDevUserLogin@CDevUserLoginFactory@@SAPAVIDevUserLogin@@PAVCDevInfo@@@Z ?CreateDownloader@CDevRemoteFileDownloaderFactory@@SAPAVCDevRemoteFileDownloader@@PAVIDevUserLogin@@@Z ?CreateDownloader@CDevRemoteFileDownloaderFactory@@SAPAVCDevRemoteFileDownloader@@PAVIDevUserLogin@@JPAUTIME@@1PAD@Z ?CreateDownloader@CDevRemoteFileDownloaderFactory@@SAPAVCDevRemoteFileDownloader@@PAVIDevUserLogin@@PAD1@Z ?CreateFinder@CDevRemoteFileFinderFactory@@SAPAVCDevRemoteFileFinder@@PAVIDevUserLogin@@PAUtagSearchEventCondition@@@Z ?CreateFinder@CDevRemoteFileFinderFactory@@SAPAVCDevRemoteFileFinder@@PAVIDevUserLogin@@PAUtagSearchFileCondition@@@Z ?CreateRemotePlayback@CDevRemotePlaybackFactory@@SAPAVCDevRemotePlayback@@PAVIDevUserLogin@@PAUHWND__@@@Z ?CreateRemotePlayback@CDevRemotePlaybackFactory@@SAPAVCDevRemotePlayback@@PAVIDevUserLogin@@PAUHWND__@@JPAUTIME@@2@Z ?DeleteDevAlarm@CDevAlarmFactory@@SAXPAVIDevAlarm@@PAVIDevUserLogin@@@Z ?DeleteDevConfig@CDevConfigFactory@@SAXPAVIDevConfig@@PAVIDevUserLogin@@@Z ?DeleteDevCtlPtz@CDevCtlPtzFactory@@SAXPAVIDevCtlPtz@@PAVIDevUserLogin@@@Z ?DeleteDevLocalPlayback@CDevLocalPlaybackFactory@@SAXPAVIDevLocalPlayback@@@Z ?DeleteDevOnvif@CDevOnvifFactory@@SAXPAVIDevOnvif@@@Z ?DeleteDevPreview@CDevPreviewFactory@@SAXPAVIDevPreview@@PAVIDevUserLogin@@@Z ?DeleteDevUserLogin@CDevUserLoginFactory@@SAXPAVIDevUserLogin@@@Z ?DeleteDownloader@CDevRemoteFileDownloaderFactory@@SAXPAVCDevRemoteFileDownloader@@@Z ?DeleteFinder@CDevRemoteFileFinderFactory@@SAXPAVCDevRemoteFileFinder@@@Z ?DeleteRemotePlayback@CDevRemotePlaybackFactory@@SAXPAVCDevRemotePlayback@@@Z ?EnableLog2File@CRLGlobal@@SAHHPADH@Z ?FindClose@CDevRemoteFileFinder@@UAEHXZ ?GetBuffer@CRLGlobal@@SAPAUMsgAlarmInfo@@XZ ?GetChannelState@CRLGlobal@@SAHJAAUMsgChannelInfo@@@Z ?GetNetThroughOut@@YAHAAK@Z ?HandleChange@CRLGlobal@@SAXJPAUMsgChannelChangeInfo@@@Z ?HandleException@CRLGlobal@@SAXKJJPAX@Z ?HandleFileFindRespond@CRLGlobal@@SAXJW4BC_RSP_CODE_E@@JJPAUtagBC_FIND_DATA@@@Z ?HandleGetFileByNameRespond@CRLGlobal@@SAXJW4BC_RSP_CODE_E@@J@Z ?HandleGetFileByTimeRespond@CRLGlobal@@SAXJW4BC_RSP_CODE_E@@J@Z ?HandleGetRespond@CRLGlobal@@SAXJJJW4BC_RSP_CODE_E@@W4BC_CMD_E@@PAXKPAK@Z ?HandleLoginRespond@CRLGlobal@@SAXJW4BC_RSP_CODE_E@@PAUtagBC_DEVICE_INFO@@@Z ?HandleMsg@CRLGlobal@@SAXPAUMsgAlarmInfo@@@Z ?HandlePlayBackRespond@CRLGlobal@@SAXJW4BC_RSP_CODE_E@@J@Z ?HandlePreviewRespond@CRLGlobal@@SAXJW4BC_RSP_CODE_E@@J@Z ?HandleRecFileDateRespond@CRLGlobal@@SAXJW4BC_RSP_CODE_E@@PAUtag_BC_RECFILE_SCHEDULE@@@Z ?HandleSeekRespond@CRLGlobal@@SAXJW4BC_RSP_CODE_E@@@Z ?HandleSetRespond@CRLGlobal@@SAXJJJW4BC_RSP_CODE_E@@W4BC_CMD_E@@@Z ?HandleStartAlarmRespond@CRLGlobal@@SAXJW4BC_RSP_CODE_E@@J@Z ?HandleStopAlarmRespond@CRLGlobal@@SAXJW4BC_RSP_CODE_E@@J@Z ?IsDownloading@CDevRemoteFileDownloader@@UAEHXZ ?IsMessageCallbackRegistered@CRLGlobal@@SAHXZ ?RegisterAlarmCallback@CRLGlobal@@SAXPAX0@Z ?RegisterAllocator@CRLGlobal@@SAXPAX@Z ?RegisterConnectChangeCallBack@CRLGlobal@@SAHXZ ?RegisterExceptionCallBack@CRLGlobal@@SAHXZ ?RegisterFileFindRespondCallBack@CRLGlobal@@SAHXZ ?RegisterGetFileByNameRespondCallBack@CRLGlobal@@SAHXZ ?RegisterGetFileByTimeRespondCallBack@CRLGlobal@@SAHXZ ?RegisterGetRespondCallBack@CRLGlobal@@SAHXZ ?RegisterHandleConnectChange@CRLGlobal@@SAXPAX@Z ?RegisterHandleException@CRLGlobal@@SAXPAX@Z ?RegisterHandleFileFindRespond@CRLGlobal@@SAXPAX@Z ?RegisterHandleGetFileByNameRespond@CRLGlobal@@SAXPAX@Z ?RegisterHandleGetFileByTimeRespond@CRLGlobal@@SAXPAX@Z ?RegisterHandleGetRespond@CRLGlobal@@SAXPAX@Z ?RegisterHandleLoginRespond@CRLGlobal@@SAXPAX@Z ?RegisterHandleMessage@CRLGlobal@@SAXPAX@Z ?RegisterHandlePlayBackRespond@CRLGlobal@@SAXPAX@Z ?RegisterHandlePreviewRespond@CRLGlobal@@SAXPAX@Z ?RegisterHandleRecFileDateRespond@CRLGlobal@@SAXPAX@Z ?RegisterHandleSeekRespond@CRLGlobal@@SAXPAX@Z ?RegisterHandleSetRespond@CRLGlobal@@SAXPAX@Z ?RegisterHandleStartAlarmRespond@CRLGlobal@@SAXPAX@Z ?RegisterHandleStopAlarmRespond@CRLGlobal@@SAXPAX@Z ?RegisterLoginRespondCallBack@CRLGlobal@@SAHXZ ?RegisterPlayBackRespondCallBack@CRLGlobal@@SAHXZ ?RegisterPreviewRespondCallBack@CRLGlobal@@SAHXZ ?RegisterRecFileDateRespondCallBack@CRLGlobal@@SAHXZ ?RegisterSeekRespondCallBack@CRLGlobal@@SAHXZ ?RegisterSetRespondCallBack@CRLGlobal@@SAHXZ ?RegisterStartAlarmRespondCallBack@CRLGlobal@@SAHXZ ?RegisterStopAlarmRespondCallBack@CRLGlobal@@SAHXZ ?SetPartingSize@CRLGlobal@@SAHK@Z ?StartListen@CRLGlobal@@SAHPADGPAX@Z ?Startup@CRLGlobal@@SAHHH@Z ?Stop@CDevRemoteFileDownloader@@UAEHXZ ?Stop@CDevRemotePlayback@@UAEHXZ ?StopListen@CRLGlobal@@SAHXZ ?UpdateChannelEnc@CRLGlobal@@SAHJ@Z ?m_GetMsgBuffer@CRLGlobal@@0P6APAXXZA ?m_cbConnectChange@CRLGlobal@@0P6GXJPAUMsgChannelChangeInfo@@@ZA ?m_cbException@CRLGlobal@@0P6GXKJJPAX@ZA ?m_cbFileFindRespond@CRLGlobal@@0P6GXJW4BC_RSP_CODE_E@@JJPAUtagBC_FIND_DATA@@@ZA ?m_cbGetFileByNameRespond@CRLGlobal@@0P6GXJW4BC_RSP_CODE_E@@J@ZA ?m_cbGetFileByTimeRespond@CRLGlobal@@0P6GXJW4BC_RSP_CODE_E@@J@ZA ?m_cbGetRespond@CRLGlobal@@0P6GXJJJW4BC_RSP_CODE_E@@W4BC_CMD_E@@PAXKPAK@ZA ?m_cbHandleMsg@CRLGlobal@@0P6GXPAUMsgAlarmInfo@@@ZA ?m_cbLoginRespond@CRLGlobal@@0P6GXJW4BC_RSP_CODE_E@@PAUtagBC_DEVICE_INFO@@@ZA ?m_cbPlayBackRespond@CRLGlobal@@0P6GXJW4BC_RSP_CODE_E@@J@ZA ?m_cbPreviewRespond@CRLGlobal@@0P6GXJW4BC_RSP_CODE_E@@J@ZA ?m_cbRecFileDateRespond@CRLGlobal@@0P6GXJW4BC_RSP_CODE_E@@PAUtag_BC_RECFILE_SCHEDULE@@@ZA ?m_cbSeekRespond@CRLGlobal@@0P6GXJW4BC_RSP_CODE_E@@@ZA ?m_cbSetRespond@CRLGlobal@@0P6GXJJJW4BC_RSP_CODE_E@@W4BC_CMD_E@@@ZA ?m_cbStartAlarmRespond@CRLGlobal@@0P6GXJW4BC_RSP_CODE_E@@J@ZA ?m_cbStopAlarmRespond@CRLGlobal@@0P6GXJW4BC_RSP_CODE_E@@J@ZA ?m_lListenHandle@CRLGlobal@@0JA

SmartClient/EnCodeQr.dll

IMPHASH 2e85ba219d4135ddf89e48511d38fd09
SHA256 cbe3d49f0cd61338aa8cd09520fbfbd86c3a8a7cffc7706781c5b4834070d47a
MD5 42cc61fdef61737bb6c7788e037b926f
SHA1 a6c81ca9309a192fc92a8926ca1f93e5a14cb892
SHA512 be9ffa13a2e5cc813e8bb2a3fbe32a7329d44438659ccc4543f7305d3c3e8dfd6c47e165a43f82658215243b03bb203efdd3a68d177e67767b0c4f1360745798
SSDEEP 1536:9uI03/Af3G2/z4YxCi+TcTeuDQ7xlv5vyQ4ADDtz3AC0t0dWkOcHMMHW8bcN9odL:L04Nzhx4EKlCAnSC0zZB8bw9odyRPA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

51064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcatA ResumeThread CloseHandle TerminateThread WaitForSingleObject GetPrivateProfileStringA PurgeComm ReadFile SetCommTimeouts SetCommState Sleep SetupComm CreateFileA SetEnvironmentVariableA CompareStringW CompareStringA GetUserDefaultLCID EnumSystemLocalesA GetLocaleInfoA IsValidCodePage GetVersionExA GetFileAttributesExA MultiByteToWideChar WideCharToMultiByte GetDiskFreeSpaceExA GetModuleFileNameA GetFileAttributesA CreateDirectoryA lstrlenA GetPrivateProfileIntA GetCommState lstrcpyA IsValidLocale LCMapStringW LCMapStringA SetConsoleCtrlHandler SetEndOfFile LoadLibraryA GetProcAddress GetOEMCP GetACP GetCPInfo GetStringTypeW GetStringTypeA IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter InterlockedIncrement InterlockedDecrement FlushFileBuffers SetStdHandle GetEnvironmentStringsW RtlUnwind HeapAlloc GetTimeZoneInformation GetSystemTime GetLocalTime GetLastError CreateThread GetCurrentThreadId TlsSetValue ExitThread GetCommandLineA GetVersion HeapFree EnterCriticalSection LeaveCriticalSection WriteFile InitializeCriticalSection ExitProcess TerminateProcess GetCurrentProcess HeapReAlloc HeapSize TlsAlloc TlsFree SetLastError TlsGetValue GetCurrentThread SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection SetFilePointer HeapDestroy HeapCreate VirtualFree FatalAppExitA VirtualAlloc IsBadWritePtr UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetLocaleInfoW

user32

GetDC MessageBoxA SendMessageA LoadImageA wsprintfA DrawStateA

gdi32

CreateEnhMetaFileA CloseEnhMetaFile CreateMetaFileA CloseMetaFile GetDeviceCaps

advapi32

RegSetValueExA RegOpenKeyA RegQueryValueExA RegCloseKey RegCreateKeyA

shell32

ShellExecuteA

oleaut32

SysAllocStringByteLen

wsock32

inet_addr WSACleanup gethostbyname gethostname closesocket setsockopt socket send inet_ntoa connect htons recv WSAStartup

netapi32

Netbios

Name

.text

Size

108KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SmartClient/IOTCAPIs.dll

IMPHASH 29adc4c54b36be60461c4ca4c3c5ba99
SHA256 038bc381c5f1d5d0e00074e56a7645a3b75337dfb530dba2ad6c59588fb089f7
MD5 21d5169dc45b5ec2b9a479493ddb55c7
SHA1 77f8a3f74f210a23c0e3bed7c891956359a74aad
SHA512 f5d5849f97d491a5a1495ae9bbc4dcd9c56c9958551c53716493655a8bb9cd8c129f4a42e14b7711e71b1c1fd8a3e8293348231cd558ad64586faa9e3ac8a182
SSDEEP 3072:cDBeXL0eMeKdzyTuY7WQDB2ZZcegpTptNtL:NXwv97Y7Begp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

62660

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LeaveCriticalSection EnterCriticalSection Sleep GetTickCount HeapAlloc GetProcessHeap HeapFree CloseHandle CreateThread DeleteCriticalSection WaitForSingleObject InitializeCriticalSection ReadFile SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetLocaleInfoA MultiByteToWideChar HeapSize SetFilePointer CreateFileA FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle GetOEMCP GetSystemTimeAsFileTime GetLastError HeapReAlloc GetCurrentThreadId GetCommandLineA GetVersionExA VirtualFree VirtualAlloc HeapDestroy HeapCreate GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement RtlUnwind SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId LoadLibraryA GetCPInfo GetACP

ws2_32

closesocket shutdown getsockname connect gethostbyname recv getpeername recvfrom ioctlsocket socket setsockopt getsockopt htonl bind WSAStartup WSACleanup htons inet_addr select __WSAFDIsSet sendto ntohs inet_ntoa

iphlpapi

GetAdaptersAddresses GetAdaptersInfo

SmartClient/Install.ini

SHA256 9b350d78598ca04f4a91a5e7717505f50f3da13db5e536c11da88da5310dbf93
MD5 48fe62e3641773422c8ec607e890c979
SHA1 6b2d16c09ad178bbdbaac24870bb71fe10c8bb9a
SHA512 bb3e1dde3161842fd9871f30001306068b85b1079d515d04621e12e57878701de4cc3c3395006fed194bb8a9f8e68c5d9a865ede63fdd27241db641e44ef34ef
MD5 SHA1 SHA512

SmartClient/LangFiles/LangBgr.ini

SHA256 36a706d62711cc3b6baba9067e4428772323d6fdb54982e7bc0980d3d72fb3c7
MD5 3c22352a625a36f0fc877e948b79d995
SHA1 664ee01b338bc51f5411b4937b144f2cb5b0ae89
SHA512 d43ccc74abe456c11393091131575dfc21db493d1d61d1d2241d8c070fab6810f19fb23b6e48e2bd573a304400dff91473e7ce3da1e6e8fbfa7a6f01ca03c49b
SSDEEP 1536:gfiC1M2gci+qcMmO2kOqpwWhfx1ikZhkMELruzHmTV6iC/cy1uY:DcNO7
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangChs.ini

SHA256 fd3de4f0cf42c90ddf8a44420dcac8f4a009e7a00c403bfd9e560f14f73fa601
MD5 7aacc6a3c9483ee35c20bb44e4ad5259
SHA1 f70f527dbfec3546deccebb6f6e409f9048bb0ec
SHA512 060d5ac452a2b2a8adf65a32953346b88b9e5e0cd595931b84c1eab1003991297afd8d62e38e414e69d2f8350b83c74f312db62ec6f75c521dcba54bd2571f72
SSDEEP 1536:1Jbv2Tf/81uOZTuxzI9rxOM9H9ZawCG3XwP:KSR9lvXwP
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangCht.ini

SHA256 1cd94750fd73fe02225ca79105486d22dc096168587f91f341b24b26bd70654d
MD5 e4bd962c56fc36510c060cf1748c1795
SHA1 004fab93c16824364f2cfe73d1218ee5ef94992d
SHA512 818fc64b5baeb9704f4288bf3c973fdb30c25ccfbd546c9d5ad2e4b714861f1e677adb5c7d79165350469a97015c1726e8799586b4533cd88a84c8f2db4d3d32
SSDEEP 1536:1H/S2HjOFCz90Y8Ys78bysS8mrc6iCscy1uY:1/x8BI
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangCzh.ini

SHA256 36a706d62711cc3b6baba9067e4428772323d6fdb54982e7bc0980d3d72fb3c7
MD5 3c22352a625a36f0fc877e948b79d995
SHA1 664ee01b338bc51f5411b4937b144f2cb5b0ae89
SHA512 d43ccc74abe456c11393091131575dfc21db493d1d61d1d2241d8c070fab6810f19fb23b6e48e2bd573a304400dff91473e7ce3da1e6e8fbfa7a6f01ca03c49b
SSDEEP 1536:gfiC1M2gci+qcMmO2kOqpwWhfx1ikZhkMELruzHmTV6iC/cy1uY:DcNO7
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangEng.ini

SHA256 6822a358a7e166c1034d141489605480cc805ef63a7578887802608b5f492028
MD5 7fbd2ffdd83501f501f4e6f6c105ab07
SHA1 a66d79c7e2adb34750b2f6f0c4d9ef7089750ae9
SHA512 770bd69f35241c4a118f4518c41a692f99357536dc1a50e3c73469fd96788c1b78d2b77f9da109d02215d31768e12194572eebe6ffeede64ca59e6c0d8c043ec
SSDEEP 1536:gfiC1M2dcU+qT6mO2kOqpwWFfx1ikZhkMELruzHmTV6iC/cy1uI:ScE8b
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangEsn.ini

SHA256 2dd3a26987fd3645c223169f1a4942469d5bc1b7d132c9afccec75e2fc6639e9
MD5 bcb94d0177aca7b93b4163dd2a8dc6a0
SHA1 cc35baa5a56899f4d40548a65f2a2f9094a98451
SHA512 e6c345d4e588357c7e5e12510c8bd8584574cda19741536e4fb8fe8d16eec9c5f1882b5369427034a1fd12c005d6e5a1617ac92469c577e15cc151c933591a2c
SSDEEP 1536:l1hjq2SSOqg5u0qOUFG6MHy71+spmDi2z9JNiC/cy1uY:IjlZ
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangFra.ini

SHA256 4879ea1f719927cab1c881cb74e4e2f29f760dac1a1890962ecfdeba4abcc146
MD5 7ab278cceb6067ef610d093b3a8d9d4f
SHA1 1d07ed79f5839b6060f88e6b18d1b2faefa61bf6
SHA512 9cd4486450ee00685132a7f941500197801f2565b3d3b6a8abe70073ed3de239710bcd41fef02c380926aa3381be2cfb992b3560604f12cd9ab12d3294be9317
SSDEEP 1536:0KcDIz24SITDvyKgBvjZk+qS/7h5VkQy/ULzHmTV6iC/cy1uY:fqhDLR
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangGerman.ini

SHA256 17b3fc71572123097c9361d8ee7a42671b6776a1ce822b05a155069052db6032
MD5 a48b2385f3ac265124d73df60ee22279
SHA1 c750c209a0cce1d70fa311ce05cfdf990b373ac3
SHA512 cdd39cde1648adbbb7ddf7890eb5ee8e464cc60b43bee6246052de56dbcc9c01147d0776a924ee80fc8426d4e0384a0af08895d982dad787454601f77f5948df
SSDEEP 1536:7JoGg9rmZ2y2yU2et+NRasCmFE1NXA/YTHCYo1I0CO0nmoKFbJ8U0zaGKQm2z3RE:Xdgt+DasCyUrCYo1+K8OGLecD5Ju
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangHun.ini

SHA256 7b1f94aebcba6870c2d4af4d42659c8395ccb839e6bb5ae7cc6ddcd671b76a31
MD5 65282aa2a91b8ea4342666e48c9ea2e2
SHA1 9249eda2703ecd3b9aa57a143be09b0e26d5c557
SHA512 b0346617a0bb0cb8cd3cacd0bde6d2d6855f2cfc6d43fed3df00eb231bf32cb56afb26827a3777a5c94664de2407589d873f2514947e268dbb8412e4fc3fdf14
SSDEEP 3072:CDH+r4TRV86INUZWprOVPghFmNq8vhTY6Rofy+4xN9eFMTCqBE0NIZRLcBSv886:L8F
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangIta.ini

SHA256 e2012c2f91df9b143b91a64ceac2d2070b69e3d083a453d126353e64d278f186
MD5 68dae5fd7efff9f7e08359338b1f3110
SHA1 0fe13857c4a324405085f749712423f4bb25f5f6
SHA512 bb65515c97f2cc092f700890af986b0aecbcef10dcb818202eb0add38f595aed356de19e29fdb5165084b1a73fe92e1d5e2c42d237152d2129ae060420e7229f
SSDEEP 1536:+us9bf62ek0yNYKr1l9h2j7kZxkMELruzHmTV6iC/cy1uN:o6
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangKra.ini

SHA256 36a706d62711cc3b6baba9067e4428772323d6fdb54982e7bc0980d3d72fb3c7
MD5 3c22352a625a36f0fc877e948b79d995
SHA1 664ee01b338bc51f5411b4937b144f2cb5b0ae89
SHA512 d43ccc74abe456c11393091131575dfc21db493d1d61d1d2241d8c070fab6810f19fb23b6e48e2bd573a304400dff91473e7ce3da1e6e8fbfa7a6f01ca03c49b
SSDEEP 1536:gfiC1M2gci+qcMmO2kOqpwWhfx1ikZhkMELruzHmTV6iC/cy1uY:DcNO7
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangPersian.ini

SHA256 36a706d62711cc3b6baba9067e4428772323d6fdb54982e7bc0980d3d72fb3c7
MD5 3c22352a625a36f0fc877e948b79d995
SHA1 664ee01b338bc51f5411b4937b144f2cb5b0ae89
SHA512 d43ccc74abe456c11393091131575dfc21db493d1d61d1d2241d8c070fab6810f19fb23b6e48e2bd573a304400dff91473e7ce3da1e6e8fbfa7a6f01ca03c49b
SSDEEP 1536:gfiC1M2gci+qcMmO2kOqpwWhfx1ikZhkMELruzHmTV6iC/cy1uY:DcNO7
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangPol.ini

SHA256 a7f669bf6319b5a4310c30df6e2d31ab2f859d4c7032eaf9e9ffa78c367a48ae
MD5 3d58681b8bc83b5bbbcf17b92f53a9dd
SHA1 792e886b458fb812181940d4c548ae675376755f
SHA512 b187b2d224343cd06fb2c7d3e60337c0230edb890de85ef781aef8bc4a7095b751c78104e57bf2f66a02c5ea838f774a9c92146572b93ec18562992450e9a408
SSDEEP 1536:pB0c2z116W5CVFgH1/N3LWdGkwabkzHmTV6iC/cy1uY:kQG3
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangPtg.ini

SHA256 482a8fe15a3d8fa175ba2d3fbf18424d06cf21d0f4f266951f6f9f802a2bb6e1
MD5 f5370dbb1c1e1efa3b8f9fbce5e8a2cd
SHA1 7c6f31d344b01f54849b2b9b843801e87e715b9b
SHA512 4bf7f4ff75cc77db1ac23c5599730bcf81ba1184136b2e76ef2dc34f10fea674eaf12ccc30c189f32c11ecb99728cf3fd998c6cd897a4e6656163bed17254882
SSDEEP 1536:+GE/XWV2IkSNCI+bUfGpAg3ss4XFLcIC6FTp7LBMVHEkBr1zHmTV6iC/cy1uY:XE+ksDGD
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangRom.ini

SHA256 22cfcb49a9356b3dd5c6625192a1d685398de8d2230b58dc268f1372784fdbd1
MD5 926c869fa00eaed7c932926d265e9902
SHA1 984b3baa0d87c7b49de58cb16cb66b1d96ee0639
SHA512 92dc388bdfff253c20a5c12b7245157aeb9bf1cd3bd94a0be7cd8b70e108150380aac7bb204b91726f87ce1a5be29b7048b6637c3efddd1de2290f2325d55a00
SSDEEP 1536:xpT0j723eFL0oV09zM4VEO7c2ykYkBrZzHmTV6iC/cy1uY:TsI
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangRus.ini

SHA256 60cd5b2402f7110e983d1d6d701e04ad62ad3e15e79a0383e34e850f10eb1988
MD5 3c8c9f7f1e71dd6733bc1da3b078c7d4
SHA1 ecacf0923049e7f55ad68ecab81e0a6270cb80d2
SHA512 eea19b4845b9917ffca52a6f9cbfd720befc1e454559c46f5703e622775274dde0b5215a392b33ba3034db46527fc5294ecc57921bbeba1d0ca6e0a7d3db2b19
SSDEEP 1536:zrzNOi2Qdt3sTbTnDJKpudaNedOOhiC/cy1uY:zr5nwEuJOI
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangRus_st.ini

SHA256 2af6e481e6fbcfa53a659e6a81b15e32918a1d791601fa623be7a69923b21494
MD5 7392c3b3293d07b506d60678ca36c6a8
SHA1 3c7e500eb7dfbe95441d6429f2835fa6792b5c62
SHA512 ad2bd9d66c6b7417a8de622c63129c7417a95a21331516a8e3e3164eccfe8d1dd2328888db90078023c8c8d6cf4087e1fcc9df921270ac2ea9b57e475f037975
SSDEEP 1536:0pHRujI22SjwCDXyVgWBqzPbRakXfsAOBEAXzkgg7P8qedO8+iC/cy1uY:QHk9tiOR
MD5 SHA1 SHA512 SSDEEP

SmartClient/LangFiles/LangThai.ini

SHA256 917f13753286f0c10dc9a1f27cbec94af529b54cb083b16e3a873d49ada70810
MD5 512ba8eed97ca080fdc762bfec48b662
SHA1 532141683ec201cd8aad29c052b30ec12c1ec41b
SHA512 659244bbd6b2efe7f73e397125c169b47eabf86bdf18d86fe89a3cae9c92c72f1fa0417e30cc1a2816e7b94ad580b6d53669e3a884c4e34f1970c3ed21a01f8b
SSDEEP 1536:nLkcC9oGMFiveP2Z9CJ/6oGRjF60aTgX2sijl5t9EuPqOY7YVP44AHUCpbYDo5hN:nU
MD5 SHA1 SHA512 SSDEEP

SmartClient/Language.cfg

SHA256 6497c8139d0951db0b12c9eb4acb4631a3225ea00d7eb0b8c60557522745b1df
MD5 95c8234337fd941cf55ea6bc5aa6a5e7
SHA1 aa128fb7a6f4de411266caa071afa9f36ceb5484
SHA512 bf0597f057222ad9f8e273c5f7ba2a324fee046675fd92b9b6cc930d225db643c22474c375e79cde55f6b583557228a7fb25af9655235ed4b7ce656fd8752ab5
SSDEEP 192:wAxFe/RVelKlVuS53fvm0oWcOiBb6tJllsAt:wAClkS53fu0oWqb6tJl2At
MD5 SHA1 SHA512 SSDEEP

SmartClient/Language.dll

IMPHASH 783870f90e494430a205054f73fb8772
SHA256 6890139bd1fe3e86d42a8b01789d8db251d2061cda650c83bf336ad07399d434
MD5 19920cae88627c749f3f2c7e799d6f7c
SHA1 f6c4ebba949083fc4f518d6cfd1d90c31092461c
SHA512 ff365149caba68c2c144babcf20e5e570add21c7bdecc2c46c70915069b55d0a514c3ae866f9316bb4ac843ef96338b246fa96b3d7c67c2288fcd10cea297974
SSDEEP 3072:0KfZiyEylb4XMuKovH0bVSM8sSRzrzLCId0lySEXjW6JDm2N9mBucD5aEVkXB:1iBVv/0bVSRsSlfD0lySEXjWt2XqYEi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

87060

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\release version\NvrBranch_V2.0-20150617\Language\bin\Language.pdb

kernel32

HeapFree HeapAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA RtlUnwind HeapReAlloc RaiseException SetStdHandle GetFileType Sleep ExitProcess HeapSize HeapCreate HeapDestroy VirtualFree VirtualAlloc GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage GlobalFlags GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetTimeZoneInformation LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA GetModuleHandleA GlobalFindAtomW LoadLibraryA GetVersionExA CompareStringW InterlockedIncrement lstrlenA SetErrorMode TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalAddAtomW GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange lstrcmpW GetFileTime GetFileSizeEx FileTimeToLocalFileTime FileTimeToSystemTime CreateFileW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetCurrentProcess DuplicateHandle CloseHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile LoadLibraryW GetCurrentProcessId GetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree lstrlenW WideCharToMultiByte FreeLibrary InterlockedDecrement SetLastError GetProcAddress GetSystemDefaultLangID WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileSectionW MultiByteToWideChar GetFileAttributesW FindResourceW LoadResource LockResource SizeofResource GetModuleFileNameW SetHandleCount GetModuleHandleW

user32

DestroyMenu ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW ShowWindow SetWindowTextW LoadIconW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetForegroundWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx CopyRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect UnhookWindowsHookEx GetSubMenu GetMenuItemCount GetWindow RegisterWindowMessageW LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowTextW UnregisterClassW SetCursor SetWindowsHookExW GetTopWindow GetMenuItemID GetMenuState MessageBoxW EnableWindow IsWindowEnabled GetLastActivePopup GetWindowLongW GetParent SendMessageW GetWindowThreadProcessId IsWindow GetFocus GetSystemMetrics CharUpperW PostQuitMessage PostMessageW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem GetDlgItem

gdi32

DeleteDC GetStockObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx RectVisible SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW GetDeviceCaps PtVisible DeleteObject SetMapMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox CreateBitmap TextOutW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegSetValueExW RegCreateKeyExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegCloseKey

shlwapi

PathFindExtensionW PathStripToRootW PathIsUNCW PathFindFileNameW

oleaut32

VariantClear VariantChangeType VariantInit

SmartClient/Live555.dll

IMPHASH 0e4431f374fc61abfaa5069d71ad92bf
SHA256 f33a3147cee8529f2f5c7e8aa0eb1d4500c22d0fa2937371f19c06e6ec09f2b3
MD5 e1c1b1c7339d2cc0b1eaae0cce2c1f98
SHA1 cd44de6d1383c30a1dc5da26845b50b72969cd6b
SHA512 5738eaf8dfec12bedb02681a998e1bf9d8b71fa05a0cf2bb76c35f4bb5379a51fb946b733a60479dcd1a75cb1c470b38d43309f88893f4efafaf09216f1dcec5
SSDEEP 3072:qXe7gz9b3qa7J1s2tvwEwq6wleay8SZ8fJvLFpLq34KJkuxI56kcoNn5:mzZls2tvhwq6pZZ8xG34KjkT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

98650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

connect send htons gethostbyname WSAStartup inet_addr WSACleanup ioctlsocket gethostname recvfrom ntohl htonl ntohs getsockname setsockopt sendto bind closesocket getsockopt select WSAGetLastError socket __WSAFDIsSet

kernel32

WideCharToMultiByte SetEnvironmentVariableA CompareStringW CompareStringA GetStringTypeW GetStringTypeA CreateFileA GetLocaleInfoA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCurrentProcessId GetTickCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapSize InitializeCriticalSectionAndSpinCount LoadLibraryA InterlockedIncrement InterlockedDecrement QueryPerformanceCounter Sleep QueryPerformanceFrequency EnterCriticalSection LeaveCriticalSection GetTimeZoneInformation GetSystemTimeAsFileTime GetLastError HeapFree SetFilePointer HeapAlloc GetModuleHandleW GetProcAddress ExitProcess TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA RaiseException SetStdHandle GetFileType WriteFile GetModuleHandleA GetConsoleCP GetConsoleMode SetHandleCount GetStdHandle GetStartupInfoA DeleteCriticalSection GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError MultiByteToWideChar ReadFile HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc FlushFileBuffers CloseHandle RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW

SmartClient/LocalSetting.ini

SHA256 65008602899051aaefad3c98b7c2d22391362834d8f2a9edb053f4a043df6315
MD5 5f962cbdb58ae7c35e05e3fb435ec862
SHA1 d6d682c97979fa8eaa93b524bca9de0e7d2d18a5
SHA512 39dc6885f451f46877d9f86cc700f7c5c58c496bd704f5fb61589ef7c514e6b02a697371c0e10e878c2e111b789089b29aa1e4d8693038597772be913e3bfa04
MD5 SHA1 SHA512

SmartClient/MakeBarCode.cfg

SHA256 d9318329415806ce0d6e6d156b4ae6c69444932fd72b64508bb7d00477dfb069
MD5 64e035d7d70183b8fae6ba5073cccd67
SHA1 670a57abb660a9f507c7d9392c41cd8055748cdf
SHA512 92aea95e6f753c25687c916176aa6ae43cce737b410aff6a28fe4dae8689864d82b4d9becab145824150415809887f31932d77c284c5a4c70ef773adfc379a5e
MD5 SHA1 SHA512

SmartClient/MicrosoftAt.ttf

SHA256 769738126184d688ddc078df2304ddaf7a25c840c0937170cab790482f40750f
MD5 f80465e9d8cea2b48da01f5aba236b59
SHA1 5871c08b5398926ee36f4c917256d2c9b6fe68ec
SHA512 3acc39cc61df400529352f0eb8225fb717d5c29da5b124a6e9efa7b4e63d71a43a103d2c1db6e9280b8039506faebced42604bf30c5b48d1536a5f3d4f003211
SSDEEP 196608:Bzyip6QwZbvJ5Cch+Vjg1WNSzAyul2b0a92:BzPpBwZblyc4Svow0w2
MD5 SHA1 SHA512 SSDEEP

SmartClient/OnvifPC.dll

IMPHASH 0d8268e8c16bce3d30318c5ada4ee740
SHA256 30c8a65d1177552319966f0925915a75287b2c6b8fb3fd63dbbfb77be7009849
MD5 98afdc6fafe63ea3a276e50a861d9e16
SHA1 ee2051abe84be49d426e1125b1adae15a6edaf6c
SHA512 1c0fc44fc5b0f0aaf8608ad26a1daf23e8e09efca1f51e6e0b8c683e2f8288710f2854a6c479bc36ba0f91e29ff7596872f4cd21ac0570b8edb81ee6e7119439
SSDEEP 24576:uQDhSQGVt0VloqrODK/+ynx3jtj1QFmMZWKmghYgy5:R+SQJWKmk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

1586700

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\02_LocalSVN\pc_ti\NvrBranch_12-16\onvif\OnvifPC\bin\OnvifPC.pdb

kernel32

Sleep GetLastError SetLastError FormatMessageA CompareStringW CompareStringA HeapSize CreateFileA FlushFileBuffers InitializeCriticalSectionAndSpinCount LoadLibraryA GetLocaleInfoA GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStringTypeW GetStringTypeA GetSystemTimeAsFileTime ExitThread CloseHandle ResumeThread CreateThread HeapFree EnterCriticalSection LeaveCriticalSection HeapAlloc WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode MultiByteToWideChar ReadFile InterlockedDecrement GetCPInfo GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InterlockedIncrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree GetTimeZoneInformation ExitProcess HeapCreate HeapDestroy VirtualFree DeleteCriticalSection VirtualAlloc HeapReAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleHandleA GetModuleFileNameA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetFilePointer SetStdHandle RtlUnwind LCMapStringA LCMapStringW SetEnvironmentVariableA

ws2_32

shutdown accept connect getsockopt inet_addr gethostbyname recvfrom sendto send closesocket ioctlsocket ntohl select __WSAFDIsSet recv WSAStartup socket WSAGetLastError setsockopt htonl htons bind listen

SmartClient/RDTApis.dll

IMPHASH dbe18bcf03769c483183f85ed6a1a8ca
SHA256 c052bba5b7e18ae734a6baeaa641b8562bf70b4b1de13c2b72b0f527745c009f
MD5 0b2ef2ad94ba6361b61cb2c6bbdc0485
SHA1 9448242d3b56dadc75f05742616a59adc034f879
SHA512 83df4cafc1b39ff2deee00410aa9316d47f6ef90a991ed8e5c55cfec8ce1e1e97f0b8b591fbb7e8dc052ad0ef539b7b5129c9c561d778d5217f56675010a4912
SSDEEP 1536:cLFSr/XZ0FWIA4yGMgbPp1PsTnmQqKPyIrXtSa:cLFSvIAjGMupVimQTtl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

19762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateMutexA ReleaseMutex WaitForSingleObject GetSystemTimeAsFileTime CloseHandle CreateThread Sleep WideCharToMultiByte GetTimeZoneInformation GetLastError HeapFree HeapAlloc GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InterlockedDecrement GetCPInfo HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA RtlUnwind TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId SetFilePointer GetConsoleCP GetConsoleMode GetACP GetOEMCP InitializeCriticalSection LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW LoadLibraryA SetStdHandle FlushFileBuffers CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoA CompareStringA CompareStringW SetEnvironmentVariableA HeapSize SetEndOfFile ReadFile

iotcapis

IOTC_Session_Channel_ON RT IOTC_Session_Check IOTC_Session_Read IOTC_Session_Write IOTC_Session_Channel_OFF

SmartClient/RemoteConfig.dll

IMPHASH 63f61fc28ccc4930f9e75a7b08e5c433
SHA256 cf62ba24f5b5b4d9ab2a425bdc8b5dc1e01352e5e62e41ce9facfc698c950b24
MD5 0ec9a5548a56e70ee62ac7f1e4baef3e
SHA1 cc72c7f57b59d7d65398f724645df62be40b6265
SHA512 2c7e0317e6c54b1763db3c8edf37e1034461a085ccfc00117cb897bd3df2d4f4b3a6945f7cfe24525f0fbd3348fa65fb41889d729d6582911cb9b5b3bd46432c
SSDEEP 24576:Tpz1k+Y6VHSX5W/xPlRUQFReZMs6+RLNOM8L5m4FNDhtPwzOlfK:YIHSJW/xtaQ7K/vL+w4FND/PEOlfK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

552715

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\release version\NvrBranch_V2.0-20150617\RemoteCofig DevMiddleware\Bin\RemoteConfig.pdb

language

?DLL_GetResFromKey@@YA?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@ABV12@@Z

kernel32

TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA RtlUnwind RaiseException HeapReAlloc Sleep ExitProcess HeapSize VirtualFree HeapCreate HeapDestroy GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA GetSystemTimeAsFileTime GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA CreateFileA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA HeapFree VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect HeapAlloc GetCurrentProcess SetEndOfFile FlushFileBuffers SetFilePointer WriteFile ReadFile WritePrivateProfileStringW InterlockedIncrement GlobalFlags SetErrorMode TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc CloseHandle GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW CompareStringA lstrcmpA GetCurrentProcessId GetModuleHandleA InterlockedDecrement FormatMessageW LocalFree MulDiv GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom GetVersionExW CompareStringW LoadLibraryA SetLastError lstrcmpW GetVersionExA GetLastError IsDBCSLeadByte GetTimeZoneInformation GetLocalTime GetProcAddress LoadLibraryW FreeLibrary WideCharToMultiByte lstrlenA GetFileAttributesW GetModuleFileNameW GetModuleHandleW GlobalFree GlobalUnlock GlobalLock GlobalAlloc FreeResource lstrlenW InterlockedExchange EnterCriticalSection LeaveCriticalSection FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar FreeEnvironmentStringsA

user32

DestroyMenu UnregisterClassW GetMessageW TranslateMessage ValidateRect DrawFocusRect GetDesktopWindow GetActiveWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog GetWindowThreadProcessId SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuW EnableMenuItem CheckMenuItem ScrollWindowEx IsWindowEnabled ShowWindow MoveWindow SetWindowTextW IsDialogMessageW SetDlgItemTextW EndPaint BeginPaint ClientToScreen GetMenuState RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageW GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints SetMenu SetScrollRange SetScrollPos SetForegroundWindow IsWindowVisible GetSubMenu GetMenuItemID GetMenuItemCount MessageBoxW CreateWindowExW RegisterClassW AdjustWindowRectEx GetScrollInfo SetScrollInfo GetDlgCtrlID CallWindowProcW GetMenu SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetSystemMetrics GetWindow GrayStringW DrawTextExW TabbedTextOutW DrawTextW IsWindow ReleaseDC GetDC IsRectEmpty WindowFromPoint RegisterClassExW LoadIconW GetClassInfoExW PostQuitMessage SetClassLongW GetFocus DrawEdge FillRect LoadBitmapW ScreenToClient LoadImageW ShowScrollBar UpdateWindow IntersectRect SetWindowLongW GetWindowLongW SetTimer KillTimer OffsetRect ReleaseCapture SetCapture GetCapture SetCursor InflateRect CopyRect GetSysColor InvalidateRect GetWindowDC SendMessageW EnableWindow PostMessageW GetClientRect GetKeyState PtInRect GetCursorPos GetParent GetWindowRect RedrawWindow GetSysColorBrush LoadCursorW DefWindowProcW GetClassInfoW

gdi32

SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx SelectClipRgn CreateFontIndirectW GetTextMetricsW CreateBitmap RestoreDC SaveDC IntersectClipRect ExcludeClipRect SetMapMode DeleteDC DeleteObject GetDeviceCaps SetBkColor SetTextColor GetClipBox Escape ExtTextOutW RectVisible PtVisible CreateRectRgn GetBkColor DPtoLP GetViewportExtEx GetWindowExtEx GetMapMode LPtoDP TextOutW GetStockObject Rectangle SetBkMode Ellipse RoundRect CreatePen CreateSolidBrush CreateFontW BitBlt CreateCompatibleBitmap GetTextExtentPoint32W GetDIBColorTable StretchBlt CreateDIBSection GetObjectW CreateCompatibleDC SetDIBColorTable SelectObject

msimg32

TransparentBlt AlphaBlend

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegOpenKeyW RegSetValueExW RegCreateKeyExW RegQueryValueW RegCloseKey RegEnumKeyW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW

comctl32

_TrackMouseEvent

shlwapi

PathFindExtensionW PathFindFileNameW PathRemoveFileSpecW

ole32

CoInitializeEx CoCreateInstance CreateStreamOnHGlobal CoTaskMemFree CoUninitialize

oleaut32

VariantTimeToSystemTime SystemTimeToVariantTime SysAllocStringLen VariantClear VariantChangeType VariantInit

gdiplus

GdipDeleteGraphics GdipCreateBitmapFromStream GdiplusStartup GdipCreateBitmapFromFile GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImagePaletteSize GdipGetImagePalette GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipCloneImage GdipAlloc GdipFree GdipDisposeImage GdipGetImageGraphicsContext GdiplusShutdown GdipDrawImageI

SmartClient/SmartClient.exe

IMPHASH 7c849865f498738d44d3dfebe9daa93e
SHA256 2f45600dcbcc925605c9283a94f24426618e9ae4fdd2abed9c5ce8179b390576
MD5 c8f80e12cd7a80fe87f74d6dc125d89e
SHA1 3d53877802caf8a0860afc80afdf9122833c17c9
SHA512 362e9e6c4def2a3468a82405a1fec8553c1051ea58584d17001633506e4510ddff0fe0465d2dd0adec6735520437c2c92e0eaa9b6d7a20d5070753031bde24cb
SSDEEP 49152:k0FMGlQd1H0tAUOWmub1ab4FND/PoW3rtngZL21wyCnxws9BO7Q+UE:kgQ1HcJqubYb4FND3JngIvS+7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

394795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\release version\NvrBranch_V2.0-20150617\SmartClient\bin\SmartClient.pdb

gdiplus

GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDrawImageI GdipFree GdipGetImageGraphicsContext GdipGetImagePaletteSize GdipGetImagePalette GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipAlloc GdipDisposeImage GdipBitmapUnlockBits GdiplusStartup GdiplusShutdown GdipDeleteGraphics

sqlite3

sqlite3_busy_timeout sqlite3_mprintf sqlite3_free sqlite3_vmprintf sqlite3_errmsg sqlite3_get_table sqlite3_free_table sqlite3_changes sqlite3_open sqlite3_close sqlite3_exec

wpcap

pcap_open pcap_compile pcap_setfilter pcap_findalldevs_ex pcap_freealldevs pcap_next_ex pcap_sendpacket

devmiddleware

?GetNetThroughOut@@YAHAAK@Z ?Cleanup@CRLGlobal@@SAHXZ ?StopListen@CRLGlobal@@SAHXZ ?RegisterSeekRespondCallBack@CRLGlobal@@SAHXZ ?RegisterHandleSeekRespond@CRLGlobal@@SAXPAX@Z ?RegisterPlayBackRespondCallBack@CRLGlobal@@SAHXZ ?RegisterHandlePlayBackRespond@CRLGlobal@@SAXPAX@Z ?RegisterRecFileDateRespondCallBack@CRLGlobal@@SAHXZ ?RegisterHandleRecFileDateRespond@CRLGlobal@@SAXPAX@Z ?RegisterGetFileByNameRespondCallBack@CRLGlobal@@SAHXZ ?RegisterHandleGetFileByNameRespond@CRLGlobal@@SAXPAX@Z ?RegisterGetFileByTimeRespondCallBack@CRLGlobal@@SAHXZ ?RegisterHandleGetFileByTimeRespond@CRLGlobal@@SAXPAX@Z ?RegisterFileFindRespondCallBack@CRLGlobal@@SAHXZ ?RegisterHandleFileFindRespond@CRLGlobal@@SAXPAX@Z ?RegisterSetRespondCallBack@CRLGlobal@@SAHXZ ?RegisterHandleSetRespond@CRLGlobal@@SAXPAX@Z ?RegisterGetRespondCallBack@CRLGlobal@@SAHXZ ?RegisterHandleGetRespond@CRLGlobal@@SAXPAX@Z ?RegisterPreviewRespondCallBack@CRLGlobal@@SAHXZ ?RegisterHandlePreviewRespond@CRLGlobal@@SAXPAX@Z ?RegisterLoginRespondCallBack@CRLGlobal@@SAHXZ ?RegisterHandleLoginRespond@CRLGlobal@@SAXPAX@Z ?RegisterConnectChangeCallBack@CRLGlobal@@SAHXZ ?RegisterHandleConnectChange@CRLGlobal@@SAXPAX@Z ?RegisterExceptionCallBack@CRLGlobal@@SAHXZ ?RegisterHandleException@CRLGlobal@@SAXPAX@Z ?RegisterAlarmCallback@CRLGlobal@@SAXPAX0@Z ?RegisterAllocator@CRLGlobal@@SAXPAX@Z ?RegisterHandleMessage@CRLGlobal@@SAXPAX@Z ?Startup@CRLGlobal@@SAHHH@Z ?CreateDevOnvif@CDevOnvifFactory@@SAPAVIDevOnvif@@H@Z ?Check_RecFile_Is_Del@CRLGlobal@@SAHPAD@Z ?GetChannelState@CRLGlobal@@SAHJAAUMsgChannelInfo@@@Z ?CreateRemotePlayback@CDevRemotePlaybackFactory@@SAPAVCDevRemotePlayback@@PAVIDevUserLogin@@PAUHWND__@@@Z ?CreateDownloader@CDevRemoteFileDownloaderFactory@@SAPAVCDevRemoteFileDownloader@@PAVIDevUserLogin@@@Z ?DeleteFinder@CDevRemoteFileFinderFactory@@SAXPAVCDevRemoteFileFinder@@@Z ?CreateFinder@CDevRemoteFileFinderFactory@@SAPAVCDevRemoteFileFinder@@PAVIDevUserLogin@@PAUtagSearchFileCondition@@@Z ?DeleteRemotePlayback@CDevRemotePlaybackFactory@@SAXPAVCDevRemotePlayback@@@Z ?SetPartingSize@CRLGlobal@@SAHK@Z ?DeleteDownloader@CDevRemoteFileDownloaderFactory@@SAXPAVCDevRemoteFileDownloader@@@Z ?CreateDownloader@CDevRemoteFileDownloaderFactory@@SAPAVCDevRemoteFileDownloader@@PAVIDevUserLogin@@PAD1@Z ?UpdateChannelEnc@CRLGlobal@@SAHJ@Z ?DeleteDevConfig@CDevConfigFactory@@SAXPAVIDevConfig@@PAVIDevUserLogin@@@Z ?CreateDevConfig@CDevConfigFactory@@SAPAVIDevConfig@@PAVIDevUserLogin@@@Z ?CreateDevPreview@CDevPreviewFactory@@SAPAVIDevPreview@@PAVIDevUserLogin@@J@Z ?CreateDevCtlPtz@CDevCtlPtzFactory@@SAPAVIDevCtlPtz@@PAVIDevUserLogin@@JPAVIDevPreview@@@Z ?DeleteDevCtlPtz@CDevCtlPtzFactory@@SAXPAVIDevCtlPtz@@PAVIDevUserLogin@@@Z ?DeleteDevPreview@CDevPreviewFactory@@SAXPAVIDevPreview@@PAVIDevUserLogin@@@Z ?CreateDevUserLogin@CDevUserLoginFactory@@SAPAVIDevUserLogin@@PAVCDevInfo@@@Z ?DeleteDevUserLogin@CDevUserLoginFactory@@SAXPAVIDevUserLogin@@@Z ?CreateDevAlarm@CDevAlarmFactory@@SAPAVIDevAlarm@@PAVIDevUserLogin@@@Z ?DeleteDevAlarm@CDevAlarmFactory@@SAXPAVIDevAlarm@@PAVIDevUserLogin@@@Z

language

?DLL_GetCurrentShow@@YA?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ ?DLL_GetValueMapLans@@YAPAV?$map@HV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@U?$less@H@std@@V?$allocator@U?$pair@$$CBHV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@@4@@std@@ABV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z ?DLL_LoadLangView@@YAXABV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V12@@Z ?DLL_GetResFromKey@@YA?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@ABV12@@Z

remoteconfig

SetCustomFont SetUserID ShowRemoteConfig SetLanguageID SetVideoStandard SetPreviewHwnd SetUserName SetDvrTypeInfo SetWifiUser SetChannelNum SetDvrMachineType SetDvrPort SetDvrIP SetNotransFrame SetETAbaility SetDevConfig GetRemoteCfgHwnd SetDvrType SetSDCard SetPTZ SetStartChannelNum SetAllPreview SetHDChannels SetAlarmInportNum SetAlarmOutportNum SetFDAbaility SetVTAbaility SetIDAbaility

kernel32

CreateEventW ResumeThread GetModuleFileNameW WideCharToMultiByte lstrlenA WaitForSingleObject TerminateThread InterlockedIncrement GetFileAttributesW GetModuleHandleW GetProcAddress GetLastError LoadLibraryW SetLastError GetExitCodeThread GetTickCount Sleep GetDiskFreeSpaceExW DeleteFileW CreateDirectoryW FindFirstFileW FindNextFileW FindClose CreateThread GetLocalTime CreateFileW ReleaseMutex WritePrivateProfileStringW GetPrivateProfileStringW GetSystemDefaultLangID InitializeCriticalSectionAndSpinCount MulDiv OpenProcess GetCurrentProcessId CreateMutexW TerminateProcess GetCurrentThreadId GetCurrentDirectoryW GlobalMemoryStatus GetSystemTime GetSystemInfo GetLogicalDriveStringsW GetDriveTypeW FreeLibrary LocalFree FormatMessageW GetVersionExA lstrcmpW LoadLibraryA CompareStringW GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW GetModuleHandleA lstrcmpA SetThreadPriority SuspendThread FileTimeToSystemTime FileTimeToLocalFileTime GetThreadLocale ReadFile WriteFile SetFilePointer FlushFileBuffers LockFile UnlockFile SetEndOfFile GetFileSize DuplicateHandle GetCurrentProcess GetVolumeInformationW GetFullPathNameW CompareStringA EnumResourceLanguagesW ConvertDefaultLocale GetCurrentThread LocalAlloc TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree GlobalFlags GetFileSizeEx GetFileTime SetErrorMode GetStartupInfoW HeapFree HeapAlloc VirtualProtect VirtualAlloc VirtualQuery GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapReAlloc ExitThread RtlUnwind RaiseException ExitProcess HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTimeZoneInformation GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetCurrentDirectoryA GetDriveTypeA GetProcessHeap SetEnvironmentVariableA SetEvent CloseHandle GetVersionExW InterlockedDecrement GetLocaleInfoW lstrcpynW DeleteCriticalSection InitializeCriticalSection GlobalFree GlobalUnlock GlobalLock GlobalAlloc FreeResource LockResource MultiByteToWideChar SizeofResource LoadResource FindResourceW lstrlenW InterlockedExchange LeaveCriticalSection EnterCriticalSection ResetEvent

user32

RegisterWindowMessageW BeginPaint EndPaint SetDlgItemTextW IsDialogMessageW SetWindowTextW MoveWindow IsWindowEnabled GetWindowThreadProcessId GetMenuCheckMarkDimensions SetMenuItemBitmaps WaitMessage ValidateRect GetActiveWindow TranslateMessage GetMessageW EndDialog GetNextDlgTabItem CreateDialogIndirectParamW DestroyMenu CharUpperW CharNextW MapDialogRect SetWindowContextHelpId UnregisterClassW CopyAcceleratorTableW RemovePropW InvalidateRgn GetNextDlgGroupItem MessageBeep RegisterClipboardFormatW PostThreadMessageW DrawTextW TabbedTextOutW SetCapture LoadBitmapW ReleaseCapture InvalidateRect DrawFocusRect SendMessageW EnableWindow PostMessageW GetKeyState PtInRect GetCursorPos FillRect GetClientRect GetWindowDC GetParent GetWindowRect RedrawWindow GetSysColorBrush LoadCursorW DefWindowProcW SendDlgItemMessageW GetFocus SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow SetActiveWindow DispatchMessageW GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos PeekMessageW MapWindowPoints TrackPopupMenu SetMenu CreateWindowExW RegisterClassW AdjustWindowRectEx SetWindowPlacement GetDlgCtrlID GetMenu SendDlgItemMessageA WinHelpW IsChild GetClassLongW GetClassNameW SetPropW SetWindowPos SystemParametersInfoA GetWindowPlacement GetWindow GetMenuState GetMenuItemID GetMenuItemCount UnhookWindowsHookEx SystemParametersInfoW IntersectRect SetWindowsHookExW PostQuitMessage DrawIcon AppendMenuW GetSystemMenu CallNextHookEx SetClassLongW EnableMenuItem RegisterClassExW GetClassInfoExW EqualRect MessageBoxW GetLastActivePopup ShowWindow FindWindowW UpdateWindow DestroyIcon LoadIconW DrawEdge FindWindowExW CheckMenuItem SetForegroundWindow ClientToScreen ScreenToClient GetDesktopWindow WindowFromPoint GetClassInfoW GetPropW GetSubMenu ModifyMenuW LoadMenuW OffsetRect DrawFrameControl SetWindowLongW CallWindowProcW GetWindowLongW CallWindowProcA SetTimer KillTimer GetCapture SetCursor CopyRect GetSysColor ReleaseDC GetDC SetParent GetSystemMetrics InflateRect IsIconic IsWindowVisible IsWindow SetRect GrayStringW IsRectEmpty DrawTextExW

gdi32

SetMapMode ExcludeClipRect IntersectClipRect LineTo MoveToEx SelectClipRgn SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn CreateRectRgnIndirect GetRgnBox RestoreDC SaveDC GetClipBox CreateRectRgn SetPixel CreateFontIndirectW Polygon GetDeviceCaps SetBkMode GetStockObject Rectangle CreatePatternBrush SetTextColor SetBkColor GetTextMetricsW GetTextColor Ellipse GetTextExtentPoint32W RoundRect CreatePen CreateSolidBrush CreateFontW Escape ExtTextOutW CreateCompatibleDC CreateDIBSection DeleteObject StretchBlt GetDIBColorTable SelectObject SetDIBColorTable GetObjectW CreateCompatibleBitmap BitBlt LPtoDP GetMapMode GetWindowExtEx GetViewportExtEx DPtoLP GetBkColor GetCurrentObject CreateBitmap GetPixel PtVisible RectVisible TextOutW DeleteDC

msimg32

AlphaBlend TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegCreateKeyExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyW RegOpenKeyExW RegSetValueExW RegQueryValueExW RegCloseKey

shell32

ShellExecuteW SHGetSpecialFolderLocation Shell_NotifyIconW SHBrowseForFolderW SHGetPathFromIDListW

comctl32

_TrackMouseEvent InitCommonControlsEx

shlwapi

PathIsRootW PathFindFileNameW PathIsUNCW PathStripToRootW PathFindExtensionW

oledlg

OleUIBusyW

ole32

CoRevokeClassObject CoFreeUnusedLibraries CreateStreamOnHGlobal CoCreateGuid CoTaskMemFree CoTaskMemAlloc CLSIDFromString CLSIDFromProgID CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard OleInitialize OleUninitialize

oleaut32

SysAllocString VarDateFromStr SysFreeString SystemTimeToVariantTime SysAllocStringByteLen VariantClear VariantInit VariantCopy SysAllocStringLen VariantChangeType VariantTimeToSystemTime SysStringLen SafeArrayDestroy OleCreateFontIndirect

ws2_32

WSAAsyncSelect htons socket bind WSACleanup recvfrom setsockopt gethostbyname ntohs htonl accept select WSASetLastError connect WSAStartup send recv inet_addr closesocket sendto WSAGetLastError WSASocketW gethostname inet_ntoa

psapi

EnumProcessModules EnumProcesses GetModuleFileNameExW

netapi32

Netbios

SmartClient/TempQr.bmp

SHA256 8a676931ac2e31c8be94a54d8a1b160566507e48f85824881ec9bccfe29452b8
MD5 db4786521f36232d91366bc187b43141
SHA1 3a236e6c46011d8b9e2c4e33e0e317390c5590f8
SHA512 5eb32e0497e85bdc2fc0984e49a941057e9a276317153cdef2b19a3b9d9f1621ce362cf31321919ad66c0297cd2360352bd4d6547d5b80f4f890d4b1202929fa
MD5 SHA1 SHA512

SmartClient/UserInfo.db

SHA256 adb16093c595bfff7344851f6dd1352ff862892231bd268541fac34ff951395c
MD5 1a6c5525919cab95180af7711dd885aa
SHA1 6af50a64d28f7383fbe8b65fe94a315801f8ef34
SHA512 6957d04427d81e95dcf3e5955c7ff20a3f902704210a3f0742e75da7be27b1d986d004a212f03f4ca5c42953a880994e3fbc1b6ba7fb77f209f3b5217128a28f
SSDEEP 96:QIIzGbQNGvGfoGawINGfWGfRGFGrHW2IIzGbQFnooTz:oRHB2doTz
MD5 SHA1 SHA512 SSDEEP

SmartClient/WinPcap.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 fc4623b113a1f603c0d9ad5f83130bd6de1c62b973be9892305132389c8588de
MD5 a11a2f0cfe6d0b4c50945989db6360cd
SHA1 e2516fcd1573e70334c8f50bee5241cdfdf48a00
SHA512 2652d84eb91ca7957b4fb3ff77313e5dae978960492669242df4f246296f1bedaa48c0d33ffb286b2859a1b86ef5460060b551edca597b4ec60ee08676877c70
SSDEEP 24576:UBOldyR6ORWsaM2QROxa6jsqUENfJjNK/CG6niqiL:2KzqWsayROxa6QDENuaG+ifL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

be:72:38:f0:32:8c:16:3b:2e:d9:97:ba:f7:42:66:0c:3b:6b:63:df

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Chains

Mar 1, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 26, 2012 - Oct 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/bootOptions.ini

SHA256 f6f2e247226ab06e9b56ae2d10ccd02d9298abccac85c56abfa19e5587446d54
MD5 9f64b7e590b32b5ba414f4301fb8b3d5
SHA1 8d44c84b3a78b4fd8b2dcf8d3d49400e47b41840
SHA512 513251b52da94d56e505ed8b8bac07b6f5e325561c6c6865c424bd2aecb437e69d9a8c91a1595deb2293f1df166b9712e8807a57506f80889bc5c2e1afb6d5f7
MD5 SHA1 SHA512

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

$PLUGINSDIR/modern-header.bmp

SHA256 c0e284fde834fe8a6f90504dba7abff25b1e7dd4611483341203fd3efc5de8a6
MD5 d8f59a707b2a5000c7903595eddc3d48
SHA1 e86239fe1dc3cfdbec6006817160eb5f1fc92bca
SHA512 91e28a685733620832d3851d7f3eee36495f2728610bd6c66f305cdda039f75ab8499d0e51e64afa018c221a728889503db2fc7c84cf9599a61b68951686b048
SSDEEP 192:UdCd/28k2hZrlQ+jP3/PGs/ZkTnSQpuWE:UD8jLlQ+jP3///ZUSJ5
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/Packet.dll

IMPHASH 19fa7010cacd16ef346ea8bbc2e8b999
SHA256 cd9f4fb077c25013226e0883f9ae02e9ced9b71f07637081e55ae70fd0788f29
MD5 2ce150705bbeb30e6c8059cc530043aa
SHA1 3d8615f9d8f8f7a5d78b3c06bf746948b9ef6ba5
SHA512 9f7573ca679ef0cc0e1d815f605a399e87f7a046e3e51970d2c7597329b19e118cc2da7240ee854e13e31582f12bab8be506d1612ac81d5b453ef366d4674dcf
SSDEEP 1536:zbDKMXRC2wKDDuDirGfqs97WcETlsxtl2o+V:PDKMtfuysAcETlsxtco8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

86:ca:55:b7:f9:4a:c7:29:69:93:49:93:a7:2a:43:b4:e9:30:f5:a5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Chains

Mar 1, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 26, 2012 - Oct 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

26704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\releases\winpcap_4_1_3\winpcap\packetNtx\Dll\Project\Release\x86\Packet.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

npptools

SetBoolInBlob DestroyBlob CreateBlob CreateNPPInterface GetNPPBlobTable

ws2_32

inet_addr

iphlpapi

GetAdaptersInfo

kernel32

GlobalFree GlobalAlloc GlobalHandle ReleaseMutex GlobalLock WaitForSingleObject GlobalUnlock QueryPerformanceCounter CreateEventW SetEvent DeviceIoControl GetModuleHandleW WriteFile QueryPerformanceFrequency GetSystemDirectoryW WideCharToMultiByte CloseHandle GetVersion GetStringTypeW ReadFile GetFullPathNameW GetModuleFileNameW MultiByteToWideChar CreateFileA GetLastError SetLastError CreateMutexW GetProcAddress InitializeCriticalSection Sleep GetVersionExW LeaveCriticalSection EnterCriticalSection ResetEvent DeleteCriticalSection OutputDebugStringA GetSystemTimeAsFileTime GetLocaleInfoA HeapSize FlushFileBuffers LoadLibraryW GetCurrentThreadId GetStringTypeA LCMapStringW LCMapStringA WriteConsoleW GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleA ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree GetTickCount GetCurrentProcessId SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA VirtualAlloc HeapReAlloc RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP

advapi32

QueryServiceStatus StartServiceW OpenServiceA RegOpenKeyExA CreateServiceA ControlService OpenSCManagerW RegEnumKeyW RegCloseKey RegOpenKeyExW RegQueryValueExW RegQueryValueExA CloseServiceHandle

ole32

CoUninitialize CoInitializeEx CoInitialize

$SYSDIR/pthreadVC.dll

IMPHASH 90ee61357770484e2d085958b94141a3
SHA256 99c61abf41c3aec38cab3ed6270adbca9a247bbf5f9aa9d29ecb0659a5527f48
MD5 f04a90f917ba10ae2dcbe859870f4dea
SHA1 6668ebe373ce58c33017697c477557653427e626
SHA512 aec29301b9ce311b27f1590b0e0c4121acdc183a30b570e087d77b7035684f02a6dfbdee950c37f3023b32e2ea5a075a5fbe6d18a2804da9490d4959733bb516
SSDEEP 384:hSvfC8Vv0Vy7ojuq7GQcdWTc4zU+GFronD/yD5rBEe0kiH32Jp9AhOW:wt+TGQcdWYdMG59EeJiH3YzW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

25783

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

pthreadCancelableTimedWait pthreadCancelableWait pthread_attr_destroy pthread_attr_getdetachstate pthread_attr_getinheritsched pthread_attr_getschedparam pthread_attr_getschedpolicy pthread_attr_getscope pthread_attr_getstackaddr pthread_attr_getstacksize pthread_attr_init pthread_attr_setdetachstate pthread_attr_setinheritsched pthread_attr_setschedparam pthread_attr_setschedpolicy pthread_attr_setscope pthread_attr_setstackaddr pthread_attr_setstacksize pthread_barrier_destroy pthread_barrier_init pthread_barrier_wait pthread_barrierattr_destroy pthread_barrierattr_getpshared pthread_barrierattr_init pthread_barrierattr_setpshared pthread_cancel pthread_cond_broadcast pthread_cond_destroy pthread_cond_init pthread_cond_signal pthread_cond_timedwait pthread_cond_wait pthread_condattr_destroy pthread_condattr_getpshared pthread_condattr_init pthread_condattr_setpshared pthread_create pthread_delay_np pthread_detach pthread_equal pthread_exit pthread_getconcurrency pthread_getschedparam pthread_getspecific pthread_getw32threadhandle_np pthread_join pthread_key_create pthread_key_delete pthread_kill pthread_mutex_destroy pthread_mutex_init pthread_mutex_lock pthread_mutex_timedlock pthread_mutex_trylock pthread_mutex_unlock pthread_mutexattr_destroy pthread_mutexattr_getkind_np pthread_mutexattr_getpshared pthread_mutexattr_gettype pthread_mutexattr_init pthread_mutexattr_setkind_np pthread_mutexattr_setpshared pthread_mutexattr_settype pthread_num_processors_np pthread_once pthread_rwlock_destroy pthread_rwlock_init pthread_rwlock_rdlock pthread_rwlock_timedrdlock pthread_rwlock_timedwrlock pthread_rwlock_tryrdlock pthread_rwlock_trywrlock pthread_rwlock_unlock pthread_rwlock_wrlock pthread_rwlockattr_destroy pthread_rwlockattr_getpshared pthread_rwlockattr_init pthread_rwlockattr_setpshared pthread_self pthread_setcancelstate pthread_setcanceltype pthread_setconcurrency pthread_setschedparam pthread_setspecific pthread_spin_destroy pthread_spin_init pthread_spin_lock pthread_spin_trylock pthread_spin_unlock pthread_testcancel pthread_timechange_handler_np pthread_win32_process_attach_np pthread_win32_process_detach_np pthread_win32_thread_attach_np pthread_win32_thread_detach_np ptw32_get_exception_services_code ptw32_pop_cleanup ptw32_push_cleanup sched_get_priority_max sched_get_priority_min sched_getscheduler sched_setscheduler sched_yield sem_close sem_destroy sem_getvalue sem_init sem_open sem_post sem_post_multiple sem_timedwait sem_trywait sem_unlink sem_wait

$SYSDIR/wpcap.dll

IMPHASH 10dce091d63eed72dc0010ebc8838f6a
SHA256 b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
MD5 4633b298d57014627831ccac89a2c50b
SHA1 e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA512 29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
SSDEEP 6144:E4yIm5rC9WNWwKcNBSCiLvK8+jKgZBwIbg2:jyIm59WwpqCuEKIwv2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

cf:62:51:f0:27:45:ec:8f:43:5a:c8:f8:39:3a:ab:b8:9f:42:52:b7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Chains

Mar 1, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 26, 2012 - Oct 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

124026

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\releases\winpcap_4_1_3\winpcap\wpcap\PRJ\Release\x86\wpcap.pdb

ws2_32

WSACleanup ntohl gethostbyname htons gethostbyaddr WSAGetLastError htonl getservbyname inet_addr getservbyport inet_ntoa WSASetLastError getprotobyname accept closesocket getpeername getsockopt setsockopt getsockname select WSAStartup shutdown connect listen send socket bind ntohs recv

packet

PacketGetNetInfoEx PacketGetAdapterNames PacketSetMinToCopy PacketSetLoopbackBehavior PacketSetHwFilter PacketGetStats PacketSendPacket PacketSetReadTimeout PacketReceivePacket PacketSetMode PacketOpenAdapter PacketSetBpf PacketAllocatePacket PacketInitPacket PacketCloseAdapter PacketFreePacket PacketGetNetType PacketSetBuff PacketGetVersion PacketSetDumpName PacketSendPackets PacketIsDumpEnded PacketGetReadEvent PacketSetDumpLimits PacketGetAirPcapHandle PacketGetStatsEx

kernel32

SetUnhandledExceptionFilter SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA CreateFileA GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA ReadFile MultiByteToWideChar FlushFileBuffers GetConsoleMode GetConsoleCP WideCharToMultiByte HeapSize SetFilePointer CloseHandle VirtualAlloc VirtualFree HeapCreate HeapDestroy TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP InterlockedDecrement InterlockedIncrement GetCPInfo GetModuleFileNameA WriteFile DeleteCriticalSection GetLastError GetSystemDirectoryA FreeLibrary GetProcAddress EnterCriticalSection LoadLibraryA LeaveCriticalSection GetVersion FindNextFileA FormatMessageA FindFirstFileA FindClose InterlockedExchange SetLastError InterlockedCompareExchange Sleep InitializeCriticalSection UnhandledExceptionFilter HeapFree HeapAlloc RtlUnwind SetStdHandle GetFileType HeapReAlloc GetModuleHandleA ExitProcess GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap TerminateProcess GetCurrentProcess IsDebuggerPresent SetHandleCount GetStdHandle GetStartupInfoA

bpf_dump bpf_filter bpf_image bpf_validate endservent eproto_db getservent install_bpf_program pcap_activate pcap_breakloop pcap_close pcap_compile pcap_compile_nopcap pcap_create pcap_createsrcstr pcap_datalink pcap_datalink_name_to_val pcap_datalink_val_to_description pcap_datalink_val_to_name pcap_dispatch pcap_dump pcap_dump_close pcap_dump_file pcap_dump_flush pcap_dump_ftell pcap_dump_open pcap_file pcap_fileno pcap_findalldevs pcap_findalldevs_ex pcap_free_datalinks pcap_freealldevs pcap_freecode pcap_get_airpcap_handle pcap_geterr pcap_getevent pcap_getnonblock pcap_hopen_offline pcap_is_swapped pcap_lib_version pcap_list_datalinks pcap_live_dump pcap_live_dump_ended pcap_lookupdev pcap_lookupnet pcap_loop pcap_major_version pcap_minor_version pcap_next pcap_next_etherent pcap_next_ex pcap_offline_filter pcap_offline_read pcap_open pcap_open_dead pcap_open_live pcap_open_offline pcap_parsesrcstr pcap_perror pcap_read pcap_remoteact_accept pcap_remoteact_cleanup pcap_remoteact_close pcap_remoteact_list pcap_sendpacket pcap_sendqueue_alloc pcap_sendqueue_destroy pcap_sendqueue_queue pcap_sendqueue_transmit pcap_set_buffer_size pcap_set_datalink pcap_set_promisc pcap_set_snaplen pcap_set_timeout pcap_setbuff pcap_setdirection pcap_setfilter pcap_setmintocopy pcap_setmode pcap_setnonblock pcap_setsampling pcap_setuserbuffer pcap_snapshot pcap_stats pcap_stats_ex pcap_strerror wsockinit

WinPcapInstall.dll

IMPHASH ad1fff2efc5a1aa2884d5c780a51aa99
SHA256 d9f4cd9f0e1bc9a138fb4da6f83c92c3e86eb3de4f988d5943d75c9b1dc6bb9d
MD5 e78291558cb803dfd091ad8fb56feecc
SHA1 4bde2f87e903fe8d3bd80179c5584cec7a8cbdc4
SHA512 042b96bc2c0e6d8b6e2730426938eb7400fd833be8a108a4942f559fedefabc35fd5dcb7ea1898d377b4382c0a9af8eeeebd663a4c852c706e3bd168c1f1f62f
SSDEEP 1536:s7xjrG5m+619YG7L2xo8JfmL4iMtgLZtAeYjFH:s7s27yaL4kVtAeE9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

26:4b:32:ba:02:ff:cd:d6:6e:bf:35:a6:b9:a2:17:e5:f8:50:5e:5e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Chains

Mar 1, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 26, 2012 - Oct 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

10944

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\releases\winpcap_4_1_3\winpcap\install\WinPcap Installer Helper\Release\x86\WinPcapInstall.pdb

kernel32

LoadLibraryA GetProcAddress GetCurrentProcess LoadLibraryExA GetLastError Sleep FormatMessageA FreeLibrary GetModuleHandleA LocalFree GetCurrentThreadId GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent CloseHandle EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc SetStdHandle WriteFile GetConsoleCP GetConsoleMode FlushFileBuffers CreateFileA InitializeCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetFilePointer SetEndOfFile ReadFile LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

advapi32

OpenSCManagerA ChangeServiceConfigA StartServiceA CreateServiceA DeleteService CloseServiceHandle OpenServiceA ControlService

ole32

CoUninitialize CoInitializeEx CoCreateInstance

rpcapd.exe

IMPHASH 2b9e73ff502840fe6b381682c42d43cf
SHA256 52360f17c9c70c9cea3316560b40c4d89fd705ed7e6b6088c99fc54d4cc35eb5
MD5 83a6c2cafe236652d1559640594a0ea8
SHA1 c99aa678f387c00c4470fa3cd7b037d26720960d
SHA512 4f6981c4e8d64311087795e9639516409bf80ebca5c7f25af1fb436aaccf90f24617ecd3f95b63558981b12bc0e5eeacf120fea7be5e5fa05ecf3afa4f9f799b
SSDEEP 3072:mL7m5RTfrUna0m2BeIIgJ3155FulLfbt/6:C7m5RTEaseIH515qfA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

61:6f:43:de:5d:fa:a5:33:da:d2:7b:2b:a1:91:56:48:59:00:98:7b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Chains

Mar 1, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 26, 2012 - Oct 27, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

36901

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\releases\winpcap_4_1_3\winpcap\wpcap\libpcap\rpcapd\Release\x86\rpcapd.pdb

wpcap

install_bpf_program pcap_compile pcap_open_offline pcap_create pcap_open_live bpf_validate pcap_findalldevs pcap_strerror pcap_freealldevs pcap_geterr pcap_close pcap_setfilter pcap_stats pcap_next_ex

ws2_32

gethostbyaddr closesocket WSASetLastError getsockname htonl inet_addr getservbyname ntohl inet_ntoa ntohs accept htons connect WSAStartup shutdown WSACleanup recv bind socket send listen getservbyport select gethostbyname getpeername WSAGetLastError

pthreadvc

pthread_attr_init pthread_attr_setdetachstate pthread_exit pthread_cancel pthread_attr_destroy pthread_setcancelstate pthread_setcanceltype pthread_create

packet

PacketSetMinToCopy PacketSetLoopbackBehavior

kernel32

GetConsoleOutputCP WriteConsoleA HeapSize FlushFileBuffers SetStdHandle CreateFileA ReadFile GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA GetConsoleMode GetConsoleCP SetFilePointer GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA InitializeCriticalSection WriteConsoleW RtlUnwind GetStartupInfoA GetFileType SetHandleCount GetModuleFileNameA GetStdHandle WriteFile HeapReAlloc VirtualAlloc DeleteCriticalSection VirtualFree HeapCreate HeapDestroy GetCurrentThreadId SetLastError TlsFree GetSystemDirectoryA FormatMessageA GetLastError FreeLibrary GetProcAddress CloseHandle Sleep LoadLibraryA TlsSetValue TlsAlloc SetEndOfFile SetConsoleCtrlHandler HeapFree HeapAlloc GetModuleHandleA ExitProcess EnterCriticalSection LeaveCriticalSection GetCommandLineA GetVersionExA GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue

user32

MessageBoxA

advapi32

StartServiceCtrlDispatcherA SetServiceStatus LogonUserA ImpersonateLoggedOnUser RegisterServiceCtrlHandlerA

SmartClient/hi_VoiceEngine.dll

IMPHASH 9704c6413403804e79b3afc92396146e
SHA256 e01ae544a18a4e04c283c7f4b0480b57d2abd7b7056044dfb8d645baea1d3716
MD5 1dee5fc9473a23400dd008b8843a119c
SHA1 c5aa7cc4fb41f28751458c797abf403e848a806c
SHA512 9154cc8448997a23588b537f8d3ea30a40cc3e7bb9a9d63b7b0d3f2c42631e30dec4d62b764e9b458c3d33580f333513b9fd9a1514e1aaa0611916ef81f2d8c2
SSDEEP 768:i4u4Jh0hjFt5iK1DyKzAM4yJFcqWOZ5j9xYIpMcWsaHZetVt54M9QA:/uWh0Fa3fzO1CcWBit54iQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

19010

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SmartClient/playctrl.dll

IMPHASH 6b8f2672aa7868aa263c0ced31422ee6
SHA256 0a418d8d88b4dd45f030d6bc6cdb688d4df368ef2c16eda49ffe7ad9629bf66c
MD5 f86f180131c8ef4323b4b18c887b166a
SHA1 22355db359a96731537fe08e0d2b1cfbe1faa37b
SHA512 b286499501075ec924b3e1d95705c07376e490b878af71b2538a7401e92fc8ca7b7aaf72d0ad2e776bcaebb8669ff6d824726664207a7513dbcda70bc80306d5
SSDEEP 49152:I/xHk6SB/DyUn4HBUpIj48ivgokAgHUmQXVP:IUyUnMBiIjHokA8UmQXB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

458278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ddraw

DirectDrawCreateEx

user32

GetClientRect PostThreadMessageA PeekMessageA ReleaseDC DrawFocusRect SetRect ClientToScreen SendMessageA GetDC GetDesktopWindow

gdi32

DeleteObject CreateBitmap SelectObject SetStretchBltMode StretchBlt CreateCompatibleDC

winmm

waveInClose waveInOpen waveInPrepareHeader waveInAddBuffer waveInStart waveOutUnprepareHeader waveInReset mixerOpen waveInStop waveOutClose waveOutOpen waveOutPrepareHeader waveOutWrite timeKillEvent timeGetDevCaps timeBeginPeriod timeEndPeriod timeSetEvent timeGetTime waveInUnprepareHeader mixerGetLineControlsA mixerGetLineInfoA mixerGetControlDetailsA mixerSetControlDetails mixerClose waveOutReset

kernel32

CreateFileW GetFullPathNameA GetCurrentDirectoryA SetCurrentDirectoryA SetLastError FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime FindClose CreateDirectoryA InterlockedExchange IsDBCSLeadByteEx GetSystemTimeAsFileTime GetProcessAffinityMask GetConsoleScreenBufferInfo SetConsoleTextAttribute GetLocaleInfoW SetEnvironmentVariableA CompareStringW CompareStringA GetUserDefaultLCID EnumSystemLocalesA GetLocaleInfoA IsValidCodePage IsValidLocale SetEndOfFile LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection WaitForSingleObject CloseHandle CreateThread CreateEventA Sleep GetLocalTime GetTickCount QueryPerformanceCounter QueryPerformanceFrequency SetEvent LeaveCriticalSection EnterCriticalSection GetModuleFileNameA GetModuleHandleA ReleaseMutex OutputDebugStringA CreateMutexA TerminateThread ResetEvent LoadLibraryA FreeLibrary GetProcAddress WaitForMultipleObjects RtlUnwind GetTimeZoneInformation GetSystemTime GetLastError DeleteFileA GetFileAttributesA RaiseException GetCommandLineA GetVersion HeapAlloc HeapFree GetCurrentThreadId SetConsoleCtrlHandler TlsAlloc TlsFree TlsSetValue TlsGetValue GetCurrentThread FlushFileBuffers WriteFile ExitProcess FatalAppExitA SetHandleCount GetStdHandle GetFileType GetStartupInfoA SetFilePointer ReadFile WideCharToMultiByte TerminateProcess GetCurrentProcess HeapReAlloc HeapSize SetUnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr IsBadReadPtr IsBadCodePtr UnhandledExceptionFilter SetStdHandle InterlockedDecrement InterlockedIncrement CreateFileA GetCPInfo GetACP GetOEMCP

ole32

CoTaskMemFree

advapi32

CryptReleaseContext CryptAcquireContextA CryptGenRandom

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

160KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

4KB

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.debug_a

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.debug_i

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.debug_l

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.debug_f

Size

4KB

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.debug_l

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.debug_p

Size

4KB

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.debug_a

Size

4KB

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.debug_r

Size

4KB

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SmartClient/sqlite3.dll

IMPHASH fe62f9dce6776626b1ed9d7894e7710d
SHA256 1ca02cf19ca9728127674132823947ae8f60ea417e4b1173ef2278987c06c258
MD5 0a764b1e2ae70d5223b095cb9e7cc5d7
SHA1 327d73848f2a8378cd94f4aa9a91d9620e378ce9
SHA512 1d7a66b5f843a237b71f4ab14527993423a526ca65e4ffb464b048904d6a94c7b24ea7a108d5a1b151f0fe074fb9228378590180334cef8a68c5051062af5269
SSDEEP 6144:g2YXPFsclAKSPAoqQdpDbuLFBvIqKrcmzvdiULvBz8yV2dMmCDE6fwnJXeE/kxJt:g2YZre/DbuLFKqKrccdiU9bLDXYIV/Z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_DLL

PDB paths

sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_database_name sqlite3_column_database_name16 sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_origin_name sqlite3_column_origin_name16 sqlite3_column_table_name sqlite3_column_table_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_data_count sqlite3_db_config sqlite3_db_handle sqlite3_db_mutex sqlite3_db_status sqlite3_declare_vtab sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_exec sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_value sqlite3_result_zeroblob sqlite3_rollback_hook sqlite3_rtree_geometry_callback sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_step sqlite3_stmt_status sqlite3_strnicmp sqlite3_table_column_metadata sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_trace sqlite3_transfer_bindings sqlite3_update_hook sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_int sqlite3_value_int64 sqlite3_value_numeric_type sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_hook sqlite3_win32_mbcs_to_utf8

Name

.text

Size

415KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.stab

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.stabstr

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SmartClient/unins000.dat

SHA256 cb0aafe09ce6d7328ceb79adfece5a9a46c97c6feaae18cb886c27e920e67503
MD5 5216deeed0eecc7be41ad2fe648cf4e9
SHA1 66efdb372dd1690ff85393b1b596d38af38960c4
SHA512 1caf3a64d8ac419e3163285bb731527b9e6e9ff6e1ee9e24fe1a6d1fbbbd55bb60ef08ca6a46ebc09700fb247304863533c2ca0cdc77caf8262a815c3dac44cc
SSDEEP 96:RHYlU4XKD8tYBWQZ7S87ICSss/L+GGxxovdV+7JCZ4l0dSmxWVPUMeUEN6u+ggaz:QqD8O3ICSsAr9ftryMira
MD5 SHA1 SHA512 SSDEEP

SmartClient/unins000.exe

SHA256 55eb62bc55d3018b748cea76b3e74d1032645cc2afcc6a764d0094774b095e9d
MD5 7cbe336031d4717396ef3ff791b4ef82
SHA1 716e6571a3d43755215e0a26a4a3ca92f12b1eeb
SHA512 61f283b623e1893d8c196922d5fb2a56a4b42d3e893c2b7fd2530f1fe261a7cef74c2e1ec860ab8b821bac7d93b1a1747998cd79b4ee06b1b9876ca065e2fecf
SSDEEP 12288:rcC+QSkqgnQNIBCa5lZWnDtyEfeyyERtS+RgGP6/PW+UHx+/O:B+QSkqgnQNDa5lZe9fvyErqPW+UHx+/O
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

1

Entry point

636992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

619KB

Virtual Size

618KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

8B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SmartClient.zip

SmartClient/AVApis.dll

kernel32

iotcapis

generic

SmartClient/BCNetSDK.dll

wsock32

kernel32

playctrl

iotcapis

bcp2p_api

rdtapis

netapi32

iphlpapi

wpcap

shlwapi

generic

SmartClient/BCP2P_API.dll

ws2_32

iphlpapi

kernel32

generic

SmartClient/DevMiddleware.dll

playctrl

bcnetsdk

kernel32

generic

SmartClient/EnCodeQr.dll

kernel32

user32

gdi32

advapi32

shell32

oleaut32

wsock32

netapi32

generic

SmartClient/IOTCAPIs.dll

kernel32

ws2_32

iphlpapi

generic

SmartClient/Install.ini

SmartClient/LangFiles/LangBgr.ini

SmartClient/LangFiles/LangChs.ini

SmartClient/LangFiles/LangCht.ini

SmartClient/LangFiles/LangCzh.ini

SmartClient/LangFiles/LangEng.ini

SmartClient/LangFiles/LangEsn.ini

SmartClient/LangFiles/LangFra.ini

SmartClient/LangFiles/LangGerman.ini

SmartClient/LangFiles/LangHun.ini

SmartClient/LangFiles/LangIta.ini

SmartClient/LangFiles/LangKra.ini

SmartClient/LangFiles/LangPersian.ini

SmartClient/LangFiles/LangPol.ini

SmartClient/LangFiles/LangPtg.ini

SmartClient/LangFiles/LangRom.ini

SmartClient/LangFiles/LangRus.ini

SmartClient/LangFiles/LangRus_st.ini

SmartClient/LangFiles/LangThai.ini

SmartClient/Language.cfg

SmartClient/Language.dll

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

oleaut32

generic

SmartClient/Live555.dll

ws2_32

kernel32