8379c28556ccbaf63a00ec134eaffee9_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

8379c28556ccbaf63a00ec134eaffee9_JaffaCakes118
Size

9.4MB
MD5

8379c28556ccbaf63a00ec134eaffee9
SHA1

b0e74cf13ac36b1d487064d8f7ee09c58e337a1a
SHA256

5c4d8b86d7a87afd63480fff2541c51fd089f4d43905364f2f653095ca024594
SHA512

f0beb3422f964b7c0c93619f1ef85b32bf96006ad27e4c370d45d8ab8316cafc343ec731eaa0f9dfb08f4d6560ebc069aaaddeb861aac9ae4fb64dbcc571a7e4
SSDEEP

196608:Swo0GPAKVzuay3N6DP8qnKianbDGATwPsfaIrcCCnitFXEWmdAd:SwLGPAyS3N6r8qnKZlIb2iAd

Score

3^/10

Malware Config

Signatures

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
8379c28556ccbaf63a00ec134eaffee9_JaffaCakes118
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack008/$PLUGINSDIR/InstallOptions.dll
unpack008/$PLUGINSDIR/NSISArray.dll
unpack008/$PLUGINSDIR/System.dll
unpack008/$PLUGINSDIR/UserInfo.dll
unpack008/$PLUGINSDIR/nsProcess.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
static1/unpack001/install_flash_player.exe	nsis_installer_1

Files

8379c28556ccbaf63a00ec134eaffee9_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 756KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/SogouExplorer/Skin/搜狗浏览器 2010.seskin
.zip
0
1
10
11
12
13
14
15
16
17
18
19
2
20
21
22
23
24
25
26
27
28
29
3
30
31
32
33
34
35
36
37
39
4
40
41
42
43
44
45
46
47
48
49
5
50
51
52
53
54
55
56
57
58
59
6
60
61
62
63
64
65
66
67
68
69
7
70
71
72
73
74
75
76
77
78
79
8
80
81
82
83
84
85
86
87
88
89
9
90
$APPDATA/SogouExplorer/Skin/搜狗浏览器IE经典版.seskin
.zip
0
1
10
11
12
13
14
15
16
17
18
19
2
20
21
22
23
24
25
26
27
28
29
3
30
31
32
33
34
35
36
37
39
4
40
41
42
43
44
45
46
47
48
49
5
50
51
52
53
54
55
56
57
58
59
6
60
61
62
63
64
65
66
67
68
69
7
70
71
72
73
74
75
76
77
78
79
8
80
81
82
83
84
85
86
87
88
89
9
90
$APPDATA/SogouExplorer/Skin/搜狗浏览器‘Chrome’版.seskin
.zip
0
1
10
11
12
13
14
15
16
17
18
19
2
20
21
22
23
24
25
26
27
28
29
3
30
31
32
33
34
35
36
37
39
4
40
41
42
43
44
45
46
47
48
49
5
50
51
52
53
54
55
56
57
58
59
6
60
61
62
63
64
65
66
67
68
69
7
70
71
72
73
74
75
76
77
78
79
8
80
81
82
83
84
85
86
87
88
89
9
90
$APPDATA/SogouExplorer/Skin/搜狗浏览器时尚版.seskin
.zip
0
1
10
11
12
13
14
15
16
17
18
19
2
20
21
22
23
24
25
26
27
28
29
3
30
31
32
33
34
35
36
37
38
39
4
40
41
42
43
44
45
46
47
48
49
5
50
51
52
53
54
55
56
57
58
59
6
60
61
62
63
64
65
66
67
68
69
7
70
71
72
73
74
75
76
77
78
79
8
80
81
82
83
84
85
86
87
88
89
9
90
$APPDATA/SogouExplorer/Skin/搜狗浏览器水晶全透明版.seskin
.zip
0
1
10
11
12
13
14
15
16
17
18
19
2
20
21
22
23
24
25
26
27
28
29
3
30
31
32
33
34
35
36
37
38
39
4
40
41
42
43
44
45
46
47
48
49
5
50
51
52
53
54
55
56
57
58
59
6
60
61
62
63
64
65
66
67
68
69
7
70
71
72
73
74
75
76
77
78
79
8
80
81
82
83
84
85
86
87
88
89
9
90
$PLUGINSDIR/FindProcDLL.dll
.dll windows:4 windows x86 arch:x86

e26d7460d0c04056b9226a899477ba4d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
CloseHandle
OpenProcess
LoadLibraryW
GetProcAddress
GetVersionExW
GlobalFree
lstrcpyW
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
LCMapStringW
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
HeapDestroy
HeapCreate
VirtualFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
DisableThreadLibraryCalls
WriteFile
VirtualAlloc
RtlUnwind
GetStringTypeA
GetStringTypeW
GetLastError
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
SetStdHandle
FlushFileBuffers

Exports

Exports

FindProc

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

d806a080e21508dd768fa70be247d2ae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryW
GetProcAddress
GetVersionExW
GlobalFree
lstrcpyW
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
RtlUnwind
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
LoadLibraryA

Exports

Exports

KillProc

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/io.ini
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/overwriteinstall.ini
$PLUGINSDIR/setup1.bmp
$R0
.exe windows:4 windows x86 arch:x86

1963f7407daebe9c731f7582e3e17de8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:d3:ce:02:eb:71:f7:99:ec:b5:f8:bb:79:66:28:a6
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

10-07-2009 00:00

Not After

14-07-2012 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\se_src\branches\2.0release\bin\AllLibRelease\SogouExplorer.pdb

Imports

kernel32

GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
RtlUnwind
FreeLibrary
InterlockedExchange
InitializeCriticalSection
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
WideCharToMultiByte
GetSystemDirectoryA
DeviceIoControl
LocalAlloc
GetFileAttributesW
GetFileAttributesA
FormatMessageW
GetDiskFreeSpaceA
LockFileEx
AreFileApisANSI
FormatMessageA
LockFile
UnlockFile
GetFileInformationByHandle
LCMapStringA
HeapSize
Sleep
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapDestroy
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
CreateEventW
WaitForSingleObject
CreateFileMappingW
OpenFileMappingW
CloseHandle
lstrlenW
InterlockedExchangeAdd
FlushInstructionCache
SearchPathW
FindFirstFileW
FindClose
MapViewOfFile
UnmapViewOfFile
FindNextFileW
CreateFileW
CreateThread
SetEvent
SizeofResource
LockResource
MultiByteToWideChar
FindResourceExW
lstrlenA
OpenMutexW
CreateDirectoryA
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
CreateProcessW
GlobalAddAtomW
FindResourceW
GetModuleHandleW
GetTempPathW
GetTempFileNameW
CreateFileMappingA
SetProcessWorkingSetSize
GlobalMemoryStatusEx
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
GetExitCodeProcess
GetPrivateProfileStringW
CreateDirectoryW
SystemTimeToFileTime
FindFirstFileA
DeleteFileA
FindNextFileA
RemoveDirectoryA
GetSystemTime
CreateMutexW
ReleaseMutex
ReadFile
SetFilePointer
GlobalAlloc
GetVersionExW
VirtualProtect
GlobalLock
GlobalUnlock
GetFullPathNameW
GetLocalTime
GetFileSize
lstrcmpiW
GetFileTime
CompareFileTime
GlobalFree
TerminateThread
GlobalSize
DeleteFileW
GetSystemInfo
ExpandEnvironmentStringsW
SetFileAttributesW
CopyFileW
RemoveDirectoryW
MoveFileExW
CopyFileA
CreateFileA
TryEnterCriticalSection
lstrcmpiA
GetDiskFreeSpaceW
CreateSemaphoreW
ReleaseSemaphore
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
GetThreadPriority
FindResourceA
IsBadReadPtr
OpenThread
OpenFileMappingA
GetThreadContext
SetThreadContext
VirtualQuery
InterlockedCompareExchange
SuspendThread
ResumeThread
lstrcmpA
GlobalMemoryStatus
Module32FirstW
lstrcpyA
GetTempPathA
GetProcessTimes
CreateProcessA
FileTimeToDosDateTime
lstrcatA
lstrcpyW
lstrcpynW
IsProcessorFeaturePresent
GetThreadLocale
GetDriveTypeW
ExitThread
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCurrentDirectoryA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetDriveTypeA
GetFullPathNameA
FreeEnvironmentStringsA
GetModuleFileNameW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
GetStartupInfoW
GetProcessHeap
HeapAlloc
GetVersionExA
HeapFree
GetCurrentThread
OutputDebugStringW
OutputDebugStringA
GetCurrentProcess
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
TerminateProcess
WaitForMultipleObjects
GetTickCount
LoadResource
GetProcAddress

