36c8fd959956ec0900d6f000985fd604_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

36c8fd959956ec0900d6f000985fd604_JaffaCakes118
Size

6.4MB
MD5

36c8fd959956ec0900d6f000985fd604
SHA1

314fa3e22d9be920b7a8a6bb4709e70fcaf14d29
SHA256

fc5eb0eb86fefb3f0bb6fc181721a628d74bc9dd0cefa8e851dee449e15715bc
SHA512

2538bca605f942d18816168968476eefa0078274c3d6abe77a6d3a24ea96b3c45c3165b8180f145718340797a20067a0e595b91fcb506b2729da8fe41f0028d5
SSDEEP

98304:9HeH+KieoBvrV357wYQ/WqWsWMHeOFhMS4Q48nDfpsAY4XZe6B19:ZeCTBJ357wS5sWoeOFhMUXndHp9t

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack002/CCTVPlayer.ocx	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/CCTVPlayer.ocx	upx

Unsigned PE 16 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsis_plugin.dll
unpack001/$SYSDIR/gtapi.dll
unpack001/$SYSDIR/nsis_loader.dll
unpack002/$PLUGINSDIR/FindProcDLL.dll
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/KillProcDLL.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/rmsp011.ax
unpack004/$PLUGINSDIR/FindProcDLL.dll
unpack004/$PLUGINSDIR/KillProcDLL.dll
unpack005/$PLUGINSDIR/FindProcDLL.dll
unpack005/$PLUGINSDIR/KillProcDLL.dll

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/bass-plugins.exe	nsis_installer_1
static1/unpack002/uninst.exe	nsis_installer_1
static1/unpack001/uninstuusee.exe	nsis_installer_1

Files

36c8fd959956ec0900d6f000985fd604_JaffaCakes118
.exe windows:4 windows x86 arch:x86

170729c4965736ee8f8f4d1bab77cf38

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e6:e9:c1:30:bb:20:36:47:c5:cc:ed:df:6b:cf:ce:f3:dd:39:2c:53
Signer

Actual PE Digest

e6:e9:c1:30:bb:20:36:47:c5:cc:ed:df:6b:cf:ce:f3:dd:39:2c:53

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
GetCommandLineA
CloseHandle
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
MulDiv
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SendMessageTimeoutA

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 416KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/Google/Custom Buttons/UUSEE_BU1.XML
$APPDATA/Google/Custom Buttons/UUSEE_BU2.XML
$PLUGINSDIR/CustomPageGoogle.ini
$PLUGINSDIR/CustomPageGoogleOK.ini
$PLUGINSDIR/FindProcDLL.dll
.dll windows:4 windows x86 arch:x86

c480ee4d2a64d4a16edee43fdfe35079

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
HeapCreate
VirtualFree
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
FreeLibrary
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
DisableThreadLibraryCalls
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetACP
GetOEMCP
WriteFile
VirtualAlloc
RtlUnwind
GetStringTypeA
GetStringTypeW
GetCPInfo

user32

wsprintfA

Exports

Exports

FindProc

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/GoogleTB.bmp
$PLUGINSDIR/GoogleTBOK.bmp
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

57354bdeea3dfae6e948101add87501a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
GetPrivateProfileIntA
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
MultiByteToWideChar
GlobalAlloc

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
MapWindowPoints
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadIconA

gdi32

SetTextColor
GetObjectA
SelectObject
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
CreateCompatibleDC

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
RtlUnwind
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP

Exports

Exports

KillProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsis_plugin.dll
.dll windows:4 windows x86 arch:x86

7c58f908d174f6041ae16146003e99a8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\pulse\recipes\373670950\base\branches\ci_release_branch\googleclient\ci\build\ship\obj\tools\src\distribution_control\nsis_plugin_not_signed_dll.pdb

Imports

kernel32

GetStringTypeExW
lstrcpynW
GetFileAttributesExW
GetDateFormatW
GetNumberFormatW
GetLocaleInfoW
GetThreadLocale
GetSystemTimeAsFileTime
SystemTimeToFileTime
FileTimeToLocalFileTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
GetACP
GetLocaleInfoA
InterlockedCompareExchange
GetProcAddress
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedExchangeAdd
SleepEx
GetTickCount
GetSystemInfo
LocalFree
CreateMutexW
ReleaseSemaphore
CreateEventW
WaitForSingleObject
ReleaseMutex
CloseHandle
Sleep
lstrcmpW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
SetEndOfFile
ReadFile
WriteFile
GetConsoleCP
GetConsoleMode
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
HeapCreate
GetStdHandle
GetModuleFileNameA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetOEMCP
IsValidCodePage
SetStdHandle
SetFilePointer
GetExitCodeProcess
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CreateFileW
FlushFileBuffers
GetStringTypeA
GetStringTypeW
ResetEvent
GetLongPathNameW
RemoveDirectoryW
GetCurrentDirectoryW
LoadLibraryW
VirtualProtect
GetFileTime
MoveFileExW
lstrlenA
FindResourceExW
LockResource
SetEvent
GetVersionExW
GetNativeSystemInfo
GetLogicalDriveStringsW
QueryDosDeviceW
GetUserGeoID
GetGeoInfoW
OpenProcess
GlobalLock
GlobalUnlock
GetPrivateProfileStringW
ProcessIdToSessionId
GetFileSizeEx
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
SearchPathW
lstrlenW
GetModuleHandleW
SetLastError
GetModuleFileNameW
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
InterlockedIncrement
SizeofResource
lstrcmpiW
GetLastError
LoadResource
FindResourceW
InterlockedDecrement
DisableThreadLibraryCalls
DeleteCriticalSection
FreeLibrary
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
CompareStringW
lstrcpynA
WideCharToMultiByte
GlobalAlloc
GlobalFree
lstrcpyA
LoadLibraryExW
OpenMutexW
MulDiv
CopyFileW
SetEnvironmentVariableW
RegisterWaitForSingleObject
SetCurrentDirectoryW
DeleteFileW
SetFileAttributesW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindNextChangeNotification
FindFirstChangeNotificationW
FindClose
FindCloseChangeNotification
GetFileSize
GetTempPathW
FormatMessageW
ExpandEnvironmentStringsW
Thread32Next
Thread32First
GetShortPathNameW
ReadProcessMemory
WaitForSingleObjectEx
WaitForMultipleObjectsEx
AssignProcessToJobObject
CreateJobObjectW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetPrivateProfileIntW
GetPrivateProfileSectionNamesW
VerifyVersionInfoW
VerSetConditionMask
TerminateProcess
MultiByteToWideChar
CreateProcessW
VirtualQuery
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile

user32

GetDC
GetWindowRect
DestroyWindow
ReleaseDC
MapWindowPoints
LoadCursorW
GetWindowTextW
CreateDialogParamW
ReleaseCapture
SetCursor
SetWindowPos
CreateWindowExW
GetClientRect
CharLowerBuffW
MessageBoxW
SystemParametersInfoW
GetWindow
SetForegroundWindow
PeekMessageW
PostQuitMessage
MsgWaitForMultipleObjects
ExitWindowsEx
FlashWindow
EnumWindows
GetWindowThreadProcessId
PostThreadMessageW
IsWindowVisible
KillTimer
GetSystemMetrics
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
SetTimer
InvalidateRgn
RedrawWindow
DestroyAcceleratorTable
DestroyIcon
GetMenu
IsIconic
ClientToScreen
AdjustWindowRectEx
RegisterWindowMessageW
InSendMessageEx
IsChild
CreateAcceleratorTableW
UnregisterClassW
AllowSetForegroundWindow
FindWindowW
LoadImageW
PtInRect
GetClassInfoExW
GetSysColor
FillRect
GetFocus
DrawFocusRect
RegisterClassExW
SetWindowLongW
ShowWindow
DefWindowProcW
IsDialogMessageW
CharUpperBuffW
LoadBitmapW
MoveWindow
GetKeyState
EnableWindow
UnregisterClassA
wvsprintfW
IsCharAlphaW
CharLowerW
GetDlgItem
InvalidateRect
GetDlgCtrlID
CharNextW
SendMessageW
EndPaint
IsWindow
BeginPaint
GetClassNameW
SetFocus
PostMessageW
GetCapture
SetCapture
SetWindowTextW
CallWindowProcW
GetParent
UpdateWindow
OffsetRect
DispatchMessageW
SetRectEmpty
IsWindowEnabled
GetGUIThreadInfo
GetWindowTextLengthW
GetDesktopWindow
GetWindowLongW
GetCursorPos
ScreenToClient
GetMessageW
DrawTextW
TranslateMessage

ole32

CoCreateGuid
CLSIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleLockRunning
CoSetProxyBlanket
CoGetClassObject
CLSIDFromProgID
OleInitialize
CoInitialize
CoUnmarshalInterface
CoTaskMemAlloc
CoGetObject
CoCreateInstance
OleUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize

oleaut32

OleCreateFontIndirect
DispCallFunc
SysAllocStringLen
VariantCopy
VarUI4FromStr
SysFreeString
SysAllocString
LoadTypeLi
LoadRegTypeLi
SafeArrayGetUBound
VariantCopyInd
SafeArrayGetLBound
SafeArrayUnlock
SafeArrayLock
VariantClear
VariantInit
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SafeArrayGetVartype
SafeArrayCopy
SafeArrayCreate
SafeArrayDestroy

advapi32

RegOpenCurrentUser
GetSidSubAuthorityCount
AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetNamedSecurityInfoW
LookupAccountSidW
RevertToSelf
ImpersonateLoggedOnUser
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
RegNotifyChangeKeyValue
RegEnumValueW
RegRestoreKeyW
RegSaveKeyW
InitializeAcl
CloseServiceHandle
EqualSid
InitializeSecurityDescriptor
MakeAbsoluteSD
GetSecurityDescriptorControl
ConvertSidToStringSidW
GetSecurityDescriptorLength
IsValidSid
MakeSelfRelativeSD
GetLengthSid
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
GetSidSubAuthority
OpenProcessToken
InitializeSid
GetSecurityDescriptorGroup
GetSidLengthRequired
CopySid
AddAce
GetAclInformation
OpenSCManagerW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
RegDeleteKeyW
GetTokenInformation
OpenServiceW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorOwner
ConvertStringSidToSidW
RegUnLoadKeyW
RegLoadKeyW
CryptHashData
CryptAcquireContextW
CryptCreateHash
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
CryptVerifySignatureW
QueryServiceStatus
SetSecurityInfo

shlwapi

PathAppendW
PathCanonicalizeW
UrlCreateFromPathW
UrlUnescapeW
UrlEscapeW
PathCreateFromUrlW
PathRemoveFileSpecW
PathStripPathW
SHQueryValueExW
StrRetToStrW
PathFindFileNameW

gdi32

SetBkMode
SetTextColor
DeleteDC
DeleteObject
GetStockObject
GetObjectW
CreateFontIndirectW
SelectObject
GetTextExtentPoint32W
CreateFontW
CreateCompatibleBitmap
CreateSolidBrush
BitBlt
GetDeviceCaps
CreateCompatibleDC

shell32

SHGetDesktopFolder
ShellExecuteW
SHGetFolderLocation
ShellExecuteExW
SHCreateDirectoryExW
SHChangeNotify
Shell_NotifyIconW
SHGetFolderPathW

comctl32

ImageList_Add
ImageList_Create
_TrackMouseEvent

psapi

EnumProcessModules
EnumProcesses
GetModuleFileNameExW
GetProcessImageFileNameW

iphlpapi

GetIfTable

msi

ord205

userenv

UnloadUserProfile

urlmon

CreateURLMoniker

crypt32

CertFreeCertificateContext
CertGetNameStringW
CertCreateCertificateContext
CryptImportPublicKeyInfo

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Exports

Exports

Create
GooglePackCompatibilityCheck

Sections

.text
Size: 595KB - Virtual size: 595KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$R1/MSGRP2P.xml
.xml
$SYSDIR/gtapi.dll
.dll windows:4 windows x86 arch:x86

91071b71e06d53c1a5bb85e8a41231c2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build_server\Bar\googleclient\bar\build\opt\obj\partner\gtapi\gtapi.pdb

Imports

advapi32

RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegCloseKey

kernel32

lstrcmpA
lstrlenA
lstrcmpiA
GetCurrentThreadId
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect
GetSystemInfo

user32

CharUpperA
CharNextA

Exports

Exports

ToolbarCompatibilityCheck

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/gtapi_pack.dll
.dll windows:4 windows x86 arch:x86

a15c8ee80b0e018ee4bbdc4d0cb469d0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

31:44:c0:6a:6c:fb:50:76:c1:5d:39:95:72:c6:94:21
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

19/06/2007, 00:00

Not After

18/06/2010, 23:59

Subject

CN=Google Inc,OU=Digital ID Class 3 - Netscape Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b5:5c:91:c6:f5:e2:d3:49:29:7b:f3:61:55:34:80:04:37:a3:09:a9
Signer

Actual PE Digest

b5:5c:91:c6:f5:e2:d3:49:29:7b:f3:61:55:34:80:04:37:a3:09:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\pulse\recipes\244945231\base\googleclient\ci\build\ship\obj\tools\src\install_precheck\gpapi_not_signed_dll.pdb

Imports

advapi32

RegOpenKeyExW
RegCloseKey
AllocateAndInitializeSid
FreeSid
CheckTokenMembership

shlwapi

SHQueryValueExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetCPInfo
QueryPerformanceCounter
VirtualFree
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
GetModuleHandleA
VirtualAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrcmpiW
lstrlenW
GetVersionExW
GetCurrentProcess
CloseHandle
FindResourceW
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceExW
GetLastError
SetLastError
GetStringTypeExW
MultiByteToWideChar
WideCharToMultiByte
lstrcpynW
GetFileAttributesExW
GetCurrentProcessId
GetTickCount
FlushFileBuffers
SetFilePointer
WriteFile
GetSystemTimeAsFileTime
GetCommandLineA
GetThreadLocale
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
InterlockedCompareExchange
InterlockedDecrement
ExitProcess
IsDebuggerPresent
Sleep
TerminateProcess
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
GetACP
GetLocaleInfoA
GetCurrentThreadId

user32

UnregisterClassA
wvsprintfW
CharLowerW

Exports

Exports

GooglePackCompatibilityCheck

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/nsis_loader.dll
.dll windows:4 windows x86 arch:x86

64ac47d8853464f1277297b81208868c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3953
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord1089
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord800
ord860
ord540
ord1176
ord1575
ord1168
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord3825
ord4274
ord6467
ord1578
ord269
ord826
ord600
ord1116

msvcrt

_except_handler3
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
??2@YAPAXI@Z
__CxxFrameHandler

kernel32

LocalFree
GetCurrentProcess
OpenProcess
CloseHandle
GetModuleHandleA
GetProcAddress
LocalAlloc

psapi

GetModuleFileNameExA

Exports

Exports

GetLoader

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 462B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/GoogleToolbarInstaller_zh-CN_signed.msi
.msi
$TEMP/UUSeeDownLoad.exe
.exe windows:4 windows x86 arch:x86

d80853f9cff979cf19aff5b60e684218

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

16:b4:c2:b4:98:d7:04:3a:41:88:31:f3:33:da:d5:39:93:11:f5:c3
Signer

Actual PE Digest

16:b4:c2:b4:98:d7:04:3a:41:88:31:f3:33:da:d5:39:93:11:f5:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
GetLastError
FormatMessageA
GetTempPathA
GetModuleHandleA
GetCommandLineA
GetTickCount

shell32

ShellExecuteA

mfc42

ord1575
ord4160
ord800
ord540
ord825
ord860
ord2763
ord535
ord858
ord4277
ord5683
ord6877
ord2818
ord561
ord815
ord6876
ord537

msvcrt

__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__CxxFrameHandler
__dllonexit
__p___initenv
exit
_XcptFilter
_exit
_onexit

urlmon

URLDownloadToFileA

msvcp60

?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/stubinst_signed.exe
.exe windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

31:44:c0:6a:6c:fb:50:76:c1:5d:39:95:72:c6:94:21
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

19/06/2007, 00:00

Not After

18/06/2010, 23:59

Subject

CN=Google Inc,OU=Digital ID Class 3 - Netscape Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4c:cb:35:1c:1f:ee:f6:db:44:c5:89:be:b3:9f:97:b0:73:7e:e9:ed
Signer

Actual PE Digest

4c:cb:35:1c:1f:ee:f6:db:44:c5:89:be:b3:9f:97:b0:73:7e:e9:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 1.2MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UUPlayer.dll
.dll windows:4 windows x86 arch:x86

07a59053b8df3c4ea7a45e85568c5d0c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a1:41:13:3d:60:2e:ef:f7:a6:a5:96:d8:c1:42:b5:37:52:48:d5:f7
Signer

Actual PE Digest

a1:41:13:3d:60:2e:ef:f7:a6:a5:96:d8:c1:42:b5:37:52:48:d5:f7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42u

ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord3948
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord4480
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4616
ord4418
ord3733
ord561
ord825
ord815
ord1173
ord1568
ord1165
ord1570
ord1179
ord342
ord1240
ord1194
ord1563
ord1248
ord6371
ord2980
ord4269
ord269
ord826
ord600
ord1571
ord6466
ord1250
ord1115

msvcrt

??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
??2@YAPAXI@Z
__CxxFrameHandler

kernel32

LocalFree
LocalAlloc

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 496KB - Virtual size: 492KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UUPlayer_2008_update.ini
UUSeePlayer.exe
.exe windows:4 windows x86 arch:x86

c05d9cf6bf3a1f896975e98e088865c1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d2:ad:20:79:d8:2e:3b:be:cd:5c:f8:67:02:18:69:70:aa:3d:e9:f4
Signer

Actual PE Digest

d2:ad:20:79:d8:2e:3b:be:cd:5c:f8:67:02:18:69:70:aa:3d:e9:f4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord4601
ord4710
ord4744
ord4602
ord5010
ord4369
ord4846
ord4828
ord355
ord4224
ord5228
ord1173
ord5264
ord6375
ord1230
ord3442
ord3191
ord4155
ord941
ord2385
ord2644
ord1560
ord5579
ord268
ord1662
ord2078
ord2550
ord6266
ord6374
ord4118
ord4875
ord539
ord4273
ord3568
ord5819
ord3659
ord3566
ord996
ord640
ord5781
ord1633
ord323
ord2854
ord415
ord613
ord289
ord715
ord5637
ord1859
ord2861
ord3614
ord816
ord5785
ord562
ord283
ord2746
ord1863
ord686
ord5603
ord2754
ord897
ord2400
ord1635
ord2445
ord1854
ord4215
ord2576
ord3649
ord2430
ord6138
ord2559
ord5784
ord5783
ord5871
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6017
ord6168
ord5869
ord5790
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord3591
ord2755
ord3915
ord472
ord6190
ord2855
ord3981
ord2914
ord3697
ord1083
ord501
ord807
ord2915
ord2004
ord4158
ord2112
ord554
ord1614
ord4197
ord5602
ord2745
ord696
ord1258
ord5638
ord4180
ord5624
ord2444
ord4018
ord909
ord1808
ord2538
ord3810
ord291
ord1109
ord2715
ord2382
ord3054
ord5094
ord5097
ord4461
ord4298
ord3345
ord5006
ord975
ord5468
ord3398
ord2874
ord2873
ord4146
ord4072
ord5233
ord5278
ord2641
ord1658
ord4430
ord1717
ord5252
ord4421
ord706
ord408
ord1857
ord5095
ord2093
ord5098
ord3346
ord976
ord4147
ord2374
ord5279
ord5250
ord2437
ord401
ord674
ord1850
ord2094
ord5469
ord407
ord645
ord1856
ord5248
ord366
ord1834
ord5801
ord4140
ord5480
ord3227
ord1134
ord1137
ord2144
ord1851
ord3348
ord4616
ord1811
ord3097
ord6150
ord2523
ord4358
ord4052
ord5467
ord4116
ord2381
ord5077
ord1702
ord1706
ord5230
ord6365
ord5275
ord5244
ord2436
ord331
ord4231
ord6644
ord2706
ord3638
ord394
ord773
ord5436
ord6379
ord5446
ord6390
ord3716
ord795
ord4270
ord5438
ord3313
ord5180
ord354
ord755
ord470
ord2294
ord2397
ord713
ord6137
ord414
ord5777
ord4629
ord3635
ord3688
ord6597
ord4128
ord4292
ord2372
ord6688
ord3296
ord3281
ord3084
ord3288
ord6003
ord3282
ord4120
ord3292
ord3291
ord3995
ord3909
ord6004
ord3792
ord5431
ord1676
ord1666
ord2620
ord5976
ord2633
ord4117
ord6210
ord6192
ord4293
ord5944
ord3083
ord3866
ord3869
ord3868
ord6194
ord4281
ord4278
ord3132
ord3791
ord5715
ord6088
ord3519
ord4027
ord6091
ord4030
ord2541
ord2425
ord3574
ord426
ord726
ord3785
ord2813
ord920
ord833
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord3733
ord561
ord815
ord4041
ord2137
ord2136
ord6221
ord5227
ord5243
ord2124
ord4595
ord6113
ord1202
ord1131
ord824
ord1197
ord4199
ord826
ord2717
ord5296
ord6149
ord798
ord1989
ord5461
ord5188
ord533
ord6665
ord551
ord3332
ord3806
ord1155
ord2822
ord1941
ord4029
ord3000
ord3170
ord3172
ord3494
ord6921
ord4688
ord466
ord3991
ord3993
ord2092
ord5930
ord5210
ord929
ord937
ord3404
ord935
ord939
ord801
ord6874
ord6139
ord541
ord668
ord3173
ord4053
ord2773
ord2762
ord356
ord547
ord2070
ord2081
ord2072
ord2108
ord2105
ord2106
ord2100
ord2086
ord6608
ord2115
ord4042
ord4294
ord3393
ord3728
ord4396
ord3365
ord810
ord693
ord4266
ord2085
ord3747
ord556
ord809
ord1088
ord2114
ord2567
ord4390
ord3569
ord609
ord4238
ord956
ord6238
ord2572
ord4394
ord3625
ord682
ord2403
ord2015
ord4213
ord2570
ord4392
ord3577
ord616
ord6316
ord4474
ord3605
ord656
ord6919
ord6920
ord6354
ord6153
ord3285
ord3711
ord790
ord3714
ord793
ord3693
ord765
ord3626
ord683
ord6735
ord6511
ord2631
ord5491
ord729
ord2496
ord1699
ord430
ord3211
ord5778
ord4037
ord3703
ord781
ord5681
ord3269
ord439
ord736
ord4517
ord4078
ord1937
ord4522
ord4536
ord4538
ord4519
ord4524
ord5647
ord3122
ord3611
ord350
ord5641
ord1824
ord3121
ord349
ord550
ord1825
ord2912
ord2795
ord958
ord6308
ord4172
ord6006
ord5769
ord2593
ord3175
ord3178
ord3171
ord3502
ord5061
ord1826
ord1568
ord1570
ord5706
ord6278
ord6279
ord536
ord927
ord3753
ord6758
ord3403
ord3222
ord3049
ord3420
ord3875
ord5929
ord3805
ord933
ord6910
ord6605
ord6504
ord6733
ord2634
ord6330
ord4050
ord3312
ord5856
ord2776
ord5852
ord3298
ord1771

msvcrt

wcstod
_ftol
_itoa
wcscmp
_wcsicmp
__CxxFrameHandler
_onexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_controlfp
sprintf
_wtoi
_except_handler3
printf
isalnum
wcschr
localtime
time
isalpha
iswdigit
_purecall
_wremove
fclose
fread
ftell
fseek
_wfopen
fwrite
wcscpy
wcsncpy
wcslen
wcsncmp
wcstol
strerror
_errno
_wcsnicmp
swprintf
wcsstr
memmove
wcscat
_beginthreadex
free
malloc
wcsrchr
_wcsupr
_beginthread
_waccess
fflush
srand
exit
_wtol
swscanf
rand
_snprintf
atof
toupper
_wsplitpath
fgets
fgetws
isspace
strncmp
strchr
tolower
fprintf
fopen
fputc
sscanf
fputs
_wchdir
_wgetcwd
wcscoll
_CxxThrowException
calloc
memcpy
memset
_exit
_XcptFilter
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__dllonexit

kernel32

lstrcpyW
CreateFileW
OutputDebugStringW
SetFilePointer
VirtualQuery
GetVersionExW
CreateProcessW
CloseHandle
CreateDirectoryW
WriteFile
WaitForSingleObject
ResumeThread
GetModuleFileNameW
WideCharToMultiByte
GetDriveTypeW
SetVolumeLabelW
GetDiskFreeSpaceW
GetStartupInfoW
lstrlenW
GetSystemInfo
GetFileTime
GetFileSize
FileTimeToDosDateTime
FileTimeToLocalFileTime
GlobalMemoryStatus
GetSystemTimeAsFileTime
IsBadCodePtr
IsBadReadPtr
GetProcAddress
GetModuleHandleW
DeviceIoControl
SetPriorityClass
GetCurrentProcess
CompareStringW
OpenProcess
MultiByteToWideChar
GetFileAttributesW
lstrcpynW
LockResource
LoadResource
FindResourceW
GetVersion
LocalFree
FormatMessageW
GetLastError
MulDiv
GetTickCount
SetLastError
GetCurrentThreadId
LoadLibraryW
FreeLibrary
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GetSystemDirectoryW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CopyFileW
CreateEventW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SizeofResource
ResetEvent
SetEvent
Sleep
LoadLibraryExW
lstrcpyA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetProcessTimes
Process32NextW
TerminateProcess
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
CreateSemaphoreW
GetCommandLineW
GetTempPathW
GetPrivateProfileStringW
LocalFileTimeToFileTime
SystemTimeToFileTime
lstrcmpW
GetProcessHeap
HeapFree
HeapAlloc
GlobalMemoryStatusEx
HeapReAlloc
GetACP
GetTimeZoneInformation
GetPrivateProfileIntW
GetPrivateProfileStructW
WritePrivateProfileStringW
lstrlenA
GetExitCodeThread
SetFileAttributesW
VirtualProtect
FlushInstructionCache

user32

SetScrollPos
SetScrollRange
ShowScrollBar
GetPropA
SendMessageA
SetWindowLongA
GetWindowLongA
OemToCharBuffA
CharToOemBuffA
MapWindowPoints
SetCursorPos
UpdateWindow
GetActiveWindow
SetCursor
InvalidateRect
GetDC
CallNextHookEx
GetClassNameW
GetWindowLongW
CallWindowProcW
GetPropW
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowLongW
IntersectRect
DeleteMenu
IsRectEmpty
ClientToScreen
RedrawWindow
GetMenuState
LoadMenuW
GetDesktopWindow
GetMenuStringW
InsertMenuW
ModifyMenuW
GetMenuDefaultItem
GrayStringW
DrawTextW
TabbedTextOutW
DrawEdge
SetRect
DrawFocusRect
DrawStateW
InflateRect
GetClientRect
GetMenuItemCount
GetSubMenu
GetMenuItemID
WindowFromDC
CopyRect
GetMenuInfo
DestroyIcon
GetIconInfo
FillRect
GetMenuItemRect
GetMenuItemInfoW
OffsetRect
SetScrollInfo
SetMenuInfo
GetSysColor
GetWindowDC
CloseClipboard
SetClipboardData
EmptyClipboard
ReleaseDC
LoadBitmapW
RemovePropW
PostQuitMessage
EnableMenuItem
CheckMenuItem
SetParent
SetMenuDefaultItem
GetMessagePos
IsZoomed
IsIconic
GetScrollInfo
EnableScrollBar
RegisterClipboardFormatW
GetCapture
GetWindowRgn
GetDlgCtrlID
TrackMouseEvent
SetCapture
ReleaseCapture
SetForegroundWindow
GetSystemMetrics
SetWindowPos
IsWindowEnabled
IsWindow
SetFocus
MessageBoxW
wvsprintfW
wsprintfW
UnregisterHotKey
RegisterHotKey
GetKeyState
LoadCursorW
DefWindowProcW
SetTimer
SetWindowRgn
ShowWindow
SystemParametersInfoW
GetWindowRect
ScreenToClient
SetRectEmpty
EqualRect
PeekMessageW
UnionRect
LoadStringW
WindowFromPoint
FindWindowExW
SetPropW
keybd_event
LoadIconW
GetFocus
IsChild
MenuItemFromPoint
GetMenu
DestroyMenu
GetSystemMenu
LoadImageW
RegisterWindowMessageW
GetParent
EnableWindow
PostMessageW
GetWindowThreadProcessId
GetCursorPos
IsWindowVisible
SendMessageW
GetScrollRange
IsMenu
GetScrollPos
OpenClipboard
SetActiveWindow
TranslateMessage
GetMessageW
PtInRect
KillTimer
GetForegroundWindow
DispatchMessageW
LoadAcceleratorsW
TranslateAcceleratorW
GetWindow

gdi32

CreateBitmap
CreatePolygonRgn
SetStretchBltMode
SetBkColor
SetTextColor
GetCurrentObject
GetObjectType
MoveToEx
LineTo
GetTextColor
CombineRgn
CreatePenIndirect
GetWindowExtEx
GetViewportExtEx
LPtoDP
GetMapMode
DPtoLP
GetBkColor
StretchBlt
SelectObject
DeleteDC
SelectClipRgn
CreateRectRgnIndirect
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
UnrealizeObject
SetBrushOrgEx
CreatePen
Rectangle
BitBlt
GetTextExtentPoint32W
RoundRect
DeleteObject
GetObjectW
GetPixel
SetPixel
GetNearestColor
CreateFontIndirectW
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
CreatePatternBrush
CreateSolidBrush
CreateRoundRectRgn
CreateRectRgn

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

GetUserNameW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegEnumValueW
RegOpenKeyW
RegCreateKeyExW
RegDeleteValueW
RegCloseKey

shell32

SHGetFolderPathW
DragQueryFileW
DragFinish
SHChangeNotify
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW

comctl32

ImageList_Replace
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetIcon
ImageList_GetImageCount
ImageList_Draw
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_AddMasked

ole32

CoUninitialize
CoGetMalloc
CreateStreamOnHGlobal
CoInitialize
CoCreateInstance
ProgIDFromCLSID
CLSIDFromString

olepro32

ord251

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Xlen@std@@YAXXZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

ws2_32

recvfrom
setsockopt
socket
WSAStartup
inet_ntoa
WSAGetLastError
connect
send
recv
htons
gethostbyname
inet_addr
sendto
closesocket
WSACleanup

psapi

EmptyWorkingSet
GetModuleFileNameExW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wininet

InternetQueryOptionW
CreateUrlCacheEntryW
InternetSetCookieW
CommitUrlCacheEntryW
InternetReadFile
HttpQueryInfoW
InternetOpenUrlW
InternetCloseHandle
InternetOpenA
InternetGetConnectedState
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
FindFirstUrlCacheEntryW

iphlpapi

GetAdaptersInfo
GetIpForwardTable

winmm

waveOutGetNumDevs

shlwapi

PathFileExistsW
PathIsDirectoryW

msimg32

TransparentBlt
AlphaBlend

Exports

Exports

?interfaceMap@CCustomControlSite@@1UAFX_INTERFACEMAP@@B

Sections

.text
Size: 860KB - Virtual size: 856KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 329KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bass-plugins.exe
.exe windows:4 windows x86 arch:x86

170729c4965736ee8f8f4d1bab77cf38

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2a:ad:53:44:36:0b:0d:77:90:50:8f:03:6d:15:c2:7d:bd:a0:c1:a4
Signer

Actual PE Digest

2a:ad:53:44:36:0b:0d:77:90:50:8f:03:6d:15:c2:7d:bd:a0:c1:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
GetCommandLineA
CloseHandle
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
MulDiv
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SendMessageTimeoutA

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 288KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/FindProcDLL.dll
.dll windows:4 windows x86 arch:x86

c480ee4d2a64d4a16edee43fdfe35079

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
HeapCreate
VirtualFree
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
FreeLibrary
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
DisableThreadLibraryCalls
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetACP
GetOEMCP
WriteFile
VirtualAlloc
RtlUnwind
GetStringTypeA
GetStringTypeW
GetCPInfo

user32

wsprintfA

Exports

Exports

FindProc

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

57354bdeea3dfae6e948101add87501a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
GetPrivateProfileIntA
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
MultiByteToWideChar
GlobalAlloc

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
MapWindowPoints
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadIconA

gdi32

SetTextColor
GetObjectA
SelectObject
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
CreateCompatibleDC

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
RtlUnwind
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP

Exports

Exports

KillProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
CCTVPlayer.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:d8:6e:d0:58:dc:2b:a8:b8:10:75:e6:ca:a2:80:d1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07/01/2009, 00:00

Not After

07/01/2010, 23:59

Subject

CN=CCTV International Networks Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Video Technology,O=CCTV International Networks Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

37:3d:60:c0:30:90:4d:be:c1:9c:23:a9:46:95:93:a3:40:7a:65:bb
Signer

Actual PE Digest

37:3d:60:c0:30:90:4d:be:c1:9c:23:a9:46:95:93:a3:40:7a:65:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

UPX0
Size: - Virtual size: 492KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 272KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CoCode.dll
.dll windows:5 windows x86 arch:x86

fd41c89ab9f125174e3a5d62ed38c115

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

57:3f:f6:bb:81:e8:a3:ec:3f:a2:82:32:4a:b2:3d:55:3f:0d:90:4a
Signer

Actual PE Digest

57:3f:f6:bb:81:e8:a3:ec:3f:a2:82:32:4a:b2:3d:55:3f:0d:90:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\myprog\CoCode\CoCode\Release\CoCode.pdb

Imports

kernel32

GetTickCount
InterlockedIncrement
InterlockedDecrement
GetCurrentProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
Sleep
GetLastError
CreateSemaphoreW
CloseHandle
HeapAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
HeapSize
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
GetModuleHandleA

Exports

Exports

eric
ericex
ericexex
ericexexex
erichahaha
ericzhao
ericzsq
zhaoeric
zsq
zsqeric

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MediaCenter.ini
UFDeMux.ax
.dll regsvr32 windows:4 windows x86 arch:x86

e3c137f27b904b663fa5c90fb96b156a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:2e:b5:51:18:53:79:66:42:71:40:8b:bb:fa:e2:8a:2e:c5:31:ab
Signer

Actual PE Digest

08:2e:b5:51:18:53:79:66:42:71:40:8b:bb:fa:e2:8a:2e:c5:31:ab

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

waveOutGetNumDevs

kernel32

WaitForSingleObject
ResetEvent
CloseHandle
InterlockedExchange
SetThreadPriority
Sleep
lstrcpynW
lstrlenW
InterlockedIncrement
InterlockedDecrement
CreateEventW
VirtualFree
lstrcmpW
GetCurrentProcess
GetCurrentThreadId
VirtualAlloc
SetEvent
GetProcAddress
GetModuleHandleW
GetTickCount
GetLastError
GetVersionExW
CreateThread
MultiByteToWideChar
lstrlenA
GetModuleFileNameA
DisableThreadLibraryCalls
GetStringTypeW
GetStringTypeA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LCMapStringA
LCMapStringW
SetStdHandle
FreeLibrary
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
GetConsoleMode
GetConsoleCP
SetFilePointer
RaiseException
HeapFree
RtlUnwind
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
HeapReAlloc
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
HeapSize
GetLocaleInfoA
WriteConsoleA

advapi32

RegSetValueW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegCreateKeyW

ole32

CoTaskMemAlloc
CoInitialize
CoFreeUnusedLibraries
CoUninitialize
CoCreateInstance
StringFromGUID2
CoTaskMemFree

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 108KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UFSource.ax
.dll regsvr32 windows:4 windows x86 arch:x86

376d0c418d10c2eeaba61ca79a12d2e1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a9:19:13:85:b9:ea:b4:63:ee:21:57:e4:52:74:4a:e8:66:3b:06:eb
Signer

Actual PE Digest

a9:19:13:85:b9:ea:b4:63:ee:21:57:e4:52:74:4a:e8:66:3b:06:eb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\FFormat\UFSource\Release\UFSource.pdb

Imports

kernel32

CloseHandle
WaitForMultipleObjects
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersion
CreateEventA
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetCurrentThreadId
GetTickCount
GetVersionExA
CreateSemaphoreA
InterlockedIncrement
WaitForSingleObject
ReleaseSemaphore
GetSystemInfo
VirtualFree
GetCurrentProcess
VirtualAlloc
FreeLibrary
LoadLibraryA
lstrlenA
GetModuleFileNameA
DisableThreadLibraryCalls
GetLocaleInfoA
IsValidCodePage
GetOEMCP
GetCPInfo
HeapSize
GetLastError
CreateThread
ResetEvent
SetEvent
InterlockedDecrement
HeapReAlloc
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
WriteFile
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
QueryPerformanceCounter

user32

wsprintfA

advapi32

RegCreateKeyA
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA

ole32

StringFromGUID2
CoTaskMemFree
CoFreeUnusedLibraries
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoInitialize

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UUPlayer.exe
.exe windows:4 windows x86 arch:x86

cdc28a82c5f93ee4c8db41c7ffe0dc6b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

dd:28:0e:b8:c0:0f:42:50:25:d5:5f:ee:48:75:91:8e:05:68:51:ab
Signer

Actual PE Digest

dd:28:0e:b8:c0:0f:42:50:25:d5:5f:ee:48:75:91:8e:05:68:51:ab

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord2977
ord3142
ord3254
ord4459
ord4480
ord3257
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4616
ord4418
ord3733
ord561
ord825
ord815
ord4272
ord2756
ord4199
ord1569
ord6371
ord4269
ord540
ord538
ord858
ord800
ord3131
ord535
ord1165

msvcrt

__p__fmode
__set_app_type
_except_handler3
__dllonexit
_onexit
_controlfp
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
__CxxFrameHandler
__p__commode

kernel32

GetStartupInfoW
GetCommandLineW
GetModuleHandleW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shell32

ShellExecuteW

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UUPlayer.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

26eef8b0cb3ead57a7b656ca4380a9b2

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cc:be:f2:6b:5b:66:14:bd:c4:79:79:ee:a0:a8:07:0c:ce:41:a9:30
Signer

Actual PE Digest

cc:be:f2:6b:5b:66:14:bd:c4:79:79:ee:a0:a8:07:0c:ce:41:a9:30

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3401
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3670
ord561
ord3952
ord2724
ord6354
ord1216
ord1168
ord6467
ord1227
ord535
ord1877
ord4249
ord2486
ord2687
ord6364
ord3326
ord6365
ord4472
ord5498
ord3278
ord3353
ord3681
ord446
ord743
ord1177
ord1226
ord1210
ord2439
ord1693
ord5618
ord994
ord4342
ord4687
ord4639
ord5674
ord2156
ord4856
ord4920
ord6002
ord2137
ord1963
ord5213
ord2953
ord3868
ord5150
ord4705
ord4707
ord2876
ord2998
ord5649
ord4113
ord4661
ord4660
ord4768
ord4650
ord4903
ord4548
ord4521
ord4594
ord4988
ord4925
ord4930
ord4935
ord4659
ord4909
ord4908
ord4668
ord4667
ord4666
ord4648
ord4689
ord5023
ord4654
ord4643
ord4354
ord4780
ord4649
ord4637
ord4636
ord5060
ord4584
ord4371
ord4361
ord4356
ord4739
ord4741
ord4738
ord4409
ord4079
ord5008
ord4415
ord4992
ord4979
ord2488
ord3404
ord4539
ord2954
ord6055
ord4078
ord1776
ord4407
ord5241
ord2384
ord5163
ord6370
ord4353
ord5290
ord3798
ord4837
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2983
ord3148
ord3260
ord4466
ord3269
ord2986
ord3080
ord4081
ord4624
ord5825
ord723
ord3946
ord423
ord2541
ord4949
ord6199
ord4459
ord3663
ord3626
ord6819
ord2414
ord283
ord6880
ord6030
ord2864
ord926
ord4129
ord5683
ord924
ord6930
ord6928
ord1601
ord4204
ord6282
ord1105
ord4441
ord2795
ord1892
ord4252
ord1212
ord4570
ord4672
ord4843
ord5011
ord5265
ord4376
ord4853
ord4998
ord4713
ord2514
ord6052
ord1775
ord2385
ord6371
ord5286
ord4438
ord3279
ord4625
ord4425
ord449
ord746
ord2278
ord1132
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord815
ord823
ord860
ord537
ord540
ord2818
ord922
ord858
ord800
ord4603
ord825
ord1131

msvcrt

memcpy
_ftol
sprintf
_strnicmp
__CxxFrameHandler
printf
isalnum
wcsncpy
wcslen
_access
strtok
atof
atoi
_adjust_fdiv
malloc
_initterm
free
__dllonexit
_onexit
??1type_info@@UAE@XZ

kernel32

GetCurrentProcess
SetPriorityClass
CreateFileA
CloseHandle
DeviceIoControl
GetVersionExA
TerminateProcess
Sleep
ReadFile
PeekNamedPipe
GetTickCount
LocalFree
LocalAlloc
CreateThread
CreateProcessA
WriteFile
CreateDirectoryA
CreatePipe

user32

FillRect
MessageBoxA
GetWindowRect
SendMessageA
EnableWindow
wsprintfA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

ole32

CoCreateInstance

oleaut32

LoadRegTypeLi

ws2_32

closesocket
WSACleanup
WSAStartup
socket

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xlen@std@@YAXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

iphlpapi

GetAdaptersInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UUSeeMediaCenter.exe
.exe windows:4 windows x86 arch:x86

51f3ef0d7e19ff82c46aa41161706a28

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

00:8a:da:fe:d3:73:76:08:eb:3c:ce:c5:a4:4c:17:45:9b:20:2d:30
Signer

Actual PE Digest

00:8a:da:fe:d3:73:76:08:eb:3c:ce:c5:a4:4c:17:45:9b:20:2d:30

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetUserNameW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

mfc42u

ord2910
ord1775
ord2634
ord536
ord2933
ord3312
ord6279
ord6278
ord2756
ord5706
ord1570
ord1568
ord2385
ord5349
ord5352
ord5804
ord5199
ord3224
ord2755
ord389
ord4273
ord6655
ord3806
ord6374
ord1644
ord1197
ord1230
ord551
ord2078
ord4294
ord6266
ord1940
ord2388
ord3341
ord5296
ord5299
ord4074
ord4693
ord5303
ord5285
ord4616
ord817
ord565
ord2718
ord4221
ord2248
ord996
ord613
ord289
ord5819
ord3659
ord415
ord715
ord5637
ord3568
ord640
ord323
ord2854
ord1859
ord2861
ord816
ord5785
ord562
ord283
ord2746
ord1863
ord686
ord5603
ord2754
ord897
ord2400
ord1635
ord2445
ord1854
ord3696
ord500
ord772
ord1173
ord2430
ord6138
ord2559
ord5784
ord5783
ord5871
ord4272
ord3915
ord472
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6017
ord6168
ord5869
ord5790
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord3591
ord6190
ord3688
ord3614
ord3566
ord2855
ord1633
ord5781
ord4215
ord2576
ord3649
ord5568
ord2914
ord807
ord2915
ord2004
ord2112
ord554
ord1172
ord4197
ord5852
ord1192
ord5602
ord4158
ord2745
ord696
ord1258
ord4018
ord2444
ord1808
ord2538
ord3810
ord291
ord1109
ord2715
ord2382
ord3054
ord5094
ord5097
ord4461
ord4298
ord3345
ord5006
ord975
ord5468
ord3398
ord2874
ord2873
ord4146
ord4072
ord5233
ord5278
ord2641
ord1658
ord4430
ord1717
ord5252
ord4421
ord706
ord1857
ord5095
ord2093
ord5098
ord3346
ord976
ord4147
ord2374
ord5279
ord5250
ord2437
ord674
ord1850
ord2094
ord5469
ord645
ord1856
ord5248
ord1834
ord4140
ord5480
ord3227
ord1134
ord1137
ord4155
ord5801
ord2144
ord1851
ord4689
ord5935
ord5191
ord1995
ord5726
ord3943
ord2177
ord2176
ord4209
ord3102
ord5612
ord988
ord3439
ord3188
ord4157
ord3348
ord6449
ord709
ord411
ord1811
ord3097
ord6150
ord2523
ord861
ord4052
ord5467
ord4116
ord2381
ord5077
ord1702
ord1706
ord5230
ord6365
ord5275
ord5244
ord2436
ord331
ord4231
ord6644
ord2706
ord5856
ord1614
ord3981
ord3651
ord407
ord326
ord3652
ord408
ord3645
ord401
ord3618
ord366
ord3638
ord394
ord4180
ord909
ord5624
ord3697
ord1083
ord5638
ord773
ord501
ord5446
ord6390
ord5436
ord6379
ord2680
ord3792
ord5431
ord1676
ord1666
ord2620
ord5976
ord2633
ord4117
ord6210
ord6192
ord4293
ord5944
ord3083
ord3866
ord3869
ord3868
ord6194
ord4281
ord4278
ord3132
ord3791
ord5715
ord6088
ord3519
ord4027
ord6091
ord4030
ord2541
ord2425
ord3574
ord726
ord426
ord3785
ord920
ord3805
ord833
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord5298
ord4692
ord5710
ord3733
ord561
ord815
ord826
ord6113
ord1202
ord1131
ord824
ord4041
ord2137
ord2136
ord6221
ord5227
ord5243
ord2124
ord4595
ord2717
ord3313
ord5180
ord354
ord1155
ord2822
ord1941
ord4029
ord6191
ord3865
ord4028
ord433
ord5571
ord1565
ord2070
ord2081
ord2072
ord2108
ord2105
ord2106
ord2100
ord2086
ord6608
ord2092
ord2115
ord6437
ord4270
ord1229
ord755
ord470
ord4042
ord3716
ord795
ord556
ord809
ord2372
ord4118
ord1088
ord2114
ord2567
ord4390
ord3569
ord609
ord3084
ord2403
ord2015
ord4213
ord2570
ord4392
ord3577
ord616
ord6316
ord4474
ord6238
ord3605
ord656
ord6919
ord6921
ord6920
ord3711
ord790
ord3714
ord793
ord3693
ord765
ord3626
ord683
ord6735
ord6511
ord6354
ord3747
ord2574
ord3635
ord693
ord4238
ord3288
ord956
ord3296
ord6597
ord6688
ord3281
ord4396
ord3728
ord810
ord4266
ord3298
ord3285
ord3292
ord3291
ord3282
ord6153
ord3365
ord2631
ord5491
ord729
ord2496
ord1699
ord430
ord3993
ord6003
ord3211
ord5778
ord4037
ord3393
ord2085
ord3703
ord781
ord2572
ord4394
ord3625
ord682
ord5681
ord3269
ord439
ord736
ord4517
ord4078
ord1937
ord4522
ord4536
ord4538
ord4519
ord4524
ord4050
ord1771
ord925
ord6376
ord2294
ord6871
ord6211
ord860
ord5977
ord2857
ord1235
ord857
ord1143
ord2233
ord465
ord4219
ord535
ord353
ord6381
ord1971
ord665
ord942
ord2810
ord6898
ord6896
ord2606
ord1105
ord823
ord538
ord5679
ord4124
ord940
ord384
ord2088
ord4279
ord5949
ord818
ord2127
ord567
ord3397
ord5286
ord4769
ord4495
ord4494
ord4452
ord3016
ord4768
ord4804
ord1130
ord4493
ord2858
ord5047
ord4718
ord4451
ord2447

msvcrt

_wsplitpath
_vsnprintf
_vsnwprintf
_wremove
malloc
free
fgets
memmove
wcscat
_mbstok
_itoa
_strlwr
_stricmp
_wcsnicmp
fgetws
_exit
_XcptFilter
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UAE@XZ
_controlfp
_beginthreadex
strcpy
__CxxFrameHandler
strlen
sprintf
memset
memcpy
exit
wcstod
_wcsicmp
_wtoi
wcscmp
_ftol
strcat
strcmp
_except_handler3
_purecall
memcmp
?what@exception@@UBEPBDXZ
fclose
fflush
fwrite
_wfopen
_wtol
??0exception@@QAE@ABQBD@Z
_CxxThrowException
??1exception@@UAE@XZ
rand
srand
time
localtime
swprintf
wcscpy
wcsncpy
wprintf
wcsncmp
wcslen
strncat
getenv
atoi
printf
strtok
sscanf
atol
strstr
fopen
fread
ftell
fseek
swscanf

kernel32

CreateFileW
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcpyW
IsBadReadPtr
IsBadCodePtr
lstrcpynW
CreateDirectoryW
GetVersionExW
CreateProcessW
CloseHandle
ResumeThread
GetExitCodeThread
Process32NextW
WaitForSingleObject
GetModuleFileNameW
LoadLibraryA
GetProcAddress
FreeLibrary
LockResource
LoadResource
FindResourceW
GetVersion
lstrlenW
MulDiv
SetLastError
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GetSystemDirectoryW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CopyFileW
OpenFileMappingW
LoadLibraryExW
GetProcessTimes
lstrcmpW
HeapReAlloc
GetPrivateProfileIntW
GetPrivateProfileStructW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetStartupInfoW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
LoadLibraryW
WriteFile
TerminateProcess
GetModuleHandleW
VirtualQuery
SetFilePointer
OutputDebugStringW
GetSystemInfo
GetFileSize
FileTimeToDosDateTime
GlobalMemoryStatus
GetSystemTimeAsFileTime
InterlockedDecrement
CreateThread
GetTickCount
CompareStringW
GetTempPathW
GetPrivateProfileStringW
GlobalMemoryStatusEx
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDrives
GetTempPathA
GetSystemDirectoryA
HeapFree
HeapAlloc
GetProcessHeap
LocalFree
FindClose
FindNextFileA
FindFirstFileA
GetCommandLineW
GetLastError
MultiByteToWideChar
WritePrivateProfileStringW
DeleteFileW
SetFileAttributesW
DeleteFileA
FormatMessageW
MoveFileExW
Process32FirstW
CreateToolhelp32Snapshot
lstrlenA
Sleep
OpenProcess
WideCharToMultiByte
FreeResource

user32

DrawMenuBar
GetWindow
IsZoomed
LoadAcceleratorsW
TranslateAcceleratorW
SetCursor
SetRectEmpty
ReleaseCapture
UpdateWindow
SetCapture
InvalidateRect
PtInRect
IsWindowVisible
GetKeyState
GetWindowRgn
TrackMouseEvent
GetCapture
ScreenToClient
GetDlgCtrlID
RegisterClipboardFormatW
TabbedTextOutW
DrawFocusRect
DrawEdge
SetRect
DrawStateW
FillRect
GetMessagePos
GetMenuItemInfoW
OffsetRect
InflateRect
CopyRect
WindowFromDC
GetMenuInfo
DestroyIcon
GetIconInfo
GetMenuItemRect
IsMenu
SetMenuInfo
GetWindowDC
GetSysColor
LoadBitmapW
IsWindow
SetTimer
SetMenu
PostQuitMessage
MoveWindow
ModifyMenuW
SetForegroundWindow
FindWindowW
GetSystemMetrics
WindowFromPoint
GetClassNameW
LoadCursorW
SetPropW
BringWindowToTop
BeginPaint
EndPaint
SetWindowLongW
GetWindowLongW
DefWindowProcW
GetDC
ReleaseDC
EqualRect
GetPropW
UnhookWindowsHookEx
SetWindowsHookExW
IntersectRect
CreatePopupMenu
DeleteMenu
RemoveMenu
IsRectEmpty
ClientToScreen
UpdateLayeredWindow
RegisterClassExW
CreateWindowExW
SetWindowPos
wvsprintfW
MessageBoxW
GrayStringW
GetMenuDefaultItem
GetParent
DrawTextW
SendMessageW
RegisterWindowMessageW
SetWindowRgn
GetWindowRect
EnableWindow
GetMenuItemCount
GetMenuItemID
CallNextHookEx
RemovePropW
CallWindowProcW
LoadImageW
GetSystemMenu
RedrawWindow
GetMenuState
LoadMenuW
GetDesktopWindow
GetMenuStringW
InsertMenuW
AppendMenuW
GetSubMenu
DestroyMenu
GetMenu
KillTimer
GetCursorPos
MenuItemFromPoint
GetFocus
IsChild
ShowWindow
LoadIconW
keybd_event
SystemParametersInfoW
GetClientRect
PostMessageW
wsprintfW

gdi32

GetCurrentObject
GetBrushOrgEx
CreateBitmap
StretchBlt
SetBkColor
SetTextColor
GetObjectType
OffsetRgn
CreateRectRgnIndirect
SelectClipRgn
CreateHatchBrush
Escape
ExtTextOutW
TextOutW
SetPixel
GetPixel
BitBlt
RoundRect
Rectangle
RectVisible
PtVisible
GetNearestColor
SetBrushOrgEx
CreateCompatibleBitmap
UnrealizeObject
CreateFontIndirectW
CreatePatternBrush
CreateSolidBrush
CreatePen
GetTextExtentPoint32W
GetObjectW
GetStockObject
CreateCompatibleDC
CreateDIBSection
SelectObject
GetDeviceCaps
DeleteDC
DeleteObject
CombineRgn
CreateRoundRectRgn
CreateRectRgn
SetStretchBltMode

shell32

SHGetFolderPathW
Shell_NotifyIconW
CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHChangeNotify
ShellExecuteW

comctl32

ImageList_GetImageInfo
ImageList_Draw
ImageList_GetIcon
ImageList_AddMasked
ImageList_Add
ImageList_GetImageCount
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_Replace

ole32

CLSIDFromProgID
CLSIDFromString
CoInitialize
OleDraw
OleCreate
OleSetContainedObject
CoCreateInstance
OleRun
ProgIDFromCLSID
CoUninitialize
CoGetMalloc

oleaut32

GetErrorInfo
VariantClear
SysAllocString
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
VariantInit
SysFreeString

ws2_32

inet_ntoa
gethostbyname
htons
socket
closesocket
WSACleanup
gethostbyaddr
inet_addr
sendto
recv
send
WSAGetLastError
connect
setsockopt
recvfrom
WSAStartup

msvcp60

?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z

shlwapi

PathFileExistsW
PathIsDirectoryW

psapi

EmptyWorkingSet

imagehlp

ImageNtHeader
CheckSumMappedFile

wininet

InternetReadFile
InternetQueryOptionW
HttpQueryInfoW
InternetOpenUrlW
InternetGetConnectedState
InternetOpenA
InternetCloseHandle

iphlpapi

GetAdaptersInfo
GetIpAddrTable
GetBestInterface
GetIpForwardTable

winmm

waveOutGetNumDevs

msimg32

TransparentBlt
AlphaBlend

Exports

Exports

?interfaceMap@CCustomControlSite@@1UAFX_INTERFACEMAP@@B

Sections

.text
Size: 596KB - Virtual size: 593KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UUUpgrade.exe
.exe windows:4 windows x86 arch:x86

638c219913087041e5255c80ebc92bd9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bd:73:a2:33:ed:20:30:28:f5:2f:71:11:12:ac:f1:1b:06:d6:47:e7
Signer

Actual PE Digest

bd:73:a2:33:ed:20:30:28:f5:2f:71:11:12:ac:f1:1b:06:d6:47:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW

psapi

EnumProcessModules
EnumProcesses
GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

mfc42u

ord1768
ord4395
ord5286
ord3397
ord4418
ord3634
ord567
ord692
ord2294
ord4270
ord956
ord3798
ord3614
ord3716
ord809
ord795
ord2606
ord556
ord3621
ord3658
ord2406
ord5871
ord1088
ord2114
ord1634
ord2855
ord6195
ord3871
ord3792
ord6354
ord858
ord535
ord6193
ord2854
ord6871
ord2859
ord942
ord5568
ord2910
ord927
ord2810
ord6451
ord823
ord538
ord4667
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord6051
ord5193
ord2388
ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord3733
ord815
ord561
ord818
ord663
ord6865
ord6920
ord6867
ord922
ord5706
ord925
ord2613
ord1131
ord1196
ord1244
ord4272
ord4124
ord5679
ord6279
ord6278
ord2755
ord6330
ord2634
ord940
ord3566
ord1143
ord1165
ord348
ord2127
ord1172
ord537
ord536
ord4219
ord4155
ord2858
ord1569
ord2371
ord755
ord470
ord4294
ord2078
ord2680
ord3806
ord2637
ord1941
ord4029
ord2573
ord4214
ord2016
ord2405
ord6362
ord1764
ord3087
ord4229
ord2362
ord825
ord324
ord540
ord861
ord641
ord800
ord3592
ord4419
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5276
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4704
ord4992
ord4847
ord4370
ord5261
ord1089
ord6211

msvcrt

_controlfp
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
swscanf
_beginthreadex
__p__wpgmptr
wcscmp
_wcsnicmp
_wcsicmp
vswprintf
swprintf
fwrite
fflush
wcscpy
_wfopen
fseek
fclose
wcsstr
wcslen
wcscat
__CxxFrameHandler
ftell

kernel32

CloseHandle
GetModuleHandleW
Sleep
GetLocalTime
WideCharToMultiByte
GetModuleFileNameW
InitializeCriticalSection
EnterCriticalSection
GetPrivateProfileIntW
GetLastError
FormatMessageW
LocalFree
LeaveCriticalSection
DeleteCriticalSection
lstrcatW
lstrcpyW
GetWindowsDirectoryW
LoadLibraryW
FreeLibrary
lstrcpynW
TerminateProcess
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
GetProcAddress
LoadLibraryExW
SetErrorMode
ExitProcess
GetModuleFileNameA
CreateProcessW
MoveFileExW
DeleteFileW
CopyFileW
GetCommandLineW
GetPrivateProfileSectionW
GetPrivateProfileStringW
TerminateThread
WaitForSingleObject
SetEvent
ResetEvent
GetStartupInfoW
ReadProcessMemory
GetShortPathNameW
OpenProcess
GetCurrentProcess

user32

GetWindowRect
GetParent
LoadCursorW
RedrawWindow
GetCursorPos
KillTimer
FindWindowExW
FindWindowW
SetCursorPos
GetWindowThreadProcessId
EnumWindows
MessageBoxA
GetActiveWindow
SetForegroundWindow
IntersectRect
GetWindow
LoadIconW
GetSystemMetrics
LoadBitmapW
AppendMenuW
GetSystemMenu
DrawIcon
IsIconic
PostMessageW
GetDC
ReleaseDC
InflateRect
InvalidateRect
IsWindow
SetWindowTextW
EnableWindow
SendMessageW
PtInRect
SetWindowLongW
GetClientRect
SetTimer
SetCursor
DestroyCursor
CopyIcon

gdi32

GetTextExtentPoint32W
GetObjectW
CreateFontIndirectW
GetStockObject

advapi32

LookupPrivilegeValueW
RegQueryValueExW
OpenProcessToken
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueW

shell32

CommandLineToArgvW
ShellExecuteW

ole32

OleInitialize
OleUninitialize

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UUUpgrade.ini
UUUpgrade.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

4dd6ac7a22fdda1eed6c5f0e518ac3e4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d5:94:01:9d:da:4b:ef:16:9b:27:43:52:14:3a:21:43:57:4c:49:8c
Signer

Actual PE Digest

d5:94:01:9d:da:4b:ef:16:9b:27:43:52:14:3a:21:43:57:4c:49:8c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupIterateCabinetW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

shlwapi

PathFileExistsW
SHDeleteKeyW

shell32

SHGetPathFromIDListW
Shell_NotifyIconW
ShellExecuteW
SHFileOperationW
SHCreateDirectoryExW
SHGetSpecialFolderLocation

iphlpapi

GetAdaptersInfo

psapi

EnumProcesses
GetModuleFileNameExW
EnumProcessModules

mfc42u

ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4418
ord3658
ord1165
ord1143
ord6193
ord6211
ord4294
ord4270
ord2371
ord6451
ord755
ord5871
ord5785
ord6168
ord470
ord6597
ord815
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord3396
ord4616
ord3665
ord561
ord3947
ord2716
ord6350
ord1213
ord6466
ord1224
ord1869
ord4244
ord2478
ord2679
ord6360
ord3321
ord6361
ord4466
ord5494
ord3273
ord3348
ord3676
ord446
ord743
ord1174
ord4001
ord2719
ord2722
ord2721
ord1223
ord1207
ord348
ord663
ord2431
ord1686
ord5614
ord994
ord4336
ord4681
ord4633
ord5670
ord2148
ord4850
ord4914
ord5998
ord2129
ord1955
ord5207
ord2948
ord3863
ord5144
ord4699
ord4701
ord2871
ord2993
ord5645
ord4108
ord3254
ord4654
ord4762
ord4644
ord4897
ord4542
ord4515
ord4588
ord4982
ord4919
ord4924
ord4929
ord4653
ord4903
ord4902
ord4662
ord4661
ord4660
ord4642
ord4683
ord5017
ord4648
ord4637
ord4348
ord4774
ord4643
ord4631
ord4630
ord5054
ord4578
ord4365
ord4355
ord4350
ord4733
ord4735
ord4732
ord4403
ord4597
ord5002
ord4409
ord4986
ord4973
ord2480
ord3399
ord4533
ord2949
ord2376
ord6366
ord2978
ord3143
ord3255
ord4460
ord2981
ord3075
ord4076
ord4618
ord5821
ord723
ord3941
ord423
ord2855
ord2533
ord4943
ord641
ord2506
ord324
ord5706
ord2787
ord4219
ord1128
ord536
ord940
ord4273
ord1244
ord4453
ord668
ord3176
ord4053
ord2773
ord2762
ord356
ord942
ord4215
ord2576
ord3649
ord2430
ord6266
ord2858
ord1637
ord711
ord4163
ord413
ord2756
ord1884
ord4247
ord1209
ord4564
ord4666
ord4837
ord5005
ord5261
ord4370
ord4847
ord4992
ord4707
ord6048
ord1767
ord6367
ord5282
ord4432
ord3274
ord4619
ord4419
ord449
ord746
ord2270
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord5157
ord2377
ord5237
ord4401
ord1768
ord4073
ord6051
ord1941
ord3806
ord3332
ord1594
ord927
ord538
ord6867
ord6865
ord922
ord925
ord389
ord6055
ord3224
ord5199
ord5804
ord5352
ord2385
ord6868
ord4272
ord2755
ord6414
ord537
ord354
ord5180
ord6381
ord1971
ord2810
ord665
ord860
ord823
ord861
ord5679
ord4124
ord858
ord540
ord2910
ord535
ord800
ord825
ord269
ord826
ord600
ord1571
ord1250
ord1248
ord1563
ord1194
ord1240
ord342
ord1179
ord1570
ord1568
ord1173
ord1115
ord1129
ord4655
ord941

msvcrt

_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
malloc
swscanf
wcscmp
wcsncpy
_CxxThrowException
_adjust_fdiv
strncpy
free
realloc
wcslen
__CxxFrameHandler
sprintf
fclose
ftell
fseek
_wfopen
wcscpy
atoi
strtok
strstr
_beginthreadex
fflush
fwrite
swprintf
vswprintf
isalpha
_wcsicmp
_ftol

kernel32

GetModuleHandleW
lstrlenW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetVersionExW
GetLocalTime
WaitForSingleObject
CloseHandle
GetModuleFileNameW
InitializeCriticalSection
EnterCriticalSection
GetPrivateProfileIntW
lstrcatW
FormatMessageW
LeaveCriticalSection
Sleep
DeleteCriticalSection
WideCharToMultiByte
GetTickCount
GetFileAttributesW
MoveFileExW
PulseEvent
ResetEvent
SetEvent
CreateMutexW
DeviceIoControl
CreateFileA
LocalAlloc
GetCurrentProcess
OpenProcess
GetShortPathNameW
TerminateProcess
TerminateThread
GetTempPathW
DeleteFileW
GetProcAddress
FreeLibrary
LoadLibraryExW
LocalFree
SetErrorMode
lstrcpyW
CreateProcessW
GetPrivateProfileSectionW
WriteFile
ReadFile
GetLastError
CreateFileW
GetFileSize

user32

RedrawWindow
LoadCursorW
SetRect
GetWindowRect
UpdateWindow
SetForegroundWindow
PostMessageW
DrawTextW
GetClientRect
SetCursor
PtInRect
FillRect
EnableWindow
CharLowerW
DrawIcon
LoadIconW
DrawEdge
LoadMenuW
GetSubMenu
FindWindowExW
KillTimer
InflateRect
SetTimer
GetSystemMetrics
SystemParametersInfoW
GetSysColor
SetWindowPos
FindWindowW
SetCursorPos
GetCursorPos

gdi32

CreateSolidBrush
GetDeviceCaps
SelectObject
Rectangle
SetBkMode
SetTextColor
GetStockObject
CreateFontW
DeleteObject
GetObjectW
Ellipse

advapi32

OpenProcessToken
AdjustTokenPrivileges
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
LookupPrivilegeValueW
RegEnumValueW
RegCreateKeyExW

comctl32

_TrackMouseEvent

ole32

CoInitialize
OleInitialize
OleUninitialize
CoCreateInstance
OleRun

oleaut32

SysFreeString
LoadRegTypeLi
GetErrorInfo
SysAllocString
SysStringLen
SysAllocStringLen

ws2_32

sendto
WSACleanup
WSAStartup
socket
gethostbyname
htons
connect
closesocket
recv
send
inet_addr

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UUWebPlayer.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

d211161b4b0dc1dad46077d05d10cf1c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

70:42:77:6c:7e:c0:a0:8f:50:02:f4:c5:60:ff:98:6c:cb:1b:7c:80
Signer

Actual PE Digest

70:42:77:6c:7e:c0:a0:8f:50:02:f4:c5:60:ff:98:6c:cb:1b:7c:80

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

inet_ntoa
sendto
gethostbyname
htons
socket
WSACleanup
WSAStartup
inet_addr
closesocket

mfc42

ord1182
ord342
ord1243
ord6449
ord2727
ord6467
ord2730
ord2729
ord825
ord6055
ord1776
ord5290
ord3402
ord4424
ord5265
ord4376
ord4853
ord4998
ord4710
ord2514
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord3597
ord641
ord567
ord324
ord2135
ord818
ord2302
ord4234
ord800
ord6197
ord2379
ord823
ord815
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord3401
ord4622
ord3670
ord561
ord4046
ord2145
ord2144
ord6225
ord5231
ord5247
ord2132
ord4601
ord1134
ord824
ord3952
ord5435
ord1683
ord1673
ord2628
ord5980
ord2641
ord4122
ord6214
ord6196
ord4298
ord5948
ord3088
ord3875
ord3872
ord3871
ord6198
ord4286
ord4283
ord3137
ord3796
ord5719
ord6092
ord3524
ord4032
ord6095
ord4035
ord2549
ord2433
ord3353
ord3579
ord426
ord726
ord826
ord2724
ord6354
ord1216
ord1168
ord1227
ord1877
ord4249
ord2486
ord2687
ord1577
ord3326
ord6365
ord4472
ord5498
ord3278
ord3681
ord446
ord743
ord1177
ord4006
ord1226
ord1210
ord2439
ord1693
ord5618
ord994
ord4342
ord4687
ord4639
ord5674
ord2156
ord4856
ord4920
ord1131
ord2137
ord1963
ord5213
ord2953
ord3868
ord5150
ord4705
ord4707
ord2876
ord2998
ord5649
ord4113
ord4661
ord4660
ord4768
ord4650
ord4903
ord4548
ord4521
ord4594
ord4988
ord4925
ord4930
ord4935
ord4659
ord4909
ord4908
ord4668
ord4667
ord4666
ord4648
ord4689
ord5023
ord4654
ord4643
ord4354
ord4780
ord4649
ord4637
ord4636
ord5060
ord4584
ord4371
ord4361
ord4356
ord4739
ord4741
ord4738
ord4409
ord4603
ord5008
ord4415
ord4992
ord4979
ord2488
ord3404
ord4539
ord4534
ord2954
ord2384
ord6370
ord2983
ord3148
ord3260
ord4466
ord2986
ord3080
ord4081
ord4624
ord5825
ord723
ord3946
ord540
ord423
ord5333
ord2541
ord4949
ord6030
ord6215
ord6195
ord3870
ord2086
ord861
ord2614
ord2864
ord4459
ord924
ord939
ord922
ord941
ord537
ord860
ord6663
ord535
ord858
ord926
ord4202
ord1892
ord4252
ord1212
ord4570
ord4672
ord4843
ord5011
ord4713
ord6371
ord5286
ord4438
ord3279
ord4625
ord449
ord746
ord2278
ord1949
ord4034
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord269
ord1575
ord1176
ord1116
ord1132
ord6364
ord6002

msvcrt

_initterm
malloc
_adjust_fdiv
??1type_info@@UAE@XZ
free
_onexit
__dllonexit
srand
rand
strncpy
_mbscmp
strchr
strstr
time
localtime
_CxxThrowException
__CxxFrameHandler
sprintf

kernel32

CompareStringA
GetDiskFreeSpaceExA
LocalFree
LocalAlloc
GetVersionExA

user32

BringWindowToTop
IsWindow
EnableWindow
GetParent

ole32

OleRun
CoCreateInstance
CoInitialize

oleaut32

GetErrorInfo
VariantInit
SysAllocString
LoadRegTypeLi
VariantClear

Exports

Exports

?interfaceMap@CCustomControlSite@@1UAFX_INTERFACEMAP@@B
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
check_cmd.exe
.exe windows:4 windows x86 arch:x86

5bb0949a332b2dedf4049800738c00f0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

16:f2:8f:fc:7d:b4:68:32:9c:7b:ad:ac:5d:7f:02:0e:ec:83:5e:47
Signer

Actual PE Digest

16:f2:8f:fc:7d:b4:68:32:9c:7b:ad:ac:5d:7f:02:0e:ec:83:5e:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileSize
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetSystemDirectoryW
GetVersionExW
GetModuleHandleW
GetCommandLineW
GetConsoleTitleW
CreateFileW
CopyFileW
CloseHandle

user32

EnableWindow
ShowWindow
FindWindowW

mfc42u

ord5261
ord4847
ord4992
ord2506
ord6048
ord4073
ord1767
ord4401
ord5237
ord2377
ord5157
ord6370
ord4347
ord5276
ord3793
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2116
ord5273
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4621
ord4419
ord3592
ord800
ord641
ord861
ord540
ord324
ord825
ord2286
ord2354
ord2362
ord4229
ord858
ord6330
ord2634
ord3087
ord4704
ord940
ord2810
ord942
ord4370
ord2438
ord823
ord537
ord561
ord815
ord1568

msvcrt

exit
__p___winitenv
__wgetmainargs
_initterm
__setusermatherr
_XcptFilter
__p__commode
__p__fmode
__set_app_type
_itoa
_controlfp
_exit
_onexit
__dllonexit
wcscpy
_wtoi
_except_handler3
memmove
wcslen
wcscat
__CxxFrameHandler
_adjust_fdiv

msvcp60

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

imagehlp

ImageNtHeader
CheckSumMappedFile

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
download.dll
.dll windows:4 windows x86 arch:x86

c84e1efa4e31f4e494efe383dd062c56

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1a:53:e6:14:b7:58:7c:b2:ff:9e:ee:a8:9c:e9:19:17:3a:dd:9b:eb
Signer

Actual PE Digest

1a:53:e6:14:b7:58:7c:b2:ff:9e:ee:a8:9c:e9:19:17:3a:dd:9b:eb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord2554
ord4424
ord3738
ord561
ord815
ord1199
ord1247
ord3584
ord543
ord803
ord4278
ord6663
ord5683
ord6467
ord1578
ord600
ord826
ord269
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord1116
ord4486
ord6375
ord4274
ord2614
ord922
ord2818
ord941
ord939
ord2763
ord4129
ord6283
ord4202
ord5710
ord6282
ord1158
ord860
ord2764
ord924
ord823
ord540
ord858
ord535
ord825
ord800
ord4622
ord537

msvcrt

??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
_onexit
__dllonexit
_strdup
strchr
_mkdir
_write
_read
realloc
_getpid
ctime
printf
_lseeki64
_stati64
strncpy
_close
time
_iob
fprintf
_open
_ftol
_mbscmp
sprintf
malloc
_mbsicmp
atoi
free
__CxxFrameHandler
_stat

kernel32

GetLastError
DeleteFileA
EnterCriticalSection
LeaveCriticalSection
GetTempPathA
RemoveDirectoryA
MoveFileA
CreateThread
LocalFree
LocalAlloc
FindClose
FindNextFileA
FindFirstFileA
GetTickCount
Sleep
GetExitCodeThread
DeleteCriticalSection
InitializeCriticalSection

user32

FindWindowA

advapi32

CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextA

wsock32

select
__WSAFDIsSet
recv
WSAStartup
htons
socket
inet_ntoa
connect
closesocket
gethostbyname
send

Exports

Exports

AddIERequest
AddURL
AddWatchURL
CreateDownloadMgr
GetCacheFilename
GetData
GetFileExt
GetStatusInfo
GetTotalLength
ReleaseDownloadMgr
Run
SetCachePath
SetCacheSize
SetIEDrag
SetIndex
SetTaskParams
Stop

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
in_net.dll
.dll windows:4 windows x86 arch:x86

22d50d98242a7c0b374bed94e8f38697

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

84:78:b3:96:7e:77:6f:36:a1:f8:84:2d:bb:88:e4:e5:cd:eb:85:83
Signer

Actual PE Digest

84:78:b3:96:7e:77:6f:36:a1:f8:84:2d:bb:88:e4:e5:cd:eb:85:83

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
CreateErrorInfo
GetErrorInfo
SetErrorInfo
GetActiveObject
SysFreeString
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegFlushKey
RegCloseKey

user32

GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExA
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClassLongA
SetCapture
SetActiveWindow
SendMessageW
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageW
PeekMessageA
OffsetRect
OemToCharA
MsgWaitForMultipleObjects
MessageBoxA
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageW
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMessageTime
GetMessagePos
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassLongA
GetClassInfoA
GetCapture
GetActiveWindow
FrameRect
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerBuffA
CharLowerA
CharUpperBuffA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout

kernel32

GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
CompareStringA
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
lstrcpyA
WriteFile
WaitForSingleObject
VirtualQuery
VirtualAlloc
TryEnterCriticalSection
Sleep
SizeofResource
SetThreadLocale
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
RemoveDirectoryA
ReleaseMutex
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
OpenMutexA
MultiByteToWideChar
MulDiv
MoveFileA
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalSize
GlobalLock
GlobalFree
GlobalFindAtomA
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomA
GetVersionExA
GetVersion
GetUserDefaultLCID
GetTimeZoneInformation
GetTickCount
GetThreadLocale
GetTempPathA
GetSystemTime
GetSystemInfo
GetStdHandle
GetQueuedCompletionStatus
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetDiskFreeSpaceExA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetComputerNameA
GetCPInfo
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateThread
CreateMutexA
CreateIoCompletionPort
CreateFileA
CreateEventA
CreateDirectoryA
CompareStringA
CloseHandle
Sleep

gdi32

UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetMapMode
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
RectVisible
RealizePalette
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
LPtoDP
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionA
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateEnhMetaFileA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
CloseEnhMetaFile
BitBlt

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

ole32

CLSIDFromString
CoTaskMemFree
StringFromCLSID
CoCreateGuid
CreateStreamOnHGlobal
IsAccelerator
OleDraw
OleSetMenuDescriptor
CoTaskMemFree
ProgIDFromCLSID
StringFromCLSID
CoCreateInstance
CoGetClassObject
CoUninitialize
CoInitialize
IsEqualGUID

comctl32

_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create

wsock32

__WSAFDIsSet
WSACleanup
WSAStartup
WSAGetLastError
gethostname
getservbyname
gethostbyname
socket
shutdown
setsockopt
sendto
send
select
recvfrom
recv
ntohs
listen
ioctlsocket
inet_ntoa
inet_addr
htons
htonl
connect
closesocket
bind

ws2_32

WSAAccept
WSARecv
WSASend
WSASocketA
WSAGetLastError
closesocket

iphlpapi

GetIpAddrTable
GetBestInterface

Exports

Exports

uuseePSPmodlePlugin
uuseePSPmodlePlugin2
uuseePSPmodlePlugin3
uuseePSPmodlePlugin4
uuseePSPmodlePlugin5

Sections

.text
Size: 781KB - Virtual size: 781KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 27KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 205B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
out_mmshttp.dll
.dll windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e4:f4:e1:db:26:56:4f:62:10:f9:a5:84:a4:6e:da:eb:01:e5:c5:00
Signer

Actual PE Digest

e4:f4:e1:db:26:56:4f:62:10:f9:a5:84:a4:6e:da:eb:01:e5:c5:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

RebootServer2
TestPortUp2
uuseeOutmodulePlugin
uuseeOutmodulePlugin2

Sections

CODE
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 165B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
recommend.dll
.dll regsvr32 windows:4 windows x86 arch:x86

24d3ddf2a31422e26e0badd69d7842d5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:f5:3b:c2:bc:7c:ff:ba:30:bb:bf:87:08:69:8b:c6:97:e7:16:fe
Signer

Actual PE Digest

0b:f5:3b:c2:bc:7c:ff:ba:30:bb:bf:87:08:69:8b:c6:97:e7:16:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\MyFiles\myProject\VR\example\example\release\recommend.pdb

Imports

kernel32

GetFileAttributesW
GetFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
GetCommandLineA
GetProcessHeap
RtlUnwind
RaiseException
HeapReAlloc
ExitProcess
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
SetStdHandle
GetFileType
SetHandleCount
GetStdHandle
GetStartupInfoA
GetConsoleCP
VirtualFree
HeapDestroy
HeapCreate
GetModuleFileNameA
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
Sleep
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
SetEnvironmentVariableA
GlobalFlags
GetModuleHandleA
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalFindAtomW
LoadLibraryA
GetVersionExA
GlobalAddAtomW
CompareStringW
InterlockedIncrement
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
InterlockedExchange
lstrcmpW
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
MulDiv
ReleaseMutex
CreateMutexW
CreateFileW
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
GetCurrentProcess
DuplicateHandle
CloseHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
GetCurrentProcessId
FreeResource
GlobalAlloc
GlobalFree
FreeLibrary
SetLastError
GetProcAddress
GetModuleHandleW
LoadLibraryW
lstrcpyW
CreateThread
WaitForSingleObject
SizeofResource
GetTickCount
GetModuleFileNameW
lstrlenW
MultiByteToWideChar
WritePrivateProfileStringW
WideCharToMultiByte
GetLastError
lstrlenA
GetPrivateProfileStringW
FindResourceW
InterlockedDecrement
LoadResource
GetConsoleMode
LockResource

user32

RegisterClipboardFormatW
PostThreadMessageW
SetRect
IsRectEmpty
CopyAcceleratorTableW
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
UnregisterClassW
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
SetActiveWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
UpdateWindow
GetMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
EqualRect
DefWindowProcW
CallWindowProcW
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
OffsetRect
PtInRect
CharNextW
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
GetActiveWindow
GetKeyState
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
PeekMessageW
DispatchMessageW
IsWindowVisible
GetSystemMetrics
UnregisterClassA
SetForegroundWindow
SendMessageW
EnableWindow
PostMessageW
PostQuitMessage
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
CharUpperW
GetWindowThreadProcessId
DestroyMenu
LoadCursorW
GetSysColorBrush
MessageBeep
GetNextDlgGroupItem
ReleaseCapture
SetCapture
InvalidateRgn
AdjustWindowRectEx
InvalidateRect
SetTimer
KillTimer
LoadIconW
IsWindow
CopyRect
GetDesktopWindow
GetClientRect
GetDC
ReleaseDC
UnhookWindowsHookEx
SetWindowPos
MapDialogRect
GetParent
SetWindowContextHelpId
GetWindow
GetDlgItem
SendDlgItemMessageW
IsDialogMessageW
GetWindowLongW
SetWindowTextW
GetDlgCtrlID
SetWindowLongW
MoveWindow
ShowWindow
IsWindowEnabled
SetFocus
GetFocus
GetLastActivePopup
MessageBoxW
GetWindowTextLengthW
GetWindowTextW

gdi32

ExtSelectClipRgn
DeleteDC
ScaleWindowExtEx
GetMapMode
GetRgnBox
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
CreateRectRgnIndirect
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
GetTextColor
GetBkColor
GetObjectW
GetStockObject
CreateBitmap
GetDeviceCaps
RectVisible

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegSetValueExW
RegQueryValueW
RegDeleteKeyW
RegEnumKeyW
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyW
RegCloseKey
RegQueryValueExW

shell32

SHGetPathFromIDListW
Shell_NotifyIconW
ShellExecuteW
SHGetSpecialFolderLocation

shlwapi

PathIsUNCW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW

oledlg

OleUIBusyW

ole32

OleRun
CoInitialize
CoCreateInstance
CLSIDFromProgID
CoTaskMemFree
CoTaskMemAlloc
CoRevokeClassObject
StringFromGUID2
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CLSIDFromString

oleaut32

SysFreeString
VariantInit
VariantClear
VariantChangeType
SysAllocStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
VariantCopy
GetErrorInfo
SysStringLen

ws2_32

WSASetLastError
WSACleanup
WSAStartup

wininet

HttpOpenRequestW
InternetConnectW
HttpSendRequestW
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
HttpQueryInfoW
InternetQueryDataAvailable

Exports

Exports

DelMI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetMI

Sections

.text
Size: 280KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
review/bf_bg.gif
.gif
review/local.htm
.html .js polyglot
review/skin1_bufferbar.gif
.gif
review/skin1_bufferbg0.gif
.gif
review/skin1_bufferbg1.gif
.gif
review/skin_fullscreen.gif
.gif
review/skin_mute.gif
.gif
review/skin_pause.gif
.gif
review/skin_play.gif
.gif
review/skin_qback.gif
.gif
review/skin_qnext.gif
.gif
review/skin_share.gif
.gif
review/skin_stop.gif
.gif
review/skin_volume.gif
.gif
review/skin_volumebar.gif
.gif
review/skin_volumebarbg.gif
.gif
review/skin_volumebarbg2.gif
.gif
rmsp011.ax
.dll regsvr32 windows:4 windows x86 arch:x86

49685aea39d66a6911971422b8bc6724

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Video\mpc-hc_svn\bin\x86\RealMediaSplitter.pdb

Imports

kernel32

SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFullPathNameW
LocalAlloc
GlobalAddAtomW
WritePrivateProfileStringW
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
GetModuleHandleA
GlobalFlags
CompareStringW
GetVersionExA
LoadLibraryA
GlobalFindAtomW
HeapFree
RtlUnwind
HeapAlloc
GetCommandLineA
GetProcessHeap
WriteFile
ExitProcess
SetStdHandle
GetFileType
VirtualQuery
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
LCMapStringA
LCMapStringW
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
ReadFile
GetThreadLocale
GetFileTime
GetFileSize
GetFileAttributesW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentProcessId
GlobalDeleteAtom
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
SetLastError
DeleteFileW
Sleep
RaiseException
GetVersion
CreateFileW
GetVolumeInformationW
FindFirstFileW
FindClose
DisableThreadLibraryCalls
CreateThread
GetVersionExW
GetTickCount
GetCurrentThread
SetThreadPriority
GetModuleHandleW
InterlockedExchange
VirtualAlloc
CreateSemaphoreW
GetCurrentThreadId
GetCurrentProcess
DuplicateHandle
VirtualFree
GetSystemInfo
ReleaseSemaphore
WaitForSingleObject
ResetEvent
SetEvent
CreateEventW
CloseHandle
lstrcpynW
InterlockedDecrement
InterlockedIncrement
lstrcmpW
GetLastError
lstrlenA
lstrlenW
GetSystemDirectoryW
GetModuleFileNameA
GetModuleFileNameW
LoadLibraryW
GetProcAddress
FreeLibrary
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
HeapReAlloc

user32

LoadIconW
WinHelpW
GetCapture
GetClassLongW
SetPropW
GetPropW
RemovePropW
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
UnregisterClassA
SetForegroundWindow
GetClientRect
GetMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
CopyRect
DefWindowProcW
CallWindowProcW
SetWindowLongW
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameW
PtInRect
GetWindowTextW
SetWindowTextW
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
LoadCursorW
GetDC
ReleaseDC
GetSysColor
UnregisterClassW
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
GetActiveWindow
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
CharUpperW
GetSystemMetrics
DestroyMenu
ShowWindow
SetWindowPos
GetWindowThreadProcessId
SendMessageW
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
PostMessageW
PostQuitMessage
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
SetRect
DispatchMessageW
RegisterWindowMessageW
PeekMessageW
GetSysColorBrush

gdi32

ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
RestoreDC
SetViewportExtEx
PtVisible
SaveDC
OffsetViewportOrgEx
CreateBitmap
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
SetBkColor
GetDeviceCaps
DeleteObject
GetClipBox
SetMapMode
SetTextColor
RectVisible

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegQueryValueW
RegEnumKeyW
RegOpenKeyW
RegCreateKeyExW
RegCreateKeyW
RegSetValueW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shlwapi

PathIsUNCW
PathFindExtensionW
PathStripToRootW
PathRemoveFileSpecA
PathFileExistsW
PathAppendW
PathAddBackslashW
PathAddBackslashA
PathRemoveFileSpecW
PathFindFileNameW

ole32

StringFromGUID2
CoCreateInstance
CoUninitialize
CoFreeUnusedLibraries
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromString

oleaut32

VariantInit
VariantChangeType
SysAllocStringLen
SysAllocString
SysFreeString
VariantClear

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT64
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
seeplayer.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

a84f4b7149997f9a957c4ae460720fc9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c8:50:d9:25:3e:ce:85:72:19:33:9d:8e:52:e2:92:e3:32:13:ca:10
Signer

Actual PE Digest

c8:50:d9:25:3e:ce:85:72:19:33:9d:8e:52:e2:92:e3:32:13:ca:10

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\MyFiles\myProject\TrafficLight\UPlayer\release\seeplayer.pdb

Imports

wmvcore

WMCreateWriter
WMCreateReader

iphlpapi

GetAdaptersInfo
GetBestInterface
GetIpAddrTable

msdmo

DMOEnum

kernel32

ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
FindClose
FindFirstFileA
GetVolumeInformationA
GetShortPathNameA
FindResourceExA
GetSystemTimeAsFileTime
HeapAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
ExitProcess
GetCommandLineA
RtlUnwind
SetStdHandle
GetFileType
GetACP
IsValidCodePage
GetTimeZoneInformation
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStartupInfoA
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileW
SetEnvironmentVariableA
GetFullPathNameA
GetFileTime
GetFileAttributesA
GetOEMCP
GetCPInfo
GlobalFlags
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetUserDefaultLCID
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
GetProfileIntA
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
GetThreadLocale
GetModuleFileNameW
FreeResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
ReleaseMutex
CreateMutexA
GlobalFree
GlobalSize
GetProcessHeap
HeapFree
IsDBCSLeadByte
GetModuleHandleA
LoadLibraryExA
CompareStringA
GetVersion
lstrcmpiA
InterlockedExchange
CompareStringW
OpenFileMappingA
CopyFileA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
GetSystemDirectoryA
GetVersionExA
LocalFree
FormatMessageA
TerminateThread
SetFileAttributesA
GetPrivateProfileStringA
FreeLibrary
GetProcAddress
LoadLibraryA
GetPrivateProfileIntA
CreateThread
WritePrivateProfileStringA
CreateProcessA
SetThreadPriority
RaiseException
DeleteCriticalSection
FlushInstructionCache
GlobalAlloc
GetModuleFileNameA
GetCurrentProcess
GlobalLock
InitializeCriticalSection
GlobalUnlock
EnterCriticalSection
MulDiv
LeaveCriticalSection
lstrlenW
lstrcmpA
SetLastError
CloseHandle
CreateEventA
InterlockedIncrement
SetEvent
WaitForSingleObject
Sleep
LockResource
SizeofResource
GetCurrentThreadId
WideCharToMultiByte
GetCurrentProcessId
GetLastError
MultiByteToWideChar
GetTempPathA
OutputDebugStringA
GetTickCount
DeleteFileA
InterlockedDecrement
FindResourceA
LoadResource
lstrlenA
InterlockedCompareExchange
IsProcessorFeaturePresent
HeapSize

user32

MessageBeep
PostThreadMessageA
GetDCEx
TranslateAcceleratorA
GetMenuItemInfoA
GetSysColorBrush
UnregisterClassA
LockWindowUpdate
SetWindowContextHelpId
MapDialogRect
CreateMenu
DestroyMenu
RegisterClipboardFormatA
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
DrawEdge
SetRectEmpty
ShowOwnedPopups
GetMessageA
GetActiveWindow
ValidateRect
PostQuitMessage
CopyAcceleratorTableA
IsClipboardFormatAvailable
KillTimer
SetTimer
SetWindowRgn
DrawIcon
IsRectEmpty
FindWindowA
IsDialogMessageA
GetWindowThreadProcessId
IsWindowEnabled
InflateRect
LoadIconA
SendDlgItemMessageA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetLastActivePopup
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetScrollRange
GetNextDlgGroupItem
SetScrollPos
GetScrollPos
ShowScrollBar
IsWindowVisible
GetMenu
GetClassInfoA
RegisterClassA
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
OffsetRect
IntersectRect
IsIconic
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
GetForegroundWindow
GetCursorPos
WindowFromPoint
SystemParametersInfoA
UpdateWindow
GetSystemMetrics
SetParent
SetForegroundWindow
CharUpperA
AdjustWindowRectEx
LoadImageA
UpdateLayeredWindow
EqualRect
wsprintfW
SetRect
CopyRect
ShowWindow
GetWindowRect
GetWindowTextLengthA
CharNextA
SetFocus
wsprintfA
CreateWindowExA
GetWindow
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowTextA
BeginPaint
CallNextHookEx
SetWindowTextA
InvalidateRgn
GetDialogBaseUnits
GetTabbedTextExtentA
DestroyIcon
UnpackDDElParam
GetSysColor
RedrawWindow
ReuseDDElParam
LoadMenuA
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
BringWindowToTop
GetScrollRange
SetMenu
IsWindow
DestroyWindow
GetClassInfoExA
CreateAcceleratorTableA
EndPaint
GetDlgItem
RegisterClassExA
DestroyAcceleratorTable
ReleaseDC
GetDesktopWindow
EnumChildWindows
SetWindowPos
GetClassNameA
DefWindowProcA
RegisterWindowMessageA
SetCapture
MoveWindow
ReleaseCapture
IsChild
MessageBoxA
PostMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
LoadCursorA
GetParent
ScreenToClient
ClientToScreen
InvalidateRect
SetCursor
PtInRect
SetWindowLongA
GetWindowLongA
EnableWindow
LoadBitmapA
SendMessageA
CallWindowProcA
FillRect
GetDC
GetFocus
GetClientRect
ModifyMenuA

gdi32

CreatePen
CreateFontIndirectA
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
OffsetViewportOrgEx
PatBlt
CreateEllipticRgn
LPtoDP
Ellipse
GetRgnBox
GetBkColor
GetTextColor
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
GetTextExtentPoint32A
GetTextAlign
GetTextMetricsA
EnumFontFamiliesExA
Rectangle
UnrealizeObject
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateBitmap
CreatePatternBrush
ExtSelectClipRgn
GetCurrentPositionEx
BitBlt
SelectObject
GetObjectA
CreateSolidBrush
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
CreateCompatibleDC
GetPixel
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
SetTextAlign
MoveToEx
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
CreateDIBSection
CreateCompatibleBitmap
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
StretchBlt
SetViewportExtEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegOpenKeyA
RegSetValueA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
RegSetValueExA
RegCreateKeyA
RegCloseKey
RegQueryValueExA

shell32

DragQueryFileA
ExtractIconA
DragFinish

comctl32

_TrackMouseEvent

shlwapi

PathFileExistsA
PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

GetRunningObjectTable
CreateItemMoniker
CoTaskMemFree
StringFromGUID2
CreateDataCache
CreateStreamOnHGlobal
CoTaskMemAlloc
OleUninitialize
OleLockRunning
OleInitialize
CLSIDFromProgID
CLSIDFromString
CoInitialize
CoCreateInstance
CoGetClassObject
OleCreate
OleSetContainedObject
OleDraw
CoTaskMemRealloc
ReadFmtUserTypeStg
StringFromCLSID
ReleaseStgMedium
OleDuplicateData
OleGetClipboard
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoDisconnectObject
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoRegisterClassObject
CoRevokeClassObject
CoRegisterMessageFilter
OleLoadFromStream
OleFlushClipboard
OleIsCurrentClipboard
ReadClassStm
CoFreeUnusedLibraries
OleSaveToStream
CreateOleAdviseHolder
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateDataAdviseHolder
OleRun

oleaut32

OleCreatePropertyFrame
RegisterTypeLi
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime
GetErrorInfo
VarUI4FromStr
VariantCopy
LoadTypeLi
SysAllocStringLen
LoadRegTypeLi
OleCreateFontIndirect
SysStringLen
SysAllocString
VariantChangeType
VariantClear
VariantInit
SysFreeString
SysStringByteLen
OleLoadPicture
OleCreatePictureIndirect
SysAllocStringByteLen

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

ws2_32

sendto
htons
inet_addr
WSACleanup
closesocket
socket
WSAStartup
inet_ntoa
gethostbyname

wininet

HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
InternetConnectA
InternetQueryDataAvailable
HttpQueryInfoA
HttpOpenRequestA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 724KB - Virtual size: 723KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
skins/UUPlayer/About_Engine.bmp
skins/UUPlayer/Ctrl_CheckBox_1_Engine.bmp
skins/UUPlayer/Ctrl_CheckBox_2_Engine.bmp
skins/UUPlayer/Ctrl_CheckBox_3_Engine.bmp
skins/UUPlayer/Ctrl_CheckBox_4_Engine.bmp
skins/UUPlayer/Ctrl_CheckBox_C1_Engine.bmp
skins/UUPlayer/Ctrl_CheckBox_C2_Engine.bmp
skins/UUPlayer/Ctrl_CheckBox_C3_Engine.bmp
skins/UUPlayer/Ctrl_CheckBox_C4_Engine.bmp
skins/UUPlayer/Ctrl_ComboBox_1_Engine.bmp
skins/UUPlayer/Ctrl_ComboBox_2_Engine.bmp
skins/UUPlayer/Ctrl_ComboBox_3_Engine.bmp
skins/UUPlayer/Ctrl_ComboBox_4_Engine.bmp
skins/UUPlayer/Ctrl_Edit_1_Engine.bmp
skins/UUPlayer/Ctrl_Edit_4_Engine.bmp
skins/UUPlayer/Ctrl_PushButton_1_Engine.bmp
skins/UUPlayer/Ctrl_PushButton_2_Engine.bmp
skins/UUPlayer/Ctrl_PushButton_3_Engine.bmp
skins/UUPlayer/Ctrl_PushButton_4_Engine.bmp
skins/UUPlayer/Ctrl_RadioButton_1_Engine.bmp
skins/UUPlayer/Ctrl_RadioButton_2_Engine.bmp
skins/UUPlayer/Ctrl_RadioButton_3_Engine.bmp
skins/UUPlayer/Ctrl_RadioButton_4_Engine.bmp
skins/UUPlayer/Ctrl_RadioButton_C1_Engine.bmp
skins/UUPlayer/Ctrl_RadioButton_C2_Engine.bmp
skins/UUPlayer/Ctrl_RadioButton_C3_Engine.bmp
skins/UUPlayer/Ctrl_RadioButton_C4_Engine.bmp
skins/UUPlayer/Dlg_Back_Engine.bmp
skins/UUPlayer/Dlg_Detect_Engine.bmp
skins/UUPlayer/Dlg_Frame_1_Engine.bmp
skins/UUPlayer/Dlg_Frame_2_Engine.bmp
skins/UUPlayer/Dlg_Frame_3_Engine.bmp
skins/UUPlayer/Icon_Information_Engine.bmp
skins/UUPlayer/Icon_Question_Engine.bmp
skins/UUPlayer/Icon_Stop_Engine.bmp
skins/UUPlayer/ListHeader_1_Engine.bmp
skins/UUPlayer/ListHeader_2_Engine.bmp
skins/UUPlayer/ListHeader_3_Engine.bmp
skins/UUPlayer/ListHeader_ArrowD_Engine.bmp
skins/UUPlayer/ListHeader_ArrowU_Engine.bmp
skins/UUPlayer/ListHeader_SP_Engine.bmp
skins/UUPlayer/Resource.h
skins/UUPlayer/Resource_Engine.h
skins/UUPlayer/Setting_Group_1_1_Engine.bmp
skins/UUPlayer/Setting_Group_1_2_Engine.bmp
skins/UUPlayer/Setting_Group_1_3_Engine.bmp
skins/UUPlayer/Setting_Group_2_1_Engine.bmp
skins/UUPlayer/Setting_Group_2_2_Engine.bmp
skins/UUPlayer/Setting_Group_2_3_Engine.bmp
skins/UUPlayer/Setting_Group_3_1_Engine.bmp
skins/UUPlayer/Setting_Group_3_2_Engine.bmp
skins/UUPlayer/Setting_Group_3_3_Engine.bmp
skins/UUPlayer/Setting_Group_4_1_Engine.bmp
skins/UUPlayer/Setting_Group_4_2_Engine.bmp
skins/UUPlayer/Setting_Group_4_3_Engine.bmp
skins/UUPlayer/Setting_Group_5_1_Engine.bmp
skins/UUPlayer/Setting_Group_5_2_Engine.bmp
skins/UUPlayer/Setting_Group_5_3_Engine.bmp
skins/UUPlayer/UUSEE_Engine.ui
skins/UUPlayer/Wnd_Setting_1_Engine.bmp
skins/UUPlayer/Wnd_Setting_2_Engine.bmp
skins/UUPlayer/Wnd_Setting_3_Engine.bmp
trafficlight.dll
.dll windows:4 windows x86 arch:x86

65f5f709f53adc25977c3a2ec951e75f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7f:4c:75:5a:3d:08:cf:46:76:d1:9a:ba:cd:56:e1:05:1a:fe:ca:b6
Signer

Actual PE Digest

7f:4c:75:5a:3d:08:cf:46:76:d1:9a:ba:cd:56:e1:05:1a:fe:ca:b6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

iphlpapi

GetBestInterface
GetAdaptersInfo
GetIpAddrTable

kernel32

TlsFree
GlobalGetAtomNameA
GetThreadLocale
lstrcmpW
GlobalFindAtomA
GlobalAddAtomA
WritePrivateProfileStringA
GlobalFlags
GetCPInfo
GetOEMCP
MoveFileA
ReadFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetCurrentProcess
RtlUnwind
RaiseException
ExitThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeFormatA
LocalReAlloc
GetSystemTimeAsFileTime
VirtualAlloc
HeapAlloc
HeapFree
HeapReAlloc
GetProcessHeap
ExitProcess
HeapSize
GetConsoleCP
GetConsoleMode
GetStdHandle
GetACP
IsValidCodePage
GetTimeZoneInformation
VirtualFree
HeapDestroy
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
CreateFileW
SetEnvironmentVariableA
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
SetErrorMode
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
ReleaseMutex
CreateMutexA
GetLocalTime
CreateProcessA
GetModuleFileNameA
CreateThread
GetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
CreateDirectoryA
WriteFile
GetFileAttributesA
lstrcpyA
GetFullPathNameA
GetCommandLineA
GetModuleHandleA
lstrlenA
lstrcmpiA
CompareStringA
CompareStringW
MultiByteToWideChar
InterlockedExchange
GetVersion
LocalFree
OpenFileMappingA
FreeLibrary
LoadLibraryA
GetProcAddress
CopyFileA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetFileSize
GetSystemDirectoryA
CreateFileA
GetVersionExA
GetWindowsDirectoryA
SetEvent
WaitForMultipleObjects
TerminateThread
GetLastError
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
ResetEvent
WaitForSingleObject
CloseHandle
InterlockedIncrement
SetThreadPriority
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceA
GetTickCount
GetCurrentThreadId
GetTempPathA
DeleteFileA
Sleep
OutputDebugStringA
GetDateFormatA

user32

SetWindowTextA
SetCursor
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
GetWindowTextA
LoadCursorA
GetSystemMetrics
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
DestroyMenu
SetForegroundWindow
ShowWindow
GetCursorPos
ValidateRect
UnhookWindowsHookEx
GetWindowThreadProcessId
SendMessageA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
PostMessageA
PostQuitMessage
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetSysColorBrush
GetMenu

gdi32

ScaleWindowExtEx
DeleteDC
CreateBitmap
GetStockObject
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
SaveDC
GetDeviceCaps
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
PtVisible

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo

shlwapi

PathFindFileNameA
PathFindExtensionA

oleaut32

VariantChangeType
VariantClear
VariantInit

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

imagehlp

ImageNtHeader
CheckSumMappedFile

ws2_32

WSAWaitForMultipleEvents
WSAEventSelect
WSACreateEvent
listen
WSAEnumNetworkEvents
WSAGetLastError
closesocket
htons
WSAStartup
WSASend
WSAAccept
WSACleanup
bind
WSACloseEvent
WSARecv
socket
inet_addr
sendto
inet_ntoa
WSASocketA

Exports

Exports

GetChannelCtrl
GetDownloadCtrl

Sections

.text
Size: 292KB - Virtual size: 290KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uninst.exe
.exe windows:4 windows x86 arch:x86

170729c4965736ee8f8f4d1bab77cf38

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b6:73:78:cf:75:af:e5:18:82:71:8b:4b:7e:14:5b:64:61:2c:96:48
Signer

Actual PE Digest

b6:73:78:cf:75:af:e5:18:82:71:8b:4b:7e:14:5b:64:61:2c:96:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
GetCommandLineA
CloseHandle
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
MulDiv
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SendMessageTimeoutA

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 280KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/FindProcDLL.dll
.dll windows:4 windows x86 arch:x86

c480ee4d2a64d4a16edee43fdfe35079

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
HeapCreate
VirtualFree
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
FreeLibrary
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
DisableThreadLibraryCalls
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetACP
GetOEMCP
WriteFile
VirtualAlloc
RtlUnwind
GetStringTypeA
GetStringTypeW
GetCPInfo

user32

wsprintfA

Exports

Exports

FindProc

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
RtlUnwind
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP

Exports

Exports

KillProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
videoAccDll.dll
.dll windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

86:68:b4:5b:72:8e:7f:23:e3:35:74:b4:a3:1b:93:dd:e1:97:49:41
Signer

Actual PE Digest

86:68:b4:5b:72:8e:7f:23:e3:35:74:b4:a3:1b:93:dd:e1:97:49:41

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

binddll
binddllT
binddllT2
clearurllist
destroydll
getstatus
getstatusInfo
initdll
setguidT
setguidT2
setoutdll
setoutdllT
settrueoutdll
startdll
startdllex
stopT
stopT2

Sections

CODE
Size: 562KB - Virtual size: 561KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
g.uusee.com.ico
geturltodown.htm
.html .js polyglot
geturltoplay.htm
.html .js polyglot
henkuai.ico
skins/UUPlayer/About.bmp
skins/UUPlayer/Control_Button_FullScreen_1.bmp
skins/UUPlayer/Control_Button_FullScreen_2.bmp
skins/UUPlayer/Control_Button_FullScreen_3.bmp
skins/UUPlayer/Control_Button_Recording_1.bmp
skins/UUPlayer/Control_Button_Recording_2.bmp
skins/UUPlayer/Control_Button_Recording_3.bmp
skins/UUPlayer/Control_Button_pause_1.bmp
skins/UUPlayer/Control_Button_pause_2.bmp
skins/UUPlayer/Control_Button_pause_3.bmp
skins/UUPlayer/Control_Button_pause_4.bmp
skins/UUPlayer/Ctrl_CheckBox_1.bmp
skins/UUPlayer/Ctrl_CheckBox_2.bmp
skins/UUPlayer/Ctrl_CheckBox_3.bmp
skins/UUPlayer/Ctrl_CheckBox_4.bmp
skins/UUPlayer/Ctrl_CheckBox_C1.bmp
skins/UUPlayer/Ctrl_CheckBox_C2.bmp
skins/UUPlayer/Ctrl_CheckBox_C3.bmp
skins/UUPlayer/Ctrl_CheckBox_C4.bmp
skins/UUPlayer/Ctrl_ComboBox_1.bmp
skins/UUPlayer/Ctrl_ComboBox_2.bmp
skins/UUPlayer/Ctrl_ComboBox_3.bmp
skins/UUPlayer/Ctrl_ComboBox_4.bmp
skins/UUPlayer/Ctrl_Edit_1.bmp
skins/UUPlayer/Ctrl_Edit_4.bmp
skins/UUPlayer/Ctrl_PushButton_1.bmp
skins/UUPlayer/Ctrl_PushButton_2.bmp
skins/UUPlayer/Ctrl_PushButton_3.bmp
skins/UUPlayer/Ctrl_PushButton_4.bmp
skins/UUPlayer/Ctrl_RadioButton_1.bmp
skins/UUPlayer/Ctrl_RadioButton_2.bmp
skins/UUPlayer/Ctrl_RadioButton_3.bmp
skins/UUPlayer/Ctrl_RadioButton_4.bmp
skins/UUPlayer/Ctrl_RadioButton_C1.bmp
skins/UUPlayer/Ctrl_RadioButton_C2.bmp
skins/UUPlayer/Ctrl_RadioButton_C3.bmp
skins/UUPlayer/Ctrl_RadioButton_C4.bmp
skins/UUPlayer/Dlg_Back.bmp
skins/UUPlayer/Dlg_Detect.bmp
skins/UUPlayer/Dlg_Frame_1.bmp
skins/UUPlayer/Dlg_Frame_2.bmp
skins/UUPlayer/Dlg_Frame_3.bmp
skins/UUPlayer/Dlg_Record_Task_1.bmp
skins/UUPlayer/Icon_Information.bmp
skins/UUPlayer/Icon_Question.bmp
skins/UUPlayer/Icon_Stop.bmp
skins/UUPlayer/ListHeader_1.bmp
skins/UUPlayer/ListHeader_2.bmp
skins/UUPlayer/ListHeader_3.bmp
skins/UUPlayer/ListHeader_ArrowD.bmp
skins/UUPlayer/ListHeader_ArrowU.bmp
skins/UUPlayer/ListHeader_SP.bmp
skins/UUPlayer/List_Header_D.bmp
skins/UUPlayer/List_Header_H.bmp
skins/UUPlayer/List_Header_N.bmp
skins/UUPlayer/List_Header_S.bmp
skins/UUPlayer/List_Header_Spliter.bmp
skins/UUPlayer/List_StatusErr.bmp
skins/UUPlayer/List_StatusExist.bmp
skins/UUPlayer/List_StatusFin.bmp
skins/UUPlayer/List_StatusNotFound.bmp
skins/UUPlayer/List_StatusPause.bmp
skins/UUPlayer/List_StatusPlay.bmp
skins/UUPlayer/List_StatusStop.bmp
skins/UUPlayer/List_StatusWait.bmp
skins/UUPlayer/Menu_Button1.bmp
skins/UUPlayer/Menu_Button2.bmp
skins/UUPlayer/Menu_Button3.bmp
skins/UUPlayer/Menu_Button4.bmp
skins/UUPlayer/Menu_Button5.bmp
skins/UUPlayer/Mode_Compact.bmp
skins/UUPlayer/Mode_Full.bmp
skins/UUPlayer/Mode_Medium.bmp
skins/UUPlayer/Play_Window_Rec_icon.bmp
skins/UUPlayer/Progressbar_BM_0.bmp
skins/UUPlayer/Progressbar_BM_1.bmp
skins/UUPlayer/Progressbar_BM_2.bmp
skins/UUPlayer/Progressbar_BM_3.bmp
skins/UUPlayer/Progressbar_BM_4.bmp
skins/UUPlayer/Progressbar_BM_5.bmp
skins/UUPlayer/Progressbar_BM_6.bmp
skins/UUPlayer/Progressbar_BM_7.bmp
skins/UUPlayer/Progressbar_Block_1.bmp
skins/UUPlayer/Progressbar_Block_2.bmp
skins/UUPlayer/Progressbar_Block_3.bmp
skins/UUPlayer/Progressbar_Block_4.bmp
skins/UUPlayer/Resource.h
skins/UUPlayer/Setting_Group_1_1.bmp
skins/UUPlayer/Setting_Group_1_2.bmp
skins/UUPlayer/Setting_Group_1_3.bmp
skins/UUPlayer/Setting_Group_2_1.bmp
skins/UUPlayer/Setting_Group_2_2.bmp
skins/UUPlayer/Setting_Group_2_3.bmp
skins/UUPlayer/Setting_Group_3_1.bmp
skins/UUPlayer/Setting_Group_3_2.bmp
skins/UUPlayer/Setting_Group_3_3.bmp
skins/UUPlayer/Setting_Group_4_1.bmp
skins/UUPlayer/Setting_Group_4_2.bmp
skins/UUPlayer/Setting_Group_4_3.bmp
skins/UUPlayer/Setting_Group_5_1.bmp
skins/UUPlayer/Setting_Group_5_2.bmp
skins/UUPlayer/Setting_Group_5_3.bmp
skins/UUPlayer/Side_Button1.bmp
skins/UUPlayer/Side_Button2.bmp
skins/UUPlayer/Side_Button3.bmp
skins/UUPlayer/Side_Button4.bmp
skins/UUPlayer/Side_Button5.bmp
skins/UUPlayer/Side_Button6.bmp
skins/UUPlayer/Startup.gif
.gif
skins/UUPlayer/Titlebar_button_Res_1.bmp
skins/UUPlayer/Titlebar_button_Res_2.bmp
skins/UUPlayer/Titlebar_button_Res_3.bmp
skins/UUPlayer/Titlebar_button_TopMost_1.bmp
skins/UUPlayer/Titlebar_button_TopMost_2.bmp
skins/UUPlayer/Titlebar_button_TopMost_3.bmp
skins/UUPlayer/TopTab_Browse.bmp
skins/UUPlayer/TopTab_Play.bmp
skins/UUPlayer/TopTab_Record.bmp
skins/UUPlayer/Tree_Arrow.bmp
skins/UUPlayer/Tree_ArrowH.bmp
skins/UUPlayer/Tree_Collapse.bmp
skins/UUPlayer/Tree_Collapse2.bmp
skins/UUPlayer/Tree_Expand.bmp
skins/UUPlayer/Tree_Expand2.bmp
skins/UUPlayer/Tree_HScrollBarThumb_D.bmp
skins/UUPlayer/Tree_HScrollBarThumb_H.bmp
skins/UUPlayer/Tree_HScrollBarThumb_N.bmp
skins/UUPlayer/Tree_HScrollBarThumb_S.bmp
skins/UUPlayer/Tree_HScrollBar_D.bmp
skins/UUPlayer/Tree_HScrollBar_H.bmp
skins/UUPlayer/Tree_HScrollBar_N.bmp
skins/UUPlayer/Tree_HScrollBar_S.bmp
skins/UUPlayer/Tree_Header.bmp
skins/UUPlayer/Tree_Hot_0.bmp
skins/UUPlayer/Tree_Hot_1.bmp
skins/UUPlayer/Tree_Icon0.bmp
skins/UUPlayer/Tree_Icon1.bmp
skins/UUPlayer/Tree_Icon2.bmp
skins/UUPlayer/Tree_Icon3.bmp
skins/UUPlayer/Tree_Icon4.bmp
skins/UUPlayer/Tree_ScrollBarThumb_D.bmp
skins/UUPlayer/Tree_ScrollBarThumb_H.bmp
skins/UUPlayer/Tree_ScrollBarThumb_N.bmp
skins/UUPlayer/Tree_ScrollBarThumb_S.bmp
skins/UUPlayer/Tree_ScrollBar_D.bmp
skins/UUPlayer/Tree_ScrollBar_H.bmp
skins/UUPlayer/Tree_ScrollBar_N.bmp
skins/UUPlayer/Tree_ScrollBar_S.bmp
skins/UUPlayer/Tree_SortIconDown.bmp
skins/UUPlayer/Tree_SortIconUp.bmp
skins/UUPlayer/UUSEE.ui
skins/UUPlayer/Volume_Bar_Block_1.bmp
skins/UUPlayer/Volume_Bar_Block_2.bmp
skins/UUPlayer/Volume_Bar_Block_3.bmp
skins/UUPlayer/Volume_Button_2_1.bmp
skins/UUPlayer/Volume_Button_2_2.bmp
skins/UUPlayer/Volume_Button_2_3.bmp
skins/UUPlayer/Wnd_AD.bmp
skins/UUPlayer/Wnd_Bottom.bmp
skins/UUPlayer/Wnd_Browser_1.bmp
skins/UUPlayer/Wnd_Browser_2.bmp
skins/UUPlayer/Wnd_Browser_3.bmp
skins/UUPlayer/Wnd_ChannelInfo.bmp
skins/UUPlayer/Wnd_ChannelInfo_5.bmp
skins/UUPlayer/Wnd_Control_1.bmp
skins/UUPlayer/Wnd_Control_2.bmp
skins/UUPlayer/Wnd_Control_3.bmp
skins/UUPlayer/Wnd_Control_4.bmp
skins/UUPlayer/Wnd_Info.bmp
skins/UUPlayer/Wnd_Main_1.bmp
skins/UUPlayer/Wnd_Main_2.bmp
skins/UUPlayer/Wnd_Main_3.bmp
skins/UUPlayer/Wnd_Main_5.bmp
skins/UUPlayer/Wnd_Media_1.bmp
skins/UUPlayer/Wnd_Media_2.bmp
skins/UUPlayer/Wnd_Media_3.bmp
skins/UUPlayer/Wnd_Media_4.bmp
skins/UUPlayer/Wnd_Navigate.bmp
skins/UUPlayer/Wnd_Play_1.bmp
skins/UUPlayer/Wnd_Play_2.bmp
skins/UUPlayer/Wnd_Play_5.bmp
skins/UUPlayer/Wnd_Setting_1.bmp
skins/UUPlayer/Wnd_Setting_2.bmp
skins/UUPlayer/Wnd_Setting_3.bmp
skins/UUPlayer/Wnd_Side2.bmp
skins/UUPlayer/Wnd_Side_1.bmp
skins/UUPlayer/Wnd_Side_2.bmp
skins/UUPlayer/Wnd_Side_3.bmp
skins/UUPlayer/Wnd_Side_5.bmp
skins/UUPlayer/Wnd_Top_1.bmp
skins/UUPlayer/Wnd_Top_2.bmp
skins/UUPlayer/Wnd_Top_3.bmp
skins/UUPlayer/Wnd_Web.bmp
ugege.ico
uninstuusee.exe
.exe windows:4 windows x86 arch:x86

170729c4965736ee8f8f4d1bab77cf38

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/04/2009, 00:00

Not After

03/04/2010, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Shi Yue Network Technology Co.\, Ltd.\ ,L=bei jing,ST=china,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

18:cb:03:33:58:a8:ad:e6:2d:c8:e5:f8:1c:14:e4:74:cb:2b:10:b3
Signer

Actual PE Digest

18:cb:03:33:58:a8:ad:e6:2d:c8:e5:f8:1c:14:e4:74:cb:2b:10:b3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
GetCommandLineA
CloseHandle
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
MulDiv
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SendMessageTimeoutA

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 368KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/FindProcDLL.dll
.dll windows:4 windows x86 arch:x86

c480ee4d2a64d4a16edee43fdfe35079

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
HeapCreate
VirtualFree
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
FreeLibrary
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
DisableThreadLibraryCalls
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetACP
GetOEMCP
WriteFile
VirtualAlloc
RtlUnwind
GetStringTypeA
GetStringTypeW
GetCPInfo

user32

wsprintfA

Exports

Exports

FindProc

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
RtlUnwind
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP

Exports

Exports

KillProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uusee.ico
uusee.swf

Sharing

General

Malware Config

Signatures

Files

170729c4965736ee8f8f4d1bab77cf38

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7fCertificate

Extended Key Usages

Key Usages

e6:e9:c1:30:bb:20:36:47:c5:cc:ed:df:6b:cf:ce:f3:dd:39:2c:53Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 262KB

.ndata Size: - Virtual size: 416KB

.rsrc Size: 7KB - Virtual size: 8KB

c480ee4d2a64d4a16edee43fdfe35079

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 9KB - Virtual size: 10KB

.reloc Size: 1KB - Virtual size: 1KB

57354bdeea3dfae6e948101add87501a

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 940B

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 2KB

4ec328f99bdd944fc98d8a5cf11f7a62

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

3d:00:8b:66:a6:15:9b:6f:9a:cd:86:3e:8d:43:bd:7f
Certificate

e6:e9:c1:30:bb:20:36:47:c5:cc:ed:df:6b:cf:ce:f3:dd:39:2c:53
Signer

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 262KB

.ndata
Size: - Virtual size: 416KB

.rsrc
Size: 7KB - Virtual size: 8KB

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 9KB - Virtual size: 10KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 940B

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 494B

.text
Size: 595KB - Virtual size: 595KB

.rdata
Size: 200KB - Virtual size: 200KB

.data
Size: 22KB - Virtual size: 36KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 65KB - Virtual size: 65KB

.text
Size: 24KB - Virtual size: 20KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 5KB

.reloc
Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

31:44:c0:6a:6c:fb:50:76:c1:5d:39:95:72:c6:94:21
Certificate