40092e1aa0778c915805aa8b5a2f6a94_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

40092e1aa0778c915805aa8b5a2f6a94_JaffaCakes118
Size

5.5MB
MD5

40092e1aa0778c915805aa8b5a2f6a94
SHA1

a47a7e99a6a84659c397e5e1ecd7d4da35bcef93
SHA256

02ceabc98536fbe37e8f7f821789fc994b06e568d5d5b3798c5bbb0a8627de44
SHA512

ed564befe047caf16c7966e6bce7314c4a641f4792b70fa3680a97efdc4ec60400192af2990d0606789aae7a5ccf7da576aa6458d0806629a249bde0ee2ae06d
SSDEEP

98304:ZssmGBCXAyVWte82Wna+JP8e+4OfUWjQVK0QQcg6OYASFuVd8VHd:ZsJGBCwyVG1a+JA40UtGg6OY5Gd81d

Score

3^/10

Malware Config

Signatures

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
unpack003/$PLUGINSDIR/NSISArray.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/UserInfo.dll
unpack003/$PLUGINSDIR/fpinstall.dll
unpack003/$PLUGINSDIR/nsExec.dll
unpack001/Enterprise/bin/App_Code.dll
unpack001/Enterprise/bin/App_Web_v-fusqvl.dll
unpack001/Enterprise/bin/App_Web_wqp_euiq.dll
unpack001/Enterprise/bin/App_Web_xugbuxft.dll
unpack001/Enterprise/bin/AspNetPager.dll
unpack001/Enterprise/bin/FredCK.FCKeditorV2.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
static1/unpack002/FP_AX_CAB_INSTALLER.exe	nsis_installer_1

Files

40092e1aa0778c915805aa8b5a2f6a94_JaffaCakes118
.rar
Enterprise/Admin/AboutUS.aspx
Enterprise/Admin/Admin_Blog.aspx
Enterprise/Admin/Admin_DataBak.aspx
Enterprise/Admin/CengGongAL.aspx
Enterprise/Admin/Default.aspx
Enterprise/Admin/GuestBook.aspx
Enterprise/Admin/Help.aspx
Enterprise/Admin/Job.aspx
Enterprise/Admin/Js/jquery-latest.pack.js
.js
Enterprise/Admin/Js/main.js
.js
Enterprise/Admin/Login.aspx
Enterprise/Admin/Manager.aspx
Enterprise/Admin/Member.aspx
Enterprise/Admin/Reply.aspx
Enterprise/Admin/Validata.aspx
Enterprise/Admin/Vote.aspx
Enterprise/Admin/admin.js
.js
Enterprise/Admin/images/admin/bg1.gif
.gif
Enterprise/Admin/images/admin/bg2.gif
.gif
Enterprise/Admin/images/admin/crm_10.gif
.gif
Enterprise/Admin/images/admin/crm_11.gif
.gif
Enterprise/Admin/images/admin/crm_12.gif
.gif
Enterprise/Admin/images/admin/crm_13.gif
.gif
Enterprise/Admin/images/admin/crm_14.gif
.gif
Enterprise/Admin/images/admin/crm_15.gif
.gif
Enterprise/Admin/images/admin/crm_16.gif
.gif
Enterprise/Admin/images/admin/crm_17.gif
.gif
Enterprise/Admin/images/admin/crm_18.gif
.gif
Enterprise/Admin/images/admin/crm_19.gif
.gif
Enterprise/Admin/images/admin/crm_20.gif
.gif
Enterprise/Admin/images/admin/crm_21.gif
.gif
Enterprise/Admin/images/admin/crm_22.gif
.gif
Enterprise/Admin/images/admin/crm_23_01.gif
.gif
Enterprise/Admin/images/admin/crm_24_01.gif
.gif
Enterprise/Admin/images/admin/crm_7.gif
.gif
Enterprise/Admin/images/admin/crm_8.gif
.gif
Enterprise/Admin/images/admin/crm_9.gif
.gif
Enterprise/Admin/images/admin/delete.gif
.gif
Enterprise/Admin/images/admin/goto.gif
.gif
Enterprise/Admin/images/admin/jia.gif
.gif
Enterprise/Admin/images/admin/jian.gif
.gif
Enterprise/Admin/images/admin/login.gif
.gif
Enterprise/Admin/images/admin/loginstyle.css
Enterprise/Admin/images/admin/memo.gif
.gif
Enterprise/Admin/images/admin/newhead.css
Enterprise/Admin/images/i_home.gif
.gif
Enterprise/Admin/images/main_login_go.gif
.gif
Enterprise/Admin/index.aspx
.js
Enterprise/Admin/left.aspx
.asp
Enterprise/Admin/link.aspx
Enterprise/Admin/logout.aspx
Enterprise/Admin/news.aspx
.js
Enterprise/Admin/news_show.aspx
Enterprise/Admin/news_type.aspx
Enterprise/Admin/picc.aspx
Enterprise/Admin/produce.aspx
Enterprise/Admin/shiyong.aspx
Enterprise/Admin/skins/css/main.css
Enterprise/Admin/skins/css/style.css
Enterprise/Admin/skins/css/style_left.css
Enterprise/Admin/skins/css/vssver.scc
Enterprise/Admin/skins/default/Forum_nav.gif
.gif
Enterprise/Admin/skins/default/bg2.gif
.gif
Enterprise/Admin/skins/default/line_bg.gif
.gif
Enterprise/Admin/skins/images/CleanCache.gif
.gif
Enterprise/Admin/skins/images/arrow.gif
.gif
Enterprise/Admin/skins/images/bbs_home.gif
.gif
Enterprise/Admin/skins/images/bg.gif
.gif
Enterprise/Admin/skins/images/bg2.gif
.gif
Enterprise/Admin/skins/images/bg3.gif
.gif
Enterprise/Admin/skins/images/bg4.gif
.gif
Enterprise/Admin/skins/images/body_bg.gif
.gif
Enterprise/Admin/skins/images/button_bg.gif
.gif
Enterprise/Admin/skins/images/dvbbs.gif
.gif
Enterprise/Admin/skins/images/exit.gif
.gif
Enterprise/Admin/skins/images/help.gif
.gif
Enterprise/Admin/skins/images/help_icon.gif
.gif
Enterprise/Admin/skins/images/home.gif
.gif
Enterprise/Admin/skins/images/left.gif
.gif
Enterprise/Admin/skins/images/left_bg.gif
.gif
Enterprise/Admin/skins/images/left_menu_bg.gif
.gif
Enterprise/Admin/skins/images/login.gif
.gif
Enterprise/Admin/skins/images/logo.gif
.gif
Enterprise/Admin/skins/images/logo_down.gif
.gif
Enterprise/Admin/skins/images/logo_up.gif
.gif
Enterprise/Admin/skins/images/menu01.gif
.gif
Enterprise/Admin/skins/images/menu01_right.gif
.gif
Enterprise/Admin/skins/images/menu02.gif
.gif
Enterprise/Admin/skins/images/menu_button_bg.gif
.gif
Enterprise/Admin/skins/images/menu_icon.gif
.gif
Enterprise/Admin/skins/images/menu_icon2.gif
.gif
Enterprise/Admin/skins/images/menu_left_line.gif
.gif
Enterprise/Admin/skins/images/menu_left_topbg.gif
.gif
Enterprise/Admin/skins/images/menu_nofollow.gif
.gif
Enterprise/Admin/skins/images/menu_plus.gif
.gif
Enterprise/Admin/skins/images/minus.gif
.gif
Enterprise/Admin/skins/images/plus.gif
.gif
Enterprise/Admin/skins/images/ref.gif
.gif
Enterprise/Admin/skins/images/right.gif
.gif
Enterprise/Admin/skins/images/search.gif
.gif
Enterprise/Admin/skins/images/skins.gif
.gif
Enterprise/Admin/skins/images/tag.gif
.gif
Enterprise/Admin/skins/images/teble_bottom_left.gif
.gif
Enterprise/Admin/skins/images/teble_bottom_right.gif
.gif
Enterprise/Admin/skins/images/teble_top_left.gif
.gif
Enterprise/Admin/skins/images/teble_top_right.gif
.gif
Enterprise/Admin/skins/images/top_bg.gif
.gif
Enterprise/Admin/skins/images/top_table_leftbg.gif
.gif
Enterprise/Admin/skins/images/up.gif
.gif
Enterprise/Admin/skins/images/up2.gif
.gif
Enterprise/Admin/skins/images/user_sys.gif
.gif
Enterprise/Admin/skins/images/user_tag.gif
.gif
Enterprise/Admin/skins/images/viewpic.gif
.gif
Enterprise/Admin/soft.aspx
Enterprise/Admin/sp.aspx
Enterprise/Admin/type.aspx
Enterprise/AnLi.aspx
.js
Enterprise/App_Data/db.mdb
Enterprise/App_Data/安装必读.txt
Enterprise/ChooseMe.aspx
Enterprise/Default.aspx
.js
Enterprise/DownLoad.aspx
Enterprise/DownLoad_1.aspx
Enterprise/GuestBook.aspx
Enterprise/GuestBook_1.aspx
Enterprise/Job.aspx
Enterprise/Job_gh.aspx
Enterprise/Job_zl.aspx
Enterprise/Link.aspx
Enterprise/News.aspx
Enterprise/News_show.aspx
Enterprise/PrecompiledApp.config
Enterprise/Product.aspx
Enterprise/SiPin.aspx
Enterprise/UC/Top.ascx
.js
Enterprise/UC/foot.ascx
Enterprise/UC/sp.ascx
.js
Enterprise/Uploads/anli/small/X20091111202935.gif
.png
Enterprise/Uploads/anli/small/X2009121621102.gif
.png
Enterprise/Uploads/anli/small/X20091216214327.gif
.png
Enterprise/Uploads/anli/small/X2009121621557.gif
.png
Enterprise/Uploads/anli/small/X20091222222146.gif
.png
Enterprise/Uploads/anli/small/X20091222224231.gif
.png
Enterprise/Uploads/anli/small/X20091222235133.gif
.png
Enterprise/Uploads/anli/small/X2009122304236.gif
.png
Enterprise/Uploads/anli/small/X2009122304317.gif
.png
Enterprise/Uploads/anli/small/X2009122305034.jpg
.png
Enterprise/Uploads/down/200752922327295.gif
.gif
Enterprise/Uploads/down/20094209455137097.gif
.gif
Enterprise/Uploads/down/D2009121621102.gif
.png
Enterprise/Uploads/down/D20091216214327.gif
.png
Enterprise/Uploads/down/D2010127141320.gif
.png
Enterprise/Uploads/down/small/200752922327295.gif
.gif
Enterprise/Uploads/down/small/20094209455137097.gif
.gif
Enterprise/Uploads/down/small/X2009121621102.gif
.png
Enterprise/Uploads/down/small/X20091216214327.gif
.png
Enterprise/Uploads/down/small/X2010127141320.gif
.png
Enterprise/Uploads/links/20100118021032.jpg
.jpg
Enterprise/Uploads/links/20100118115735.jpg
.jpg
Enterprise/Uploads/links/lg.gif
.gif
Enterprise/Uploads/links/links.jpg
.jpg
Enterprise/Uploads/links/nologo.jpg
.jpg
Enterprise/Uploads/links/sxmtpxw.jpg
.jpg
Enterprise/Uploads/links/sxnjjd.jpg
.jpg
Enterprise/Uploads/links/ycnw.jpg
.jpg
Enterprise/Uploads/links/zytx.jpg
.jpg
Enterprise/Uploads/product/D2005620224043948.jpg
.jpg
Enterprise/Uploads/product/D2005620225313949.jpg
.jpg
Enterprise/Uploads/product/D2006101116202721529.gif
.gif
Enterprise/Uploads/product/D2006101821305019787.gif
.gif
Enterprise/Uploads/product/D2006101900464984708.gif
.gif
Enterprise/Uploads/product/D2006101918253288185.jpg
.jpg
Enterprise/Uploads/product/D20066197593745275.gif
.gif
Enterprise/Uploads/product/D200661980345600.gif
.gif
Enterprise/Uploads/product/D2006649255933476.gif
.gif
Enterprise/Uploads/product/D20091111202935.gif
.gif
Enterprise/Uploads/product/D2009121621102.gif
.gif
Enterprise/Uploads/product/D20091216214327.gif
.gif
Enterprise/Uploads/product/D20091222224231.gif
.gif
Enterprise/Uploads/product/D2009122304236.gif
.gif
Enterprise/Uploads/product/D2009122304317.gif
.gif
Enterprise/Uploads/product/D2009122305034.jpg
.jpg
Enterprise/Uploads/product/D2010127141320.gif
.gif
Enterprise/Uploads/product/Dyc.gif
.gif
Enterprise/Uploads/product/small/X2005620224043948.jpg
.jpg
Enterprise/Uploads/product/small/X2005620225313949.jpg
.jpg
Enterprise/Uploads/product/small/X2006101116202721529.gif
.gif
Enterprise/Uploads/product/small/X2006101821305019787.gif
.gif
Enterprise/Uploads/product/small/X2006101900464984708.gif
.gif
Enterprise/Uploads/product/small/X2006101918253288185.jpg
.jpg
Enterprise/Uploads/product/small/X20066197593745275.gif
.gif
Enterprise/Uploads/product/small/X200661980345600.gif
.gif
Enterprise/Uploads/product/small/X2006649255933476.gif
.gif
Enterprise/Uploads/product/small/X20091111202935.gif
.png
Enterprise/Uploads/product/small/X2009121621102.gif
.png
Enterprise/Uploads/product/small/X20091216214327.gif
.png
Enterprise/Uploads/product/small/X20091222224231.gif
.gif
Enterprise/Uploads/product/small/X2009122304236.gif
.gif
Enterprise/Uploads/product/small/X2009122304317.gif
.gif
Enterprise/Uploads/product/small/X2009122305034.jpg
.jpg
Enterprise/Uploads/product/small/X2010127141320.gif
.png
Enterprise/Uploads/product/small/Xyc.gif
.gif
Enterprise/Uploads/sp/20091103032750.flv
Enterprise/Uploads/sp/flvplayer.swf
Enterprise/Uploads/sp/swflash.cab
.cab
FP_AX_CAB_INSTALLER.exe
.exe windows:4 windows x86 arch:x86

8f26fcd857d64db1a0ee4f8bdb240223

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:ea:81:7c:ba:c7:c3:8a:ba:72:e7:be:6f:00:de:6d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07/11/2007, 00:00

Not After

10/12/2008, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9f:21:f2:50:c6:f2:4f:53:cd:c3:8e:cb:0c:f7:3e:fd:22:10:49:dc
Signer

Actual PE Digest

9f:21:f2:50:c6:f2:4f:53:cd:c3:8e:cb:0c:f7:3e:fd:22:10:49:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
lstrcmpiA
CopyFileA
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
MulDiv
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetCurrentProcess

user32

ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SetForegroundWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISArray.dll
.dll windows:4 windows x86 arch:x86

91596216b99c852af6e0fb1fe8192de4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpyA
lstrcpynA
lstrcmpiA
lstrcmpA
lstrcatA
GlobalAlloc

user32

MessageBoxA
SendMessageA
wsprintfA
GetDlgItem
FindWindowExA
DialogBoxParamA
EnableWindow
SetWindowTextA
EndDialog
RedrawWindow
CharLowerA

Exports

Exports

ArrayCount
ArrayExists
Clear
Concat
Copy
Cut
Debug
Delete
ErrorStyle
Exists
ExistsI
FreeUnusedMem
Join
New
Pop
Push
Put
ReDim
Read
ReadToStack
Reverse
Search
SearchI
SetSize
Shift
SizeOf
Sort
Splice
Swap
Unload
Unshift
Write
WriteList
WriteListC

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

48cfa0ea7e353e4a7dd23572da8374ef

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
GetCurrentProcess
GetLastError
GlobalFree
CloseHandle
lstrcpynA
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName

Sections

.text
Size: 1024B - Virtual size: 573B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 45B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/fpinstall.dll
.dll windows:4 windows x86 arch:x86

4bb7026bcfe942cdf23b6f661ad54f48

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
WideCharToMultiByte
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
OpenProcess
GetVersionExA
FormatMessageA
GetLastError
SetFileAttributesA
GetFileAttributesA
GetCurrentProcess
TerminateProcess
CloseHandle
lstrlenA
lstrcpyA
GlobalAlloc
lstrcpynA
LoadLibraryA
GlobalFree

user32

MessageBoxA

advapi32

GetTokenInformation
RegOpenKeyA
RegEnumKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken

Exports

Exports

_ChangeRegKeyDACL
_FindProcess
_KillProcess
_ObjectExistsAndIsOwnedBySomeoneElse
_RecursiveRegLockUnlock
_Unload
_UnlockControl

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 466B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

238a16a49edf3ab59e2f8c89449c9af7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
lstrcpynA
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
PeekNamedPipe
GetTickCount
CreateProcessA
GetStartupInfoA
CreatePipe
GetVersionExA
GlobalLock
DeleteFileA
TerminateProcess
lstrlenA
lstrcatA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CloseHandle
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
GetCommandLineA
Sleep
lstrcmpiA
GetExitCodeProcess

user32

SendMessageA
OemToCharBuffA
CharNextA
wsprintfA
CharPrevA
FindWindowExA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 362B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Flash10a.ocx
.dll regsvr32 windows:5 windows x86 arch:x86

b96e6cdd3ac5ae1b1f74aaa2a517f3af

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:ea:81:7c:ba:c7:c3:8a:ba:72:e7:be:6f:00:de:6d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07/11/2007, 00:00

Not After

10/12/2008, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c3:96:c4:3e:d2:33:21:6d:68:6d:3e:9b:fa:03:ec:cd:ab:f9:dc:23
Signer

Actual PE Digest

c3:96:c4:3e:d2:33:21:6d:68:6d:3e:9b:fa:03:ec:cd:ab:f9:dc:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\flashfarm\depot\main\player\branches\FlashPlayer\FlashPlayer10_DotReleases\platform\win32\obj\Flash5AX\Release\Flash.pdb

Imports

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

winmm

waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveInGetNumDevs
waveOutGetDevCapsA
waveOutUnprepareHeader
waveOutGetNumDevs
waveOutOpen
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveOutGetPosition
timeSetEvent
timeKillEvent
timeBeginPeriod
timeGetTime
waveOutPrepareHeader
waveOutWrite
waveOutClose
waveOutReset
timeGetDevCaps
waveInGetDevCapsA
timeEndPeriod

wininet

HttpSendRequestA
InternetOpenA
HttpQueryInfoA
HttpOpenRequestA
InternetConnectA
InternetReadFile
InternetCloseHandle

crypt32

CryptGetMessageCertificates
CertCreateCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertCloseStore
CryptVerifyMessageSignature

rpcrt4

UuidToStringA
RpcStringFreeA

oleaut32

OleCreatePropertyFrame
SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
SysAllocStringLen
SysStringLen
SysStringByteLen
VariantInit
VariantClear
VariantChangeType
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
SafeArrayDestroy
VarBstrCat
SysAllocStringByteLen
SafeArrayUnlock
SafeArrayLock
SafeArrayCreateVector

kernel32

LocalFree
LocalAlloc
SetFileAttributesA
GetFileAttributesA
CreateMutexA
FreeLibrary
GetModuleFileNameA
MulDiv
GlobalUnlock
GlobalLock
InterlockedIncrement
InterlockedDecrement
GetModuleHandleW
GetCurrentThreadId
OutputDebugStringA
SetLastError
DisableThreadLibraryCalls
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
SetErrorMode
GetTickCount
LCMapStringA
LCMapStringW
CreateProcessA
TlsAlloc
QueryPerformanceCounter
QueryPerformanceFrequency
SetThreadPriority
WaitForSingleObject
SetWaitableTimer
CreateThread
CreateWaitableTimerA
GetProcessTimes
GetCurrentProcessId
GlobalSize
GetTempFileNameW
GetSystemDefaultLangID
MoveFileA
DeleteFileA
GetSystemInfo
GetUserDefaultLangID
CreateFileA
ExitThread
WriteFile
SetFilePointer
ReadFile
GetFileSize
GetCurrentProcess
FindResourceExA
FindResourceExW
GetFileAttributesW
SetUnhandledExceptionFilter
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
CreateDirectoryA
CreateFileW
GetCurrentDirectoryA
GetTempFileNameA
GetSystemDirectoryA
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
SetCurrentDirectoryA
SetFilePointerEx
GetFileSizeEx
GetFileAttributesExA
RemoveDirectoryA
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
TerminateThread
lstrcpyA
IsDBCSLeadByteEx
VirtualProtectEx
HeapAlloc
GetProcessHeap
HeapFree
VirtualAlloc
VirtualFree
VirtualProtect
CreateSemaphoreA
ReleaseSemaphore
IsProcessorFeaturePresent
GetCommandLineA
UnhandledExceptionFilter
GetStdHandle
TlsGetValue
TlsSetValue
TlsFree
TerminateProcess
IsDebuggerPresent
HeapCreate
LockResource
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
FlushInstructionCache
lstrcmpiA
GetModuleHandleA
GetLastError
LoadLibraryA
GetProcAddress
GlobalAlloc
GetLocaleInfoA
GetVersionExA
lstrlenW
lstrlenA
RaiseException
WideCharToMultiByte
GlobalFree
GetCurrentThread
SetThreadAffinityMask
VirtualQuery
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ResetEvent
CreateEventA
CloseHandle
WaitForMultipleObjects
SetEvent
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
IsValidCodePage
GetOEMCP
RtlUnwind
HeapDestroy
HeapReAlloc
ExitProcess

user32

IsClipboardFormatAvailable
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetWindowThreadProcessId
PeekMessageA
WaitForInputIdle
GetForegroundWindow
TranslateMessage
DispatchMessageA
DialogBoxParamW
DialogBoxParamA
RedrawWindow
DialogBoxIndirectParamW
DialogBoxIndirectParamA
EndDialog
GetDesktopWindow
LoadIconA
SendMessageA
GetDlgItem
SetWindowTextA
GetMenuItemCount
InsertMenuItemW
GetClipboardFormatNameA
RegisterClipboardFormatA
GetParent
IsChild
PtInRect
BeginPaint
EndPaint
SystemParametersInfoA
GetMenuItemID
DeleteMenu
InsertMenuItemA
GetMenuItemInfoA
TrackPopupMenu
KillTimer
SetTimer
UpdateWindow
RegisterClassA
GetWindowRect
MapVirtualKeyA
GetKeyState
GetFocus
ReleaseCapture
GetSystemMetrics
EnumDisplaySettingsA
GetCapture
LoadMenuA
GetSubMenu
DestroyMenu
SetCursor
WindowFromPoint
GetCursorPos
ScreenToClient
GetClientRect
MessageBoxA
LoadStringA
SetCapture
IsWindow
DestroyWindow
EnableMenuItem
CheckMenuItem
SetFocus
GetWindowInfo
CopyRect
SendInput
GetKeyboardLayout
FillRect
UnregisterClassA
CreateWindowExA
RegisterClassExA
InvalidateRect
DefWindowProcA
UnionRect
CallWindowProcA
IntersectRect
EqualRect
SetWindowRgn
SetWindowPos
GetDC
ReleaseDC
GetClassInfoExA
ShowWindow
GetWindowLongA
SetWindowLongA
CharNextW
CharNextA
ClientToScreen
GetMonitorInfoA
OffsetRect
SetRect
MonitorFromWindow
GetTopWindow
GetDoubleClickTime
EnumWindows
PostMessageA
IsWindowEnabled
GetWindow
GetClassNameA
GetWindowTextW
GetWindowTextA
LoadCursorA

gdi32

CreateMetaFileA
GetObjectA
CreateDIBSection
DeleteObject
GetDIBits
CreateCompatibleBitmap
SetWindowOrgEx
SelectObject
SelectPalette
RealizePalette
ExtTextOutA
SetBkColor
CreateSolidBrush
StretchBlt
SetWindowExtEx
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
SetTextAlign
TextOutA
BitBlt
StartPage
SetStretchBltMode
GetStretchBltMode
Rectangle
GetStockObject
StretchDIBits
SetViewportOrgEx
EndPage
GetClipBox
GetSystemPaletteEntries
GetObjectType
GetICMProfileA
CreateDCA
CreateFontIndirectA
GetTextMetricsA
EnumFontFamiliesA
SetBkMode
IntersectClipRect
SelectClipRgn
ExtTextOutW
SetTextColor
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
GetBkColor
CreateFontIndirectW
SetWorldTransform
SetGraphicsMode
GetWorldTransform
SetTextCharacterExtra
CreatePen
DPtoLP
GetTextExtentPoint32W
GetCurrentObject
GetTextExtentPoint32A
CreatePalette
StartDocA
EndDoc
StrokePath
ExtCreatePen
FillPath
SetPolyFillMode
SaveDC
BeginPath
MoveToEx
EndPath
LineTo
PolyBezierTo
SelectClipPath
RestoreDC
GdiFlush
CreateCompatibleDC
DeleteDC
GetPixel
GetFontData
LPtoDP
EnumFontFamiliesExW
GetDeviceCaps

comdlg32

CommDlgExtendedError
GetSaveFileNameA
PrintDlgA
GetOpenFileNameA

advapi32

RegEnumKeyExA
RegQueryValueExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHAppBarMessage

ole32

OleRegGetMiscStatus
CreateDataAdviseHolder
CoCreateInstance
StringFromGUID2
OleLoadFromStream
OleRegGetUserType
OleSaveToStream
CoInitialize
ReleaseStgMedium
OleFlushClipboard
OleIsCurrentClipboard
OleGetClipboard
OleRegEnumVerbs
CreateOleAdviseHolder
CoTaskMemRealloc
CoTaskMemFree
WriteClassStm
CreateBindCtx
OleUninitialize
OleSetClipboard
CoUninitialize
CoRegisterMessageFilter
CoTaskMemAlloc
OleInitialize

shlwapi

SHDeleteKeyA

urlmon

HlinkSimpleNavigateToMoniker
RegisterBindStatusCallback
CreateURLMoniker
CopyStgMedium

mscms

DeleteColorTransform
CloseColorProfile
CreateColorTransformW
OpenColorProfileA
TranslateBitmapBits

ws2_32

getservbyname
htons
gethostbyaddr
getservbyport
WSASetLastError
setsockopt
connect
recvfrom
sendto
WSAAddressToStringA
gethostname
select
ioctlsocket
ntohl
htonl
WSACloseEvent
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACleanup
closesocket
WSAGetLastError
WSAIoctl
WSAAsyncSelect
socket
WSASocketA
WSAStartup
recv
send
bind
ntohs
getsockname
inet_addr
inet_ntoa
gethostbyname

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 514KB - Virtual size: 514KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 106KB - Virtual size: 961KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FlashUtil10a.exe
.exe windows:5 windows x86 arch:x86

9f1a0e4c5dd3045d038d3e28066881dd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:ea:81:7c:ba:c7:c3:8a:ba:72:e7:be:6f:00:de:6d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07/11/2007, 00:00

Not After

10/12/2008, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d2:76:e3:7c:d3:5f:7d:8c:53:df:b6:23:06:d7:23:f3:4e:b2:b3:8f
Signer

Actual PE Digest

d2:76:e3:7c:d3:5f:7d:8c:53:df:b6:23:06:d7:23:f3:4e:b2:b3:8f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wininet

InternetCloseHandle
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
HttpQueryInfoA

crypt32

CertFreeCertificateContext
CertCreateCertificateContext
CryptVerifyMessageSignature
CertCloseStore
CryptGetMessageCertificates
CertVerifySubjectCertificateContext
CertFindCertificateInStore

shlwapi

SHDeleteKeyA

kernel32

IsValidCodePage
GetOEMCP
GetLastError
CreateMutexA
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetTempPathA
WriteFile
FormatMessageA
_lclose
_lread
OpenFile
GetSystemDirectoryA
SetThreadLocale
GetSystemDefaultLangID
LocalFree
LocalAlloc
GetCurrentProcess
CreateThread
GetModuleHandleA
GetVersionExA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
UnmapViewOfFile
GetTickCount
WaitForSingleObject
ReleaseMutex
WideCharToMultiByte
GetACP
GetFileAttributesA
CreateDirectoryA
DeleteFileA
MultiByteToWideChar
CreateFileW
SetFilePointer
SetFileAttributesA
InterlockedIncrement
MapViewOfFile
CreateFileMappingA
CreateProcessA
FindClose
ExitProcess
GetCommandLineA
GetCPInfo
IsDebuggerPresent
TerminateProcess
HeapSize
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
Sleep
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
GetStdHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
HeapAlloc
HeapFree
GetStartupInfoA
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
InterlockedDecrement
RtlUnwind

user32

WaitForInputIdle
SystemParametersInfoA
GetForegroundWindow
LoadImageA
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
DestroyIcon
LoadCursorA
RegisterClassExA
DefWindowProcA
CreateDialogParamA
SetWindowTextA
CharNextA
CreateWindowExA
GetDlgItem
SetWindowLongA
MessageBoxA
LoadBitmapA
LoadStringA
DialogBoxParamA
EndDialog
GetParent
GetDesktopWindow
GetWindowRect
SetWindowPos
PostMessageA
ShowWindow
SendMessageA
DestroyWindow
PostQuitMessage
DdeInitializeA
DdeDisconnect
DdeUninitialize
DdeClientTransaction
DdeCreateStringHandleA
DdeConnect
DdeFreeStringHandle
ScreenToClient
GetWindowLongA

gdi32

DeleteObject

advapi32

RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteValueA

shell32

ShellExecuteA

ole32

CoRegisterClassObject
CoUninitialize
CoInitialize
CoRevokeClassObject

oleaut32

DispGetIDsOfNames
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
SysAllocString
DispInvoke
SafeArrayDestroy

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
uninstall_activeX.exe.nsis
swflash.inf
Enterprise/Uploads/sp/video_play.swf
Enterprise/Vote_show.aspx
Enterprise/Web.Config
.xml
Enterprise/about.aspx
Enterprise/bin/App_Code.compiled
Enterprise/bin/App_Code.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Enterprise/bin/App_Web_v-fusqvl.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Enterprise/bin/App_Web_wqp_euiq.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Enterprise/bin/App_Web_xugbuxft.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Enterprise/bin/AspNetPager.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Enterprise/bin/FredCK.FCKeditorV2.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Enterprise/contact.aspx
Enterprise/css/rq.js
.js
Enterprise/css/style.css
Enterprise/fckeditor/editor/css/behaviors/disablehandles.htc
Enterprise/fckeditor/editor/css/behaviors/showtableborders.htc
Enterprise/fckeditor/editor/css/fck_editorarea.css
Enterprise/fckeditor/editor/css/fck_internal.css
Enterprise/fckeditor/editor/css/fck_showtableborders_gecko.css
Enterprise/fckeditor/editor/css/images/fck_anchor.gif
.gif
Enterprise/fckeditor/editor/css/images/fck_flashlogo.gif
.gif
Enterprise/fckeditor/editor/css/images/fck_hiddenfield.gif
.gif
Enterprise/fckeditor/editor/css/images/fck_pagebreak.gif
.gif
Enterprise/fckeditor/editor/dialog/common/fck_dialog_common.css
Enterprise/fckeditor/editor/dialog/common/fck_dialog_common.js
.js
Enterprise/fckeditor/editor/dialog/common/fcknumericfield.htc
.js
Enterprise/fckeditor/editor/dialog/common/images/locked.gif
.gif
Enterprise/fckeditor/editor/dialog/common/images/reset.gif
.gif
Enterprise/fckeditor/editor/dialog/common/images/unlocked.gif
.gif
Enterprise/fckeditor/editor/dialog/common/moz-bindings.xml
.js .xml polyglot
Enterprise/fckeditor/editor/dialog/fck_about.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_about/logo_fckeditor.gif
.gif
Enterprise/fckeditor/editor/dialog/fck_about/logo_fredck.gif
.gif
Enterprise/fckeditor/editor/dialog/fck_anchor.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_button.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_checkbox.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_colorselector.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_docprops.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_docprops/fck_document_preview.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_find.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_flash.html
.html
Enterprise/fckeditor/editor/dialog/fck_flash/fck_flash.js
.js
Enterprise/fckeditor/editor/dialog/fck_flash/fck_flash_preview.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_form.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_hiddenfield.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_image.html
.html
Enterprise/fckeditor/editor/dialog/fck_image/fck_image.js
.js
Enterprise/fckeditor/editor/dialog/fck_image/fck_image_preview.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_link.html
.html
Enterprise/fckeditor/editor/dialog/fck_link/fck_link.js
.js
Enterprise/fckeditor/editor/dialog/fck_listprop.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_paste.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_radiobutton.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_replace.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_select.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_select/fck_select.js
.js
Enterprise/fckeditor/editor/dialog/fck_smiley.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_source.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_specialchar.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_spellerpages.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_spellerpages/spellerpages/controlWindow.js
.js
Enterprise/fckeditor/editor/dialog/fck_spellerpages/spellerpages/controls.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.cfm
.js
Enterprise/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php
.js
Enterprise/fckeditor/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.pl
.sh .js linux polyglot
Enterprise/fckeditor/editor/dialog/fck_spellerpages/spellerpages/spellChecker.js
.js
Enterprise/fckeditor/editor/dialog/fck_spellerpages/spellerpages/spellchecker.html
.js
Enterprise/fckeditor/editor/dialog/fck_spellerpages/spellerpages/spellerStyle.css
Enterprise/fckeditor/editor/dialog/fck_spellerpages/spellerpages/wordWindow.js
.js
Enterprise/fckeditor/editor/dialog/fck_table.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_tablecell.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_template.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_template/images/template1.gif
.gif
Enterprise/fckeditor/editor/dialog/fck_template/images/template2.gif
.gif
Enterprise/fckeditor/editor/dialog/fck_template/images/template3.gif
.gif
Enterprise/fckeditor/editor/dialog/fck_textarea.html
.html .js polyglot
Enterprise/fckeditor/editor/dialog/fck_textfield.html
.html .js polyglot
Enterprise/fckeditor/editor/fckdebug.html
.html .js polyglot
Enterprise/fckeditor/editor/fckdialog.html
.html .js polyglot
Enterprise/fckeditor/editor/fckeditor.html
.html .js polyglot
Enterprise/fckeditor/editor/fckeditor.original.html
.html .js polyglot
Enterprise/fckeditor/editor/filemanager/browser/default/browser.css
Enterprise/fckeditor/editor/filemanager/browser/default/browser.html
.html .js polyglot
Enterprise/fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx
.asp
Enterprise/fckeditor/editor/filemanager/browser/default/frmactualfolder.html
.html .js polyglot
Enterprise/fckeditor/editor/filemanager/browser/default/frmcreatefolder.html
.html .js polyglot
Enterprise/fckeditor/editor/filemanager/browser/default/frmfolders.html
.html .js polyglot
Enterprise/fckeditor/editor/filemanager/browser/default/frmresourceslist.html
.html .js polyglot
Enterprise/fckeditor/editor/filemanager/browser/default/frmresourcetype.html
.html .js polyglot
Enterprise/fckeditor/editor/filemanager/browser/default/frmupload.html
.html .js polyglot
Enterprise/fckeditor/editor/filemanager/browser/default/images/ButtonArrow.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/Folder.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/Folder32.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/FolderOpened.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/FolderOpened32.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/FolderUp.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/ai.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/avi.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/bmp.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/cs.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/default.icon.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/dll.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/doc.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/exe.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/fla.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/gif.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/htm.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/html.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/jpg.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/js.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/mdb.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/mp3.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/pdf.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/png.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/ppt.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/rdp.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/swf.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/swt.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/txt.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/vsd.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/xls.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/xml.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/32/zip.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/ai.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/avi.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/bmp.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/cs.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/default.icon.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/dll.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/doc.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/exe.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/fla.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/gif.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/htm.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/html.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/jpg.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/js.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/mdb.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/mp3.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/pdf.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/png.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/ppt.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/rdp.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/swf.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/swt.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/txt.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/vsd.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/xls.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/xml.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/icons/zip.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/images/spacer.gif
.gif
Enterprise/fckeditor/editor/filemanager/browser/default/js/common.js
.js
Enterprise/fckeditor/editor/filemanager/browser/default/js/fckxml.js
.js
Enterprise/fckeditor/editor/filemanager/upload/aspx/upload.aspx
.asp
Enterprise/fckeditor/editor/images/anchor.gif
.gif
Enterprise/fckeditor/editor/images/arrow_ltr.gif
.gif
Enterprise/fckeditor/editor/images/arrow_rtl.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/angel_smile.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/angry_smile.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/broken_heart.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/cake.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/confused_smile.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/cry_smile.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/devil_smile.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/embaressed_smile.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/envelope.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/heart.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/kiss.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/lightbulb.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/omg_smile.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/regular_smile.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/sad_smile.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/shades_smile.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/teeth_smile.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/thumbs_down.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/thumbs_up.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/tounge_smile.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/whatchutalkingabout_smile.gif
.gif
Enterprise/fckeditor/editor/images/smiley/msn/wink_smile.gif
.gif
Enterprise/fckeditor/editor/images/spacer.gif
.gif
Enterprise/fckeditor/editor/js/fckeditorcode_gecko.js
.js
Enterprise/fckeditor/editor/js/fckeditorcode_ie.js
.js
Enterprise/fckeditor/editor/lang/_getfontformat.html
.html .js polyglot
Enterprise/fckeditor/editor/lang/_translationstatus.txt
Enterprise/fckeditor/editor/lang/en.js
.js
Enterprise/fckeditor/editor/lang/zh-cn.js
.js
Enterprise/fckeditor/editor/lang/zh.js
.js
Enterprise/fckeditor/editor/plugins/autogrow/fckplugin.js
.js
Enterprise/fckeditor/editor/plugins/placeholder/fck_placeholder.html
.html .js polyglot
Enterprise/fckeditor/editor/plugins/placeholder/fckplugin.js
.js
Enterprise/fckeditor/editor/plugins/placeholder/lang/de.js
Enterprise/fckeditor/editor/plugins/placeholder/lang/en.js
Enterprise/fckeditor/editor/plugins/placeholder/lang/fr.js
Enterprise/fckeditor/editor/plugins/placeholder/lang/it.js
Enterprise/fckeditor/editor/plugins/placeholder/lang/pl.js
Enterprise/fckeditor/editor/plugins/placeholder/placeholder.gif
.gif
Enterprise/fckeditor/editor/plugins/simplecommands/fckplugin.js
Enterprise/fckeditor/editor/plugins/tablecommands/fckplugin.js
Enterprise/fckeditor/editor/skins/_fckviewstrips.html
.html .js polyglot
Enterprise/fckeditor/editor/skins/default/fck_dialog.css
Enterprise/fckeditor/editor/skins/default/fck_editor.css
Enterprise/fckeditor/editor/skins/default/fck_strip.gif
.gif
Enterprise/fckeditor/editor/skins/default/images/toolbar.arrowright.gif
.gif
Enterprise/fckeditor/editor/skins/default/images/toolbar.buttonarrow.gif
.gif
Enterprise/fckeditor/editor/skins/default/images/toolbar.collapse.gif
.gif
Enterprise/fckeditor/editor/skins/default/images/toolbar.end.gif
.gif
Enterprise/fckeditor/editor/skins/default/images/toolbar.expand.gif
.gif
Enterprise/fckeditor/editor/skins/default/images/toolbar.separator.gif
.gif
Enterprise/fckeditor/editor/skins/default/images/toolbar.start.gif
.gif
Enterprise/fckeditor/fckconfig.js
.js
Enterprise/fckeditor/fckeditor.js
.js
Enterprise/fckeditor/fckpackager.xml
.xml
Enterprise/fckeditor/fckstyles.xml
.xml
Enterprise/fckeditor/fcktemplates.xml
.xml
Enterprise/fuwu.aspx
Enterprise/images/1.gif
.gif
Enterprise/images/20.jpg
.jpg
Enterprise/images/23.jpg
.jpg
Enterprise/images/N_title.jpg
.jpg
Enterprise/images/adpic/01.jpg
.jpg
Enterprise/images/adpic/02.jpg
.jpg
Enterprise/images/adpic/03.JPG
.jpg
Enterprise/images/adpic/04.jpg
.jpg
Enterprise/images/advertisement.jpg
.jpg
Enterprise/images/arrow_7.gif
.gif
Enterprise/images/beijing1.jpg
.jpg
Enterprise/images/bg_position.gif
.gif
Enterprise/images/bg_title_01.gif
.gif
Enterprise/images/biaozhun.jpg
.jpg
Enterprise/images/bk.jpg
.jpg
Enterprise/images/case_r10_c3.jpg
.jpg
Enterprise/images/case_r11_c3.jpg
.jpg
Enterprise/images/case_r12_c3.jpg
.jpg
Enterprise/images/case_r14_c1.jpg
.jpg
Enterprise/images/case_r3_c1.jpg
.jpg
Enterprise/images/case_r5_c1.jpg
.jpg
Enterprise/images/case_r6_c1.jpg
.jpg
Enterprise/images/case_r7_c3.jpg
.jpg
Enterprise/images/case_r8_c1.jpg
.jpg
Enterprise/images/case_r9_c3.jpg
.jpg
Enterprise/images/cgal.gif
.gif
Enterprise/images/colleague.jpg
.jpg
Enterprise/images/cptj.gif
.gif
Enterprise/images/css.css
Enterprise/images/dl.gif
.gif
Enterprise/images/flash/hcwlwmo.swf
Enterprise/images/icon_04.gif
.gif
Enterprise/images/icon_06.gif
.gif
Enterprise/images/icon_07.gif
.gif
Enterprise/images/icon_09.gif
.gif
Enterprise/images/icon_10.gif
.gif
Enterprise/images/icon_11.gif
.gif
Enterprise/images/icon_12.gif
.gif
Enterprise/images/icon_13.gif
.gif
Enterprise/images/icon_14.gif
.gif
Enterprise/images/icon_Announce.gif
.gif
Enterprise/images/icon_education.gif
.gif
Enterprise/images/icon_from.gif
.gif
Enterprise/images/icon_page.gif
.gif
Enterprise/images/index1_87.jpg
.jpg
Enterprise/images/index_002.gif
.gif
Enterprise/images/index_201.jpg
.jpg
Enterprise/images/index_33.jpg
.jpg
Enterprise/images/index_83.jpg
.jpg
Enterprise/images/index_85.jpg
.jpg
Enterprise/images/index_90.jpg
.jpg
Enterprise/images/isvote.gif
.gif
Enterprise/images/kekao.jpg
.jpg
Enterprise/images/kuaijie.jpg
.jpg
Enterprise/images/left-kuang-bg.gif
.gif
Enterprise/images/left-kuang1.gif
.gif
Enterprise/images/left-kuang2.gif
.gif
Enterprise/images/line.gif
.gif
Enterprise/images/link.jpg
.jpg
Enterprise/images/logo.gif
Enterprise/images/ly/QQ.bmp
Enterprise/images/ly/email.gif
.gif
Enterprise/images/menubg.jpg
.jpg
Enterprise/images/network.jpg
.jpg
Enterprise/images/newleaveword.gif
.gif
Enterprise/images/news.gif
.gif
Enterprise/images/pingan_index_ipc_127.jpg
.jpg
Enterprise/images/pingan_index_ipc_151.jpg
.jpg
Enterprise/images/pingan_index_ipc_76.jpg
.jpg
Enterprise/images/pingan_index_ipc_78.jpg
.jpg
Enterprise/images/pingan_index_ipc_82.jpg
.jpg
Enterprise/images/pinzhi.jpg
.jpg
Enterprise/images/pulldown.js
.js
Enterprise/images/q03.gif
.gif
Enterprise/images/quanmian.jpg
.jpg
Enterprise/images/quickmenu_01.gif
.gif
Enterprise/images/quickmenu_02.gif
.gif
Enterprise/images/quickmenu_03.gif
.gif
Enterprise/images/quickmenu_04.gif
.gif
Enterprise/images/quickmenu_05.gif
.gif
Enterprise/images/read.gif
.gif
Enterprise/images/recurit_03.jpg
.jpg
Enterprise/images/recurit_c1.jpg
.jpg
Enterprise/images/recurit_c2.jpg
.jpg
Enterprise/images/serve.jpg
.jpg
Enterprise/images/service.gif
.gif
Enterprise/images/sliderMenu.js
Enterprise/images/spacer.gif
.gif
Enterprise/images/system.jpg
.jpg
Enterprise/images/tiao.gif
.gif
Enterprise/images/top.gif
.gif
Enterprise/images/voteSubmit.gif
.gif
Enterprise/images/voteView.gif
.gif
Enterprise/images/write.gif
.gif
Enterprise/images/xwdt.gif
.gif
Enterprise/images/y_02.gif
.gif
Enterprise/images/y_04.gif
.gif
Enterprise/images/zhuangye.jpg
.jpg
Enterprise/images/znss_ss.jpg
.jpg
Enterprise/product_show.aspx
Enterprise/安装必读.txt
Enterprise/新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

8f26fcd857d64db1a0ee4f8bdb240223

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

4b:ea:81:7c:ba:c7:c3:8a:ba:72:e7:be:6f:00:de:6dCertificate

Extended Key Usages

Key Usages

9f:21:f2:50:c6:f2:4f:53:cd:c3:8e:cb:0c:f7:3e:fd:22:10:49:dcSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 114KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 44KB - Virtual size: 43KB

91596216b99c852af6e0fb1fe8192de4

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 1024B - Virtual size: 24KB

.rsrc Size: 512B - Virtual size: 432B

.reloc Size: 2KB - Virtual size: 1KB

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 92B

.reloc Size: 512B - Virtual size: 496B

48cfa0ea7e353e4a7dd23572da8374ef

Headers

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 573B

.rdata Size: 1024B - Virtual size: 576B

.data Size: 512B - Virtual size: 45B

.reloc Size: 512B - Virtual size: 132B

4bb7026bcfe942cdf23b6f661ad54f48

Headers

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

4b:ea:81:7c:ba:c7:c3:8a:ba:72:e7:be:6f:00:de:6d
Certificate

9f:21:f2:50:c6:f2:4f:53:cd:c3:8e:cb:0c:f7:3e:fd:22:10:49:dc
Signer

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 114KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 44KB - Virtual size: 43KB

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 24KB

.rsrc
Size: 512B - Virtual size: 432B

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 496B

.text
Size: 1024B - Virtual size: 573B

.rdata
Size: 1024B - Virtual size: 576B

.data
Size: 512B - Virtual size: 45B

.reloc
Size: 512B - Virtual size: 132B

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 466B

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 362B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

4b:ea:81:7c:ba:c7:c3:8a:ba:72:e7:be:6f:00:de:6d
Certificate

c3:96:c4:3e:d2:33:21:6d:68:6d:3e:9b:fa:03:ec:cd:ab:f9:dc:23
Signer

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 514KB - Virtual size: 514KB

.data
Size: 106KB - Virtual size: 961KB