user32

EnableMenuItem
SetMenuItemInfoW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
InsertMenuItemW
SetMenuDefaultItem
GetDlgItem
CreatePopupMenu
GetIconInfo
GetDlgCtrlID
GetMenuItemCount
MenuItemFromPoint
GetMenuItemInfoW
DeleteMenu
IsClipboardFormatAvailable
GetMenuItemID
CheckMenuItem
RemoveMenu
GetMenuItemRect
SetMenuContextHelpId
GetMenuContextHelpId
GetClipboardData
EnumThreadWindows
AllowSetForegroundWindow
EnumDisplayMonitors
GetSystemMenu
TrackPopupMenuEx
EnableWindow
SetScrollInfo
GetScrollInfo
GetMenuState
GetMenuStringW
MessageBeep
InflateRect
SetRectEmpty
CharNextW
SetClassLongW
GetMenu
CreateDialogIndirectParamW
IsDialogMessageW
AdjustWindowRectEx
DrawEdge
GetDlgItemTextW
DrawFocusRect
SetDlgItemTextW
GetSysColor
SetLayeredWindowAttributes
LoadBitmapW
FillRect
MoveWindow
SetCursorPos
GetKeyState
GetScrollPos
InsertMenuW
GetScrollRange
GetClassLongW
SetScrollPos
PostThreadMessageW
MapVirtualKeyExW
GetKeyboardLayout
GetKeyNameTextW
CharLowerBuffW
MsgWaitForMultipleObjects
EnumWindows
CreateWindowExA
CreateDialogParamA
CreateDialogParamW
CreateDialogIndirectParamA
MessageBoxExA
MessageBoxExW
MessageBoxIndirectA
MessageBoxIndirectW
RegisterClassA
RegisterClassW
RegisterClassExA
GetSubMenu
SendInput
PrintWindow
LoadIconW
MapWindowPoints
SetMenuItemBitmaps
TrackPopupMenu
FlashWindow
DrawIcon
wsprintfW
wvsprintfA
wsprintfA
UnregisterClassA
PeekMessageW
PostQuitMessage
GetWindowThreadProcessId
ShowWindowAsync
GetLastActivePopup
IntersectRect
MonitorFromRect
SetFocus
CreateIconIndirect
MessageBoxW
DestroyIcon
LoadImageW
ScreenToClient
GetAncestor
RegisterWindowMessageW
GetCursorPos
ShowWindow
UnhookWindowsHookEx
RegisterClassExW
DefWindowProcW
KillTimer
SetWindowsHookExW
SetWindowLongW
TrackMouseEvent
SetCursor
GetWindowRect
IsWindowVisible
GetMonitorInfoW
DestroyCursor
GetWindow
MonitorFromPoint
IsWindow
CopyRect
GetClientRect
GetDesktopWindow
CreateWindowExW
GetAsyncKeyState
PtInRect
OffsetRect
GetWindowLongW
DestroyWindow
DrawTextW
WindowFromPoint
CallWindowProcW
ReleaseDC
GetWindowDC
SetWindowPos
LoadCursorW
UpdateLayeredWindow
GetDC
CallNextHookEx
GetClassInfoExW
GetSystemMetrics
EndPaint
BeginPaint
BringWindowToTop
FindWindowExW
FindWindowW
LoadMenuW
EqualRect
CopyIcon
GetWindowTextLengthW
GetWindowTextW
IsWindowEnabled
SetCapture
SendMessageTimeoutW
GetFocus
ShowOwnedPopups
ReleaseCapture
ClientToScreen
SetWindowRgn
EndDeferWindowPos
DeferWindowPos
SetParent
EndMenu
BeginDeferWindowPos
DestroyMenu
SetForegroundWindow
SendMessageW
InvalidateRect
IsCharAlphaNumericA
PostMessageW
IsIconic
SetWindowTextW
GetParent
RedrawWindow
GetCapture
ChildWindowFromPoint
DrawIconEx
UnionRect
RegisterHotKey
UnregisterHotKey
GetForegroundWindow
GetClassNameW
DispatchMessageW
TranslateMessage
GetMessageW
MonitorFromWindow
UpdateWindow
GetWindowPlacement
ActivateKeyboardLayout
SystemParametersInfoW
SetTimer

shlwapi

StrCmpIW
PathFileExistsA
PathFileExistsW
SHGetValueW
StrCmpW
StrStrIW
StrCpyNW
SHSetValueW
PathRemoveFileSpecW
PathIsDirectoryW
PathFindExtensionW
SHEnumValueW
SHQueryInfoKeyW
SHDeleteKeyW
PathAppendA
SHDeleteValueW
PathAppendW
PathIsNetworkPathW
StrToIntW

comctl32

InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Destroy
_TrackMouseEvent
ImageList_GetIconSize
ImageList_Draw
ImageList_Add
ImageList_Create

uxtheme

OpenThemeData
CloseThemeData

gdi32

GetBkMode
RoundRect
SetWindowOrgEx
GetRegionData
IntersectClipRect
SelectClipRgn
CombineRgn
CreateRectRgn
CreateFontIndirectW
GetTextExtentPoint32W
ExtTextOutW
SetBkColor
GetClipBox
BitBlt
CreateCompatibleBitmap
CreatePen
SetViewportOrgEx
CreateRoundRectRgn
LineTo
GetDeviceCaps
GetStockObject
CreateSolidBrush
GetObjectType
CreateRectRgnIndirect
Rectangle
LPtoDP
MoveToEx
DPtoLP
ExtFloodFill
DeleteDC
StretchBlt
SetBkMode
SetTextColor
GetTextColor
CreateFontW
CreateCompatibleDC
CreateDIBSection
GetCurrentObject
SelectObject
GetObjectW
SetBitmapBits
GetBitmapBits
DeleteObject

advapi32

RegDeleteValueW
RegEnumValueW
RegCreateKeyW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyW
RegOpenCurrentUser
GetUserNameA

shell32

ExtractIconExW
SHGetFolderPathA
SHGetDesktopFolder
SHOpenFolderAndSelectItems
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
SHFileOperationW
SHGetFolderPathW
CommandLineToArgvW
SHCreateDirectoryExW
SHGetFileInfoW
ExtractIconW
SHGetFolderLocation
SHGetPathFromIDListW
ord155
SHGetSpecialFolderPathA

ole32

OleDuplicateData
ReleaseStgMedium
DoDragDrop
RegisterDragDrop
CoTaskMemFree
CoUninitialize
CoRegisterClassObject
StringFromGUID2
OleUninitialize
OleInitialize
CoCreateInstance
CoInitialize
CoFileTimeNow
CreateStreamOnHGlobal
CoRevokeClassObject

oleaut32

SysFreeString
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
VariantInit
GetErrorInfo

Exports

Exports

??0CFavImportMgr@@QAE@XZ
??0CImportFromFile@@QAE@XZ
??0CImportFromIe@@QAE@XZ
??0CPrivateConfig@@QAE@XZ
??0CProxyConfig@@QAE@XZ
??0CProxyItem@@QAE@XZ
??1CFavImportMgr@@QAE@XZ
??1CImportFromFile@@QAE@XZ
??1CImportFromIe@@QAE@XZ
??1CPrivateConfig@@QAE@XZ
??4CProxyItem@@QAEAAV0@ABV0@@Z
??8CProxyItem@@QAEHABV0@@Z
?AddAdBlockRule@AdBlock@UserCenter@@YAHAAUAdBlockRuleItem@@@Z
?AddImportSource@CFavImportMgr@@QAEHPAVCFavorImportFromBase@@@Z
?AddItem@Favorite@UserCenter@@YA_NPAUtag_FAVORITEM@@_N1@Z
?AddOneCommonNoShow@FormData@UserCenter@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?AddOnePreciseNoShow@FormData@UserCenter@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?AddProxyToList@CProxyConfig@@QAEHABVCProxyItem@@@Z
?Add_yesky_Fav@Favorite@UserCenter@@YA_NXZ
?AlterItem@Favorite@UserCenter@@YA_NPAUtag_FAVORITEM@@@Z
?AxLogPingback@Misc@Common@@YAJHPB_WZZ
?BeginImport@CFavImportMgr@@QAEHH@Z
?BeginImport@FavorImportBkGrd@UserCenter@@YAHPAUHWND__@@H@Z
?BitmapFromIcon@UIMisc@Common@@YAPAUHBITMAP__@@PAUHICON__@@HH@Z
?CancelImport@CFavImportMgr@@QAEHH@Z
?ClearAdBlockHistory@UrlHistoryManager@UserCenter@@YAXXZ
?ClearDataBase@HistoryData@UserCenter@@YAJJ@Z
?ConvertAllDB@Favorite@UserCenter@@YA_NXZ
?ConvertDBToReg@DatabaseToReg@UserCenter@@YAXXZ
?ConvertRegToXML@DataBaseRegUrl@UserCenter@@YAXXZ
?DelAllCommonNoShow@FormData@UserCenter@@YAHXZ
?DelAllPreciseNoShow@FormData@UserCenter@@YAHXZ
?DelOneCommonNoShow@FormData@UserCenter@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?DelSetCommonNoShow@FormData@UserCenter@@YAHABV?$list@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z
?DelSetPreciseNoShow@FormData@UserCenter@@YAHABV?$list@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z
?DeleteAllPreciseData@FormData@UserCenter@@YAHXZ
?DeleteItem@Favorite@UserCenter@@YA_NH@Z
?DeleteItem@Favorite@UserCenter@@YA_NPAUtag_FAVORITEM@@@Z
?DeleteOneUnitCommonData@FormData@UserCenter@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?DeleteOneUnitPreciseData@FormData@UserCenter@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?DeleteProxyFromList@CProxyConfig@@QAEHK@Z
?DeleteProxyList@CProxyConfig@@QAEHXZ
?DeleteUrlHistory@UrlHistoryManager@UserCenter@@YA_NPB_WH@Z
?DetourAttach@Detours@Util@@YAJPAPAXPAX@Z
?DetourDetach@Detours@Util@@YAJPAPAXPAX@Z
?DetourTransactionBegin@Detours@Util@@YAJXZ
?DetourTransactionCommit@Detours@Util@@YAJXZ
?DetourUpdateThread@Detours@Util@@YAJPAX@Z
?DirtyWorks@HistoryData@UserCenter@@YAXXZ
?DoImport@FavorImportBkGrd@UserCenter@@YAHK@Z
?DoImportFromHtml@FavorImportBkGrd@UserCenter@@YAXPB_WK@Z
?EndImport@FavorImportBkGrd@UserCenter@@YAHXZ
?ExchangeStatUrlHistoryToDataBase@ExchangeHistory@UserCenter@@YAXXZ
?ExchangeVisitedUrlCacheEntryToDataBase@ExchangeHistory@UserCenter@@YAXXZ
?ExtractUrlFromUrlLinkFile@URLMisc@Common@@YAJPB_WPA_WI@Z
?FileSizeToString@UIMisc@Common@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_K@Z
?FormatFileName@Misc@Common@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z
?GetAccurateOSVersion@Misc@Common@@YAJXZ
?GetAllAdBlockHistory@UrlHistoryManager@UserCenter@@YAHAAV?$vector@UAdBlockHistoryItem@@V?$allocator@UAdBlockHistoryItem@@@std@@@std@@@Z
?GetAllAdBlockRules@AdBlock@UserCenter@@YAHAAV?$vector@UAdBlockRuleItem@@V?$allocator@UAdBlockRuleItem@@@std@@@std@@H@Z
?GetAllCommonMoniker@FormData@UserCenter@@YAHAAV?$list@UMonikerItem@@V?$allocator@UMonikerItem@@@std@@@std@@@Z
?GetAllCommonMoniker@FormData@UserCenter@@YAHAAV?$list@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z
?GetAllCommonNoShow@FormData@UserCenter@@YAHAAV?$list@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z
?GetAllPreciseNoShow@FormData@UserCenter@@YAHAAV?$list@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z
?GetAllPreciseURL@FormData@UserCenter@@YAHAAV?$list@UFormName@@V?$allocator@UFormName@@@std@@@std@@@Z
?GetAuxWndFromAx@ModuleManager@Common@@YAPAUHWND__@@XZ
?GetAuxWndFromMain@ModuleManager@Common@@YAPAUHWND__@@XZ
?GetAxUIWnd@ModuleManager@Common@@YAPAUHWND__@@XZ
?GetBitCount@Misc@Common@@YAGI@Z
?GetCacheDisk@NetOptimize@Trash@@YAKPA_WPAK@Z
?GetCommonForigenID@FormData@UserCenter@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?GetConfigBinary@GetConfig@UserCenter@@YAKHPAXK@Z
?GetConfigBool@GetConfig@UserCenter@@YA_NH@Z
?GetConfigInt@GetConfig@UserCenter@@YAHH@Z
?GetConfigListPoint@GetConfig@UserCenter@@YAPAU_CONFIG_PARAM_@@XZ
?GetConfigString@GetConfig@UserCenter@@YAPB_WH@Z
?GetConfigStringFile@GetConfig@UserCenter@@YA_NHPA_WI@Z
?GetCurImportCount@FavorImportBkGrd@UserCenter@@YAHXZ
?GetCurrentImportURL@CFavImportMgr@@QAEXAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?GetCurrentUser@Passport@@YAPB_WXZ
?GetCurrentUserNick@Passport@@YAPB_WXZ
?GetDefaultCommonData@FormData@UserCenter@@YAHXZ
?GetDefaultConfigBool@GetConfig@UserCenter@@YA_NH@Z
?GetDefaultConfigInt@GetConfig@UserCenter@@YAHH@Z
?GetDefaultConfigString@GetConfig@UserCenter@@YAPB_WHPA_WI@Z
?GetDefaultFont@Misc@Common@@YAPAUHFONT__@@_N@Z
?GetFeedbackURL@Update@Trash@@YAXAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?GetFileCount@CFavImportMgr@@QAEHXZ
?GetFileCount@FavorImportBkGrd@UserCenter@@YAHXZ
?GetFileDescription@IEMisc@Common@@YA_NPB_WPA_WK@Z
?GetFileVersion@IEMisc@Common@@YA_NPB_WAAJ111@Z
?GetFirstStartup@NetOptimize@Trash@@YAKXZ
?GetFolderCount@CFavImportMgr@@QAEHXZ
?GetFolderCount@FavorImportBkGrd@UserCenter@@YAHXZ
?GetFullPathById@Favorite@UserCenter@@YA_NHPA_WH@Z
?GetHardwareID@Misc@Common@@YAPBDXZ
?GetIEProxyStatusEx@NetOptimize@Trash@@YAHPA_WK0K@Z
?GetIEVersion@IEMisc@Common@@YAJAAJ@Z
?GetIdByFullPath@Favorite@UserCenter@@YA_NPB_WPAH@Z
?GetItem@Favorite@UserCenter@@YA_NHPAPAUtag_FAVORITEM@@PAHPAUHWND__@@@Z
?GetItem@Favorite@UserCenter@@YA_NHPB_WPAPAUtag_FAVORITEM@@PAHPAUHWND__@@@Z
?GetItem@Favorite@UserCenter@@YA_NPAUtag_FAVORITEM@@PAPAU3@PAHPAUHWND__@@@Z
?GetItem@Favorite@UserCenter@@YA_NPAUtag_FAVORITEM@@PB_WPAPAU3@PAHPAUHWND__@@@Z
?GetKeyNameByShortcut@GetConfig@UserCenter@@YAPB_WKPA_WI@Z
?GetKeyValueBinary@CPrivateConfig@@QAEKABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAEK@Z
?GetKeyValueDword@CPrivateConfig@@QAEKABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@K@Z
?GetKeyValueInt@CPrivateConfig@@QAEHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H@Z
?GetKindOfNavigateUrl@URLMisc@Common@@YAJPB_W@Z
?GetLastLoginTime@Passport@@YA_NAAUtm@@@Z
?GetLastSyncTime@Passport@@YA_NAAUtm@@@Z
?GetMainModulePath@Misc@Common@@YAPB_WXZ
?GetMainUIUtilWnd@ModuleManager@Common@@YAPAUHWND__@@XZ
?GetMainUIWnd@ModuleManager@Common@@YAPAUHWND__@@XZ
?GetOldVersionConfigItem@ConfigManager@UserCenter@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@_N@Z
?GetOneUnitCommonData@FormData@UserCenter@@YAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$list@UFormItem@@V?$allocator@UFormItem@@@std@@@4@@Z
?GetOneUnitPreciseData@FormData@UserCenter@@YAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$list@UFormItem@@V?$allocator@UFormItem@@@std@@@4@@Z
?GetPXPStartPage@IEMisc@Trash@@YA_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetPXPStartPageLow@IEMisc@Trash@@YA_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetPassBy@Proxy@UserCenter@@YAPB_WPA_WK@Z
?GetPassportAccountFromInput@Passport@@YA_NPA_WAAK@Z
?GetPathFileInvalidChar@Misc@Common@@YAPB_WXZ
?GetProxyCategorical@CProxyItem@@QAE?AW4ProxyCategorical@@XZ
?GetProxyFromList@CProxyConfig@@QAEHAAVCProxyItem@@K@Z
?GetProxyIndexFromList@CProxyConfig@@QAEHAAVCProxyItem@@@Z
?GetProxyItemIPAndPort@CProxyItem@@QAEPB_WXZ
?GetProxyItemPassword@CProxyItem@@QAEPB_WXZ
?GetProxyItemProxyName@CProxyItem@@QAEPB_WXZ
?GetProxyItemSpeed@CProxyItem@@QAEKXZ
?GetProxyItemType@CProxyItem@@QAEPB_WXZ
?GetProxyItemszUser@CProxyItem@@QAEPB_WXZ
?GetProxyNumber@CProxyConfig@@QAEKXZ
?GetProxySpeedThread@CProxyConfig@@QAEKPAUHWND__@@II@Z
?GetRootItem@Favorite@UserCenter@@YA_NPAUtag_FAVORITEM@@@Z
?GetSEDataPath@Misc@Common@@YAPB_WXZ
?GetSEVersion@Misc@Common@@YAPB_WXZ
?GetSearchEngineHistory@HistoryData@UserCenter@@YAHXZ
?GetShowTip@NetOptimize@Trash@@YAKXZ
?GetSpecialPath@Misc@Common@@YA_NHPA_WH@Z
?GetSpecificDataFromSkinZip@Misc@Trash@@YA_NPB_WPAPAEPAHH@Z
?GetStartParamFromRegistry@NetOptimize@Trash@@YAKAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?GetTitleByUrl@HistoryData@UserCenter@@YA_NPB_WPA_WK@Z
?GetUserDefaultBrowser@@YAXAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?GetUserExperienceParticipation@GetConfig@UserCenter@@YA_NXZ
?GetUsingProxy@Proxy@UserCenter@@YAHAAVCProxyItem@@H@Z
?GetUsingProxyCategorical@Proxy@UserCenter@@YA?AW4ProxyCategorical@@H@Z
?GetValue@BrowserConf@Trash@@YAXPB_WAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?GetVideoAccReg@NetOptimize@Trash@@YAKXZ
?GetWebAccReg@NetOptimize@Trash@@YAKXZ
?ImportFromEarlierVer@Favorite@UserCenter@@YA_NXZ
?InitConfigArrayDefaultValue@ConfigManager@UserCenter@@YAXPAU_CONFIG_PARAM_@@@Z
?InitConfigArrayFromLocalFile2ForOldVersion@ConfigManager@UserCenter@@YA_NPAU_CONFIG_PARAM_@@@Z
?InitConfigFile@ConfigManager@UserCenter@@YA_NXZ
?InitGDIPlusOnce@Misc@Common@@YAXXZ
?InitSpecificCommonConfigFile@ConfigManager@UserCenter@@YAXQAPB_W@Z
?Initialize@Database@UserCenter@@YAXXZ
?Initialize@PingBack@Trash@@YAXXZ
?InstallCrashReport@@YAXPBD0_NP6AXPAU_EXCEPTION_POINTERS@@@Z@Z
?IsAdmin@CDefaultBrowser@@SAHXZ
?IsChild@Favorite@UserCenter@@YAHHH@Z
?IsContainingSpecialUrlOnly@Favorite@UserCenter@@YAHHABV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@@Z
?IsExists@Favorite@UserCenter@@YA_NHPB_W_NPAPAUtag_FAVORITEM@@@Z
?IsFavorEmpty@Favorite@UserCenter@@YAHXZ
?IsFileExist@Misc@Common@@YA_NPB_W@Z
?IsLogAccDirect@PingBack@Common@@YAHPBD@Z
?IsNetBarMode@Passport@@YA_NXZ
?IsNullPage@IEMisc@Common@@YA_NPAUIWebBrowser2@@@Z
?IsPXPStartPageAlreadyOpen@IEMisc@Trash@@YA_NXZ
?IsPathValid@Misc@Common@@YA_NPB_W@Z
?IsProxyItemSelect@CProxyItem@@QAEHXZ
?IsProxyItemsNeedAuthentication@CProxyItem@@QAEHXZ
?IsValidProxyItem@CProxyItem@@QAEHXZ
?LoadImageFromRes@UIMisc@Common@@YAPAUHBITMAP__@@PAUHINSTANCE__@@IPB_W@Z
?Log360SE@PingBack@Trash@@YAX_N@Z
?LogADBlock@PingBack@Common@@YAXHPB_W@Z
?LogAccDirect@PingBack@Common@@YAXPB_WKK@Z
?LogDefaultBrowser@PingBack@Common@@YAXHH@Z
?LogMultiCore@PingBack@Trash@@YAXHPB_W@Z
?LogPassport@PingBack@Common@@YAXH@Z
?LogPassport@PingBack@Common@@YAXHPB_W@Z
?LogProxyInstall@PingBack@Trash@@YAXXZ
?LogSeInstall@PingBack@Trash@@YAX_N@Z
?LogSeProxyNormalExit@PingBack@Trash@@YAXXZ
?LogSeSearch@PingBack@Trash@@YAXH@Z
?LogSeUninstall@PingBack@Trash@@YAXXZ
?LogSkipWizard@PingBack@Common@@YAXXZ
?LogVideoRequest@PingBack@Common@@YAXPB_WK@Z
?LogWizardFinished@PingBack@Common@@YAXHHHH@Z
?MD5HashFileToStringA@Misc@Common@@YAXPB_WPAE@Z
?ModifySearchEngine@Favorite@UserCenter@@YA_NXZ
?MoveItem@Favorite@UserCenter@@YA_NPBUtag_FAVORITEM@@00PAH@Z
?NotifyAddFavor@Favorite@UserCenter@@YAXXZ
?NotifyAllProcess@Proxy@UserCenter@@YAXXZ
?NotifyRefreshAll@Favorite@UserCenter@@YAXK@Z
?NotifyRefreshAll@UrlHistoryManager@UserCenter@@YAXH@Z
?OpenSection@CPrivateConfig@@QAEHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H@Z
?OpenUrlByIE@URLMisc@Common@@YA_NPB_W@Z
?ParseLocalEnvironment@NetOptimize@Trash@@YAKPAUHWND__@@K@Z
?PassportInitialize@Passport@@YAXXZ
?Pause@CFavImportMgr@@QAEXXZ
?RebuildRecentTable@HistoryData@UserCenter@@YAXXZ
?RegisterDefault@IEMisc@Trash@@YAKK@Z
?RemoteGetConfigBool@AxGetConfig@Common@@YA_NH@Z
?RemoteGetConfigInt@AxGetConfig@Common@@YAHH@Z
?RemoteGetConfigString@AxGetConfig@Common@@YAHHPA_WH@Z
?RemoteSetConfigBool@AxGetConfig@Common@@YAXH_N@Z
?RemoteSetConfigInt@AxGetConfig@Common@@YAXHH@Z
?RemoteSetConfigString@AxGetConfig@Common@@YAXHPB_W@Z
?RemoveAdBlockRule@AdBlock@UserCenter@@YA_NAAUAdBlockRuleItem@@@Z
?RemoveAllAdBlockRule@AdBlock@UserCenter@@YAXH@Z
?ResRelease@Favorite@UserCenter@@YAJPAUtag_FAVORITEM@@@Z
?Resume@CFavImportMgr@@QAEXXZ
?RunSEUpdater@Update@Trash@@YA_NH@Z
?Save2@ConfigManager@UserCenter@@YA_NI@Z
?Save@ConfigManager@UserCenter@@YA_NI@Z
?SaveAsHtml@Favorite@UserCenter@@YAJPB_WHPAUHWND__@@@Z
?SaveAsXmlFile@Favorite@UserCenter@@YAJPB_WHPAUHWND__@@@Z
?SaveBitmapToFile@Misc@Common@@YA_NPAUHBITMAP__@@PB_WABU_GUID@@J@Z
?SaveBitmapToStream@Misc@Common@@YA_NPAUHBITMAP__@@PAUIStream@@ABU_GUID@@J@Z
?SaveCommonConfigFile@ConfigManager@UserCenter@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAU_CONFIG_PARAM_@@@Z
?SaveConfigArrayIntoLocalFile2@ConfigManager@UserCenter@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAU_CONFIG_PARAM_@@@Z
?SaveConfigArrayIntoLocalFile@ConfigManager@UserCenter@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAU_CONFIG_PARAM_@@@Z
?SaveProxyItems@CProxyConfig@@QAEXXZ
?Serialize@CProxyItem@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?SetAxUIWnd@ModuleManager@Common@@YAXPAUHWND__@@@Z
?SetCacheDisk@NetOptimize@Trash@@YAKPB_WK@Z
?SetConfigBinary@GetConfig@UserCenter@@YA_NHPAXK@Z
?SetConfigBool@GetConfig@UserCenter@@YA_NH_N@Z
?SetConfigInt@GetConfig@UserCenter@@YA_NHH@Z
?SetConfigString@GetConfig@UserCenter@@YA_NHPB_W@Z
?SetCoverMode@CFavImportMgr@@QAEXH@Z
?SetDefaultCommonData@FormData@UserCenter@@YAHH@Z
?SetFirstStartup@NetOptimize@Trash@@YAKK@Z
?SetIconReference@FavorIcon@Trash@@YAXPAUHICON__@@H@Z
?SetInitialization@Favorite@UserCenter@@YA_NXZ
?SetKeyValueDword@CPrivateConfig@@QAEHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@K@Z
?SetMainUIUtilWnd@ModuleManager@Common@@YAXPAUHWND__@@@Z
?SetNotifyWnd@CFavImportMgr@@QAEHPAUHWND__@@@Z
