868fe5a04d9a6a0c0dfa9450f73063c6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

868fe5a04d9a6a0c0dfa9450f73063c6_JaffaCakes118
Size

3.0MB
MD5

868fe5a04d9a6a0c0dfa9450f73063c6
SHA1

7d778ee80ca14838906a1745643af7a2486720c8
SHA256

47b71a3397838c558a0add66d4f0532e7e2dca3ea00b566f21d105a8c784b848
SHA512

b2972df555a8ac4ba89065c2a549dab990c63246795d9aed8682b1a1f1809fc7c8078c2c04fff84150a86737bdc8cccd7b79de4beb54bff90afcf57a3c650077
SSDEEP

98304:Mnfwr6nBU9GGJfhcgrQoUikcXaANUf/FTXp:MnG6nIvJZ5QTikci5

Score

3^/10

Malware Config

Signatures

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
868fe5a04d9a6a0c0dfa9450f73063c6_JaffaCakes118
unpack001/$PLUGINSDIR/FileInfo.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Uninstall.exe
unpack005/$PLUGINSDIR/InstallOptions.dll
unpack005/$PLUGINSDIR/KillProcDLL.dll
unpack005/$PLUGINSDIR/System.dll

Files

868fe5a04d9a6a0c0dfa9450f73063c6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/CoralExplorer/FavIcon/3D6A8AC8F2013B0D7A1EA53076E96320.ico
$APPDATA/CoralExplorer/FavIcon/6E086A7049DD129DF69051413AC6AB3A.ico
$APPDATA/CoralExplorer/FavIcon/81C6AF03AC3E2B181DD99A3C1AFD1AA3.ico
$APPDATA/CoralExplorer/FavIcon/85131C29C8F7B398A345BD7F1A51DAB1.ico
$APPDATA/CoralExplorer/FavIcon/8FDEAD446A8D607C20207D38D669E349.ico
$APPDATA/CoralExplorer/FavIcon/A4C4A052651124668E8F829A3AA6D63C.ico
$APPDATA/CoralExplorer/FavIcon/F2A7BED2A1035F9E4EC022B3ECA481A8.ico
$APPDATA/CoralExplorer/FavIcon/default_page.ico
$APPDATA/CoralExplorer/FavIcon/home.ico
$APPDATA/CoralExplorer/Users/Default/SystemUrl.data
$PLUGINSDIR/FileInfo.dll
.dll windows:4 windows x86 arch:x86

f6e384a477f8efc14029bba8fca9bd0f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\program files\nsis\nsis-2.42.6-unicode-src\plugins\FileInfo.pdb

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

SetLastError
lstrcpynW
GlobalFree
lstrcpyW
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
LCMapStringA
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
WriteFile
InitializeCriticalSection
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
GetStringTypeW

user32

wsprintfW

Exports

Exports

GetSpecialBuild

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

cc7109b9c3b24bf2e4cc2be1f2650012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExW
GlobalFree
lstrcpyW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
LCMapStringW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteFile
InitializeCriticalSection
RtlUnwind
HeapSize

Exports

Exports

KillProc

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Config/FavIcon/3D6A8AC8F2013B0D7A1EA53076E96320.ico
Config/FavIcon/6E086A7049DD129DF69051413AC6AB3A.ico
Config/FavIcon/81C6AF03AC3E2B181DD99A3C1AFD1AA3.ico
Config/FavIcon/85131C29C8F7B398A345BD7F1A51DAB1.ico
Config/FavIcon/8FDEAD446A8D607C20207D38D669E349.ico
Config/FavIcon/A4C4A052651124668E8F829A3AA6D63C.ico
Config/FavIcon/F2A7BED2A1035F9E4EC022B3ECA481A8.ico
Config/FavIcon/default_page.ico
Config/FavIcon/home.ico
Config/Users/Default/SystemUrl.data
Coral.dll
.dll windows:4 windows x86 arch:x86

c7884ad39b7fba5a48f40bbfc49dcf4c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

36:6b:c2:bf:35:70:7f:36:1a:ae:0f:68:4d:06:fb:5a:59:20:1f:81
Signer

Actual PE Digest

36:6b:c2:bf:35:70:7f:36:1a:ae:0f:68:4d:06:fb:5a:59:20:1f:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\coral\branches\CoralExplorer_v1.1.3111\build_temp\Win32\Release\CoralCore\Coral.pdb

Imports

kernel32

CreateFileW
CopyFileW
GetFileSize
OpenThread
InterlockedExchangeAdd
ResumeThread
CreateMutexW
ReleaseMutex
GetACP
WideCharToMultiByte
GetFileAttributesW
CreateDirectoryW
DeleteFileW
SetFileAttributesW
GetFullPathNameW
GetTempPathW
GetTempFileNameW
GetWindowsDirectoryW
GetLongPathNameW
FindFirstFileW
FindClose
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
WaitForSingleObject
ReadFile
PeekNamedPipe
ExpandEnvironmentStringsW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GlobalUnlock
GlobalLock
GetUserDefaultLangID
GetVersionExW
TerminateThread
GlobalFree
OpenProcess
GlobalAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
InterlockedExchange
HeapFree
GetProcessHeap
HeapAlloc
WaitForMultipleObjects
ResetEvent
CreateProcessW
CloseHandle
GetCurrentProcess
GetLastError
LoadLibraryExW
GetModuleFileNameW
LeaveCriticalSection
lstrlenW
GetCurrentThreadId
EnterCriticalSection
RaiseException
InterlockedDecrement
MultiByteToWideChar
lstrcmpiW
DeleteCriticalSection
LoadResource
FindResourceW
SizeofResource
GetModuleHandleW
DisableThreadLibraryCalls
FreeLibrary
InitializeCriticalSection
GetProcAddress
LoadLibraryW
Sleep
SetEvent
GetTickCount
CreateEventW
InterlockedIncrement
WriteFile

user32

IsWindowVisible
SendMessageTimeoutW
SetWindowPos
IsWindow
GetWindowThreadProcessId
SetForegroundWindow
DestroyWindow
CharNextW
UnregisterClassA
PostMessageW
MessageBoxW
wsprintfW
GetActiveWindow
GetClipboardData
SetClipboardData
CloseClipboard
RegisterClipboardFormatW
OpenClipboard
LoadStringW
GetWindowLongW
GetWindowPlacement
GetWindowRect
SetFocus
CopyRect
AllowSetForegroundWindow
SendMessageW
InvalidateRect
SystemParametersInfoW
PtInRect

advapi32

RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
GetTokenInformation
CopySid
InitializeSecurityDescriptor
RegSetKeySecurity
OpenProcessToken
AllocateAndInitializeSid
GetSidIdentifierAuthority
InitializeAcl
RegEnumKeyW
AddAce
GetSidSubAuthorityCount
RegGetKeySecurity
GetLengthSid
SetSecurityDescriptorDacl
FreeSid
GetSidSubAuthority
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
SHChangeNotify
ShellExecuteExW
SHFileOperationW

ole32

OleUninitialize
CoTaskMemFree
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
CoTaskMemRealloc
OleInitialize
CoInitialize
CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

SHDeleteKeyW

msvcr80

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
memset
__CxxFrameHandler3
_CxxThrowException
_splitpath_s
_stricmp
memcpy
_beginthreadex
towlower
_vsnwprintf_s
towupper
wcschr
wcsstr
_errno
_swprintf
isalnum
_wcsdup
memmove_s
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
??_V@YAXPAX@Z
malloc
_recalloc
memcpy_s
wcsncpy_s
free
??2@YAPAXI@Z
_purecall
?what@exception@std@@UBEPBDXZ

urlmon

IsValidURL
URLDownloadToFileW

wininet

FindFirstUrlCacheEntryW
InternetCloseHandle
InternetSetOptionW
InternetQueryOptionW
DeleteUrlCacheEntryW
InternetCrackUrlW
GetUrlCacheEntryInfoW
FindCloseUrlCache
FindNextUrlCacheEntryW
InternetOpenW

dnsapi

DnsRecordListFree
DnsQuery_W

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

CoralCreateObject

Sections

.text
Size: 372KB - Virtual size: 372KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Coral.exe
.exe windows:4 windows x86 arch:x86

d822f3a651c14853f1d1287d99641a21

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:32:f6:17:e7:c3:0d:35:b1:80:6c:be:96:d1:20:8d:b2:47:cc:fe
Signer

Actual PE Digest

62:32:f6:17:e7:c3:0d:35:b1:80:6c:be:96:d1:20:8d:b2:47:cc:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\coral\branches\CoralExplorer_v1.1.3111\build_temp\Win32\Release\Coral\Coral.pdb

