a1fd7de0bf59799f60d9030cd9ee34f1cc36bc9f34b935c087cfaf11c820c62f

Sharing

Copy URL Twitter E-mail

General

Target

a1fd7de0bf59799f60d9030cd9ee34f1cc36bc9f34b935c087cfaf11c820c62f
Size

12.2MB
MD5

6ee6b3b2dc337f864070e321e4c4dfcc
SHA1

72ea6efe6b80fa7f38225c4ba6c74dfd260497b3
SHA256

a1fd7de0bf59799f60d9030cd9ee34f1cc36bc9f34b935c087cfaf11c820c62f
SHA512

015a092da1f54806629c17a8de7d63babd15754de8ec3a62fe771d7a3233a6f65d49b04541250cdf5fa8432e87f6cea137fde1313f7ebd90b625d680cb2be2b2
SSDEEP

393216:eatNtCraYBimqduVvuzDdYVXfpjCRusT6eLxeg6wgXKr:eaftwbBC4QFYVP8n6ixd6M

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/360DrvMgr.exe
unpack001/DrvMgrUI.dll
unpack001/ScriptExecute.exe
unpack001/atiags32.dll

Files

a1fd7de0bf59799f60d9030cd9ee34f1cc36bc9f34b935c087cfaf11c820c62f
.zip
360Base.dll
.dll windows:5 windows x86 arch:x86

04a116d242e299d4ddbfcdcde9080a8f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9c:57:83:91:29:74:c3:40:38:38:02:24:0e:59:f9:8b:da:71:4d:ed:ad:b4:1d:67:3d:c8:75:3f:8f:cc:95:a3
Signer

Actual PE Digest

9c:57:83:91:29:74:c3:40:38:38:02:24:0e:59:f9:8b:da:71:4d:ed:ad:b4:1d:67:3d:c8:75:3f:8f:cc:95:a3

Digest Algorithm

sha256

PE Digest Matches

true

23:d1:a0:5a:0e:e2:46:7a:a1:6f:06:e1:06:8b:58:cb:07:bc:c1:4d
Signer

Actual PE Digest

23:d1:a0:5a:0e:e2:46:7a:a1:6f:06:e1:06:8b:58:cb:07:bc:c1:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\139308\out\Release\360Base.pdb

Imports

kernel32

WaitForSingleObject
InitializeCriticalSectionAndSpinCount
ReleaseMutex
LocalFree
lstrlenA
HeapAlloc
GetACP
LocalFileTimeToFileTime
FreeResource
GetCurrentProcess
GetSystemWindowsDirectoryW
GetSystemInfo
MapViewOfFileEx
IsBadReadPtr
VirtualFree
VirtualAlloc
GetFileSize
GetLocalTime
FindResourceExW
GetStdHandle
GetVersion
GlobalMemoryStatus
GetTickCount
ExitProcess
SetFilePointerEx
ReadFile
GetCurrentProcessId
lstrcmpiA
DeleteAtom
FindAtomW
CreateMutexW
HeapFree
GetProcessHeap
lstrcmpA
GetVersionExW
GetFileType
SetLastError
UnmapViewOfFile
LockResource
MapViewOfFile
CreateFileMappingW
CloseHandle
DeviceIoControl
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
GetLastError
RaiseException
lstrcmpiW
GetModuleHandleW
GetProcAddress
lstrlenW
InterlockedCompareExchange
Sleep
FreeLibrary
CreateFileW
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
AddAtomW
OpenThread
GetAtomNameW
GetSystemTime
FormatMessageW
OutputDebugStringW
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
LoadLibraryA
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetErrorMode
LoadLibraryW
GetFileAttributesW
UnlockFileEx
LockFileEx
QueryPerformanceCounter
FindClose
FindNextFileW
FindFirstFileW
MoveFileExW
SetFilePointer
DeleteFileW
GetFileAttributesExW
FlushFileBuffers
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
WriteFile
GetCurrentThreadId
WideCharToMultiByte
GetFileSizeEx
HeapDestroy
HeapReAlloc
HeapSize
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapCreate
GetModuleFileNameA
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetStartupInfoA
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
GetModuleHandleA

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
CharNextW
GetDesktopWindow

advapi32

ReportEventW
DeregisterEventSource
RegisterEventSourceW
RegQueryValueExW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA

ole32

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoCreateGuid

oleaut32

SysAllocString
VarUI4FromStr

shlwapi

StrCmpNIW
StrTrimA
PathFindFileNameW
StrStrIW
PathCombineW
PathAppendW
PathFileExistsW
StrCmpIW
SHSetValueA
StrStrIA
SHGetValueA
StrRChrW

version

GetFileVersionInfoSizeW
VerQueryValueW

netapi32

Netbios

crypt32

CertGetCertificateChain
CertFreeCertificateContext
CryptDecodeObject
CryptMsgControl
CertFindCertificateInStore
CryptQueryObject
CryptDecodeObjectEx
CertAddStoreToCollection
CertOpenStore
CertCloseStore
CertOpenSystemStoreW
CryptMsgGetParam
CryptMsgUpdate
CryptMsgOpenToDecode
CertGetCertificateContextProperty
CertGetNameStringW
CertFreeCertificateChain
CryptMsgClose

iphlpapi

GetAdaptersInfo

Exports

Exports

CreateObject
InitLibs

Sections

.text
Size: 601KB - Virtual size: 601KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360DrvMgr.exe
.exe windows:5 windows x86 arch:x86

3d3d2ab3399e0c6c08606786ea8815f7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\568550\out\Release\360DrvMgr.pdb

Imports

kernel32

GetVersion
DeleteCriticalSection
DeviceIoControl
GetModuleFileNameA
OpenMutexW
SetLastError
GetTickCount
QueryPerformanceCounter
LocalAlloc
GetSystemPowerStatus
SetFilePointer
ReadFile
GetFileSizeEx
GetCurrentThread
VirtualAlloc
VirtualQuery
ResumeThread
GetThreadContext
SuspendThread
OpenThread
SetThreadPriority
GetThreadPriority
FlushInstructionCache
VirtualProtect
InterlockedIncrement
InterlockedDecrement
GetTempFileNameW
GetTempPathW
GetPrivateProfileStringW
GetWindowsDirectoryW
lstrcmpiW
ReleaseSemaphore
OpenSemaphoreW
GetLocalTime
SetEvent
CreateEventW
FreeResource
WaitForMultipleObjects
WriteFile
lstrcmpiA
ResetEvent
OpenEventW
ExitProcess
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
CreateFileA
GetProcessHeap
lstrcmpA
SetEnvironmentVariableA
CompareStringW
CompareStringA
HeapAlloc
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetLocaleInfoA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
SetHandleCount
InitializeCriticalSectionAndSpinCount
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetStringTypeW
GetCPInfo
LCMapStringW
LCMapStringA
GetStdHandle
GetFileType
WriteConsoleW
CreateThread
ExitThread
GetDateFormatA
GetTimeFormatA
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
HeapUnlock
TlsSetValue
OutputDebugStringW
TlsGetValue
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
HeapFree
DeleteFileW
GetCurrentThreadId
WideCharToMultiByte
GetLastError
CreateMutexW
QueryDosDeviceW
InitializeCriticalSection
GetLongPathNameW
GetCurrentProcess
GetDiskFreeSpaceExW
GetStartupInfoW
CreateProcessW
GetCurrentProcessId
WaitForSingleObject
GetExitCodeProcess
GetVersionExW
OpenProcess
WritePrivateProfileStringW
InterlockedCompareExchange
Sleep
GetCommandLineW
GetPrivateProfileIntW
InterlockedExchange
lstrlenW
GetModuleHandleA
GetSystemInfo
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
LoadLibraryExW
LoadLibraryW
LocalFree
lstrlenA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
MultiByteToWideChar
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
RaiseException
GetSystemDirectoryW
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
FindFirstFileW
FindNextFileW
FindClose
CreateFileW
SetStdHandle

user32

LoadCursorW
GetClassInfoExW
SetWindowRgn
GetCursorPos
FillRect
DrawIconEx
GetForegroundWindow
AttachThreadInput
SetForegroundWindow
CopyRect
InvalidateRect
UnregisterClassA
ScreenToClient
PostQuitMessage
SetDlgItemTextW
DialogBoxParamW
CreateDialogParamW
InflateRect
GetWindowPlacement
IsWindowEnabled
IsWindowVisible
SetRect
LoadMenuW
DeleteMenu
EnableMenuItem
ModifyMenuW
DestroyMenu
GetWindowRect
GetDlgItem
MessageBoxW
GetActiveWindow
SetWindowTextW
MoveWindow
GetParent
CreateWindowExW
ReleaseDC
GetDC
FindWindowW
RegisterWindowMessageW
PostMessageW
UpdateLayeredWindow
RegisterClassExW
SetFocus
MonitorFromPoint
TrackPopupMenu
GetWindowThreadProcessId
FindWindowExW
SystemParametersInfoW
IsDlgButtonChecked
CheckDlgButton
ScrollWindow
DrawTextW
GetSubMenu
GetWindowTextLengthW
GetWindowTextW
EndPaint
BeginPaint
EnableWindow
RedrawWindow
PtInRect
GetWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
GetClientRect
DestroyIcon
EndDialog
GetSystemMetrics
LoadImageW
GetLastInputInfo
IsDialogMessageW
SendMessageW
KillTimer
SetTimer
UpdateWindow
IsIconic
LoadIconW
LockSetForegroundWindow
DestroyWindow
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
wsprintfW
IsWindow
ShowWindow
BringWindowToTop
SendMessageTimeoutW
GetClassInfoW
RegisterClassW
WaitForInputIdle
GetShellWindow
ExitWindowsEx
GetWindowLongW
SetWindowLongW
CallWindowProcW
DefWindowProcW
SetWindowPos

gdi32

SetTextColor
SetBkMode
GetObjectW
DeleteObject
DeleteDC
SelectObject
CreateCompatibleDC
BitBlt
CreateRectRgn
CreateFontW
EnumFontFamiliesW
ExtTextOutW
SetBkColor
SetViewportOrgEx
CreateDIBSection
StretchBlt
SetStretchBltMode
MoveToEx
LineTo
CreateSolidBrush
CombineRgn
CreatePen
CreateCompatibleBitmap

advapi32

RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteKeyW
DuplicateTokenEx
RegSetValueExW
RegDeleteValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
RegOpenKeyExW
RegEnumKeyExA
RegCloseKey

shell32

SHGetSpecialFolderPathW
Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathW
ShellExecuteExW
ord165
ShellExecuteW
SHGetSpecialFolderPathA
CommandLineToArgvW

ole32

CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SysAllocStringByteLen
SysAllocString
SysStringLen
VarUI4FromStr
SysStringByteLen
VariantClear
VariantInit
SysFreeString

shlwapi

PathIsDirectoryW
AssocQueryStringW
PathIsRelativeW
StrStrIA
PathQuoteSpacesW
PathAddBackslashW
PathRemoveExtensionW
StrCmpIW
SHSetValueW
StrCmpW
PathStripPathW
PathAppendA
SHGetValueW
PathUnquoteSpacesW
PathAppendW
PathFileExistsW
SHSetValueA
PathCombineA
SHGetValueA
PathFileExistsA
PathRemoveFileSpecW
StrStrIW
PathCombineW

gdiplus

GdipCloneImage
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipCreateFromHDC
GdiplusStartup
GdipGetImageHeight
GdipGetImageWidth
GdipFree
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDeleteGraphics
GdipAlloc
GdipDisposeImage

psapi

GetModuleBaseNameW
GetProcessImageFileNameW

Sections

.text
Size: 557KB - Virtual size: 557KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 180KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 336KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360LibDrvmgr.dat
360NetBase.dll
.dll windows:5 windows x86 arch:x86

21312c342dfe15c1768ec19a879c07b1

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ee:ee:ed:e7:f3:2e:83:8a:e9:c1:8b:f6:59:a7:c6:d9:62:13:63:c5:01:22:ba:96:f2:c6:1b:6f:bb:9a:6f:ca
Signer

Actual PE Digest

ee:ee:ed:e7:f3:2e:83:8a:e9:c1:8b:f6:59:a7:c6:d9:62:13:63:c5:01:22:ba:96:f2:c6:1b:6f:bb:9a:6f:ca

Digest Algorithm

sha256

PE Digest Matches

true

71:62:86:09:fa:ff:91:9c:39:e2:02:5e:52:8b:e3:48:1f:6d:00:ca
Signer

Actual PE Digest

71:62:86:09:fa:ff:91:9c:39:e2:02:5e:52:8b:e3:48:1f:6d:00:ca

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\vmagent_new\bin\joblist\344211\out\Release\360NetBase.pdb

Imports

ws2_32

htons
getsockopt
recv
closesocket
socket
connect
WSASetLastError
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
ioctlsocket
__WSAFDIsSet
select
send
getpeername
bind
ntohs
getsockname
setsockopt
WSAGetLastError
shutdown

user32

MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

kernel32

WriteConsoleW
TlsFree
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
SleepEx
CloseHandle
WaitForSingleObject
ReleaseMutex
CreateMutexA
ExpandEnvironmentStringsA
Sleep
FormatMessageA
GetTickCount
MultiByteToWideChar
DeviceIoControl
CreateFileA
GetCurrentProcessId
WideCharToMultiByte
FreeLibrary
InterlockedCompareExchange
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryA
lstrlenA
LoadLibraryW
lstrlenW
FindClose
lstrcmpW
GetLongPathNameW
FindFirstFileW
ReadDirectoryChangesW
CreateFileW
CreateEventA
GetPrivateProfileStringW
lstrcmpiW
GetOverlappedResult
lstrcatW
lstrcpyW
GetSystemDirectoryW
WriteFile
SetEvent
GetCurrentProcess
GetModuleHandleA
GetVersionExA
GetSystemDirectoryA
InterlockedExchange
GetModuleFileNameA
WaitForMultipleObjects
FreeLibraryAndExitThread
CreateThread
GetModuleHandleExA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetEndOfFile
SetFilePointerEx
ReadFile
GetFileSizeEx
CreateMutexW
TlsGetValue
HeapAlloc
HeapFree
OutputDebugStringW
GetProcessHeap
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
GetCurrentThreadId
TlsAlloc
GetVersion
GetFileType
GetStdHandle
QueryPerformanceCounter
GlobalMemoryStatus
FlushConsoleInputBuffer
GetSystemTime
ExitThread
HeapReAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
RaiseException
RtlUnwind
GetCommandLineA
ExitProcess
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
InterlockedIncrement
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryA
LCMapStringA
LCMapStringW
GetConsoleCP
FlushFileBuffers
SetFilePointer
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

advapi32

RegQueryValueExW
RegOpenKeyExW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumKeyExW
RegQueryValueExA
RegNotifyChangeKeyValue
RegEnumKeyExA
RegCloseKey

oleaut32

SysFreeString
VarBstrCmp
VariantClear
SysAllocStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen

shlwapi

PathCombineA
StrStrIW
SHGetValueW
PathFileExistsW
PathAppendW
StrCmpIW
PathFileExistsA
PathFindFileNameA
PathRemoveFileSpecW

crypt32

CertEnumCertificatesInStore
CertOpenSystemStoreA
CertCloseStore

Exports

Exports

InitLibs

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360NetUL.dll
.dll windows:5 windows x86 arch:x86

