2170b52a9b0e36221f5f4033f6b40986_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2170b52a9b0e36221f5f4033f6b40986_JaffaCakes118
Size

7.2MB
MD5

2170b52a9b0e36221f5f4033f6b40986
SHA1

12ba90342ae6132fe4e2fdb7fd630d39ce074773
SHA256

d7d47aa5796cad499374b284e865f715e7496efca16566add1c3a505730259de
SHA512

6d074266f5ec57cdb3d6f9961ed1ab3b653a8a1949d0550045563b426b11d0002c2ee2f22d9dbb03aaf36b4ebfa346ecb2fb45e83f5236f2168afec3aa523763
SSDEEP

98304:Ib4O806Vz9S3oB08fFQuX32TsJAnxTmeMnKG9ZonejJ+SPonVQ05KkN:2UVz9AkZtQuX32TNxpMKnSQnVQs

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/crashreport.exe	upx

Unsigned PE 18 IoCs

Checks for missing Authenticode signature.

resource
unpack002/$APPDATA/KuaiKuai/KKGame/download/libcurl.dll
unpack002/$APPDATA/KuaiKuai/KKGame/download/libexpatw.dll
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/Processes.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsDialogs.dll
unpack003/out.upx
unpack004/$PLUGINSDIR/InstallOptions.dll
unpack005/$PLUGINSDIR/CheckKsvsSvcDLL.dll
unpack005/$PLUGINSDIR/InstallOptions.dll
unpack005/$PLUGINSDIR/KillProcDLL.dll
unpack005/$PLUGINSDIR/System.dll
unpack005/$PLUGINSDIR/nsExec.dll
unpack002/libcurl.dll
unpack002/libexpatw.dll
unpack002/uninst.exe
unpack006/$PLUGINSDIR/Processes.dll
unpack006/$PLUGINSDIR/System.dll

NSIS installer 8 IoCs

installer

resource	yara_rule
static1/unpack001/kk_setup_game_10_1.exe	nsis_installer_1
static1/unpack001/kk_setup_game_10_1.exe	nsis_installer_2
static1/unpack002/kkrs_setup.exe	nsis_installer_1
static1/unpack002/kkrs_setup.exe	nsis_installer_2
static1/unpack002/ksvs_setup.exe	nsis_installer_1
static1/unpack002/ksvs_setup.exe	nsis_installer_2
static1/unpack002/uninst.exe	nsis_installer_1
static1/unpack002/uninst.exe	nsis_installer_2

Files

2170b52a9b0e36221f5f4033f6b40986_JaffaCakes118
.rar
kk_setup_game_10_1.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

46:17:dc:88:e3:b5:7a:40:6b:89:71:d2:c4:c2:33:20:37:60:ec:56
Signer

Actual PE Digest

46:17:dc:88:e3:b5:7a:40:6b:89:71:d2:c4:c2:33:20:37:60:ec:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/KuaiKuai/KKGame/download/kkdownload.exe
.exe windows:5 windows x86 arch:x86

c0d4f083fa62db67fb705b643a601dbf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e8:64:da:69:34:9c:1c:63:9b:89:f8:0b:b1:64:a5:f5:a8:e3:0c:57
Signer

Actual PE Digest

e8:64:da:69:34:9c:1c:63:9b:89:f8:0b:b1:64:a5:f5:a8:e3:0c:57

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\kkbuild\hudson\jobs\kk\workspace\product\win32\kkdownload.pdb

Imports

kernel32

lstrlenW
WideCharToMultiByte
GetLastError
CreateThread
WaitForMultipleObjects
GetExitCodeThread
ResumeThread
SetEvent
TerminateThread
LoadLibraryW
GetProcAddress
GetPrivateProfileStringW
WritePrivateProfileStringW
CreateDirectoryW
CreateFileW
Sleep
lstrlenA
MultiByteToWideChar
GetFileAttributesW
DeleteFileW
GetModuleFileNameW
LocalAlloc
LocalFree
GetModuleHandleW
FreeLibrary
GetCommandLineW
GetFullPathNameW
GetLongPathNameW
lstrcmpiW
CreateEventW
InitializeCriticalSection
DeleteCriticalSection
GetPrivateProfileIntW
GetWindowsDirectoryW
GetTickCount
WaitForSingleObject
ResetEvent
LeaveCriticalSection
EnterCriticalSection
CloseHandle
SetFileTime
CreateFileA
SystemTimeToFileTime
DeleteFileA
SetEndOfFile
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetModuleHandleA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
GetSystemTimeAsFileTime
MoveFileA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCurrentThreadId
GetStartupInfoW
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
WriteFile
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
VirtualAlloc
SetFilePointer
ReadFile
FlushFileBuffers
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage

advapi32

InitializeSecurityDescriptor
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
SHChangeNotify
CommandLineToArgvW
SHGetFolderPathW

ole32

CoInitializeEx
CoCreateInstance

shlwapi

PathFileExistsW
PathRemoveArgsW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

InternetSetOptionExA
InternetCloseHandle
HttpQueryInfoA
InternetOpenA
InternetOpenUrlA

Sections

.text
Size: 187KB - Virtual size: 187KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$APPDATA/KuaiKuai/KKGame/download/libcurl.dll
.dll windows:5 windows x86 arch:x86

bdd8f294be92a3d6c2b6221763f7c002

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

recvfrom
sendto
send
select
__WSAFDIsSet
WSASetLastError
gethostbyname
listen
accept
WSAStartup
WSACleanup
recv
socket
connect
closesocket
setsockopt
getsockopt
htons
bind
ntohs
getsockname
WSAGetLastError
ioctlsocket

wldap32

ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord32
ord35
ord79
ord200
ord33
ord301
ord27
ord41
ord46

kernel32

GetFileInformationByHandle
HeapSize
GetProcessHeap
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
FlushFileBuffers
GetModuleHandleA
MultiByteToWideChar
GetCurrentDirectoryA
GetFullPathNameA
SetStdHandle
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetModuleFileNameA
WriteFile
SleepEx
ExpandEnvironmentStringsA
CloseHandle
DuplicateHandle
GetCurrentProcess
WaitForSingleObject
ReleaseMutex
SetEvent
WaitForMultipleObjects
CreateEventA
CreateMutexA
SetLastError
GetExitCodeThread
TerminateThread
GetLastError
Sleep
FormatMessageA
ReadFile
PeekNamedPipe
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
HeapReAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
SetFilePointer
FindClose
GetDriveTypeA
FindFirstFileA
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
RtlUnwind
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$APPDATA/KuaiKuai/KKGame/download/libexpatw.dll
.dll windows:4 windows x86 arch:x86

027cf8b153bfc3407e39f0badac4f27d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
HeapFree
HeapReAlloc
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapSize
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Exports

Exports

XML_DefaultCurrent
XML_ErrorString
XML_ExpatVersion
XML_ExpatVersionInfo
XML_ExternalEntityParserCreate
XML_FreeContentModel
XML_GetBase
XML_GetBuffer
XML_GetCurrentByteCount
XML_GetCurrentByteIndex
XML_GetCurrentColumnNumber
XML_GetCurrentLineNumber
XML_GetErrorCode
XML_GetFeatureList
XML_GetIdAttributeIndex
XML_GetInputContext
XML_GetParsingStatus
XML_GetSpecifiedAttributeCount
XML_MemFree
XML_MemMalloc
XML_MemRealloc
XML_Parse
XML_ParseBuffer
XML_ParserCreate
XML_ParserCreateNS
XML_ParserCreate_MM
XML_ParserFree
XML_ParserReset
XML_ResumeParser
XML_SetAttlistDeclHandler
XML_SetBase
XML_SetCdataSectionHandler
XML_SetCharacterDataHandler
XML_SetCommentHandler
XML_SetDefaultHandler
XML_SetDefaultHandlerExpand
XML_SetDoctypeDeclHandler
XML_SetElementDeclHandler
XML_SetElementHandler
XML_SetEncoding
XML_SetEndCdataSectionHandler
XML_SetEndDoctypeDeclHandler
XML_SetEndElementHandler
XML_SetEndNamespaceDeclHandler
XML_SetEntityDeclHandler
XML_SetExternalEntityRefHandler
XML_SetExternalEntityRefHandlerArg
XML_SetNamespaceDeclHandler
XML_SetNotStandaloneHandler
XML_SetNotationDeclHandler
XML_SetParamEntityParsing
XML_SetProcessingInstructionHandler
XML_SetReturnNSTriplet
XML_SetSkippedEntityHandler
XML_SetStartCdataSectionHandler
XML_SetStartDoctypeDeclHandler
XML_SetStartElementHandler
XML_SetStartNamespaceDeclHandler
XML_SetUnknownEncodingHandler
XML_SetUnparsedEntityDeclHandler
XML_SetUserData
XML_SetXmlDeclHandler
XML_StopParser
XML_UseForeignDTD
XML_UseParserAsHandlerArg

Sections

.text
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Processes.dll
.dll windows:5 windows x86 arch:x86

eaa5f91829171a65db414b9e64ec9548

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
FreeLibrary
OpenProcess
CloseHandle
TerminateProcess
GlobalFree
lstrcpyA
FlushFileBuffers
CreateFileA
GetCurrentThreadId
GetCommandLineA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

GetDesktopWindow
FindWindowA
UpdateWindow
wsprintfA

Exports

Exports

FindDevice
FindProcess
KillProcess

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/image.bmp
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/kknsisplugin.dll
.dll windows:5 windows x86 arch:x86

6aca62768bfac89e363a4728364d1873

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

60:c5:24:65:fa:04:92:c0:be:35:91:0e:76:f4:05:88:9b:8f:45:b1
Signer

Actual PE Digest

60:c5:24:65:fa:04:92:c0:be:35:91:0e:76:f4:05:88:9b:8f:45:b1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\work\kk_new_code\coding\nsis_plugin\kknsisplugin\Release\kknsisplugin.pdb

Imports

kernel32

LocalAlloc
GetLastError
LocalFree
FileTimeToSystemTime
lstrcmpA
LockResource
LoadResource
SizeofResource
FindResourceExW
GetModuleFileNameW
MultiByteToWideChar
lstrlenA
lstrcpynA
GlobalAlloc
GlobalFree
FileTimeToLocalFileTime
lstrcpyA
GetFileAttributesW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
RaiseException
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
WriteFile
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryA
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW

crypt32

CertGetNameStringW
CryptMsgClose
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptDecodeObject
CryptQueryObject
CryptMsgGetParam

wintrust

WinVerifyTrust

Exports

Exports

checkSign
writeChannel

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/pagerecommender.ini
$PLUGINSDIR/pagerecommender2.ini
$PLUGINSDIR/securitywarm.bmp
$PLUGINSDIR/securitywarm.ini
$PLUGINSDIR/selectdir.ini
$PLUGINSDIR/shortcutpage.ini
$PLUGINSDIR/showpresentation.bmp
$PLUGINSDIR/showpresentation.ini
app_server_info2.dat
checkkkinfo.dll
.dll windows:5 windows x86 arch:x86

b4d6f130328c978d50ac6442d34564db

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

89:ce:c3:aa:0f:4c:50:7a:ed:75:54:19:1c:ae:fc:1a:7f:7c:bf:80
Signer

Actual PE Digest

89:ce:c3:aa:0f:4c:50:7a:ed:75:54:19:1c:ae:fc:1a:7f:7c:bf:80

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\kkbuild\hudson\jobs\kk\workspace\product\win32\checkkkinfo.pdb

Imports

kernel32

CreateEventW
WaitForSingleObject
SetEvent
CloseHandle
Sleep
LocalFree
LocalAlloc
GetLastError
CreateDirectoryW
GetModuleFileNameW
DeleteCriticalSection
LeaveCriticalSection
MultiByteToWideChar
lstrlenA
EnterCriticalSection
GetVersionExA
DeviceIoControl
GetVersion
lstrcpynA
GetPrivateProfileIntW
InitializeCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetACP
GetOEMCP
IsValidCodePage
VirtualFree
VirtualAlloc
HeapCreate
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
FreeLibrary
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GetModuleHandleA

advapi32

GetSecurityInfo
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueA
SetSecurityInfo
SetEntriesInAclA
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetFolderPathW

shlwapi

PathRemoveFileSpecW
PathFileExistsW
PathRemoveArgsW
PathAppendW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetOpenUrlA
HttpQueryInfoA
InternetCloseHandle
InternetSetOptionExA
InternetOpenA

iphlpapi

GetAdaptersInfo

ole32

CoCreateInstance
OleRun
CoUninitialize
CoInitializeEx
CoCreateGuid
CoSetProxyBlanket

oleaut32

SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear
VariantChangeType
VariantInit

Exports

Exports

?GenUUID@@YAHPADPAH@Z
funCheckKKInfo

Sections

.text
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crashreport.exe
.exe windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b0:79:dc:74:be:19:84:b0:e2:06:ac:b9:b4:56:ba:b4:a2:d7:38:90
Signer

Actual PE Digest

b0:79:dc:74:be:19:84:b0:e2:06:ac:b9:b4:56:ba:b4:a2:d7:38:90

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 608KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 301KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 677KB - Virtual size: 677KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 5KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 36B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
data_server_list2.dat
defval.cfg
gamelib3.xml
kislivx.dll
.dll regsvr32 windows:5 windows x86 arch:x86

224acc427d6c049c7dc25df48fa2524d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

18:c0:60:39:a4:70:6c:1d:d3:03:f0:f9:77:6a:ff:8e:0b:9d:c4:1a
Signer

Actual PE Digest

18:c0:60:39:a4:70:6c:1d:d3:03:f0:f9:77:6a:ff:8e:0b:9d:c4:1a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\kkbuild\hudson\jobs\kk\workspace\product\win32\kislivx.pdb

Imports

kernel32

OpenProcess
TerminateProcess
LocalFree
FlushFileBuffers
DisableThreadLibraryCalls
GetLastError
VirtualFree
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReleaseSemaphore
ResetEvent
IsBadReadPtr
GetCurrentProcess
WaitNamedPipeW
SetNamedPipeHandleState
lstrlenW
GetModuleFileNameW
CreateDirectoryW
GetFileAttributesW
RemoveDirectoryW
FindClose
IsBadWritePtr
DeleteFileW
GetTempFileNameW
GetVersionExW
GetModuleHandleW
GetTimeZoneInformation
GetSystemTimeAdjustment
GetLocalTime
CreateProcessW
GetExitCodeProcess
WriteFile
GetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetExitCodeThread
SuspendThread
TerminateThread
MoveFileW
LocalAlloc
VirtualQuery
OpenThread
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
GetFileInformationByHandle
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
ReleaseMutex
DuplicateHandle
CreateMutexW
WaitForMultipleObjects
PeekNamedPipe
FormatMessageW
SleepEx
CompareStringW
CompareStringA
GetModuleHandleA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
SetFileAttributesW
FreeLibrary
GetPrivateProfileSectionNamesW
LoadLibraryW
GetProcAddress
GetTickCount
SetFilePointer
GetFileSize
GetPrivateProfileIntW
ReadFile
CreateFileW
GetPrivateProfileStringW
GetDriveTypeW
GetDiskFreeSpaceExW
GetCurrentThreadId
WritePrivateProfileStringW
WideCharToMultiByte
MoveFileExW
CopyFileW
MultiByteToWideChar
Sleep
SetEvent
WaitForSingleObject
GetWindowsDirectoryW
CloseHandle
CreateEventW
GetTempPathW
GetSystemDirectoryW
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetEnvironmentVariableW
SetEnvironmentVariableA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
CreateFileA
GetStartupInfoA
SetHandleCount
GetFileType
SetStdHandle
HeapDestroy
HeapCreate
HeapReAlloc
GetModuleFileNameA
GetStdHandle
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapFree
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
ExitThread
CreateThread
GetCommandLineA
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
GetCPInfo
GetACP

user32

DispatchMessageW
IsWindowVisible
FlashWindowEx
EnumWindows
TranslateMessage
PostThreadMessageW
MsgWaitForMultipleObjects
PeekMessageW
GetWindowThreadProcessId
FindWindowW

advapi32

LookupPrivilegeValueW
GetUserNameW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
ControlService
QueryServiceStatus
StartServiceW
OpenServiceW
RegEnumKeyExW
RegDeleteValueW
CloseServiceHandle
OpenSCManagerW
RegCreateKeyExW
RegOpenKeyExW
ImpersonateLoggedOnUser
RevertToSelf
CreateProcessAsUserW
DuplicateTokenEx
GetTokenInformation
OpenProcessToken
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyW

shell32

CommandLineToArgvW

ole32

CoCreateGuid

shlwapi

PathFileExistsW
PathIsRelativeW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

recv
send
WSAStartup
closesocket
ntohs
htons
getsockopt
socket
bind
setsockopt
getsockname
inet_addr
connect
ioctlsocket
accept
listen
WSAGetLastError
sendto
recvfrom
gethostbyname
WSASetLastError
__WSAFDIsSet
select
inet_ntoa
WSACleanup

winmm

timeGetTime

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 669KB - Virtual size: 669KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kisupco.dll
.dll regsvr32 windows:5 windows x86 arch:x86

3f325977e787a811eee042ea8d91ef51

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2f:7d:d3:ed:32:d2:fe:61:87:56:98:cd:d1:1b:72:49:f6:4c:3a:88
Signer

Actual PE Digest

2f:7d:d3:ed:32:d2:fe:61:87:56:98:cd:d1:1b:72:49:f6:4c:3a:88

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\kkbuild\hudson\jobs\kk\workspace\product\win32\kisupco.pdb

Imports

kernel32

GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
GetTempPathW
GetFileAttributesW
CreateFileW
GetFileSize
ReadFile
SetFileAttributesW
GetExitCodeProcess
SetFilePointer
WriteFile
GetCurrentProcess
VirtualQuery
RemoveDirectoryW
GetSystemTimeAdjustment
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
SetEndOfFile
CreateFileA
GetModuleHandleA
GetLocaleInfoW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetStringTypeW
DeleteFileW
MoveFileW
CreateDirectoryW
GetCommandLineW
CreateEventW
GetPrivateProfileIntW
GetModuleFileNameW
lstrlenW
Sleep
Process32NextW
Process32FirstW
WaitForSingleObject
CreateProcessW
CreateToolhelp32Snapshot
TerminateProcess
GetCurrentProcessId
CloseHandle
OutputDebugStringW
OpenProcess
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
VirtualAlloc
QueryPerformanceCounter
VirtualFree
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MoveFileA
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
ExitProcess
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType

user32

GetWindowThreadProcessId
MessageBoxW
GetPropW
GetWindowTextW
PostMessageW
EnumWindows
DispatchMessageW
TranslateMessage
PeekMessageW

advapi32

RegEnumKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegSetValueW
RegCreateKeyExW
RegCloseKey
CreateProcessAsUserW
DuplicateTokenEx
OpenProcessToken

shell32

ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoTaskMemFree
StringFromCLSID

oleaut32

SysAllocString

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW
GetProcessImageFileNameW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

shlwapi

PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathIsRelativeW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 238KB - Virtual size: 238KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kkdlengine.dll
.dll windows:5 windows x86 arch:x86

677c80b2873b90d90c5e1c3ee3417e23

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

83:a4:59:9a:68:f5:ef:2b:bf:12:51:31:b3:35:bf:96:ee:cb:6a:85
Signer

Actual PE Digest

83:a4:59:9a:68:f5:ef:2b:bf:12:51:31:b3:35:bf:96:ee:cb:6a:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\kkbuild\hudson\jobs\kk\workspace\product\win32\kkdlengine.pdb

Imports

kernel32

LeaveCriticalSection
CreateFileW
CloseHandle
DeleteFileW
SetFileAttributesW
WriteFile
WaitForSingleObject
EnterCriticalSection
LoadLibraryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
FreeLibrary
ReadFile
DeleteCriticalSection
InitializeCriticalSection
Sleep
GetLongPathNameW
GetLocaleInfoW
LCMapStringW
LCMapStringA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InterlockedIncrement
InterlockedDecrement
GetLastError
WideCharToMultiByte
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
HeapAlloc
HeapFree
RaiseException
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
RtlUnwind
GetModuleHandleA

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW

wininet

InternetCloseHandle
HttpQueryInfoW
InternetSetOptionExA
InternetReadFile
InternetOpenA
InternetOpenUrlW

Exports

Exports

KKDL_CreateTask
KKDL_DeleteTask
KKDL_Init
KKDL_QueryResumeableInfo
KKDL_QueryTask
KKDL_QueryWorkEngine
KKDL_StopTask
KKDL_Term

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kkdownload.dll
.dll windows:5 windows x86 arch:x86

1aecc840048799c82047a2d557c7bdca

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:8c:ae:08:e4:f0:08:c9:71:46:b5:72:12:7e:0b:1a:52:9f:b7:47
Signer

Actual PE Digest

52:8c:ae:08:e4:f0:08:c9:71:46:b5:72:12:7e:0b:1a:52:9f:b7:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\kuaikuai\client\framework\bin\win32\kkdownload.pdb

Imports

kktoolset

ksl_write_log
ksl_get_logger
crypt_md5_destroy
crypt_md5_done
crypt_md5_process
crypt_md5_init
crypt_md5_create
crypt_sha1_done
crypt_sha1_process
crypt_sha1_init
crypt_sha1_destroy
crypt_sha1_create
crypt_base64_encode

kernel32

CreateFileA
GetProcessHeap
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
InterlockedIncrement
InterlockedDecrement
FreeLibrary
LoadLibraryW
GetProcAddress
GetTickCount
Sleep
GetQueuedCompletionStatus
WaitForSingleObject
TerminateThread
GetLastError
PostQueuedCompletionStatus
CreateIoCompletionPort
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
MultiByteToWideChar
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
GetModuleFileNameW
CreateEventW
SetEvent
CreateFileW
GetFileSizeEx
GetFileTime
SetFilePointerEx
ReadFile
SystemTimeToFileTime
CreateDirectoryW
WriteFile
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
UnmapViewOfFile
GetVolumeInformationW
SetFileValidData
FlushFileBuffers
SetFileTime
MoveFileExW
FileTimeToSystemTime
CreateProcessW
GetExitCodeProcess
CreateFileMappingW
MapViewOfFile
FlushViewOfFile
GetCurrentThreadId
GetCurrentDirectoryW
ResumeThread
GetSystemTime
SetFilePointer
GetVersionExW
InterlockedExchange
GetStringTypeW
GetStringTypeA
LCMapStringA
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
RtlUnwind
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RaiseException
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
HeapReAlloc
VirtualAlloc
SetEndOfFile
GetModuleHandleA
VirtualFree
HeapDestroy
HeapCreate
GetCommandLineA
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetSystemTimeAsFileTime

shell32

SHGetFolderPathW

ws2_32

WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSACloseEvent
WSAEventSelect
WSACreateEvent
listen
WSASocketW
recvfrom
htonl
WSARecv
WSASend
sendto
bind
accept
ioctlsocket
WSAIoctl
connect
inet_ntoa
inet_addr
select
WSAGetLastError
htons
getsockname
setsockopt
recv
socket
__WSAFDIsSet
closesocket
gethostbyname
send
getsockopt
WSACleanup
WSAStartup
getpeername
ntohs

shlwapi

PathAppendW
StrStrIA

iphlpapi

NotifyAddrChange
GetAdaptersInfo
CancelIPChangeNotify

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

kdl_get_service
kdl_init
kdl_term

Sections

.text
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kkgame.exe
.exe windows:5 windows x86 arch:x86

e90a2833d4c05035ecf9c2b5e378f965

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bf:c4:ef:a0:2f:97:6d:21:44:d9:da:3a:b6:59:4f:f7:44:56:32:d8
Signer

Actual PE Digest

bf:c4:ef:a0:2f:97:6d:21:44:d9:da:3a:b6:59:4f:f7:44:56:32:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\kkbuild\hudson\jobs\kk\workspace\product\win32\game\kkgame.pdb

Imports

kktoolset

minizip_init
minizip_unz_extract
minizip_unz_close
minizip_unz_open

kkgpengine

KKGP_DepInstall
KKGP_DepStopInstall
KKGP_DepQueryProgress
KKGP_IfAppSupportRepair
KKGP_ConfigAppForRepair
?GenUUID@@YAHPADPAH@Z
KKGP_UnhandledExceptionFilter
KKGP_QueryKKFile
KKGP_Init
KKGP_Term
KKGP_RunApp
KKGP_InitApp
KKGP_SetAppKeyValue
KKGP_GetAppKeyValue
KKGP_SetAppRoot
KKGP_QueryAppInitStage
KKGP_CheckApp
KKGP_DeleteApp
KKGP_GetAppRoot
KKGP_QueryApp_Ex
KKGP_StopInitApp
KKGP_ConfigAppWithKKFile
KKGP_GetProcessCount
KKGP_GetAppDepInsFromPath
KKGP_OpenAppProgramDir
KKGP_GetAppDepIns

kernel32

ResumeThread
SuspendThread
WinExec
lstrcmpiW
GetLongPathNameW
GetFullPathNameW
GetCommandLineW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDrives
GetModuleHandleW
GetPrivateProfileIntW
SetThreadPriority
GetVersionExA
GetACP
GetSystemDefaultLangID
CreateMutexW
ReleaseMutex
ReadFile
WriteFile
GlobalFree
MulDiv
InterlockedDecrement
GlobalMemoryStatusEx
GetFileSize
LoadLibraryA
SetUnhandledExceptionFilter
GetCurrentProcessId
GetCurrentProcess
OutputDebugStringA
GetCurrentThreadId
GetLocalTime
RaiseException
SetLastError
lstrcmpW
InterlockedIncrement
FlushInstructionCache
GlobalHandle
LoadLibraryExW
lstrcpyW
CompareStringW
GetLocaleInfoW
GetDateFormatW
DeleteFileA
OpenMutexW
GetVersionExW
lstrcpynW
FlushFileBuffers
FileTimeToSystemTime
SetProcessWorkingSetSize
GetSystemInfo
GetTempPathW
GetTempFileNameW
VirtualAlloc
GetModuleHandleA
GetFileInformationByHandle
VirtualProtect
GetCurrentThread
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
HeapDestroy
HeapReAlloc
HeapSize
InterlockedExchange
SystemTimeToFileTime
CreateFileA
WaitForMultipleObjects
GetExitCodeThread
ResetEvent
CreateThread
WaitForSingleObject
SetEvent
TerminateThread
GetSystemTimeAsFileTime
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
MoveFileA
ExitThread
GetStartupInfoW
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
VirtualQuery
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
GetModuleFileNameA
CreateEventW
WideCharToMultiByte
WritePrivateProfileStringW
GetPrivateProfileStringW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetProcAddress
FreeLibrary
LocalAlloc
GetModuleFileNameW
MultiByteToWideChar
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
lstrlenA
FindFirstFileW
CreateDirectoryW
MoveFileExW
Sleep
CopyFileW
GetLastError
OutputDebugStringW
CreateFileW
GetFileTime
CloseHandle
SetFileTime
FindNextFileW
FindClose
LocalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FreeResource
GetVersion
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
GetFileAttributesA
lstrlenW
GetTickCount
GetConsoleCP
GetConsoleMode
GetOEMCP
IsValidCodePage
HeapCreate
GetTimeZoneInformation
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CompareStringA
SetEnvironmentVariableA
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetTimeFormatW

user32

GetScrollInfo
GetScrollPos
RegisterClipboardFormatW
SetScrollInfo
SetDlgItemTextW
DrawFrameControl
EqualRect
GetMessagePos
GetAsyncKeyState
OpenClipboard
EmptyClipboard
CloseClipboard
SetClipboardData
ValidateRect
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetMenu
AdjustWindowRectEx
MessageBoxW
DrawIconEx
DialogBoxIndirectParamW
EnableWindow
GetActiveWindow
CreateDialogParamW
SetLayeredWindowAttributes
UpdateLayeredWindow
OffsetRect
UpdateWindow
ShowScrollBar
SetRectEmpty
ShowWindow
IsDialogMessageW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
EndDialog
SystemParametersInfoW
SetForegroundWindow
CreateDialogIndirectParamW
InvalidateRgn
SetCapture
MoveWindow
CreateAcceleratorTableW
CharNextW
GetClassNameW
RedrawWindow
IsWindow
IsChild
SetFocus
GetFocus
DestroyAcceleratorTable
GetDlgItem
SetWindowTextW
RegisterWindowMessageW
GetClassInfoExW
GetKeyState
ExitWindowsEx
GetWindow
PeekMessageW
wsprintfW
GetUpdateRect
CopyRect
ReleaseDC
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
PostQuitMessage
RegisterClassExW
GetDesktopWindow
EndPaint
BeginPaint
PtInRect
GetMenuItemInfoW
GetWindowDC
DrawStateW
GetMenuItemCount
SetMenuItemInfoW
RegisterClassW
EnumWindows
GetPropW
EnableMenuItem
InflateRect
IsWindowVisible
GetSystemMetrics
GetWindowRect
ScreenToClient
SetRect
FillRect
FrameRect
SetWindowRgn
GetWindowTextLengthW
LoadBitmapW
CallWindowProcW
GetWindowLongW
SetWindowLongW
DrawEdge
DrawTextW
CreateWindowExW
DefWindowProcW
GetDlgCtrlID
GetParent
IsWindowEnabled
KillTimer
SetTimer
InvalidateRect
CreatePopupMenu
InsertMenuItemW
CheckMenuItem
TrackPopupMenu
DestroyMenu
GetLastInputInfo
MonitorFromRect
IsZoomed
IsIconic
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
BringWindowToTop
SetPropW
UnregisterHotKey
MonitorFromPoint
GetSubMenu
LoadMenuW
DialogBoxParamW
RemoveMenu
ModifyMenuW
MapDialogRect
FindWindowW
GetDC
GetClientRect
SetWindowPos
GetWindowTextW
SendMessageW
SetCursor
LoadCursorW
ReleaseCapture
PostMessageW
RegisterHotKey
IntersectRect
DestroyIcon
GetIconInfo
ClientToScreen
GetCapture
GetCursorPos
WindowFromPoint
DrawFocusRect
DestroyCursor
GetSysColor
UnregisterClassA
GetComboBoxInfo
IsRectEmpty
SetWindowContextHelpId
SetScrollPos
LoadImageW

gdi32

SetWindowOrgEx
GetTextExtentPoint32W
GetBkColor
CreatePolygonRgn
RoundRect
OffsetRgn
GetCurrentObject
ExcludeClipRect
Rectangle
GetClipBox
CreateRectRgnIndirect
OffsetWindowOrgEx
GetObjectA
SetViewportOrgEx
RestoreDC
SaveDC
CreateFontW
GetDeviceCaps
CreateDIBSection
CreateFontIndirectW
SetRectRgn
CreateSolidBrush
CreatePen
MoveToEx
LineTo
CreateBitmap
CreateCompatibleBitmap
SelectClipRgn
StretchBlt
SetTextColor
SetBkMode
SelectObject
CreateCompatibleDC
DeleteDC
SetBkColor
GetTextMetricsW
ExtTextOutW
GetPixel
CreateRectRgn
CombineRgn
BitBlt
GetObjectW
GetStockObject
GetTextColor
DeleteObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
SetEntriesInAclW
RegSetValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDestroyHash
CryptAcquireContextW
AllocateAndInitializeSid

shell32

ExtractIconExW
ShellExecuteExW
CommandLineToArgvW
SHGetFolderPathW
SHAppBarMessage
Shell_NotifyIconW
SHChangeNotify
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
CoInitialize
CoInitializeSecurity
OleUninitialize
OleInitialize
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
StringFromGUID2
CoTaskMemAlloc
OleLockRunning
CoTaskMemFree
CoTaskMemRealloc
CoCreateGuid
RegisterDragDrop
RevokeDragDrop
OleDuplicateData
ReleaseStgMedium
DoDragDrop

oleaut32

VarBstrCat
SysStringByteLen
DispCallFunc
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysStringLen
SysAllocStringLen
OleLoadPicture
SysFreeString
SysAllocString
VariantInit
VariantClear

shlwapi

PathFileExistsW
PathAppendW
PathRemoveArgsW
PathRemoveFileSpecW
StrStrIW
SHCreateStreamOnFileW
SHDeleteKeyW

comctl32

InitCommonControlsEx
ImageList_GetIconSize
ImageList_LoadImageW
ImageList_Destroy
ImageList_DrawEx
ImageList_GetIcon
_TrackMouseEvent
ImageList_Draw

msimg32

GradientFill
AlphaBlend
TransparentBlt

gdiplus

GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDrawLineI
GdipCreateStringFormat
GdipDeleteStringFormat
GdiplusStartup
GdipSetStringFormatTrimming
GdipRotateWorldTransform
GdipDrawImageRectRect
GdipCloneFont
GdiplusShutdown
GdipBitmapGetPixel
GdipCloneBitmapAreaI
GdipCreateBitmapFromHBITMAP
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipSetSmoothingMode
GdipReleaseDC
GdipSetImageAttributesWrapMode
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDeleteFont
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCreateFont
GdipMeasureString
GdipDrawImageI
GdipDrawString
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCloneImage
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDeleteCachedBitmap
GdipCreateCachedBitmap
GdipDrawImageRectRectI
GdipSetStringFormatAlign
GdipDrawImageRectI
GdipFillRectangleI
GdipDrawRectangleI
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipCreatePen1
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipAlloc
GdipFree
GdipGetImageHeight
GdipGetImageWidth