?SetPassBy@Proxy@UserCenter@@YAHPA_W@Z
?SetProxyCategorical@CProxyItem@@QAEXW4ProxyCategorical@@@Z
?SetProxyItemIPAndPort@CProxyItem@@QAEXPB_W@Z
?SetProxyItemPassword@CProxyItem@@QAEXPB_W@Z
?SetProxyItemProxyName@CProxyItem@@QAEXPB_W@Z
?SetProxyItemSelect@CProxyItem@@QAEXH@Z
?SetProxyItemSpeed@CProxyItem@@QAEXK@Z
?SetProxyItemType@CProxyItem@@QAEXPB_W@Z
?SetProxyItemsNeedAuthentication@CProxyItem@@QAEXH@Z
?SetProxyItemszUser@CProxyItem@@QAEXPB_W@Z
?SetProxyToList@CProxyConfig@@QAEHAAVCProxyItem@@K@Z
?SetShowTip@NetOptimize@Trash@@YAKK@Z
?SetSogouDefault@IEMisc@Trash@@YAHH@Z
?SetSogouDefaultWhenIEOnly@IEMisc@Trash@@YAHXZ
?SetStartItemMemory@NetOptimize@Trash@@YAKK@Z
?SetStartParamToRegistry@NetOptimize@Trash@@YAKPB_W@Z
?SetUserExperienceParticipation@GetConfig@UserCenter@@YAX_N@Z
?SetValue@BrowserConf@Trash@@YAXPB_W0@Z
?SetVideoAccReg@NetOptimize@Trash@@YAKK@Z
?SetWebAccReg@NetOptimize@Trash@@YAKK@Z
?StartCoreAccelerater@NetOptimize@Trash@@YAKXZ
?StartNewSessionOfAccelerater@NetOptimize@Trash@@YAKXZ
?StopWebAccelerater@NetOptimize@Trash@@YAKXZ
?SwitchUser@Passport@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AB_N11@Z
?SyncUserData@Passport@@YAHH_N@Z
?TerminateAccelerater@NetOptimize@Trash@@YAKXZ
?Transaction@HistoryData@UserCenter@@YAXH@Z
?TransactionCommand@Favorite@UserCenter@@YA_NH@Z
?TransactionCommand@UrlHistoryManager@UserCenter@@YAXH@Z
?TransferUserData@Passport@@YAH_NPAUHWND__@@@Z
?Uninitialize@Database@UserCenter@@YAXXZ
?Update@Passport@@YAXXZ
?UpdateFormCommonData@FormData@UserCenter@@YAHHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$list@UFormItem@@V?$allocator@UFormItem@@@std@@@4@@Z
?UpdateFormPreciseData@FormData@UserCenter@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0ABV?$list@UFormItem@@V?$allocator@UFormItem@@@std@@@4@@Z
?UpdatePreciseDataName@FormData@UserCenter@@YAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@000@Z
?Url2Ansi@URLMisc@Common@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W@Z
?UrlDecode@URLMisc@Common@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
?UserLogin@Passport@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AB_N11@Z
?UserLoginBlockMode@Passport@@YAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AB_N11@Z
?UserLogout@Passport@@YAH_N@Z
?WaitComplete@CFavImportMgr@@QAEXK@Z
?WriteToFile@BrowserConf@Trash@@YAXXZ
?base64_decode@@YAHPBEHPAEPAH@Z
?sogou_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 404KB - Virtual size: 401KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 352KB - Virtual size: 349KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FlashIcon.ico
Skin/搜狗浏览器 2010.seskin
.zip
0
1
10
11
12
13
14
15
16
17
18
19
2
20
21
22
23
24
25
26
27
28
29
3
30
31
32
33
34
35
36
37
39
4
40
41
42
43
44
45
46
47
48
49
5
50
51
52
53
54
55
56
57
58
59
6
60
61
62
63
64
65
66
67
68
69
7
70
71
72
73
74
75
76
77
78
79
8
80
81
82
83
84
85
86
87
88
89
9
90
StartPage/$R0
.html .js polyglot
StartPage/Local/baidu.gif
.gif
StartPage/Local/baiduc.gif
.gif
StartPage/Local/checkbox.gif
.gif
StartPage/Local/checkbox1.gif
.gif
StartPage/Local/checkbox2.gif
.gif
StartPage/Local/close.gif
.gif
StartPage/Local/close.png
.png
StartPage/Local/default.gif
.gif
StartPage/Local/default.jpg
.jpg
StartPage/Local/default_page.ico
StartPage/Local/fenge.png
.png
StartPage/Local/google.gif
.gif
StartPage/Local/googlec.gif
.gif
StartPage/Local/guding1.png
.png
StartPage/Local/guding2.png
.png
StartPage/Local/help.gif
.gif
StartPage/Local/ie.css
StartPage/Local/ie.js
.js
StartPage/Local/iframe.html
.html .js polyglot
StartPage/Local/iframe_wk.html
.html .js polyglot
StartPage/Local/index.html
.html .js polyglot
StartPage/Local/logo.gif
.gif
StartPage/Local/none.jpg
.jpg
StartPage/Local/q1.png
.png
StartPage/Local/q2.png
.png
StartPage/Local/rbg.jpg
.jpg
StartPage/Local/rbg0.jpg
.jpg
StartPage/Local/rbg2.jpg
.jpg
StartPage/Local/rbg3.jpg
.jpg
StartPage/Local/reset.gif
.gif
StartPage/Local/sb.jpg
.jpg
StartPage/Local/selmenu.png
.png
StartPage/Local/set.gif
.gif
StartPage/Local/setcancel.gif
.gif
StartPage/Local/setok.gif
.gif
StartPage/Local/shadow1.jpg
.jpg
StartPage/Local/shadow2.gif
.gif
StartPage/Local/sogou.gif
.gif
StartPage/Local/sogouc.gif
.gif
StartPage/Local/space.gif
.gif
StartPage/Local/tran1.png
.png
StartPage/Local/tran2.png
.png
StartPage/Local/tran3.png
.png
StartPage/Local/wk.css
StartPage/Local/wk.js
.js
StartPage/Selector/baidu_logo.png
.png
StartPage/Selector/google_logo.png
.png
StartPage/Selector/index.html
.html .js polyglot
StartPage/Selector/pic_daohang.jpg
.jpg
StartPage/Selector/pic_kongbai.jpg
.jpg
StartPage/Selector/pic_sousuo.jpg
.jpg
StartPage/Selector/pic_zuiai.jpg
.jpg
StartPage/Selector/pic_zuiai_1.jpg
.jpg
StartPage/Selector/pic_zuiai_2.jpg
.jpg
StartPage/Selector/s_baidu_logo.png
.png
StartPage/Selector/s_google_logo.png
.png
StartPage/Selector/s_sogou_logo.png
.png
StartPage/Selector/sogou_logo.png
.png
StartPage/Selector/start_body_bg.jpg
.jpg
StartPage/Selector/start_btn_daohang.png
.png
StartPage/Selector/start_btn_daohang_hit.png
.png
StartPage/Selector/start_btn_kongbai.png
.png
StartPage/Selector/start_btn_kongbai_hit.png
.png
StartPage/Selector/start_btn_light.png
.png
StartPage/Selector/start_btn_qita.png
.png
StartPage/Selector/start_btn_queding.png
.png
StartPage/Selector/start_btn_queding_hit.png
.png
StartPage/Selector/start_btn_queding_hover.png
.png
StartPage/Selector/start_btn_sousuo.png
.png
StartPage/Selector/start_btn_sousuo_hit.png
.png
StartPage/Selector/start_btn_zidingyi.png
.png
StartPage/Selector/start_btn_zidingyi_hit.png
.png
StartPage/Selector/start_btn_zuiai.png
.png
StartPage/Selector/start_btn_zuiai_hit.png
.png
StartPage/Selector/start_checkbox_checked.png
.png
StartPage/Selector/start_checkbox_hover.png
.png
StartPage/Selector/start_checkbox_normal.png
.png
StartPage/Selector/start_daohang_logo_bg.png
.png
StartPage/Selector/start_ico_home.gif
.gif
StartPage/Selector/start_stage_arrow_daohang.png
.png
StartPage/Selector/start_stage_arrow_kongbai.png
.png
StartPage/Selector/start_stage_arrow_sousuo.png
.png
StartPage/Selector/start_stage_arrow_zidingyi.png
.png
StartPage/Selector/start_stage_arrow_zuiai.png
.png
StartPage/Selector/start_stage_main.png
.png
StartPage/Selector/start_text_1.png
.png
StartPage/Selector/start_zidingyi_dizhikuang.gif
.gif
StartPage/Selector/start_zidingyi_icon.gif
.gif
StartPage/Selector/start_zidingyi_text.gif
.gif
UserInstruct/download.swf
UserInstruct/passport.swf
UserInstruct/passport_20.swf
UserInstruct/swichcore.swf
UserInstruct/tabscroll.swf
UserInstruct/videoExtract.swf
UserInstruct/videoOnTop.swf
install_flash_player.exe
.exe windows:4 windows x86 arch:x86

8f26fcd857d64db1a0ee4f8bdb240223

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

05-11-2009 00:00

Not After

10-12-2010 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

20:48:94:5f:68:21:8d:e4:3b:ad:16:7b:b7:e5:a9:51:81:b4:ec:fd
Signer

Actual PE Digest

20:48:94:5f:68:21:8d:e4:3b:ad:16:7b:b7:e5:a9:51:81:b4:ec:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
lstrcmpiA
CopyFileA
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
MulDiv
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetCurrentProcess

user32

ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SetForegroundWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

57354bdeea3dfae6e948101add87501a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
GetPrivateProfileIntA
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
MultiByteToWideChar
GlobalAlloc

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
MapWindowPoints
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadIconA

gdi32

SetTextColor
GetObjectA
SelectObject
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
CreateCompatibleDC

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 954B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISArray.dll
.dll windows:4 windows x86 arch:x86

91596216b99c852af6e0fb1fe8192de4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpyA
lstrcpynA
lstrcmpiA
lstrcmpA
lstrcatA
GlobalAlloc

user32

MessageBoxA
SendMessageA
wsprintfA
GetDlgItem
FindWindowExA
DialogBoxParamA
EnableWindow
SetWindowTextA
EndDialog
RedrawWindow
CharLowerA

Exports

Exports

ArrayCount
ArrayExists
Clear
Concat
Copy
Cut
Debug
Delete
ErrorStyle
Exists
ExistsI
FreeUnusedMem
Join
New
Pop
Push
Put
ReDim
Read
ReadToStack
Reverse
Search
SearchI
SetSize
Shift
SizeOf
Sort
Splice
Swap
Unload
Unshift
Write
WriteList
WriteListC

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

48cfa0ea7e353e4a7dd23572da8374ef

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
GetCurrentProcess
GetLastError
GlobalFree
CloseHandle
lstrcpynA
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName

Sections

.text
Size: 1024B - Virtual size: 573B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 45B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/browser_listing.ini
$PLUGINSDIR/nsProcess.dll
.dll windows:4 windows x86 arch:x86

c9fc7f6df8fedf8f8f1f9f820c072664

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
CloseHandle
TerminateProcess
OpenProcess
lstrcmpiA
WideCharToMultiByte
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryA
GetVersionExA
GlobalFree
lstrcpynA
GlobalAlloc

Exports

Exports

_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 646B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 146B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NPSWF32.dll
.dll regsvr32 windows:5 windows x86 arch:x86

15bef043fc940bd27e0ae030bfabec21

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

05-11-2009 00:00

Not After

10-12-2010 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

56:15:fa:58:89:54:13:db:9f:07:51:06:c0:9a:e0:2c:6e:75:b5:ff
Signer

Actual PE Digest

56:15:fa:58:89:54:13:db:9f:07:51:06:c0:9a:e0:2c:6e:75:b5:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\flashfarm\depot\main\player\branches\FlashPlayer\FlashPlayer10_Marlin\platform\win32\obj\NPWin\Release\NPSWF32.pdb

Imports

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

winmm

waveOutGetPosition
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveOutOpen
timeGetTime
waveInGetDevCapsA
waveOutGetDevCapsA
waveInGetNumDevs
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
waveOutClose
waveOutReset
timeGetDevCaps
timeEndPeriod
timeBeginPeriod
timeKillEvent
timeSetEvent
waveOutGetNumDevs

wininet

InternetCloseHandle
HttpQueryInfoA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile

crypt32

CryptGetMessageCertificates
CertCreateCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertCloseStore
CryptVerifyMessageSignature

rpcrt4

RpcStringFreeA
UuidToStringA

oleaut32

LoadRegTypeLi
UnRegisterTypeLi
SysFreeString
SysAllocString
SysStringLen
LoadTypeLi
RegisterTypeLi

urlmon

CopyStgMedium

kernel32

OpenFile
LockResource
LoadResource
SizeofResource
FindResourceA
GetModuleHandleA
DeleteFileA
WriteFile
CreateFileA
GetTempFileNameA
GetCurrentDirectoryA
CreateDirectoryA
GetEnvironmentVariableA
GlobalFree
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
SetThreadPriority
WaitForSingleObject
SetWaitableTimer
CreateThread
CreateWaitableTimerA
GetProcessTimes
GetCurrentProcess
GlobalUnlock
GlobalLock
GetCurrentProcessId
GlobalSize
GlobalAlloc
FreeLibrary
GetSystemInfo
GetSystemDefaultLangID
MoveFileA
GetFileAttributesA
GetUserDefaultLangID
_lwrite
SetFilePointer
ReadFile
GetFileSize
FindResourceExA
FindResourceExW
GetFileAttributesW
SetUnhandledExceptionFilter
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
CreateMutexA
CreateFileW
GetSystemDirectoryA
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
GetFileAttributesExA
SetCurrentDirectoryA
RemoveDirectoryA
SetFilePointerEx
GetFileSizeEx
CreateProcessA
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
TerminateThread
lstrcpyA
IsDBCSLeadByteEx
UnhandledExceptionFilter
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
_lclose
FreeResource
GetModuleFileNameA
lstrlenA
RaiseException
lstrlenW
FlushInstructionCache
LCMapStringW
LCMapStringA
GetTickCount
GetCurrentThreadId
GetLocaleInfoA
SetErrorMode
GetLastError
GetVersionExA
LoadLibraryA
GetProcAddress
GetCurrentThread
SetThreadAffinityMask
VirtualQuery
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ResetEvent
CreateEventA
CloseHandle
WaitForMultipleObjects
SetEvent
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsDebuggerPresent
RtlUnwind
GetCommandLineA
GetModuleHandleW
ReleaseSemaphore
CreateSemaphoreA
VirtualProtect
VirtualFree
VirtualAlloc
HeapFree
GetProcessHeap
HeapAlloc
VirtualProtectEx
HeapReAlloc
HeapCreate
HeapDestroy
ExitProcess
GetOEMCP
IsValidCodePage
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
ExitThread

user32

DialogBoxIndirectParamW
DialogBoxIndirectParamA
EndDialog
GetDesktopWindow
LoadIconA
GetDlgItem
SetWindowTextA
GetMenuItemCount
InsertMenuItemW
GetSystemMetrics
GetClipboardFormatNameA
RegisterClipboardFormatA
GetCapture
SystemParametersInfoA
ScreenToClient
GetMenuItemID
DeleteMenu
InsertMenuItemA
GetMenuItemInfoA
TrackPopupMenu
ReleaseCapture
SetCapture
GetCursorPos
WindowFromPoint
GetParent
CreateWindowExA
GetWindowRect
SetWindowPos
ShowWindow
DestroyWindow
RedrawWindow
SendNotifyMessageA
SetWindowLongA
KillTimer
MapVirtualKeyA
GetClientRect
MessageBoxA
DefWindowProcA
RegisterClassA
PostMessageA
GetFocus
GetTopWindow
LoadStringA
LoadMenuA
GetSubMenu
DestroyMenu
InvalidateRect
LoadCursorA
SetCursor
GetKeyState
BeginPaint
EndPaint
EnableMenuItem
CheckMenuItem
EnumDisplaySettingsA
SetFocus
GetWindowInfo
CopyRect
SendInput
GetKeyboardLayout
FillRect
DialogBoxParamA
DialogBoxParamW
GetForegroundWindow
SendMessageA
WaitForInputIdle
GetDC
ReleaseDC
ClientToScreen
GetMonitorInfoA
OffsetRect
SetRect
MonitorFromWindow
GetDoubleClickTime
IsWindow
GetWindowThreadProcessId
GetWindowLongA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
IsClipboardFormatAvailable
SetTimer
UnregisterClassA

gdi32

BitBlt
SelectObject
RealizePalette
SelectPalette
ExtTextOutA
SetBkColor
CreateSolidBrush
GetDeviceCaps
SetStretchBltMode
GetStretchBltMode
GetClipBox
GetSystemPaletteEntries
Rectangle
GetStockObject
StretchDIBits
LPtoDP
CreateCompatibleBitmap
GetDIBits
DeleteObject
CreateDIBSection
GetObjectA
GetPixel
StretchBlt
DeleteDC
CreateCompatibleDC
CreateDCA
CreateFontIndirectA
GetTextMetricsA
EnumFontFamiliesA
SetBkMode
SetTextAlign
IntersectClipRect
SelectClipRgn
ExtTextOutW
SetTextColor
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
GetBkColor
CreateFontIndirectW
SetWorldTransform
SetGraphicsMode
GetWorldTransform
SetTextCharacterExtra
CreatePen
DPtoLP
GetTextExtentPoint32W
GetCurrentObject
GetTextExtentPoint32A
CreatePalette
StartDocA
EndDoc
StrokePath
ExtCreatePen
FillPath
GdiFlush
RestoreDC
SelectClipPath
StartPage
PolyBezierTo
EndPage
SetPolyFillMode
SaveDC
BeginPath
EndPath
MoveToEx
GetFontData
GetICMProfileA
EnumFontFamiliesExW
LineTo

comdlg32

CommDlgExtendedError
GetSaveFileNameA
PrintDlgA
GetOpenFileNameA

advapi32

RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegCloseKey

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHAppBarMessage
SHBrowseForFolderA

ole32

CreateBindCtx
ReleaseStgMedium
OleUninitialize
CoInitialize
OleGetClipboard
OleFlushClipboard
OleInitialize
CoUninitialize
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
OleIsCurrentClipboard
OleSetClipboard

mscms

OpenColorProfileA
CloseColorProfile
TranslateBitmapBits
DeleteColorTransform
CreateColorTransformW

ws2_32

WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
ntohl
select
gethostname
WSAAddressToStringA
sendto
recvfrom
WSACloseEvent
connect
ioctlsocket
setsockopt
WSASetLastError
getservbyport
gethostbyaddr
htons
getservbyname
htonl
inet_ntoa
gethostbyname
inet_addr
getsockname
ntohs
bind
send
recv
WSAStartup
WSASocketA
socket
WSAAsyncSelect
WSAIoctl
WSAGetLastError
closesocket
WSACleanup

Exports

Exports

DllRegisterServer
DllUnregisterServer
FlashPlayer_10_0_45_2_FlashPlayer
Flash_DisableLocalSecurity
Flash_EnforceLocalSecurity
Java_ShockwaveFlash_CurrentFrame_stub
Java_ShockwaveFlash_FlashVersion_stub
Java_ShockwaveFlash_FrameLoaded_stub
Java_ShockwaveFlash_GetVariable_stub
Java_ShockwaveFlash_GotoFrame_stub
Java_ShockwaveFlash_IsPlaying_stub
Java_ShockwaveFlash_LoadMovie_stub
Java_ShockwaveFlash_Pan_stub
Java_ShockwaveFlash_PercentLoaded_stub
Java_ShockwaveFlash_Play_stub
Java_ShockwaveFlash_SetVariable_stub
Java_ShockwaveFlash_SetZoomRect_stub
Java_ShockwaveFlash_StopPlay_stub
Java_ShockwaveFlash_TCallFrame_stub
Java_ShockwaveFlash_TCallLabel_stub
Java_ShockwaveFlash_TCurrentFrame_stub
Java_ShockwaveFlash_TCurrentLabel_stub
Java_ShockwaveFlash_TGetProperty_stub
Java_ShockwaveFlash_TGotoFrame_stub
Java_ShockwaveFlash_TGotoLabel_stub
Java_ShockwaveFlash_TPlay_stub
Java_ShockwaveFlash_TSetProperty_stub
Java_ShockwaveFlash_TStopPlay_stub
Java_ShockwaveFlash_TotalFrames_stub
Java_ShockwaveFlash_Zoom_stub
NP_GetEntryPoints
NP_Initialize
NP_Shutdown
native_ShockwaveFlash_CurrentFrame
native_ShockwaveFlash_FlashVersion
native_ShockwaveFlash_FrameLoaded
native_ShockwaveFlash_GetVariable
native_ShockwaveFlash_GotoFrame
native_ShockwaveFlash_IsPlaying
native_ShockwaveFlash_LoadMovie
native_ShockwaveFlash_Pan
native_ShockwaveFlash_PercentLoaded
native_ShockwaveFlash_Play
native_ShockwaveFlash_SetVariable
native_ShockwaveFlash_SetZoomRect
native_ShockwaveFlash_StopPlay
native_ShockwaveFlash_TCallFrame
native_ShockwaveFlash_TCallLabel
native_ShockwaveFlash_TCurrentFrame
native_ShockwaveFlash_TCurrentLabel
native_ShockwaveFlash_TGetProperty
native_ShockwaveFlash_TGotoFrame
native_ShockwaveFlash_TGotoLabel
native_ShockwaveFlash_TPlay
native_ShockwaveFlash_TSetProperty
native_ShockwaveFlash_TStopPlay
native_ShockwaveFlash_TotalFrames
native_ShockwaveFlash_Zoom
register_ShockwaveFlash
unregister_ShockwaveFlash
unuse_ShockwaveFlash
unuse_netscape_plugin_Plugin
use_ShockwaveFlash
use_netscape_plugin_Plugin

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512KB - Virtual size: 512KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 107KB - Virtual size: 994KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NPSWF32_FlashUtil.exe
.exe windows:5 windows x86 arch:x86

c8a9f0aa8ca1ec9669a57e97c635955d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

05-11-2009 00:00

Not After

10-12-2010 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

eb:0e:57:6d:c4:56:74:ca:8c:76:34:64:78:f1:fa:56:51:aa:62:27
Signer

Actual PE Digest

eb:0e:57:6d:c4:56:74:ca:8c:76:34:64:78:f1:fa:56:51:aa:62:27

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wininet

InternetCloseHandle
HttpQueryInfoA
InternetReadFile
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA

crypt32

CertVerifySubjectCertificateContext
CryptGetMessageCertificates
CertCloseStore
CertFreeCertificateContext
CryptVerifyMessageSignature
CertFindCertificateInStore
CertCreateCertificateContext

shlwapi

SHDeleteKeyA

kernel32

GetCPInfo
IsDebuggerPresent
GetLastError
CreateMutexA
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetTempPathA
WriteFile
FormatMessageA
_lclose
_lread
OpenFile
GetSystemDirectoryA
SetThreadLocale
GetSystemDefaultLangID
LocalFree
LocalAlloc
GetCurrentProcess
CreateThread
GetModuleHandleA
GetVersionExA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
UnmapViewOfFile
GetTickCount
WaitForSingleObject
ReleaseMutex
WideCharToMultiByte
GetACP
GetFileAttributesA
CreateDirectoryA
DeleteFileA
MultiByteToWideChar
CreateFileW
SetFilePointer
SetFileAttributesA
InterlockedIncrement
InterlockedDecrement
CreateFileMappingA
FindClose
FindNextFileA
FindFirstFileA
CreateProcessA
ExitProcess
GetCommandLineA
TerminateProcess
HeapSize
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetOEMCP
FreeEnvironmentStringsA
Sleep
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
GetStdHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
HeapAlloc
HeapFree
GetStartupInfoA
IsValidCodePage
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
MapViewOfFile
RtlUnwind

user32

GetForegroundWindow
SystemParametersInfoA
WaitForInputIdle
LoadImageA
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
DestroyIcon
LoadCursorA
RegisterClassExA
DefWindowProcA
CreateDialogParamA
SetWindowTextA
CharNextA
CreateWindowExA
GetDlgItem
SetWindowLongA
MessageBoxA
LoadBitmapA
LoadStringA
DialogBoxParamA
EndDialog
GetParent
GetDesktopWindow
GetWindowRect
SetWindowPos
PostMessageA
ShowWindow
SendMessageA
DestroyWindow
PostQuitMessage
DdeInitializeA
DdeDisconnect
DdeUninitialize
DdeClientTransaction
DdeCreateStringHandleA
DdeConnect
DdeFreeStringHandle
ScreenToClient
GetWindowLongA

gdi32

DeleteObject

advapi32

RegDeleteValueA
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
LookupAccountSidA

shell32

ShellExecuteA

ole32

CoRegisterClassObject
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
CoRevokeClassObject

oleaut32

SafeArrayCreateVector
SafeArrayUnaccessData
SafeArrayDestroy
DispInvoke
SysAllocString
SafeArrayAccessData
LoadRegTypeLi
DispGetIDsOfNames

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
flashplayer.xpt
uninstall_plugin.exe.nsis

Sharing

General

Malware Config

Signatures

Files

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 756KB

.rsrc Size: 19KB - Virtual size: 18KB

e26d7460d0c04056b9226a899477ba4d

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 19KB - Virtual size: 19KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 7KB

.reloc Size: 2KB - Virtual size: 1KB

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

d806a080e21508dd768fa70be247d2ae

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 17KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 2KB

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 899B

.data Size: 512B - Virtual size: 64B

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 756KB

.rsrc
Size: 19KB - Virtual size: 18KB

.text
Size: 19KB - Virtual size: 19KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 7KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 20KB - Virtual size: 17KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 899B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 574B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 48B

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 590B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

72:d3:ce:02:eb:71:f7:99:ec:b5:f8:bb:79:66:28:a6
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 404KB - Virtual size: 401KB

.data
Size: 60KB - Virtual size: 89KB

.rsrc
Size: 352KB - Virtual size: 349KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1
Certificate

20:48:94:5f:68:21:8d:e4:3b:ad:16:7b:b7:e5:a9:51:81:b4:ec:fd
Signer