Imports

kernel32

FreeLibrary
LoadLibraryW
GetModuleFileNameW
GetProcAddress
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CoralApp.dll
.dll windows:4 windows x86 arch:x86

6728fe14c04483ae988f84bc861b6ff6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:81:aa:1e:50:50:b4:3c:a4:0d:da:ad:5b:d7:9d:24:d2:48:2b:2c
Signer

Actual PE Digest

41:81:aa:1e:50:50:b4:3c:a4:0d:da:ad:5b:d7:9d:24:d2:48:2b:2c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\coral\branches\CoralExplorer_v1.1.3111\build_temp\Win32\Release\CoralApp\CoralApp.pdb

Imports

kernel32

InterlockedExchangeAdd
ResumeThread
Sleep
CloseHandle
GetCurrentProcessId
GetVersionExW
OpenProcess
TerminateThread
GetProcAddress
GetACP
GetLocaleInfoA
GetThreadLocale
RaiseException
LeaveCriticalSection
OpenThread
InterlockedIncrement
FindResourceW
GetLastError
GetModuleFileNameW
LoadLibraryExW
GetCurrentThreadId
lstrlenW
LoadLibraryW
EnterCriticalSection
MultiByteToWideChar
InterlockedDecrement
DeleteCriticalSection
lstrcmpiW
InterlockedExchange
GetModuleHandleW
LoadResource
SizeofResource
GetFullPathNameW
CreateDirectoryW
GetFileAttributesW
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
DisableThreadLibraryCalls
InitializeCriticalSection
FreeLibrary
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersionExA

user32

GetClassNameA
GetWindowThreadProcessId
GetDlgItem
FindWindowExA
CharNextW
DestroyWindow
MessageBoxW
UnregisterClassA
GetActiveWindow

advapi32

RegEnumKeyExW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW

shell32

ShellExecuteExW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHFileOperationW

ole32

CoCreateInstance
CoTaskMemAlloc
OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemRealloc

oleaut32

VarUI4FromStr

msvcr80

free
memmove_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
malloc
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
_purecall
_beginthreadex
towlower
towupper
wcschr
_stricmp
_splitpath_s
_CxxThrowException
__CxxFrameHandler3
memset
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
memcpy_s
??2@YAPAXI@Z
??_V@YAXPAX@Z
_recalloc
??3@YAXPAX@Z
wcsncpy_s
memcpy

gdiplus

GdiplusStartup
GdiplusShutdown

Exports

Exports

LoadCoralApp

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralDb.dll
.dll windows:4 windows x86 arch:x86

cda5f5f654c97924506513545d72a087

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b0:b3:14:8f:02:91:2f:59:ff:96:5a:99:d4:f7:13:86:cb:91:66:67
Signer

Actual PE Digest

b0:b3:14:8f:02:91:2f:59:ff:96:5a:99:d4:f7:13:86:cb:91:66:67

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\coral\branches\CoralExplorer_v1.1.3111\build_temp\Win32\Release\CoralDb\CoralDb.pdb

Imports

kernel32

CopyFileW
SetEndOfFile
GetFileSize
WriteFile
ReadFile
CreateFileW
SetFilePointer
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
FindFirstFileW
FindClose
FindNextFileW
GetProcAddress
GetModuleFileNameW
LoadLibraryW
FreeLibrary
GetTempFileNameW
MoveFileExW
GetWindowsDirectoryW
GetLongPathNameW
MoveFileW
lstrlenW
GetFullPathNameW
GetTempPathW
GetCurrentProcessId
UnlockFile
GetTempPathA
LockFile
LocalFree
CreateDirectoryW
GetSystemTime
UnlockFileEx
AreFileApisANSI
DeleteFileA
GetSystemTimeAsFileTime
FormatMessageA
WideCharToMultiByte
Sleep
FormatMessageW
GetVersionExW
GetFileAttributesA
MultiByteToWideChar
FlushFileBuffers
LockFileEx
GetDiskFreeSpaceW
GetFullPathNameA
LoadLibraryA
CreateFileA
CreateFileMappingW
GetDiskFreeSpaceA
MapViewOfFile
GetSystemInfo
UnmapViewOfFile
GetFileAttributesExW
QueryPerformanceCounter
InterlockedCompareExchange
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
SetFileAttributesW
DeleteFileW
GetLastError
GetFileAttributesW
DisableThreadLibraryCalls
WaitForSingleObject
CloseHandle
CreateMutexW
ReleaseMutex
InterlockedExchangeAdd
GetSystemDefaultLangID
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedExchange
FindResourceW
GetModuleHandleW
GetTickCount

user32

GetDesktopWindow
GetDC
DrawIconEx
LoadStringW
LoadImageW
DestroyIcon
GetIconInfo
ReleaseDC

gdi32

CreateCompatibleDC
CreateSolidBrush
GetObjectW
DeleteDC
BitBlt
DeleteObject
SelectObject

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

msvcr80

??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
memmove_s
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
free
??_V@YAXPAX@Z
malloc
swprintf_s
wcschr
towupper
_vsnwprintf_s
towlower
_errno
_localtime64
atoi
memmove
realloc
strncmp
_localtime64_s
qsort
_CxxThrowException
__CxxFrameHandler3
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
memcpy_s
?what@exception@std@@UBEPBDXZ
memset

gdiplus

GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetCrackUrlW

Exports

Exports

CoralCreateObject

Sections

.text
Size: 741KB - Virtual size: 741KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralDownload.dll
.dll windows:4 windows x86 arch:x86

599c090f1bf12475b2c1a0839cfdf9fb

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d8:d6:c8:63:8f:da:7d:c5:27:1c:e6:6c:98:88:8d:65:48:e1:18:40
Signer

Actual PE Digest

d8:d6:c8:63:8f:da:7d:c5:27:1c:e6:6c:98:88:8d:65:48:e1:18:40

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\coral\branches\CoralExplorer_v1.1.3111\build_temp\Win32\Release\CoralDownload\CoralDownload.pdb

Imports

wininet

HttpQueryInfoW
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
InternetSetOptionW

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DisableThreadLibraryCalls
CreateFileW
Sleep
WriteFile
CloseHandle
GetTickCount
InterlockedExchangeAdd

msvcr80

_except_handler4_common
memset
??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal

Exports

Exports

CoralCreateObject

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralRender.dll
.dll windows:4 windows x86 arch:x86

ff6cfc4a2abc9c3199d828f05395083f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a6:ea:46:34:4c:8a:7d:4b:fe:21:ac:37:0e:6c:42:9f:c6:c3:b0:54
Signer

Actual PE Digest

a6:ea:46:34:4c:8a:7d:4b:fe:21:ac:37:0e:6c:42:9f:c6:c3:b0:54

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\coral\branches\CoralExplorer_v1.1.3111\build_temp\Win32\Release\CoralRender\CoralRender.pdb

Imports

wininet

InternetOpenW
InternetQueryOptionW
InternetCloseHandle
InternetSetOptionW

kernel32

DeleteCriticalSection
InitializeCriticalSection
GetLastError
CreateEventW
WaitForSingleObject
SetEvent
CloseHandle
ResetEvent
GetCurrentThreadId
ResumeThread
WaitNamedPipeW
SetNamedPipeHandleState
CreateFileW
WriteFile
ReadFile
PeekNamedPipe
GlobalFree
WriteProcessMemory
GetProcAddress
FreeLibrary
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
GetVersionExW
GetTickCount
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
EnterCriticalSection
LeaveCriticalSection
InterlockedExchangeAdd
Sleep
GetCurrentProcess
DisableThreadLibraryCalls
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime

user32

DispatchMessageW
PostThreadMessageW
wsprintfW
GetMessageW
PeekMessageW
TranslateMessage

ole32

CoCreateGuid

msvcr80

__clean_type_info_names_internal
_except_handler4_common
??2@YAPAXI@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_onexit
_lock
__dllonexit
memset
??3@YAXPAX@Z
_purecall
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
memmove_s
memcpy_s
_invalid_parameter_noinfo
_vsnwprintf_s
_errno
??_V@YAXPAX@Z
_beginthreadex
_CxxThrowException
__CxxFrameHandler3
_encode_pointer
_malloc_crt
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
_unlock

gdiplus

GdiplusShutdown
GdiplusStartup

winmm

waveOutWrite
midiStreamOut

Exports

Exports

CoralCreateObject

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralTrident.dll
.dll windows:4 windows x86 arch:x86

45e5ded337fce1eafe7b1cd55974e367

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fa:7b:14:66:7a:57:68:1c:7b:c9:8b:c6:34:fd:a2:68:cb:32:8b:27
Signer

Actual PE Digest

fa:7b:14:66:7a:57:68:1c:7b:c9:8b:c6:34:fd:a2:68:cb:32:8b:27

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\coral\branches\CoralExplorer_v1.1.3111\build_temp\Win32\Release\CoralTrident\CoralTrident.pdb

Imports

kernel32

GetFileAttributesW
FindFirstFileW
FindClose
GlobalFree
LocalAlloc
LocalFree
GetUserDefaultLangID
GetFullPathNameW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
GetVersionExA
GetACP
ResumeThread
FreeResource
InterlockedExchange
LockResource
GetVersionExW
FindResourceExW
GetSystemDefaultLangID
InterlockedExchangeAdd
GetProcAddress
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcmpW
GetModuleFileNameW
GetTickCount
LoadLibraryW
CreateEventW
CloseHandle
SetEvent
Sleep
WaitForSingleObject
FlushInstructionCache
SetLastError
GetCurrentProcess
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
lstrlenW
LoadResource
LeaveCriticalSection
GetModuleHandleW
GetLastError
LoadLibraryExW
EnterCriticalSection
MultiByteToWideChar
GetCurrentThreadId
FreeLibrary
lstrcmpiW
RaiseException
DisableThreadLibraryCalls
FindResourceW
SizeofResource

user32

SetWindowLongW
CharUpperBuffW
CharNextW
MoveWindow
UnregisterClassA
SetCursor
InflateRect
GetKeyState
mouse_event
GetWindowRect
ScreenToClient
GetCursorPos
DestroyWindow
CreateAcceleratorTableW
GetSysColor
GetFocus
CreateWindowExW
GetTopWindow
InvalidateRect
GetClientRect
GetClassInfoExW
ShowWindow
DeleteMenu
InsertMenuW
GetMenuStringW
GetWindow
SetClassLongW
RegisterClassExW
LoadCursorW
AllowSetForegroundWindow
FindWindowExW
ReleaseDC
GetDesktopWindow
SetMenuItemInfoW
SetForegroundWindow
DestroyMenu
RedrawWindow
GetClassNameW
IsWindowEnabled
FillRect
SendMessageTimeoutW
GetClassLongW
IsWindowVisible
GetWindowTextW
GetWindowThreadProcessId
EnableWindow
InvalidateRgn
WindowFromPoint
PostQuitMessage
BeginPaint
SendDlgItemMessageW
GetKeyboardLayout
DefWindowProcW
GetDC
ClientToScreen
ReleaseCapture
IsChild
CallWindowProcW
GetWindowTextLengthW
GetWindowLongW
SetWindowTextW
GetNextDlgGroupItem
LoadIconW
DestroyAcceleratorTable
SetWindowPos
SetCapture
SystemParametersInfoW
SetWindowsHookExW
MenuItemFromPoint
RemovePropW
CallNextHookEx
SetPropW
GetPropW
UnhookWindowsHookEx
GetWindowDC
CopyRect
SetRect
OffsetRect
DrawTextW
KillTimer
UpdateWindow
SetTimer
PtInRect
IsWindow
LoadMenuW
GetForegroundWindow
GetSubMenu
GetMenuItemCount
GetMenuItemID
SendMessageW
TrackPopupMenu
GetMenuItemInfoW
FindWindowExA
GetDlgItem
SetActiveWindow
GetParent
GetClassNameA
PostMessageW
LoadStringW
MessageBoxW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
RegisterWindowMessageW
IsMenu
EndPaint
ActivateKeyboardLayout
SetFocus
GetSystemMetrics

gdi32

GetBkMode
SetTextColor
LineTo
SetBkMode
SetBkColor
MoveToEx
GetCurrentObject
SetViewportOrgEx
CreateFontIndirectW
ExtTextOutW
CreatePen
IntersectClipRect
Polyline
ExtCreatePen
StretchBlt
CreateDIBSection
GetObjectW
DeleteDC
CreateSolidBrush
CreateCompatibleBitmap
DeleteObject
GetStockObject
CreateCompatibleDC
GetDeviceCaps
BitBlt
GetTextExtentPoint32W
SelectObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegOpenKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey

shell32

DragQueryFileW

ole32

CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoTaskMemAlloc
ReleaseStgMedium
OleUninitialize
StringFromGUID2
OleInitialize
CoGetInterfaceAndReleaseStream
CreateStreamOnHGlobal
CoGetClassObject
CoTaskMemFree
CLSIDFromProgID
OleLockRunning
CreateBindCtx
CoUninitialize
CoInitialize
CLSIDFromString
CoTaskMemRealloc

oleaut32

VarUI4FromStr
SysAllocString
VariantChangeType
VariantClear
SysStringLen
VariantInit
VarBstrCmp
SysStringByteLen
LoadRegTypeLi
OleCreateFontIndirect
DispCallFunc
LoadTypeLi
SysAllocStringLen
SysFreeString

shlwapi

PathFindExtensionW

comctl32

ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Draw
ImageList_Create

msimg32

AlphaBlend

urlmon

RegisterBindStatusCallback
CoInternetGetSession
CreateURLMoniker

msvcr80

_CIexp
_CIsqrt
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
memset
__CxxFrameHandler3
_CxxThrowException
_CIacos
wcschr
_errno
towlower
_vsnwprintf_s
towupper
_wcsicmp
wcsspn
wcscspn
_resetstkoflw
wcscpy_s
swprintf_s
__RTDynamicCast
_beginthreadex
wcsstr
_purecall
calloc
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
memcpy
memmove_s
??_V@YAXPAX@Z
malloc
??2@YAPAXI@Z
wcsncpy_s
_recalloc
memcpy_s
free
??3@YAXPAX@Z
?what@exception@std@@UBEPBDXZ

gdiplus

GdipCreateBitmapFromStream
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipGraphicsClear
GdipGetImageThumbnail
GdipCreateBitmapFromScan0
GdiplusShutdown
GdipDisposeImage
GdiplusStartup
GdipGetImageEncodersSize
GdipAlloc
GdipFree
GdipSaveImageToFile
GdipCloneImage
GdipCreateHBITMAPFromBitmap
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wininet

InternetCrackUrlW
GetUrlCacheEntryInfoW
DeleteUrlCacheEntryW

dnsapi

DnsRecordListFree
DnsQuery_W

Exports

Exports

CoralCreateObject

Sections

.text
Size: 317KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralUI.dll
.dll windows:4 windows x86 arch:x86

548169b92ba5dc7ef74d7f977d7951df

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b2:62:d1:2d:ed:04:74:30:89:71:db:cd:bc:51:d8:bd:f4:ec:92:16
Signer

Actual PE Digest

b2:62:d1:2d:ed:04:74:30:89:71:db:cd:bc:51:d8:bd:f4:ec:92:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\coral\branches\CoralExplorer_v1.1.3111\build_temp\Win32\Release\CoralUI\CoralUI.pdb

Imports

gdiplus

GdipDrawImageRectI
GdipFree
GdipGetImageGraphicsContext
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipGetImageThumbnail
GdipCreateHBITMAPFromBitmap
GdipDeleteGraphics
GdipGraphicsClear

kernel32

FileTimeToSystemTime
WriteFile
ReadFile
GetFullPathNameW
GetTempPathW
GetTempFileNameW
GetWindowsDirectoryW
GetLongPathNameW
LocalAlloc
LocalFree
GlobalFree
FindFirstFileW
SetFilePointer
CreateFileW
GetFileSize
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
DisableThreadLibraryCalls
InterlockedIncrement
LoadResource
EnterCriticalSection
GetModuleHandleW
GetModuleFileNameW
SizeofResource
MultiByteToWideChar
LeaveCriticalSection
DeleteCriticalSection
lstrlenW
GetLastError
lstrcmpiW
WideCharToMultiByte
LoadLibraryExW
InitializeCriticalSection
RaiseException
InterlockedDecrement
FreeLibrary
FlushInstructionCache
GetCurrentProcess
SetLastError
GetCurrentThreadId
GlobalAlloc
GlobalUnlock
GlobalLock
MulDiv
lstrcmpW
CompareStringW
GetVersionExW
GetTickCount
InterlockedExchange
LoadLibraryW
GetProcAddress
InterlockedExchangeAdd
FreeResource
LockResource
SwitchToThread
WaitForSingleObject
HeapFree
GetThreadLocale
GetLocaleInfoA
CloseHandle
ResumeThread
Sleep
ResetEvent
CreateEventW
VirtualAlloc
SetEvent
DeleteFileW
SetFileAttributesW
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
GetACP
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
FindNextFileW
FindResourceW
FindClose
CreateDirectoryW
GetFileAttributesW
InterlockedCompareExchange

user32

CloseClipboard
IsRectEmpty
SetRect
SetMenu
DrawEdge
GetMenu
DrawMenuBar
GetMessagePos
SetMenuInfo
GetMenuState
GetMenuItemID
GetMenuStringW
ModifyMenuW
DeleteMenu
RemovePropW
GetPropW
KillTimer
SetPropW
IsDialogMessageW
EndDialog
SetMenuItemInfoW
FrameRect
DrawIconEx
GetWindowDC
CharPrevW
MapVirtualKeyW
SendMessageTimeoutW
DrawFocusRect
GetWindowThreadProcessId
CopyRect
SetWindowRgn
SetForegroundWindow
GetMenuItemCount
GetDlgCtrlID
GetSystemMenu
GetMenuItemInfoW
GetForegroundWindow
DestroyMenu
EnableMenuItem
SetRectEmpty
GetWindowPlacement
TranslateAcceleratorW
GetLastActivePopup
MapWindowPoints
GetMonitorInfoW
AllowSetForegroundWindow
IsIconic
OpenClipboard
GetClipboardData
GetClassInfoW
IsClipboardFormatAvailable
SetCaretPos
HideCaret
GetCaretPos
MapVirtualKeyExW
GetKeyboardLayout
CharLowerBuffW
SetCursor
MonitorFromPoint
GetKeyState
GetWindowRect
ShowWindow
UpdateWindow
CheckMenuItem
OffsetRect
PostQuitMessage
LoadStringA
RegisterClipboardFormatW
CreatePopupMenu
DrawTextW
GetKeyNameTextW
IsMenu
keybd_event
GetSubMenu
TrackPopupMenuEx
RemoveMenu
AttachThreadInput
SetClipboardData
MessageBoxW
MenuItemFromPoint
CallNextHookEx
InflateRect
SetWindowsHookExW
UnhookWindowsHookEx
CreateDialogParamW
EnableWindow
IsHungAppWindow
GetMenuItemRect
SystemParametersInfoW
MonitorFromWindow
PtInRect
DialogBoxParamW
AppendMenuW
GetCapture
TrackPopupMenu
IsWindowEnabled
BringWindowToTop
SetActiveWindow
GetActiveWindow
DestroyAcceleratorTable
ReleaseDC
InvalidateRgn
GetDlgItem
GetMessageW
PostThreadMessageW
GetFocus
RegisterWindowMessageW
MoveWindow
EndPaint
RedrawWindow
SendMessageW
PeekMessageW
DestroyWindow
GetDesktopWindow
GetClientRect
BeginPaint
GetSysColor
IsChild
GetWindow
ClientToScreen
GetDC
InvalidateRect
IsWindow
ScreenToClient
ReleaseCapture
DispatchMessageW
GetParent
CreateAcceleratorTableW
SetCapture
GetWindowTextW
LoadStringW
GetWindowTextLengthW
SetFocus
TranslateMessage
FillRect
SetWindowTextW
LoadAcceleratorsW
LoadMenuW
GetClassNameW
CallWindowProcW
RegisterClassExW
DefWindowProcW
PostMessageW
SetWindowPos
GetClassInfoExW
SetWindowLongW
GetSystemMetrics
IsWindowVisible
GetWindowLongW
LoadCursorW
CreateWindowExW
GetCursorPos
GetDoubleClickTime
MessageBeep
DestroyIcon
LoadIconW
LoadImageW
CharNextW
UnregisterClassA
GetClassLongW
SetClassLongW
SetWindowPlacement
WindowFromPoint
SetTimer

gdi32

PatBlt
CreatePatternBrush
CreateBitmap
SelectClipRgn
SetTextAlign
TextOutW
CreateRectRgnIndirect
GetDIBits
StretchBlt
CreateDIBSection
GetTextColor
CreatePen
CreateRectRgn
SetWindowOrgEx
OffsetWindowOrgEx
GetBkColor
GetBkMode
LineTo
GetTextExtentPoint32W
GetCurrentObject
IntersectClipRect
CreateDCW
SetBitmapBits
GetBitmapBits
ExtTextOutW
SetTextColor
SetBkColor
SetBkMode
CreatePolygonRgn
CreateFontIndirectW
CreateCompatibleDC
CreateSolidBrush
SelectObject
GetDeviceCaps
CreateCompatibleBitmap
SetViewportOrgEx
MoveToEx
GetTextMetricsW
GetStockObject
GetObjectW
BitBlt
DeleteDC
DeleteObject
CombineRgn

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
RegOpenKeyExA
RegEnumKeyExW

shell32

SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2
OleInitialize
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromString
OleUninitialize
CLSIDFromProgID
OleDuplicateData
ReleaseStgMedium
DoDragDrop
RevokeDragDrop
RegisterDragDrop
CoUninitialize
CoInitialize
CoGetClassObject

oleaut32

LoadRegTypeLi
SysStringLen
VariantClear
VariantInit
SysStringByteLen
LoadTypeLi
OleCreateFontIndirect
SysAllocString
SysAllocStringLen
VarUI4FromStr
SysFreeString

msvcr80

??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
free
memcpy_s
malloc
_recalloc
wcsncpy_s
??_V@YAXPAX@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
swprintf_s
vswprintf_s
wcscpy_s
strncpy_s
_wtoi
__RTDynamicCast
wcschr
towupper
_vsnwprintf_s
towlower
_errno
_beginthreadex
_time64
_mktime64
_localtime64
memmove
memchr
memcpy
_CxxThrowException
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
memmove_s
memset
__CxxFrameHandler3

comctl32

ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Destroy
InitCommonControlsEx
_TrackMouseEvent
ImageList_SetBkColor
ImageList_LoadImageW
ImageList_GetImageCount
ImageList_Draw
ImageList_Create

msimg32

AlphaBlend
GradientFill

imm32

ImmReleaseContext
ImmGetCompositionStringW
ImmGetContext

winmm

timeSetEvent
timeKillEvent

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wininet

InternetReadFile
InternetQueryOptionW
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetSetOptionW
InternetCrackUrlW

dnsapi

DnsQuery_W
DnsRecordListFree

Exports

Exports

CoralCreateObject

Sections

.text
Size: 950KB - Virtual size: 950KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralUI2.dll
.dll windows:4 windows x86 arch:x86

0642967323a43cc509a82f763496abd6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b0:9f:82:c4:61:d0:23:3d:1a:48:17:7b:dd:9f:23:b7:d6:dd:44:3c
Signer

Actual PE Digest

b0:9f:82:c4:61:d0:23:3d:1a:48:17:7b:dd:9f:23:b7:d6:dd:44:3c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\coral\branches\DirectUI\SVNServer\DirectUI\Build\CoralUI2.pdb

Imports

kernel32

GetThreadLocale
GetLocaleInfoA
InterlockedCompareExchange
InterlockedExchange
GetVersionExA
HeapFree
GetProcessHeap
Sleep
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
EnterCriticalSection
GetSystemTimeAsFileTime
GetCurrentThreadId
GetFileSize
FileTimeToSystemTime
FileTimeToDosDateTime
GetFileInformationByHandle
GetLocalTime
SystemTimeToFileTime
GetFileType
SetFilePointer
ReadFile
LockResource
FreeResource
CopyFileW
DeleteFileW
CreateEventW
GetCurrentProcess
SetProcessWorkingSetSize
GetTickCount
GetTempPathW
WideCharToMultiByte
lstrlenA
GetCurrentDirectoryW
UnmapViewOfFile
LoadLibraryExW
GetLastError
LoadResource
MultiByteToWideChar
GetModuleHandleW
lstrcmpiW
FindResourceW
RaiseException
SizeofResource
DisableThreadLibraryCalls
InterlockedIncrement
DeleteCriticalSection
IsBadReadPtr
GetVersionExW
FreeLibrary
InitializeCriticalSection
GetProcAddress
LoadLibraryW
GlobalUnlock
GlobalFree
GlobalAlloc
WriteFile
CreateFileW
CloseHandle
GlobalLock
InterlockedDecrement
GetModuleFileNameW
LeaveCriticalSection
lstrlenW
GetACP

user32

GetWindowTextLengthW
DestroyWindow
GetWindowTextW
SendMessageW
MoveWindow
UnregisterClassA
GetDC
SetTimer
SetWindowPos
MessageBoxW
IsWindowEnabled
IsWindowVisible
GetActiveWindow
IsZoomed
InvalidateRect
GetWindowLongW
SetCapture
BringWindowToTop
GetWindowRect
IsWindow
GetIconInfo
DrawIconEx
SetParent
ReleaseDC
SetCursor
RedrawWindow
CopyRect
ShowWindow
CreateWindowExW
SetWindowLongW
SetFocus
SetWindowTextW
DestroyMenu
GetParent
CloseWindow
KillTimer
SetActiveWindow
GetDlgCtrlID
LockWindowUpdate
GetClientRect
GetDlgItem
PostMessageW
EnableWindow
UpdateWindow
GetCapture
CharNextW
SetRectEmpty
RemovePropW
SetPropW
GetWindow
GetSystemMetrics
GetTopWindow
GetMonitorInfoW
GetDesktopWindow
SetWindowRgn
BeginDeferWindowPos
EqualRect
OffsetRect
ReleaseCapture
ScreenToClient
EnableMenuItem
EndDeferWindowPos
GetClassNameW
UpdateLayeredWindow
GetCursorPos
GetKeyState
IsRectEmpty
ClientToScreen
GetPropW
IntersectRect
DestroyCursor
MonitorFromWindow
PtInRect
EndPaint
InflateRect
BeginPaint
DefWindowProcW
SystemParametersInfoW
GetSystemMenu
GetSysColor
DrawTextW
UnionRect
GetSubMenu
GetClassLongW
CreatePopupMenu
DeleteMenu
SetRect
IsMenu
GetMenuItemCount
GetMenuItemID
InsertMenuW
LoadImageW
RemoveMenu
CallNextHookEx
UnhookWindowsHookEx
MonitorFromPoint
GetForegroundWindow
SetWindowsHookExW
TrackPopupMenuEx
LoadMenuW
DeferWindowPos
GetMessagePos
GetWindowDC
GetDoubleClickTime
TrackPopupMenu
IsIconic
DestroyIcon
GetFocus
GetAsyncKeyState
CallWindowProcW
GetMenuStringW
GetMenuItemInfoW
ModifyMenuW
AppendMenuW
LoadCursorW

gdi32

CreateRectRgn
SetViewportOrgEx
CreateCompatibleDC
SetRectRgn
CombineRgn
PatBlt
SelectClipRgn
CreateCompatibleBitmap
CreateBitmap
CreatePen
CreateFontIndirectW
PolyDraw
EndPath
SetBkMode
MoveToEx
CreateSolidBrush
GetRegionData
GetWindowOrgEx
FillPath
ExtCreateRegion
BeginPath
CreateRectRgnIndirect
PolyBezierTo
LineTo
SetTextColor
WidenPath
CreateICW
SetDIBits
SetBkColor
ExtTextOutW
GetCurrentObject
CreateDIBSection
IntersectClipRect
SetWindowOrgEx
PtInRegion
CreatePatternBrush
GetClipBox
OffsetRgn
DeleteObject
BitBlt
SelectObject
RealizePalette
CreateDCW
DeleteDC
GetStockObject
GetDIBits
SelectPalette
GetObjectW
GetPath
GetDeviceCaps

advapi32

RegDeleteKeyW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey

shell32

ShellExecuteW

ole32

CoCreateGuid
CoFreeUnusedLibraries
CreateStreamOnHGlobal
StringFromGUID2
CoInitialize
CoUninitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CLSIDFromString

oleaut32

VariantInit
VariantClear
LoadRegTypeLi
LoadTypeLi
SysStringLen
SysFreeString
VariantChangeType
OleTranslateColor
SysAllocString
SafeArrayGetLBound
SafeArrayRedim
SafeArrayGetElement
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayCreate
SafeArrayPutElement
VarBstrCat
SysAllocStringByteLen
SysAllocStringLen
SysStringByteLen
VariantCopy
VarUI4FromStr

comctl32

ImageList_GetImageCount
ImageList_LoadImageW
ImageList_Destroy
ImageList_GetIcon
ImageList_GetImageInfo
_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipCloneBitmapAreaI
GdipFillPieI
GdipCreateTexture
GdipCreateHICONFromBitmap
GdipDrawImageI
GdipSetSmoothingMode
GdipMeasureString
GdipBitmapUnlockBits
GdipDeleteFont
GdipBitmapLockBits
GdipDrawString
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipCreateBitmapFromFile
GdipSetTextRenderingHint
GdipGetImageWidth
GdipSetInterpolationMode
GdipSetStringFormatTrimming
GdipCreateStringFormat
GdipSetStringFormatHotkeyPrefix
GdipGetImageHeight
GdipGetStringFormatFlags
GdipGetImageGraphicsContext
GdipSetCompositingQuality
GdipCreateBitmapFromStream
GdipSetStringFormatFlags
GdipCreateFontFromLogfontW
GdipCreateHBITMAPFromBitmap
GdipSetStringFormatLineAlign
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHICON
GdipCreateLineBrushFromRectWithAngleI
GdipDrawImageRectI
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneBrush
GdipAlloc
GdipFree
GdipCreateFromHDC
GdipDeleteBrush
GdipDeleteGraphics
GdipCreateSolidFill
GdipFillRectangleI

msvcr80

wcstoul
wcschr
atoi
_wtoi
_wcsicmp
__RTDynamicCast
vswprintf_s
_waccess
sscanf_s
_stricmp
fclose
vsprintf_s
fseek
fopen_s
strcpy_s
fread
_wfopen_s
strcat_s
fwrite
_vsnprintf_s
ftell
wcscpy_s
swprintf_s
wcscat_s
strncpy_s
wcsncpy_s
_resetstkoflw
malloc
memmove_s
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
calloc
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
_recalloc
?what@exception@std@@UBEPBDXZ
_invalid_parameter_noinfo
_purecall
memcpy_s
free
??_V@YAXPAX@Z
memchr
??3@YAXPAX@Z
_tzset
_wcsnicmp
toupper
strchr
fprintf
ferror
fputc
isalnum
isspace
tolower
isalpha
strncmp
memset
__CxxFrameHandler3
_CxxThrowException
memcpy
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
??2@YAPAXI@Z
floor
_mktime64

rpcrt4

UuidFromStringW

Exports

Exports

CloseSkin
OpenSkin

Sections

.text
Size: 714KB - Virtual size: 713KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralUpdate.dll
.dll windows:4 windows x86 arch:x86

6362dfb64d589f619316e47ae17a7192

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:38:3a:1c:c9:87:75:ed:03:17:7d:d4:c4:e2:26:80:ee:17:04:db
Signer

Actual PE Digest

75:38:3a:1c:c9:87:75:ed:03:17:7d:d4:c4:e2:26:80:ee:17:04:db

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\coral\branches\CoralExplorer_v1.1.3111\build_temp\Win32\Release\CoralUpdate\CoralUpdate.pdb

Imports

wininet

HttpOpenRequestW
InternetCloseHandle
InternetOpenW
InternetOpenUrlW
InternetReadFile
HttpQueryInfoW
InternetCrackUrlW
HttpAddRequestHeadersW
HttpSendRequestW
HttpEndRequestW
InternetSetOptionW
HttpSendRequestExW
InternetConnectW
InternetWriteFile

kernel32

DeleteCriticalSection
Sleep
MultiByteToWideChar
GetLastError
GetModuleFileNameW
GetCurrentThreadId
LoadLibraryExW
FindResourceW
GetModuleHandleW
InterlockedDecrement
FlushInstructionCache
InterlockedExchange
lstrlenW
SetLastError
EnterCriticalSection
lstrcmpiW
RaiseException
FreeLibrary
GetCurrentProcess
InitializeCriticalSection
SetPriorityClass
CreateFileW
DeviceIoControl
CloseHandle
GetVersionExW
WritePrivateProfileStringW
GetPrivateProfileStringW
DeleteFileW
GetFileAttributesW
CopyFileW
GetTickCount
LoadLibraryW
GetComputerNameW
MoveFileW
WriteFile
WaitForSingleObject
InterlockedExchangeAdd
GetACP
WideCharToMultiByte
GetTempFileNameW
LoadLibraryA
SetFileTime
GetWindowsDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
GetLongPathNameW
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
GetTempPathW
FindNextFileW
FindFirstFileW
FindClose
SetEndOfFile
GetFileSize
ReadFile
SetFilePointer
ResumeThread
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTime
SystemTimeToFileTime
FormatMessageW
LocalFree
TerminateProcess
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
OpenProcess
VirtualFree
VirtualAlloc
LoadResource
GetProcAddress
SizeofResource
CreateMutexW
LeaveCriticalSection
InterlockedIncrement
DisableThreadLibraryCalls
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
GetVersionExA
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
ExpandEnvironmentStringsW

user32

LoadStringW
GetClassInfoExW
GetSubMenu
GetMenuDefaultItem
SetMenuDefaultItem
LoadMenuW
TrackPopupMenu
RegisterWindowMessageW
CreateWindowExW
RegisterClassExW
GetCursorPos
LoadCursorW
CallWindowProcW
GetActiveWindow
PostMessageW
SetDlgItemTextW
IsWindowVisible
DialogBoxParamW
SetTimer
EnableWindow
IsIconic
KillTimer
IsDialogMessageW
PostQuitMessage
CharNextW
TranslateMessage
DefWindowProcW
PeekMessageW
CreateDialogParamW
GetMessageW
DestroyWindow
DispatchMessageW
SetWindowPos
GetWindowRect
SetWindowTextW
SendMessageW
DestroyMenu
IsMenu
GetSystemMenu
SetWindowLongW
GetParent
ModifyMenuW
MapWindowPoints
GetWindowLongW
LoadImageW
LoadIconW
GetSystemMetrics
SystemParametersInfoW
GetWindow
EndDialog
GetClientRect
IsWindow
DestroyIcon
ShowWindow
SetForegroundWindow
GetDlgItem
UnregisterClassA
MessageBoxW

gdi32

DeleteObject
CreateFontIndirectW

advapi32

RegCreateKeyExW
RegDeleteKeyW
GetUserNameW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW

shell32

SHGetSpecialFolderLocation
Shell_NotifyIconW
ShellExecuteExW
SHFileOperationW
SHGetPathFromIDListW
ShellExecuteW
SHChangeNotify

ole32

CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoInitialize

oleaut32

VarUI4FromStr

msvcr80

_beginthreadex
swprintf_s
_except_handler4_common
towlower
_vsnwprintf_s
towupper
wcschr
_errno
memmove
rand
_wtoi
srand
_localtime64_s
vswprintf_s
swscanf_s
_vswprintf_c_l
_vswprintf
_invalid_parameter_noinfo
strncpy
_recalloc
free
malloc
??0exception@std@@QAE@XZ
_time64
wcsncpy_s
_purecall
??_V@YAXPAX@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
memcpy_s
memmove_s
??2@YAPAXI@Z
wcscpy_s
_stricmp
_splitpath_s
memcpy
_CxxThrowException
__CxxFrameHandler3
?terminate@@YAXXZ
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_unlock
__dllonexit
_lock
_onexit
??3@YAXPAX@Z
__clean_type_info_names_internal
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
memset

shlwapi

SHDeleteKeyW

comctl32

InitCommonControlsEx

Exports

Exports

CoralCreateObject

Sections

.text
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Microsoft.VC80.CRT.manifest
Skins/Coral.dui
.zip
objects.xml
.xml
plugin.xml
.xml
Skins/Coral.skn
.zip
Close_Btn.png
CoralSkinPreview.png
.png
Coral_Logo.png
Find_Next.png
Find_Prev.png
Findbar_Resault_Icon.png
Findbar_Select item_big.png
Findbar_select item_small.png
Float 2.png
Float.png
FullScreenExitButton.png
IE6_Menubar.png
.png
IE6_devide.PNG
.png
LeftRight.png
Left_Border.png
.png
Main_Background.png
.png
ProgressBar.png
.png
Rebar_Background.png
.png
Right.png
Right_Border.png
.png
Searchbar_list_btn.png
SideBarSplitterBar.png
SideBar_Topbar.png
StatusBar_Background.png
System_Button.png
Tab_Thumb.png
ToolBar_Separator.png
Toolbar_Gripper.png
add.png
adressbar_list_btn.png
back.png
.png
cal.png
close_btn_small.png
default_page.png
.png
delete.png
done.png
edit.png
fav.png
find.png
findbar_backgroung.png
findbar_bg.png
forward.png
.png
go_btn.png
history.png
history_site.png
home.png
.png
menubar_selecte_item.png
more_btn.png
.png
more_list_btn.png
.png
most.png
new_tab.png
notice.png
objects.xml
.xml
pen.png
pen_highlight_icon.png
pen_selecte_highlight.png
prop.xml
.xml
refresh.png
.png
restore.png
.png
safe1.png
safe2.png
search_btn.png
.png
searchbar_bg.png
.png
select item.png
select item_small.png
shareres.xml
.xml
sidebar_bg.png
sidebar_bg_right.png
sidebar_btn.png
sidebar_searchbar_bg.png
sidebar_view_bg.png
size-contrl.png
statusbar_select_item.png
statusbar_zoomlist_arrow.png
stop.png
.png
tab1.png
.png
tab2.png
.png
tab_background.png
.png
tab_item.png
.png
tab_loading.png
tab_move_left.png
tab_move_right.png
tab_states.png
voice1.png
voice2.png
waite.png
zoom.png
Skins/Coral.xml
.xml
Skins/CoralIE.skn
.zip
Close_Btn.png
.png
CoralSkinPreview.png
.png
Coral_Logo.png
.png
Find_Next.png
.png
Find_Prev.png
.png
Findbar_Resault_Icon.png
.png
Findbar_Select item_big.png
.png
Findbar_select item_small.png
.png
Float 2.png
.png
Float.png
.png
FullScreenExitButton.png
IE6_Menubar.png
.png
IE6_devide.PNG
.png
LeftRight.png
.png
Left_Border.png
.png
Main_Background.png
.png
ProgressBar.png
.png
Rebar_Background.png
.png
Right.png
.png
Right_Border.png
.png
Searchbar_list_btn.png
.png
SideBarSplitterBar.png
.png
SideBar_Topbar.png
.png
StatusBar_Background.png
.png
System_Button.png
.png
Tab_Thumb.png
.png
ToolBar_Separator.png
.png
Toolbar_Gripper.png
.png
add.png
.png
adressbar_list_btn.png
.png
back.png
.png
cal.png
.png
close_btn_small.png
.png
default_page.png
.png
delete.png
.png
done.png
.png
edit.png
.png
fav.png
.png
find.png
.png
findbar_backgroung.png
.png
findbar_bg.png
.png
forward.png
.png
go_btn.png
.png
history.png
.png
history_site.png
.png
home.png
.png
menubar_selecte_item.png
.png
more_btn.png
.png
more_list_btn.png
.png
most.png
.png
new_tab.png
.png
notice.png
.png
objects.xml
.xml
pen.png
.png
pen_highlight_icon.png
.png
pen_selecte_highlight.png
.png
prop.xml
.xml
refresh.png
.png
restore.png
.png
safe1.png
.png
safe2.png
.png
search_btn.png
.png
searchbar_bg.png
.png
select item.png
.png
select item_small.png
.png
shareres.xml
.xml
sidebar_bg.png
.png
sidebar_bg_right.png
.png
sidebar_btn.png
.png
sidebar_searchbar_bg.png
.png
sidebar_view_bg.png
.png
size-contrl.png
.png
statusbar_select_item.png
.png
statusbar_zoomlist_arrow.png
.png
stop.png
.png
tab1.png
.png
tab2.png
.png
tab_background.png
.png
tab_item.png
.png
tab_loading.png
.png
tab_move_left.png
.png
tab_move_right.png
.png
tab_states.png
.png
voice1.png
.png
voice2.png
.png
waite.png
.png
zoom.png
.png
StartPage/css/css.css
StartPage/css/home.css
StartPage/guide.htm
.html
StartPage/home.htm
.html
StartPage/images/all_search_icon_baidu.gif
.gif
StartPage/images/blank.gif
.gif
StartPage/images/guide/01_img_01.gif
.gif
StartPage/images/guide/01_img_02.gif
.gif
StartPage/images/guide/01_img_03.gif
.gif
StartPage/images/guide/01_img_04.gif
.gif
StartPage/images/guide/02_img_01.gif
.gif
StartPage/images/guide/02_img_02.gif
.gif
StartPage/images/guide/03_img_01.gif
.gif
StartPage/images/guide/03_img_02.gif
.gif
StartPage/images/guide/03_img_03.gif
.gif
StartPage/images/guide/04_img_01.gif
.gif
StartPage/images/guide/04_img_02.gif
.gif
StartPage/images/guide/04_img_03.gif
.gif
StartPage/images/guide/05_img_01.gif
.gif
StartPage/images/guide/05_img_02.gif
.gif
StartPage/images/guide/back.gif
.gif
StartPage/images/guide/bg.gif
.gif
StartPage/images/guide/ico.gif
.gif
StartPage/images/guide/kaishi.gif
.gif
StartPage/images/guide/logo.gif
.gif
StartPage/images/guide/mainbg.gif
.gif
StartPage/images/guide/menu1_1.gif
.gif
StartPage/images/guide/menu1_2.gif
.gif
StartPage/images/guide/menu1_3.gif
.gif
StartPage/images/guide/menu2_1.gif
.gif
StartPage/images/guide/menu2_2.gif
.gif
StartPage/images/guide/menu2_3.gif
.gif
StartPage/images/guide/menu3_1.gif
.gif
StartPage/images/guide/menu3_2.gif
.gif
StartPage/images/guide/menu3_3.gif
.gif
StartPage/images/guide/menu4_1.gif
.gif
StartPage/images/guide/menu4_2.gif
.gif
StartPage/images/guide/menu4_3.gif
.gif
StartPage/images/guide/menu5_1.gif
.gif
StartPage/images/guide/menu5_2.gif
.gif
StartPage/images/guide/p_down.gif
.gif
StartPage/images/guide/p_down.png
.png
StartPage/images/guide/shanhu.gif
.gif
StartPage/images/guide/start.gif
.gif
StartPage/images/guide/start.png
.png
StartPage/images/guide/xiangd.gif
.gif
StartPage/images/guide/xiangd.png
.png
StartPage/images/guide/zuij.gif
.gif
StartPage/images/home/2345_big.jpg
.jpg
StartPage/images/home/2345_small.jpg
.jpg
StartPage/images/home/baidu_big.jpg
.jpg
StartPage/images/home/baidu_small.jpg
.jpg
StartPage/images/home/kaixin_big.jpg
.jpg
StartPage/images/home/kaixin_small.jpg
.jpg
StartPage/images/home/sina_big.jpg
.jpg
StartPage/images/home/sina_small.jpg
.jpg
StartPage/images/home/taobao_big.jpg
.jpg
StartPage/images/home/taobao_small.jpg
.jpg
StartPage/images/home/youku_big.jpg
.jpg
StartPage/images/home/youku_small.jpg
.jpg
StartPage/images/main_bottombar_report.gif
.gif
StartPage/images/main_bottombar_report2.gif
.gif
StartPage/images/main_bottombar_report3.gif
.gif
StartPage/images/main_content_error.gif
.gif
StartPage/images/main_grid_bar_bj.gif
.gif
StartPage/images/main_grid_bar_blank.gif
.gif
StartPage/images/main_grid_bar_blank_hover.gif
.gif
StartPage/images/main_grid_bar_edit.gif
.gif
StartPage/images/main_grid_bar_edit_hover.gif
.gif
StartPage/images/main_grid_bar_edit_pressed.gif
.gif
StartPage/images/main_grid_bar_refresh.gif
.gif
StartPage/images/main_grid_bar_refresh_hover.gif
.gif
StartPage/images/main_grid_bar_refresh_pressed.gif
.gif
StartPage/images/main_grid_bar_remove.gif
.gif
StartPage/images/main_grid_bar_remove_hover.gif
.gif
StartPage/images/main_grid_bar_remove_pressed.gif
.gif
StartPage/images/main_grid_item.gif
.gif
StartPage/images/main_grid_item_add.gif
.gif
StartPage/images/main_grid_item_hover.gif
.gif
StartPage/images/main_grid_item_loading.gif
.gif
StartPage/images/main_search_act_baidu.gif
.gif
StartPage/images/main_search_act_bing.gif
.gif
StartPage/images/main_search_act_google.gif
.gif
StartPage/images/main_search_act_sogou.gif
.gif
StartPage/images/main_search_act_soso.gif
.gif
StartPage/images/main_search_act_yahoo.gif
.gif
StartPage/images/main_search_act_youdao.gif
.gif
StartPage/images/main_search_background1.gif
.gif
StartPage/images/main_search_background2.gif
.gif
StartPage/images/main_search_background2b.gif
.gif
StartPage/images/main_search_background3.gif
.gif
StartPage/images/main_search_background4.gif
.gif
StartPage/images/main_search_bigicon_baidu.gif
.gif
StartPage/images/main_search_bigicon_bing.gif
.gif
StartPage/images/main_search_bigicon_google.gif
.gif
StartPage/images/main_search_bigicon_sogou.gif
.gif
StartPage/images/main_search_bigicon_soso.gif
.gif
StartPage/images/main_search_bigicon_yahoo.gif
.gif
StartPage/images/main_search_bigicon_youdao.gif
.gif
StartPage/images/main_search_button.gif
.gif
StartPage/images/main_search_icon_baidu.gif
.gif
StartPage/images/main_search_icon_bing.gif
.gif
StartPage/images/main_search_icon_dduote.gif
.gif
StartPage/images/main_search_icon_dshooter.gif
.gif
StartPage/images/main_search_icon_dverycd.gif
.gif
StartPage/images/main_search_icon_dxunlei.gif
.gif
StartPage/images/main_search_icon_google.gif
.gif
StartPage/images/main_search_icon_ibaidu.gif
.gif
StartPage/images/main_search_icon_igoogle.gif
.gif
StartPage/images/main_search_icon_isoso.gif
.gif
StartPage/images/main_search_icon_mabaidu.gif
.gif
StartPage/images/main_search_icon_magoogle.gif
.gif
StartPage/images/main_search_icon_mbaidu.gif
.gif
StartPage/images/main_search_icon_mgoogle.gif
.gif
StartPage/images/main_search_icon_msoso.gif
.gif
StartPage/images/main_search_icon_sbuy360.gif
.gif
StartPage/images/main_search_icon_sdangdang.gif
.gif
StartPage/images/main_search_icon_sjyjo.gif
.gif
StartPage/images/main_search_icon_sodou.gif
.gif
StartPage/images/main_search_icon_sogou.gif
.gif
StartPage/images/main_search_icon_soso.gif
.gif
StartPage/images/main_search_icon_spaipai.gif
.gif
StartPage/images/main_search_icon_staobao.gif
.gif
StartPage/images/main_search_icon_vbaidu.gif
.gif
StartPage/images/main_search_icon_vgoogle.gif
.gif
StartPage/images/main_search_icon_vsoso.gif
.gif
StartPage/images/main_search_icon_vtudou.gif
.gif
StartPage/images/main_search_icon_vyouku.gif
.gif
StartPage/images/main_search_icon_wbaidu.gif
.gif
StartPage/images/main_search_icon_wsoso.gif
.gif
StartPage/images/main_search_icon_wwiki.gif
.gif
StartPage/images/main_search_icon_yahoo.gif
.gif
StartPage/images/main_search_icon_youdao.gif
.gif
StartPage/images/main_search_logo_baidu.gif
.gif
StartPage/images/main_search_logo_bing.gif
.gif
StartPage/images/main_search_logo_dduote.gif
.gif
StartPage/images/main_search_logo_dshooter.gif
.gif
StartPage/images/main_search_logo_dverycd.gif
.gif
StartPage/images/main_search_logo_dxunlei.gif
.gif
StartPage/images/main_search_logo_google.gif
.gif
StartPage/images/main_search_logo_ibaidu.gif
.gif
StartPage/images/main_search_logo_igoogle.gif
.gif
StartPage/images/main_search_logo_isoso.gif
.gif
StartPage/images/main_search_logo_mabaidu.gif
.gif
StartPage/images/main_search_logo_magoogle.gif
.gif
StartPage/images/main_search_logo_mbaidu.gif
.gif
StartPage/images/main_search_logo_mgoogle.gif
.gif
StartPage/images/main_search_logo_msoso.gif
.gif
StartPage/images/main_search_logo_sbuy360.gif
.gif
StartPage/images/main_search_logo_sdangdang.gif
.gif
StartPage/images/main_search_logo_sjyjo.gif
.gif
StartPage/images/main_search_logo_sogou.gif
.gif
StartPage/images/main_search_logo_soso.gif
.gif
StartPage/images/main_search_logo_spaipai.gif
.gif
StartPage/images/main_search_logo_staobao.gif
.gif
StartPage/images/main_search_logo_vbaidu.gif
.gif
StartPage/images/main_search_logo_vgoogle.gif
.gif
StartPage/images/main_search_logo_vsoso.gif
.gif
StartPage/images/main_search_logo_vtudou.gif
.gif
StartPage/images/main_search_logo_vyouku.gif
.gif
StartPage/images/main_search_logo_wbaidu.gif
.gif
StartPage/images/main_search_logo_wsoso.gif
.gif
StartPage/images/main_search_logo_wwiki.gif
.gif
StartPage/images/main_search_logo_yahoo.gif
.gif
StartPage/images/main_search_logo_youdao.gif
.gif
StartPage/images/main_search_xl_arrow.gif
.gif
StartPage/images/main_search_xl_background1.gif
.gif
StartPage/images/main_search_xl_background2.gif
.gif
StartPage/images/main_toolbar_icon1.gif
.gif
StartPage/images/main_toolbar_icon2.gif
.gif
StartPage/images/main_toolbar_icon3.gif
.gif
StartPage/images/main_toolbar_icon4.gif
.gif
StartPage/images/main_toolbar_icon5.gif
.gif
StartPage/images/main_toolbar_icon6.gif
.gif
StartPage/images/popup_dialog_background.gif
.gif
StartPage/images/popup_dialog_close.gif
.gif
StartPage/images/popup_dialog_edit_background.gif
.gif
StartPage/images/popup_dialog_edit_background2.gif
.gif
StartPage/images/popup_dialog_list_button.gif
.gif
StartPage/images/popup_dialog_list_button2.gif
.gif
StartPage/images/popup_dialog_list_button3.gif
.gif
StartPage/images/popup_dialog_list_icon.gif
.gif
StartPage/images/popup_dialog_list_icon1.gif
.gif
StartPage/images/popup_dialog_list_icon2.gif
.gif
StartPage/images/popup_dialog_list_icon3.gif
.gif
StartPage/images/popup_dialog_list_icon4.gif
.gif
StartPage/images/popup_dialog_list_icon4_2.gif
.gif
StartPage/images/popup_dialog_list_tit.gif
.gif
StartPage/images/popup_dialog_list_tit_hover.gif
.gif
StartPage/images/switch_bj.gif
.gif
StartPage/images/switch_combar_icon1.gif
.gif
StartPage/images/switch_combar_icon2.gif
.gif
StartPage/images/switch_widbar_icon1.gif
.gif
StartPage/images/switch_widbar_icon2.gif
.gif
StartPage/images/tick.gif
.gif
StartPage/images/tick.ico
StartPage/index.htm
.html .js polyglot
StartPage/js/RCAddressBar.js
.js
StartPage/js/coral.js
.js
StartPage/js/createmenu.js
.js
StartPage/js/keySuggestion.js
.js
StartPage/search.htm
.html .js polyglot
StartPage/step1.htm
.html .js polyglot
StartPage/step2.htm
.html .js polyglot
StartPage/step3.htm
.html .js polyglot
StartPage/step4.htm
.html .js polyglot
StartPage/step5.htm
.html .js polyglot
Uninstall.exe
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

cc7109b9c3b24bf2e4cc2be1f2650012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExW
GlobalFree
lstrcpyW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
LCMapStringW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteFile
InitializeCriticalSection
RtlUnwind
HeapSize

Exports

Exports

KillProc

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/un.option.ini
lang/CoralLang_chs.dll
.dll windows:4 windows x86 arch:x86

a41ee06935c52cf69ebe02770a700852

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c1:d7:ba:5e:9d:e1:3b:0d:93:9b:00:3c:37:f2:3b:d1:b1:14:b5:94
Signer

Actual PE Digest

c1:d7:ba:5e:9d:e1:3b:0d:93:9b:00:3c:37:f2:3b:d1:b1:14:b5:94

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\coral\branches\CoralExplorer_v1.1.3111\build_temp\Win32\Release\CoralLang_chs\CoralLang_chs.pdb

Imports

kernel32

DisableThreadLibraryCalls
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Exports

Exports

CoralCreateObject

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 747KB - Virtual size: 746KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
msvcr80.dll
.dll windows:4 windows x86 arch:x86

7fecbc4a16a5dc85a5394a1df6217680

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:91:3d:94:b9:ba:4e:61:2c:9e:39:33:c3:ef:33:96:a5:c1:75:48
Signer

Actual PE Digest

1a:91:3d:94:b9:ba:4e:61:2c:9e:39:33:c3:ef:33:96:a5:c1:75:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msvcr80.i386.pdb

Imports

msvcrt

_getdrives

kernel32

GetStringTypeA
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetSystemDirectoryW
GetLongPathNameW
GetCurrentThreadId
TlsGetValue
DebugBreak
OutputDebugStringA
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
FindNextFileA
FindFirstFileA
FindClose
FindNextFileW
FindFirstFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
Sleep
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
VirtualAlloc
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteConsoleW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
MultiByteToWideChar
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
WideCharToMultiByte
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
SetLocalTime
GetStringTypeW
LoadLibraryW
GetLocaleInfoA
GetLocaleInfoW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
RtlUnwind
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
CreateFileA
CompareStringA
CompareStringW
Beep
GetDiskFreeSpaceA
GetLogicalDrives
SetErrorMode
GetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetDriveTypeA
CreateDirectoryA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
DeleteFileW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
MoveFileA
RaiseException
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
CreateProcessW
HeapValidate
HeapCompact
HeapWalk
VirtualProtect
GetSystemInfo
VirtualQuery
IsDBCSLeadByteEx
ReadConsoleA
ReadConsoleW
SetConsoleMode
SetEndOfFile
DuplicateHandle
GetFileInformationByHandle
PeekNamedPipe
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
LockFile
UnlockFile
CreatePipe
ReadFile
CreateFileW
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime

Exports

Exports

$I10_OUTPUT
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1exception@std@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@@6B@
??_7exception@std@@6B@
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZH@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?raw_name@type_info@@QBEPBDXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?unexpected@@YAXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?what@exception@std@@UBEPBDXZ
@_calloc_crt@8
@_malloc_crt@4
@_realloc_crt@8
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_Strftime
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindStdDelDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___fls_getvalue@4
___fls_setvalue@8
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringW
__crtGetLocaleInfoW
__crtGetStringTypeW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_app_type
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lc_clike
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__amblksiz
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__osplatform
__p__osver
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__winmajor
__p__winminor
__p__winver
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__set_flsgetvalue
__setlc_active
__setusermatherr
__strncnt
__swprintf_l
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__unDNameHelper
__uncaught_exception
__unguarded_readlc_active
__vswprintf_l
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_amsg_exit
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_crt
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_commode
_configthreadlocale
_control87
_controlfp
_controlfp_s
_copysign
_cprintf
_cprintf_l
_cprintf_p
_cprintf_p_l
_cprintf_s
_cprintf_s_l
_cputs
_cputws
_creat
_create_locale
_crt_debugger_hook
_cscanf
_cscanf_l
_cscanf_s
_cscanf_s_l
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_cwait
_cwprintf
_cwprintf_l
_cwprintf_p
_cwprintf_p_l
_cwprintf_s
_cwprintf_s_l
_cwscanf
_cwscanf_l
_cwscanf_s
_cwscanf_s_l
_daylight
_decode_pointer
_difftime32
_difftime64
_dosmaperr
_dstbias
_dup
_dup2
_dupenv_s
_ecvt
_ecvt_s
_encode_pointer
_encoded_null
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_except_handler4_common
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fclose_nolock
_fcloseall
_fcvt
_fcvt_s
_fdopen
_fflush_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filbuf
_filelength
_filelengthi64
_fileno
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_free_locale
_freea
_freea_s
_freefls
_fscanf_l
_fscanf_s_l
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_ftell_nolock
_ftelli64
_ftelli64_nolock
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_ftol
_fullpath
_futime32
_futime64
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwrite_nolock
_fwscanf_l
_fwscanf_s_l
_gcvt
_gcvt_s
_get_amblksiz
_get_current_locale
_get_daylight
_get_doserrno
_get_dstbias
_get_errno
_get_fmode
_get_heap_handle
_get_invalid_parameter_handler
_get_osfhandle
_get_osplatform
_get_osver
_get_output_format
_get_pgmptr
_get_printf_count_output
_get_purecall_handler
_get_sbh_threshold
_get_terminate
_get_timezone
_get_tzname
_get_unexpected
_get_winmajor
_get_winminor
_get_winver
_get_wpgmptr
_getch
_getch_nolock
_getche
_getche_nolock
_getcwd
_getdcwd
_getdcwd_nolock
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp

Sections

.text
Size: 396KB - Virtual size: 393KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
珊瑚免责声明.txt

Sharing

General

Malware Config

Signatures

Files

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 1.4MB

.rsrc Size: 19KB - Virtual size: 18KB

f6e384a477f8efc14029bba8fca9bd0f

Headers

File Characteristics

PDB Paths

Imports

version

kernel32

user32

Exports

Exports

Sections

.text Size: 26KB - Virtual size: 26KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 3KB - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 5KB - Virtual size: 4KB

cc7109b9c3b24bf2e4cc2be1f2650012

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 28KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 4KB - Virtual size: 3KB

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 899B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 574B

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 1.4MB

.rsrc
Size: 19KB - Virtual size: 18KB

.text
Size: 26KB - Virtual size: 26KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 3KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 5KB - Virtual size: 4KB

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 899B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 574B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 48B

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 590B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

36:6b:c2:bf:35:70:7f:36:1a:ae:0f:68:4d:06:fb:5a:59:20:1f:81
Signer

.text
Size: 372KB - Virtual size: 372KB

.rdata
Size: 63KB - Virtual size: 63KB

.data
Size: 6KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 30KB - Virtual size: 29KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

62:32:f6:17:e7:c3:0d:35:b1:80:6c:be:96:d1:20:8d:b2:47:cc:fe
Signer

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 7KB - Virtual size: 6KB