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ws2_32

inet_addr
htons
socket
setsockopt
ioctlsocket
WSAGetLastError
closesocket
connect
select
getaddrinfo
inet_ntoa
freeaddrinfo
WSAStartup
gethostbyname

wininet

InternetSetOptionExA
InternetOpenUrlA
InternetOpenA
InternetReadFile
InternetCloseHandle
InternetCrackUrlA
GetUrlCacheEntryInfoW
InternetGoOnlineW
HttpQueryInfoA
InternetGetConnectedState

iphlpapi

GetAdaptersInfo
GetIpAddrTable

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 307KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
kkgamewizard.exe
.exe windows:5 windows x86 arch:x86

07338db19617c7e40d3b0cdcc0d44bec

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f7:63:0b:0d:fa:20:f2:49:4c:46:62:7a:f7:3b:7e:44:f3:67:6b:85
Signer

Actual PE Digest

f7:63:0b:0d:fa:20:f2:49:4c:46:62:7a:f7:3b:7e:44:f3:67:6b:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\kkbuild\hudson\jobs\kk\workspace\product\win32\game\kkgamewizard.pdb

Imports

kernel32

LoadLibraryW
ResumeThread
ResetEvent
GetPrivateProfileStringW
GlobalHandle
GlobalFree
CreateMutexW
ReleaseMutex
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
GetVersionExA
DeviceIoControl
lstrcpynA
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
SetConsoleCtrlHandler
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineW
MulDiv
FreeEnvironmentStringsW
GetTimeZoneInformation
FlushFileBuffers
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
ReadFile
IsValidCodePage
GetProcAddress
GetACP
ExitProcess
HeapCreate
FatalAppExitA
GetModuleHandleA
GetModuleFileNameA
GetStdHandle
WriteFile
GetCurrentThread
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
LCMapStringW
LCMapStringA
GetCPInfo
GetStartupInfoW
CreateThread
ExitThread
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
InterlockedExchange
WideCharToMultiByte
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
lstrlenA
FindFirstFileW
MoveFileExW
Sleep
CopyFileW
OutputDebugStringW
CreateFileW
GetFileTime
SetFileTime
FindNextFileW
FindClose
LocalAlloc
LocalFree
CreateDirectoryW
GetVersion
FindResourceExW
GetTickCount
FreeResource
SetEvent
WaitForSingleObject
CloseHandle
CreateEventW
lstrcmpiW
LoadLibraryExW
SizeofResource
MultiByteToWideChar
FreeLibrary
lstrcmpW
lstrlenW
RaiseException
GetCurrentProcess
FlushInstructionCache
SetLastError
GetLastError
FindResourceW
LoadResource
LockResource
GlobalAlloc
GetModuleFileNameW
GlobalLock
GlobalUnlock
WritePrivateProfileStringW
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetOEMCP
GetModuleHandleW
GetPrivateProfileIntW
GetCurrentThreadId
GetEnvironmentStringsW

user32

SystemParametersInfoW
SetForegroundWindow
PostQuitMessage
DestroyWindow
GetWindow
MapDialogRect
SendMessageW
UnregisterClassA
SetWindowLongW
CreateWindowExW
PostMessageW
MoveWindow
LoadImageW
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
KillTimer
GetDlgItem
SetWindowContextHelpId
IsWindow
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindowLongW
GetParent
RegisterClassExW
LoadCursorW
GetClassInfoExW
RegisterWindowMessageW
DefWindowProcW
GetWindowTextW
GetWindowTextLengthW
BeginPaint
EndPaint
DestroyAcceleratorTable
GetSysColor
GetFocus
SetFocus
IsChild
FillRect
RedrawWindow
GetClassNameW
CharNextW
GetDesktopWindow
ReleaseDC
GetDC
CreateAcceleratorTableW
ClientToScreen
ScreenToClient
ReleaseCapture
SetCapture
GetSystemMetrics
SetWindowTextW
SetWindowPos
GetUpdateRect
CopyRect
SetRect
FrameRect
LoadBitmapW
GetDlgCtrlID
IsWindowEnabled
DrawEdge
DrawTextW
SetCursor
GetCapture
WindowFromPoint
DrawFocusRect
DestroyCursor
PtInRect
InflateRect
SetTimer
GetCursorPos
SetWindowRgn
CreateDialogIndirectParamW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
FindWindowW
CallWindowProcW
InvalidateRgn
InvalidateRect

gdi32

CombineRgn
CreateFontIndirectW
SetRectRgn
CreatePen
MoveToEx
LineTo
CreateBitmap
SelectClipRgn
StretchBlt
SetBkColor
GetTextMetricsW
ExtTextOutW
SetTextColor
SetBkMode
GetPixel
DeleteDC
CreateRectRgn
CreateDIBSection
GetStockObject
GetObjectW
GetDeviceCaps
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
SetViewportOrgEx
SelectObject
CreateCompatibleDC
BitBlt
RestoreDC
SaveDC

advapi32

FreeSid
SetEntriesInAclA
SetSecurityInfo
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
GetSecurityInfo

shell32

SHGetFolderPathW
ShellExecuteExW

ole32

OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoTaskMemRealloc
CoTaskMemFree
CoCreateGuid
CoSetProxyBlanket
CoInitializeEx
OleRun
CoInitialize
CoUninitialize
OleLockRunning
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

oleaut32

SysStringByteLen
SysAllocStringByteLen
VariantChangeType
GetErrorInfo
SetErrorInfo
SysAllocString
SysFreeString
VariantInit
VariantClear
DispCallFunc
SysAllocStringLen
SysStringLen
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
OleLoadPicture
CreateErrorInfo

shlwapi

PathAppendW
PathRemoveFileSpecW
SHCreateStreamOnFileW
PathFileExistsW

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

GradientFill
TransparentBlt

gdiplus

GdipAlloc
GdipGetImageWidth
GdipCreateSolidFill
GdipBitmapGetPixel
GdipCloneBitmapAreaI
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCloneImage
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDeleteCachedBitmap
GdipCreateCachedBitmap
GdipDrawImageRectI
GdipDrawRectangleI
GdipDeletePen
GdipCreatePen1
GdiplusStartup
GdiplusShutdown
GdipGetImageHeight
GdipDeleteBrush
GdipDeleteFont
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCreateFont
GdipDrawImageRectRectI
GdipMeasureString
GdipDrawString
GdipFillRectangleI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCloneBrush
GdipFree

wininet

InternetOpenUrlA
HttpQueryInfoA
InternetCloseHandle
InternetOpenA
InternetSetOptionExA

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

iphlpapi

GetAdaptersInfo

Exports

Exports

?GenUUID@@YAHPADPAH@Z

Sections

.text
Size: 464KB - Virtual size: 463KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kkgms.dll
.dll windows:5 windows x86 arch:x86

f7904eb640690afa975ec46c0bc76299

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:aa:dc:7c:3b:9b:42:28:2e:f2:e6:83:5f:77:b7:80:31:60:bd:7e
Signer

Actual PE Digest

7b:aa:dc:7c:3b:9b:42:28:2e:f2:e6:83:5f:77:b7:80:31:60:bd:7e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\kkbuild\hudson\jobs\kk\workspace\product\win32\kkgms.pdb

Imports

kernel32

GetProcAddress
SetFileTime
ReadFile
SetFilePointerEx
GetFileSizeEx
SetEndOfFile
GetLastError
CreateDirectoryW
SetFileAttributesW
GetFileTime
FileTimeToSystemTime
CopyFileW
GetTempPathW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetFileSize
OutputDebugStringW
WritePrivateProfileSectionW
GetComputerNameW
CreateEventW
SetEvent
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
OpenEventW
ResetEvent
OpenFileMappingW
LocalFree
LocalAlloc
GetFileAttributesW
GetACP
GetVersionExA
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
CreateMutexW
ReleaseMutex
GetLogicalDrives
GetDriveTypeW
LoadLibraryW
GetDiskFreeSpaceExW
GetModuleHandleW
DeleteFileA
SystemTimeToFileTime
CreateFileA
WaitForMultipleObjects
GetExitCodeThread
RaiseException
FreeLibrary
FlushFileBuffers
WriteFile
SetFilePointer
CreateFileW
DeleteFileW
lstrlenA
SuspendThread
GetExitCodeProcess
ResumeThread
GetModuleFileNameW
GetTickCount
lstrlenW
WideCharToMultiByte
CreateProcessW
Sleep
MultiByteToWideChar
lstrcmpiW
TerminateThread
WaitForSingleObject
CloseHandle
CreateThread
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
InterlockedDecrement
GetCurrentProcessId
DeleteCriticalSection
DeviceIoControl
GetVersion
lstrcpynA
SetEnvironmentVariableA
CompareStringW
VirtualQuery
CompareStringA
GetModuleHandleA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
LoadLibraryA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
ExitProcess
GetConsoleMode
GetConsoleCP
VirtualAlloc
VirtualFree
HeapCreate
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetVolumeInformationW
InitializeCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
MoveFileA
GetCurrentThreadId
GetCommandLineA
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError

advapi32

RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueA
SetSecurityInfo
SetEntriesInAclA
GetSecurityInfo
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExA
RegOpenKeyExA
SetEntriesInAclW
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW

shell32

SHGetFolderPathW
ShellExecuteExW
SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteW
SHChangeNotify
SHFileOperationW

ole32

CoSetProxyBlanket
CoUninitialize
CreateStreamOnHGlobal
OleRun
CoCreateInstance
CoInitializeEx
CoCreateGuid

oleaut32

SysStringLen
VariantInit
VariantClear
VariantChangeType
GetErrorInfo
SysAllocStringLen
SysAllocStringByteLen
SysAllocString
SysFreeString
SysStringByteLen

shlwapi

PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathCreateFromUrlW
PathIsDirectoryW

ksvsclient

ksvsVersion
ksvsGetService

rpcrt4

UuidFromStringW

kktoolset

crypt_md5_done
crypt_md5_destroy
crypt_md5_init
crypt_md5_process
crypt_md5_create

iphlpapi

GetAdaptersInfo

Exports

Exports

?GenUUID@@YAHPADPAH@Z
kgmsGetService

Sections

.text
Size: 597KB - Virtual size: 597KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kkgpengine.dll
.dll windows:5 windows x86 arch:x86

e2fdb895ddd79733e4b2074e6e6548b5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

12:27:93:37:86:4f:0b:56:41:b7:8c:a5:f3:34:c1:0f:f1:a5:f9:30
Signer

Actual PE Digest

12:27:93:37:86:4f:0b:56:41:b7:8c:a5:f3:34:c1:0f:f1:a5:f9:30

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\kkbuild\hudson\jobs\kk\workspace\product\win32\kkgpengine.pdb

Imports

kkdlengine

KKDL_CreateTask
KKDL_Term
KKDL_Init
KKDL_QueryWorkEngine
KKDL_QueryResumeableInfo
KKDL_QueryTask
KKDL_DeleteTask

kernel32

WaitForSingleObject
GetTickCount
SetThreadPriority
GetCurrentThread
Sleep
MoveFileWithProgressW
MoveFileExW
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetTempPathW
GetDiskFreeSpaceExW
MoveFileW
GetCurrentProcessId
GetModuleFileNameW
CreateEventW
SetEvent
GetPrivateProfileStringW
WritePrivateProfileStringW
LocalAlloc
LocalFree
FreeLibrary
GetPrivateProfileIntW
MultiByteToWideChar
GetACP
GetVersionExA
lstrlenA
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
TerminateProcess
GetExitCodeProcess
GetVersionExW
GetSystemDirectoryW
CopyFileW
GetProcAddress
GetShortPathNameW
LoadLibraryW
SetEndOfFile
SetFilePointerEx
WriteFile
ReadFile
GetLastError
CreateDirectoryW
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
DeleteFileW
SetFileTime
CloseHandle
GetFileSizeEx
CreateFileW
FindClose
FindFirstFileW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CompareStringW
CompareStringA
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSection
GetLocaleInfoW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleHandleA
GetTimeZoneInformation
FlushFileBuffers
SetFilePointer
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
VirtualAlloc
VirtualFree
HeapCreate
GetModuleFileNameA
GetStdHandle
GetStringTypeW
GetStringTypeA
IsValidLocale
SetEnvironmentVariableA
lstrcpynA
GetVersion
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
DeviceIoControl
GetFileAttributesA
CreateThread
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
GetSystemTimeAsFileTime
ExitThread
GetCurrentThreadId
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetFileAttributesW
GetCommandLineA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetModuleHandleW
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetOEMCP

advapi32

RegCreateKeyExA
RegOpenKeyExW
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueA
SetSecurityInfo
SetEntriesInAclA
GetSecurityInfo
GetTokenInformation
DuplicateTokenEx
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
RegEnumKeyExW
RegDeleteValueW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryValueExW
RegCloseKey

shell32

SHFileOperationW
SHGetFolderPathW
ShellExecuteW
ShellExecuteExW

ole32

CoCreateInstance
OleRun
CoSetProxyBlanket
CoCreateGuid
CoUninitialize
CoInitializeEx

oleaut32

SysStringByteLen
SysFreeString
VariantChangeType
VariantClear
VariantInit
SysAllocString
SysAllocStringByteLen
SysStringLen

shlwapi

StrCmpNW
StrStrIW
PathAppendW
PathIsDirectoryW
PathFileExistsW

wininet

InternetCloseHandle
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
InternetConnectW
InternetReadFile
InternetOpenA
InternetOpenUrlA
HttpQueryInfoA
InternetSetOptionExA
InternetOpenW
HttpQueryInfoW
InternetCrackUrlW

psapi

GetModuleFileNameExW

ksvsclient

ksvsGetService
ksvsVersion

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

msi

ord113

iphlpapi

GetAdaptersInfo

Exports

Exports

?GenUUID@@YAHPADPAH@Z
KKGP_CheckApp
KKGP_ConfigAppForRepair
KKGP_ConfigAppWithKKFile
KKGP_DeleteApp
KKGP_DepInstall
KKGP_DepQueryProgress
KKGP_DepStopInstall
KKGP_GetAppDepIns
KKGP_GetAppDepInsFromPath
KKGP_GetAppKeyValue
KKGP_GetAppRoot
KKGP_GetProcessCount
KKGP_IfAppSupportRepair
KKGP_Init
KKGP_InitApp
KKGP_OpenAppProgramDir
KKGP_QueryApp
KKGP_QueryAppInitStage
KKGP_QueryApp_Ex
KKGP_QueryKKFile
KKGP_RunApp
KKGP_SetAppKeyValue
KKGP_SetAppRoot
KKGP_StopInitApp
KKGP_Term
KKGP_UnhandledExceptionFilter

Sections

.text
Size: 338KB - Virtual size: 338KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kkicon.ico
kkmisc.exe
.exe windows:5 windows x86 arch:x86

90e0fc5f09380c638410db143d7771a9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d6:4a:54:f6:25:7a:9b:a8:4a:a6:db:9b:c3:3d:a9:ca:f9:52:59:ef
Signer

Actual PE Digest

d6:4a:54:f6:25:7a:9b:a8:4a:a6:db:9b:c3:3d:a9:ca:f9:52:59:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Projects\kuaikuai\client\ksvs\trunk\product\win32\privilege_operation.pdb

Imports

kernel32

GetCurrentProcessId
CreateFileW
GetModuleFileNameW
GetFileSizeEx
SetFileValidData
WaitForSingleObject
CloseHandle
GetLastError
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
LoadLibraryA
RaiseException
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

ole32

CoInitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kkpid.kid
.xml
kkrs_setup.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a9:00:99:be:fd:b6:ad:aa:fb:dd:dc:ce:33:19:53:05:50:e3:b5:40
Signer

Actual PE Digest

a9:00:99:be:fd:b6:ad:aa:fb:dd:dc:ce:33:19:53:05:50:e3:b5:40

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
kkproto.dll
.dll regsvr32 windows:5 windows x86 arch:x86

a9ccb614f36a835485c21db6d68246e3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:eb:52:c6:c9:ff:a1:5d:87:b2:94:0f:a1:58:54:1e:db:10:8d:ee
Signer

Actual PE Digest

05:eb:52:c6:c9:ff:a1:5d:87:b2:94:0f:a1:58:54:1e:db:10:8d:ee

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\MyPrj\mercury\trunk\client\cofun\product\win32\kkproto.pdb

Imports

kernel32

FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
SetThreadLocale
GetModuleHandleW
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetModuleFileNameW
lstrcmpiW
GetLastError
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetThreadLocale
lstrlenW
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapAlloc
HeapFree
RtlUnwind
GetCurrentThreadId
GetCommandLineA
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance

oleaut32

SysFreeString
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi

rpcrt4

NdrOleAllocate
NdrOleFree
NdrStubForwardingFunction
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 51B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kkrs.exe
.exe windows:5 windows x86 arch:x86

b917c47c526e4b5d393fac6d8f35f0ba

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a5:0d:55:ac:aa:42:4a:7d:5f:9f:dc:f7:dd:4e:38:35:6c:3a:a6:cb
Signer

Actual PE Digest

a5:0d:55:ac:aa:42:4a:7d:5f:9f:dc:f7:dd:4e:38:35:6c:3a:a6:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\KINGSOFT_KK\Build\Build_Src\kuaikuai\kk\product\win32\kkrs\kkrs.pdb

Imports

kernel32

LocalFree
GetCommandLineW
MultiByteToWideChar
GetCurrentThreadId
DeleteCriticalSection
RaiseException
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
GetModuleHandleW
GetLastError
InitializeCriticalSection
FreeLibrary
LoadLibraryExW
CompareStringW
CompareStringA
FlushFileBuffers
CloseHandle
GetFullPathNameW
GetLocaleInfoW
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
GetLongPathNameW
lstrcmpiW
WideCharToMultiByte
WinExec
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
GetModuleFileNameW
WriteConsoleA
SetStdHandle
LoadLibraryA
InterlockedExchange
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringA
GetConsoleMode
GetConsoleCP
CreateFileA
lstrlenW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetFileAttributesW
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
Sleep
ExitProcess
VirtualQuery
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
SetEnvironmentVariableA

user32

CharNextW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
DestroyWindow
MessageBoxW
DefWindowProcW

advapi32

RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW

shell32

CommandLineToArgvW
ShellExecuteW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VarUI4FromStr
SysFreeString

shlwapi

PathRemoveFileSpecW
PathRemoveArgsW
PathAppendW

comctl32

InitCommonControlsEx

Sections

.text
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
uninst.exe.nsis
kkslgn.dll
.dll windows:5 windows x86 arch:x86

524a2015e2551455da8c48be8ea8e8bd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c4:0d:52:2a:6d:f0:53:8d:ca:3e:fe:f3:cd:1c:cb:1f:9c:4d:02:8b
Signer

Actual PE Digest

c4:0d:52:2a:6d:f0:53:8d:ca:3e:fe:f3:cd:1c:cb:1f:9c:4d:02:8b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\kkbuild\hudson\jobs\kk\workspace\product\win32\kkslgn.pdb

Imports

kernel32

OpenFileMappingW
OutputDebugStringW
MapViewOfFile
OpenEventW
WaitForSingleObject
ResetEvent
SetEvent
CloseHandle
UnmapViewOfFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
GetLastError
HeapFree
HeapAlloc
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
WriteFile
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW

Exports

Exports

kkGetActiveUserToken

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kktoolset.dll
.dll windows:5 windows x86 arch:x86

0e65b7b71dff1a3294b8ca184597bb94

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

26:34:d6:71:cc:ed:ca:d4:27:89:6e:6f:87:8e:5c:b1:43:a1:ce:28
Signer

Actual PE Digest

26:34:d6:71:cc:ed:ca:d4:27:89:6e:6f:87:8e:5c:b1:43:a1:ce:28

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\kuaikuai\client\framework\bin\win32\kktoolset.pdb

Imports

kernel32

LeaveCriticalSection
GetModuleFileNameW
CreateDirectoryW
GetLastError
GetLocalTime
GetCurrentProcessId
CreateFileW
OutputDebugStringA
WriteFile
OutputDebugStringW
WriteConsoleW
GetStdHandle
FreeLibrary
LoadLibraryW
GetProcAddress
GetTempPathW
SetUnhandledExceptionFilter
EnterCriticalSection
GetCurrentProcess
lstrcpynW
FindFirstFileW
SystemTimeToFileTime
DeleteFileW
FindNextFileW
FindClose
CreateFileA
SetFilePointer
ReadFile
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
MultiByteToWideChar
GetProcessHeap
CloseHandle
DeleteCriticalSection
GetCurrentThreadId
InitializeCriticalSection
SetEndOfFile
GetLocaleInfoW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LCMapStringW
LCMapStringA
FlushFileBuffers
HeapFree
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
InterlockedIncrement
InterlockedDecrement
GetSystemTimeAsFileTime
GetCommandLineA
RaiseException
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
HeapSize
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionAndSpinCount
LoadLibraryA

user32

wsprintfW
wsprintfA

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

shell32

ShellExecuteW

shlwapi

PathRemoveExtensionW
PathAppendW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Exports

Exports

ConvertUTF16toUTF32
ConvertUTF16toUTF8
ConvertUTF32toUTF16
ConvertUTF32toUTF8
ConvertUTF8toUTF16
ConvertUTF8toUTF32
crypt_base64_decode
crypt_base64_encode
crypt_blowfish_create
crypt_blowfish_decrypt
crypt_blowfish_destroy
crypt_blowfish_encrypt
crypt_blowfish_init
crypt_md5_create
crypt_md5_destroy
crypt_md5_done
crypt_md5_init
crypt_md5_process
crypt_sha1_create
crypt_sha1_destroy
crypt_sha1_done
crypt_sha1_init
crypt_sha1_process
isLegalUTF8Sequence
ksl_get_logger
ksl_get_logger_level
ksl_set_log_dir
ksl_set_logger_level
ksl_write_log
minidump_creator_check
minidump_creator_init
minizip_add_item
minizip_close
minizip_init
minizip_open
minizip_unz_close
minizip_unz_extract
minizip_unz_open

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kkuninst.exe
.exe windows:5 windows x86 arch:x86

d543c051ec15fceba96a1305aed3631f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4d:43:5e:fc:f4:f3:03:0d:9e:dc:d8:93:e3:aa:24:d0:63:85:98:46
Signer

Actual PE Digest

4d:43:5e:fc:f4:f3:03:0d:9e:dc:d8:93:e3:aa:24:d0:63:85:98:46

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipCreateCachedBitmap
GdipDeleteCachedBitmap
GdipDrawImageRectI
GdipFillRectangleI
GdipDrawRectangleI
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipCreatePen1
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipAlloc
GdipDrawImageRectRectI
GdiplusStartup
GdiplusShutdown
GdipBitmapGetPixel
GdipCloneBitmapAreaI
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipFree

wininet

HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetCrackUrlW
HttpQueryInfoA
InternetOpenUrlA
InternetSetOptionExA
InternetOpenA
InternetCloseHandle

kernel32

GlobalUnlock
GlobalLock
GlobalAlloc
LoadResource
SizeofResource
FindResourceW
GetTickCount
lstrlenW
LockResource
FindResourceExW
GetVersion
GetModuleFileNameW
LocalFree
LocalAlloc
CreateEventW
GlobalFree
MulDiv
ResumeThread
WaitForSingleObject
ResetEvent
SetEvent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetCurrentThreadId
RaiseException
FlushInstructionCache
GetCurrentProcess
lstrcmpW
InterlockedIncrement
InterlockedDecrement
SetLastError
GlobalHandle
GetModuleHandleW
FreeLibrary
LoadLibraryExW
lstrcmpiW
GetLongPathNameW
GetFullPathNameW
GetCommandLineW
GetCurrentProcessId
QueryPerformanceCounter
FreeResource
FreeEnvironmentStringsW
IsValidCodePage
RemoveDirectoryW
GetACP
GetModuleFileNameA
WriteFile
HeapCreate
GetTimeZoneInformation
SetFilePointer
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ReadFile
GetModuleHandleA
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
LCMapStringW
LCMapStringA
GetCPInfo
GetStartupInfoW
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
GetSystemTimeAsFileTime
InterlockedExchange
WideCharToMultiByte
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetEnvironmentStringsW
MultiByteToWideChar
GetVersionExA
DeviceIoControl
lstrcpynA
GetFileAttributesW
SetFileAttributesW
DeleteFileW
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
lstrlenA
FindFirstFileW
CreateDirectoryW
MoveFileExW
Sleep
CopyFileW
GetLastError
OutputDebugStringW
CreateFileW
GetFileTime
CloseHandle
InitializeCriticalSectionAndSpinCount
SetFileTime
FindNextFileW
FindClose
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetOEMCP

user32

MapDialogRect
ShowWindow
UnregisterClassA
ScreenToClient
InvalidateRect
GetWindowRect
SetWindowRgn
GetCursorPos
SetTimer
PostMessageW
KillTimer
GetSystemMetrics
SetWindowContextHelpId
GetParent
InflateRect
BeginPaint
EndPaint
EndDialog
wsprintfW
LoadImageW
SystemParametersInfoW
SetForegroundWindow
DialogBoxIndirectParamW
GetDlgItem
InvalidateRgn
SetCapture
MoveWindow
CreateAcceleratorTableW
GetDesktopWindow
CharNextW
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
IsWindowVisible
GetClassNameW
RedrawWindow
IsWindow
IsChild
SetFocus
GetFocus
PtInRect
GetSysColor
DestroyCursor
DrawFocusRect
GetWindow
DestroyAcceleratorTable
SetWindowTextW
RegisterWindowMessageW
GetClassInfoExW
RegisterClassExW
DestroyWindow
GetActiveWindow
GetUpdateRect
CopyRect
ReleaseDC
SetRect
FillRect
FrameRect
GetWindowTextLengthW
LoadBitmapW
CallWindowProcW
GetWindowLongW
SetWindowLongW
GetDlgCtrlID
IsWindowEnabled
GetDC
GetClientRect
SetWindowPos
GetWindowTextW
CreateWindowExW
DrawEdge
DrawTextW
DefWindowProcW
SendMessageW
SetCursor
LoadCursorW
ReleaseCapture
ClientToScreen
GetCapture
WindowFromPoint

gdi32

LineTo
MoveToEx
CreateCompatibleBitmap
SelectClipRgn
StretchBlt
CreateCompatibleDC
SetBkColor
GetTextMetricsW
ExtTextOutW
SetTextColor
SetBkMode
SelectObject
GetPixel
BitBlt
GetObjectW
DeleteDC
DeleteObject
CreateRectRgn
CreateDIBSection
GetStockObject
CreatePen
CreateSolidBrush
SetRectRgn
CreateFontIndirectW
GetDeviceCaps
SaveDC
RestoreDC
SetViewportOrgEx
CreateBitmap
CombineRgn

advapi32

SetEntriesInAclW
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetValueExW
RegQueryValueExW
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
RegQueryValueA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
AllocateAndInitializeSid

shell32

ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteW

ole32

CoUninitialize
CoInitialize
OleUninitialize
OleInitialize
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
StringFromGUID2
CoCreateGuid
CoSetProxyBlanket
CoInitializeEx
OleRun
CoTaskMemAlloc
OleLockRunning
CoTaskMemFree
CoTaskMemRealloc
CreateStreamOnHGlobal

oleaut32

SysStringLen
SysAllocString
VariantInit
VariantClear
SysAllocStringLen
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
DispCallFunc
SysFreeString
OleLoadPicture
OleCreateFontIndirect
SysAllocStringByteLen
SysStringByteLen
VariantChangeType

shlwapi

PathFileExistsW
PathAppendW
SHCreateStreamOnFileW
PathRemoveArgsW

comctl32

InitCommonControlsEx
_TrackMouseEvent

msimg32

GradientFill
TransparentBlt

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

iphlpapi

GetAdaptersInfo

Exports

Exports

?GenUUID@@YAHPADPAH@Z

Sections

.text
Size: 339KB - Virtual size: 338KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
kkupd.exe
.exe windows:5 windows x86 arch:x86

25f4f616c842ce63e1296da2b0be08be

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b0:b6:83:94:a7:b5:bc:ac:41:55:f8:a2:81:d4:e4:81:95:4c:4e:5b
Signer

Actual PE Digest

b0:b6:83:94:a7:b5:bc:ac:41:55:f8:a2:81:d4:e4:81:95:4c:4e:5b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\kkbuild\hudson\jobs\kk\workspace\coding\kkupdate\Product\Release\dbginfo\kkupd.pdb

Imports

kernel32

lstrcmpW
OpenEventW
CreateThread
ResumeThread
CreateFileW
ReadFile
lstrlenA
SetEvent
CompareStringW
lstrcpyW
CreateMutexA
ReleaseMutex
OpenProcess
GetCurrentProcessId
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
LocalFree
CreateEventW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
lstrlenW
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
GetCurrentProcess
GetVersionExA
DeviceIoControl
GetVersion
lstrcpynA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEndOfFile
FlushFileBuffers
SetStdHandle
GetPrivateProfileStringA
GetConsoleCP
SetFilePointer
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
MulDiv
GetTickCount
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
ExitProcess
GetStartupInfoA
GetFileType
SetHandleCount
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
WriteFile
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileAttributesW
GetSystemTimeAsFileTime
ExitThread
InterlockedExchange
WideCharToMultiByte
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
GlobalLock
GlobalUnlock
FlushInstructionCache
LockResource
GlobalAlloc
GlobalFree
GlobalHandle
SetLastError
OutputDebugStringW
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryExW
Sleep
SetThreadPriority
CreateProcessW
GetStartupInfoW
FreeLibrary
TerminateThread
WaitForSingleObject
GetLastError
LoadLibraryW
GetModuleFileNameW
CloseHandle
GetFileSize
CreateFileA
GetModuleFileNameA
DeleteFileA
InterlockedCompareExchange
FindResourceW
GetLocalTime
GetModuleHandleW
GetConsoleMode
GetModuleHandleA

user32

PeekMessageW
DefWindowProcW
UnregisterClassA
DestroyWindow
CreateDialogIndirectParamW
RegisterClassExW
LoadCursorW
SetWindowLongW
GetWindowLongW
GetMessageW
DispatchMessageW
CharNextW
GetSystemMetrics
LoadImageW
DestroyAcceleratorTable
ReleaseDC
GetDC
InvalidateRect
GetDesktopWindow
PostMessageW
TranslateMessage
WindowFromPoint
GetWindowThreadProcessId
EnumWindows
GetPropW
IsWindowEnabled
DrawFocusRect
SetCursor
GetCapture
GetDlgCtrlID
GetCursorPos
PtInRect
UpdateWindow
DrawTextW
OffsetRect
SetRectEmpty
SystemParametersInfoW
ShowWindow
EnableWindow
PostQuitMessage
IsWindowVisible
KillTimer
SetTimer
SetPropW
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
MapWindowPoints
MapDialogRect
SetWindowContextHelpId
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
BeginPaint
EndPaint
IsChild
GetFocus
SetFocus
GetWindow
GetDlgItem
SendMessageW
IsWindow
GetClassNameW
GetSysColor
SetWindowPos
RedrawWindow
GetClassInfoExW
CreateWindowExW
CreateAcceleratorTableW
ClientToScreen
GetParent
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
FillRect
GetClientRect
InvalidateRgn
CallWindowProcW

gdi32

CreateCompatibleBitmap
SetBkMode
SetTextColor
CreateFontIndirectW
CreateFontW
CreateSolidBrush
CreateCompatibleDC
GetDeviceCaps
SelectObject
DeleteObject
BitBlt
DeleteDC
GetStockObject
GetObjectW

advapi32

LookupPrivilegeValueW
SetEntriesInAclA
SetSecurityInfo
CreateProcessAsUserW
DuplicateTokenEx
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
GetSecurityInfo

shell32

ShellExecuteW
CommandLineToArgvW
ShellExecuteExW
Shell_NotifyIconW

ole32

OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
CoCreateGuid
CoSetProxyBlanket
CoInitializeEx
OleRun
OleUninitialize
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

VariantChangeType
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VariantInit
VariantClear
LoadTypeLi
LoadRegTypeLi
SysStringLen
OleCreateFontIndirect
SysAllocString
VarUI4FromStr
SysFreeString

shlwapi

PathRemoveFileSpecW

comctl32

_TrackMouseEvent
InitCommonControlsEx

wininet

InternetCloseHandle
HttpQueryInfoA
InternetOpenUrlA
InternetSetOptionExA
InternetOpenA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

psapi

GetModuleFileNameExW
GetProcessImageFileNameW
EnumProcesses
EnumProcessModules

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

iphlpapi

GetAdaptersInfo

Exports

Exports

?GenUUID@@YAHPADPAH@Z

Sections

.text
Size: 217KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ksvs_setup.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:d9:04:31:3c:83:37:c1:c9:bb:1b:b2:6a:a9:68:62:a2:ab:4c:9b
Signer

Actual PE Digest

39:d9:04:31:3c:83:37:c1:c9:bb:1b:b2:6a:a9:68:62:a2:ab:4c:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/CheckKsvsSvcDLL.dll
.dll windows:5 windows x86 arch:x86

334f5a46e176e110a13c64201d7963a3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shlwapi

PathFileExistsA

kernel32

GetLastError
WaitForSingleObject
GetExitCodeProcess
lstrcpyA
GlobalFree
GetSystemInfo
GetVersionExA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CreateProcessA
TlsAlloc
HeapFree
HeapAlloc
RaiseException
RtlUnwind
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
LoadLibraryA
HeapSize
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
ReadFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
SetStdHandle
CloseHandle
WriteConsoleA

advapi32

RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyA

Exports

Exports

CheckCanInstall
CheckCanUninstall
CheckKsvsSvcNeedReboot
CheckKsvsSvcVersion
CheckOSVersion
CheckProcessorArch
RepairKsvsService

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
RtlUnwind
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP

Exports

Exports

KillProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

d83f71e61ee459ee63ca3e829966a9dc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
lstrcpyA
lstrcpynA
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
PeekNamedPipe
GetTickCount
CreateProcessA
GetStartupInfoA
CreatePipe
GetVersionExA
GetModuleHandleA
DeleteFileA
lstrcmpiA
lstrlenA
lstrcatA
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
GetProcAddress
GlobalLock
GetCurrentProcess

user32

SendMessageA
OemToCharBuffA
CharNextA
wsprintfA
CharPrevA
FindWindowExA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 410B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ksvsdrv.sys
.sys windows:5 windows x64 arch:x64

598ad283b59911c5096b1270f9c25fc4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bf:a8:a3:2d:6b:69:b4:d7:7e:bb:f4:ee:1b:a0:9c:e1:e1:8e:47:1b
Signer

Actual PE Digest

bf:a8:a3:2d:6b:69:b4:d7:7e:bb:f4:ee:1b:a0:9c:e1:e1:8e:47:1b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\kkbuild\hudson\jobs\ksvs\workspace\product\win32\ksvsdrv_64.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
PsSetCreateProcessNotifyRoutine
PsCreateSystemThread
ExAllocatePool
ZwClose
ExDeleteResourceLite
PsGetCurrentThreadId
ObfDereferenceObject
ExInitializeResourceLite
DbgPrint
wcslen
RtlVolumeDeviceToDosName
PsLookupProcessByProcessId
RtlAppendUnicodeStringToString
ObReferenceObjectByHandle
ZwOpenProcess
ObfReferenceObject
ZwOpenFile
ZwTerminateProcess
RtlInitUnicodeString
MmGetSystemRoutineAddress
ZwQueryValueKey
PsGetVersion
ZwOpenKey
ExAcquireResourceExclusiveLite
KeLeaveCriticalRegion
KeSetEvent
KeEnterCriticalRegion
KeDelayExecutionThread
ExAcquireResourceSharedLite
ExReleaseResourceLite
RtlCompareMemory
PsGetCurrentProcessId
IoGetLowerDeviceObject
IoDeleteSymbolicLink
IoAttachDeviceToDeviceStackSafe
IoDeleteDevice
wcsncpy
IoDetachDevice
IoGetAttachedDeviceReference
IoCreateSymbolicLink
IoCreateDevice
IoEnumerateDeviceObjectList
ZwDeleteValueKey
MmMapLockedPagesSpecifyCache
ZwEnumerateValueKey
IofCompleteRequest
RtlCompareUnicodeString
ZwEnumerateKey
ZwQueryKey
RtlDeleteElementGenericTableAvl
RtlInsertElementGenericTableAvl
ZwReadFile
RtlGetElementGenericTableAvl
ZwCreateFile
RtlIsGenericTableEmptyAvl
ZwQueryDirectoryFile
RtlInitializeGenericTableAvl
ZwQueryVolumeInformationFile
ZwWriteFile
RtlLookupElementGenericTableAvl
KeInitializeEvent
IoSetTopLevelIrp
KeWaitForSingleObject
MmCanFileBeTruncated
IoGetTopLevelIrp
KeWaitForMultipleObjects
IofCallDriver
ZwCreateKey
ZwSetValueKey
ObQueryNameString
IoIs32bitProcess
MmBuildMdlForNonPagedPool
IoFreeMdl
IoCreateFileSpecifyDeviceObjectHint
IoFreeIrp
IoAllocateIrp
IoAllocateMdl
ExGetPreviousMode
CmRegisterCallback
__C_specific_handler

Sections

.text
Size: 145KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.txt
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ksvsupd.exe
.exe windows:5 windows x86 arch:x86

79a984f62654a19228002f121931799b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b2:a6:f6:46:57:d8:ee:ed:ef:b5:dd:6a:b1:17:2c:47:d9:36:eb:c1
Signer

Actual PE Digest

b2:a6:f6:46:57:d8:ee:ed:ef:b5:dd:6a:b1:17:2c:47:d9:36:eb:c1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\kkbuild\hudson\jobs\ksvs\workspace\product\win32\ksvsupd.pdb

Imports

ws2_32

socket
__WSAFDIsSet
closesocket
ntohs
recv
getsockopt
htons
WSAGetLastError
select
send
setsockopt
inet_addr
inet_ntoa
WSAStartup
connect
gethostbyname
WSACleanup
ioctlsocket

kernel32

TerminateThread
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
InterlockedIncrement
SystemTimeToFileTime
MoveFileExW
FlushViewOfFile
SetFileTime
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
GetFileSizeEx
EnterCriticalSection
CreateFileMappingW
GetSystemInfo
DeleteCriticalSection
ReadFile
SetFilePointerEx
CreateThread
FileTimeToSystemTime
GetFileInformationByHandle
CreateDirectoryW
SetConsoleCtrlHandler
AllocConsole
GetCommandLineW
GetTickCount
Sleep
GetExitCodeProcess
CreateProcessW
OutputDebugStringA
CreateEventW
GetCurrentThread
GetCurrentProcess
LoadLibraryW
FreeLibrary
GetProcAddress
WaitForSingleObject
SetEvent
DeleteFileW
CloseHandle
CreateFileW
LocalFree
LocalAlloc
GetLastError
GetModuleFileNameW
LoadLibraryA
GetLocaleInfoW
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetProcessHeap
SetStdHandle
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
WriteConsoleW
GetConsoleOutputCP
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleCP
CreateFileA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
GetModuleFileNameA
GetStdHandle
ExitProcess
IsValidCodePage
GetOEMCP
InterlockedDecrement
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetStartupInfoW
MultiByteToWideChar
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetACP
WriteConsoleA

advapi32

RegCreateKeyExA
StartServiceCtrlDispatcherW
RegisterEventSourceW
RegisterServiceCtrlHandlerW
ReportEventW
QueryServiceStatusEx
DeregisterEventSource
QueryServiceStatus
SetServiceStatus
GetTokenInformation
OpenThreadToken
OpenProcessToken
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
CopySid
GetLengthSid
IsValidSid
RegDeleteKeyW
InitializeSecurityDescriptor
QueryServiceConfigW
DeleteService
ControlService
OpenServiceW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyW
RegQueryValueExA

shell32

CommandLineToArgvW

ole32

CoInitializeEx
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject
CoInitializeSecurity

shlwapi

PathFileExistsW

wtsapi32

WTSSendMessageW

rpcrt4

UuidToStringW
RpcStringFreeW

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
server_list.dat
update/ksvsupd.exe
.exe windows:5 windows x86 arch:x86

79a984f62654a19228002f121931799b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b2:a6:f6:46:57:d8:ee:ed:ef:b5:dd:6a:b1:17:2c:47:d9:36:eb:c1
Signer

Actual PE Digest

b2:a6:f6:46:57:d8:ee:ed:ef:b5:dd:6a:b1:17:2c:47:d9:36:eb:c1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\kkbuild\hudson\jobs\ksvs\workspace\product\win32\ksvsupd.pdb

Imports

ws2_32

socket
__WSAFDIsSet
closesocket
ntohs
recv
getsockopt
htons
WSAGetLastError
select
send
setsockopt
inet_addr
inet_ntoa
WSAStartup
connect
gethostbyname
WSACleanup
ioctlsocket

kernel32

TerminateThread
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
InterlockedIncrement
SystemTimeToFileTime
MoveFileExW
FlushViewOfFile
SetFileTime
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
GetFileSizeEx
EnterCriticalSection
CreateFileMappingW
GetSystemInfo
DeleteCriticalSection
ReadFile
SetFilePointerEx
CreateThread
FileTimeToSystemTime
GetFileInformationByHandle
CreateDirectoryW
SetConsoleCtrlHandler
AllocConsole
GetCommandLineW
GetTickCount
Sleep
GetExitCodeProcess
CreateProcessW
OutputDebugStringA
CreateEventW
GetCurrentThread
GetCurrentProcess
LoadLibraryW
FreeLibrary
GetProcAddress
WaitForSingleObject
SetEvent
DeleteFileW
CloseHandle
CreateFileW
LocalFree
LocalAlloc
GetLastError
GetModuleFileNameW
LoadLibraryA
GetLocaleInfoW
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetProcessHeap
SetStdHandle
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
WriteConsoleW
GetConsoleOutputCP
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleCP
CreateFileA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
GetModuleFileNameA
GetStdHandle
ExitProcess
IsValidCodePage
GetOEMCP
InterlockedDecrement
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetStartupInfoW
MultiByteToWideChar
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetACP
WriteConsoleA

advapi32

RegCreateKeyExA
StartServiceCtrlDispatcherW
RegisterEventSourceW
RegisterServiceCtrlHandlerW
ReportEventW
QueryServiceStatusEx
DeregisterEventSource
QueryServiceStatus
SetServiceStatus
GetTokenInformation
OpenThreadToken
OpenProcessToken
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
CopySid
GetLengthSid
IsValidSid
RegDeleteKeyW
InitializeSecurityDescriptor
QueryServiceConfigW
DeleteService
ControlService
OpenServiceW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyW
RegQueryValueExA

shell32

CommandLineToArgvW

ole32

CoInitializeEx
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject
CoInitializeSecurity

shlwapi

PathFileExistsW

wtsapi32

WTSSendMessageW

rpcrt4

UuidToStringW
RpcStringFreeW

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ksvsclient.dll
.dll windows:5 windows x86 arch:x86

8fb4dd1fad71cc2711a8a5b2a24cc6f5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3e:96:85:e0:54:57:ec:de:21:dc:69:04:78:22:0e:a5:0f:fd:3f:f5
Signer

Actual PE Digest

3e:96:85:e0:54:57:ec:de:21:dc:69:04:78:22:0e:a5:0f:fd:3f:f5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\KINGSOFT_DUBA\Build\Build_Src\kuaikuai\ksvs\product\win32\ksvsclient.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

Sleep
GetTickCount
GetLastError
OutputDebugStringA
DisableThreadLibraryCalls
ReadFile
TlsAlloc
FlushFileBuffers
CloseHandle
CreateFileA
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
RaiseException
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
HeapSize
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

advapi32

RegCloseKey
RegDeleteValueW
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
StartServiceW
CloseServiceHandle
QueryServiceStatus
RegOpenKeyW
RegQueryValueExW
OpenSCManagerW
OpenServiceW

ole32

CoGetClassObject
CoCreateInstance

oleaut32

SysAllocString

Exports

Exports

checkKsvsVersion
getComponentPath
ksvsGetService
ksvsVersion
regApp

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libcurl.dll
.dll windows:5 windows x86 arch:x86

bdd8f294be92a3d6c2b6221763f7c002

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

recvfrom
sendto
send
select
__WSAFDIsSet
WSASetLastError
gethostbyname
listen
accept
WSAStartup
WSACleanup
recv
socket
connect
closesocket
setsockopt
getsockopt
htons
bind
ntohs
getsockname
WSAGetLastError
ioctlsocket

wldap32

ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord32
ord35
ord79
ord200
ord33
ord301
ord27
ord41
ord46

kernel32

GetFileInformationByHandle
HeapSize
GetProcessHeap
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
FlushFileBuffers
GetModuleHandleA
MultiByteToWideChar
GetCurrentDirectoryA
GetFullPathNameA
SetStdHandle
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetModuleFileNameA
WriteFile
SleepEx
ExpandEnvironmentStringsA
CloseHandle
DuplicateHandle
GetCurrentProcess
WaitForSingleObject
ReleaseMutex
SetEvent
WaitForMultipleObjects
CreateEventA
CreateMutexA
SetLastError
GetExitCodeThread
TerminateThread
GetLastError
Sleep
FormatMessageA
ReadFile
PeekNamedPipe
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
HeapReAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
SetFilePointer
FindClose
GetDriveTypeA
FindFirstFileA
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
RtlUnwind
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libexpatw.dll
.dll windows:4 windows x86 arch:x86

027cf8b153bfc3407e39f0badac4f27d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
HeapFree
HeapReAlloc
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapSize
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Exports

Exports

XML_DefaultCurrent
XML_ErrorString
XML_ExpatVersion
XML_ExpatVersionInfo
XML_ExternalEntityParserCreate
XML_FreeContentModel
XML_GetBase
XML_GetBuffer
XML_GetCurrentByteCount
XML_GetCurrentByteIndex
XML_GetCurrentColumnNumber
XML_GetCurrentLineNumber
XML_GetErrorCode
XML_GetFeatureList
XML_GetIdAttributeIndex
XML_GetInputContext
XML_GetParsingStatus
XML_GetSpecifiedAttributeCount
XML_MemFree
XML_MemMalloc
XML_MemRealloc
XML_Parse
XML_ParseBuffer
XML_ParserCreate
XML_ParserCreateNS
XML_ParserCreate_MM
XML_ParserFree
XML_ParserReset
XML_ResumeParser
XML_SetAttlistDeclHandler
XML_SetBase
XML_SetCdataSectionHandler
XML_SetCharacterDataHandler
XML_SetCommentHandler
XML_SetDefaultHandler
XML_SetDefaultHandlerExpand
XML_SetDoctypeDeclHandler
XML_SetElementDeclHandler
XML_SetElementHandler
XML_SetEncoding
XML_SetEndCdataSectionHandler
XML_SetEndDoctypeDeclHandler
XML_SetEndElementHandler
XML_SetEndNamespaceDeclHandler
XML_SetEntityDeclHandler
XML_SetExternalEntityRefHandler
XML_SetExternalEntityRefHandlerArg
XML_SetNamespaceDeclHandler
XML_SetNotStandaloneHandler
XML_SetNotationDeclHandler
XML_SetParamEntityParsing
XML_SetProcessingInstructionHandler
XML_SetReturnNSTriplet
XML_SetSkippedEntityHandler
XML_SetStartCdataSectionHandler
XML_SetStartDoctypeDeclHandler
XML_SetStartElementHandler
XML_SetStartNamespaceDeclHandler
XML_SetUnknownEncodingHandler
XML_SetUnparsedEntityDeclHandler
XML_SetUserData
XML_SetXmlDeclHandler
XML_StopParser
XML_UseForeignDTD
XML_UseParserAsHandlerArg

Sections

.text
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
license.txt
pops/skin/pop1/bg.png
.png
pops/skin/pop1/close_down.png
.png
pops/skin/pop1/close_hover.png
.png
pops/skin/pop1/close_normal.png
.png
pops/skin/pop1/skin.ini
pops/skin/pop2/bg.png
.png
pops/skin/pop2/close_down.png
.png
pops/skin/pop2/close_hover.png
.png
pops/skin/pop2/close_normal.png
.png
pops/skin/pop2/skin.ini
pops/skin/pop3/close_down.png
.png
pops/skin/pop3/close_hover.png
.png
pops/skin/pop3/close_normal.png
.png
pops/skin/pop3/icon.png
.png
pops/skin/pop3/skin.ini
pops/skin/pop3/title.png
.png
ressrc/chs/kislive.dat
ressrc/chs/kkupd.svr
skin/skin1/ver1/about_bar.bmp
skin/skin1/ver1/acc_repair/3rdtool.png
.png
skin/skin1/ver1/acc_repair/bg.png
.png
skin/skin1/ver1/acc_repair/close_down.png
.png
skin/skin1/ver1/acc_repair/close_hover.png
.png
skin/skin1/ver1/acc_repair/close_normal.png
.png
skin/skin1/ver1/acc_repair/repair_down.png
.png
skin/skin1/ver1/acc_repair/repair_hover.png
.png
skin/skin1/ver1/acc_repair/repair_normal.png
.png
skin/skin1/ver1/acc_repair/warning.png
.png
skin/skin1/ver1/bg/bg_bottom_left.png
.png
skin/skin1/ver1/bg/bg_bottom_middle.png
.png
skin/skin1/ver1/bg/bg_bottom_right.png
.png
skin/skin1/ver1/bg/bg_left_bottom.png
.png
skin/skin1/ver1/bg/bg_left_middle.png
.png
skin/skin1/ver1/bg/bg_left_top.png
.png
skin/skin1/ver1/bg/bg_right_bottom.png
.png
skin/skin1/ver1/bg/bg_right_middle.png
.png
skin/skin1/ver1/bg/bg_right_top.png
.png
skin/skin1/ver1/bg/bg_top_left.png
.png
skin/skin1/ver1/bg/bg_top_middle.png
.png
skin/skin1/ver1/bg/bg_top_right.png
.png
skin/skin1/ver1/bg/bottom_spe_line.png
.png
skin/skin1/ver1/bg/dlg_title.png
.png
skin/skin1/ver1/bg/dlg_title2.png
.png
skin/skin1/ver1/bg/kdou.png
.png
skin/skin1/ver1/bg/main_subtab_bg.png
.png
skin/skin1/ver1/bg/main_subtab_bg2.png
.png
skin/skin1/ver1/bg/main_subtab_hover.png
.png
skin/skin1/ver1/bg/main_subtab_normal.png
.png
skin/skin1/ver1/bg/main_subtab_select.png
.png
skin/skin1/ver1/bg/maintip_hover_close.png
.png
skin/skin1/ver1/bg/maintip_normal_close.png
.png
skin/skin1/ver1/bg/message_down_left.png
.png
skin/skin1/ver1/bg/message_down_middle.png
.png
skin/skin1/ver1/bg/message_down_right.png
.png
skin/skin1/ver1/bg/message_hover_left.png
.png
skin/skin1/ver1/bg/message_hover_middle.png
.png
skin/skin1/ver1/bg/message_hover_right.png
.png
skin/skin1/ver1/bg/message_normal_left.png
.png
skin/skin1/ver1/bg/message_normal_middle.png
.png
skin/skin1/ver1/bg/message_normal_right.png
.png
skin/skin1/ver1/bg/notice.png
.png
skin/skin1/ver1/bg/notice_bg.png
.png
skin/skin1/ver1/bg/search_left.png
.png
skin/skin1/ver1/bg/search_middle.png
.png
skin/skin1/ver1/bg/search_right.png
.png
skin/skin1/ver1/bg/spe_line.png
.png
skin/skin1/ver1/bg/unlogin_icon.png
.png
skin/skin1/ver1/bg/user_face.png
.png
skin/skin1/ver1/bg/user_face_bg.png
.png
skin/skin1/ver1/bg/user_face_bg_hover.png
.png
skin/skin1/ver1/btn/btn_broadcast_down.png
.png
skin/skin1/ver1/btn/btn_broadcast_hover.png
.png
skin/skin1/ver1/btn/btn_broadcast_normal.png
.png
skin/skin1/ver1/btn/btn_close_down.png
.png
skin/skin1/ver1/btn/btn_close_hover.png
.png
skin/skin1/ver1/btn/btn_close_normal.png
.png
skin/skin1/ver1/btn/btn_disable_sound_down.png
.png
skin/skin1/ver1/btn/btn_disable_sound_hover.png
.png
skin/skin1/ver1/btn/btn_disable_sound_normal.png
.png
skin/skin1/ver1/btn/btn_download_mgr_down.png
.png
skin/skin1/ver1/btn/btn_download_mgr_hover.png
.png
skin/skin1/ver1/btn/btn_download_mgr_normal.png
.png
skin/skin1/ver1/btn/btn_enable_sound_down.png
.png
skin/skin1/ver1/btn/btn_enable_sound_hover.png
.png
skin/skin1/ver1/btn/btn_enable_sound_normal.png
.png
skin/skin1/ver1/btn/btn_feedback_down.png
.png
skin/skin1/ver1/btn/btn_feedback_hover.png
.png
skin/skin1/ver1/btn/btn_feedback_normal.png
.png
skin/skin1/ver1/btn/btn_login_down.png
.png
skin/skin1/ver1/btn/btn_login_hover.png
.png
skin/skin1/ver1/btn/btn_login_normal.png
.png
skin/skin1/ver1/btn/btn_max_down.png
.png
skin/skin1/ver1/btn/btn_max_hover.png
.png
skin/skin1/ver1/btn/btn_max_normal.png
.png
skin/skin1/ver1/btn/btn_menu_down.png
.png
skin/skin1/ver1/btn/btn_menu_hover.png
.png
skin/skin1/ver1/btn/btn_menu_normal.png
.png
skin/skin1/ver1/btn/btn_min_down.png
.png
skin/skin1/ver1/btn/btn_min_hover.png
.png
skin/skin1/ver1/btn/btn_min_normal.png
.png
skin/skin1/ver1/btn/btn_nodownload_mgr_down.png
.png
skin/skin1/ver1/btn/btn_nodownload_mgr_hover.png
.png
skin/skin1/ver1/btn/btn_nodownload_mgr_normal.png
.png
skin/skin1/ver1/btn/btn_pay_down.png
.png
skin/skin1/ver1/btn/btn_pay_hover.png
.png
skin/skin1/ver1/btn/btn_pay_normal.png
.png
skin/skin1/ver1/btn/btn_register_down.png
.png
skin/skin1/ver1/btn/btn_register_hover.png
.png
skin/skin1/ver1/btn/btn_register_normal.png
.png
skin/skin1/ver1/btn/btn_reset_down.png
.png
skin/skin1/ver1/btn/btn_reset_hover.png
.png
skin/skin1/ver1/btn/btn_reset_normal.png
.png
skin/skin1/ver1/btn/btn_restore_down.png
.png
skin/skin1/ver1/btn/btn_restore_hover.png
.png
skin/skin1/ver1/btn/btn_restore_normal.png
.png
skin/skin1/ver1/btn/btn_service_down.png
.png
skin/skin1/ver1/btn/btn_service_hover.png
.png
skin/skin1/ver1/btn/btn_service_normal.png
.png
skin/skin1/ver1/btn/btn_shop_down.png
.png
skin/skin1/ver1/btn/btn_shop_hover.png
.png
skin/skin1/ver1/btn/btn_shop_normal.png
.png
skin/skin1/ver1/btn/btn_size_fullscreen_down.png
.png
skin/skin1/ver1/btn/btn_size_fullscreen_hover.png
.png
skin/skin1/ver1/btn/btn_size_fullscreen_normal.png
.png
skin/skin1/ver1/btn/btn_unlogin_down.png
.png
skin/skin1/ver1/btn/btn_unlogin_hover.png
.png
skin/skin1/ver1/btn/btn_unlogin_normal.png
.png
skin/skin1/ver1/btn/green_btn_down.png
.png
skin/skin1/ver1/btn/green_btn_hover.png
.png
skin/skin1/ver1/btn/green_btn_normal.png
.png
skin/skin1/ver1/common_bg_bottom_left.bmp
skin/skin1/ver1/common_bg_bottom_middle.bmp
skin/skin1/ver1/common_bg_bottom_right.bmp
skin/skin1/ver1/common_bg_middle_left.bmp
skin/skin1/ver1/common_bg_middle_middle.bmp
skin/skin1/ver1/common_bg_middle_right.bmp
skin/skin1/ver1/common_bg_top_left.bmp
skin/skin1/ver1/common_bg_top_middle.bmp
skin/skin1/ver1/common_bg_top_right.bmp
skin/skin1/ver1/common_btn_down.bmp
skin/skin1/ver1/common_btn_hover.bmp
skin/skin1/ver1/common_btn_normal.bmp
skin/skin1/ver1/common_close_down.bmp
skin/skin1/ver1/common_close_hover.bmp
skin/skin1/ver1/common_close_normal.bmp
skin/skin1/ver1/depins_bg.png
.png
skin/skin1/ver1/depins_cancel_disable.png
.png
skin/skin1/ver1/depins_cancel_down.png
.png
skin/skin1/ver1/depins_cancel_hover.png
.png
skin/skin1/ver1/depins_cancel_normal.png
.png
skin/skin1/ver1/depins_continue_disable.png
.png
skin/skin1/ver1/depins_continue_down.png
.png
skin/skin1/ver1/depins_continue_hover.png
.png
skin/skin1/ver1/depins_continue_normal.png
.png
skin/skin1/ver1/depins_ignore_disable.png
.png
skin/skin1/ver1/depins_ignore_down.png
.png
skin/skin1/ver1/depins_ignore_hover.png
.png
skin/skin1/ver1/depins_ignore_normal.png
.png
skin/skin1/ver1/depins_repair_down.png
.png
skin/skin1/ver1/depins_repair_hover.png
.png
skin/skin1/ver1/depins_repair_normal.png
.png
skin/skin1/ver1/kk_msgbox_bg.png
.png
skin/skin1/ver1/kk_msgbox_no_down.png
.png
skin/skin1/ver1/kk_msgbox_no_hover.png
.png
skin/skin1/ver1/kk_msgbox_no_normal.png
.png
skin/skin1/ver1/kk_msgbox_warning.png
.png
skin/skin1/ver1/kk_msgbox_yes_down.png
.png
skin/skin1/ver1/kk_msgbox_yes_hover.png
.png
skin/skin1/ver1/kk_msgbox_yes_normal.png
.png
skin/skin1/ver1/kkfile.png
.png
skin/skin1/ver1/msgbeforerun/msgbeforerun_bg.png
.png
skin/skin1/ver1/msgbeforerun/msgbeforerun_cancel_down.png
.png
skin/skin1/ver1/msgbeforerun/msgbeforerun_cancel_hover.png
.png
skin/skin1/ver1/msgbeforerun/msgbeforerun_cancel_normal.png
.png
skin/skin1/ver1/msgbeforerun/msgbeforerun_close_down.png
.png
skin/skin1/ver1/msgbeforerun/msgbeforerun_close_hover.png
.png
skin/skin1/ver1/msgbeforerun/msgbeforerun_close_normal.png
.png
skin/skin1/ver1/msgbeforerun/msgbeforerun_continue_down.png
.png
skin/skin1/ver1/msgbeforerun/msgbeforerun_continue_hover.png
.png
skin/skin1/ver1/msgbeforerun/msgbeforerun_continue_normal.png
.png
skin/skin1/ver1/netest/bg.png
.png
skin/skin1/ver1/netest/cancel_hover.png
.png
skin/skin1/ver1/netest/cancel_normal.png
.png
skin/skin1/ver1/netest/cancel_select.png
.png
skin/skin1/ver1/netest/close_hover.png
.png
skin/skin1/ver1/netest/close_normal.png
.png
skin/skin1/ver1/netest/close_select.png
.png
skin/skin1/ver1/netest/exit_hover.png
.png
skin/skin1/ver1/netest/exit_normal.png
.png
skin/skin1/ver1/netest/exit_select.png
.png
skin/skin1/ver1/netest/icon_ask.png
.png
skin/skin1/ver1/netest/icon_error.png
.png
skin/skin1/ver1/netest/icon_link.png
.png
skin/skin1/ver1/netest/icon_slow.png
.png
skin/skin1/ver1/netest/icon_suggest.png
.png
skin/skin1/ver1/netest/icon_tip.png
.png
skin/skin1/ver1/netest/icon_well.png
.png
skin/skin1/ver1/netest/loading_bg.png
.png
skin/skin1/ver1/netest/loading_scroll.png
.png
skin/skin1/ver1/netest/restart_hover.png
.png
skin/skin1/ver1/netest/restart_normal.png
.png
skin/skin1/ver1/netest/restart_select.png
.png
skin/skin1/ver1/netest/speed_ruler.png
.png
skin/skin1/ver1/netest/start_hover.png
.png
skin/skin1/ver1/netest/start_normal.png
.png
skin/skin1/ver1/netest/start_select.png
.png
skin/skin1/ver1/oem/14_1/bg_top_left.png
.png
skin/skin1/ver1/oem/14_2/bg_top_left.png
.png
skin/skin1/ver1/skin.ini
skin/skin1/ver1/tab/btn_multipletablist_hover.png
.png
skin/skin1/ver1/tab/btn_multipletablist_normal.png
.png
skin/skin1/ver1/tab/btn_multipletablist_select.png
.png
skin/skin1/ver1/tab/game_multiple_hover_left.png
.png
skin/skin1/ver1/tab/game_multiple_hover_middle.png
.png
skin/skin1/ver1/tab/game_multiple_hover_right.png
.png
skin/skin1/ver1/tab/game_multiple_normal_left.png
.png
skin/skin1/ver1/tab/game_multiple_normal_middle.png
.png
skin/skin1/ver1/tab/game_multiple_normal_right.png
.png
skin/skin1/ver1/tab/game_multiple_select_left.png
.png
skin/skin1/ver1/tab/game_multiple_select_middle.png
.png
skin/skin1/ver1/tab/game_multiple_select_right.png
.png
skin/skin1/ver1/tab/tab_gamehall_hover.png
.png
skin/skin1/ver1/tab/tab_gamehall_normal.png
.png
skin/skin1/ver1/tab/tab_gamehall_select.png
.png
skin/skin1/ver1/tab/tab_mygame_hover.png
.png
skin/skin1/ver1/tab/tab_mygame_normal.png
.png
skin/skin1/ver1/tab/tab_mygame_select.png
.png
skin/skin1/ver1/tab/tabblack_close_hover.png
.png
skin/skin1/ver1/tab/tabblack_close_normal.png
.png
skin/skin1/ver1/tab/tabblack_close_select.png
.png
skin/skin1/ver1/tab/tabwhite_close_hover.png
.png
skin/skin1/ver1/tab/tabwhite_close_normal.png
.png
skin/skin1/ver1/tab/tabwhite_close_select.png
.png
smrupd.dat
uninst.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Processes.dll
.dll windows:5 windows x86 arch:x86

eaa5f91829171a65db414b9e64ec9548

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
FreeLibrary
OpenProcess
CloseHandle
TerminateProcess
GlobalFree
lstrcpyA
FlushFileBuffers
CreateFileA
GetCurrentThreadId
GetCommandLineA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

GetDesktopWindow
FindWindowA
UpdateWindow
wsprintfA

Exports

Exports

FindDevice
FindProcess
KillProcess

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
update.cfg
updateinfo.txt
ver.ini
web/apps/depins/images/icon_status.gif
.gif
web/apps/depins/images/icon_warning.gif
.gif
web/apps/depins/images/progress.gif
.gif
web/apps/depins/index.html
.html .js polyglot
web/apps/depins/main.css
web/apps/depins/main.js
.js
web/apps/detail/gamedetail.js
.js
web/apps/detail/guangbo.css
web/apps/detail/guangbo.js
.js
web/apps/detail/images/arrow.gif
.gif
web/apps/detail/images/arrow_l.gif
.gif
web/apps/detail/images/bg.gif
.gif
web/apps/detail/images/big.cur
web/apps/detail/images/btn.gif
.gif
web/apps/detail/images/btn.jpg
.jpg
web/apps/detail/images/btn_bg.png
.png
web/apps/detail/images/btn_comment.gif
.gif
web/apps/detail/images/btn_comment_disable.gif
.gif
web/apps/detail/images/btn_download.png
.png
web/apps/detail/images/btn_run.png
.png
web/apps/detail/images/btn_run_pc.png
.png
web/apps/detail/images/btn_run_video.jpg
.jpg
web/apps/detail/images/btn_score.gif
.gif
web/apps/detail/images/btn_send.jpg
.jpg
web/apps/detail/images/cancel-hover.jpg
.jpg
web/apps/detail/images/cancel.jpg
.jpg
web/apps/detail/images/checkbox.jpg
.jpg
web/apps/detail/images/checked.jpg
.jpg
web/apps/detail/images/close-hover.jpg
.jpg
web/apps/detail/images/close.jpg
.jpg
web/apps/detail/images/close_2.jpg
.jpg
web/apps/detail/images/comment_bg_arrow.gif
.gif
web/apps/detail/images/comment_bg_bottom.gif
.gif
web/apps/detail/images/comment_bg_top.gif
.gif
web/apps/detail/images/confirm_btn.jpg
.jpg
web/apps/detail/images/detail_comment_bg.gif
.gif
web/apps/detail/images/file-hover.jpg
.jpg
web/apps/detail/images/file.jpg
.jpg
web/apps/detail/images/grey.gif
.gif
web/apps/detail/images/group_icon.gif
.gif
web/apps/detail/images/home-head.jpg
.jpg
web/apps/detail/images/icon.gif
.gif
web/apps/detail/images/icon_bg.jpg
.jpg
web/apps/detail/images/icon_close.gif
.gif
web/apps/detail/images/icon_img.gif
.gif
web/apps/detail/images/icon_keys.png
.png
web/apps/detail/images/icon_sns.gif
.gif
web/apps/detail/images/img_bg.gif
.gif
web/apps/detail/images/img_icon.gif
.gif
web/apps/detail/images/jiantou.gif
.gif
web/apps/detail/images/l_bg1.gif
web/apps/detail/images/l_bg2.gif
web/apps/detail/images/list_bg.gif
.gif
web/apps/detail/images/loading.gif
.gif
web/apps/detail/images/loading_tieba.gif
.gif
web/apps/detail/images/middletext.jpg
.jpg
web/apps/detail/images/nav_line.gif
.gif
web/apps/detail/images/rating.gif
.gif
web/apps/detail/images/s_arrow.gif
.gif
web/apps/detail/images/sanjiao.gif
.gif
web/apps/detail/images/small.cur
web/apps/detail/images/speed_title_bg.gif
.gif
web/apps/detail/images/status_bg.gif
.gif
web/apps/detail/images/tabs_bg.gif
.gif
web/apps/detail/images/talkcloud.gif
.gif
web/apps/detail/images/tip_bg.gif
.gif
web/apps/detail/images/title_bg.gif
.gif
web/apps/detail/images/topbg.jpg
.jpg
web/apps/detail/images/type_box.gif
.gif
web/apps/detail/images/ui-bg_flat_30_cccccc_40x100.png
.png
web/apps/detail/images/ui-bg_flat_50_5c5c5c_40x100.png
.png
web/apps/detail/images/ui-bg_glass_20_555555_1x400.png
.png
web/apps/detail/images/ui-bg_glass_40_0078a3_1x400.png
.png
web/apps/detail/images/ui-bg_glass_40_ffc73d_1x400.png
.png
web/apps/detail/images/ui-bg_gloss-wave_25_333333_500x100.png
.png
web/apps/detail/images/ui-bg_highlight-soft_80_eeeeee_1x100.png
.png
web/apps/detail/images/ui-bg_inset-soft_25_000000_1x100.png
.png
web/apps/detail/images/ui-bg_inset-soft_30_f58400_1x100.png
.png
web/apps/detail/images/ui-icons_cccccc_256x240.png
.png
web/apps/detail/images/ui-icons_ffffff_256x240.png
.png
web/apps/detail/images/video_txt_bg.gif
.gif
web/apps/detail/images/zf-hover.jpg
.jpg
web/apps/detail/images/zf.jpg
.jpg
web/apps/detail/images/zfgb.jpg
.jpg
web/apps/detail/jquery-ui-1.8.11.custom.slider.css
web/apps/detail/jquery-ui-1.8.11.custom.slider.js
.js
web/apps/detail/main.css
web/apps/detail/main.html
.js
web/apps/detail/main.js
.js
web/apps/detail/onlinegame.js
.js
web/apps/fav/favorites.js
.js
web/apps/fav/images/fav_btn_login.gif
.gif
web/apps/fav/images/fav_fail_bg.gif
.gif
web/apps/fav/images/fav_no_bg.gif
.gif
web/apps/fav/images/fav_nologin_bg.gif
.gif
web/apps/fav/images/hover.png
.png
web/apps/fav/main.css
web/apps/fav/main.html
web/apps/fav/main.js
.js
web/apps/feedback/images/status_bg.gif
.gif
web/apps/feedback/main.css
web/apps/feedback/main.html
web/apps/feedback/main.js
.js
web/apps/flashplayer/images/bar.gif
.gif
web/apps/flashplayer/images/bar_bg.gif
.gif
web/apps/flashplayer/images/bareffect.swf
web/apps/flashplayer/images/bg.gif
.gif
web/apps/flashplayer/images/blank.gif
.gif
web/apps/flashplayer/images/btn_close.gif
.gif
web/apps/flashplayer/images/dialog_btn.gif
.gif
web/apps/flashplayer/images/star.gif
.gif
web/apps/flashplayer/images/swfloader3.swf
web/apps/flashplayer/images/title_bg.gif
.gif
web/apps/flashplayer/main.css
web/apps/flashplayer/main.html
web/apps/flashplayer/main.js
.js
web/apps/flashplayer/player.js
.js
web/apps/gamelist/images/blank.gif
.gif
web/apps/gamelist/images/img_bg.gif
.gif
web/apps/gamelist/images/score.gif
.gif
web/apps/gamelist/main.css
web/apps/gamelist/main.html
web/apps/gamelist/main.js
.js
web/apps/gamestore/images/header_bg.gif
.gif
web/apps/gamestore/images/header_search.gif
.gif
web/apps/gamestore/images/header_tab.gif
.gif
web/apps/gamestore/images/header_tab_long.gif
.gif
web/apps/gamestore/images/status_bg.gif
.gif
web/apps/gamestore/main.css
web/apps/gamestore/main.html
web/apps/gamestore/main.js
.js
web/apps/hall/images/arrow.gif
.gif
web/apps/hall/images/btn.gif
.gif
web/apps/hall/images/btn_focus.gif
.gif
web/apps/hall/images/btn_home.gif
.gif
web/apps/hall/images/gamehall_bg.gif
.gif
web/apps/hall/images/hot.gif
.gif
web/apps/hall/images/img_bg.gif
.gif
web/apps/hall/images/img_error.gif
.gif
web/apps/hall/images/new.gif
.gif
web/apps/hall/images/star.gif
.gif
web/apps/hall/images/star_dark.gif
.gif
web/apps/hall/images/t_title_bg.png
.png
web/apps/hall/images/title_bg.gif
.gif
web/apps/hall/images/top1.png
.png
web/apps/hall/images/top2.png
.png
web/apps/hall/images/top3.png
.png
web/apps/hall/images/top_index_bg_1.png
.png
web/apps/hall/images/top_index_bg_2.png
.png
web/apps/hall/images/toplist_bg.gif
.gif
web/apps/hall/lobbygame.js
.js
web/apps/hall/lobbytree.js
.js
web/apps/hall/main.css
web/apps/hall/main.html
web/apps/hall/main.js
.js
web/apps/hall/topic.js
.js
web/apps/hardwarecheck/hardwarecheck.js
.js
web/apps/hardwarecheck/images/btn.gif
.gif
web/apps/hardwarecheck/images/icon.png
.png
web/apps/hardwarecheck/images/pass.jpg
.jpg
web/apps/hardwarecheck/images/sep_line.jpg
.jpg
web/apps/hardwarecheck/images/waiting.jpg
.jpg
web/apps/hardwarecheck/images/warning.jpg
.jpg
web/apps/hardwarecheck/main.css
web/apps/hardwarecheck/main.html
web/apps/hardwarecheck/main.js
.js
web/apps/homepage/images/button_bg.gif
.gif
web/apps/homepage/images/icon_kuaikuai.gif
.gif
web/apps/homepage/images/icon_warning.gif
.gif
web/apps/homepage/images/loading.gif
.gif
web/apps/homepage/main.css
web/apps/homepage/main.html
web/apps/homepage/main.js
.js
web/apps/homepage/offline.css
web/apps/homepage/offline.html
.html .js polyglot
web/apps/iknow/main.css
web/apps/iknow/main.html
web/apps/iknow/main.js
.js
web/apps/localgame/images/asc.gif
.gif
web/apps/localgame/images/btn.gif
.gif
web/apps/localgame/images/btn_addgame.png
.png
web/apps/localgame/images/btn_delete.gif
.gif
web/apps/localgame/images/btn_icon.gif
.gif
web/apps/localgame/images/btn_list.gif
.gif
web/apps/localgame/images/btn_select.gif
.gif
web/apps/localgame/images/desc.gif
.gif
web/apps/localgame/images/field_bg_active.gif
.gif
web/apps/localgame/images/field_bg_hover.gif
.gif
web/apps/localgame/images/header_bg.gif
.gif
web/apps/localgame/images/hover.gif
.gif
web/apps/localgame/images/icon_bg.gif
.gif
web/apps/localgame/images/icon_hint.gif
.gif
web/apps/localgame/images/item_bg.gif
.gif
web/apps/localgame/images/no-item.gif
.gif
web/apps/localgame/images/no_init.gif
.gif
web/apps/localgame/images/status_bg.gif
.gif
web/apps/localgame/localgame.js
.js
web/apps/localgame/main.css
web/apps/localgame/main.html
web/apps/localgame/main.js
.js
web/apps/manager2/images/block_bg.gif
.gif
web/apps/manager2/images/btn.gif
.gif
web/apps/manager2/images/cursor.gif
.gif
web/apps/manager2/images/dot.gif
.gif
web/apps/manager2/images/icon_bg.gif
.gif
web/apps/manager2/images/icon_default.gif
.gif
web/apps/manager2/images/loading.gif
.gif
web/apps/manager2/images/loading_bg.gif
.gif
web/apps/manager2/images/loading_scroll.gif
.gif
web/apps/manager2/images/no-games.gif
.gif
web/apps/manager2/images/progressing.gif
.gif
web/apps/manager2/images/status_bg.gif
.gif
web/apps/manager2/images/status_more.gif
.gif
web/apps/manager2/images/tip_bg.gif
.gif
web/apps/manager2/images/tip_s_bg.gif
.gif
web/apps/manager2/index.html
.html
web/apps/manager2/main.css
web/apps/manager2/main.js
.js
web/apps/online/main.css
web/apps/online/main.html
web/apps/online/main.js
.js
web/apps/partner/images/loading.gif
.gif
web/apps/partner/main.css
web/apps/partner/main.html
web/apps/partner/main.js
.js
web/apps/pop/images/bg.png
.png
web/apps/pop/images/btn.gif
.gif
web/apps/pop/index.html
.html .js polyglot
web/apps/pop/main.css
web/apps/pop/main.js
.js
web/apps/qipai/images/status_bg.gif
.gif
web/apps/qipai/main.css
web/apps/qipai/main.html
web/apps/qipai/main.js
.js
web/apps/qipai/qipai.js
.js
web/apps/recommend/images/btn.gif
.gif
web/apps/recommend/images/btn.jpg
.jpg
web/apps/recommend/images/btn_comment.gif
.gif
web/apps/recommend/images/btn_run.gif
.gif
web/apps/recommend/images/btn_tieba.gif
.gif
web/apps/recommend/images/editor_title_bg.gif
.gif
web/apps/recommend/images/error.gif
.gif
web/apps/recommend/images/group_icon.gif
.gif
web/apps/recommend/images/icon_question.png
.png
web/apps/recommend/images/icon_share.png
.png
web/apps/recommend/images/icon_sns.gif
.gif
web/apps/recommend/images/list_more_bg.jpg
.jpg
web/apps/recommend/images/list_more_icon.gif
.gif
web/apps/recommend/images/quest.gif
.gif
web/apps/recommend/images/star.gif
.gif
web/apps/recommend/images/status_bg.gif
.gif
web/apps/recommend/main.css
web/apps/recommend/main.html
web/apps/recommend/main.js
.js
web/apps/recommend/recommendlist.js
.js
web/apps/run/images/light.png
.png
web/apps/run/images/loading.gif
.gif
web/apps/run/main.css
web/apps/run/main.html
web/apps/run/main.js
.js
web/apps/run/regapp.js
.js
web/apps/run/runapp.js
.js
web/apps/save/images/loading1.gif
.gif
web/apps/save/images/save_bg.gif
.gif
web/apps/save/images/save_btn_login.gif
.gif
web/apps/save/images/save_done.gif
.gif
web/apps/save/images/save_down.gif
.gif
web/apps/save/images/save_down_icon.gif
.gif
web/apps/save/images/save_fail_bg.gif
.gif
web/apps/save/images/save_no_bg.gif
.gif
web/apps/save/images/save_nologin_bg.gif
.gif
web/apps/save/images/save_up_icon.gif
.gif
web/apps/save/images/save_upload.gif
.gif
web/apps/save/main.css
web/apps/save/main.html
web/apps/save/main.js
.js
web/apps/save/savelist.js
.js
web/apps/search/images/blank.gif
.gif
web/apps/search/images/btn.gif
.gif
web/apps/search/images/editor_title_bg.gif
.gif
web/apps/search/images/header_search.gif
.gif
web/apps/search/images/icon.gif
.gif
web/apps/search/images/img_bg.gif
.gif
web/apps/search/images/list_more_bg.gif
.gif
web/apps/search/images/list_more_icon.gif
.gif
web/apps/search/images/loading.gif
.gif
web/apps/search/images/search-btn.jpg
.jpg
web/apps/search/images/star.gif
.gif
web/apps/search/images/star_dark.gif
.gif
web/apps/search/images/status_bg.gif
.gif
web/apps/search/main.css
web/apps/search/main.html
web/apps/search/main.js
.js
web/apps/search/searchlist.js
.js
web/apps/startcover/images/bar.gif
.gif
web/apps/startcover/images/bar_bg.gif
.gif
web/apps/startcover/images/blank.gif
.gif
web/apps/startcover/images/btn.gif
.gif
web/apps/startcover/images/btn_close.gif
.gif
web/apps/startcover/images/cursor.gif
.gif
web/apps/startcover/images/editor_title_bg.gif
.gif
web/apps/startcover/images/load_bg.gif
.gif
web/apps/startcover/images/loading.gif
.gif
web/apps/startcover/images/ok.gif
.gif
web/apps/startcover/images/star.gif
.gif
web/apps/startcover/main.css
web/apps/startcover/main.html
web/apps/startcover/main.js
.js
web/apps/startcover/progress.js
.js
web/apps/startcover2/images/bg.gif
.gif
web/apps/startcover2/images/dot.gif
.gif
web/apps/startcover2/images/editor_btn_close.gif
.gif
web/apps/startcover2/images/editor_title_bg.gif
.gif
web/apps/startcover2/images/load_bg.gif
.gif
web/apps/startcover2/images/loading_bar.gif
.gif
web/apps/startcover2/images/loading_blue.gif
.gif
web/apps/startcover2/images/retry_btn.gif
.gif
web/apps/startcover2/images/retry_btn_abort.gif
.gif
web/apps/startcover2/images/run_btn.gif
.gif
web/apps/startcover2/images/star.gif
.gif
web/apps/startcover2/images/steps.gif
.gif
web/apps/startcover2/images/type_icons.gif
.gif
web/apps/startcover2/index.html
.html
web/apps/startcover2/main.css
web/apps/startcover2/main.js
.js
web/apps/uninstall/images/button.gif
.gif
web/apps/uninstall/images/disappear.gif
.gif
web/apps/uninstall/images/page3.jpg
.jpg
web/apps/uninstall/images/page4.jpg
.jpg
web/apps/uninstall/images/pic01.jpg
.jpg
web/apps/uninstall/images/pic02.jpg
.jpg
web/apps/uninstall/images/pic03.jpg
.jpg
web/apps/uninstall/images/pic04.jpg
.jpg
web/apps/uninstall/images/pic05.jpg
.jpg
web/apps/uninstall/images/pic06.jpg
.jpg
web/apps/uninstall/images/top1_left.jpg
.jpg
web/apps/uninstall/images/top2_left.jpg
.jpg
web/apps/uninstall/images/top3_left.jpg
.jpg
web/apps/uninstall/images/top4_left.jpg
.jpg
web/apps/uninstall/images/u0.gif
.gif
web/apps/uninstall/index.html
.html .js polyglot
web/apps/uninstall/page2.html
.html .js polyglot
web/apps/uninstall/page3.html
.html
web/apps/uninstall/page4.html
.html
web/apps/uninstall/page5.html
.html
web/apps/uninstall/style.css
web/apps/uninstall/uninstall.js
.js
web/apps/utilities/images/btn_download.png
.png
web/apps/utilities/images/icon_bg.gif
.gif
web/apps/utilities/images/item_bg.png
.png
web/apps/utilities/images/menu_item_bg.png
.png
web/apps/utilities/images/star.gif
.gif
web/apps/utilities/images/status_bg.gif
.gif
web/apps/utilities/main.css
web/apps/utilities/main.html
web/apps/utilities/main.js
.js
web/apps/utilities/utilities.js
.js
web/apps/webplayer/images/bg.gif
.gif
web/apps/webplayer/images/dialog_btn.gif
.gif
web/apps/webplayer/main.css
web/apps/webplayer/main.html
web/apps/webplayer/main.js
.js
web/apps/webplayer/player.js
.js
web/apps/webplayer/webgame.js
.js
web/apps/wizard/images/Q1.jpg
.jpg
web/apps/wizard/images/Q2.jpg
.jpg
web/apps/wizard/images/Q3.jpg
.jpg
web/apps/wizard/images/add.jpg
.jpg
web/apps/wizard/images/boy.jpg
.jpg
web/apps/wizard/images/checkbox.gif
.gif
web/apps/wizard/images/choose.jpg
.jpg
web/apps/wizard/images/close.gif
.gif
web/apps/wizard/images/game_ajzm3.jpg
.jpg
web/apps/wizard/images/game_als.jpg
.jpg
web/apps/wizard/images/game_btmbcjml.jpg
.jpg
web/apps/wizard/images/game_bxjg.jpg
.jpg
web/apps/wizard/images/game_bztkdz.jpg
.jpg
web/apps/wizard/images/game_ckxt.jpg
.jpg
web/apps/wizard/images/game_cnzx.jpg
.jpg
web/apps/wizard/images/game_cyhx.jpg
.jpg
web/apps/wizard/images/game_ddt.jpg
.jpg
web/apps/wizard/images/game_dfhwd.jpg
.jpg
web/apps/wizard/images/game_dxcyys.jpg
.jpg
web/apps/wizard/images/game_fkjyonline.jpg
.jpg
web/apps/wizard/images/game_fndxn.jpg
.jpg
web/apps/wizard/images/game_gdtw2.jpg
.jpg
web/apps/wizard/images/game_gwly8.jpg
.jpg
web/apps/wizard/images/game_hlnc2.jpg
.jpg
web/apps/wizard/images/game_jpfc13.jpg
.jpg
web/apps/wizard/images/game_jtlq.jpg
.jpg
web/apps/wizard/images/game_jy2.jpg
.jpg
web/apps/wizard/images/game_jyys.jpg
.jpg
web/apps/wizard/images/game_ldol.jpg
.jpg
web/apps/wizard/images/game_lgcrdnz.jpg
.jpg
web/apps/wizard/images/game_lhlt.jpg
.jpg
web/apps/wizard/images/game_mftm.jpg
.jpg
web/apps/wizard/images/game_mm.jpg
.jpg
web/apps/wizard/images/game_msxq2.jpg
.jpg
web/apps/wizard/images/game_ppkdc.jpg
.jpg
web/apps/wizard/images/game_ppt.jpg
.jpg
web/apps/wizard/images/game_qdzsxp.jpg
.jpg
web/apps/wizard/images/game_qjxz.jpg
.jpg
web/apps/wizard/images/game_qqxw.jpg
.jpg
web/apps/wizard/images/game_qszl.jpg
.jpg
web/apps/wizard/images/game_rwpd2.jpg
.jpg
web/apps/wizard/images/game_shwj4.jpg
.jpg
web/apps/wizard/images/game_sldwq.jpg
.jpg
web/apps/wizard/images/game_syzy.jpg
.jpg
web/apps/wizard/images/game_tksj.jpg
.jpg
web/apps/wizard/images/game_tsy2.jpg
.jpg
web/apps/wizard/images/game_wdgzwg.jpg
.jpg
web/apps/wizard/images/game_ws2.jpg
.jpg
web/apps/wizard/images/game_wxwx.jpg
.jpg
web/apps/wizard/images/game_xfdzcg.jpg
.jpg
web/apps/wizard/images/game_xff.jpg
.jpg
web/apps/wizard/images/game_xjkp.jpg
.jpg
web/apps/wizard/images/game_xjqxz4.jpg
.jpg
web/apps/wizard/images/game_yjkgd.jpg
.jpg
web/apps/wizard/images/game_yycs.jpg
.jpg
web/apps/wizard/images/game_zglj.jpg
.jpg
web/apps/wizard/images/game_zm.jpg
.jpg
web/apps/wizard/images/game_zwdzjs.jpg
.jpg
web/apps/wizard/images/girl.jpg
.jpg
web/apps/wizard/images/grey.gif
.gif
web/apps/wizard/images/run_btn.jpg
.jpg
web/apps/wizard/images/sort.jpg
.jpg
web/apps/wizard/index.html
.html .js polyglot
web/apps/wizard/style.css
web/common/css/app.css
web/common/css/app_ie6.css
web/common/css/autocomplete.css
web/common/css/dialog.css
web/common/css/images/avatar.gif
.gif
web/common/css/images/btn.gif
.gif
web/common/css/images/cmenu-hover.gif
.gif
web/common/css/images/dialog_btn.gif
.gif
web/common/css/images/dialog_btn_long.gif
.gif
web/common/css/images/dialog_close.gif
.gif
web/common/css/images/dialog_icon.gif
.gif
web/common/css/images/dialog_icon_right.gif
.gif
web/common/css/images/dialog_icon_wrong.gif
.gif
web/common/css/images/dialog_title_bg.gif
.gif
web/common/css/images/dialog_title_icon.gif
.gif
web/common/css/images/error_bg.gif
.gif
web/common/css/images/esc_tip.gif
.gif
web/common/css/images/esc_tip.png
.png
web/common/css/images/esc_tip_big.gif
.gif
web/common/css/images/esc_tip_big.png
.png
web/common/css/images/flow_tips.png
.png
web/common/css/images/game_tip_arrow.png
.png
web/common/css/images/game_tip_bottom.png
.png
web/common/css/images/game_tip_middle.png
.png
web/common/css/images/game_tip_top.png
.png
web/common/css/images/icon_default.gif
.gif
web/common/css/images/icon_keys.png
.png
web/common/css/images/iknow.png
.png
web/common/css/images/lightbox-blank.gif
.gif
web/common/css/images/lightbox-btn-close.gif
.gif
web/common/css/images/lightbox-btn-next.gif
.gif
web/common/css/images/lightbox-btn-prev.gif
.gif
web/common/css/images/lightbox-ico-loading.gif
.gif
web/common/css/images/loading.gif
.gif
web/common/css/images/overlay_bg.gif
.gif
web/common/css/images/status_bg.gif
.gif
web/common/css/images/status_button.gif
.gif
web/common/css/images/type_icon_4m.gif
.gif
web/common/css/images/type_icon_cn_tag.gif
.gif
web/common/css/images/type_icons.gif
.gif
web/common/css/jquery.wordcounter.css
web/common/css/lightbox.css
web/common/css/reset-min.css
web/common/js/api.min.js
.js
web/common/js/common.min.js
.js
web/common/js/dialog.js
.js
web/common/js/event.min.js
.js
web/common/js/init.min.js
.js
web/common/js/jquery.autocomplete.js
.js
web/common/js/jquery.capability.min.js
.js
web/common/js/jquery.inlinetips.js
.js
web/common/js/jquery.js
.js
web/common/js/jquery.lightbox.js
.js
web/common/js/jquery.tablesorter.js
.js
web/common/js/jquery.tmpl.js
.js
web/common/js/jquery.wordcounter.js
.js
web/common/js/json2.min.js
.js
web/common/js/manager.min.js
.js
web/common/js/sizzle.min.js
.js
web/common/js/swfobject.js
.js
web/common/js/template.min.js
.js
web/common/js/ui.min.js
.js
web/common/js/var.js
.js
web/index.html
.html .js polyglot
zlib1.dll
.dll windows:4 windows x86 arch:x86

66a201125fb55b79ced6d0ecd1985e10

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22-06-2009 00:00

Not After

21-06-2012 23:59

Subject

CN=Zhuhai Kingsoft Software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Zhuhai Kingsoft Software Co.\,Ltd,L=Zhuhai,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

43:83:ad:65:20:cb:ca:eb:99:41:15:8a:55:bc:28:19:6b:e8:11:bd
Signer

Actual PE Digest

43:83:ad:65:20:cb:ca:eb:99:41:15:8a:55:bc:28:19:6b:e8:11:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
Sleep
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

_close
_lseek
_open
_read
_write
__dllonexit
__lc_codepage
__mb_cur_max
_errno
_iob
abort
fflush
fputc
free
fwrite
getenv
localeconv
malloc
memchr
memcpy
sprintf
strcat
strcpy
strerror
strlen
vfprintf
wcslen

Exports

Exports

adler32
adler32_combine
compress
compress2
compressBound
crc32
crc32_combine
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePrime
deflateReset
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgets
gzoffset
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzungetc
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
uncompress
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1bCertificate

Extended Key Usages

Key Usages

46:17:dc:88:e3:b5:7a:40:6b:89:71:d2:c4:c2:33:20:37:60:ec:56Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 72KB

.rsrc Size: 28KB - Virtual size: 28KB

c0d4f083fa62db67fb705b643a601dbf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1bCertificate

Extended Key Usages

Key Usages

e8:64:da:69:34:9c:1c:63:9b:89:f8:0b:b1:64:a5:f5:a8:e3:0c:57Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

ole32

shlwapi

version

wininet

Sections

.text Size: 187KB - Virtual size: 187KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 7KB - Virtual size: 14KB

.rsrc Size: 218KB - Virtual size: 217KB

.reloc Size: 12KB - Virtual size: 11KB

bdd8f294be92a3d6c2b6221763f7c002

Headers

File Characteristics

Imports

ws2_32

wldap32

kernel32

Exports

Exports

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

46:17:dc:88:e3:b5:7a:40:6b:89:71:d2:c4:c2:33:20:37:60:ec:56
Signer

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 72KB

.rsrc
Size: 28KB - Virtual size: 28KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

0b:a4:bc:43:99:30:34:6b:95:69:4b:4c:7f:2b:98:1b
Certificate

e8:64:da:69:34:9c:1c:63:9b:89:f8:0b:b1:64:a5:f5:a8:e3:0c:57
Signer

.text
Size: 187KB - Virtual size: 187KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 7KB - Virtual size: 14KB

.rsrc
Size: 218KB - Virtual size: 217KB

.reloc
Size: 12KB - Virtual size: 11KB

.text
Size: 208KB - Virtual size: 208KB

.rdata
Size: 33KB - Virtual size: 33KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 9KB

.text
Size: 108KB - Virtual size: 105KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 8KB - Virtual size: 7KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 37KB - Virtual size: 36KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate