ead791414bf8b9f1126e4d6b099ecf939f595d03d5d30c69dc05c637806ea0d4

Sharing

Copy URL

Twitter E-mail

General

Target

ead791414bf8b9f1126e4d6b099ecf939f595d03d5d30c69dc05c637806ea0d4
Size

2.5MB
MD5

4726474b31484684a60f8be1ecfa7986
SHA1

5ad7989e8d5ecfcdba14bdb0135380ce19f709fd
SHA256

ead791414bf8b9f1126e4d6b099ecf939f595d03d5d30c69dc05c637806ea0d4
SHA512

15f13bfa0be287fd2d62561ce0c97594504b98d489a51c4db2b1fcdba233ac462a16b2e2edb7f144b50563b6e2d25e3f991314d6858d4038da01a9d6f8683922
SSDEEP

49152:I9If342N0i9pbtiRQg0O5ItoeoHB25zJinnbi/DQfmOugHjwaKy:f4X2Bca/OCOhhkzMW/3OuxQ

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/bin/CameraDll.dll	aspack_v212_v242
static1/unpack001/bin/SnapShot.exe	aspack_v212_v242

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
ead791414bf8b9f1126e4d6b099ecf939f595d03d5d30c69dc05c637806ea0d4
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/bin/CameraDll.dll
unpack001/bin/SnapShot.exe
unpack001/bin/shdoclc.dll
unpack001/uninst.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

Files

ead791414bf8b9f1126e4d6b099ecf939f595d03d5d30c69dc05c637806ea0d4
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

295fc8c35dee88b924b0f6bafc807c6c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
GetTickCount
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

LoadCursorA
PtInRect
MapWindowPoints
GetDlgCtrlID
CloseClipboard
SetCursor
OpenClipboard
GetClientRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
DrawTextA
GetWindowLongA
DrawFocusRect
MessageBoxA
CallWindowProcA
PostMessageA
SetTimer
KillTimer
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClipboardData

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
114IE.exe
.exe windows:4 windows x86 arch:x86

8ba8b631f9affb854a14d5db4bcb98a3

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:24:a9:28:4d:72:20:ad:a9:c4:f3:a8:86:d0:c2:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

04-09-2009 00:00

Not After

04-09-2011 23:59

Subject

CN=xiamen chinasource internet service co.\,ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=xiamen chinasource internet service co.\,ltd.,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

31:bf:df:de:55:db:b5:41:14:ef:99:94:80:5d:3b:f5:2e:b1:a7:4c
Signer

Actual PE Digest

31:bf:df:de:55:db:b5:41:14:ef:99:94:80:5d:3b:f5:2e:b1:a7:4c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\TGApp\Tango4\release\tango3.pdb

Imports

psapi

GetMappedFileNameA
GetModuleFileNameExW
EnumProcessModules
EnumProcesses

wininet

FindFirstUrlCacheEntryExW
FindNextUrlCacheEntryExW
InternetCanonicalizeUrlW
FindCloseUrlCache
InternetSetOptionW
DeleteUrlCacheEntryW
InternetGetCookieW
GetUrlCacheEntryInfoW
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
InternetCrackUrlW

kernel32

VirtualProtect
VirtualAlloc
VirtualQuery
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
ExitProcess
ExitThread
RtlUnwind
RaiseException
HeapSize
SetStdHandle
GetFileType
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetOEMCP
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetCurrentDirectoryA
GetDriveTypeA
CreateFileA
SetEnvironmentVariableA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
TlsGetValue
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
GetProfileIntW
InterlockedDecrement
lstrlenA
lstrcmpA
LocalAlloc
GetShortPathNameW
GetFullPathNameW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetThreadLocale
GetModuleHandleA
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryA
lstrcmpW
GetVersionExA
GetSystemInfo
MoveFileExW
DeleteCriticalSection
InitializeCriticalSection
ResumeThread
lstrcmpiW
lstrcatW
WritePrivateProfileStringA
GetPrivateProfileStringA
MulDiv
FreeResource
lstrcpyW
DeleteAtom
GlobalAddAtomW
GetLocalTime
LocalFileTimeToFileTime
GetCurrentDirectoryW
GlobalReAlloc
LoadLibraryExW
WinExec
TerminateProcess
GetVersion
InterlockedIncrement
GetACP
SetProcessWorkingSetSize
Thread32Next
TerminateThread
OpenThread
Thread32First
ResetEvent
UnmapViewOfFile
GetLongPathNameW
GetSystemDefaultLCID
CompareStringW
GetWindowsDirectoryW
WriteFile
SetFilePointer
GetFileSize
GetFileAttributesW
GetModuleFileNameW
HeapFree
GetProcessHeap
HeapAlloc
ReadFile
CreateProcessW
GetStartupInfoW
CreatePipe
GetSystemDirectoryW
GetModuleFileNameA
ReadProcessMemory
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ExpandEnvironmentStringsW
LocalFree
FormatMessageW
GetCurrentProcess
GetVolumeInformationW
GetLogicalDrives
RemoveDirectoryW
CreateDirectoryW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
SetFileTime
SystemTimeToFileTime
CreateFileW
GlobalMemoryStatus
GetVersionExW
GetCurrentThread
SetThreadPriority
CreateEventW
CreateThread
WaitForSingleObject
CloseHandle
OpenProcess
lstrcpynW
WideCharToMultiByte
GlobalSize
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
CopyFileW
Sleep
Beep
GetModuleHandleW
MapViewOfFile
CreateFileMappingW
GetCurrentProcessId
GetSystemDefaultLangID
GetTickCount
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcAddress
LoadLibraryW
GetDriveTypeW
GetTempPathW
MoveFileW
SetFileAttributesW
FreeLibrary
GlobalFree
GetCurrentThreadId
GetLastError
SetEvent
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
lstrlenW
SetLastError
FindResourceW
LoadResource
LockResource
SizeofResource
WritePrivateProfileStringW
SetErrorMode
GlobalFlags
GetCommandLineA

user32

EnableMenuItem
CheckMenuItem
ShowWindow
IsDialogMessageW
SetDlgItemTextW
SetDlgItemInt
GetDlgItemInt
EndPaint
BeginPaint
GetWindowDC
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetFocus
GetWindowTextLengthW
GetLastActivePopup
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
MapWindowPoints
SetScrollPos
GetScrollPos
RegisterClassW
AdjustWindowRectEx
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
SystemParametersInfoA
GetWindowPlacement
CreateWindowExW
DestroyWindow
UnionRect
IsWindowEnabled
ChildWindowFromPoint
GetClassInfoW
DestroyCursor
CopyIcon
CreateIconIndirect
GetIconInfo
GetDlgItemTextA
SetDlgItemTextA
IntersectRect
RemovePropW
CallWindowProcW
GetPropW
GetDlgItem
SetPropW
SetWindowTextW
GetMessagePos
DrawFrameControl
wsprintfW
DestroyMenu
RegisterClassExW
DefWindowProcW
GetClassInfoExW
ModifyMenuW
DrawEdge
WindowFromPoint
GetCapture
RegisterClipboardFormatW
IsHungAppWindow
RedrawWindow
DrawAnimatedRects
EnumChildWindows
TrackPopupMenu
SetMenuItemInfoW
LoadMenuW
WaitForInputIdle
GetWindowTextW
GetClassNameW
SendMessageTimeoutW
GetSystemMenu
GetAsyncKeyState
GetDesktopWindow
GetWindow
SetWindowLongW
UnregisterClassA
GetMenuCheckMarkDimensions
CharUpperW
EndDialog
GetNextDlgTabItem
GetUpdateRect
AttachThreadInput
GetForegroundWindow
SetWindowPos
SetActiveWindow
SetForegroundWindow
IsRectEmpty
SetWindowRgn
GetMonitorInfoW
MonitorFromPoint
EqualRect
IsIconic
GetMenuState
IsWindow
UnregisterHotKey
RegisterHotKey
SetParent
LoadIconW
AllowSetForegroundWindow
FindWindowExW
FindWindowW
MessageBoxW
ExitWindowsEx
SetClipboardData
EmptyClipboard
DispatchMessageW
TranslateMessage
GetMessageW
IsChild
PeekMessageW
GetDoubleClickTime
GetWindowThreadProcessId
GetWindowLongW
EnumWindows
RegisterWindowMessageW
FillRect
SetRect
CreateCursor
SetMenuDefaultItem
GetCursor
GetMenuItemID
CreateDialogIndirectParamW
GetActiveWindow
GetDCEx
ValidateRect
PostQuitMessage
MapDialogRect
SetWindowContextHelpId
GetSubMenu
GetMenuItemCount
GetMenu
IsClipboardFormatAvailable
GetKeyState
MoveWindow
GetSysColor
GetCursorPos
DrawFocusRect
InvalidateRgn
CopyAcceleratorTableW
CharNextW
PostThreadMessageW
UnregisterClassW
GetSysColorBrush
GetNextDlgGroupItem
GetDialogBaseUnits
ScreenToClient
GetClientRect
InvalidateRect
MessageBeep
KillTimer
SetTimer
IsWindowVisible
ClientToScreen
TrackMouseEvent
GetDC
ReleaseDC
GetFocus
SendMessageW
EnableWindow
DrawTextW
PostMessageW
LoadImageW
DrawIconEx
DestroyIcon
GetWindowRect
SetRectEmpty
TabbedTextOutW
DrawTextExW
GrayStringW
PtInRect
CopyRect
OffsetRect
GetSystemMetrics
SystemParametersInfoW
UpdateWindow
OpenClipboard
GetClipboardData
CloseClipboard
CreatePopupMenu
AppendMenuW
LockWindowUpdate
GetParent
SetCursor
InflateRect
LoadBitmapW
ReleaseCapture
SetCapture
LoadCursorW
SetMenuItemBitmaps

gdi32

GetTextColor
GetRgnBox
CreatePolygonRgn
DPtoLP
PatBlt
SetRectRgn
ExtCreatePen
CreatePatternBrush
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetWindowExtEx
GetViewportExtEx
IntersectClipRect
ExcludeClipRect
SetMapMode
SetDIBColorTable
SelectObject
RestoreDC
SaveDC
GetDIBColorTable
StretchBlt
DeleteObject
CreateDIBSection
BitBlt
CreateCompatibleDC
GetBkColor
DeleteDC
CreateRoundRectRgn
SelectClipRgn
FillRgn
FrameRgn
SetTextJustification
SetBkColor
SetBkMode
GetTextMetricsW
SetTextColor
GetTextExtentPoint32W
GetDeviceCaps
ExtCreateRegion
OffsetRgn
SetROP2
Rectangle
SetPixel
CreateRectRgnIndirect
SetBitmapBits
CreateBitmap
CombineRgn
CreateRectRgn
GetDIBits
CreateDCW
LineTo
MoveToEx
CreateSolidBrush
GetCurrentObject
EnumFontsW
GetStockObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetMapMode
CreatePen
CreateFontIndirectW
CreateCompatibleBitmap
GetObjectW
GetClipBox

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

FreeSid
RegSetValueExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegSetValueW
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegQueryValueW
RegEnumValueW
RegDeleteKeyW
RegQueryValueExA
GetUserNameW
RegQueryInfoKeyW
RegSetKeySecurity
RegCreateKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAce
InitializeAcl
AllocateAndInitializeSid
RegGetKeySecurity
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
CopySid
GetLengthSid
GetTokenInformation
RegSetValueExA
RegCreateKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyW
RegEnumKeyW

shell32

Shell_NotifyIconW
SHGetSpecialFolderPathW
ExtractIconW
SHGetFileInfoW
ExtractIconExW
SHEmptyRecycleBinW
DragAcceptFiles
DragQueryFileW
DragFinish
SHBrowseForFolderW
SHAppBarMessage
ShellExecuteW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17
ImageList_GetImageCount
ImageList_GetIcon
ImageList_GetIconSize

shlwapi

SHGetValueW
SHDeleteKeyW
SHDeleteValueW
PathStripToRootW
PathIsUNCW
UrlUnescapeW
PathFindExtensionW
PathFindFileNameW

oledlg

OleUIBusyW

ole32

CoTaskMemAlloc
CoCreateInstance
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoUnmarshalInterface
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoTaskMemFree
StringFromCLSID
StringFromGUID2
CLSIDFromString
CoRegisterClassObject
CoRevokeClassObject
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CLSIDFromProgID
CoGetClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
StgOpenStorageOnILockBytes

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SysFreeString
VariantClear
SysAllocString
VariantInit
VarUdateFromDate
VarDateFromStr
OleLoadPicture
SysStringLen
SysStringByteLen
SysAllocStringLen
VariantChangeType
VariantCopy
SafeArrayDestroy
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect

ws2_32

socket
ioctlsocket
send
connect
recv
__WSAFDIsSet
select
WSAStartup
gethostname
gethostbyname
inet_ntoa
WSACleanup
closesocket
WSAGetLastError
WSAAsyncGetHostByName
WSACancelAsyncRequest
htons

gdiplus

GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipAlloc
GdipFree
GdipGetImagePixelFormat

imm32

ImmReleaseContext
ImmSetOpenStatus
ImmGetOpenStatus
ImmGetContext
ImmGetDefaultIMEWnd

iphlpapi

GetIfTable
GetAdaptersInfo

secur32

AcquireCredentialsHandleW
FreeContextBuffer
InitializeSecurityContextW
CompleteAuthToken
QuerySecurityPackageInfoW

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 376KB - Virtual size: 375KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bin/114Web.exe
.exe windows:4 windows x86 arch:x86

008f6da9918a06de9d6cfd7c228ef16d

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:24:a9:28:4d:72:20:ad:a9:c4:f3:a8:86:d0:c2:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

04-09-2009 00:00

Not After

04-09-2011 23:59

Subject

CN=xiamen chinasource internet service co.\,ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=xiamen chinasource internet service co.\,ltd.,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e4:b6:e0:3c:57:2b:5b:55:11:17:54:8d:0a:92:cc:e4:4d:c5:d7:b2
Signer

Actual PE Digest

e4:b6:e0:3c:57:2b:5b:55:11:17:54:8d:0a:92:cc:e4:4d:c5:d7:b2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\TGApp\TangoPage4\release\TangoWeb.pdb

Imports

kernel32

TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
WritePrivateProfileStringW
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
VirtualAlloc
HeapReAlloc
RtlUnwind
CreateThread
SetStdHandle
GetFileType
HeapSize
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetStartupInfoA
GetFileTime
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GetFileAttributesW
GlobalFlags
SuspendThread
ResumeThread
SetThreadPriority
GetCurrentThread
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
lstrlenA
lstrcmpA
CreateFileW
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
lstrcmpW
GetVersionExA
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
FormatMessageW
LocalFree
MulDiv
SetLastError
UnmapViewOfFile
GetTempPathW
DeleteFileW
GlobalFree
GlobalSize
CopyFileW
WaitForSingleObject
ResetEvent
CreateEventW
SetEvent
SetProcessWorkingSetSize
SetUnhandledExceptionFilter
RaiseException
GetModuleFileNameW
GetModuleHandleW
ExitThread
VirtualProtect
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
lstrcmpiW
ReadProcessMemory
GetCurrentThreadId
TerminateThread
OpenProcess
MapViewOfFile
OpenFileMappingW
Sleep
CreateProcessW
GetVersionExW
CreateDirectoryW
GetTickCount
FreeLibrary
FindClose
FindFirstFileW
WideCharToMultiByte
GetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
LoadLibraryExA
LoadLibraryW
LoadLibraryA
WriteProcessMemory
lstrcmpiA
GetCurrentProcessId
VirtualQuery
GetProcAddress
GetModuleHandleA
GetSystemInfo
Module32NextW
Module32FirstW
GetCurrentProcess
CreateToolhelp32Snapshot
CloseHandle
GetWindowsDirectoryW
ExitProcess
HeapDestroy
GetModuleFileNameA

user32

PostThreadMessageW
GetMessageW
TranslateMessage
ValidateRect
MapDialogRect
DestroyMenu
PostQuitMessage
CharUpperW
MoveWindow
SetWindowTextW
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
CheckMenuItem
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
GetWindowTextW
GetLastActivePopup
DispatchMessageW
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetDlgCtrlID
DefWindowProcW
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetMenuState
IntersectRect
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
IsChild
GetParent
CharLowerBuffW
CharUpperBuffW
GetDesktopWindow
GetWindowLongW
OffsetRect
ActivateKeyboardLayout
LoadKeyboardLayoutA
GetKeyboardLayoutNameA
CreatePopupMenu
MessageBoxW
RegisterClipboardFormatW
ScreenToClient
SetMenuItemInfoW
TrackPopupMenu
SetWindowLongW
GetMenuItemID
InsertMenuW
LoadMenuW
AppendMenuW
MessageBoxA
GetActiveWindow
UnregisterClassA
TabbedTextOutW
DrawTextW
DrawTextExW
CreateMenu
CallWindowProcW
GetSubMenu
GetMenuItemCount
EnableMenuItem
IsWindow
GetKeyState
CharNextW
ReleaseCapture
LoadCursorW
SetCursor
UpdateWindow
MessageBeep
GetSystemMetrics
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
GetNextDlgGroupItem
SystemParametersInfoW
SetCapture
UnregisterClassW
GetSysColorBrush
InvalidateRgn
IsRectEmpty
CopyAcceleratorTableW
GetMenu
GrayStringW
GetClientRect
PtInRect
PostMessageW
TrackMouseEvent
InvalidateRect
EnableWindow
GetClassNameW
RegisterWindowMessageW
SendMessageTimeoutW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetDC
PrintWindow
ReleaseDC
SetTimer
SendMessageW
KillTimer
FindWindowW
GetWindowThreadProcessId
LoadImageW
LoadIconW
SetRect
DestroyIcon
AllowSetForegroundWindow
GetForegroundWindow
AttachThreadInput
IsWindowEnabled
SetWindowPos
CopyRect
GetWindowRect
GetWindow
IsWindowVisible
EqualRect
SetFocus
SetActiveWindow
SetForegroundWindow
ShowWindow
InflateRect
GetCursorPos
SetWindowContextHelpId

gdi32

CreateBitmap
GetDeviceCaps
CreatePen
CreateRectRgnIndirect
GetRgnBox
GetBkColor
GetTextColor
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetWindowExtEx
GetClipBox
SetMapMode
SetTextColor
SetStretchBltMode
SetBkColor
RestoreDC
SaveDC
Ellipse
GetStockObject
GetBitmapBits
SetBrushOrgEx
GetCurrentObject
SetDIBColorTable
SelectObject
GetDIBColorTable
DeleteObject
CreateDIBSection
DeleteDC
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
CreateCompatibleBitmap
StretchBlt
GetViewportExtEx
GetObjectW
GetMapMode
CreateCompatibleDC

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

RegDeleteKeyW
RegQueryValueExW
RegCloseKey
RegEnumKeyW
RegQueryValueW
RegOpenKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteW
DragQueryFileW
DragFinish
SHGetSpecialFolderPathW

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW
StrStrIW
UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
StrRetToStrW

oledlg

OleUIBusyW

ole32

OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CreateStreamOnHGlobal
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoUninitialize
CoUnmarshalInterface
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CLSIDFromString
CoGetMarshalSizeMax
CoMarshalInterface
CoGetClassObject
CLSIDFromProgID
OleGetClipboard
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoDisconnectObject
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRegisterMessageFilter

oleaut32

SysFreeString
VarUI4FromStr
SysAllocStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VariantInit
VariantChangeType
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetUBound
VarBstrCmp
VariantCopy
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
LoadTypeLi

urlmon

CoInternetGetSession
RegisterBindStatusCallback
CoInternetSetFeatureEnabled

imagehlp

ImageDirectoryEntryToData

winmm

waveOutGetVolume

dsound

ord1

gdiplus

GdipCreateBitmapFromFile
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipFree
GdipAlloc
GdipDisposeImage
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdiplusShutdown
GdipSaveImageToFile

wininet

GetUrlCacheEntryInfoW
InternetSetOptionW
InternetCrackUrlW
InternetCanonicalizeUrlW

Sections

.text
Size: 448KB - Virtual size: 447KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 472KB - Virtual size: 468KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bin/Addr.dll
.dll windows:4 windows x86 arch:x86

92067e0ebb5e0a1e85e48a00a8f66f9d

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:24:a9:28:4d:72:20:ad:a9:c4:f3:a8:86:d0:c2:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

04-09-2009 00:00

Not After

04-09-2011 23:59

Subject

CN=xiamen chinasource internet service co.\,ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=xiamen chinasource internet service co.\,ltd.,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

45:28:e7:e7:67:5f:2b:7a:19:5b:6a:21:aa:8b:1c:58:a0:a8:71:d3
Signer

Actual PE Digest

45:28:e7:e7:67:5f:2b:7a:19:5b:6a:21:aa:8b:1c:58:a0:a8:71:d3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\vc研究\Addr\release\Addr.pdb

Imports

ws2_32

socket
recv
sendto
htons
htonl
closesocket
recvfrom
connect
gethostbyname
send
WSAStartup
WSACleanup
inet_addr

kernel32

TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
SetErrorMode
GlobalFlags
WritePrivateProfileStringW
InterlockedIncrement
GetFileAttributesW
GetFileTime
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteFileA
GetSystemTimeAsFileTime
GetCommandLineA
HeapAlloc
GetProcessHeap
LeaveCriticalSection
ExitProcess
RaiseException
HeapReAlloc
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
GetTimeFormatA
GetDateFormatA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
CreateFileA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetCurrentDirectoryA
GetDriveTypeA
SetEnvironmentVariableA
LocalAlloc
CreateFileW
GetFullPathNameW
GetVolumeInformationW
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
MoveFileW
FindFirstFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileW
FindClose
GetVersionExW
GetProfileIntW
FormatMessageW
LocalFree
MulDiv
GetModuleHandleA
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
GlobalUnlock
GlobalFree
FreeResource
InterlockedDecrement
lstrlenW
CloseHandle
GlobalAddAtomW
GetCurrentProcessId
GetCurrentThread
ConvertDefaultLocale
GetModuleFileNameW
GetVersion
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpW
GlobalAlloc
FreeLibrary
GlobalDeleteAtom
Sleep
GetTickCount
MultiByteToWideChar
SuspendThread
GetPrivateProfileIntA
GetCurrentThreadId
WritePrivateProfileStringA
GetPrivateProfileStringA
GetSystemWindowsDirectoryA
WinExec
LockResource
SizeofResource
WideCharToMultiByte
LoadResource
FindResourceW
CreateDirectoryA
CreateThread
GetProcAddress
SetLastError
GetLastError
SetThreadPriority
LoadLibraryW
GetModuleHandleW
InterlockedCompareExchange
RtlUnwind

user32

IsDialogMessageW
SetWindowTextW
MoveWindow
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
BeginPaint
EndPaint
GetDCEx
LoadCursorW
CharUpperW
UnregisterClassW
GetSysColorBrush
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
TrackPopupMenu
GetMenu
GetSubMenu
GetMenuItemID
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowPos
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
DestroyMenu
GetSystemMetrics
CreateDialogIndirectParamW
GetDlgItem
GetNextDlgTabItem
EndDialog
UnregisterClassA
CopyRect
IsWindow
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
GetActiveWindow
IsWindowVisible
ValidateRect
GetLastActivePopup
IsWindowEnabled
PostQuitMessage
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetMenuState
EnableMenuItem
CheckMenuItem
GetWindowLongW
GetParent
SetFocus
SetActiveWindow
KillTimer
SetWindowLongW
GetDesktopWindow
SetParent
PostMessageW
SetForegroundWindow
AttachThreadInput
GetForegroundWindow
GetWindowThreadProcessId
SetWindowTextA
SetDlgItemTextA
FillRect
DrawIconEx
GetClientRect
SetRectEmpty
GetDC
InflateRect
OffsetRect
SetRect
ReleaseDC
GetSysColor
UpdateWindow
DestroyIcon
SetCursor
SetCapture
GetKeyState
CreateCursor
GetCursorPos
GetMenuItemCount
GetCursor
SetMenuDefaultItem
ReleaseCapture
MessageBoxA
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
GetClassLongW
GetDlgItemTextA
SetTimer
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetWindowTextLengthW
DestroyWindow
GetWindowTextW
GetDlgItemTextW
SetDlgItemTextW
GetWindowRect
ShowWindow
ClientToScreen
ScreenToClient
MsgWaitForMultipleObjects
PtInRect
LoadIconW
InvalidateRect
AppendMenuW
PeekMessageW
CreatePopupMenu
MessageBoxW
SendMessageW
EnableWindow
DispatchMessageW
ModifyMenuW
UnhookWindowsHookEx

gdi32

PtVisible
RectVisible
TextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
SetTextColor
CreatePatternBrush
GetDeviceCaps
CreatePen
CreateSolidBrush
SetRectRgn
CombineRgn
DeleteObject
GetClipBox
ExtTextOutW
GetObjectW
PatBlt
CreateRectRgnIndirect
CreateBitmap
GetStockObject
CreateCompatibleDC
CreateRectRgn
SelectClipRgn
CreateCompatibleBitmap
SetMapMode
SetBkMode
RestoreDC
SaveDC
SetBkColor

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegQueryValueW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW

shell32

SHGetPathFromIDListA
ShellExecuteW
DragQueryFileA
ShellExecuteA
DragAcceptFiles
SHGetSpecialFolderLocation

comctl32

ImageList_GetIconSize

shlwapi

PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsDirectoryA
PathIsUNCW

oleaut32

VariantInit
VariantChangeType
VariantClear

Exports

Exports

CreateAddrBookWnd
CreateAddrTaskWnd
DeleteAddrBookWndPtr
DeleteTaskWndPtr
GetAddrFiles
GetPtr
ImportAddrBook
MDALogOut
MailConfig
MoveAddrBookWnd
MoveAddrTaskWnd
NewAddrBookWnd
NewAddrTaskWnd
OutportAddrBook
SMSChangePassword
SearchAddr
SendMailToMyself
SetAddrFiles
SetMainWndHWND
ShowLog
ShowSendMail
ShowSendMailDlg
ShowSendSMSDlg

Sections

.text
Size: 496KB - Virtual size: 495KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/CameraDll.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

??0CxFile@@QAE@ABV0@@Z
??0CxFile@@QAE@XZ
??0CxIOFile@@QAE@ABV0@@Z
??0CxIOFile@@QAE@PAU_iobuf@@@Z
??0CxImage@@QAE@ABV0@_N11@Z
??0CxImage@@QAE@K@Z
??0CxImage@@QAE@KKKK@Z
??0CxImage@@QAE@PAEKK@Z
??0CxImage@@QAE@PAU_iobuf@@K@Z
??0CxImage@@QAE@PAVCxFile@@K@Z
??0CxImage@@QAE@PBDK@Z
??0CxImageGIF@@QAE@ABV0@@Z
??0CxImageGIF@@QAE@XZ
??0CxImageJPG@@QAE@ABV0@@Z
??0CxImageJPG@@QAE@XZ
??0CxImagePNG@@QAE@ABV0@@Z
??0CxImagePNG@@QAE@XZ
??0CxMemFile@@QAE@ABV0@@Z
??0CxMemFile@@QAE@PAEK@Z
??1CxFile@@UAE@XZ
??1CxIOFile@@UAE@XZ
??1CxImage@@UAE@XZ
??1CxImageGIF@@UAE@XZ
??1CxImageJPG@@UAE@XZ
??1CxImagePNG@@UAE@XZ
??1CxMemFile@@UAE@XZ
??4CxFile@@QAEAAV0@ABV0@@Z
??4CxIOFile@@QAEAAV0@ABV0@@Z
??4CxImage@@QAEAAV0@ABV0@@Z
??4CxImageGIF@@QAEAAV0@ABV0@@Z
??4CxImageJPG@@QAEAAV0@ABV0@@Z
??4CxImagePNG@@QAEAAV0@ABV0@@Z
??4CxMemFile@@QAEAAV0@ABV0@@Z
??_7CxFile@@6B@
??_7CxIOFile@@6B@
??_7CxImage@@6B@
??_7CxImageGIF@@6B@
??_7CxImageJPG@@6B@
??_7CxImagePNG@@6B@
??_7CxMemFile@@6B@
??_C@_0L@BGJF@Read?5Error?$AA@
??_C@_0M@GIHK@Flush?5Error?$AA@
??_C@_0M@KPPG@Write?5Error?$AA@
??_FCxIOFile@@QAEXXZ
??_FCxImage@@QAEXXZ
??_FCxMemFile@@QAEXXZ
??_OCxImage@@QAEXABV0@@Z
?Alloc@CxMemFile@@IAEXK@Z
?AlphaClear@CxImage@@QAEXXZ
?AlphaCopy@CxImage@@QAE_NAAV1@@Z
?AlphaCreate@CxImage@@QAEXXZ
?AlphaDelete@CxImage@@QAEXXZ
?AlphaFlip@CxImage@@QAE_NXZ
?AlphaGet@CxImage@@QAEEJJ@Z
?AlphaGetMax@CxImage@@QBEEXZ
?AlphaInvert@CxImage@@QAEXXZ
?AlphaIsValid@CxImage@@QAE_NXZ
?AlphaMirror@CxImage@@QAE_NXZ
?AlphaPaletteClear@CxImage@@QAEXXZ
?AlphaPaletteEnable@CxImage@@QAEX_N@Z
?AlphaPaletteIsEnabled@CxImage@@QAE_NXZ
?AlphaPaletteIsValid@CxImage@@QAE_NXZ
?AlphaPaletteSplit@CxImage@@QAE_NPAV1@@Z
?AlphaSet@CxImage@@QAEXE@Z
?AlphaSet@CxImage@@QAEXJJE@Z
?AlphaSet@CxImage@@QAE_NAAV1@@Z
?AlphaSetMax@CxImage@@QAEXE@Z
?AlphaSplit@CxImage@@QAE_NPAV1@@Z
?AlphaStrip@CxImage@@QAEXXZ
?Bitfield2RGB@CxImage@@IAEXPAEGGGE@Z
?BlendPalette@CxImage@@QAEXKJ@Z
?Clear@CxImage@@QAEXE@Z
?Close@CxIOFile@@UAE_NXZ
?Close@CxMemFile@@UAE_NXZ
?CompareColors@CxImage@@KAHPBX0@Z
?Copy@CxImage@@QAEXABV1@_N11@Z
?CopyInfo@CxImage@@IAEXABV1@@Z
?CopyToHandle@CxImage@@QAEPAXXZ
?Create@CxImage@@QAEPAXKKKK@Z
?CreateFromARGB@CxImage@@QAE_NKKPAE@Z
?CreateFromHANDLE@CxImage@@QAE_NPAX@Z
?CreateFromHBITMAP@CxImage@@QAEXPAUHBITMAP__@@@Z
?CreateFromHICON@CxImage@@QAEXPAUHICON__@@@Z
?Crop@CxImage@@QAE_NABUtagRECT@@PAV1@@Z
?Crop@CxImage@@QAE_NJJJJPAV1@@Z
?Decode@CxImage@@QAE_NPAEKK@Z
?Decode@CxImage@@QAE_NPAU_iobuf@@K@Z
?Decode@CxImage@@QAE_NPAVCxFile@@K@Z
?Decode@CxImageGIF@@QAE_NPAU_iobuf@@@Z
?Decode@CxImageGIF@@QAE_NPAVCxFile@@@Z
?Decode@CxImageJPG@@QAE_NPAU_iobuf@@@Z
?Decode@CxImageJPG@@QAE_NPAVCxFile@@@Z
?Decode@CxImagePNG@@QAE_NPAU_iobuf@@@Z
?Decode@CxImagePNG@@QAE_NPAVCxFile@@@Z
?DecodeExif@CxImageJPG@@QAE_NPAU_iobuf@@@Z
?DecodeExif@CxImageJPG@@QAE_NPAVCxFile@@@Z
?DecodeExtension@CxImageGIF@@IAE_NPAVCxFile@@@Z
?DecreaseBpp@CxImage@@QAE_NK_NPAUtagRGBQUAD@@@Z
?Destroy@CxImage@@QAEXXZ
?Dither@CxImage@@QAE_NJ@Z
?Draw2@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@@Z
?Draw2@CxImage@@QAEJPAUHDC__@@JJJJ@Z
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@@Z
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@@Z
?DrawTextA@CxImage@@QAEJPAUHDC__@@JJPBDUtagRGBQUAD@@1JJEE@Z
?Enable@CxImage@@QAEX_N@Z
?Encode@CxImage@@QAE_NAAPAEAAJK@Z
?Encode@CxImage@@QAE_NPAU_iobuf@@K@Z
?Encode@CxImage@@QAE_NPAU_iobuf@@PAPAV1@HK@Z
?Encode@CxImage@@QAE_NPAVCxFile@@K@Z
?Encode@CxImage@@QAE_NPAVCxFile@@PAPAV1@HK@Z
?Encode@CxImageGIF@@QAE_NPAU_iobuf@@@Z
?Encode@CxImageGIF@@QAE_NPAU_iobuf@@PAPAVCxImage@@H_N@Z
?Encode@CxImageGIF@@QAE_NPAVCxFile@@@Z
?Encode@CxImageGIF@@QAE_NPAVCxFile@@PAPAVCxImage@@H_N@Z
?Encode@CxImageJPG@@QAE_NPAU_iobuf@@@Z
?Encode@CxImageJPG@@QAE_NPAVCxFile@@@Z
?Encode@CxImagePNG@@QAE_NPAU_iobuf@@@Z
?Encode@CxImagePNG@@QAE_NPAVCxFile@@@Z
?EncodeBody@CxImageGIF@@IAEXPAVCxFile@@_N@Z
?EncodeComment@CxImageGIF@@IAEXPAVCxFile@@@Z
?EncodeExtension@CxImageGIF@@IAEXPAVCxFile@@@Z
?EncodeHeader@CxImageGIF@@IAEXPAVCxFile@@@Z
?EncodeLoopExtension@CxImageGIF@@IAEXPAVCxFile@@@Z
?EncodeRGB@CxImageGIF@@IAE_NPAVCxFile@@@Z
?EncodeSafeCheck@CxImage@@IAE_NPAVCxFile@@@Z
?Eof@CxIOFile@@UAE_NXZ
?Eof@CxMemFile@@UAE_NXZ
?Error@CxIOFile@@UAEJXZ
?Error@CxMemFile@@UAEJXZ
?Flip@CxImage@@QAE_NXZ
?Flush@CxIOFile@@UAE_NXZ
?Flush@CxMemFile@@UAE_NXZ
?Free@CxMemFile@@IAEXXZ
?GetBits@CxImage@@QAEPAEXZ
?GetBpp@CxImage@@QBEGXZ
?GetBuffer@CxMemFile@@QAEPAEXZ
?GetC@CxIOFile@@UAEJXZ
?GetC@CxMemFile@@UAEJXZ
?GetColorType@CxImage@@QAEEXZ
?GetComment@CxImageGIF@@QAEXPAD@Z
?GetDIB@CxImage@@QBEPAXXZ
?GetDisposalMethod@CxImageGIF@@QAEJXZ
?GetEffWidth@CxImage@@QBEKXZ
?GetEncodeOption@CxImage@@QBEKXZ
?GetEscape@CxImage@@QBEJXZ
?GetFlags@CxImage@@QBEKXZ
?GetFrame@CxImage@@QBEJXZ
?GetFrameDelay@CxImage@@QBEKXZ
?GetHeight@CxImage@@QBEKXZ
?GetJpegQuality@CxImage@@QBEEXZ
?GetLastError@CxImage@@QAEPADXZ
?GetLoops@CxImageGIF@@QAEJXZ
?GetNearestIndex@CxImage@@QAEEUtagRGBQUAD@@@Z
?GetNumColors@CxImage@@QBEKXZ
?GetNumFrames@CxImage@@QBEJXZ
?GetNumLayers@CxImage@@QBEJXZ
?GetOffset@CxImage@@QAEXPAJ0@Z
?GetPalette@CxImage@@QBEPAUtagRGBQUAD@@XZ
?GetPaletteColor@CxImage@@QAE?AUtagRGBQUAD@@E@Z
?GetPaletteColor@CxImage@@QAE_NEPAE00@Z
?GetPaletteSize@CxImage@@QAEKXZ
?GetParent@CxImage@@QBEPAV1@XZ
?GetPixelColor@CxImage@@QAE?AUtagRGBQUAD@@JJ_N@Z
?GetPixelGray@CxImage@@QAEEJJ@Z
?GetPixelIndex@CxImage@@QAEEJJ@Z
?GetProgress@CxImage@@QBEJXZ
?GetSize@CxImage@@QAEJXZ
?GetTransColor@CxImage@@QAE?AUtagRGBQUAD@@XZ
?GetTransIndex@CxImage@@QBEJXZ
?GetType@CxImage@@QBEKXZ
?GetVersion@CxImage@@QAEPBDXZ
?GetWidth@CxImage@@QBEKXZ
?GetXDPI@CxImage@@QBEJXZ
?GetYDPI@CxImage@@QBEJXZ
?Ghost@CxImage@@IAEXPAV1@@Z
?GifMix@CxImageGIF@@IAEXAAVCxImage@@AAUtag_image@1@@Z
?GifNextPixel@CxImageGIF@@IAEHXZ
?GrayScale@CxImage@@QAE_NXZ
?IncreaseBpp@CxImage@@QAE_NK@Z
?IsEnabled@CxImage@@QBE_NXZ
?IsGrayScale@CxImage@@QAE_NXZ
?IsIndexed@CxImage@@QAE_NXZ
?IsInside@CxImage@@QAE_NJJ@Z
?IsTransparent@CxImage@@QBE_NXZ
?IsValid@CxImage@@QBE_NXZ
?Load@CxImage@@QAE_NPBDK@Z
?Load@CxImage@@QAE_NPBGK@Z
?LoadResource@CxImage@@QAE_NPAUHRSRC__@@KPAUHINSTANCE__@@@Z
?MakeBitmap@CxImage@@QAEPAUHBITMAP__@@PAUHDC__@@@Z
?Mirror@CxImage@@QAE_NXZ
?Negative@CxImage@@QAE_NXZ
?Open@CxIOFile@@QAE_NPBD0@Z
?Open@CxMemFile@@QAE_NXZ
?PutC@CxFile@@UAE_NE@Z
?PutC@CxIOFile@@UAE_NE@Z
?PutC@CxMemFile@@UAE_NE@Z
?Putword@CxImageGIF@@IAEXHPAVCxFile@@@Z
?RGBQUADtoRGB@CxImage@@QAEKUtagRGBQUAD@@@Z
?RGBtoBGR@CxImage@@IAEXPAEH@Z
?RGBtoRGBQUAD@CxImage@@QAE?AUtagRGBQUAD@@K@Z
?Read@CxIOFile@@UAEIPAXII@Z
?Read@CxMemFile@@UAEIPAXII@Z
?Resample@CxImage@@QAE_NJJHPAV1@@Z
?Rotate180@CxImage@@QAE_NPAV1@@Z
?Rotate@CxImage@@QAE_NMPAV1@@Z
?RotateLeft@CxImage@@QAE_NPAV1@@Z
?RotateRight@CxImage@@QAE_NPAV1@@Z
?Save@CxImage@@QAE_NPBDK@Z
?Save@CxImage@@QAE_NPBGK@Z
?Seek@CxIOFile@@UAE_NJH@Z
?Seek@CxMemFile@@UAE_NJH@Z
?SelectionAddColor@CxImage@@QAE_NUtagRGBQUAD@@@Z
?SelectionAddEllipse@CxImage@@QAE_NUtagRECT@@@Z
?SelectionAddPolygon@CxImage@@QAE_NPAUtagPOINT@@J@Z
?SelectionAddRect@CxImage@@QAE_NUtagRECT@@@Z
?SelectionClear@CxImage@@QAE_NXZ
?SelectionCopy@CxImage@@QAE_NAAV1@@Z
?SelectionCreate@CxImage@@QAE_NXZ
?SelectionDelete@CxImage@@QAE_NXZ
?SelectionGetBox@CxImage@@QAEXAAUtagRECT@@@Z
?SelectionInvert@CxImage@@QAE_NXZ
?SelectionIsInside@CxImage@@QAE_NJJ@Z
?SelectionIsValid@CxImage@@QAE_NXZ
?SelectionToHRGN@CxImage@@QAE_NAAPAUHRGN__@@@Z
?SetComment@CxImageGIF@@QAEXPBD@Z
?SetDisposalMethod@CxImageGIF@@QAEXH@Z
?SetEncodeOption@CxImage@@QAEXK@Z
?SetEscape@CxImage@@QAEXJ@Z
?SetFlags@CxImage@@QAEXK_N@Z
?SetFrame@CxImage@@QAEXJ@Z
?SetFrameDelay@CxImage@@QAEXK@Z
?SetGrayPalette@CxImage@@QAEXXZ
?SetJpegQuality@CxImage@@QAEXE@Z
?SetLoops@CxImageGIF@@QAEXH@Z
?SetOffset@CxImage@@QAEXJJ@Z
?SetPalette@CxImage@@QAEXKPAE00@Z
?SetPalette@CxImage@@QAEXPAUrgb_color@@K@Z
?SetPalette@CxImage@@QAEXPAUtagRGBQUAD@@K@Z
?SetPaletteColor@CxImage@@QAEXEEEEE@Z
?SetPaletteColor@CxImage@@QAEXEK@Z
?SetPaletteColor@CxImage@@QAEXEUtagRGBQUAD@@@Z
?SetPixelColor@CxImage@@QAEXJJK@Z
?SetPixelColor@CxImage@@QAEXJJUtagRGBQUAD@@_N@Z
?SetPixelIndex@CxImage@@QAEXJJE@Z
?SetProgress@CxImage@@QAEXJ@Z
?SetStdPalette@CxImage@@QAEXXZ
?SetTransColor@CxImage@@QAEXUtagRGBQUAD@@@Z
?SetTransIndex@CxImage@@QAEXJ@Z
?SetXDPI@CxImage@@QAEXJ@Z
?SetYDPI@CxImage@@QAEXJ@Z
?Size@CxIOFile@@UAEJXZ
?Size@CxMemFile@@UAEJXZ
?Skew@CxImage@@QAE_NMMJJ@Z
?Startup@CxImage@@IAEXK@Z
?Stretch@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@@Z
?Stretch@CxImage@@QAEJPAUHDC__@@JJJJ@Z
?SwapIndex@CxImage@@QAEXEE@Z
?Tell@CxIOFile@@UAEJXZ
?Tell@CxMemFile@@UAEJXZ
?Tile@CxImage@@QAEJPAUHDC__@@PAUtagRECT@@@Z
?Transfer@CxImage@@QAEXAAV1@@Z
?Write@CxIOFile@@UAEIPBXII@Z
?Write@CxMemFile@@UAEIPBXII@Z
?b3spline@CxImage@@IAEMM@Z
?char_out@CxImageGIF@@IAEXH@Z
?cl_hash@CxImageGIF@@IAEXJ@Z
?compressLZW@CxImageGIF@@IAEXHPAVCxFile@@@Z
?compressNONE@CxImageGIF@@IAEXHPAVCxFile@@@Z
?compressRLE@CxImageGIF@@IAEXHPAVCxFile@@@Z
?decoder@CxImageGIF@@IAEFPAVCxFile@@PAVCImageIterator@@FAAH@Z
?expand2to4bpp@CxImagePNG@@IAEXPAE@Z
?flush_char@CxImageGIF@@IAEXXZ
?get_byte@CxImageGIF@@IAEHPAVCxFile@@@Z
?get_next_code@CxImageGIF@@IAEFPAVCxFile@@@Z
?get_num_frames@CxImageGIF@@IAEHPAVCxFile@@PAUtag_TabCol@1@PAUtag_dscgif@1@@Z
?ima_png_error@CxImagePNG@@IAEXPAUpng_struct_def@@PAD@Z
?init_exp@CxImageGIF@@IAEFF@Z
?out_line@CxImageGIF@@IAEHPAVCImageIterator@@PAEH@Z
?output@CxImageGIF@@IAEXF@Z
?rle_block_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z
?rle_block_out@CxImageGIF@@IAEXEPAUtag_RLE@1@@Z
?rle_clear@CxImageGIF@@IAEXPAUtag_RLE@1@@Z
?rle_compute_triangle_count@CxImageGIF@@IAEIII@Z
?rle_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z
?rle_flush_clearorrep@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z
?rle_flush_fromclear@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z
?rle_flush_withtable@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z
?rle_isqrt@CxImageGIF@@IAEII@Z
?rle_output@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z
?rle_output_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z
?rle_output_plain@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z
?rle_reset_out_clear@CxImageGIF@@IAEXPAUtag_RLE@1@@Z
?rle_write_block@CxImageGIF@@IAEXPAUtag_RLE@1@@Z
?seek_next_image@CxImageGIF@@IAEJPAVCxFile@@J@Z
?user_error_fn@CxImagePNG@@KAXPAUpng_struct_def@@PBD@Z
?user_flush_data@CxImagePNG@@KAXPAUpng_struct_def@@@Z
?user_read_data@CxImagePNG@@KAXPAUpng_struct_def@@PAEI@Z
?user_write_data@CxImagePNG@@KAXPAUpng_struct_def@@PAEI@Z
CameraSubArea
CameraWindow
CameraWindowLikeSpy

Sections

.text
Size: 143KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MYSHARE
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bin/SnapShot.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 9KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 22KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bin/TGHistory.dll
.dll regsvr32 windows:4 windows x86 arch:x86

4cfc4003dbe546235bf9847add8e3ece

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17-11-2006 00:00

Not After

30-12-2020 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

28:1e:27:b2:e5:c0:bd:28:82:25:8a:67:21:08:5a:15
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

19-11-2010 00:00

Not After

19-11-2011 23:59

Subject

CN=Beijing Tangguo Network Technique Co.\,Ltd.,OU=Software Department,O=Beijing Tangguo Network Technique Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

00:c3:62:e9:63:f4:76:93:6b:ca:25:32:44:e4:21:4d:d9:83:7c:f7
Signer

Actual PE Digest

00:c3:62:e9:63:f4:76:93:6b:ca:25:32:44:e4:21:4d:d9:83:7c:f7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\TGApp\TGHistory\release\TGHistory.pdb

Imports

kernel32

GetFileTime
WritePrivateProfileStringW
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetCommandLineA
GetProcessHeap
HeapReAlloc
RtlUnwind
RaiseException
ExitProcess
HeapSize
SetStdHandle
GetFileType
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
Sleep
HeapDestroy
GetFileAttributesW
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GlobalFlags
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
InterlockedIncrement
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
InterlockedExchange
GetFullPathNameW
GetVolumeInformationW
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
LocalAlloc
GetModuleHandleA
GetProfileIntW
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
FreeLibrary
InterlockedDecrement
GetCurrentProcessId
GetModuleFileNameW
GlobalFree
FormatMessageW
LocalFree
lstrlenW
FindNextFileW
GlobalUnlock
GlobalLock
GlobalAlloc
FindClose
FindFirstFileW
GetCurrentThread
SetThreadPriority
CreateEventW
CreateThread
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetEvent
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetLastError
SetLastError
MultiByteToWideChar
FileTimeToLocalFileTime
FileTimeToSystemTime
CloseHandle
MapViewOfFile
CreateFileMappingW
CreateFileW
ExpandEnvironmentStringsW
FindResourceW
LoadResource
LockResource
SizeofResource
HeapCreate
WideCharToMultiByte

user32

DrawTextExW
DrawTextW
TabbedTextOutW
GetDCEx
ShowWindow
MoveWindow
SetWindowTextW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
CheckMenuItem
DestroyMenu
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextW
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
TrackPopupMenu
SetForegroundWindow
IsWindowVisible
GetMenu
PostMessageW
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
SetWindowPos
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
UnhookWindowsHookEx
IsWindow
GetWindowThreadProcessId
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
MessageBoxW
GetMenuState
GetMenuItemID
GetSubMenu
GetWindowRect
GetFocus
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetSysColorBrush
UnregisterClassW
GetActiveWindow
ValidateRect
LoadCursorW
DispatchMessageW
PostQuitMessage
CharUpperW
EndPaint
BeginPaint
GrayStringW
TranslateMessage
GetMessageW
CopyRect
EnableMenuItem
LoadImageW
GetSysColor
UpdateWindow
DestroyIcon
OffsetRect
DrawIconEx
FillRect
SetRect
ReleaseDC
SetRectEmpty
GetDC
InflateRect
InvalidateRect
PtInRect
GetClientRect
EnableWindow
ClientToScreen
CreateCursor
SendMessageW
GetMenuItemCount
SetMenuDefaultItem
AppendMenuW
CreatePopupMenu
GetKeyState
ScreenToClient
GetCursorPos
ReleaseCapture
SetCursor
SetCapture
GetCursor
GetClassInfoW
UnregisterClassA

gdi32

OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
SetViewportOrgEx
CreateSolidBrush
SetRectRgn
CombineRgn
MoveToEx
LineTo
SelectObject
Escape
TextOutW
RectVisible
PtVisible
CreateRectRgn
SelectClipRgn
CreateCompatibleDC
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreatePatternBrush
DeleteObject
CreatePen
CreateBitmap
ExtTextOutW
SetBkColor
SetTextColor
GetClipBox
PatBlt
CreateRectRgnIndirect
GetDeviceCaps
CreateCompatibleBitmap

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

RegEnumKeyW
RegSetValueExW
RegQueryValueW
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyExW
RegOpenKeyW
RegCloseKey
RegQueryValueExW

shell32

ExtractIconExW
ShellExecuteExW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetMalloc
SHGetFileInfoW
SHGetSpecialFolderPathW

comctl32

ImageList_GetIconSize

shlwapi

UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
StrRetToStrW
PathFindFileNameW

ole32

CoInitialize
CoUninitialize
StringFromGUID2

oleaut32

VariantClear
VariantChangeType
VariantInit
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi

wininet

DeleteUrlCacheEntryW
GetUrlCacheEntryInfoW
FindFirstUrlCacheEntryExW
FindNextUrlCacheEntryExW
FindCloseUrlCache
InternetCrackUrlW
InternetCanonicalizeUrlW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TGHistoryCreate
TGHistoryCreateWnd
TGHistoryDelete
TGHistoryDllTest
TGHistoryGetMaxHits
TGHistoryKillThread
TGHistoryMoveWindow
TGHistoryPreTranslateMsg
TGHistorySearchKeywordChange
TGHistorySetAppName
TGHistorySetCallBack
TGHistorySetFillType
TGHistorySetIconDir
TGHistorySetLineColor

Sections

.text
Size: 260KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/TGMail.dll
.dll windows:5 windows x86 arch:x86

ebfcd97d25c02abbcd30845dd81787ad

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:24:a9:28:4d:72:20:ad:a9:c4:f3:a8:86:d0:c2:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

04-09-2009 00:00

Not After

04-09-2011 23:59

Subject

CN=xiamen chinasource internet service co.\,ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=xiamen chinasource internet service co.\,ltd.,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4c:20:66:1c:6a:6a:96:30:a3:b2:26:97:f1:6e:b4:07:74:4b:a0:53
Signer

Actual PE Digest

4c:20:66:1c:6a:6a:96:30:a3:b2:26:97:f1:6e:b4:07:74:4b:a0:53

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\TGMail\Release\TGMail.pdb

Imports

kernel32

VirtualProtect
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

ole32

CoCreateInstance

msvcr90

__clean_type_info_names_internal
_unlock
_crt_debugger_hook
_lock
_onexit
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
__dllonexit

Exports

Exports

SetMail

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 366B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/TGNetWork.dll
.dll windows:4 windows x86 arch:x86

40095c1612fe96c686d5db66d20cf510

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:24:a9:28:4d:72:20:ad:a9:c4:f3:a8:86:d0:c2:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

04-09-2009 00:00

Not After

04-09-2011 23:59

Subject

CN=xiamen chinasource internet service co.\,ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=xiamen chinasource internet service co.\,ltd.,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9c:ca:c3:82:c6:a6:56:50:e5:3e:c0:73:9c:b0:bc:85:37:9d:d9:cd
Signer

Actual PE Digest

9c:ca:c3:82:c6:a6:56:50:e5:3e:c0:73:9c:b0:bc:85:37:9d:d9:cd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\TGApp\TGNetWork\release\TGNetWork.pdb

Imports

kernel32

DeleteCriticalSection
TlsFree
SetErrorMode
GlobalFlags
InterlockedIncrement
GetFileAttributesW
WritePrivateProfileStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
GetCommandLineA
GetProcessHeap
RtlUnwind
RaiseException
HeapReAlloc
VirtualAlloc
HeapSize
VirtualFree
HeapDestroy
HeapCreate
LocalReAlloc
GetCPInfo
GetACP
GetOEMCP
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
SetStdHandle
GetCurrentDirectoryA
GetDriveTypeA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
GetCurrentThread
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
InterlockedExchange
GetFullPathNameW
GetVolumeInformationW
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
GetThreadLocale
DeleteFileW
MoveFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileW
GlobalFree
FormatMessageW
LocalFree
MulDiv
GetModuleHandleA
GetProfileIntW
FreeResource
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
FreeLibrary
InterlockedDecrement
GetModuleFileNameW
lstrlenW
ExitProcess
GetTickCount
GetPrivateProfileStringA
GetSystemWindowsDirectoryA
CreateDirectoryA
GetLongPathNameW
WaitForSingleObject
GetModuleFileNameA
GetVersionExW
CreateThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileTime
Sleep
SetFileTime
WriteFile
ExitThread
SetThreadPriority
WinExec
ResumeThread
SuspendThread
CloseHandle
FindClose
CreateFileW
WideCharToMultiByte
FindFirstFileW
GetFileSize
GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentThreadId
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetLastError
GetStdHandle
SetLastError

user32

GetSysColorBrush
GetMessageW
LoadCursorW
GetDCEx
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
DestroyMenu
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetLastActivePopup
DispatchMessageW
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
UnregisterClassW
PeekMessageW
MapWindowPoints
TrackPopupMenu
IsWindowVisible
GetMenu
GetSubMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetParent
EqualRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetWindowLongW
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
GetWindow
UnhookWindowsHookEx
CopyRect
IsWindow
GetAsyncKeyState
GetActiveWindow
SetWindowPos
FindWindowW
MessageBoxA
LoadIconW
MessageBoxW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
KillTimer
SetActiveWindow
GetDlgItemTextA
PostMessageW
TranslateMessage
ValidateRect
PostQuitMessage
CharUpperW
GetDesktopWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
EndPaint
SetForegroundWindow
AttachThreadInput
BeginPaint
GrayStringW
DrawTextExW
DrawTextW
GetMessagePos
TabbedTextOutW
GetWindowThreadProcessId
GetForegroundWindow
SetTimer
SetWindowLongW
GetWindowRect
GetSysColor
UpdateWindow
DestroyIcon
OffsetRect
DrawIconEx
FillRect
SetRect
ReleaseDC
SetRectEmpty
GetDC
InflateRect
InvalidateRect
PtInRect
GetClientRect
EnableWindow
ClientToScreen
CreateCursor
SendMessageW
GetMenuItemCount
SetMenuDefaultItem
AppendMenuW
CreatePopupMenu
GetKeyState
ScreenToClient
GetCursorPos
ReleaseCapture
SetCursor
SetCapture
GetCursor
GetMenuItemID
UnregisterClassA

gdi32

SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
GetDeviceCaps
CreateSolidBrush
SetRectRgn
CombineRgn
SelectClipRgn
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutW
RectVisible
PtVisible
CreateCompatibleDC
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreatePatternBrush
DeleteObject
CreatePen
CreateBitmap
ExtTextOutW
GetObjectW
SetBkColor
SetTextColor
GetClipBox
PatBlt
CreateRectRgnIndirect
CreateCompatibleBitmap
CreateRectRgn

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegEnumKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
GetUserNameA
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
RegCloseKey

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
DragAcceptFiles
DragQueryFileA
DragQueryFileW
ShellExecuteA
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteW

comctl32

ImageList_GetIconSize

shlwapi

PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathIsDirectoryA
PathFindFileNameW

ole32

CoUninitialize
CoInitialize

oleaut32

VariantClear
VariantChangeType
VariantInit

ws2_32

recvfrom
sendto
WSACleanup
ioctlsocket
inet_ntoa
gethostbyname
gethostname
accept
__WSAFDIsSet
select
recv
htonl
WSAStartup
socket
htons
bind
listen
closesocket
WSAAsyncSelect
setsockopt
inet_addr
connect
send

netapi32

NetApiBufferFree
NetWkstaGetInfo

Exports

Exports

TGNetWordDllSetMainHWND
TGNetWorkDllAddFileToUserWnd
TGNetWorkDllAdvanceSend
TGNetWorkDllCreateTaskTreeWnd
TGNetWorkDllCreateUserTreeWnd
TGNetWorkDllDeleteTask
TGNetWorkDllDeleteTaskTreeWnd
TGNetWorkDllDeleteUserTreeWnd
TGNetWorkDllGetIpPort
TGNetWorkDllGetPtr
TGNetWorkDllGetTransRate
TGNetWorkDllIsTaskFinish
TGNetWorkDllMoveTaskWindow
TGNetWorkDllMoveUserWindow
TGNetWorkDllMoveWindow
TGNetWorkDllNewTaskTreeWnd
TGNetWorkDllNewUserTreeWnd
TGNetWorkDllRefreshUser
TGNetWorkDllSearchUser
TGNetWorkDllSendExitMessage
TGNetWorkDllSetLogFile
TGNetWorkDllSetSoftName
TGNetWorkDllShowLog
TGNetWorkDllShowSendDlg
TGNetWorkDllStopTask
TGNetWorkDllTest

Sections

.text
Size: 288KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/TGRes.dll
.dll .js windows:4 windows x86 arch:x86 polyglot

7c89263619d2d7957f0c8ac998f4d14c

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:24:a9:28:4d:72:20:ad:a9:c4:f3:a8:86:d0:c2:e1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

04-09-2009 00:00

Not After

04-09-2011 23:59

Subject

CN=xiamen chinasource internet service co.\,ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=xiamen chinasource internet service co.\,ltd.,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

12:dc:86:f8:f6:3c:26:cd:96:a2:9a:45:d3:a0:7e:b8:85:d6:27:f3
Signer

Actual PE Digest

12:dc:86:f8:f6:3c:26:cd:96:a2:9a:45:d3:a0:7e:b8:85:d6:27:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\TGAPP\TGRes(114)\release\TGRes.pdb

Imports

msvcr80

_lock
__dllonexit
_except_handler4_common
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
free
_encoded_null
_malloc_crt
_onexit
_encode_pointer

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/flvplayer.swf
bin/shdoclc.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 485KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
custom.ini
image/0.png
.png
image/1.png
.png
image/2.png
.png
image/3.png
.png
image/360warn.gif
.gif
image/4.png
.png
image/5.png
.png
image/abchina.ico
image/addfav.ico
image/bankcomm.ico
image/boc.ico
image/booko.ico
image/ccb.ico
image/cebbank.ico
image/cib.ico
image/cmbc.ico
image/cmbchina.ico
image/default.ico
image/folder.ico
image/gdb.ico
image/hxb.ico
image/icbc.ico
image/jiasu1.gif
.gif
image/openfolder.ico
image/plugapp.ico
image/psbc.ico
image/refresh.ico
image/safe.ico
image/saveform.png
.png
image/sdb.ico
image/search.png
.png
image/spdb.ico
image/uncheck.ico
image/unknow.ico
initsearcheng.txt
inittgfilter.txt
inittoolbarurls.txt
initwebguide.txt
plugin.txt
plugin5/IE/tgplug.png
.png
plugin5/С/tgplug.ini
plugin5/С/tgplug.png
.png
plugin5/վ/tgplug.ini
plugin5/վ/tgplug.png
.png
plugin5//tgplug.ini
plugin5//tgplug.png
.png
plugin5//tgplug.ini
plugin5//tgplug.png
.png
plugin5//tgplug.png
.png
plugin5/ͼ/tgplug.ini
plugin5/ͼ/tgplug.png
.png
plugin5//tgplug.ini
plugin5//tgplug.png
.png
plugin5/ⲿ/tgplug.ini
plugin5/ⲿ/tgplug.png
.png
plugin5/ҳ/tgplug.ini
plugin5/ҳ/tgplug.png
.png
plugin5/ַ/tgplug.png
.png
plugin5//tgplug.ini
plugin5//tgplug.png
.png
skin/IE6Skin.zip
.zip
-1.png
.png
0.PNG
.png
1.png
.png
2.png
.png
3.PNG
.png
4.PNG
.png
5.PNG
.png
BtnAdvanced.bmp
BtnBrowser.bmp
BtnCloseApp.bmp
BtnEditDrop.bmp
BtnEditLeft.bmp
BtnFav.bmp
BtnForwardDrop.bmp
BtnGo.bmp
BtnMinMaxApp.bmp
BtnPageLabel.bmp
BtnSafe.bmp
BtnSearchEng.bmp
BtnSearchLane.bmp
BtnSideWnd.bmp
BtnSingleSearch.bmp
EditBottom.bmp
EditIcon.bmp
EditTop.bmp
Main_N.bmp
PageCloseIcon.bmp
PageLabelBtn.bmp
PageLabelCross.bmp
PageLabelTop.bmp
PageLabelTopCur.bmp
PageWaitIcon.bmp
SkinDemo.gif
.gif
SlideProgress_H.bmp
SlideProgress_N.bmp
ad_hunter.ico
alexa.ico
alexa.png
.png
book.ico
booko.ico
catchhtml.ico
clean.ico
close.ico
closed.ico
copy.ico
cut.ico
danger.ico
dead.ico
default.ico
download.ico
download.png
.png
dsearch.ico
encoding.ico
engset.ico
error.ico
exsearch.ico
extendtool.ico
favorites.ico
favorites.png
.png
fillform.ico
filter.ico
filterad.ico
filterad2.ico
find.ico
find_next.ico
find_prior.ico
findbar.ico
folder.ico
font_size.ico
highlight.ico
history.ico
history.png
.png
home.ico
ie.ico
ie.png
.png
localfile.ico
lock.ico
more.ico
msgpop.ico
network.ico
network.png
.png
newpage.ico
nocheck.ico
nocheck.png
.png
noflash.ico
noflash2.ico
nofloat.ico
nofloat2.ico
nofloat2.png
.png
nopic.ico
nopic.png
.png
nopic2.ico
nopic2.png
.png
nopop.ico
nopop.png
.png
nopop2.ico
nopop2.png
.png
ok.ico
openfolder.ico
openlink.ico
openlink.png
.png
openlink2.ico
openlink2.png
.png
page_world.ico
page_zoom.ico
pagefind.ico
paste.ico
print.ico
private.ico
private.png
.png
private2.ico
private2.png
.png
qiantai.ico
qiantai.png
.png
qiantai2.ico
qiantai2.png
.png
refresh.ico
safe.ico
safe.png
.png
safecheck.ico
save.ico
search.ico
shot.ico
skin.ico
skin.ini
split_screen.ico
split_screen.png
.png
statistics.ico
stop.ico
tango.ico
tgsoso.ico
toolbar.ico
uncheck.ico
user.ico
user.png
.png
valume_no.ico
valume_no.png
.png
valume_yes.ico
valume_yes.png
.png
youpeng.ico
youpeng.png
.png
zoom.ico
zoom.png
.png
skin/PearBlack.zip
.zip
-1.png
.png
0.PNG
.png
1.png
.png
2.png
.png
3.PNG
.png
4.PNG
.png
5.PNG
.png
BtnAdvanced.bmp
BtnBrowser.bmp
BtnCloseApp.bmp
BtnEditDrop.bmp
BtnEditLeft.bmp
BtnFav.bmp
BtnForwardDrop.bmp
BtnGo.bmp
BtnMinMaxApp.bmp
BtnPageLabel.bmp
BtnSafe.bmp
BtnSearchEng.bmp
BtnSearchLane.bmp
BtnSideWnd.bmp
BtnSingleSearch.bmp
EditBottom.bmp
EditIcon.bmp
EditTop.bmp
Main_N.bmp
PageCloseIcon.bmp
PageLabelBtn.bmp
PageLabelCross.bmp
PageLabelTop.bmp
PageLabelTopCur.bmp
PageWaitIcon.bmp
SkinDemo.gif
.gif
SlideProgress_H.bmp
SlideProgress_N.bmp
ad_hunter.ico
alexa.ico
alexa.png
.png
book.ico
booko.ico
catchhtml.ico
clean.ico
close.ico
closed.ico
copy.ico
cut.ico
danger.ico
dead.ico
default.ico
download.ico
download.png
.png
dsearch.ico
encoding.ico
engset.ico
error.ico
exsearch.ico
extendtool.ico
favorites.ico
favorites.png
.png
fillform.ico
filter.ico
filterad.ico
filterad2.ico
find.ico
find_next.ico
find_prior.ico
findbar.ico
folder.ico
font_size.ico
highlight.ico
history.ico
history.png
.png
home.ico
ie.ico
ie.png
.png
localfile.ico
lock.ico
more.ico
msgpop.ico
network.ico
network.png
.png
newpage.ico
nocheck.ico
nocheck.png
.png
noflash.ico
noflash2.ico
nofloat.ico
nofloat2.ico
nofloat2.png
.png
nopic.ico
nopic.png
.png
nopic2.ico
nopic2.png
.png
nopop.ico
nopop.png
.png
nopop2.ico
nopop2.png
.png
ok.ico
openfolder.ico
openlink.ico
openlink.png
.png
openlink2.ico
openlink2.png
.png
page_world.ico
page_zoom.ico
pagefind.ico
paste.ico
print.ico
private.ico
private.png
.png
private2.ico
private2.png
.png
qiantai.ico
qiantai.png
.png
qiantai2.ico
qiantai2.png
.png
refresh.ico
safe.ico
safe.png
.png
safecheck.ico
save.ico
search.ico
shot.ico
skin.ico
skin.ini
split_screen.ico
split_screen.png
.png
statistics.ico
stop.ico
tango.ico
tgsoso.ico
toolbar.ico
uncheck.ico
user.ico
user.png
.png
valume_no.ico
valume_no.png
.png
valume_yes.ico
valume_yes.png
.png
youpeng.ico
youpeng.png
.png
zoom.ico
zoom.png
.png
skin/Violet.zip
.zip
-1.png
.png
0.PNG
.png
1.png
.png
2.png
.png
3.PNG
.png
4.PNG
.png
5.PNG
.png
BtnAdvanced.bmp
BtnBrowser.bmp
BtnCloseApp.bmp
BtnEditDrop.bmp
BtnEditLeft.bmp
BtnFav.bmp
BtnForwardDrop.bmp
BtnGo.bmp
BtnMinMaxApp.bmp
BtnPageLabel.bmp
BtnSafe.bmp
BtnSearchEng.bmp
BtnSearchLane.bmp
BtnSideWnd.bmp
BtnSingleSearch.bmp
EditBottom.bmp
EditIcon.bmp
EditTop.bmp
Main_N.bmp
PageCloseIcon.bmp
PageLabelBtn.bmp
PageLabelCross.bmp
PageLabelTop.bmp
PageLabelTopCur.bmp
PageWaitIcon.bmp
SkinDemo.gif
.gif
SlideProgress_H.bmp
SlideProgress_N.bmp
ad_hunter.ico
alexa.ico
alexa.png
.png
book.ico
booko.ico
catchhtml.ico
clean.ico
close.ico
closed.ico
copy.ico
cut.ico
danger.ico
dead.ico
default.ico
download.ico
download.png
.png
dsearch.ico
encoding.ico
engset.ico
error.ico
exsearch.ico
extendtool.ico
favorites.ico
favorites.png
.png
fillform.ico
filter.ico
filterad.ico
filterad2.ico
find.ico
find_next.ico
find_prior.ico
findbar.ico
folder.ico
font_size.ico
highlight.ico
history.ico
history.png
.png
home.ico
ie.ico
ie.png
.png
localfile.ico
lock.ico
more.ico
msgpop.ico
network.ico
network.png
.png
newpage.ico
nocheck.ico
nocheck.png
.png
noflash.ico
noflash2.ico
nofloat.ico
nofloat2.ico
nofloat2.png
.png
nopic.ico
nopic.png
.png
nopic2.ico
nopic2.png
.png
nopop.ico
nopop.png
.png
nopop2.ico
nopop2.png
.png
ok.ico
openfolder.ico
openlink.ico
openlink.png
.png
openlink2.ico
openlink2.png
.png
page_world.ico
page_zoom.ico
pagefind.ico
paste.ico
print.ico
private.ico
private.png
.png
private2.ico
private2.png
.png
qiantai.ico
qiantai.png
.png
qiantai2.ico
qiantai2.png
.png
refresh.ico
safe.ico
safe.png
.png
safecheck.ico
save.ico
search.ico
shot.ico
skin.ico
skin.ini
split_screen.ico
split_screen.png
.png
statistics.ico
stop.ico
tango.ico
tgsoso.ico
toolbar.ico
uncheck.ico
user.ico
user.png
.png
valume_no.ico
valume_no.png
.png
valume_yes.ico
valume_yes.png
.png
youpeng.ico
youpeng.png
.png
zoom.ico
zoom.png
.png
uninst.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
webicon/baidu.ico
webicon/biying.ico
webicon/google.ico
webicon/sogou.ico
webicon/soso.ico
webicon/www.114.com.cn_favicon.ico
webicon/www.114.org_favicon.ico
webicon/www.360buy.com_favicon.ico
webicon/www.amazon.cn_favicon.ico
webicon/www.baidu.com_favicon.ico
webicon/www.taobao.com_favicon.ico
webicon/www.tmall.com_favicon.ico
webicon/yahoo.ico
webicon/youdao.ico

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 29KB - Virtual size: 28KB

295fc8c35dee88b924b0f6bafc807c6c

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

8ba8b631f9affb854a14d5db4bcb98a3

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5e:24:a9:28:4d:72:20:ad:a9:c4:f3:a8:86:d0:c2:e1Certificate

Extended Key Usages

Key Usages

31:bf:df:de:55:db:b5:41:14:ef:99:94:80:5d:3b:f5:2e:b1:a7:4cSigner

Headers

File Characteristics

PDB Paths

Imports

psapi

wininet

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

gdiplus

imm32

iphlpapi

secur32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 376KB - Virtual size: 375KB

.data Size: 24KB - Virtual size: 49KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 29KB - Virtual size: 28KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5e:24:a9:28:4d:72:20:ad:a9:c4:f3:a8:86:d0:c2:e1
Certificate

31:bf:df:de:55:db:b5:41:14:ef:99:94:80:5d:3b:f5:2e:b1:a7:4c
Signer

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 376KB - Virtual size: 375KB

.data
Size: 24KB - Virtual size: 49KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5e:24:a9:28:4d:72:20:ad:a9:c4:f3:a8:86:d0:c2:e1
Certificate

e4:b6:e0:3c:57:2b:5b:55:11:17:54:8d:0a:92:cc:e4:4d:c5:d7:b2
Signer

.text
Size: 448KB - Virtual size: 447KB

.rdata
Size: 120KB - Virtual size: 118KB

.data
Size: 20KB - Virtual size: 33KB

.rsrc
Size: 472KB - Virtual size: 468KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5e:24:a9:28:4d:72:20:ad:a9:c4:f3:a8:86:d0:c2:e1
Certificate

45:28:e7:e7:67:5f:2b:7a:19:5b:6a:21:aa:8b:1c:58:a0:a8:71:d3
Signer

.text
Size: 496KB - Virtual size: 495KB

.rdata
Size: 88KB - Virtual size: 86KB

.data
Size: 16KB - Virtual size: 29KB

.rsrc
Size: 24KB - Virtual size: 23KB