4bf233f0c7bf7a261a3bca45f41176a1

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c0:fc:69:4f:86:19:3a:9f:7c:52:7d:0a:59:e4:45:11:34:e7:7c:45:5b:49:40:1b:3c:76:5f:31:e3:55:f5:3b
Signer

Actual PE Digest

c0:fc:69:4f:86:19:3a:9f:7c:52:7d:0a:59:e4:45:11:34:e7:7c:45:5b:49:40:1b:3c:76:5f:31:e3:55:f5:3b

Digest Algorithm

sha256

PE Digest Matches

true

cc:cf:5c:11:85:e6:18:99:6b:25:b0:db:da:a2:ea:61:55:00:ab:c2
Signer

Actual PE Digest

cc:cf:5c:11:85:e6:18:99:6b:25:b0:db:da:a2:ea:61:55:00:ab:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\69705\out\Release\360NetUL.pdb

Imports

kernel32

GetProcAddress
LeaveCriticalSection
EnterCriticalSection
GetUserDefaultLangID
Sleep
GetCurrentThreadId
GetLastError
CreateThread
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
SetFilePointer
WriteFile
GetFileSize
SetEndOfFile
GetFileSizeEx
lstrlenW
GetLocalTime
GetTickCount
RaiseException
FormatMessageA
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
SetLastError
WaitForMultipleObjects
CreateDirectoryW
DisableThreadLibraryCalls
GetModuleHandleW
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
QueryPerformanceCounter
FreeLibrary
InitializeCriticalSection
LoadLibraryW
GetModuleFileNameW
GetCurrentProcessId
CreateFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleA
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetModuleFileNameA
GetStdHandle
VirtualAlloc
VirtualFree
HeapCreate
ExitProcess
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
CloseHandle
GetCPInfo
GetCommandLineA
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
TlsFree
DeleteAtom
FindAtomW
TlsAlloc
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CreateFileA
GetSystemTimeAsFileTime
ReadFile
CreateMutexW
TlsGetValue
TlsSetValue
GetAtomNameW
AddAtomW
ReleaseMutex

user32

SetWindowTextW
SetWindowsHookExW
IsDlgButtonChecked
GetDlgItemTextW
DestroyWindow
DispatchMessageW
TranslateMessage
SetDlgItemTextW
SetWindowLongW
GetWindowLongW
ShowWindow
CreateDialogParamW
PostMessageW
SendMessageW
CheckDlgButton
SetFocus
GetDlgItem
SetForegroundWindow
PostQuitMessage
UnhookWindowsHookEx
IsDialogMessageW
CallNextHookEx
GetMessageW

advapi32

RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW

shell32

SHGetFolderPathW

shlwapi

PathIsDirectoryW
PathCombineW

wininet

InternetWriteFile
HttpSendRequestExA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
HttpEndRequestA
InternetSetStatusCallbackA
InternetOpenW
InternetCloseHandle
InternetReadFileExA
HttpQueryInfoA
InternetSetOptionW
InternetGetConnectedState
InternetConnectA
InternetQueryOptionW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

winmm

timeGetTime

ws2_32

getpeername
inet_addr

Exports

Exports

HttpInit
HttpUninit
zlib_compress
zlib_compressBound
zlib_uncompress

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360P2SP.dll
.dll windows:5 windows x86 arch:x86

d42e4a8b9fd7913a155c8be974123d68

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:78:b2:16:6b:84:e7:cf:21:a3:41:ed:97:01:11:2b:6c:3b:b6:f2:37:d3:b4:4d:f0:e4:8f:80:ae:00:b7:64
Signer

Actual PE Digest

59:78:b2:16:6b:84:e7:cf:21:a3:41:ed:97:01:11:2b:6c:3b:b6:f2:37:d3:b4:4d:f0:e4:8f:80:ae:00:b7:64

Digest Algorithm

sha256

PE Digest Matches

true

6e:a2:7c:be:75:4f:b9:00:8e:72:c7:62:cb:2e:b1:b8:fc:88:fa:6d
Signer

Actual PE Digest

6e:a2:7c:be:75:4f:b9:00:8e:72:c7:62:cb:2e:b1:b8:fc:88:fa:6d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\93092\out\Release\360P2SP.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

WSAStartup
gethostbyname
accept
WSAAsyncSelect
WSACancelAsyncRequest
WSAAsyncGetHostByName
listen
shutdown
getpeername
bind
WSASetLastError
sendto
recvfrom
ioctlsocket
select
__WSAFDIsSet
WSAGetLastError
gethostname
WSACleanup
htonl
WSCEnumProtocols
ntohs
ntohl
inet_ntoa
socket
htons
connect
closesocket
setsockopt
send
recv
inet_addr

kernel32

GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
SetStdHandle
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetTickCount
WriteFile
GetLastError
SetFilePointer
ReadFile
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcess
ReleaseMutex
ReleaseSemaphore
WaitForMultipleObjects
WaitForSingleObject
SetEndOfFile
GetFileSizeEx
CreateFileW
CreateEventW
CreateSemaphoreW
CreateMutexW
SetWaitableTimer
CreateWaitableTimerW
DeleteFileW
MoveFileW
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
GetModuleHandleExW
FreeLibraryAndExitThread
GetFileSize
GlobalAlloc
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
RaiseException
GetFileAttributesW
lstrlenA
lstrlenW
GetModuleHandleW
GetUserDefaultLangID
SetEvent
InterlockedDecrement
ResetEvent
DeviceIoControl
GetModuleFileNameW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetTempPathW
QueryPerformanceFrequency
GetModuleHandleA
GetSystemDirectoryA
GetLocalTime
InterlockedExchangeAdd
CreateThread
SetHandleCount
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
GetCurrentDirectoryA
GetFileType
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapDestroy
HeapCreate
VirtualAlloc
VirtualFree
InterlockedIncrement
HeapReAlloc
GetCommandLineA
ExitThread
FindFirstFileW
GetDriveTypeW
GetLocaleInfoA
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
lstrcmpA
HeapAlloc
TlsGetValue
GetSystemTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
RtlUnwind
IsDebuggerPresent
LocalFree
SetLastError
FormatMessageW
OutputDebugStringW
SetFilePointerEx
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
TlsAlloc
FindAtomW
DeleteAtom
TlsFree
lstrcmpiA
HeapFree
GetProcessHeap
TlsSetValue
TerminateProcess
UnhandledExceptionFilter
GetAtomNameW
OpenThread
GetCurrentProcessId
SetUnhandledExceptionFilter
AddAtomW

user32

UnhookWindowsHookEx
SetForegroundWindow
ShowWindow
CheckDlgButton
UnregisterClassW
PostMessageW
CallNextHookEx
IsDialogMessageW
SetWindowLongW
GetWindowLongW
RegisterClassExW
CreateWindowExW
DefWindowProcW
SendMessageW
SetTimer
CreateDialogParamW
SetWindowPos
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
GetDlgItemTextW
wsprintfW
IsDlgButtonChecked
SetWindowsHookExW
SetWindowTextW
SetDlgItemTextW
PostQuitMessage

advapi32

LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegEnumKeyExA
RegNotifyChangeKeyValue
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyW
AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
OleRun

oleaut32

VariantChangeType
GetErrorInfo
SysFreeString
SysAllocString
VariantInit
SafeArrayDestroy
SafeArrayCreate
SafeArrayPutElement
VariantClear

shlwapi

StrStrIW
PathCombineW
SHSetValueA
UrlCanonicalizeA
UrlCanonicalizeW
PathCombineA
SHGetValueA
wvnsprintfW

netapi32

Netbios

iphlpapi

GetNetworkParams
GetAdaptersInfo

secur32

AcquireCredentialsHandleA
InitializeSecurityContextA
FreeCredentialsHandle

rasapi32

RasEnumConnectionsW
RasGetConnectStatusW

Exports

Exports

CancelCheckProxy
CheckProxy
CheckProxyEx
CreateP2SPTask
GetFinishMessage
GetServerInfo
GetUploadInfo
Init
Login
QueryTask
QueryTask2
QueryTaskPeer
RemoveTask
SetConfigInfo
SetP2spOption
StartTask
StopSeed
StopTask
Uninit
UpdateRegInfo

Sections

.text
Size: 502KB - Virtual size: 501KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 322KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360net.dll
.dll windows:5 windows x86 arch:x86

58b5d10a230e71dee29ddba8e53862ff

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

31:b6:ca:30:02:ca:cb:d3:9e:1c:31:ac:31:14:72:54:f4:ec:32:54:db:73:2e:61:54:0e:f3:ab:d7:73:d3:36
Signer

Actual PE Digest

31:b6:ca:30:02:ca:cb:d3:9e:1c:31:ac:31:14:72:54:f4:ec:32:54:db:73:2e:61:54:0e:f3:ab:d7:73:d3:36

Digest Algorithm

sha256

PE Digest Matches

true

07:1d:c6:ef:18:81:0b:2d:c6:00:01:18:ef:82:c3:6b:98:7b:68:c6
Signer

Actual PE Digest

07:1d:c6:ef:18:81:0b:2d:c6:00:01:18:ef:82:c3:6b:98:7b:68:c6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\178386\out\Release\bin\360net.pdb

Imports

kernel32

WriteFile
SetEndOfFile
SetFilePointerEx
GetSystemTime
GetCurrentProcess
ReleaseSemaphore
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
ReadFile
lstrlenW
SystemTimeToFileTime
GetFileAttributesExW
CreateMutexW
CreateSemaphoreW
SetFilePointer
GetFileSizeEx
GetFileSize
MoveFileW
CreateThread
GlobalAlloc
GlobalFree
GetLocalTime
GetCurrentProcessId
GetCurrentThreadId
GetOEMCP
GetUserDefaultLangID
GetModuleHandleExW
FreeLibraryAndExitThread
InterlockedDecrement
ResetEvent
DeviceIoControl
GetModuleHandleW
UnhandledExceptionFilter
TerminateProcess
SetEvent
Sleep
CloseHandle
GetLastError
DeleteFileW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocaleInfoA
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
GetConsoleMode
CreateEventW
lstrlenA
GetFileAttributesW
GetPrivateProfileStringW
WideCharToMultiByte
GetVersionExW
GetModuleFileNameW
GetProcAddress
FreeLibrary
LoadLibraryW
LeaveCriticalSection
MultiByteToWideChar
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetConsoleCP
GetFullPathNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RtlUnwind
SleepEx
GetVersionExA
ExpandEnvironmentStringsA
FormatMessageA
GetSystemDirectoryW
GetSystemDirectoryA
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
GetStartupInfoA
SetHandleCount
GetFileType
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsValidCodePage
LoadLibraryA
GetACP
GetCPInfo
InterlockedIncrement
GetModuleFileNameA
GetStdHandle
ExitProcess
VirtualAlloc
VirtualFree
HeapCreate
ExitThread
FindFirstFileA
GetDriveTypeA
GetCommandLineA
FindFirstFileW
GetDriveTypeW
FileTimeToLocalFileTime
ReleaseMutex
CreateFileW
FileTimeToSystemTime
FindClose
IsDebuggerPresent
GetTickCount
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
CreateFileA
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
OutputDebugStringW
FormatMessageW
SetLastError
LocalFree
TlsGetValue
TlsSetValue
GetAtomNameW
OpenThread
AddAtomW
TlsAlloc
FindAtomW
DeleteAtom
TlsFree
GetModuleHandleA
SetUnhandledExceptionFilter

user32

PostQuitMessage
SetForegroundWindow
SetFocus
CheckDlgButton
SendMessageW
GetDlgItem
SetDlgItemTextW
SetWindowTextW
SetWindowsHookExW
UnhookWindowsHookEx
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowLongW
GetWindowLongW
ShowWindow
IsDialogMessageW
CallNextHookEx
GetDesktopWindow
PostMessageW
PostThreadMessageW
wsprintfW
CreateDialogParamW
GetDlgItemTextW

advapi32

RegSetValueExA
RegNotifyChangeKeyValue
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW

shell32

SHGetSpecialFolderPathW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
OleRun

oleaut32

SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
VariantClear
VariantChangeType
VariantInit
SysAllocString
SysFreeString
GetErrorInfo

shlwapi

PathRemoveFileSpecW
PathCombineW
StrStrIW
PathFileExistsW

rasapi32

RasGetConnectStatusW
RasEnumConnectionsW

ws2_32

ntohs
ioctlsocket
getaddrinfo
freeaddrinfo
select
inet_ntoa
gethostbyname
gethostname
WSACleanup
WSAStartup
recv
send
setsockopt
getsockname
WSAGetLastError
bind
htons
getsockopt
getpeername
closesocket
socket
connect
WSASetLastError
__WSAFDIsSet

iphlpapi

GetNetworkParams

Exports

Exports

HttpCancel
HttpCreateDownloadObj
HttpDeleteDownloadObj
HttpDownload
HttpDownloadExA
HttpDownloadExW
HttpGetAllPeer
HttpGetConnectState
HttpGetContentLength
HttpGetCurrentSpeed
HttpGetLastError
HttpGetLastErrorA
HttpGetLastErrorW
HttpGetMD5
HttpGetReceivedLength
HttpGetResumedLength
HttpGetState
HttpGetStateA
HttpGetStateW
HttpInitDownPara
HttpResetAll
HttpSetOption
HttpWait
InitHttp
UnInitHttp

Sections

.text
Size: 370KB - Virtual size: 370KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
7za.dll
.dll windows:5 windows x86 arch:x86

cabe2cf79743f3d457d3373c7a9b84a7

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11/03/2013, 00:00

Not After

10/03/2016, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8a:f7:94:92:d9:75:4a:cc:de:58:08:c8:ba:2a:f5:7a:1f:f8:ed:63
Signer

Actual PE Digest

8a:f7:94:92:d9:75:4a:cc:de:58:08:c8:ba:2a:f5:7a:1f:f8:ed:63

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\28098\out\Release\7za.pdb

Imports

kernel32

VirtualAlloc
GetVersionExW
WaitForSingleObject
SetEvent
InitializeCriticalSection
ReleaseSemaphore
ResetEvent
CreateSemaphoreW
CreateEventW
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
SetConsoleCtrlHandler
SetFileApisToOEM
GetConsoleMode
SetConsoleMode
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
OpenEventW
GetProcessTimes
GetCurrentProcess
GetProcAddress
SetCurrentDirectoryW
CompareFileTime
FreeLibrary
LoadLibraryW
FormatMessageW
LocalFree
GetWindowsDirectoryW
VirtualFree
SetFileTime
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateDirectoryW
DeleteFileW
GetFullPathNameW
lstrlenW
GetCurrentDirectoryW
SearchPathW
GetTempPathW
GetTempFileNameW
FindClose
FindFirstFileW
FindNextFileW
GetFileSize
SetFilePointer
SetEndOfFile
FileTimeToSystemTime
GetSystemInfo
GetModuleHandleW
GlobalMemoryStatus
DosDateTimeToFileTime
FileTimeToDosDateTime
GetSystemTime
SystemTimeToFileTime
RaiseException
LCMapStringW
DisableThreadLibraryCalls
FileTimeToLocalFileTime
LocalFileTimeToFileTime
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WriteFile
GetStdHandle
ReadFile
CreateFileW
GetLastError
LCMapStringA
GetStringTypeW
GetStringTypeA
HeapFree
HeapReAlloc
HeapAlloc
ExitThread
CreateThread
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
HeapDestroy
Sleep
ExitProcess
HeapSize
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
SetStdHandle
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

user32

CharUpperA
CharNextA
CharPrevExA
CharLowerW
CharUpperW

oleaut32

VariantCopy
VariantClear
SysAllocStringByteLen
SysAllocString
SysFreeString

Exports

Exports

X7za

Sections

.text
Size: 617KB - Virtual size: 617KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ComputerZ1.dll
.dll windows:4 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a7:ca:19:a6:85:c1:34:5a:59:55:9e:d8:20:00:08:d1:a3:8c:32:d2:0b:c5:5a:c2:35:3e:f5:44:d4:a3:a4:93
Signer

Actual PE Digest

a7:ca:19:a6:85:c1:34:5a:59:55:9e:d8:20:00:08:d1:a3:8c:32:d2:0b:c5:5a:c2:35:3e:f5:44:d4:a3:a4:93

Digest Algorithm

sha256

PE Digest Matches

true

3f:f0:60:c0:ce:51:75:b3:e8:7b:c0:b4:d8:38:ce:77:7b:5e:e7:de
Signer

Actual PE Digest

3f:f0:60:c0:ce:51:75:b3:e8:7b:c0:b4:d8:38:ce:77:7b:5e:e7:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 10KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ComputerZ2.dll
.dll windows:5 windows x86 arch:x86

c95133b8a79513c396ef1a16972f12dd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

00:f9:c3:e6:54:10:cb:e6:94:01:b7:db:8c:14:58:41:c7:1f:24:a6:fd:de:7a:de:b3:39:3d:06:f3:70:0c:3c
Signer

Actual PE Digest

00:f9:c3:e6:54:10:cb:e6:94:01:b7:db:8c:14:58:41:c7:1f:24:a6:fd:de:7a:de:b3:39:3d:06:f3:70:0c:3c

Digest Algorithm

sha256

PE Digest Matches

true

97:c0:68:64:44:ff:44:b9:57:6b:2c:2b:2f:a2:b2:70:73:ab:4d:4f
Signer

Actual PE Digest

97:c0:68:64:44:ff:44:b9:57:6b:2c:2b:2f:a2:b2:70:73:ab:4d:4f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\369317\out\Release\ComputerZ2.pdb

Imports

kernel32

InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
ExitProcess
HeapReAlloc
HeapAlloc
GetCurrentThreadId
GetCommandLineA
RtlUnwind
RaiseException
GetCPInfo
CompareStringW
LCMapStringA
LCMapStringW
GetStringTypeW
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
IsValidCodePage
WriteFile
GetStdHandle
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetLocaleInfoW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA

Exports

Exports

GetPCVendor_Cn
GetPCVendor_En
GetVendorPic
GetVendorURL

Sections

.text
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ComputerZ5.dll
.dll windows:4 windows x86 arch:x86

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5f:0f:05:e7:3c:32:f9:59:90:3d:86:fd:93:37:2b:07:aa:7e:4b:87:6d:ec:c1:82:d2:7c:11:b7:a1:f6:28:4c
Signer

Actual PE Digest

5f:0f:05:e7:3c:32:f9:59:90:3d:86:fd:93:37:2b:07:aa:7e:4b:87:6d:ec:c1:82:d2:7c:11:b7:a1:f6:28:4c

Digest Algorithm

sha256

PE Digest Matches

true

bb:ef:69:12:69:39:10:a5:74:82:87:9c:82:47:6d:f3:e4:20:3e:28
Signer

Actual PE Digest

bb:ef:69:12:69:39:10:a5:74:82:87:9c:82:47:6d:f3:e4:20:3e:28

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

FinitPowerData
FinitSsdData
GetPowerItemName
GetPowerItemNameCount
GetPowerItemValue
GetSsdController
GetSsdSata
GetSsdType
GetSsdVendor
InitPowerData
InitSsdData

Sections

CODE
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 17KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ComputerZService.exe
.exe windows:5 windows x86 arch:x86

b0a92c17898ef63bcc925b6e25448a2f

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:35:01:ea:17:c5:39:29:8d:be:59:1e:52:8b:f6:60
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/02/2021, 15:35

Not After

06/03/2032, 15:35

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:b2:de:76:be:97:4e:d6:73:54:5d:21:13:20:da:9e:ff:07:81:84:3d:7f:dc:3c:31:d9:1f:26:3a:00:b7:17
Signer

Actual PE Digest

c9:b2:de:76:be:97:4e:d6:73:54:5d:21:13:20:da:9e:ff:07:81:84:3d:7f:dc:3c:31:d9:1f:26:3a:00:b7:17

Digest Algorithm

sha256

PE Digest Matches

true

44:3d:3b:90:f9:6b:c4:42:26:2e:fd:26:21:d5:6d:01:2e:0b:fe:4f
Signer

Actual PE Digest

44:3d:3b:90:f9:6b:c4:42:26:2e:fd:26:21:d5:6d:01:2e:0b:fe:4f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\545637\out\Release\ComputerZService.pdb

Imports

kernel32

InterlockedExchange
InterlockedCompareExchange
GetCurrentThreadId
WaitForSingleObject
GetLastError
SetLastError
LockResource
FreeLibrary
GetProcAddress
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetCurrentProcess
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
LoadResource
SizeofResource
CloseHandle
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FindResourceExW
WideCharToMultiByte
DecodePointer
InterlockedIncrement
InterlockedDecrement
VirtualProtect
GetCurrentProcessId
RaiseException
SetUnhandledExceptionFilter
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
lstrcmpiW
LoadLibraryExW
IsBadReadPtr
MultiByteToWideChar
GetFileSizeEx
WriteFile
ReadFile
WritePrivateProfileStringW
CreateFileW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
GetShortPathNameW
GetLongPathNameW
OpenProcess
CreateMutexW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Sleep
GlobalMemoryStatusEx
GetPrivateProfileIntW
GetPrivateProfileStringW
GetTickCount
FlushFileBuffers
ConnectNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState
GetNamedPipeInfo
CreateNamedPipeW
GetNamedPipeHandleStateW
SetEvent
ResetEvent
WaitForMultipleObjects
CreateEventW
GetOverlappedResult
PeekNamedPipe
CancelIo
GetTimeZoneInformation
GetSystemWindowsDirectoryW
FreeResource
GetLocalTime
WaitForSingleObjectEx
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
ReadConsoleW
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileSize
WriteConsoleW
GetACP
GetStdHandle
GetModuleFileNameA
GetSystemInfo
VirtualQuery
LoadLibraryExA
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
FormatMessageW
GetStringTypeW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
LocalFree
ReleaseMutex
GetVersionExW
SetFilePointer
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
QueryPerformanceCounter
FindClose
GetSystemDirectoryW
FindFirstFileW
FindNextFileW
GetCurrentThread
OpenThread
SetThreadPriority
GetThreadPriority
GetThreadContext
SuspendThread
ResumeThread
GetThreadSelectorEntry
InterlockedExchangeAdd
DeviceIoControl
lstrcmpA
lstrcmpiA
CreateFileA
RtlUnwind
InterlockedFlushSList
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetFileAttributesExW
SetConsoleCtrlHandler
GetFileType
SetFilePointerEx
GetConsoleCP
GetConsoleMode
ExitProcess

user32

FindWindowExW
GetWindowLongW
KillTimer
SetTimer
IsWindow
CallWindowProcW
SendMessageTimeoutW
LoadCursorW
SetWindowLongW
GetWindowThreadProcessId
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
PostMessageW
wsprintfW
UnregisterClassA
PostQuitMessage
CharNextW

oleaut32

SysAllocString
VarUI4FromStr
VariantInit
SysFreeString
VariantClear

Sections

.text
Size: 849KB - Virtual size: 848KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 165KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ComputerZ_HardwareDll.dll
.dll windows:5 windows x86 arch:x86

14276228b3e49d97f6c9d6816da98fb6

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d2:d9:da:63:f7:b5:a0:29:f2:b2:78:35:de:84:16:f8:7d:c4:37:d1:c8:d3:ee:ed:27:1f:96:e4:13:4d:28:e0
Signer

Actual PE Digest

d2:d9:da:63:f7:b5:a0:29:f2:b2:78:35:de:84:16:f8:7d:c4:37:d1:c8:d3:ee:ed:27:1f:96:e4:13:4d:28:e0

Digest Algorithm

sha256

PE Digest Matches

true

a1:c5:7c:24:a0:12:a2:8f:ea:9d:d9:10:62:74:cd:ad:07:5d:96:fc
Signer

Actual PE Digest

a1:c5:7c:24:a0:12:a2:8f:ea:9d:d9:10:62:74:cd:ad:07:5d:96:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\build\core_lib\hardware\Release\ComputerZ_HardwareDll.pdb

Imports

ole32

StringFromCLSID
CLSIDFromString
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoTaskMemFree
CoCreateGuid
CoUninitialize
CoInitialize
StringFromGUID2

kernel32

UnmapViewOfFile
CreateFileMappingW
GetTempPathW
CreateFileW
GetProcAddress
InitializeCriticalSection
LoadLibraryW
GetModuleHandleW
GetSystemDirectoryW
GetFileSize
ReadFile
WriteFile
DeleteFileW
GetModuleFileNameW
InterlockedDecrement
FreeLibrary
VirtualAlloc
VirtualFree
Sleep
DeviceIoControl
GetDriveTypeW
DefineDosDeviceW
GetVersionExW
DecodePointer
DisableThreadLibraryCalls
GetCurrentProcess
GetCurrentProcessId
CreateDirectoryW
GetPrivateProfileIntW
GetSystemTimeAsFileTime
ResetEvent
TerminateThread
GetExitCodeThread
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ReleaseSemaphore
GetSystemInfo
CreateSemaphoreW
ExpandEnvironmentStringsW
LocalAlloc
GetCurrentThread
SetThreadPriority
GetThreadPriority
SetPriorityClass
GetPriorityClass
QueryPerformanceCounter
QueryPerformanceFrequency
WritePrivateProfileStringW
GetProcessAffinityMask
SetThreadAffinityMask
GlobalMemoryStatusEx
GetLocalTime
SetLastError
GetOverlappedResult
InterlockedIncrement
TerminateProcess
SetUnhandledExceptionFilter
GetPrivateProfileStringW
ReleaseMutex
CreateMutexW
CreateProcessW
SetFilePointer
OutputDebugStringW
SetErrorMode
OutputDebugStringA
FlushFileBuffers
GetStartupInfoW
GetTempFileNameW
GetFileAttributesExW
SetProcessWorkingSetSize
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
VerSetConditionMask
VerifyVersionInfoW
WideCharToMultiByte
FindNextFileA
FindFirstFileExW
FindFirstFileExA
SetConsoleCtrlHandler
WaitForSingleObject
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetModuleFileNameA
ExitProcess
InitializeCriticalSectionAndSpinCount
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
InterlockedFlushSList
RtlUnwind
lstrcmpiA
FileTimeToSystemTime
CreateEventW
GetTickCount
CloseHandle
WaitForMultipleObjects
GetCurrentThreadId
InterlockedCompareExchange
InterlockedExchange
LocalFree
MultiByteToWideChar
FindResourceExW
FindResourceW
SizeofResource
LoadResource
GetLastError
RaiseException
GetProcessHeap
LeaveCriticalSection
OpenSemaphoreW
CancelIo
InterlockedExchangeAdd
TryEnterCriticalSection
AreFileApisANSI
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
MapViewOfFile
SetEvent
GetFileSizeEx
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LockResource
IsValidCodePage
DeleteCriticalSection
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetFileAttributesW
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
HeapCompact
SetEnvironmentVariableA
SetEnvironmentVariableW
UnlockFile
CreateFileMappingA
LockFileEx
SetStdHandle
SystemTimeToFileTime
GetSystemTime
FormatMessageA
UnhandledExceptionFilter
GetACP
lstrcpynW
lstrlenW
FindNextFileW
FindFirstFileW
lstrcmpiW
lstrcmpA
FindClose
GetWindowsDirectoryW
GlobalFree
GlobalAlloc
LoadLibraryExW
LoadLibraryExA
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
EncodePointer
GetCPInfo
FormatMessageW
GetStringTypeW
FreeResource
GetModuleHandleExW
EnterCriticalSection
GetTimeZoneInformation
WriteConsoleW
GetSystemWindowsDirectoryW

user32

GetClassInfoExW
RegisterClassExW
CallWindowProcW
PostQuitMessage
DefWindowProcW
PostMessageW
SendMessageTimeoutW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
MessageBoxW
FindWindowW
IsWindow
EnumDisplaySettingsW
KillTimer
SetTimer
EnumDisplayDevicesW
GetSystemMetrics
UnregisterClassW
wsprintfW
DestroyWindow
GetWindowLongW
SetWindowLongW
LoadCursorW
UnregisterClassA
CreateWindowExW
FindWindowExW

gdi32

GetDeviceCaps
DeleteDC
CreateDCW

advapi32

GetTokenInformation
RegSetValueExW
OpenProcessToken
CryptContextAddRef
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptSetKeyParam
InitializeSecurityDescriptor
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
SetKernelObjectSecurity
SetSecurityDescriptorDacl
DeleteService
CreateServiceW
ControlService
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW

shell32

SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ord165
ShellExecuteW
SHCreateDirectoryExW
ShellExecuteExW
SHFileOperationW
CommandLineToArgvW

oleaut32

CreateErrorInfo
SetErrorInfo
VariantChangeType
GetErrorInfo
SysStringLen
SafeArrayGetVartype
SafeArrayUnlock
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
VariantClear
VariantInit
SafeArrayGetElement
SysFreeString
SysAllocString
SafeArrayLock
SafeArrayUnaccessData
VarBstrCat
SysAllocStringLen

shlwapi

StrStrIW
StrTrimA
PathRemoveFileSpecW
StrStrIA
PathAddBackslashW
PathFileExistsW
PathCombineW
StrCmpNIW
PathMatchSpecW
SHGetValueW
StrToIntW
PathIsRelativeW
PathIsRootW
StrToIntExW
SHGetValueA
SHSetValueA
PathIsPrefixW
StrStrW
PathFindFileNameW
PathFindExtensionW
StrCmpIW
PathAppendW

dbghelp

MiniDumpWriteDump

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

setupapi

SetupDiDestroyDeviceInfoList
SetupIterateCabinetW
SetupVerifyInfFileW
SetupEnumInfSectionsW
SetupGetSourceInfoW
SetupGetTargetPathW
SetupGetSourceFileLocationW
SetupGetStringFieldW
SetupGetFieldCount
SetupGetLineCountW
SetupGetLineByIndexW
SetupFindNextMatchLineW
SetupFindNextLine
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenAppendInfFileW
SetupOpenInfFileW
CM_Reenumerate_DevNode
CM_Locate_DevNodeW
SetupDiClassNameFromGuidW
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiGetClassDescriptionW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
CM_Get_DevNode_Status
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDriverInfoList
CM_Get_Device_IDW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo

avicap32

capGetDriverDescriptionW

winmm

timeGetDevCaps
timeGetTime
waveOutGetDevCapsW
waveInGetDevCapsW
mixerGetNumDevs
auxGetNumDevs
midiInGetNumDevs
midiOutGetNumDevs
waveInGetNumDevs
waveOutGetNumDevs
mixerGetDevCapsW
midiOutGetDevCapsW
midiInGetDevCapsW
auxGetDevCapsW
timeEndPeriod
timeBeginPeriod

iphlpapi

GetAdaptersInfo
GetNetworkParams

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

rpcrt4

UuidFromStringW
UuidToStringW

wininet

InternetGetConnectedState

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

Exports

Exports

DirectXVersionProcess
Export_GetInfo
Export_Init
Finit
GetHarddiskSMARTInfo
GetHardwareInfo
GetInfo
GetInfo2
Init
InitCpuUsage
InitScanType
NvidiaMonitorSizeOfProcess
OpenCLTestProcess
PreInit
UploadAllNew

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 937KB - Virtual size: 936KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 126KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Config/config.xml
Config/defaultskin/MiniUI.xml
Config/defaultskin/defaultskin.ui
.zip
Common/360Safe-16new.png
.png
Common/360Safe.ico
Common/Buttom_Hover.png
.png
Common/CoolUI/Button_Normal.png
.png
Common/CoolUI/DlgBackground.png
.png
Common/CoolUI/DlgBackground_NB.png
.png
Common/CoolUI/DlgBackground_simple.png
.png
Common/CoolUI/TopBanner/Mainbanner_Danger.png
.png
Common/CoolUI/TopBanner/Mainbanner_Normal.png
.png
Common/CoolUI/TopBanner/Mainbanner_Safe.png
.png
Common/CoolUI/TopBanner/Mainbanner_Warn.png
.png
Common/CoolUI/cool_dlg_with_tab.png
.png
Common/CoolUI/tab/tab_background.PNG
.png
Common/CoolUI/tab/tab_hover.PNG
.png
Common/CoolUI/tab/tab_normal.PNG
.png
Common/CoolUI/tab/tab_pushed.PNG
.png
Common/DlgBackground.jpg
.jpg
Common/Foreground.jpg
.jpg
Common/Safe_S.png
.png
Common/SearchR_InfoS.png
.png
Common/Tips.png
.png
Common/animation.gif
.gif
Common/bkgnd-border.png
.png
Common/button_disable.jpg
.jpg
Common/button_focus.jpg
.jpg
Common/button_hover.jpg
.jpg
Common/button_normal.jpg
.jpg
Common/button_pushed.jpg
.jpg
Common/checkbox.png
.png
Common/close.png
.png
Common/collapse.bmp
Common/dynamic_listbox_item_hover.png
.png
Common/dynamic_listbox_item_normal.png
.png
Common/dynamic_listbox_item_pushed.png
.png
Common/error_back.png
.png
Common/expand.bmp
Common/frame.jpg
.jpg
Common/frame_border.bmp
Common/headerctrl_hover.bmp
Common/headerctrl_normal.bmp
Common/headerctrl_normal16.bmp
Common/headerctrl_pushed.bmp
Common/listCtrlBtn_Disable.jpg
.jpg
Common/listCtrlBtn_Focus.jpg
.jpg
Common/listCtrlBtn_Hover.jpg
.jpg
Common/listCtrlBtn_Normal.jpg
.jpg
Common/listCtrlBtn_Pushed.jpg
.jpg
Common/msg_icon_check.png
.png
Common/msg_icon_error.png
.png
Common/msg_icon_info.png
.png
Common/msg_icon_question.png
.png
Common/msg_icon_warning.png
.png
Common/netstateerror2.png
.png
Common/netstateok2.png
.png
Common/old/sys_button_close.png
.png
Common/old/sys_button_max.png
.png
Common/old/sys_button_menu.png
.png
Common/old/sys_button_min.png
.png
Common/old/sys_button_restore.png
.png
Common/old/sys_dlg_close.png
.png
Common/old/sys_dlg_max.png
.png
Common/old/sys_dlg_min.png
.png
Common/old/sys_dlg_restore.png
.png
Common/old/sysmenu_close2.png
.png
Common/popup_dialog_title_bar_background.bmp
Common/progress_ctrl_background.bmp
Common/progress_ctrl_fg.bmp
Common/radiobutton.bmp
Common/scrollh/background.png
.png
Common/scrollh/buttons.png
.png
Common/scrollh/thumb.png
.png
Common/scrollh/thumbgripper.png
.png
Common/scrollv/background.png
.png
Common/scrollv/buttons.png
.png
Common/scrollv/thumb.png
.png
Common/scrollv/thumbgripper.png
.png
Common/sys_button_close.png
.png
Common/sys_button_max.png
.png
Common/sys_button_min.png
.png
Common/sys_button_min2.png
.png
Common/sys_button_restore.png
.png
Common/sys_dlg_close.png
.png
Common/sysmenu_close2.png
.png
Common/tab_background.bmp
Common/tab_background.png
.png
Common/tab_hover.PNG
.png
Common/tab_normal.PNG
.png
Common/tab_pushed.PNG
.png
Common/tips_D01.png
.png
Common/title_bar_menu.png
.png
Common/toolbar_hover.png
.png
Common/toolbar_normal.png
.png
Common/toolbar_pushed.png
.png
Common/toolbar_sim_hover.png
.png
Common/toolbar_sim_normal.png
.png
Common/toolbar_sim_pushed.png
.png
ver.txt
DIFxAPI_x86.dll
.dll windows:6 windows x86 arch:x86

c8bb176aa316a8a34b7e7e1439c67e13

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

26:98:6b:1f:23:b8:07:df:c1:05:57:1b:9c:b8:b1:59:1a:1f:7c:a1
Signer

Actual PE Digest

26:98:6b:1f:23:b8:07:df:c1:05:57:1b:9c:b8:b1:59:1a:1f:7c:a1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

DIFXAPI.pdb

Imports

ntdll

RtlUnwind
RtlNtStatusToDosError
VerSetConditionMask

kernel32

VerifyVersionInfoW
GetVersionExW
lstrlenW
FreeLibrary
GetProcAddress
LoadLibraryW
DeleteFileW
SetFileAttributesW
GetEnvironmentVariableW
CompareStringW
GetFileAttributesW
MoveFileExW
GetTempFileNameW
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
GetSystemWindowsDirectoryW
MultiByteToWideChar
WideCharToMultiByte
GetFullPathNameW
CopyFileW
LocalFree
RemoveDirectoryW
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
CreateDirectoryW
LocalReAlloc
LocalAlloc
GetProcessHeap
ReleaseMutex
GetSystemDirectoryW
DeviceIoControl
WaitForSingleObject
CreateMutexW
GetSystemTimeAsFileTime
Sleep
RaiseException
GetVersionExA
HeapSize
GetCommandLineA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetModuleHandleA
ExitProcess
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteFile
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateFileA
GetThreadLocale
WaitForMultipleObjects
InterlockedCompareExchange
SetEvent
CreateEventW
SetEndOfFile
SetLastError
InterlockedExchange
lstrcmpiW
InterlockedDecrement
GetLastError
InterlockedIncrement
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
HeapFree
HeapReAlloc
EnterCriticalSection
HeapAlloc
LeaveCriticalSection
HeapDestroy
GetModuleHandleW
DeleteCriticalSection
GetModuleFileNameA
OutputDebugStringA
HeapCreate
InitializeCriticalSection
TlsGetValue

user32

UnregisterClassA
CharLowerW
CharPrevW

setupapi

CM_Query_And_Remove_SubTreeW
SetupDiSetDeviceRegistryPropertyW
SetupQueueCopyIndirectW
SetupDiCallClassInstaller
SetupDiBuildDriverInfoList
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetSelectedDevice
SetupDiOpenDeviceInfoW
SetupDiOpenDevRegKey
SetupDiGetDeviceInstanceIdW
SetupDiCreateDeviceInfoList
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupDiSetClassInstallParamsW
SetupDiClassNameFromGuidW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Locate_DevNodeW
CM_Get_DevNode_Status
CM_Setup_DevNode
SetupDiGetDeviceRegistryPropertyW
SetupGetTargetPathW
SetupInstallFilesFromInfSectionW
SetupPromptReboot
SetupInstallFromInfSectionW
SetupInstallServicesFromInfSectionW
SetupDiGetActualSectionToInstallW
SetupFindNextLine
SetupFindNextMatchLineW
SetupOpenInfFileW
SetupOpenFileQueue
SetupCommitFileQueueW
SetupQueueCopyW
SetupCloseFileQueue
SetupGetLineCountW
SetupCloseInfFile
SetupFindFirstLineW
SetupGetFieldCount
SetupGetIntField
CM_Enumerate_Classes
SetupDiEnumDeviceInfo
SetupInitDefaultQueueCallbackEx
SetupDefaultQueueCallbackW
SetupDiGetClassDevsW
SetupDiOpenClassRegKey
CM_Get_Device_IDW
SetupDiDestroyDeviceInfoList
SetupGetStringFieldW
pSetupGetGlobalFlags
pSetupSetGlobalFlags
SetupOpenAppendInfFileW
SetupCopyOEMInfW
SetupTermDefaultQueueCallback

advapi32

FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
SetEntriesInAclW
QueryServiceStatus
DeleteService
ControlService
CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW
RegCloseKey

ole32

StringFromCLSID
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance

wintrust

CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

crypt32

CertFreeCertificateContext
CertGetCTLContextProperty
CryptQueryObject
CertFreeCTLContext

Exports

Exports

DIFXAPISetLogCallbackA
DIFXAPISetLogCallbackW
DriverPackageGetPathA
DriverPackageGetPathW
DriverPackageInstallA
DriverPackageInstallW
DriverPackagePreinstallA
DriverPackagePreinstallW
DriverPackageUninstallA
DriverPackageUninstallW
SetDifxLogCallbackA
SetDifxLogCallbackW

Sections

.text
Size: 280KB - Virtual size: 279KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DataMgr.dll
.dll regsvr32 windows:5 windows x86 arch:x86

0be7c209bf420f1c80239aaccd50124f

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fc:97:5f:6f:6c:67:dd:8b:85:64:fc:58:5d:dc:de:dc:67:fa:c8:6d:5c:ea:8e:e2:3b:0b:4e:09:58:84:06:a3
Signer

Actual PE Digest

fc:97:5f:6f:6c:67:dd:8b:85:64:fc:58:5d:dc:de:dc:67:fa:c8:6d:5c:ea:8e:e2:3b:0b:4e:09:58:84:06:a3

Digest Algorithm

sha256

PE Digest Matches

true

1e:97:0e:be:cf:78:38:cf:c7:7c:3d:2f:39:1f:50:2d:68:13:81:68
Signer

Actual PE Digest

1e:97:0e:be:cf:78:38:cf:c7:7c:3d:2f:39:1f:50:2d:68:13:81:68

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\331973\out\Release\DataMgr.pdb

Imports

kernel32

LoadResource
SizeofResource
lstrcmpiW
CreateEventW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
MultiByteToWideChar
GetLongPathNameW
OpenProcess
GetCurrentProcess
TerminateProcess
CloseHandle
lstrlenW
GetStartupInfoW
EncodePointer
DecodePointer
GetThreadLocale
SetThreadLocale
DebugBreak
lstrlenA
OutputDebugStringW
WriteFile
ReadFile
FlushFileBuffers
SetNamedPipeHandleState
CreateFileW
GetOverlappedResult
WaitForMultipleObjects
CancelIo
GetFileSizeEx
GetLocalTime
GetCurrentProcessId
DeviceIoControl
ResetEvent
ReadConsoleW
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
SetEvent
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetFileType
GetStdHandle
InitializeCriticalSection
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RaiseException
GetACP
HeapReAlloc
HeapSize
LCMapStringW
WideCharToMultiByte
GetModuleFileNameA
ExitProcess
VirtualQuery
VirtualProtect
GetCurrentThreadId
GetSystemInfo
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
InterlockedFlushSList
RtlUnwind
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateMutexW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ReleaseMutex
OpenThread
HeapWalk
HeapUnlock
HeapLock
SetFilePointerEx
SetEndOfFile
CreateFileA
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTimeAsFileTime
LoadLibraryExA
WaitForSingleObject
GetCPInfo
IsDebuggerPresent
HeapAlloc
HeapFree
GetProcessHeap
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree

user32

PostMessageW
DestroyWindow
DefWindowProcW
CallWindowProcW
UnregisterClassW
SendMessageW
GetWindowLongW
IsWindow
RegisterClassExW
CreateWindowExW
GetClassInfoExW
SetWindowLongW
CharNextW
MessageBoxW
GetActiveWindow
GetWindowThreadProcessId
KillTimer
SetTimer
FindWindowW
SendMessageTimeoutW
LoadStringW
wsprintfW
LoadCursorW

advapi32

RegQueryValueExW
RegCloseKey
RegCreateKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExA

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHCreateDirectoryExW
ord680
ShellExecuteExW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoInitializeEx

oleaut32

LoadRegTypeLi
SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
SysAllocString
RegisterTypeLi
UnRegisterTypeLi
VariantInit
VariantClear
SafeArrayCreate
SafeArrayLock
SafeArrayUnlock
SafeArrayPutElement
SafeArrayCopy
SafeArrayGetVartype

shlwapi

PathIsRelativeW
PathFileExistsW
PathCombineW
PathRemoveFileSpecW
PathFindFileNameW
PathAppendW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
GetDataMgrProxy2
GetDataMgrProxy3
GetDataMgrProxyEx

Sections

.text
Size: 364KB - Virtual size: 364KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DownloadMgr.dll
.dll windows:5 windows x86 arch:x86

3906b7139ebe4989679b89abfaffcd96

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

28/01/2021, 11:08

Not After

01/03/2032, 11:08

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:de:be:ca:e5:ce:fc:32:a7:9c:0d:5a:ff:8f:f7:08:c6:1a:1b:38:74:c6:b4:24:c2:77:22:a1:0b:6c:53:e0
Signer

Actual PE Digest

54:de:be:ca:e5:ce:fc:32:a7:9c:0d:5a:ff:8f:f7:08:c6:1a:1b:38:74:c6:b4:24:c2:77:22:a1:0b:6c:53:e0

Digest Algorithm

sha256

PE Digest Matches

true

f7:06:fd:4d:63:f9:98:fe:f9:1c:5d:20:42:c5:74:83:75:f1:b8:03
Signer

Actual PE Digest

f7:06:fd:4d:63:f9:98:fe:f9:1c:5d:20:42:c5:74:83:75:f1:b8:03

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\580049\out\Release\DownloadMgr.pdb

Imports

kernel32

WideCharToMultiByte
GetLastError
ReadFile
FlushFileBuffers
GetFileAttributesExW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
CreateEventW
ResetEvent
MultiByteToWideChar
HeapAlloc
GetProcessHeap
HeapFree
lstrlenA
DeviceIoControl
GetModuleFileNameA
GetStartupInfoW
CreateProcessW
GetExitCodeProcess
SetLastError
GetTickCount
QueryPerformanceCounter
LocalAlloc
SetEvent
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
WaitForMultipleObjects
ExpandEnvironmentStringsW
GetProcessId
GetCurrentProcessId
InterlockedIncrement
InterlockedDecrement
CreateFileA
lstrcmpiA
lstrcmpA
GetSystemDirectoryW
SetEnvironmentVariableA
CompareStringW
GetCurrentThreadId
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetFileSizeEx
SetFilePointer
WriteFile
CreateFileW
DeleteCriticalSection
InitializeCriticalSection
WritePrivateProfileStringW
InterlockedExchange
GetPrivateProfileIntW
GetVersionExW
GetSystemWindowsDirectoryW
GetCurrentProcess
FreeResource
GetCommandLineW
Sleep
InterlockedCompareExchange
GetSystemInfo
GetModuleHandleA
LocalFree
lstrlenW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CloseHandle
WaitForSingleObject
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
FreeLibrary
GetProcAddress
GetModuleHandleW
DeleteFileW
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
HeapCreate
VirtualAlloc
VirtualFree
IsValidCodePage
GetOEMCP
GetACP
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetStdHandle
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetCommandLineA
GetDateFormatA
GetTimeFormatA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CreateThread
LoadLibraryExW
CompareStringA
ExitThread
ExitProcess
TlsFree
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetEndOfFile
SetFilePointerEx
CreateMutexW
TlsGetValue
OutputDebugStringW
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
ReleaseMutex
TlsAlloc

user32

GetActiveWindow
MessageBoxW
PostMessageW
GetClassInfoExW
RegisterClassExW
CreateWindowExW
DefWindowProcW

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExW
RegEnumKeyExW
CloseServiceHandle
ChangeServiceConfigW
UnlockServiceDatabase
QueryServiceLockStatusW
LockServiceDatabase
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExA

shell32

ShellExecuteExW
ord165
SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteW
SHGetDiskFreeSpaceExW

shlwapi

StrCatW
StrCmpNIW
PathIsDirectoryW
SHDeleteKeyW
PathFindFileNameW
SHDeleteValueW
StrStrIW
StrStrW
SHGetValueW
PathCombineW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
PathAddBackslashW
StrStrIA
SHSetValueA
SHGetValueA

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Exports

Exports

Create360DownloadMgrInterface
Create360DownloadMgrInterface2

Sections

.text
Size: 338KB - Virtual size: 338KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DrvInst64.exe
.exe windows:5 windows x64 arch:x64

79f0d93a87087b5e6281e9ec47c35f19

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

51:01:fe:98:6b:c2:13:34:9d:df:9c:dd:65:6c:ac:20:41:12:0f:5d:5c:7b:16:32:2a:d8:d4:eb:08:0c:3f:e9
Signer

Actual PE Digest

51:01:fe:98:6b:c2:13:34:9d:df:9c:dd:65:6c:ac:20:41:12:0f:5d:5c:7b:16:32:2a:d8:d4:eb:08:0c:3f:e9

Digest Algorithm

sha256

PE Digest Matches

true

71:22:68:0f:47:1c:bc:92:8c:a5:1b:11:8f:65:99:bd:e4:b2:b7:5a
Signer

Actual PE Digest

71:22:68:0f:47:1c:bc:92:8c:a5:1b:11:8f:65:99:bd:e4:b2:b7:5a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\vmagent_new\bin\joblist\253800\out\Release\DrvInst64.pdb

Imports

kernel32

LoadLibraryW
GetProcAddress
FreeLibrary
LocalFree
CreateFileW
WideCharToMultiByte
WriteFile
FindResourceExW
FindResourceW
LoadResource
GetModuleHandleW
SizeofResource
GetVersionExW
LockResource
GetVersion
lstrcpynW
GetModuleHandleA
GetSystemInfo
GetModuleFileNameW
GetCommandLineW
lstrlenW
GetCurrentThreadId
MultiByteToWideChar
HeapAlloc
GetProcessHeap
HeapFree
GetSystemDirectoryW
CloseHandle
CreateMutexW
FindClose
FindNextFileW
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
FindFirstFileW
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
SetFilePointer
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
LCMapStringW
HeapCreate
HeapSetInformation
GetModuleFileNameA
GetStdHandle
ExitProcess
Sleep
FlsAlloc
ReadFile
SetLastError
FlsFree
FlsSetValue
FlsGetValue
GetWindowsDirectoryW
GetLastError
GetFullPathNameW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapReAlloc
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
RtlUnwindEx
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer

advapi32

GetAclInformation
GetAce
SetNamedSecurityInfoW
GetNamedSecurityInfoW

shell32

SHGetSpecialFolderPathW
ord165
CommandLineToArgvW

shlwapi

SHGetValueW
PathFindFileNameW
PathFileExistsW
PathAppendW
StrCmpIW
PathRemoveFileSpecW

setupapi

SetupGetLineByIndexW
SetupGetTargetPathW
SetupGetSourceInfoW
SetupGetSourceFileLocationW
SetupFindNextLine
SetupFindNextMatchLineW
SetupGetStringFieldW
SetupGetFieldCount
SetupFindFirstLineW
SetupEnumInfSectionsW
SetupCloseInfFile
SetupOpenAppendInfFileW
SetupOpenInfFileW
SetupDiGetSelectedDriverW
SetupDiBuildDriverInfoList
SetupDiSetDeviceInstallParamsW
SetupDiSetSelectedDevice
SetupDiCreateDeviceInfoList
CM_Reenumerate_DevNode_Ex
CM_Locate_DevNode_ExW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstallParamsW
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsW
CM_Get_Device_IDW
SetupDiGetDeviceInfoListDetailW
SetupDiOpenDeviceInfoW
SetupDiGetClassDevsW
SetupUninstallOEMInfW
SetupGetLineCountW

rpcrt4

UuidFromStringW

difxapi

DIFXAPISetLogCallbackW
DriverPackagePreinstallW
DriverPackageInstallW

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DrvMgrUI.dll
.dll windows:5 windows x86 arch:x86

de59937a01d4aae33b2e6fd66fbede82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\543781\out\Release\DrvMgrUI.pdb

Imports

kernel32

GlobalLock
GlobalAlloc
lstrcmpW
GetTempPathW
ExpandEnvironmentStringsW
MoveFileExW
WaitForMultipleObjects
GetProcessId
lstrcmpiW
GetTempFileNameW
CreateFileA
OutputDebugStringW
DeleteFileA
GetFileSizeEx
FreeResource
GetShortPathNameW
GetCurrentDirectoryW
SetVolumeLabelW
SetFileTime
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
lstrcmpiA
lstrcmpA
GetSystemTime
FormatMessageW
FormatMessageA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetFileAttributesA
GetTempPathA
GetVersionExA
LockFileEx
LockFile
UnlockFile
AreFileApisANSI
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
DeviceIoControl
CreateEventW
GlobalUnlock
GetStartupInfoA
GetFileType
SetHandleCount
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
InitializeCriticalSectionAndSpinCount
GetStdHandle
CompareStringA
CompareStringW
GetStringTypeW
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetCommandLineA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatA
GetTimeFormatA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitThread
ExitProcess
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
TlsGetValue
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
InterlockedDecrement
InterlockedIncrement
LocalAlloc
GetLastError
CreateFileW
GetDriveTypeW
GetSystemDirectoryW
MoveFileW
FlushFileBuffers
WriteFile
ReadFile
SetFilePointer
GetFileSize
WritePrivateProfileStringW
MulDiv
RaiseException
FlushInstructionCache
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerW
GetFileAttributesW
GetFullPathNameW
CreateMutexW
GetWindowsDirectoryW
SetEvent
QueryPerformanceCounter
GetTickCount
GetModuleFileNameA
GetFileAttributesExW
SetFileAttributesW
GetCurrentProcess
GetVersion
lstrlenA
GetPrivateProfileStringW
GetPrivateProfileIntW
HeapFree
GetProcessHeap
HeapAlloc
MultiByteToWideChar
GetFullPathNameA
ResetEvent
GetCurrentThreadId
SetLastError
CreateProcessW
GetStartupInfoW
GetDiskFreeSpaceExW
GetVersionExW
FindClose
FindNextFileW
FindFirstFileW
GetCurrentProcessId
GetExitCodeProcess
OpenProcess
InterlockedExchange
GetCommandLineW
Sleep
InterlockedCompareExchange
GetSystemInfo
GetModuleHandleA
LocalFree
lstrlenW
CreateThread
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
CloseHandle
WaitForSingleObject
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
FreeLibrary
GetProcAddress
GetModuleHandleW
LoadLibraryExW
DeleteFileW

user32

CreateWindowExW
CopyRect
GetParent
InvalidateRect
SetWindowTextW
MoveWindow
FindWindowW
PostMessageW
RegisterWindowMessageW
ReleaseDC
IsChild
GetFocus
GetSysColor
GetClassNameW
GetActiveWindow
UnregisterClassA
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
GetDlgItem
GetWindowRect
GetDC
LoadImageW
GetShellWindow
CharNextW
CreateAcceleratorTableW
FindWindowExW
ScreenToClient
InvalidateRgn
GetDesktopWindow
DestroyAcceleratorTable
EndDialog
DialogBoxParamW
MonitorFromWindow
GetMonitorInfoW
GetSystemMetrics
WindowFromPoint
GetCapture
UpdateLayeredWindow
GetClassLongW
FillRect
DrawTextW
IntersectRect
GetDlgCtrlID
ClientToScreen
RedrawWindow
SetScrollPos
GetScrollInfo
SetScrollInfo
DrawIconEx
DestroyIcon
GetCursorPos
ReleaseCapture
SetCapture
SetFocus
DestroyWindow
IsDialogMessageW
GetWindowTextLengthW
GetWindowTextW
EnableWindow
ShowWindow
SetTimer
KillTimer
OffsetRect
SetCursor
DrawFocusRect
UnionRect
InflateRect
SystemParametersInfoW
ScrollWindowEx
EndPaint
BeginPaint
UpdateWindow
SetWindowPos
MapWindowPoints
GetWindow
SendMessageW
IsWindowVisible
GetClientRect
SetRectEmpty
IsRectEmpty
PtInRect
SetRect
CallWindowProcW
GetWindowLongW
SetWindowLongW
DefWindowProcW
LoadCursorW
GetClassInfoExW
RegisterClassExW
SendMessageTimeoutW
IsWindow
PostThreadMessageW
GetWindowThreadProcessId

gdi32

IntersectClipRect
CreateRectRgnIndirect
ExcludeClipRect
GetTextColor
TextOutW
GetTextExtentPoint32W
SetTextColor
OffsetViewportOrgEx
GetClipBox
GetBitmapBits
RestoreDC
SaveDC
CreateFontW
SetBkMode
SetDCPenColor
CreateCompatibleBitmap
SelectClipRgn
GetDeviceCaps
RectVisible
LineTo
MoveToEx
CreatePen
ExtTextOutW
SetBkColor
SetViewportOrgEx
BitBlt
CreateDIBSection
SetStretchBltMode
StretchBlt
SelectObject
DeleteDC
CreateCompatibleDC
GetObjectW
GetStockObject
CreateFontIndirectW
DeleteObject
CreateRectRgn
CreateSolidBrush

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
CloseServiceHandle
CreateServiceW
ChangeServiceConfig2W
ChangeServiceConfigW
UnlockServiceDatabase
QueryServiceLockStatusW
LockServiceDatabase
StartServiceW
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
RegDeleteValueW
RegSetValueExW
DuplicateTokenEx
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyW
RegEnumKeyExA

shell32

SHFileOperationW
ShellExecuteExW
ord165
CommandLineToArgvW
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc
OleInitialize
CLSIDFromString
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
OleUninitialize
CoTaskMemFree
StringFromCLSID
CoUninitialize
CoCreateInstance
CoInitialize
CLSIDFromProgID

oleaut32

SysStringLen
SysFreeString
VariantClear
SysStringByteLen
VarUI4FromStr
SysAllocStringByteLen
SystemTimeToVariantTime
VariantInit
VariantTimeToSystemTime
OleCreateFontIndirect
LoadRegTypeLi
SysAllocStringLen
SysAllocString
VariantCopy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
DispCallFunc
LoadTypeLi

shlwapi

SHGetValueW
PathCombineW
PathRemoveFileSpecW
StrStrW
StrStrIW
AssocQueryStringW
PathIsRootW
SHDeleteValueW
PathAppendW
PathIsDirectoryW
PathStripPathW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
StrStrIA
StrChrW
StrCmpIW
SHSetValueA
PathFileExistsW
SHSetValueW
SHGetValueA
PathIsRelativeW

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

setupapi

SetupFindNextMatchLineW
SetupGetStringFieldW
SetupGetFieldCount
SetupFindFirstLineW
SetupEnumInfSectionsW
SetupOpenInfFileW
SetupDiDestroyDeviceInfoList
CM_Get_DevNode_Status
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo

Exports

Exports

CreatePage

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DrvmgrCore.dll
.dll windows:5 windows x86 arch:x86

c7a3dee0b4c74b36f7a72dcbab060d2c

Code Sign

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ec:a7:43:e5:3f:51:6e:c4:5e:b1:88:b7:3b:a7:58:a2:c0:e6:7b:76:15:42:4a:11:bb:ca:96:75:72:06:b2:7b
Signer

Actual PE Digest

ec:a7:43:e5:3f:51:6e:c4:5e:b1:88:b7:3b:a7:58:a2:c0:e6:7b:76:15:42:4a:11:bb:ca:96:75:72:06:b2:7b

Digest Algorithm

sha256

PE Digest Matches

true

ae:7b:46:97:f5:4f:1a:ec:e0:96:90:74:32:7c:68:00:77:85:2c:17
Signer

Actual PE Digest

ae:7b:46:97:f5:4f:1a:ec:e0:96:90:74:32:7c:68:00:77:85:2c:17

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\653125\out\Release\DrvmgrCore.pdb

Imports

kernel32

InitializeCriticalSection
SetFileAttributesA
DeleteCriticalSection
GetFileSize
WriteFile
SetFilePointer
GetFileSizeEx
MoveFileW
GetLocalTime
GetCurrentThreadId
FindFirstFileW
FindNextFileW
FindClose
CreateEventW
ResetEvent
MultiByteToWideChar
HeapAlloc
GetProcessHeap
HeapFree
GetPrivateProfileStringW
lstrlenA
GetLastError
OpenProcess
SetFileAttributesW
GetFileAttributesExW
GetModuleFileNameA
GetStartupInfoW
CreateProcessW
GetExitCodeProcess
OpenMutexW
SetLastError
GetTickCount
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemPowerStatus
CreateDirectoryW
SetEvent
WaitForMultipleObjects
GetTempFileNameW
ReadFile
MoveFileExW
SetEndOfFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrcmpiW
InterlockedIncrement
InterlockedDecrement
GetTempPathW
SystemTimeToFileTime
RemoveDirectoryW
FormatMessageW
GetACP
GetWindowsDirectoryW
GetSystemDefaultLangID
GetFullPathNameW
CreateMutexW
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetProcessId
SetWaitableTimer
CancelWaitableTimer
ExpandEnvironmentStringsW
lstrcmpiA
CreateWaitableTimerW
CreateIoCompletionPort
GetExitCodeThread
TerminateThread
PostQueuedCompletionStatus
GetQueuedCompletionStatus
GetVolumeNameForVolumeMountPointW
GetDiskFreeSpaceW
CreateFileA
GetCurrentProcessId
CopyFileW
GetFileAttributesW
lstrcpynW
DeleteFileA
DeviceIoControl
CreateFileW
GetShortPathNameW
GetCurrentDirectoryW
SetVolumeLabelW
SetFileTime
lstrcmpA
GetSystemTime
FormatMessageA
GetDiskFreeSpaceA
GetFullPathNameA
GetFileAttributesA
GetTempPathA
GetVersionExA
LockFileEx
LockFile
UnlockFile
AreFileApisANSI
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
QueryDosDeviceW
GetDriveTypeW
GetSystemDirectoryW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetVolumeInformationW
WritePrivateProfileStringW
InterlockedExchange
GetPrivateProfileIntW
GetVersionExW
GetSystemWindowsDirectoryW
GetCurrentProcess
FreeResource
GetCommandLineW
Sleep
InterlockedCompareExchange
GetSystemInfo
GetModuleHandleA
LocalFree
lstrlenW
WideCharToMultiByte
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CloseHandle
WaitForSingleObject
RaiseException
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
FreeLibrary
GetProcAddress
GetModuleHandleW
LoadLibraryExW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStringTypeA
GetTimeZoneInformation
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
HeapCreate
VirtualAlloc
VirtualFree
IsValidCodePage
GetOEMCP
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetStdHandle
CompareStringA
CompareStringW
GetStringTypeW
LCMapStringW
LCMapStringA
RtlUnwind
GetCommandLineA
GetCPInfo
GetDateFormatA
GetTimeFormatA
FindNextFileA
FindFirstFileA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateThread
ExitThread
ExitProcess
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
OutputDebugStringW
TlsGetValue
SetFilePointerEx
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
HeapSize
HeapReAlloc
HeapDestroy
DeleteFileW

user32

SendMessageTimeoutW
GetActiveWindow
FindWindowW
IsWindow
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageW
GetClassInfoExW
RegisterClassExW
CreateWindowExW
DefWindowProcW
PostThreadMessageW
PostMessageW
FindWindowExW

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyW
RegEnumKeyExA
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW

shell32

SHGetDiskFreeSpaceExW
SHCreateDirectoryExW
SHFileOperationW
SHCreateDirectoryExA
ord165
ShellExecuteW
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoInitialize
StringFromCLSID
CoTaskMemFree

oleaut32

SysFreeString
VariantInit
VariantClear
DispCallFunc
SysAllocString
SysAllocStringLen
VariantChangeType
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetLBound
SafeArrayGetUBound
VarBstrCat
SysStringLen
GetErrorInfo

shlwapi

SHDeleteValueW
PathIsRootW
StrStrIW
StrStrW
StrStrA
PathFileExistsA
SHGetValueW
PathCombineW
PathRemoveFileSpecW
PathAppendW
SHSetValueW
StrFormatByteSizeW
PathStripToRootW
PathGetDriveNumberW
PathAddBackslashW
StrCmpIW
PathFindExtensionA
PathSkipRootA
StrStrIA
PathIsDirectoryW
SHGetValueA
SHSetValueA
PathIsRelativeW
PathStripPathW
PathRemoveExtensionW
PathRemoveBackslashW
PathFindFileNameW
PathFileExistsW
PathFindExtensionW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

setupapi

SetupDiOpenDeviceInfoW
SetupDiGetDeviceInfoListDetailW
CM_Get_Device_IDW
SetupDiSetClassInstallParamsW
SetupDiCreateDeviceInfoList
SetupUninstallOEMInfW
CM_Locate_DevNode_ExW
CM_Reenumerate_DevNode_Ex
CM_Get_Parent
SetupOpenInfFileW
SetupEnumInfSectionsW
SetupFindFirstLineW
SetupDiGetSelectedDriverW
SetupGetStringFieldW
SetupFindNextMatchLineW
SetupOpenAppendInfFileW
SetupCloseInfFile
SetupFindNextLine
SetupGetSourceFileLocationW
SetupGetSourceInfoW
SetupGetTargetPathW
SetupVerifyInfFileW
CM_Get_Device_ID_Size
SetupDiBuildDriverInfoList
SetupIterateCabinetW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiGetClassDescriptionW
SetupDiClassNameFromGuidW
SetupDiCallClassInstaller
SetupGetFieldCount
SetupDiSetSelectedDevice
SetupDiGetDeviceInstanceIdW
CM_Get_DevNode_Status
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW

rpcrt4

UuidToStringW
UuidFromStringW

msi

ord248
ord246

Exports

Exports

CompressFileToZip
CompressFileToZipWithPath
Create360BackupMgrInterface
Create360BackupMgrInterface2
Create360ScanMgrInterface
CreateCloudBackupMgrInterface
CreateInstallAndUnstallManager
CreateScanAndUploadMgrInterface
DrvInterfaceManger_Query
GetDevTypeDisplayName
GetDeviceStatusFullInfo
GetDeviceStatusInfo
GetGlobalInfo
GetGlobalInfo_2
GetMidString
InstallDriver
InstallDriver2
InstallNetDriver
IsHaveSSD
SharedConfigMgr
UninstallAmdDisplay
UninstallDriver
UninstallIntelDisplay
UninstallNvidiaDisplay
_GetDevType

Sections

.text
Size: 1015KB - Virtual size: 1015KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LiveUpd360.dll
.dll windows:5 windows x86 arch:x86

101959e525107cf2128f554199ed85c4

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:ce:60:ad:c8:39:58:38:74:61:1e:09:3e:58:f9:a2:f4:19:d3:97:2e:dc:9b:c1:b6:44:18:75:9f:6c:6b:8b
Signer

Actual PE Digest

25:ce:60:ad:c8:39:58:38:74:61:1e:09:3e:58:f9:a2:f4:19:d3:97:2e:dc:9b:c1:b6:44:18:75:9f:6c:6b:8b

Digest Algorithm

sha256

PE Digest Matches

true

63:a9:45:3e:24:6a:03:05:a5:ac:4e:ea:a5:90:06:8f:e3:5a:a9:df
Signer

Actual PE Digest

63:a9:45:3e:24:6a:03:05:a5:ac:4e:ea:a5:90:06:8f:e3:5a:a9:df

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\177689\out\Release\release\LiveUpd360.pdb

Imports

kernel32

GetFileInformationByHandle
GetFullPathNameA
GetDriveTypeA
PeekNamedPipe
FileTimeToSystemTime
EnterCriticalSection
LeaveCriticalSection
FileTimeToLocalFileTime
GetCurrentDirectoryA
GetProcAddress
GetModuleHandleW
DeleteCriticalSection
FreeLibrary
InitializeCriticalSection
LoadLibraryW
GetCurrentProcessId
CreateFileW
DeviceIoControl
CloseHandle
FindFirstFileA
GetModuleFileNameW
lstrcmpiA
lstrcmpA
SleepEx
GetVersionExA
ExpandEnvironmentStringsA
FormatMessageA
GetSystemDirectoryW
lstrlenA
GetSystemDirectoryA
Sleep
WaitForSingleObject
GetFileAttributesW
RaiseException
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetLastError
GetTickCount
SetEvent
CreateEventW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetModuleHandleExW
FreeLibraryAndExitThread
ReleaseMutex
ReleaseSemaphore
WaitForMultipleObjects
CreateSemaphoreW
CreateMutexW
SetWaitableTimer
CreateWaitableTimerW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetLocalTime
CreateThread
DeleteFileW
SetFilePointer
SetEndOfFile
WriteFile
GetFileSizeEx
FindClose
FindFirstFileW
MoveFileW
MoveFileExW
ReadFile
InterlockedIncrement
InterlockedDecrement
CopyFileW
GetLongPathNameW
GetVersionExW
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
GetFileSize
FlushFileBuffers
GetFileAttributesExW
MulDiv
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
OutputDebugStringW
FormatMessageW
SetLastError
LocalFree
GetSystemTime
TlsGetValue
TlsSetValue
GetAtomNameW
OpenThread
AddAtomW
TlsAlloc
FindAtomW
DeleteAtom
TlsFree
RtlUnwind
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
LCMapStringW
VirtualAlloc
LCMapStringA
GetModuleHandleA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA

user32

CreateWindowExW
MessageBoxW
TranslateMessage
GetMessageW
DispatchMessageW
IsWindow
FindWindowExW
SendMessageTimeoutW
DestroyWindow
PostThreadMessageW
RegisterClassW
UnregisterClassW
DefWindowProcW

shlwapi

wvnsprintfW
SHSetValueA
PathCombineW
PathRemoveFileSpecW
SHGetValueA
PathFileExistsW
SHGetValueW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

gethostbyname
socket
WSAIoctl
setsockopt
htonl
bind
WSAEventSelect
closesocket
WSAGetLastError
gethostname
inet_addr
WSACleanup
WSAStartup
sendto
htons
recvfrom
recv
send
getsockname
getsockopt
getpeername
connect
WSASetLastError
__WSAFDIsSet
select
freeaddrinfo
getaddrinfo
ioctlsocket
WSAWaitForMultipleEvents
ntohs

netapi32

Netbios

advapi32

RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExA
RegEnumKeyExW
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExW

shell32

SHGetSpecialFolderPathW

ole32

CLSIDFromString

Exports

Exports

PPClose
PPCloseHandle
PPDownload
PPGetConfig
PPInit
PPQueryTask
PPQueryTaskEx
PPRemoveTask
PPRestart
PPSetConfig
PPStartTask
PPStartTaskEx
PPStopSeed
PPStopTask
StartLan
StopLan
_EnableP2P
_GetLanupTasks
_GetProductLst
_GetTasks
_IsStopped
_P2SPCancelCheckProxy
_P2SPCheckProxy
_P2SPCheckProxyEx
_P2SPSetOption
_P2SPUpdateRegInfo
_PPQueryIPPort
_PPQueryProduct
_PPQueryTask2
_PPQueryTask3
_PPSetLocalLog
_Run
_SetKeep
_SetKeepEx
_SetLocalLog
_StartRun
_StopRun
__PPSetModulePath2

Sections

.text
Size: 471KB - Virtual size: 470KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MiniUI.dll
.dll windows:5 windows x86 arch:x86

f986ff25a78e0c855385d1734a1726e9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

17:fd:0d:29:3e:e9:e1:4d:d2:ab:20:42:39:ec:8b:18:b4:db:23:8b:16:9d:c2:ab:d8:b8:6f:95:2e:4f:03:14
Signer

Actual PE Digest

17:fd:0d:29:3e:e9:e1:4d:d2:ab:20:42:39:ec:8b:18:b4:db:23:8b:16:9d:c2:ab:d8:b8:6f:95:2e:4f:03:14

Digest Algorithm

sha256

PE Digest Matches

true

a2:18:43:e1:be:48:6d:8c:ad:df:50:6c:76:67:2b:ac:c5:d8:c4:3e
Signer

Actual PE Digest

a2:18:43:e1:be:48:6d:8c:ad:df:50:6c:76:67:2b:ac:c5:d8:c4:3e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\126488\out\Release\MiniUI.pdb

Imports

kernel32

SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleHandleA
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
SetStdHandle
LCMapStringW
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
HeapDestroy
HeapCreate
GetModuleFileNameA
GetStdHandle
HeapSize
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
GetCommandLineA
ExitProcess
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
TlsFree
DeleteAtom
FindAtomW
TlsAlloc
ReleaseMutex
AddAtomW
OpenThread
GetAtomNameW
TlsSetValue
TlsGetValue
CreateMutexW
GetSystemTime
LocalFree
FormatMessageW
GetFileSizeEx
ReadFile
WriteFile
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
LocalAlloc
HeapFree
GetProcessHeap
HeapAlloc
GetVersion
InterlockedExchange
GetFileTime
LoadLibraryExW
lstrcmpiW
FindResourceW
GetLastError
LoadResource
SizeofResource
LockResource
FreeResource
GlobalLock
GlobalUnlock
GlobalFree
CreateEventW
ResumeThread
Sleep
GlobalAlloc
SetEvent
WaitForSingleObject
ResetEvent
MulDiv
GetVersionExW
MultiByteToWideChar
WideCharToMultiByte
GetSystemWindowsDirectoryW
GetStartupInfoW
OutputDebugStringW
DebugBreak
lstrlenA
GetTempPathW
GetTempFileNameW
DeleteFileW
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
CloseHandle
RaiseException
InterlockedDecrement
lstrlenW
EnterCriticalSection
LeaveCriticalSection
CreateProcessW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
DeleteCriticalSection
FreeLibrary
InitializeCriticalSection
LoadLibraryW
GetCurrentProcessId
CreateFileW
DeviceIoControl
IsValidCodePage

user32

SetWindowPos
MonitorFromWindow
CreateDialogParamW
EnableWindow
GetMessageTime
GetPropW
EnableScrollBar
SetTimer
ShowScrollBar
SetPropW
RemovePropW
GetSysColorBrush
DrawEdge
FrameRect
DrawFrameControl
GetParent
UnregisterClassA
KillTimer
SetDlgItemTextW
EndDialog
GetWindowThreadProcessId
DialogBoxParamW
LoadImageW
wsprintfW
MessageBoxW
SetScrollRange
SetWindowTextW
FindWindowW
MapWindowPoints
LoadBitmapW
WindowFromDC
GetWindowDC
GetMessagePos
GetActiveWindow
GetDC
ReleaseDC
SetWindowLongW
CharLowerW
GetCursor
PostMessageW
GetClientRect
InvalidateRect
ShowWindow
IsWindow
GetClassInfoExW
LoadCursorW
OffsetRect
LoadStringW
DestroyWindow
DrawTextW
SystemParametersInfoW
GetWindowTextLengthW
GetWindowTextW
DrawIconEx
GetSysColor
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetSubMenu
ClientToScreen
TrackPopupMenu
MonitorFromPoint
GetMonitorInfoW
GetMenuItemCount
IsZoomed
GetMenuStringW
DestroyMenu
LoadMenuW
GetSystemMetrics
UpdateWindow
SetRectEmpty
GetFocus
EqualRect
SetFocus
SetScrollPos
SetScrollInfo
GetScrollRange
GetScrollPos
GetScrollInfo
CharNextW
wvsprintfW
SetCursor
IntersectRect
SetRect
FillRect
IsIconic
CopyIcon
SetWindowRgn
DestroyIcon
MoveWindow
EnumChildWindows
GetDlgItem
GetWindowRect
GetWindow
CharUpperW
GetComboBoxInfo
GetClassNameW
ReleaseCapture
GetNextDlgGroupItem
IsWindowEnabled
GetCursorPos
ScreenToClient
GetDlgCtrlID
CopyRect
InflateRect
PtInRect
IsRectEmpty
RedrawWindow
IsWindowVisible
SendMessageW
SetCapture
SetLayeredWindowAttributes
CreateWindowExW
RegisterClassExW
EndPaint
BeginPaint
CallWindowProcW
GetWindowLongW
DefWindowProcW

gdi32

SetTextColor
GetTextExtentPoint32W
SetBkMode
BitBlt
DeleteDC
DeleteObject
CreateCompatibleBitmap
SetViewportOrgEx
SelectObject
CreateCompatibleDC
SetBkColor
ExtTextOutW
GetCurrentObject
GetObjectW
StretchBlt
SetStretchBltMode
Rectangle
RoundRect
CreateEllipticRgn
CombineRgn
OffsetRgn
PatBlt
CreateDIBSection
PlayEnhMetaFile
SetWindowOrgEx
IntersectClipRect
CreateFontIndirectW
GetStockObject
GetObjectType
SaveDC
RestoreDC
OffsetViewportOrgEx
CreateRectRgn
CreateRoundRectRgn
GetDeviceCaps
CreateSolidBrush
SelectClipRgn
CreateDCW
GetViewportOrgEx
MoveToEx
LineTo
CreateDIBitmap
CreateFontW
CreatePen

advapi32

RegQueryValueExA
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW

ole32

CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
CoInitialize

oleaut32

VarBstrCmp
VariantCopy
SysAllocStringLen
VariantChangeType
VarUI4FromStr
OleLoadPicture
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
SysFreeString
SysStringLen
SysAllocString

shlwapi

SHSetValueW
SHGetValueW
wnsprintfW
PathRemoveExtensionW
PathFindExtensionW
PathAppendW
PathIsRelativeW
PathRemoveFileSpecW
PathCombineW
PathFileExistsW

comctl32

InitCommonControlsEx
_TrackMouseEvent
ImageList_Destroy

msimg32

GradientFill
AlphaBlend
TransparentBlt

gdiplus

GdipCloneImage
GdipLoadImageFromStream
GdipDisposeImage
GdipAlloc
GdipFree
GdipLoadImageFromStreamICM
GdiplusStartup

Exports

Exports

CreateBalloonManager
CreateDynamicScrollBar
CreateDynamicScrollBar2
CreateMessageBoxRender
CreateMiniUIBitmap
GetCompitibleMode
GetDPICompatible
GetMiniUI
GetMiniUI2
GetMiniUI3
GetMiniUI4
OnSkinChanged
SetCompitibleMode
SetMiniUIFlag

Sections

.text
Size: 621KB - Virtual size: 621KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScriptExecute.exe
.exe windows:5 windows x86 arch:x86

19b982016a82f84c24f731ebdd87ba15

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\649637\out\Release\ScriptExecute.pdb

Imports

kernel32

SetFileAttributesW
GetFileAttributesExW
GetModuleFileNameA
SetLastError
GetTickCount
QueryPerformanceCounter
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
lstrlenA
GetDiskFreeSpaceExW
CreateDirectoryW
SystemTimeToFileTime
ReadFile
ExpandEnvironmentStringsW
lstrcmpiW
GetPrivateProfileStringW
CopyFileW
TerminateProcess
InterlockedIncrement
InterlockedDecrement
GetWindowsDirectoryW
GetCurrentThread
VirtualAlloc
VirtualQuery
ResumeThread
GetThreadContext
SuspendThread
OpenThread
SetThreadPriority
GetThreadPriority
FlushInstructionCache
VirtualProtect
lstrcpyW
GetTempPathW
SetErrorMode
WaitForMultipleObjects
SetEvent
OpenEventW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetProcessHeap
HeapAlloc
HeapFree
UnmapViewOfFile
CreateEventW
MapViewOfFile
GetShortPathNameW
GetTempFileNameW
GetCurrentDirectoryW
SetVolumeLabelW
GetDriveTypeW
SetFileTime
GetFileAttributesW
LocalAlloc
GetCurrentThreadId
GetLocalTime
SetFilePointer
GetFileSizeEx
MoveFileW
WriteFile
DeleteCriticalSection
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
GetCurrentProcessId
Process32NextW
GetLastError
OpenProcess
CreateMutexW
DeviceIoControl
InitializeCriticalSection
GetCommandLineW
GetPrivateProfileIntW
InterlockedExchange
LocalFree
InterlockedCompareExchange
Sleep
lstrlenW
GetVersionExW
FreeResource
GetSystemWindowsDirectoryW
GetCurrentProcess
GetModuleHandleA
GetSystemInfo
DeleteFileW
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
LoadLibraryExW
CloseHandle
LoadLibraryW
WaitForSingleObject
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemDirectoryW
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
FindFirstFileW
FindNextFileW
FindClose
lstrcmpiA
lstrcmpA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetLocaleInfoA
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetStartupInfoA
SetHandleCount
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
LoadLibraryA
HeapCreate
VirtualFree
IsValidCodePage
GetOEMCP
GetACP
GetStringTypeW
GetCPInfo
LCMapStringW
LCMapStringA
GetStdHandle
GetFileType
WriteConsoleW
GetDateFormatA
GetTimeFormatA
CreateThread
ExitThread
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
MultiByteToWideChar
RtlUnwind
TlsFree
TlsAlloc
CreateFileW
CreateFileMappingW
RaiseException
HeapDestroy
HeapReAlloc
HeapSize
CreateFileA
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetEndOfFile
SetFilePointerEx
TlsGetValue
OutputDebugStringW
TlsSetValue
HeapUnlock
HeapLock
HeapWalk
ReleaseMutex

user32

SetForegroundWindow
MessageBoxW
FindWindowW
IsIconic
IsWindowVisible
ShowWindow
BringWindowToTop
GetActiveWindow
ExitWindowsEx

advapi32

SetSecurityDescriptorDacl
RegEnumKeyExA
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegOpenKeyW
RegCreateKeyW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetLengthSid
InitializeAcl
EqualSid
AddAce
AddAccessAllowedAce
GetSecurityDescriptorControl
SetFileSecurityW
StartServiceW
DeleteService
CreateServiceW
ChangeServiceConfig2W
LockServiceDatabase
QueryServiceLockStatusW
UnlockServiceDatabase
ChangeServiceConfigW
ControlService
QueryServiceStatus
QueryServiceConfigW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
GetAclInformation
GetAce
GetUserNameW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
GetExplicitEntriesFromAclW
DeleteAce
LookupAccountNameW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegQueryValueExA
RegOpenKeyExA

shell32

CommandLineToArgvW
SHGetSpecialFolderPathW
ord165
ShellExecuteW
SHCreateDirectoryExW
SHFileOperationW

shlwapi

PathIsRelativeW
PathIsDirectoryW
SHDeleteKeyW
PathIsRootW
SHSetValueW
SHDeleteValueW
PathStripPathW
SHGetValueW
PathFileExistsW
PathAppendW
StrFormatByteSizeW
PathCombineW
StrStrIW
PathRemoveFileSpecW
StrStrIA
SHSetValueA
PathFindFileNameW
SHGetValueA

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

psapi

EnumProcessModules
GetModuleFileNameExW

setupapi

SetupIterateCabinetW

urlmon

URLDownloadToFileW

imm32

ImmDisableIME

Sections

.text
Size: 483KB - Virtual size: 483KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 164KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SignHelper.dll
.dll windows:5 windows x86 arch:x86

7ac074b18f2c26c591f7186d54d076d2

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11/03/2013, 00:00

Not After

10/03/2016, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2e:4e:dd:7a:9c:db:56:5b:0f:84:da:22:76:48:27:5f:53:27:c6:32
Signer

Actual PE Digest

2e:4e:dd:7a:9c:db:56:5b:0f:84:da:22:76:48:27:5f:53:27:c6:32

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\building\ludashi_projects\360HardwareMaster\SignHelper\Release\SignHelper.pdb

Imports

kernel32

GetModuleFileNameW
CreateFileW
DeviceIoControl
GetModuleHandleW
CloseHandle
LoadLibraryW
MultiByteToWideChar
lstrlenA
EnterCriticalSection
GetProcAddress
GetCurrentProcessId
InitializeCriticalSection
FreeLibrary
DeleteCriticalSection
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
WriteFile
ReadFile
GetFileSizeEx
OutputDebugStringW
FormatMessageW
GetLastError
SetLastError
GetCurrentThreadId
LocalFree
GetSystemTime
CreateMutexW
TlsGetValue
HeapAlloc
HeapFree
WaitForSingleObject
GetProcessHeap
TlsSetValue
GetAtomNameW
OpenThread
AddAtomW
ReleaseMutex
TlsAlloc
FindAtomW
DeleteAtom
TlsFree
WideCharToMultiByte
lstrcmpA
lstrcmpiA
GetCommandLineA
HeapReAlloc
RaiseException
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
VirtualAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
LeaveCriticalSection

netapi32

Netbios

advapi32

RegQueryValueExA
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExW

shlwapi

SHSetValueA
SHGetValueA

Exports

Exports

GetMIDA
GetMIDW
InitA
InitW
UnInitA
UnInitW

Sections

.text
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TempMonitor.dll
.dll windows:5 windows x86 arch:x86

ba7027ef1feed645481d538ef1fe7f2c

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

28/01/2021, 11:08

Not After

01/03/2032, 11:08

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

89:85:a3:83:90:01:c6:6b:0c:26:47:7f:bf:b7:67:56:ae:2a:65:16:3e:48:f2:4e:a7:28:11:b9:4e:c6:ae:be
Signer

Actual PE Digest

89:85:a3:83:90:01:c6:6b:0c:26:47:7f:bf:b7:67:56:ae:2a:65:16:3e:48:f2:4e:a7:28:11:b9:4e:c6:ae:be

Digest Algorithm

sha256

PE Digest Matches

true

ef:9a:0e:7d:d1:a5:5f:d1:30:6b:ed:18:cd:09:b3:20:d9:dd:40:cf
Signer

Actual PE Digest

ef:9a:0e:7d:d1:a5:5f:d1:30:6b:ed:18:cd:09:b3:20:d9:dd:40:cf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\599130\out\Release\TempMonitor.pdb

Imports

kernel32

InitializeCriticalSection
CreateFileW
DeviceIoControl
DeleteCriticalSection
CloseHandle
GetCurrentProcessId
CreateEventW
WaitForSingleObject
GetModuleHandleW
LoadLibraryExW
EnterCriticalSection
GetProcAddress
FreeLibrary
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LeaveCriticalSection
SetEvent
RaiseException
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
WriteFile
ReadFile
GetFileSizeEx
GetLastError
SetLastError
CreateMutexW
TlsGetValue
OutputDebugStringW
TlsSetValue
HeapUnlock
OpenThread
HeapLock
HeapWalk
GetCurrentThreadId
ReleaseMutex
TlsAlloc
TlsFree
ExitThread
CreateThread
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
VirtualAlloc
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
GetModuleFileNameW

user32

PostMessageW
FindWindowExW

advapi32

RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW

shlwapi

PathRemoveFileSpecW
PathAppendW
PathFileExistsW

Exports

Exports

StartTempMonitor
StopTempMonitor

Sections

.text
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
atiags32.dll
.dll windows:5 windows x86 arch:x86

1cfc385348903665a4f2b0a0d18f57fa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\MyWork\ISV\isv_desktop\SDK\Tools\AMDGPUServices\ATI AGS Lib\lib\Win32\dll\atiags.pdb

Imports

kernel32

GetTempPathA
LoadLibraryA
GetModuleHandleA
GetProcAddress
FreeLibrary
GetSystemInfo
DeleteFileA
GetVersionExA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

gdi32

CreateDCA
DeleteDC
ExtEscape

msvcr90

_purecall
fopen_s
fread
ftell
fseek
ferror
fputc
fprintf
sscanf_s
atof
_vsnprintf_s
fclose
memmove
tolower
isalpha
isalnum
strncmp
strchr
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
memcpy
atoi
free
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
_mbscmp
strstr
strcpy_s
malloc
printf
memset
isspace

Exports

Exports

agsCrossfireGetGPUCount
agsDriverGetLatestVersionInfo
agsDriverGetVersionInfo
agsEyefinityGetConfigInfo

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cacert.dat
dynlenv.dll
.dll windows:5 windows x86 arch:x86

87fc4450eafd884b9231c1769147c9a5

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11/03/2013, 00:00

Not After

10/03/2016, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6e:01:7f:0b:e5:b9:6f:70:c4:6f:c8:ca:4c:49:3c:7a:eb:27:b7:fc
Signer

Actual PE Digest

6e:01:7f:0b:e5:b9:6f:70:c4:6f:c8:ca:4c:49:3c:7a:eb:27:b7:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameW
CreateFileW
GetPrivateProfileIntW
GetLastError
GetProcAddress
EnterCriticalSection
DeleteCriticalSection
TlsAlloc
CloseHandle
TlsFree
TlsGetValue
GetFileSize
GetFullPathNameW
TlsSetValue
GetModuleHandleW
GetCurrentProcessId
ReadFile
DeviceIoControl
WideCharToMultiByte
MultiByteToWideChar
OutputDebugStringA
FormatMessageA
LoadLibraryA
GetModuleFileNameA
LeaveCriticalSection
LoadLibraryW
InitializeCriticalSection
WriteFile
OutputDebugStringW
SetEnvironmentVariableA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetModuleHandleA
SetStdHandle
GetLocaleInfoW
CompareStringW
CompareStringA
FreeLibrary
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetEndOfFile
SetFilePointerEx
GetFileSizeEx
FormatMessageW
SetLastError
GetCurrentThreadId
LocalFree
GetSystemTime
CreateMutexW
HeapAlloc
HeapFree
WaitForSingleObject
GetProcessHeap
GetAtomNameW
OpenThread
AddAtomW
ReleaseMutex
FindAtomW
DeleteAtom
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
Sleep
ExitProcess
GetCommandLineA
HeapReAlloc
RtlUnwind
CreateProcessA
DuplicateHandle
MoveFileA
DeleteFileA
GetTimeFormatA
GetDateFormatA
InterlockedIncrement
InterlockedDecrement
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
HeapSize
GetStdHandle
InitializeCriticalSectionAndSpinCount
LCMapStringA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
VirtualAlloc
GetFileAttributesA
CreatePipe
GetExitCodeProcess
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetTimeZoneInformation
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
SetFilePointer

user32

GetActiveWindow
MessageBoxW

shell32

ShellExecuteW

shlwapi

PathAppendW
PathFindFileNameW
PathCombineW
SHGetValueW
PathFileExistsW

advapi32

RegCloseKey
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW

Exports

Exports

get_lua_env_dispatch
get_lua_raw_dispatch

Sections

.text
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

QProtect
Size: 65KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pdown.dll
.dll windows:5 windows x86 arch:x86

8b29c71233141e1c912a10b8a268fa9f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/12/2015, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6e:ab:ed:dd:94:57:a6:46:03:9c:18:65:b6:f0:8a:df:91:78:a5:d6:90:32:33:63:10:1f:2d:b2:92:e3:8e:86
Signer

Actual PE Digest

6e:ab:ed:dd:94:57:a6:46:03:9c:18:65:b6:f0:8a:df:91:78:a5:d6:90:32:33:63:10:1f:2d:b2:92:e3:8e:86

Digest Algorithm

sha256

PE Digest Matches

true

b5:ee:6b:28:a3:38:8d:b8:e5:4f:5c:f4:06:07:06:69:33:f5:bd:cb
Signer

Actual PE Digest

b5:ee:6b:28:a3:38:8d:b8:e5:4f:5c:f4:06:07:06:69:33:f5:bd:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\134794\out\Release\Release\PDown.pdb

Imports

kernel32

CreateFileW
GetLastError
SetEvent
GetModuleFileNameW
MoveFileW
DeleteFileW
WriteFile
MoveFileExW
ReadFile
GetTickCount
GetPrivateProfileIntW
GetSystemInfo
GlobalMemoryStatusEx
GetModuleHandleExW
FreeLibraryAndExitThread
WaitForSingleObject
LoadLibraryW
GetCurrentProcessId
GetProcAddress
FreeLibrary
CreateProcessW
GetStartupInfoW
TerminateProcess
GetCurrentProcess
OpenProcess
InterlockedDecrement
InterlockedIncrement
SetFilePointer
SetEndOfFile
ReleaseMutex
CreateMutexW
GetLocalTime
CopyFileW
DeviceIoControl
GetModuleHandleW
Sleep
FlushFileBuffers
WriteConsoleW
GetFileSizeEx
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
CloseHandle
CreateEventW
FindFirstFileW
FindClose
GetFileAttributesW
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
LoadLibraryA
VirtualAlloc
QueryPerformanceCounter
VirtualFree
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
WideCharToMultiByte
LCMapStringA
ExitProcess
LCMapStringW
InitializeCriticalSection
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleHandleA
GetModuleFileNameA
GetStdHandle
HeapReAlloc
GetCommandLineA
CreateThread
DeleteCriticalSection
GetConsoleOutputCP
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
OutputDebugStringW
FormatMessageW
MultiByteToWideChar
SetLastError
GetCurrentThreadId
LocalFree
GetSystemTime
TlsGetValue
HeapAlloc
HeapFree
GetProcessHeap
TlsSetValue
GetAtomNameW
OpenThread
AddAtomW
TlsAlloc
FindAtomW
DeleteAtom
TlsFree
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
ExitThread

user32

MessageBoxW
GetWindowThreadProcessId
SendMessageTimeoutW
PostThreadMessageW
DestroyWindow
DispatchMessageW
WaitForInputIdle
GetMessageW
CreateWindowExW
DefWindowProcW
UnregisterClassW
RegisterClassW
FindWindowW
IsWindow
TranslateMessage

advapi32

RegEnumKeyExW
RegSetValueExW
RegOpenKeyW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegQueryValueExA

shell32

SHGetSpecialFolderPathW

ole32

CoInitialize
CoCreateInstance
CLSIDFromProgID
CoUninitialize

oleaut32

SysAllocString
SysFreeString

shlwapi

PathCombineW
PathRemoveFileSpecW
wvnsprintfW
PathFileExistsW

ws2_32

sendto
WSAStartup
ntohs
WSACleanup
gethostbyname
WSAGetLastError
recvfrom
WSAWaitForMultipleEvents
closesocket
WSAEventSelect
socket
bind
htons
htonl
setsockopt
WSAIoctl

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Exports

Exports

PPClose
PPCloseHandle
PPDownload
PPGetConfig
PPInit
PPInit2
PPQueryTask
PPQueryTaskEx
PPRemoveTask
PPRestart
PPSetConfig
PPSetOption
PPStartTask
PPStartTaskEx
PPStopTask
StartLan
StopLan

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
清理残留.bat

Sharing

General

Malware Config

Signatures

Files

04a116d242e299d4ddbfcdcde9080a8f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18Certificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

9c:57:83:91:29:74:c3:40:38:38:02:24:0e:59:f9:8b:da:71:4d:ed:ad:b4:1d:67:3d:c8:75:3f:8f:cc:95:a3Signer

23:d1:a0:5a:0e:e2:46:7a:a1:6f:06:e1:06:8b:58:cb:07:bc:c1:4dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

version

netapi32

crypt32

iphlpapi

Exports

Exports

Sections

.text Size: 601KB - Virtual size: 601KB

.rdata Size: 186KB - Virtual size: 185KB

.data Size: 52KB - Virtual size: 67KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 44KB - Virtual size: 44KB

3d3d2ab3399e0c6c08606786ea8815f7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

psapi

Sections

.text Size: 557KB - Virtual size: 557KB

.rdata Size: 118KB - Virtual size: 117KB

.data Size: 180KB - Virtual size: 197KB

.rsrc Size: 336KB - Virtual size: 340KB

.reloc Size: 36KB - Virtual size: 36KB

21312c342dfe15c1768ec19a879c07b1

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

9c:57:83:91:29:74:c3:40:38:38:02:24:0e:59:f9:8b:da:71:4d:ed:ad:b4:1d:67:3d:c8:75:3f:8f:cc:95:a3
Signer

23:d1:a0:5a:0e:e2:46:7a:a1:6f:06:e1:06:8b:58:cb:07:bc:c1:4d
Signer

.text
Size: 601KB - Virtual size: 601KB

.rdata
Size: 186KB - Virtual size: 185KB

.data
Size: 52KB - Virtual size: 67KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 44KB - Virtual size: 44KB

.text
Size: 557KB - Virtual size: 557KB

.rdata
Size: 118KB - Virtual size: 117KB

.data
Size: 180KB - Virtual size: 197KB

.rsrc
Size: 336KB - Virtual size: 340KB

.reloc
Size: 36KB - Virtual size: 36KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

ee:ee:ed:e7:f3:2e:83:8a:e9:c1:8b:f6:59:a7:c6:d9:62:13:63:c5:01:22:ba:96:f2:c6:1b:6f:bb:9a:6f:ca
Signer

71:62:86:09:fa:ff:91:9c:39:e2:02:5e:52:8b:e3:48:1f:6d:00:ca
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 271KB - Virtual size: 271KB

.data
Size: 42KB - Virtual size: 65KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 57KB - Virtual size: 56KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

26:27:9f:0f:2f:11:97:0d:cc:f6:3e:ba:88:f2:d4:c4
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

23:38:91:61:e4:5a:21:8b:d2:4e:6e:85:9a:e1:11:53
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate