27d864c0abc665b8e2e1b77bb16c8f1d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

27d864c0abc665b8e2e1b77bb16c8f1d_JaffaCakes118
Size

1.6MB
MD5

27d864c0abc665b8e2e1b77bb16c8f1d
SHA1

54f3dc4ebdea0f8e590b1f92ebb7c7de1a84af03
SHA256

ce4111285881e2406c3de90e47b444d68531d33b07c51ce50cabc69985e77301
SHA512

0fc2abbae34e008b485b698f953021a323ac1d71b26c00d906ce128fac30eceb364e45e3af0dbbc8c8d9338467bfb166138f0371f1aac74b1a4926d79e77f00c
SSDEEP

24576:MMJ6aR7CF9ROz54Bm0vnbuMzZbuU4NoyA/XYcdoNuLz939oA/2StB4N2ZiOqf:JJ6uIb6veVzT4aRB9ttWai

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

27d864c0abc665b8e2e1b77bb16c8f1d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

01/07/2010, 00:00

Not After

30/06/2013, 23:59

Subject

CN=Hubei Dudu Network Technology co.\,ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Hubei Dudu Network Technology co.\,ltd.,L=wuhanshi,ST=hubeisheng,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/Chaosu/FavIcon/Default.ico
$APPDATA/Chaosu/FavIcon/china.alibaba.com.ico
$APPDATA/Chaosu/FavIcon/cn.msn.com.ico
$APPDATA/Chaosu/FavIcon/cn.yahoo.com.ico
$APPDATA/Chaosu/FavIcon/home.dangdang.com.ico
$APPDATA/Chaosu/FavIcon/reg.renren.com.ico
$APPDATA/Chaosu/FavIcon/search8.taobao.com.ico
$APPDATA/Chaosu/FavIcon/wwv.renren.com.ico
$APPDATA/Chaosu/FavIcon/www.163.com.ico
$APPDATA/Chaosu/FavIcon/www.39.net.ico
$APPDATA/Chaosu/FavIcon/www.51.com.ico
$APPDATA/Chaosu/FavIcon/www.7345.com.ico
$APPDATA/Chaosu/FavIcon/www.8412.com.ico
$APPDATA/Chaosu/FavIcon/www.baidu.com.ico
$APPDATA/Chaosu/FavIcon/www.caiwang.com.ico
$APPDATA/Chaosu/FavIcon/www.cctv.com.ico
$APPDATA/Chaosu/FavIcon/www.chinamobile.com.ico
$APPDATA/Chaosu/FavIcon/www.cmbchina.com.ico
$APPDATA/Chaosu/FavIcon/www.eachnet.com.ico
$APPDATA/Chaosu/FavIcon/www.ganji.com.ico
$APPDATA/Chaosu/FavIcon/www.google.cn.ico
$APPDATA/Chaosu/FavIcon/www.hao123.com.ico
$APPDATA/Chaosu/FavIcon/www.hc360.com.ico
$APPDATA/Chaosu/FavIcon/www.ifeng.com.ico
$APPDATA/Chaosu/FavIcon/www.pconline.com.cn.ico
$APPDATA/Chaosu/FavIcon/www.qq.com.ico
$APPDATA/Chaosu/FavIcon/www.sina.com.cn.ico
$APPDATA/Chaosu/FavIcon/www.sohu.com.ico
$APPDATA/Chaosu/FavIcon/www.soufun.com.ico
$APPDATA/Chaosu/FavIcon/www.taobao.com.ico
$APPDATA/Chaosu/FavIcon/www.wamei.com.ico
$APPDATA/Chaosu/FavIcon/www.xinhuanet.com.ico
$APPDATA/Chaosu/FavIcon/www.youku.com.ico
$APPDATA/Chaosu/FavIcon/www.zaobao.com.ico
$APPDATA/Chaosu/FavIcon/www.zhcw.com.ico
$APPDATA/Chaosu/Mousestate/Cursor.cur
$APPDATA/Chaosu/Mousestate/NextTab_tip.cur
$APPDATA/Chaosu/Mousestate/PageDown_tip.cur
$APPDATA/Chaosu/Mousestate/PageUp_tip.cur
$APPDATA/Chaosu/Mousestate/PreTab_tip.cur
$APPDATA/Chaosu/Mousestate/backward_tip.cur
$APPDATA/Chaosu/Mousestate/close.cur
$APPDATA/Chaosu/Mousestate/closeAll_tip.cur
$APPDATA/Chaosu/Mousestate/close_tip.cur
$APPDATA/Chaosu/Mousestate/forward_tip.cur
$APPDATA/Chaosu/Mousestate/refresh_tip.cur
$APPDATA/Chaosu/Page/addse.js
.js
$APPDATA/Chaosu/Page/configue.js
.js
$APPDATA/Chaosu/Page/ext-all.js
.js
$APPDATA/Chaosu/Page/ext-base.js
.js
$APPDATA/Chaosu/Page/ext-lang-zh_CN.js
.js
$APPDATA/Chaosu/Page/images/1.ico
$APPDATA/Chaosu/Page/images/2.ico
$APPDATA/Chaosu/Page/images/3.ico
$APPDATA/Chaosu/Page/images/CancelNavigate.JPG
.jpg
$APPDATA/Chaosu/Page/images/arrow.gif
.gif
$APPDATA/Chaosu/Page/images/baidu.gif
.gif
$APPDATA/Chaosu/Page/images/blank_buttonbg.jpg
.jpg
$APPDATA/Chaosu/Page/images/body_bg.jpg
.jpg
$APPDATA/Chaosu/Page/images/box/corners-blue.gif
.gif
$APPDATA/Chaosu/Page/images/box/corners.gif
.gif
$APPDATA/Chaosu/Page/images/box/l-blue.gif
.gif
$APPDATA/Chaosu/Page/images/box/l.gif
.gif
$APPDATA/Chaosu/Page/images/box/r-blue.gif
.gif
$APPDATA/Chaosu/Page/images/box/r.gif
.gif
$APPDATA/Chaosu/Page/images/box/tb-blue.gif
.gif
$APPDATA/Chaosu/Page/images/box/tb.gif
.gif
$APPDATA/Chaosu/Page/images/box_bottom.jpg
.jpg
$APPDATA/Chaosu/Page/images/box_top.jpg
.jpg
$APPDATA/Chaosu/Page/images/button.jpg
.jpg
$APPDATA/Chaosu/Page/images/button/arrow.gif
.gif
$APPDATA/Chaosu/Page/images/button/btn.gif
.gif
$APPDATA/Chaosu/Page/images/button/group-cs.gif
.gif
$APPDATA/Chaosu/Page/images/button/group-lr.gif
.gif
$APPDATA/Chaosu/Page/images/button/group-tb.gif
.gif
$APPDATA/Chaosu/Page/images/button/s-arrow-b-noline.gif
.gif
$APPDATA/Chaosu/Page/images/button/s-arrow-b.gif
.gif
$APPDATA/Chaosu/Page/images/button/s-arrow-bo.gif
.gif
$APPDATA/Chaosu/Page/images/button/s-arrow-noline.gif
.gif
$APPDATA/Chaosu/Page/images/button/s-arrow-o.gif
.gif
$APPDATA/Chaosu/Page/images/button/s-arrow.gif
.gif
$APPDATA/Chaosu/Page/images/button01.jpg
.jpg
$APPDATA/Chaosu/Page/images/button01_2.jpg
.jpg
$APPDATA/Chaosu/Page/images/button02.jpg
.jpg
$APPDATA/Chaosu/Page/images/button02_2.jpg
.jpg
$APPDATA/Chaosu/Page/images/button_bg1.gif
.gif
$APPDATA/Chaosu/Page/images/button_bg1.jpg
.jpg
$APPDATA/Chaosu/Page/images/button_bg2.gif
.gif
$APPDATA/Chaosu/Page/images/button_bg2.jpg
.jpg
$APPDATA/Chaosu/Page/images/button_bg3.jpg
.jpg
$APPDATA/Chaosu/Page/images/button_bg4.jpg
.jpg
$APPDATA/Chaosu/Page/images/chaosu_logo.jpg
.jpg
$APPDATA/Chaosu/Page/images/chaosulogo.jpg
.jpg
$APPDATA/Chaosu/Page/images/china.alibaba.com.ico
$APPDATA/Chaosu/Page/images/close_bg1.jpg
.jpg
$APPDATA/Chaosu/Page/images/close_bg2.jpg
.jpg
$APPDATA/Chaosu/Page/images/cn.bing.com.ico
$APPDATA/Chaosu/Page/images/color.jpg
.jpg
$APPDATA/Chaosu/Page/images/color_1.gif
.gif
$APPDATA/Chaosu/Page/images/color_1.jpg
.jpg
$APPDATA/Chaosu/Page/images/color_2.gif
.gif
$APPDATA/Chaosu/Page/images/color_2.jpg
.jpg
$APPDATA/Chaosu/Page/images/color_3.gif
.gif
$APPDATA/Chaosu/Page/images/color_3.jpg
.jpg
$APPDATA/Chaosu/Page/images/color_4.jpg
.jpg
$APPDATA/Chaosu/Page/images/color_5.jpg
.jpg
$APPDATA/Chaosu/Page/images/color_6.jpg
.jpg
$APPDATA/Chaosu/Page/images/color_7.jpg
.jpg
$APPDATA/Chaosu/Page/images/color_8.jpg
.jpg
$APPDATA/Chaosu/Page/images/color_9.jpg
.jpg
$APPDATA/Chaosu/Page/images/colorscroll.png
.png
$APPDATA/Chaosu/Page/images/dd/drop-add.gif
.gif
$APPDATA/Chaosu/Page/images/dd/drop-no.gif
.gif
$APPDATA/Chaosu/Page/images/dd/drop-yes.gif
.gif
$APPDATA/Chaosu/Page/images/ddd_03.jpg
.jpg
$APPDATA/Chaosu/Page/images/default.ico
$APPDATA/Chaosu/Page/images/defcon_high.png
.png
$APPDATA/Chaosu/Page/images/defcon_low.png
.png
$APPDATA/Chaosu/Page/images/defcon_med.png
.png
$APPDATA/Chaosu/Page/images/del.jpg
.jpg
$APPDATA/Chaosu/Page/images/demo_1.jpg
.jpg
$APPDATA/Chaosu/Page/images/demo_10.jpg
.jpg
$APPDATA/Chaosu/Page/images/demo_2.jpg
.jpg
$APPDATA/Chaosu/Page/images/demo_3.jpg
.jpg
$APPDATA/Chaosu/Page/images/demo_4.jpg
.jpg
$APPDATA/Chaosu/Page/images/demo_5.jpg
.jpg
$APPDATA/Chaosu/Page/images/demo_6.jpg
.jpg
$APPDATA/Chaosu/Page/images/demo_7.jpg
.jpg
$APPDATA/Chaosu/Page/images/demo_8.jpg
.jpg
$APPDATA/Chaosu/Page/images/demo_9.jpg
.jpg
$APPDATA/Chaosu/Page/images/edit_bg.jpg
.jpg
$APPDATA/Chaosu/Page/images/editor/tb-sprite.gif
.gif
$APPDATA/Chaosu/Page/images/ext-all.css
$APPDATA/Chaosu/Page/images/form/checkbox.gif
.gif
$APPDATA/Chaosu/Page/images/form/clear-trigger.gif
.gif
$APPDATA/Chaosu/Page/images/form/clear-trigger.psd
$APPDATA/Chaosu/Page/images/form/date-trigger.gif
.gif
$APPDATA/Chaosu/Page/images/form/date-trigger.psd
$APPDATA/Chaosu/Page/images/form/error-tip-corners.gif
.gif
$APPDATA/Chaosu/Page/images/form/exclamation.gif
.gif
$APPDATA/Chaosu/Page/images/form/radio.gif
.gif
$APPDATA/Chaosu/Page/images/form/search-trigger.gif
.gif
$APPDATA/Chaosu/Page/images/form/search-trigger.psd
$APPDATA/Chaosu/Page/images/form/text-bg.gif
.gif
$APPDATA/Chaosu/Page/images/form/trigger-tpl.gif
.gif
$APPDATA/Chaosu/Page/images/form/trigger.gif
.gif
$APPDATA/Chaosu/Page/images/form/trigger.psd
$APPDATA/Chaosu/Page/images/gesture_1.jpg
.jpg
$APPDATA/Chaosu/Page/images/gesture_2.jpg
.jpg
$APPDATA/Chaosu/Page/images/gesture_3.jpg
.jpg
$APPDATA/Chaosu/Page/images/gesture_4.jpg
.jpg
$APPDATA/Chaosu/Page/images/gesture_5.jpg
.jpg
$APPDATA/Chaosu/Page/images/gesture_6.jpg
.jpg
$APPDATA/Chaosu/Page/images/gesture_7.jpg
.jpg
$APPDATA/Chaosu/Page/images/gesture_8.jpg
.jpg
$APPDATA/Chaosu/Page/images/gesture_9.jpg
.jpg
$APPDATA/Chaosu/Page/images/gradient-bg.gif
.gif
$APPDATA/Chaosu/Page/images/grid/arrow-left-white.gif
.gif
$APPDATA/Chaosu/Page/images/grid/arrow-right-white.gif
.gif
$APPDATA/Chaosu/Page/images/grid/col-move-bottom.gif
.gif
$APPDATA/Chaosu/Page/images/grid/col-move-top.gif
.gif
$APPDATA/Chaosu/Page/images/grid/columns.gif
.gif
$APPDATA/Chaosu/Page/images/grid/dirty.gif
.gif
$APPDATA/Chaosu/Page/images/grid/done.gif
.gif
$APPDATA/Chaosu/Page/images/grid/drop-no.gif
.gif
$APPDATA/Chaosu/Page/images/grid/drop-yes.gif
.gif
$APPDATA/Chaosu/Page/images/grid/footer-bg.gif
.gif
$APPDATA/Chaosu/Page/images/grid/grid-blue-hd.gif
.gif
$APPDATA/Chaosu/Page/images/grid/grid-blue-split.gif
.gif
$APPDATA/Chaosu/Page/images/grid/grid-hrow.gif
.gif
$APPDATA/Chaosu/Page/images/grid/grid-loading.gif
.gif
$APPDATA/Chaosu/Page/images/grid/grid-split.gif
.gif
$APPDATA/Chaosu/Page/images/grid/grid-vista-hd.gif
.gif
$APPDATA/Chaosu/Page/images/grid/grid3-hd-btn.gif
.gif
$APPDATA/Chaosu/Page/images/grid/grid3-hrow-over.gif
.gif
$APPDATA/Chaosu/Page/images/grid/grid3-hrow.gif
.gif
$APPDATA/Chaosu/Page/images/grid/grid3-special-col-bg.gif
.gif
$APPDATA/Chaosu/Page/images/grid/grid3-special-col-sel-bg.gif
.gif
$APPDATA/Chaosu/Page/images/grid/group-by.gif
.gif
$APPDATA/Chaosu/Page/images/grid/group-collapse.gif
.gif
$APPDATA/Chaosu/Page/images/grid/group-expand-sprite.gif
.gif
$APPDATA/Chaosu/Page/images/grid/group-expand.gif
.gif
$APPDATA/Chaosu/Page/images/grid/hd-pop.gif
.gif
$APPDATA/Chaosu/Page/images/grid/hmenu-asc.gif
.gif
$APPDATA/Chaosu/Page/images/grid/hmenu-desc.gif
.gif
$APPDATA/Chaosu/Page/images/grid/hmenu-lock.gif
.gif
$APPDATA/Chaosu/Page/images/grid/hmenu-lock.png
.png
$APPDATA/Chaosu/Page/images/grid/hmenu-unlock.gif
.gif
$APPDATA/Chaosu/Page/images/grid/hmenu-unlock.png
.png
$APPDATA/Chaosu/Page/images/grid/invalid_line.gif
.gif
$APPDATA/Chaosu/Page/images/grid/loading.gif
.gif
$APPDATA/Chaosu/Page/images/grid/mso-hd.gif
.gif
$APPDATA/Chaosu/Page/images/grid/nowait.gif
.gif
$APPDATA/Chaosu/Page/images/grid/page-first-disabled.gif
.gif
$APPDATA/Chaosu/Page/images/grid/page-first.gif
.gif
$APPDATA/Chaosu/Page/images/grid/page-last-disabled.gif
.gif
$APPDATA/Chaosu/Page/images/grid/page-last.gif
.gif
$APPDATA/Chaosu/Page/images/grid/page-next-disabled.gif
.gif
$APPDATA/Chaosu/Page/images/grid/page-next.gif
.gif
$APPDATA/Chaosu/Page/images/grid/page-prev-disabled.gif
.gif
$APPDATA/Chaosu/Page/images/grid/page-prev.gif
.gif
$APPDATA/Chaosu/Page/images/grid/pick-button.gif
.gif
$APPDATA/Chaosu/Page/images/grid/refresh.gif
.gif
$APPDATA/Chaosu/Page/images/grid/row-check-sprite.gif
.gif
$APPDATA/Chaosu/Page/images/grid/row-expand-sprite.gif
.gif
$APPDATA/Chaosu/Page/images/grid/row-over.gif
.gif
$APPDATA/Chaosu/Page/images/grid/row-sel.gif
.gif
$APPDATA/Chaosu/Page/images/grid/sort-hd.gif
.gif
$APPDATA/Chaosu/Page/images/grid/sort_asc.gif
.gif
$APPDATA/Chaosu/Page/images/grid/sort_desc.gif
.gif
$APPDATA/Chaosu/Page/images/grid/wait.gif
.gif
$APPDATA/Chaosu/Page/images/helpico.jpg
.jpg
$APPDATA/Chaosu/Page/images/home.dangdang.com.ico
$APPDATA/Chaosu/Page/images/ico_1616.jpg
.jpg
$APPDATA/Chaosu/Page/images/ico_default.jpg
.jpg
$APPDATA/Chaosu/Page/images/ico_renren.jpg
.jpg
$APPDATA/Chaosu/Page/images/ico_sina.jpg
.jpg
$APPDATA/Chaosu/Page/images/ico_taobao.jpg
.jpg
$APPDATA/Chaosu/Page/images/inputbg.jpg
.jpg
$APPDATA/Chaosu/Page/images/itemico.jpg
.jpg
$APPDATA/Chaosu/Page/images/layout/collapse.gif
.gif
$APPDATA/Chaosu/Page/images/layout/expand.gif
.gif
$APPDATA/Chaosu/Page/images/layout/gradient-bg.gif
.gif
$APPDATA/Chaosu/Page/images/layout/mini-bottom.gif
.gif
$APPDATA/Chaosu/Page/images/layout/mini-left.gif
.gif
$APPDATA/Chaosu/Page/images/layout/mini-right.gif
.gif
$APPDATA/Chaosu/Page/images/layout/mini-top.gif
.gif
$APPDATA/Chaosu/Page/images/layout/ns-collapse.gif
.gif
$APPDATA/Chaosu/Page/images/layout/ns-expand.gif
.gif
$APPDATA/Chaosu/Page/images/layout/panel-close.gif
.gif
$APPDATA/Chaosu/Page/images/layout/panel-title-bg.gif
.gif
$APPDATA/Chaosu/Page/images/layout/panel-title-light-bg.gif
.gif
$APPDATA/Chaosu/Page/images/layout/stick.gif
.gif
$APPDATA/Chaosu/Page/images/layout/stuck.gif
.gif
$APPDATA/Chaosu/Page/images/layout/tab-close-on.gif
.gif
$APPDATA/Chaosu/Page/images/layout/tab-close.gif
.gif
$APPDATA/Chaosu/Page/images/left_repeat.jpg
.jpg
$APPDATA/Chaosu/Page/images/leftrepeat-28.jpg
.jpg
$APPDATA/Chaosu/Page/images/leftrepeat.jpg
.jpg
$APPDATA/Chaosu/Page/images/li_bg.jpg
.jpg
$APPDATA/Chaosu/Page/images/li_bg2.jpg
.jpg
$APPDATA/Chaosu/Page/images/libg.jpg
.jpg
$APPDATA/Chaosu/Page/images/loading.gif
.gif
$APPDATA/Chaosu/Page/images/m1.png
.png
$APPDATA/Chaosu/Page/images/m10.png
.png
$APPDATA/Chaosu/Page/images/m11.png
.png
$APPDATA/Chaosu/Page/images/m1l.png
.png
$APPDATA/Chaosu/Page/images/m2.png
.png
$APPDATA/Chaosu/Page/images/m3.png
.png
$APPDATA/Chaosu/Page/images/m4.png
.png
$APPDATA/Chaosu/Page/images/m5.png
.png
$APPDATA/Chaosu/Page/images/m6.png
.png
$APPDATA/Chaosu/Page/images/m7.png
.png
$APPDATA/Chaosu/Page/images/m8.png
.png
$APPDATA/Chaosu/Page/images/m9.png
.png
$APPDATA/Chaosu/Page/images/main_bg.jpg
.jpg
$APPDATA/Chaosu/Page/images/menu/checked.gif
.gif
$APPDATA/Chaosu/Page/images/menu/group-checked.gif
.gif
$APPDATA/Chaosu/Page/images/menu/item-over.gif
.gif
$APPDATA/Chaosu/Page/images/menu/menu-parent.gif
.gif
$APPDATA/Chaosu/Page/images/menu/menu.gif
.gif
$APPDATA/Chaosu/Page/images/menu/unchecked.gif
.gif
$APPDATA/Chaosu/Page/images/news.sina.com.cn.ico
$APPDATA/Chaosu/Page/images/next.jpg
.jpg
$APPDATA/Chaosu/Page/images/panel/corners-sprite.gif
.gif
$APPDATA/Chaosu/Page/images/panel/left-right.gif
.gif
$APPDATA/Chaosu/Page/images/panel/light-hd.gif
.gif
$APPDATA/Chaosu/Page/images/panel/tool-sprite-tpl.gif
.gif
$APPDATA/Chaosu/Page/images/panel/tool-sprites.gif
.gif
$APPDATA/Chaosu/Page/images/panel/tools-sprites-trans.gif
.gif
$APPDATA/Chaosu/Page/images/panel/top-bottom.gif
.gif
$APPDATA/Chaosu/Page/images/panel/top-bottom.png
.png
$APPDATA/Chaosu/Page/images/panel/white-corners-sprite.gif
.gif
$APPDATA/Chaosu/Page/images/panel/white-left-right.gif
.gif
$APPDATA/Chaosu/Page/images/panel/white-top-bottom.gif
.gif
$APPDATA/Chaosu/Page/images/pre.jpg
.jpg
$APPDATA/Chaosu/Page/images/progress/progress-bg.gif
.gif
$APPDATA/Chaosu/Page/images/qh_bg1.jpg
.jpg
$APPDATA/Chaosu/Page/images/qh_bg2.jpg
.jpg
$APPDATA/Chaosu/Page/images/qh_bg3.jpg
.jpg
$APPDATA/Chaosu/Page/images/qtip/bg.gif
.gif
$APPDATA/Chaosu/Page/images/qtip/close.gif
.gif
$APPDATA/Chaosu/Page/images/qtip/tip-anchor-sprite.gif
.gif
$APPDATA/Chaosu/Page/images/qtip/tip-sprite.1.gif
.gif
$APPDATA/Chaosu/Page/images/restore.png
.png
$APPDATA/Chaosu/Page/images/restoreall.png
.png
$APPDATA/Chaosu/Page/images/rightmenu_bg.jpg
.jpg
$APPDATA/Chaosu/Page/images/rightmenu_bg2.jpg
.jpg
$APPDATA/Chaosu/Page/images/rightmenu_bg3.jpg
.jpg
$APPDATA/Chaosu/Page/images/s.gif
.gif
$APPDATA/Chaosu/Page/images/search_bg1.gif
.gif
$APPDATA/Chaosu/Page/images/search_bg1.jpg
.jpg
$APPDATA/Chaosu/Page/images/search_bg2.gif
.gif
$APPDATA/Chaosu/Page/images/search_bg2.jpg
.jpg
$APPDATA/Chaosu/Page/images/search_bg3.jpg
.jpg
$APPDATA/Chaosu/Page/images/search_bg4.jpg
.jpg
$APPDATA/Chaosu/Page/images/shadow-c.png
.png
$APPDATA/Chaosu/Page/images/shadow-lr.png
.png
$APPDATA/Chaosu/Page/images/shadow.png
.png
$APPDATA/Chaosu/Page/images/shared/blue-loading.gif
.gif
$APPDATA/Chaosu/Page/images/shared/calendar.gif
.gif
$APPDATA/Chaosu/Page/images/shared/glass-bg.gif
.gif
$APPDATA/Chaosu/Page/images/shared/hd-sprite.gif
.gif
$APPDATA/Chaosu/Page/images/shared/large-loading.gif
.gif
$APPDATA/Chaosu/Page/images/shared/left-btn.gif
.gif
$APPDATA/Chaosu/Page/images/shared/loading-balls.gif
.gif
$APPDATA/Chaosu/Page/images/shared/right-btn.gif
.gif
$APPDATA/Chaosu/Page/images/shared/warning.gif
.gif
$APPDATA/Chaosu/Page/images/sizer/e-handle-dark.gif
.gif
$APPDATA/Chaosu/Page/images/sizer/e-handle.gif
.gif
$APPDATA/Chaosu/Page/images/sizer/ne-handle-dark.gif
.gif
$APPDATA/Chaosu/Page/images/sizer/ne-handle.gif
.gif
$APPDATA/Chaosu/Page/images/sizer/nw-handle-dark.gif
.gif
$APPDATA/Chaosu/Page/images/sizer/nw-handle.gif
.gif
$APPDATA/Chaosu/Page/images/sizer/s-handle-dark.gif
.gif
$APPDATA/Chaosu/Page/images/sizer/s-handle.gif
.gif
$APPDATA/Chaosu/Page/images/sizer/se-handle-dark.gif
.gif
$APPDATA/Chaosu/Page/images/sizer/se-handle.gif
.gif
$APPDATA/Chaosu/Page/images/sizer/square.gif
.gif
$APPDATA/Chaosu/Page/images/sizer/sw-handle-dark.gif
.gif
$APPDATA/Chaosu/Page/images/sizer/sw-handle.gif
.gif
$APPDATA/Chaosu/Page/images/slider-bg.png
.png
$APPDATA/Chaosu/Page/images/slider-thumb.png
.png
$APPDATA/Chaosu/Page/images/slider/slider-bg.png
.png
$APPDATA/Chaosu/Page/images/slider/slider-thumb.png
.png
$APPDATA/Chaosu/Page/images/slider/slider-v-bg.png
.png
$APPDATA/Chaosu/Page/images/slider/slider-v-thumb.png
.png
$APPDATA/Chaosu/Page/images/sports.sina.com.cn.ico
$APPDATA/Chaosu/Page/images/style.css
$APPDATA/Chaosu/Page/images/style1.css
$APPDATA/Chaosu/Page/images/style1.jpg
.jpg
$APPDATA/Chaosu/Page/images/style2.css
$APPDATA/Chaosu/Page/images/style2.jpg
.jpg
$APPDATA/Chaosu/Page/images/tabs/scroll-left.gif
.gif
$APPDATA/Chaosu/Page/images/tabs/scroll-right.gif
.gif
$APPDATA/Chaosu/Page/images/tabs/scroller-bg.gif
.gif
$APPDATA/Chaosu/Page/images/tabs/tab-btm-inactive-left-bg.gif
.gif
$APPDATA/Chaosu/Page/images/tabs/tab-btm-inactive-right-bg.gif
.gif
$APPDATA/Chaosu/Page/images/tabs/tab-btm-left-bg.gif
.gif
$APPDATA/Chaosu/Page/images/tabs/tab-btm-right-bg.gif
.gif
$APPDATA/Chaosu/Page/images/tabs/tab-close.gif
.gif
$APPDATA/Chaosu/Page/images/tabs/tab-strip-bg.gif
.gif
$APPDATA/Chaosu/Page/images/tabs/tab-strip-bg.png
.png
$APPDATA/Chaosu/Page/images/tabs/tab-strip-btm-bg.gif
.gif
$APPDATA/Chaosu/Page/images/tabs/tabs-sprite.gif
.gif
$APPDATA/Chaosu/Page/images/temp_1.jpg
.jpg
$APPDATA/Chaosu/Page/images/temp_2.jpg
.jpg
$APPDATA/Chaosu/Page/images/temp_3.jpg
.jpg
$APPDATA/Chaosu/Page/images/temp_4.jpg
.jpg
$APPDATA/Chaosu/Page/images/text_bg.jpg
.jpg
$APPDATA/Chaosu/Page/images/ticks.gif
.gif
$APPDATA/Chaosu/Page/images/toolbar/bg.gif
.gif
$APPDATA/Chaosu/Page/images/toolbar/btn-arrow-light.gif
.gif
$APPDATA/Chaosu/Page/images/toolbar/btn-arrow.gif
.gif
$APPDATA/Chaosu/Page/images/toolbar/btn-over-bg.gif
.gif
$APPDATA/Chaosu/Page/images/toolbar/gray-bg.gif
.gif
$APPDATA/Chaosu/Page/images/toolbar/more.gif
.gif
$APPDATA/Chaosu/Page/images/toolbar/tb-bg.gif
.gif
$APPDATA/Chaosu/Page/images/toolbar/tb-btn-sprite.gif
.gif
$APPDATA/Chaosu/Page/images/toolbar/tb-xl-btn-sprite.gif
.gif
$APPDATA/Chaosu/Page/images/toolbar/tb-xl-sep.gif
.gif
$APPDATA/Chaosu/Page/images/top_repeat.jpg
.jpg
$APPDATA/Chaosu/Page/images/toprepeat.jpg
.jpg
$APPDATA/Chaosu/Page/images/tree/arrows.gif
.gif
$APPDATA/Chaosu/Page/images/tree/drop-add.gif
.gif
$APPDATA/Chaosu/Page/images/tree/drop-between.gif
.gif
$APPDATA/Chaosu/Page/images/tree/drop-no.gif
.gif
$APPDATA/Chaosu/Page/images/tree/drop-over.gif
.gif
$APPDATA/Chaosu/Page/images/tree/drop-under.gif
.gif
$APPDATA/Chaosu/Page/images/tree/drop-yes.gif
.gif
$APPDATA/Chaosu/Page/images/tree/elbow-end-minus-nl.gif
.gif
$APPDATA/Chaosu/Page/images/tree/elbow-end-minus.gif
.gif
$APPDATA/Chaosu/Page/images/tree/elbow-end-plus-nl.gif
.gif
$APPDATA/Chaosu/Page/images/tree/elbow-end-plus.gif
.gif
$APPDATA/Chaosu/Page/images/tree/elbow-end.gif
.gif
$APPDATA/Chaosu/Page/images/tree/elbow-line.gif
.gif
$APPDATA/Chaosu/Page/images/tree/elbow-minus-nl.gif
.gif
$APPDATA/Chaosu/Page/images/tree/elbow-minus.gif
.gif
$APPDATA/Chaosu/Page/images/tree/elbow-plus-nl.gif
.gif
$APPDATA/Chaosu/Page/images/tree/elbow-plus.gif
.gif
$APPDATA/Chaosu/Page/images/tree/elbow.gif
.gif
$APPDATA/Chaosu/Page/images/tree/folder-open.gif
.gif
$APPDATA/Chaosu/Page/images/tree/folder.gif
.gif
$APPDATA/Chaosu/Page/images/tree/leaf.gif
.gif
$APPDATA/Chaosu/Page/images/tree/loading.gif
.gif
$APPDATA/Chaosu/Page/images/tree/s.gif
.gif
$APPDATA/Chaosu/Page/images/url_bg1.jpg
.jpg
$APPDATA/Chaosu/Page/images/url_bg2.jpg
.jpg
$APPDATA/Chaosu/Page/images/url_bg3.jpg
.jpg
$APPDATA/Chaosu/Page/images/url_bg4.jpg
.jpg
$APPDATA/Chaosu/Page/images/window/icon-error.gif
.gif
$APPDATA/Chaosu/Page/images/window/icon-info.gif
.gif
$APPDATA/Chaosu/Page/images/window/icon-question.gif
.gif
$APPDATA/Chaosu/Page/images/window/icon-warning.gif
.gif
$APPDATA/Chaosu/Page/images/window/left-corners.png
.png
$APPDATA/Chaosu/Page/images/window/left-corners.psd
$APPDATA/Chaosu/Page/images/window/left-right.png
.png
$APPDATA/Chaosu/Page/images/window/left-right.psd
$APPDATA/Chaosu/Page/images/window/right-corners.png
.png
$APPDATA/Chaosu/Page/images/window/right-corners.psd
$APPDATA/Chaosu/Page/images/window/top-bottom.png
.png
$APPDATA/Chaosu/Page/images/window/top-bottom.psd
$APPDATA/Chaosu/Page/images/www.163.com.ico
$APPDATA/Chaosu/Page/images/www.39.net.ico
$APPDATA/Chaosu/Page/images/www.51.com.ico
$APPDATA/Chaosu/Page/images/www.7y7.com.ico
$APPDATA/Chaosu/Page/images/www.7y7.com.jpg
.jpg
$APPDATA/Chaosu/Page/images/www.amazon.cn.ico
$APPDATA/Chaosu/Page/images/www.baidu.com.ico
$APPDATA/Chaosu/Page/images/www.baidu.com.jpg
.jpg
$APPDATA/Chaosu/Page/images/www.caiwang.com.ico
$APPDATA/Chaosu/Page/images/www.caiwang.com.jpg
.jpg
$APPDATA/Chaosu/Page/images/www.cctv.com.ico
$APPDATA/Chaosu/Page/images/www.cctv.com.jpg
.jpg
$APPDATA/Chaosu/Page/images/www.chinamobile.com.ico
$APPDATA/Chaosu/Page/images/www.google.cn.ico
$APPDATA/Chaosu/Page/images/www.google.cn.jpg
.jpg
$APPDATA/Chaosu/Page/images/www.icbc.com.cn.ico
$APPDATA/Chaosu/Page/images/www.icbc.com.cn.jpg
.jpg
$APPDATA/Chaosu/Page/images/www.ifeng.com.ico
$APPDATA/Chaosu/Page/images/www.kaixin001.com.ico
$APPDATA/Chaosu/Page/images/www.pconline.com.cn.ico
$APPDATA/Chaosu/Page/images/www.sina.com.cn.ico
$APPDATA/Chaosu/Page/images/www.sogou.com.ico
$APPDATA/Chaosu/Page/images/www.taobao.com.ico
$APPDATA/Chaosu/Page/images/www.taobao.com.jpg
.jpg
$APPDATA/Chaosu/Page/images/www.tianya.cn.ico
$APPDATA/Chaosu/Page/images/www.tianya.cn.jpg
.jpg
$APPDATA/Chaosu/Page/images/www.tudou.com.ico
$APPDATA/Chaosu/Page/images/www.youku.com.ico
$APPDATA/Chaosu/Page/images/xqh_bg4.jpg
.jpg
$APPDATA/Chaosu/Skin/Default/ChaoSuSetting.png
.png
$APPDATA/Chaosu/Skin/Default/Exit.png
.png
$APPDATA/Chaosu/Skin/Default/FavoriteAdd.png
.png
$APPDATA/Chaosu/Skin/Default/Find.png
.png
$APPDATA/Chaosu/Skin/Default/MainMenuBar.png
.png
$APPDATA/Chaosu/Skin/Default/NewTab.png
.png
$APPDATA/Chaosu/Skin/Default/Print.png
.png
$APPDATA/Chaosu/Skin/Default/Save.png
.png
$APPDATA/Chaosu/Skin/Default/ZoomArrow.png
.png
$APPDATA/Chaosu/Skin/Default/address.png
.png
$APPDATA/Chaosu/Skin/Default/addurl.png
.png
$APPDATA/Chaosu/Skin/Default/allsearch.png
.png
$APPDATA/Chaosu/Skin/Default/app.ico
$APPDATA/Chaosu/Skin/Default/backward.png
.png
$APPDATA/Chaosu/Skin/Default/bottombar.png
.png
$APPDATA/Chaosu/Skin/Default/chevron.png
.png
$APPDATA/Chaosu/Skin/Default/csskin.config
.xml
$APPDATA/Chaosu/Skin/Default/dropdown.png
.png
$APPDATA/Chaosu/Skin/Default/edit.png
.png
$APPDATA/Chaosu/Skin/Default/enter.png
.png
$APPDATA/Chaosu/Skin/Default/fav_add.ico
$APPDATA/Chaosu/Skin/Default/fav_directory3.ico
$APPDATA/Chaosu/Skin/Default/fav_directory4.ico
$APPDATA/Chaosu/Skin/Default/fav_net_login.ico
$APPDATA/Chaosu/Skin/Default/fav_net_nologin.ico
$APPDATA/Chaosu/Skin/Default/fav_sidebar.ico
$APPDATA/Chaosu/Skin/Default/fav_url.ico
$APPDATA/Chaosu/Skin/Default/favbar.png
.png
$APPDATA/Chaosu/Skin/Default/favmore.png
.png
$APPDATA/Chaosu/Skin/Default/favorites.png
.png
$APPDATA/Chaosu/Skin/Default/findbarClose.png
.png
$APPDATA/Chaosu/Skin/Default/findbarHighLight.png
.png
$APPDATA/Chaosu/Skin/Default/findbarNext.png
.png
$APPDATA/Chaosu/Skin/Default/findbarPrevious.png
.png
$APPDATA/Chaosu/Skin/Default/findbaritem.png
.png
$APPDATA/Chaosu/Skin/Default/forward.png
.png
$APPDATA/Chaosu/Skin/Default/home.png
.png
$APPDATA/Chaosu/Skin/Default/img_lock.png
.png
$APPDATA/Chaosu/Skin/Default/img_progress.png
.png
$APPDATA/Chaosu/Skin/Default/img_refresh.png
.png
$APPDATA/Chaosu/Skin/Default/liquidate.png
.png
$APPDATA/Chaosu/Skin/Default/mask.png
.png
$APPDATA/Chaosu/Skin/Default/menuhilight.png
.png
$APPDATA/Chaosu/Skin/Default/menuicon.png
.png
$APPDATA/Chaosu/Skin/Default/menumask.png
.png
$APPDATA/Chaosu/Skin/Default/navihistory.png
.png
$APPDATA/Chaosu/Skin/Default/new.png
.png
$APPDATA/Chaosu/Skin/Default/next.png
.png
$APPDATA/Chaosu/Skin/Default/openclosesidebar.png
.png
$APPDATA/Chaosu/Skin/Default/openfavorite.png
.png
$APPDATA/Chaosu/Skin/Default/previous.png
.png
$APPDATA/Chaosu/Skin/Default/private.png
.png
$APPDATA/Chaosu/Skin/Default/refresh.png
.png
$APPDATA/Chaosu/Skin/Default/refresh_combine.png
.png
$APPDATA/Chaosu/Skin/Default/restore.png
.png
$APPDATA/Chaosu/Skin/Default/scrollbg.png
.png
$APPDATA/Chaosu/Skin/Default/scrollgauge.png
.png
$APPDATA/Chaosu/Skin/Default/search.ico
$APPDATA/Chaosu/Skin/Default/search.png
.png
$APPDATA/Chaosu/Skin/Default/searcharrow.png
.png
$APPDATA/Chaosu/Skin/Default/searchbox.png
.png
$APPDATA/Chaosu/Skin/Default/searchenter.png
.png
$APPDATA/Chaosu/Skin/Default/select.png
.png
$APPDATA/Chaosu/Skin/Default/sep.png
.png
$APPDATA/Chaosu/Skin/Default/sidebaradd.png
.png
$APPDATA/Chaosu/Skin/Default/sidebarclose.png
.png
$APPDATA/Chaosu/Skin/Default/sidebarfavorite.png
.png
$APPDATA/Chaosu/Skin/Default/sidebarfloat.png
.png
$APPDATA/Chaosu/Skin/Default/sidebarlock.png
.png
$APPDATA/Chaosu/Skin/Default/sidebarorganize.png
.png
$APPDATA/Chaosu/Skin/Default/sizestatus.png
.png
$APPDATA/Chaosu/Skin/Default/skinpreview.png
.png
$APPDATA/Chaosu/Skin/Default/statusitem.png
.png
$APPDATA/Chaosu/Skin/Default/stop.png
.png
$APPDATA/Chaosu/Skin/Default/stop_combine.png
.png
$APPDATA/Chaosu/Skin/Default/tab_close.png
.png
$APPDATA/Chaosu/Skin/Default/tab_dragmark.png
.png
$APPDATA/Chaosu/Skin/Default/tab_new.png
.png
$APPDATA/Chaosu/Skin/Default/tab_progress.png
.png
$APPDATA/Chaosu/Skin/Default/tabbar.png
.png
$APPDATA/Chaosu/Skin/Default/tabbutton.png
.png
$APPDATA/Chaosu/Skin/Default/tabbutton2.png
.png
$APPDATA/Chaosu/Skin/Default/tabitem.png
.png
$APPDATA/Chaosu/Skin/Default/thumb.png
.png
$APPDATA/Chaosu/Skin/Default/title_close.png
.png
$APPDATA/Chaosu/Skin/Default/title_cus.png
.png
$APPDATA/Chaosu/Skin/Default/title_max.png
.png
$APPDATA/Chaosu/Skin/Default/title_max2.png
.png
$APPDATA/Chaosu/Skin/Default/title_min.png
.png
$APPDATA/Chaosu/Skin/Default/titlebar.png
.png
$APPDATA/Chaosu/Skin/Default/tool.png
.png
$APPDATA/Chaosu/Skin/Default/topbar.png
.png
$APPDATA/Chaosu/Skin/Default/translate.png
.png
$APPDATA/Chaosu/config/csBrowser-bak.config
.xml
$APPDATA/Chaosu/config/csBrowser.config
.xml
$APPDATA/Chaosu/config/csCustomButton.config
.xml
$APPDATA/Chaosu/config/csSpecifyPage.config
.xml
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

295fc8c35dee88b924b0f6bafc807c6c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
GetTickCount
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

LoadCursorA
PtInRect
MapWindowPoints
GetDlgCtrlID
CloseClipboard
SetCursor
OpenClipboard
GetClientRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
DrawTextA
GetWindowLongA
DrawFocusRect
MessageBoxA
CallWindowProcA
PostMessageA
SetTimer
KillTimer
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClipboardData

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 470B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/flag.ini
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
UnZipDll.dll
.dll windows:5 windows x86 arch:x86

7a5f04023d081276bc58c389e48b5d28

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

01/07/2010, 00:00

Not After

30/06/2013, 23:59

Subject

CN=Hubei Dudu Network Technology co.\,ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Hubei Dudu Network Technology co.\,ltd.,L=wuhanshi,ST=hubeisheng,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\ChaoSu\UnZipDll\Release\UnZipDll.pdb

Imports

kernel32

GetFullPathNameA
DosDateTimeToFileTime
CreateFileA
lstrlenA
SetFileTime
WriteFile
GetFileAttributesA
CreateDirectoryA
GetFileTime
CloseHandle
LocalFileTimeToFileTime
GetCurrentThreadId
GetCommandLineA
GetLastError
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
MultiByteToWideChar
ReadFile
GetConsoleCP
GetConsoleMode
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
SetEndOfFile
GetProcessHeap

Exports

Exports

?UnZipSkinFile@@YAHPAD@Z

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
chaosu.ico
chaosuProxy.dll
.dll regsvr32 windows:5 windows x86 arch:x86

eda5abdb9cbd837dfbd09fd54e34f220

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

01/07/2010, 00:00

Not After

30/06/2013, 23:59

Subject

CN=Hubei Dudu Network Technology co.\,ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Hubei Dudu Network Technology co.\,ltd.,L=wuhanshi,ST=hubeisheng,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\ChaoSu\chaosuProxy\Release\chaosuProxy.pdb

Imports

kernel32

InterlockedIncrement
InterlockedDecrement
lstrlenW
GetModuleHandleA
GetLastError
IsDBCSLeadByte
lstrcmpiA
RaiseException
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadLocale
GetThreadLocale
WideCharToMultiByte
LoadLibraryExA
GetProcAddress
GetModuleHandleW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
FindResourceExA
LoadResource
LockResource
SizeofResource
FindResourceA
GetModuleFileNameA
lstrlenA
MultiByteToWideChar
InitializeCriticalSection
FreeLibrary
lstrcpyA
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCurrentThreadId
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapCreate
VirtualFree
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA

user32

CharNextW
CharNextA

advapi32

RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyA

ole32

StringFromCLSID
CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc

shell32

SHGetFileInfoA

oleaut32

UnRegisterTypeLi
SysAllocString
RegisterTypeLi
SysStringLen
LoadRegTypeLi
VarUI4FromStr
GetErrorInfo
VariantChangeType
VariantCopy
VariantClear
LoadTypeLi
VariantInit
SysAllocStringLen
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
csbrowser.bak
.exe windows:5 windows x86 arch:x86

00218e32d90c394414dbc60e291aad9a

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

01/07/2010, 00:00

Not After

30/06/2013, 23:59

Subject

CN=Hubei Dudu Network Technology co.\,ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Hubei Dudu Network Technology co.\,ltd.,L=wuhanshi,ST=hubeisheng,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\ChaoSu\Chaosu\Release\csbrowser.pdb

Imports

gdiplus

GdipCreateBitmapFromFileICM
GdiplusStartup
GdipBitmapSetPixel
GdipLoadImageFromFile
GdipDrawImageRectI
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdipGetImageEncodersSize
GdiplusShutdown
GdipSetImageAttributesWrapMode
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDisposeImage
GdipCloneImage
GdipGetImageHeight
GdipAlloc
GdipFree
GdipCreateBitmapFromResource
GdipGetImageWidth
GdipDrawImageRectRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipBitmapGetPixel

wininet

InternetOpenUrlW
InternetSetOptionW
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
InternetCloseHandle
InternetOpenW
FindFirstUrlCacheEntryW
FindCloseUrlCache

shell32

ShellExecuteW
SHGetSpecialFolderPathW
CommandLineToArgvW
DragAcceptFiles
ShellExecuteExW
DragQueryFileW
SHGetFolderPathW
SHGetDesktopFolder

psapi

EnumProcessModules
GetModuleBaseNameW
EnumProcesses

iphlpapi

GetAdaptersInfo

wintrust

WinVerifyTrust
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminCalcHashFromFileHandle

detoured

Detoured

unzipdll

?UnZipSkinFile@@YAHPAD@Z

kernel32

HeapAlloc
GetProcessHeap
HeapFree
SetUnhandledExceptionFilter
GlobalFindAtomW
GlobalAddAtomW
LoadLibraryW
GetCommandLineW
GetCurrentThread
RaiseException
GlobalDeleteAtom
CreateMutexW
FreeLibrary
GetProcAddress
GetModuleHandleW
lstrcmpiW
LoadLibraryExW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSection
GetPrivateProfileIntW
SetLastError
GlobalFree
lstrlenA
DebugBreak
OutputDebugStringW
WideCharToMultiByte
lstrcpyW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
FindClose
GetVersionExW
GlobalLock
GlobalUnlock
GetCurrentProcessId
OpenProcess
TerminateProcess
FindResourceExW
CreateProcessW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
CreateFileMappingW
lstrcmpiA
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
CopyFileW
CreateDirectoryW
FileTimeToDosDateTime
lstrcmpW
CompareStringW
GetSystemTime
GlobalAlloc
MulDiv
CreateFileW
ReadFile
GetFileSize
SystemTimeToFileTime
FileTimeToSystemTime
ReadProcessMemory
VirtualFreeEx
ExpandEnvironmentStringsW
Sleep
GetLocalTime
LocalFree
LoadLibraryA
GetTempPathW
CompareFileTime
lstrcatW
VirtualQuery
VirtualProtect
VirtualAlloc
InterlockedCompareExchange
ResumeThread
GetThreadContext
SetThreadContext
SuspendThread
FindResourceW
LoadResource
LockResource
SizeofResource
GetLastError
DeleteFileW
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
MultiByteToWideChar
InterlockedIncrement
lstrlenW
WaitForMultipleObjects
SetEvent
SetThreadPriority
CreateEventW
CloseHandle
GetTickCount
WaitForSingleObject
CreateThread
InterlockedDecrement
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
IsProcessorFeaturePresent
VirtualFree
HeapDestroy
HeapReAlloc
HeapSize
UnhandledExceptionFilter
IsDebuggerPresent
MoveFileW
GetStartupInfoW
ExitProcess
HeapCreate
WriteFile
VirtualAllocEx
FileTimeToLocalFileTime
GetStdHandle
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
FlushFileBuffers
CreateFileA
lstrcpynW

user32

GetClassNameW
GetDoubleClickTime
EqualRect
SetMenuItemInfoW
SetMenuDefaultItem
CallNextHookEx
TranslateAcceleratorW
SetWindowRgn
CreateAcceleratorTableW
ModifyMenuW
SetRectEmpty
LoadMenuW
IsWindowEnabled
MessageBeep
FillRect
GetSysColorBrush
FrameRect
RegisterWindowMessageW
TrackPopupMenuEx
GetDlgCtrlID
GetCapture
DrawFocusRect
GetDesktopWindow
InvalidateRgn
FindWindowExW
wsprintfW
InsertMenuW
EnableWindow
AttachThreadInput
IntersectRect
IsRectEmpty
CharUpperW
EnableMenuItem
GetCursor
DestroyCursor
EmptyClipboard
SetClipboardData
IsWindowVisible
GetFocus
GetForegroundWindow
ReleaseCapture
SetCapture
ShowCursor
SetCursor
SetWindowTextW
CheckMenuItem
GetMenuState
SetMenuInfo
GetMenuInfo
CreatePopupMenu
MonitorFromPoint
TrackPopupMenu
DeleteMenu
SetActiveWindow
DestroyAcceleratorTable
IsIconic
InflateRect
SetMenu
GetSystemMenu
RedrawWindow
GetAsyncKeyState
WindowFromPoint
GetSystemMetrics
UnregisterClassA
OffsetRect
GetKeyState
GetCursorPos
AppendMenuW
GetMenuItemInfoW
IsZoomed
ScreenToClient
GetMessagePos
ShowWindowAsync
PostThreadMessageW
EndDialog
DialogBoxParamW
GetSubMenu
GetMenuStringW
IsMenu
CloseClipboard
GetClipboardData
OpenClipboard
GetWindowTextLengthW
IsClipboardFormatAvailable
GetSysColor
GetActiveWindow
GetDlgItem
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
GetMenuItemID
GetMenuItemCount
DestroyMenu
wvsprintfW
GetWindowRect
GetParent
GetWindow
CallWindowProcW
DefWindowProcW
DrawIconEx
LoadImageW
DestroyIcon
PtInRect
ReleaseDC
GetDC
ClientToScreen
GetWindowTextW
DrawTextW
KillTimer
SetTimer
SetFocus
IsWindow
InvalidateRect
EndPaint
BeginPaint
MoveWindow
GetClientRect
GetClassInfoExW
RegisterClassExW
CreateWindowExW
MsgWaitForMultipleObjects
SendMessageTimeoutW
AllowSetForegroundWindow
FindWindowW
PostQuitMessage
UnhookWindowsHookEx
UnregisterHotKey
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SetWindowsHookExW
RegisterHotKey
SetForegroundWindow
UpdateWindow
SetWindowPlacement
GetWindowPlacement
GetWindowThreadProcessId
IsChild
LoadCursorW
MessageBoxW
CharNextW
DestroyWindow
SetWindowLongW
GetWindowLongW
CopyRect
SystemParametersInfoW
PostMessageW
ShowWindow
LoadStringW
CharLowerW
SendMessageW
SetWindowPos
GetWindowDC

gdi32

CreatePen
ExtTextOutW
SetBkColor
GetTextExtentPoint32W
Rectangle
GetStockObject
CreateSolidBrush
SetBkMode
SelectObject
DeleteObject
StretchBlt
LPtoDP
SetTextColor
CreateCompatibleDC
CreateDCW
DeleteDC
GetCurrentObject
GetDeviceCaps
GetObjectW
SetViewportOrgEx
GetClipBox
RestoreDC
SaveDC
SetWindowOrgEx
CombineRgn
CreateRectRgn
LineTo
MoveToEx
CreateFontIndirectW
BitBlt
DPtoLP
CreateCompatibleBitmap
CreateBitmapIndirect

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegQueryValueExW
AdjustTokenPrivileges
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
RegCreateKeyW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
GetTokenInformation
GetLengthSid
CopySid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyExW
RegGetKeySecurity
AllocateAndInitializeSid
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegSetKeySecurity
RegQueryInfoKeyW
RegEnumKeyW
GetUserNameW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegOpenKeyW
LookupPrivilegeValueW

ole32

CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoRegisterClassObject
CoRevokeClassObject
OleUninitialize
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
ReleaseStgMedium
CoMarshalInterThreadInterfaceInStream
CoGetMalloc
CreateBindCtx
CoGetMarshalSizeMax
CoMarshalInterface
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoUnmarshalInterface

oleaut32

SysAllocStringByteLen
SysStringByteLen
VarUI4FromStr
SysFreeString
SysAllocString
OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
SysAllocStringLen
DispCallFunc

shlwapi

SHGetValueW
SHDeleteKeyW
SHSetValueW
StrCmpLogicalW

urlmon

UrlMkSetSessionOption
URLDownloadToFileW
UrlMkGetSessionOption

comctl32

ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_GetImageCount
InitCommonControlsEx
_TrackMouseEvent
ImageList_EndDrag
ImageList_DragLeave
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragEnter
ImageList_ReplaceIcon

Sections

.text
Size: 826KB - Virtual size: 825KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 284KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
csbrowser.exe
.exe windows:5 windows x86 arch:x86

00218e32d90c394414dbc60e291aad9a

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

01/07/2010, 00:00

Not After

30/06/2013, 23:59

Subject

CN=Hubei Dudu Network Technology co.\,ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Hubei Dudu Network Technology co.\,ltd.,L=wuhanshi,ST=hubeisheng,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\ChaoSu\Chaosu\Release\csbrowser.pdb

Imports

gdiplus

GdipCreateBitmapFromFileICM
GdiplusStartup
GdipBitmapSetPixel
GdipLoadImageFromFile
GdipDrawImageRectI
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdipGetImageEncodersSize
GdiplusShutdown
GdipSetImageAttributesWrapMode
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDisposeImage
GdipCloneImage
GdipGetImageHeight
GdipAlloc
GdipFree
GdipCreateBitmapFromResource
GdipGetImageWidth
GdipDrawImageRectRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipBitmapGetPixel

wininet

InternetOpenUrlW
InternetSetOptionW
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
InternetCloseHandle
InternetOpenW
FindFirstUrlCacheEntryW
FindCloseUrlCache

shell32

ShellExecuteW
SHGetSpecialFolderPathW
CommandLineToArgvW
DragAcceptFiles
ShellExecuteExW
DragQueryFileW
SHGetFolderPathW
SHGetDesktopFolder

psapi

EnumProcessModules
GetModuleBaseNameW
EnumProcesses

iphlpapi

GetAdaptersInfo

wintrust

WinVerifyTrust
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminCalcHashFromFileHandle

detoured

Detoured

unzipdll

?UnZipSkinFile@@YAHPAD@Z

kernel32

HeapAlloc
GetProcessHeap
HeapFree
SetUnhandledExceptionFilter
GlobalFindAtomW
GlobalAddAtomW
LoadLibraryW
GetCommandLineW
GetCurrentThread
RaiseException
GlobalDeleteAtom
CreateMutexW
FreeLibrary
GetProcAddress
GetModuleHandleW
lstrcmpiW
LoadLibraryExW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSection
GetPrivateProfileIntW
SetLastError
GlobalFree
lstrlenA
DebugBreak
OutputDebugStringW
WideCharToMultiByte
lstrcpyW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
FindClose
GetVersionExW
GlobalLock
GlobalUnlock
GetCurrentProcessId
OpenProcess
TerminateProcess
FindResourceExW
CreateProcessW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
CreateFileMappingW
lstrcmpiA
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
CopyFileW
CreateDirectoryW
FileTimeToDosDateTime
lstrcmpW
CompareStringW
GetSystemTime
GlobalAlloc
MulDiv
CreateFileW
ReadFile
GetFileSize
SystemTimeToFileTime
FileTimeToSystemTime
ReadProcessMemory
VirtualFreeEx
ExpandEnvironmentStringsW
Sleep
GetLocalTime
LocalFree
LoadLibraryA
GetTempPathW
CompareFileTime
lstrcatW
VirtualQuery
VirtualProtect
VirtualAlloc
InterlockedCompareExchange
ResumeThread
GetThreadContext
SetThreadContext
SuspendThread
FindResourceW
LoadResource
LockResource
SizeofResource
GetLastError
DeleteFileW
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
MultiByteToWideChar
InterlockedIncrement
lstrlenW
WaitForMultipleObjects
SetEvent
SetThreadPriority
CreateEventW
CloseHandle
GetTickCount
WaitForSingleObject
CreateThread
InterlockedDecrement
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
IsProcessorFeaturePresent
VirtualFree
HeapDestroy
HeapReAlloc
HeapSize
UnhandledExceptionFilter
IsDebuggerPresent
MoveFileW
GetStartupInfoW
ExitProcess
HeapCreate
WriteFile
VirtualAllocEx
FileTimeToLocalFileTime
GetStdHandle
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
FlushFileBuffers
CreateFileA
lstrcpynW

user32

GetClassNameW
GetDoubleClickTime
EqualRect
SetMenuItemInfoW
SetMenuDefaultItem
CallNextHookEx
TranslateAcceleratorW
SetWindowRgn
CreateAcceleratorTableW
ModifyMenuW
SetRectEmpty
LoadMenuW
IsWindowEnabled
MessageBeep
FillRect
GetSysColorBrush
FrameRect
RegisterWindowMessageW
TrackPopupMenuEx
GetDlgCtrlID
GetCapture
DrawFocusRect
GetDesktopWindow
InvalidateRgn
FindWindowExW
wsprintfW
InsertMenuW
EnableWindow
AttachThreadInput
IntersectRect
IsRectEmpty
CharUpperW
EnableMenuItem
GetCursor
DestroyCursor
EmptyClipboard
SetClipboardData
IsWindowVisible
GetFocus
GetForegroundWindow
ReleaseCapture
SetCapture
ShowCursor
SetCursor
SetWindowTextW
CheckMenuItem
GetMenuState
SetMenuInfo
GetMenuInfo
CreatePopupMenu
MonitorFromPoint
TrackPopupMenu
DeleteMenu
SetActiveWindow
DestroyAcceleratorTable
IsIconic
InflateRect
SetMenu
GetSystemMenu
RedrawWindow
GetAsyncKeyState
WindowFromPoint
GetSystemMetrics
UnregisterClassA
OffsetRect
GetKeyState
GetCursorPos
AppendMenuW
GetMenuItemInfoW
IsZoomed
ScreenToClient
GetMessagePos
ShowWindowAsync
PostThreadMessageW
EndDialog
DialogBoxParamW
GetSubMenu
GetMenuStringW
IsMenu
CloseClipboard
GetClipboardData
OpenClipboard
GetWindowTextLengthW
IsClipboardFormatAvailable
GetSysColor
GetActiveWindow
GetDlgItem
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
GetMenuItemID
GetMenuItemCount
DestroyMenu
wvsprintfW
GetWindowRect
GetParent
GetWindow
CallWindowProcW
DefWindowProcW
DrawIconEx
LoadImageW
DestroyIcon
PtInRect
ReleaseDC
GetDC
ClientToScreen
GetWindowTextW
DrawTextW
KillTimer
SetTimer
SetFocus
IsWindow
InvalidateRect
EndPaint
BeginPaint
MoveWindow
GetClientRect
GetClassInfoExW
RegisterClassExW
CreateWindowExW
MsgWaitForMultipleObjects
SendMessageTimeoutW
AllowSetForegroundWindow
FindWindowW
PostQuitMessage
UnhookWindowsHookEx
UnregisterHotKey
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SetWindowsHookExW
RegisterHotKey
SetForegroundWindow
UpdateWindow
SetWindowPlacement
GetWindowPlacement
GetWindowThreadProcessId
IsChild
LoadCursorW
MessageBoxW
CharNextW
DestroyWindow
SetWindowLongW
GetWindowLongW
CopyRect
SystemParametersInfoW
PostMessageW
ShowWindow
LoadStringW
CharLowerW
SendMessageW
SetWindowPos
GetWindowDC

gdi32

CreatePen
ExtTextOutW
SetBkColor
GetTextExtentPoint32W
Rectangle
GetStockObject
CreateSolidBrush
SetBkMode
SelectObject
DeleteObject
StretchBlt
LPtoDP
SetTextColor
CreateCompatibleDC
CreateDCW
DeleteDC
GetCurrentObject
GetDeviceCaps
GetObjectW
SetViewportOrgEx
GetClipBox
RestoreDC
SaveDC
SetWindowOrgEx
CombineRgn
CreateRectRgn
LineTo
MoveToEx
CreateFontIndirectW
BitBlt
DPtoLP
CreateCompatibleBitmap
CreateBitmapIndirect

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegQueryValueExW
AdjustTokenPrivileges
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
RegCreateKeyW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
GetTokenInformation
GetLengthSid
CopySid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyExW
RegGetKeySecurity
AllocateAndInitializeSid
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegSetKeySecurity
RegQueryInfoKeyW
RegEnumKeyW
GetUserNameW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegOpenKeyW
LookupPrivilegeValueW

ole32

CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoRegisterClassObject
CoRevokeClassObject
OleUninitialize
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
ReleaseStgMedium
CoMarshalInterThreadInterfaceInStream
CoGetMalloc
CreateBindCtx
CoGetMarshalSizeMax
CoMarshalInterface
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoUnmarshalInterface

oleaut32

SysAllocStringByteLen
SysStringByteLen
VarUI4FromStr
SysFreeString
SysAllocString
OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
SysAllocStringLen
DispCallFunc

shlwapi

SHGetValueW
SHDeleteKeyW
SHSetValueW
StrCmpLogicalW

urlmon

UrlMkSetSessionOption
URLDownloadToFileW
UrlMkGetSessionOption

comctl32

ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_GetImageCount
InitCommonControlsEx
_TrackMouseEvent
ImageList_EndDrag
ImageList_DragLeave
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragEnter
ImageList_ReplaceIcon

Sections

.text
Size: 826KB - Virtual size: 825KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 284KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
csbrowser.exe.manifest
.xml
detoured.dll
.dll windows:5 windows x86 arch:x86

6c8408bb5d7d5a5b75b9314f94e68763

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

01/07/2010, 00:00

Not After

30/06/2013, 23:59

Subject

CN=Hubei Dudu Network Technology co.\,ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Hubei Dudu Network Technology co.\,ltd.,L=wuhanshi,ST=hubeisheng,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Program Files\Microsoft Research\Detours Express 2.1\bin\detoured.pdb

Imports

kernel32

DisableThreadLibraryCalls

Exports

Exports

Detoured

Sections

.text
Size: 512B - Virtual size: 42B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 313B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uninst.exe.nsis

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 29KB - Virtual size: 29KB

295fc8c35dee88b924b0f6bafc807c6c

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 512B - Virtual size: 470B

7a5f04023d081276bc58c389e48b5d28

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 29KB - Virtual size: 29KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 512B - Virtual size: 470B

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

.text
Size: 59KB - Virtual size: 59KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 8KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 5KB - Virtual size: 5KB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

.text
Size: 103KB - Virtual size: 103KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 7KB - Virtual size: 10KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 8KB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate