b24d2621a558eebdce3d692fc84a6173_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b24d2621a558eebdce3d692fc84a6173_JaffaCakes118
Size

4.8MB
MD5

b24d2621a558eebdce3d692fc84a6173
SHA1

ef4159d79563df8b5e6fc386bdbd2662d48fe688
SHA256

ec826e67fbba46e838ee84c0db1a9b4ea6bdb0f6c32a3cfdb6753a3f2538ed05
SHA512

61b58088f32a76462e9d74f4f49d5087cc25310bd3d9e701ef1f98525ca3f07e3752ba144a46e43f623de03b53abc20b40f97d1a58be21c24ced718a74fc2641
SSDEEP

98304:7zVAzf2mDRkwOtsIRse7WPnKXlnLIOvV/m2a8fskgy7O0h4zMtsla3/OdQAAPx2I:48/pDCnLY//fskfO0uMtT2q95

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/ET2.0/SDOImage.dll	aspack_v212_v242

Files

b24d2621a558eebdce3d692fc84a6173_JaffaCakes118
.rar
ET2.0/AudioHook.dll
.dll windows:4 windows x86 arch:x86

40b764df47ff7fd5581abe75efec414e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fb:f2:3b:e0:e2:b6:5b:3f:31:8b:72:13:36:00:fc:5c:8e:0a:ed:ef
Signer

Actual PE Digest

fb:f2:3b:e0:e2:b6:5b:3f:31:8b:72:13:36:00:fc:5c:8e:0a:ed:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Project\AudioHook\AudioHook\Release\AudioHook.pdb

Imports

user32

UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx

kernel32

TlsFree
FlushFileBuffers
SetEvent
CloseHandle
WaitForSingleObject
GetModuleFileNameA
OpenEventA
SignalObjectAndWait
CreateEventA
Sleep
ReadProcessMemory
GetCurrentProcess
lstrcatA
CreateDirectoryA
_lclose
_lwrite
_llseek
_lcreat
_lopen
GetLocalTime
LoadLibraryA
GetProcAddress
FreeLibrary
CreateMutexA
ReleaseMutex
UnmapViewOfFile
OpenFileMappingA
GetLastError
MapViewOfFile
GetTickCount
ExitThread
GetCurrentThreadId
CreateThread
HeapAlloc
HeapFree
GetCommandLineA
GetVersionExA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
TlsAlloc
SetLastError
TlsSetValue
TlsGetValue
GetModuleHandleA
ExitProcess
TerminateProcess
UnhandledExceptionFilter
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WriteFile
GetLocaleInfoA
GetCPInfo
GetStringTypeA
GetStringTypeW
RtlUnwind
GetACP
GetOEMCP
InterlockedExchange
SetFilePointer
InitializeCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle

Exports

Exports

CleanWinHook
InitWinHook

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sharedat
Size: 4KB - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/ColorWord/1-1.gif
.gif
ET2.0/ColorWord/1-2.gif
.gif
ET2.0/ColorWord/2.gif
.gif
ET2.0/ColorWord/3.gif
.gif
ET2.0/ColorWord/4-1.gif
.gif
ET2.0/ColorWord/4-2.gif
.gif
ET2.0/ColorWord/4-3.gif
.gif
ET2.0/ColorWord/4-4.gif
.gif
ET2.0/ColorWord/4-5.gif
.gif
ET2.0/ColorWord/4.gif
.gif
ET2.0/ColorWord/5-1.gif
.gif
ET2.0/ColorWord/5-2.gif
.gif
ET2.0/ColorWord/6-1.gif
.gif
ET2.0/ColorWord/6-2.gif
.gif
ET2.0/ColorWord/6.gif
.gif
ET2.0/ColorWord/7-1.gif
.gif
ET2.0/ColorWord/7-2.gif
.gif
ET2.0/ColorWord/7-3.gif
.gif
ET2.0/ColorWord/7-4.gif
.gif
ET2.0/ColorWord/7-5.gif
.gif
ET2.0/ColorWord/7-6.gif
.gif
ET2.0/ColorWord/7-7.gif
.gif
ET2.0/ColorWord/7.gif
.gif
ET2.0/ColorWord/8-1.gif
.gif
ET2.0/ColorWord/8.gif
.gif
ET2.0/ColorWord/word.xml
.xml
ET2.0/ET.exe
.exe windows:5 windows x86 arch:x86

1aa0c6e7cc026ce293af4581be7ba111

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4c:a1:cf:fd:96:50:80:b0:0e:6e:8c:62:8a:c2:69:dd:6b:1b:07:fc
Signer

Actual PE Digest

4c:a1:cf:fd:96:50:80:b0:0e:6e:8c:62:8a:c2:69:dd:6b:1b:07:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
GetErrorInfo
SysFreeString
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
RegDeleteValueW
RegCreateKeyExW
RegCloseKey

user32

LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
WindowFromPoint
WindowFromDC
WaitMessage
ValidateRect
UpdateWindow
UnregisterHotKey
UnregisterClassW
UnionRect
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
TrackMouseEvent
ToAscii
SystemParametersInfoW
SubtractRect
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowRgn
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRectEmpty
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClipboardData
SetClassLongW
SetCapture
SetActiveWindow
SendMessageA
SendMessageW
ScrollWindow
ScrollDC
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterHotKey
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PtInRect
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OpenClipboard
OffsetRect
NotifyWinEvent
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MoveWindow
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyW
LockWindowUpdate
LoadStringW
LoadKeyboardLayoutW
LoadImageW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageA
IsDialogMessageW
IsClipboardFormatAvailable
IsChild
InvalidateRect
IntersectRect
InsertMenuItemW
InsertMenuW
InflateRect
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowDC
GetUpdateRect
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetScrollBarInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMessageExtraInfo
GetMenuStringW
GetMenuState
GetMenuItemRect
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardFormatNameW
GetClipboardData
GetClientRect
GetClassNameW
GetClassLongW
GetClassInfoW
GetCapture
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EnumClipboardFormats
EnumChildWindows
EndPaint
EndDeferWindowPos
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextExW
DrawTextW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DrawAnimatedRects
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DeferWindowPos
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
CountClipboardFormats
CopyImage
CloseClipboard
ClientToScreen
ChildWindowFromPoint
CheckMenuItem
CharUpperBuffW
CharUpperW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcW
CallNextHookEx
BeginPaint
BeginDeferWindowPos
AdjustWindowRectEx
ActivateKeyboardLayout
TranslateMessage
SetWindowLongW
RegisterClassW
GetMessageW
DispatchMessageW
DestroyWindow
DefWindowProcW
CreateWindowExW
PostMessageW

kernel32

lstrcmpiA
LoadLibraryA
LocalFree
LocalAlloc
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
IsValidLocale
GetSystemDefaultUILanguage
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetUserDefaultUILanguage
GetLocaleInfoW
GetLastError
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
ExitThread
CreateThread
CompareStringW
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
lstrlenW
lstrcpyA
lstrcpyW
lstrcmpW
WritePrivateProfileStringW
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualFree
VirtualAlloc
TerminateThread
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
SwitchToThread
SuspendThread
Sleep
SizeofResource
SignalObjectAndWait
SetThreadPriority
SetThreadLocale
SetLastError
SetFilePointer
SetFileAttributesW
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
MultiByteToWideChar
MulDiv
MoveFileW
LockResource
LoadResource
LoadLibraryW
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalSize
GlobalHandle
GlobalLock
GlobalFree
GlobalFindAtomW
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetVersionExW
GetVersion
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetTempPathW
GetSystemTime
GetSystemInfo
GetStdHandle
GetProcAddress
GetPrivateProfileStringW
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileAttributesW
GetExitCodeThread
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCPInfo
GetACP
FreeResource
InterlockedExchangeAdd
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
FindFirstFileW
FindClose
FileTimeToSystemTime
EnumCalendarInfoW
EnterCriticalSection
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreateMutexW
CreateFileW
CreateEventW
CreateDirectoryW
CopyFileW
CompareStringW
CloseHandle
Sleep
TerminateThread
VirtualAlloc
OutputDebugStringW

msimg32

TransparentBlt
GradientFill
AlphaBlend
GradientFill
GradientFill

gdi32

UnrealizeObject
TextOutW
StretchDIBits
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetTextAlign
SetStretchBltMode
SetROP2
SetPixel
SetMapMode
SetEnhMetaFileBits
SetDIBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SelectClipRgn
SaveDC
RoundRect
RestoreDC
ResizePalette
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PolyBezierTo
PolyBezier
PlayEnhMetaFile
Pie
PatBlt
OffsetRgn
MoveToEx
MaskBlt
LineTo
LPtoDP
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetViewportOrgEx
GetTextMetricsW
GetTextExtentPointW
GetTextExtentPoint32W
GetTextColor
GetTextAlign
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectW
GetNearestPaletteIndex
GetMapMode
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionW
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetCurrentObject
GetClipRgn
GetClipBox
GetBrushOrgEx
GetBkColor
GetBitmapBits
GdiFlush
FrameRgn
FillRgn
ExtTextOutW
ExtFloodFill
ExcludeClipRect
EnumFontFamiliesExW
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateRoundRectRgn
CreateRectRgnIndirect
CreateRectRgn
CreatePenIndirect
CreatePen
CreatePatternBrush
CreatePalette
CreateHalftonePalette
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileW
CombineRgn
Chord
BitBlt
Arc
GetRandomRgn

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

eztalkcore

CreateETCluster

ole32

CreateStreamOnHGlobal
ReleaseStgMedium
OleGetClipboard
OleSetClipboard
DoDragDrop
RevokeDragDrop
RegisterDragDrop
OleUninitialize
OleInitialize
CreateDataAdviseHolder
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize
IsEqualGUID

comctl32

InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControls

urlmon

URLDownloadToFileW

shell32

ShellExecuteW
Shell_NotifyIconW
SHAppBarMessage

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod

netapi32

Netbios

msvcrt

swprintf
swprintf

netspeedplatform

CreateNetSpeedPlatform

oleacc

LresultFromObject

ws2_32

WSACleanup
WSAStartup
gethostname
gethostbyname

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 22KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 1024B - Virtual size: 806B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 60B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ET2.0/ETAudioEncoder.dll
.dll windows:4 windows x86 arch:x86

c06e2ceab5018624f41495ad27d98e68

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

74:f4:11:de:7a:2b:fe:51:83:21:16:71:fb:0b:74:f2:ef:4d:46:99
Signer

Actual PE Digest

74:f4:11:de:7a:2b:fe:51:83:21:16:71:fb:0b:74:f2:ef:4d:46:99

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Project\NetBuffer\NetBuffer\bin\ETAudioEncoder.pdb

Imports

kernel32

_lclose
_lwrite
_llseek
_lcreat
_lopen
CreateDirectoryA
GetLocalTime
lstrcatA
GetModuleFileNameA
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetLastError
WriteFile
GetStdHandle
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
HeapSize
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
MultiByteToWideChar
GetLocaleInfoA
InitializeCriticalSection
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CreateFileA
CloseHandle
FlushFileBuffers

Exports

Exports

CreateSNDAPlusEncoder

Sections

.text
Size: 200KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/ETAudioEncoder2.dll
.dll windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f2:14:db:6b:c2:b0:e3:b2:91:1f:7a:08:05:a9:28:6c:cd:e6:30:85
Signer

Actual PE Digest

f2:14:db:6b:c2:b0:e3:b2:91:1f:7a:08:05:a9:28:6c:cd:e6:30:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

AddAccessForEveryone
AllocMemEx
AmSystemProcess
AmUsingInputDesktop
AnsiToWide
AutoUnhook
CollectHooks
CopyFunction
CreateGlobalEvent
CreateGlobalFileMapping
CreateGlobalMutex
CreateIpcQueue
CreateIpcQueueEx
CreateProcessExA
CreateProcessExW
CreateRemoteThreadEx
DestroyIpcQueue
FlushHooks
FreeMemEx
GetCallingModule
GetCurrentSessionId
GetInputSessionId
HookAPI
HookCode
InjectLibraryA
InjectLibrarySessionA
InjectLibrarySessionW
InjectLibraryW
InstallMadCHook
IsHookInUse
OpenGlobalEvent
OpenGlobalFileMapping
OpenGlobalMutex
ProcessHandleToId
ProcessIdToFileName
RemoteExecute
RenewHook
SendIpcMessage
StaticLibHelper_Final
StaticLibHelper_Init
ThreadHandleToId
UnhookAPI
UnhookCode
UninjectLibraryA
UninjectLibrarySessionA
UninjectLibrarySessionW
UninjectLibraryW
UninstallMadCHook
WideToAnsi

Sections

CODE
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ET2.0/ETAudioEncoder3.dll
.dll windows:4 windows x86 arch:x86

a1f638fcbf1e9ba5e57c77fe8e775510

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b9:99:14:f6:1e:ef:31:bc:7c:c5:b2:21:1f:d6:01:30:5f:d3:76:8f
Signer

Actual PE Digest

b9:99:14:f6:1e:ef:31:bc:7c:c5:b2:21:1f:d6:01:30:5f:d3:76:8f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\Project\NetBuffer\NetBuffer\bin\CELTCodec.pdb

Imports

kernel32

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
IsBadWritePtr
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
ExitProcess
TerminateProcess
GetCurrentProcess
WriteFile
CloseHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
RaiseException
RtlUnwind
InterlockedExchange
VirtualQuery
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetCPInfo
GetLocaleInfoA
GetACP
GetOEMCP
SetFilePointer
SetStdHandle
FlushFileBuffers
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect
GetSystemInfo
LCMapStringA
LCMapStringW
HeapSize
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr

Exports

Exports

CreateSNDADecoder
CreateSNDAEncoder
celt_decode
celt_decode_float
celt_decoder_create
celt_decoder_ctl
celt_decoder_destroy
celt_decoder_get_size
celt_decoder_init
celt_encode
celt_encode_float
celt_encoder_create
celt_encoder_ctl
celt_encoder_destroy
celt_encoder_get_size
celt_encoder_init
celt_header_from_packet
celt_header_init
celt_header_to_packet
celt_mode_create
celt_mode_destroy
celt_mode_info
celt_strerror

Sections

.text
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/ETComm.dll
.dll windows:4 windows x86 arch:x86

319a3b4957ce2513d6bb7d2e38b6af08

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

51:41:eb:3d:ff:8a:01:ba:61:de:c4:07:93:97:c6:cb:8d:2b:49:10
Signer

Actual PE Digest

51:41:eb:3d:ff:8a:01:ba:61:de:c4:07:93:97:c6:cb:8d:2b:49:10

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WriteFile
SetEvent
WaitForSingleObject
CloseHandle
DisconnectNamedPipe
FlushFileBuffers
WaitNamedPipeW
GetLastError
CreateFileW
ReadFileEx
HeapFree
GetProcessHeap
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
MultiByteToWideChar
SetNamedPipeHandleState
WaitForSingleObjectEx
lstrcpynW
ResumeThread
SetThreadPriority
CreateThread
CreateEventW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
EnterCriticalSection
LeaveCriticalSection
ExitProcess
RtlUnwind
GetCurrentThreadId
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
SetUnhandledExceptionFilter
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
VirtualQuery
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
LoadLibraryA
IsBadReadPtr
IsBadCodePtr
GetOEMCP
GetCPInfo
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
VirtualProtect
GetSystemInfo

Exports

Exports

CreateNamedPipeClient

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/ETCore.dll
.dll windows:4 windows x86 arch:x86

a91087bc9f3bb98bd4dabdec059a1d13

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

63:a0:dc:31:f8:bd:e4:89:b5:90:0e:f4:d1:d2:21:47:65:e0:8a:a9
Signer

Actual PE Digest

63:a0:dc:31:f8:bd:e4:89:b5:90:0e:f4:d1:d2:21:47:65:e0:8a:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

recv
inet_addr
ntohs
ntohl
WSAStartup
connect
socket
htonl
htons
bind
WSAAsyncSelect
closesocket
WSACleanup
inet_ntoa
send
WSAGetLastError
listen
shutdown

kernel32

GetSystemInfo
VirtualProtect
FlushFileBuffers
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
SetStdHandle
GetCPInfo
GetOEMCP
_lclose
_lwrite
GetCurrentProcessId
_llseek
_lcreat
_lopen
CreateDirectoryA
GetLocalTime
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
RaiseException
GlobalFree
GlobalUnlock
GlobalAlloc
LockResource
LoadResource
SizeofResource
FindResourceA
InterlockedIncrement
InterlockedDecrement
GetTickCount
OutputDebugStringA
GetLastError
SetThreadPriority
GetCurrentThread
SetEvent
CreateEventA
CloseHandle
WaitForSingleObjectEx
ResetEvent
WaitForSingleObject
lstrcatA
GetModuleFileNameA
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
IsBadWritePtr
VirtualAlloc
VirtualFree
IsBadCodePtr
IsBadReadPtr
HeapCreate
HeapDestroy
HeapSize
GetCurrentProcess
TerminateProcess
HeapReAlloc
GlobalLock
GetModuleHandleA
LoadLibraryA
SetFilePointer
ExitProcess
RtlUnwind
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
QueryPerformanceCounter
VirtualQuery
SetUnhandledExceptionFilter
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress

user32

GetAsyncKeyState
PostMessageA
RegisterClassA
CreateWindowExA
DefWindowProcA
DestroyWindow
KillTimer
SetTimer

ole32

StringFromGUID2

netlib

CreateNetModule

talkengine

CreatePCMSoftMixer
CreateRAWPlayOut
CreateTalkEngine

etrecord

CreateRecordSound

sndavideoengine

CreateVideoEngine

version

VerQueryValueA

Exports

Exports

CreateETCore

Sections

.text
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/ETFileParser.dll
.dll windows:4 windows x86 arch:x86

67201e9a6842cda576c8d9dee0498f32

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c9:75:8f:2b:39:a8:e7:ca:94:ed:70:b9:9f:38:0b:67:2b:0e:5e:7b
Signer

Actual PE Digest

c9:75:8f:2b:39:a8:e7:ca:94:ed:70:b9:9f:38:0b:67:2b:0e:5e:7b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
GetPrivateProfileIntA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentThreadId

user32

MessageBoxA

msvcr80

free
fwrite
malloc
_CIcos
_CIlog10
calloc
_CIpow
floor
_CIexp
_CIatan
_CIsin
fflush
vfprintf
__iob_func
_CIlog
ceil
memmove
tolower
memcpy
_CIsqrt
qsort
exit
fprintf
_CItan
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
fseek
strncmp
fread
strncpy
atoi
memset
_vsnprintf
fopen
fputs
fclose
_snprintf

Exports

Exports

beCloseStream
beDeinitStream
beEncodeChunk
beEncodeChunkFloatS16NI
beFlushNoGap
beInitStream
beVersion
beWriteInfoTag
beWriteVBRHeader

Sections

.text
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/ETGame.exe
.exe windows:5 windows x86 arch:x86

6dd22d846d513e7d0f64e82939945ee9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:89:c9:59:de:fa:f0:31:54:ea:d1:41:4a:46:25:e8:59:be:40:10
Signer

Actual PE Digest

08:89:c9:59:de:fa:f0:31:54:ea:d1:41:4a:46:25:e8:59:be:40:10

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\ezim\ETGame_1640\Release\ETGame.pdb

Imports

kernel32

Sleep
ExitProcess
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
HeapFree
HeapAlloc
GetStartupInfoW
GetFileTime
GetFileSizeEx
GetFileAttributesW
FileTimeToLocalFileTime
GetTickCount
SetErrorMode
CreateFileW
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
FileTimeToSystemTime
GetThreadLocale
lstrlenA
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GlobalFlags
GetModuleHandleA
GlobalFindAtomW
GetVersionExW
CompareStringW
LoadLibraryA
GetVersionExA
InterlockedDecrement
GetCurrentProcessId
GlobalAddAtomW
RaiseException
WritePrivateProfileStringW
FreeResource
SetLastError
GlobalFree
GlobalUnlock
FormatMessageW
LocalFree
lstrlenW
MulDiv
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
LoadLibraryW
WideCharToMultiByte
CompareStringA
MultiByteToWideChar
InterlockedExchange
GlobalLock
lstrcmpW
GlobalAlloc
FreeLibrary
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
FindResourceW
LoadResource
LockResource
SizeofResource
CloseHandle
OutputDebugStringW
GetLastError
IsDebuggerPresent
CreateSemaphoreW

user32

RegisterClipboardFormatW
PostThreadMessageW
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableW
CharNextW
GetSysColorBrush
ReleaseCapture
LoadCursorW
SetCapture
EndPaint
BeginPaint
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
UpdateWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
DefWindowProcW
CallWindowProcW
GetMenu
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowTextW
SetFocus
MoveWindow
SetWindowLongW
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetSysColor
DestroyMenu
CopyRect
GetWindowThreadProcessId
MessageBoxW
SetCursor
GetMessageW
TranslateMessage
DispatchMessageW
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
RegisterWindowMessageW
GetWindow
GetDesktopWindow
IsWindow
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
UnregisterClassW
GetNextDlgTabItem
EndDialog
CharUpperW
MessageBeep
GetNextDlgGroupItem
EqualRect
InvalidateRgn
GetPropW
IsIconic
ShowWindow
SetForegroundWindow
GetLastActivePopup
LoadIconW
GetSystemMenu
AppendMenuW
SendMessageW
LoadImageW
GetSystemMetrics
GetClientRect
DrawIcon
RemovePropW
SetPropW
SetWindowsHookExW
UnhookWindowsHookEx
GetWindowDC
GetWindowRect
ReleaseDC
DrawIconEx
PtInRect
ScreenToClient
OffsetRect
PostMessageW
SetWindowRgn
EnableWindow
CallNextHookEx
PostQuitMessage
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
SetWindowPos
MapDialogRect
SetWindowContextHelpId
GetParent

gdi32

ExtSelectClipRgn
DeleteDC
GetStockObject
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutW
RectVisible
PtVisible
CreateCompatibleDC
GetViewportExtEx
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
ExtTextOutW
GetObjectW
CreateBitmap
GetDeviceCaps
CreateRoundRectRgn
StretchBlt
BitBlt
SelectObject
CreateCompatibleBitmap
GetWindowExtEx

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFindExtensionW

oledlg

OleUIBusyW

ole32

CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleIsCurrentClipboard
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
CoTaskMemFree
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

SysStringLen
SysAllocStringLen
VariantInit
VariantClear
VariantCopy
VariantChangeType
SysAllocString
DispCallFunc
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysFreeString

Sections

.text
Size: 213KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/ETHall.dll
.dll windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9e:db:ef:27:38:c0:20:44:3a:d4:26:bc:e5:35:f7:47:4c:ac:86:3a
Signer

Actual PE Digest

9e:db:ef:27:38:c0:20:44:3a:d4:26:bc:e5:35:f7:47:4c:ac:86:3a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DoIdle
ProcessMessage
StartWork
StopWork

Sections

CODE
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 15KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ET2.0/ETLoader.exe
.exe windows:4 windows x86 arch:x86

8a021d476bb341572bbcaf4a463ec202

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:61:36:fc:71:24:22:44:78:bd:38:cf:6a:1c:bc:22:a4:fc:0e:99
Signer

Actual PE Digest

0b:61:36:fc:71:24:22:44:78:bd:38:cf:6a:1c:bc:22:a4:fc:0e:99

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

etcomm

CreateNamedPipeClient

kernel32

GetStartupInfoW
ExitProcess
RtlUnwind
HeapFree
TerminateProcess
HeapAlloc
HeapReAlloc
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
IsBadWritePtr
SetUnhandledExceptionFilter
GetOEMCP
GetCPInfo
GetStringTypeA
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CloseHandle
GetLastError
CreateMutexW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
OutputDebugStringW
GetLocalTime
CreateProcessW
lstrlenW
GetFileAttributesExW
IsValidCodePage
GetModuleFileNameW
GetFileAttributesW
SetErrorMode
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetStringTypeW
WritePrivateProfileStringW
lstrcmpiW
WaitForSingleObject
GetPrivateProfileIntW
GetPrivateProfileStringW
DeleteFileW
CreateEventW
SetEvent
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
GlobalFlags
InterlockedIncrement
GlobalFindAtomW
lstrlenA
GetModuleHandleA
LoadLibraryA
LoadLibraryW
lstrcatW
GetVersionExA
InterlockedDecrement
FreeResource
GlobalAddAtomW
SetLastError
GlobalFree
MulDiv
GlobalUnlock
FormatMessageW
lstrcpynW
LocalFree
GetCurrentThread
GetCurrentThreadId
GlobalLock
lstrcmpW
GlobalAlloc
FreeLibrary
GlobalDeleteAtom
WideCharToMultiByte
GetModuleHandleW
GetProcAddress
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
lstrcpyW
GetLocaleInfoW

user32

DestroyMenu
LoadCursorW
GetSysColorBrush
EndPaint
BeginPaint
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
wsprintfW
ReleaseDC
GetDC
ShowWindow
SetWindowTextW
IsDialogMessageW
WinHelpW
GetCapture
CreateWindowExW
GetClassInfoExW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageW
SendDlgItemMessageA
SetFocus
GetWindowTextW
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
GetClassInfoW
RegisterClassW
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetWindow
UnhookWindowsHookEx
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
SetMenuItemBitmaps
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapW
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
MessageBoxW
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
SetCursor
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
PostQuitMessage
RegisterWindowMessageW
GetSystemMetrics
LoadIconW
EnableWindow
SetForegroundWindow
GetClientRect
IsIconic
SendMessageW
DrawIcon
PostMessageW
UnregisterClassW

gdi32

DeleteObject
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
SetMapMode
SetBkMode
RestoreDC
SaveDC
GetObjectW
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps
GetStockObject

msimg32

GradientFill

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyW
RegDeleteKeyW
RegEnumKeyW
RegQueryValueW
RegCloseKey

comctl32

ord17
ImageList_Destroy

shlwapi

PathFindExtensionW
PathFindFileNameW
PathFileExistsW

ole32

CLSIDFromString

oleaut32

VariantInit
VariantChangeType
VariantClear

Sections

.text
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ET2.0/ETManager.exe
.exe windows:4 windows x86 arch:x86

e65af7e9797cf27104cd08ad272a0d55

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

35:be:7e:59:63:a7:70:b7:36:e8:e2:ff:6a:0f:8f:e4:99:de:34:a7
Signer

Actual PE Digest

35:be:7e:59:63:a7:70:b7:36:e8:e2:ff:6a:0f:8f:e4:99:de:34:a7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
GetLastError
CreateMutexW
SleepEx
GetTickCount
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetModuleFileNameW
InterlockedExchange
GetACP
GetLocaleInfoA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
OutputDebugStringW
GetLocalTime
MultiByteToWideChar
IsValidCodePage
CreateIoCompletionPort
PostQueuedCompletionStatus
HeapFree
GetProcessHeap
GetQueuedCompletionStatus
GetSystemInfo
EnterCriticalSection
LeaveCriticalSection
WriteFile
CreateNamedPipeW
SetEvent
ConnectNamedPipe
DisconnectNamedPipe
FlushFileBuffers
HeapAlloc
ReadFile
ReadFileEx
lstrcpynW
TerminateThread
WaitForSingleObject
SetStdHandle
SetFilePointer
GetVersionExA
HeapDestroy
HeapReAlloc
HeapSize
RtlUnwind
ExitProcess
ExitThread
GetCurrentThreadId
CreateThread
GetModuleHandleA
GetStartupInfoW
SetUnhandledExceptionFilter
VirtualProtect
VirtualAlloc
VirtualQuery
LCMapStringA
WideCharToMultiByte
LCMapStringW
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
HeapCreate
VirtualFree
IsBadWritePtr
UnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetStringTypeA
GetStringTypeW
GetOEMCP
LoadLibraryA

user32

RegisterWindowMessageW
PostMessageW

Sections

.text
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ET2.0/ETRecord.dll
.dll windows:4 windows x86 arch:x86

bce9d896037bfd54feff40b9c4102553

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

40:89:f9:8f:e2:04:4c:d7:5b:55:9c:dd:87:83:3c:ca:61:b6:aa:36
Signer

Actual PE Digest

40:89:f9:8f:e2:04:4c:d7:5b:55:9c:dd:87:83:3c:ca:61:b6:aa:36

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Project\语音聊天\GroupSpeaker\GroupTalk\RecordSound\RecordSound\Release\RecordSound.pdb

Imports

kernel32

LoadLibraryA
GetProcAddress
_lclose
_lwrite
_llseek
_lcreat
_lopen
CreateDirectoryA
GetLocalTime
CreateFileA
SetFilePointer
WriteFile
CloseHandle
FreeLibrary
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
OutputDebugStringA
GetDiskFreeSpaceExA
GetLastError
SetThreadPriority
GetCurrentThread
lstrcatA
GetModuleFileNameA
InterlockedExchange
WaitForSingleObject
ResumeThread
FindResourceA
LoadResource
SizeofResource
LockResource
IsBadReadPtr
SetUnhandledExceptionFilter
RaiseException
GetSystemInfo
VirtualProtect
FlushFileBuffers
LCMapStringW
HeapFree
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
ExitProcess
GetModuleHandleA
TerminateProcess
GetCurrentProcess
HeapSize
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
RtlUnwind
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
IsBadCodePtr

winmm

mmioWrite
mmioSetInfo
mmioAdvance
mmioGetInfo
mmioCreateChunk
mmioSeek
mmioAscend
mmioRead
mmioDescend
mmioClose
mmioOpenA

Exports

Exports

CreateRecordSound

Sections

.text
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/ETWebX.dll
.dll regsvr32 windows:4 windows x86 arch:x86

2f6603e789ce980adee0e332fab41e97

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

70:40:e6:7e:1c:5d:9c:7e:65:b4:1f:ab:93:97:00:9a:84:15:f9:d2
Signer

Actual PE Digest

70:40:e6:7e:1c:5d:9c:7e:65:b4:1f:ab:93:97:00:9a:84:15:f9:d2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
lstrcmpiW
lstrcpynW
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
GetModuleFileNameW
FreeLibrary
MultiByteToWideChar
DeleteCriticalSection
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetFileAttributesW
lstrcatW
GetProcessHeap
InitializeCriticalSection
RaiseException
lstrcpyW
lstrlenW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
SizeofResource
InterlockedExchange
CloseHandle
GetSystemInfo
VirtualProtect
FlushFileBuffers
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
SetStdHandle
GetCPInfo
GetOEMCP
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
SetFilePointer
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
HeapAlloc
HeapFree
ExitProcess
RtlUnwind
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
SetUnhandledExceptionFilter
VirtualQuery
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA

user32

CharNextW

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW

ole32

CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc

oleaut32

RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
SysStringLen
SysAllocString
UnRegisterTypeLi
SysFreeString

rpcrt4

NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
NdrDllGetClassObject
IUnknown_Release_Proxy
NdrStubForwardingFunction
NdrStubCall2
NdrDllCanUnloadNow
IUnknown_AddRef_Proxy
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy

shlwapi

PathFindExtensionW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 4KB - Virtual size: 46B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/Emotion/emo_0.dat
ET2.0/Emotion/emo_0.ini
ET2.0/Emotion/emo_0/01.gif
.gif
ET2.0/Emotion/emo_0/02.gif
.gif
ET2.0/Emotion/emo_0/03.gif
.gif
ET2.0/Emotion/emo_0/04.gif
.gif
ET2.0/Emotion/emo_0/05.gif
.gif
ET2.0/Emotion/emo_0/06.gif
.gif
ET2.0/Emotion/emo_0/07.gif
.gif
ET2.0/Emotion/emo_0/08.gif
.gif
ET2.0/Emotion/emo_0/09.gif
.gif
ET2.0/Emotion/emo_0/10.gif
.gif
ET2.0/Emotion/emo_0/100.gif
.gif
ET2.0/Emotion/emo_0/101.gif
.gif
ET2.0/Emotion/emo_0/102.gif
.gif
ET2.0/Emotion/emo_0/103.gif
.gif
ET2.0/Emotion/emo_0/104.gif
.gif
ET2.0/Emotion/emo_0/11.gif
.gif
ET2.0/Emotion/emo_0/12.gif
.gif
ET2.0/Emotion/emo_0/13.gif
.gif
ET2.0/Emotion/emo_0/14.gif
.gif
ET2.0/Emotion/emo_0/15.gif
.gif
ET2.0/Emotion/emo_0/16.gif
.gif
ET2.0/Emotion/emo_0/17.gif
.gif
ET2.0/Emotion/emo_0/18.gif
.gif
ET2.0/Emotion/emo_0/19.gif
.gif
ET2.0/Emotion/emo_0/20.gif
.gif
ET2.0/Emotion/emo_0/21.gif
.gif
ET2.0/Emotion/emo_0/22.gif
.gif
ET2.0/Emotion/emo_0/23.gif
.gif
ET2.0/Emotion/emo_0/24.gif
.gif
ET2.0/Emotion/emo_0/25.gif
.gif
ET2.0/Emotion/emo_0/26.gif
.gif
ET2.0/Emotion/emo_0/27.gif
.gif
ET2.0/Emotion/emo_0/28.gif
.gif
ET2.0/Emotion/emo_0/29.gif
.gif
ET2.0/Emotion/emo_0/30.gif
.gif
ET2.0/Emotion/emo_0/31.gif
.gif
ET2.0/Emotion/emo_0/32.gif
.gif
ET2.0/Emotion/emo_0/33.gif
.gif
ET2.0/Emotion/emo_0/34.gif
.gif
ET2.0/Emotion/emo_0/35.gif
.gif
ET2.0/Emotion/emo_0/36.gif
.gif
ET2.0/Emotion/emo_0/37.gif
.gif
ET2.0/Emotion/emo_0/38.gif
.gif
ET2.0/Emotion/emo_0/39.gif
.gif
ET2.0/Emotion/emo_0/40.gif
.gif
ET2.0/Emotion/emo_0/41.gif
.gif
ET2.0/Emotion/emo_0/42.gif
.gif
ET2.0/Emotion/emo_0/43.gif
.gif
ET2.0/Emotion/emo_0/44.gif
.gif
ET2.0/Emotion/emo_0/45.gif
.gif
ET2.0/Emotion/emo_0/46.gif
.gif
ET2.0/Emotion/emo_0/47.gif
.gif
ET2.0/Emotion/emo_0/48.gif
.gif
ET2.0/Emotion/emo_0/49.gif
.gif
ET2.0/Emotion/emo_0/50.gif
.gif
ET2.0/Emotion/emo_0/51.gif
.gif
ET2.0/Emotion/emo_0/52.gif
.gif
ET2.0/Emotion/emo_0/53.gif
.gif
ET2.0/Emotion/emo_0/54.gif
.gif
ET2.0/Emotion/emo_0/55.gif
.gif
ET2.0/Emotion/emo_0/56.gif
.gif
ET2.0/Emotion/emo_0/57.gif
.gif
ET2.0/Emotion/emo_0/58.gif
.gif
ET2.0/Emotion/emo_0/59.gif
.gif
ET2.0/Emotion/emo_0/60.gif
.gif
ET2.0/Emotion/emo_0/61.gif
.gif
ET2.0/Emotion/emo_0/62.gif
.gif
ET2.0/Emotion/emo_0/63.gif
.gif
ET2.0/Emotion/emo_0/64.gif
.gif
ET2.0/Emotion/emo_0/65.gif
.gif
ET2.0/Emotion/emo_0/66.gif
.gif
ET2.0/Emotion/emo_0/67.gif
.gif
ET2.0/Emotion/emo_0/68.gif
.gif
ET2.0/Emotion/emo_0/69.gif
.gif
ET2.0/Emotion/emo_0/70.gif
.gif
ET2.0/Emotion/emo_0/71.gif
.gif
ET2.0/Emotion/emo_0/72.gif
.gif
ET2.0/Emotion/emo_0/73.gif
.gif
ET2.0/Emotion/emo_0/74.gif
.gif
ET2.0/Emotion/emo_0/75.gif
.gif
ET2.0/Emotion/emo_0/76.gif
.gif
ET2.0/Emotion/emo_0/77.gif
.gif
ET2.0/Emotion/emo_0/78.gif
.gif
ET2.0/Emotion/emo_0/79.gif
.gif
ET2.0/Emotion/emo_0/80.gif
.gif
ET2.0/Emotion/emo_0/81.gif
.gif
ET2.0/Emotion/emo_0/82.gif
.gif
ET2.0/Emotion/emo_0/83.gif
.gif
ET2.0/Emotion/emo_0/84.gif
.gif
ET2.0/Emotion/emo_0/85.gif
.gif
ET2.0/Emotion/emo_0/86.gif
.gif
ET2.0/Emotion/emo_0/87.gif
.gif
ET2.0/Emotion/emo_0/88.gif
.gif
ET2.0/Emotion/emo_0/89.gif
.gif
ET2.0/Emotion/emo_0/90.gif
.gif
ET2.0/Emotion/emo_0/91.gif
.gif
ET2.0/Emotion/emo_0/92.gif
.gif
ET2.0/Emotion/emo_0/93.gif
.gif
ET2.0/Emotion/emo_0/94.gif
.gif
ET2.0/Emotion/emo_0/95.gif
.gif
ET2.0/Emotion/emo_0/96.gif
.gif
ET2.0/Emotion/emo_0/97.gif
.gif
ET2.0/Emotion/emo_0/98.gif
.gif
ET2.0/Emotion/emo_0/99.gif
.gif
ET2.0/ExceptionHandler.dll
.dll windows:5 windows x86 arch:x86

c2241aef59d5ab7bc2d7a35805ef0b95

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8d:53:97:75:ec:c8:4f:0a:c6:c6:49:71:43:3f:07:08:76:f2:df:e0
Signer

Actual PE Digest

8d:53:97:75:ec:c8:4f:0a:c6:c6:49:71:43:3f:07:08:76:f2:df:e0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\work\SNDA\SD_NetSpeed\Src\Product\ExceptionHandler.pdb

Imports

kernel32

GetLastError
FlushFileBuffers
WriteConsoleW
GetLocalTime
CloseHandle
CreateFileW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
SetUnhandledExceptionFilter
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
LoadLibraryW
WriteFile
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
DecodePointer
EncodePointer
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapAlloc
HeapFree
IsProcessorFeaturePresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
LCMapStringW
GetStringTypeW
GetStdHandle
InitializeCriticalSectionAndSpinCount
Sleep
HeapSize
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
HeapReAlloc
SetStdHandle

Exports

Exports

InstallExceptionHandler
WriteMinidumpWithException

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/EzTalkCore.dll
.dll windows:4 windows x86 arch:x86

f1c084cdd24453163198d8fad3095949

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

91:da:79:32:c0:ef:80:99:b5:2d:3a:0a:59:2a:33:09:77:80:d9:10
Signer

Actual PE Digest

91:da:79:32:c0:ef:80:99:b5:2d:3a:0a:59:2a:33:09:77:80:d9:10

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\ezim\bin\EzTalkCore.pdb

Imports

udpstream

CreateUDPModule

ws2_32

gethostbyname
WSAStartup
connect
socket
htons
bind
WSAAsyncSelect
closesocket
WSACleanup
inet_ntoa
send
WSAGetLastError
listen
inet_addr
recv
shutdown
htonl

kernel32

GetStdHandle
ReadFile
LCMapStringW
LCMapStringA
SetStdHandle
GetStringTypeW
GetStringTypeA
GetSystemInfo
VirtualProtect
MultiByteToWideChar
GetCPInfo
GetOEMCP
_lclose
_lwrite
_llseek
_lcreat
_lopen
CreateDirectoryA
GetLocalTime
Sleep
lstrcatA
GetModuleFileNameA
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
GetLastError
WriteFile
HeapFree
GetProcessHeap
CreateNamedPipeA
SetEvent
ConnectNamedPipe
CloseHandle
DisconnectNamedPipe
FlushFileBuffers
ReadFileEx
HeapAlloc
GetOverlappedResult
WaitForSingleObjectEx
CreateEventA
lstrcpynA
WaitForSingleObject
CreateThread
GetTickCount
WritePrivateProfileStringA
GetPrivateProfileStringA
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
SetHandleCount
SetFilePointer
UnhandledExceptionFilter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
IsBadWritePtr
VirtualAlloc
ExitProcess
RtlUnwind
GetCurrentThreadId
GetCommandLineA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualQuery
SetUnhandledExceptionFilter
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
HeapReAlloc
TerminateProcess
GetCurrentProcess
HeapSize
HeapDestroy
HeapCreate
VirtualFree
GetFileType

user32

PostMessageA
RegisterClassA
CreateWindowExA
KillTimer
SetTimer
DefWindowProcA

netlib

CreateNetModule

Exports

Exports

CreateETCluster

Sections

.text
Size: 108KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/NetConfig.ini
ET2.0/NetLib.dll
.dll windows:4 windows x86 arch:x86

e32e26fa59d4a92aac4b4ccc36529fb7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:d4:0f:ce:6c:04:60:9b:ed:a5:62:56:48:8c:fd:45:ff:59:88:f3
Signer

Actual PE Digest

77:d4:0f:ce:6c:04:60:9b:ed:a5:62:56:48:8c:fd:45:ff:59:88:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\Project\模拟器服务器\TestLib\TestLib\Bin\NetLib.pdb

Imports

ws2_32

recvfrom
WSAEventSelect
WSAWaitForMultipleEvents
WSAResetEvent
WSAEnumNetworkEvents
WSACloseEvent
WSASetEvent
WSACreateEvent
send
recv
accept
WSASocketA
WSAIoctl
ntohs
inet_ntoa
connect
listen
bind
socket
WSARecv
htons
inet_addr
sendto
WSAGetLastError
WSASend
closesocket
shutdown
setsockopt
getsockopt
WSACleanup
WSAStartup

kernel32

HeapReAlloc
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
RaiseException
VirtualProtect
FlushFileBuffers
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
GetCurrentProcessId
QueryPerformanceCounter
SetStdHandle
LoadLibraryA
GetCPInfo
GetOEMCP
GetACP
GetModuleFileNameA
lstrcatA
CreateDirectoryA
GetLocalTime
_lopen
_lcreat
_llseek
_lwrite
_lclose
OutputDebugStringA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
Sleep
InterlockedIncrement
CreateTimerQueueTimer
DeleteTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueue
DeleteTimerQueueEx
GetLastError
CreateTimerQueue
CreateEventA
SetEvent
CloseHandle
WaitForSingleObject
InterlockedDecrement
CreateIoCompletionPort
GetSystemInfo
PostQueuedCompletionStatus
WaitForMultipleObjects
GetQueuedCompletionStatus
QueueUserWorkItem
GetTickCount
ResumeThread
HeapAlloc
HeapFree
ExitThread
GetCurrentThreadId
CreateThread
GetSystemTimeAsFileTime
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
WriteFile
SetFilePointer
RtlUnwind
VirtualQuery

Exports

Exports

CreateNetModule

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/NetSpeedModule.dll
.dll windows:5 windows x86 arch:x86

2e70be43840b6a46144d0e0efc666709

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

98:17:29:59:5d:f7:b0:27:02:f3:04:c9:11:b3:e0:45:0a:1b:35:4a
Signer

Actual PE Digest

98:17:29:59:5d:f7:b0:27:02:f3:04:c9:11:b3:e0:45:0a:1b:35:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Work\SD_NetSpeed\Src\product\NetSpeedModule.pdb

Imports

ws2_32

gethostbyname
inet_addr
WSAStartup
WSAGetLastError
htons

udpcore

CreateProtocol_UDP

tcpcorec

CreateProtocol_TCP

kernel32

HeapFree
WriteConsoleW
CreateFileW
FlushFileBuffers
SetStdHandle
GetConsoleMode
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetTickCount
GetModuleFileNameW
GetModuleFileNameA
WideCharToMultiByte
GetProcAddress
LoadLibraryW
MultiByteToWideChar
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
IsProcessorFeaturePresent
WriteFile
GetStdHandle
HeapSize
GetModuleHandleW
ExitProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetStringTypeW
HeapReAlloc

netapi32

Netbios

Exports

Exports

CreateNetSpeedModule

Sections

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/NetSpeedPPP.dat
ET2.0/NetSpeedPlatForm.dll
.dll windows:5 windows x86 arch:x86

c76409a3d5d16cca0955448934b1fddf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5c:c1:89:6a:e5:8c:03:ea:36:21:9d:78:7e:f8:30:0a:40:5f:6d:84
Signer

Actual PE Digest

5c:c1:89:6a:e5:8c:03:ea:36:21:9d:78:7e:f8:30:0a:40:5f:6d:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
RegCreateKeyExW
RegCloseKey

user32

LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClassLongW
SetCapture
SetActiveWindow
SendMessageA
SendMessageW
ScrollWindow
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OffsetRect
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsIconic
IsDialogMessageA
IsDialogMessageW
IsChild
InvalidateRect
IntersectRect
InsertMenuItemW
InsertMenuW
InflateRect
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMessageExtraInfo
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClientRect
GetClassLongW
GetClassInfoW
GetCapture
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextExW
DrawTextW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CharUpperBuffW
CharNextW
CharLowerW
CallWindowProcW
CallNextHookEx
BeginPaint
AdjustWindowRectEx
ActivateKeyboardLayout
TranslateMessage
SetWindowLongW
RegisterClassW
PostMessageW
GetMessageW
DestroyWindow
DispatchMessageW
DefWindowProcW
CreateWindowExW
CharUpperW

kernel32

lstrcmpiA
LoadLibraryA
LocalFree
LocalAlloc
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
IsValidLocale
GetSystemDefaultUILanguage
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetUserDefaultUILanguage
GetLocaleInfoW
GetLastError
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
ExitThread
CreateThread
CompareStringW
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CloseHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
lstrcpyW
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
SizeofResource
SignalObjectAndWait
SetThreadPriority
SetThreadLocale
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
MultiByteToWideChar
MulDiv
LockResource
LoadResource
LoadLibraryW
LeaveCriticalSection
InitializeCriticalSection
GlobalFindAtomW
GlobalDeleteAtom
GlobalAddAtomW
GetVersionExW
GetVersion
GetTickCount
GetThreadPriority
GetThreadLocale
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetExitCodeThread
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCPInfo
FreeResource
InterlockedExchangeAdd
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateFileW
CreateEventW
CompareStringW
CloseHandle
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingW
CloseHandle
GetFileInformationByHandle
CreateFileW
Sleep
ExpandEnvironmentStringsW
VirtualAlloc
TerminateThread
GetTickCount
GetSystemDirectoryW
GetFileAttributesW
FindFirstFileW
FindClose
DeleteFileW
CreateThread
CreateMutexW
CopyFileW
CloseHandle

msimg32

AlphaBlend

gdi32

UnrealizeObject
StretchBlt
SetWindowOrgEx
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetDIBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RoundRect
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PolyBezierTo
PolyBezier
Pie
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetTextMetricsW
GetTextExtentPoint32W
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectW
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
FrameRgn
ExtTextOutW
ExtFloodFill
ExcludeClipRect
EnumFontFamiliesExW
Ellipse
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
Chord
BitBlt
Arc

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ole32

OleUninitialize
OleInitialize

iphlpapi

GetAdaptersInfo
GetIfEntry

ws2_32

WSCGetProviderPath
WSCInstallProvider
WSCEnumProtocols
WSCWriteProviderOrder
WSCDeinstallProvider
inet_addr
inet_ntoa

netspeedroutenat

SetData
GetData

comctl32

InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create

netspeedmodule

CreateNetSpeedModule

rasapi32

RasHangUpW
RasGetErrorStringW
RasGetConnectStatusW
RasDialW

Exports

Exports

CreateNetSpeedPlatform

Sections

.text
Size: 648KB - Virtual size: 647KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 20KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 1024B - Virtual size: 670B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 94B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ET2.0/NetSpeedProxy.dll
.dll windows:5 windows x86 arch:x86

6082b98a8f076f96de2faed3225d8cb8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2c:ce:2d:2a:f6:86:27:e1:3c:8f:1e:bd:09:55:34:87:97:1b:41:8e
Signer

Actual PE Digest

2c:ce:2d:2a:f6:86:27:e1:3c:8f:1e:bd:09:55:34:87:97:1b:41:8e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Work\SD_NetSpeed\Src\product\NetSpeedProxy.pdb

Imports

ws2_32

connect
WSAStartup
select
WSAGetLastError
WSACleanup
recv
__WSAFDIsSet
send

kernel32

WriteConsoleW
SetStdHandle
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetTickCount
WideCharToMultiByte
GetModuleFileNameW
GetModuleFileNameA
Sleep
CloseHandle
GetCurrentThreadId
FreeLibrary
LoadLibraryW
MultiByteToWideChar
GetProcAddress
SetUnhandledExceptionFilter
GetCurrentProcess
CreateFileW
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
GetCurrentThread
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
EncodePointer
DecodePointer
GetLastError
HeapFree
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetModuleHandleW
ExitProcess
GetCommandLineA
RaiseException
GetCPInfo
RtlUnwind
HeapAlloc
LCMapStringW
IsProcessorFeaturePresent
GetStdHandle
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
GetStartupInfoW
HeapCreate
HeapDestroy
ReadFile
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers

netapi32

Netbios

Exports

Exports

CreateNetSpeedProxy

Sections

.text
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/NetSpeedRouteNAT.dll
.dll windows:5 windows x86 arch:x86

8ebc797d5865dd450ef0cad9906573b4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

31:61:1c:9b:50:33:7d:1a:2a:42:15:64:2c:a1:99:5b:48:3e:78:c1
Signer

Actual PE Digest

31:61:1c:9b:50:33:7d:1a:2a:42:15:64:2c:a1:99:5b:48:3e:78:c1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

user32

LoadStringW
MessageBoxA
CharNextW
MessageBoxW
LoadStringW
GetSystemMetrics
CharUpperBuffW
CharNextW
CharUpperW

kernel32

lstrcmpiA
LoadLibraryA
LocalFree
LocalAlloc
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
IsValidLocale
GetSystemDefaultUILanguage
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetUserDefaultUILanguage
GetLocaleInfoW
GetLastError
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
CompareStringW
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CloseHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingW
CloseHandle
GetFileInformationByHandle
CreateFileW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQueryEx
VirtualQuery
VirtualFree
SignalObjectAndWait
SetFilePointer
SetEvent
SetEndOfFile
ResetEvent
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LeaveCriticalSection
InitializeCriticalSection
GetVersionExW
GetThreadLocale
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentProcess
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
EnterCriticalSection
DeleteCriticalSection
CreateFileW
CreateEventW
CompareStringW
CloseHandle
Sleep
SetEvent
CreateEventW
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
CloseHandle
CreateMutexW
WaitForSingleObject
LoadLibraryW
GetTickCount
GetProcAddress
GetModuleFileNameW
GetCurrentProcessId
FreeLibrary
ExpandEnvironmentStringsW
CreateThread

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wsock32

closesocket

ws2_32

WSCGetProviderPath
WSCEnumProtocols
ntohs
inet_ntoa

Exports

Exports

GetData
SetData
WSPStartup

Sections

.text
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 28KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 118B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ET2.0/NetSpeedRouteVPN.dll
.dll windows:5 windows x86 arch:x86

cf38ecb11ec5303a8cd1ceaf9680e73f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ee:85:d7:29:c1:47:3d:e4:bf:ea:63:b3:8f:7d:bc:6f:5a:ec:d8:53
Signer

Actual PE Digest

ee:85:d7:29:c1:47:3d:e4:bf:ea:63:b3:8f:7d:bc:6f:5a:ec:d8:53

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

user32

LoadStringW
MessageBoxA
CharNextW
MessageBoxW
LoadStringW
GetSystemMetrics
CharUpperBuffW
CharNextW
CharUpperW

kernel32

lstrcmpiA
LoadLibraryA
LocalFree
LocalAlloc
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
IsValidLocale
GetSystemDefaultUILanguage
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetUserDefaultUILanguage
GetLocaleInfoW
GetLastError
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
CompareStringW
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CloseHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingW
CloseHandle
GetFileInformationByHandle
CreateFileW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQueryEx
VirtualQuery
VirtualFree
SignalObjectAndWait
SetFilePointer
SetEvent
SetEndOfFile
ResetEvent
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LeaveCriticalSection
InitializeCriticalSection
GetVersionExW
GetThreadLocale
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentProcess
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
EnterCriticalSection
DeleteCriticalSection
CreateFileW
CreateEventW
CompareStringW
CloseHandle
Sleep
SetEvent
CreateEventW
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
CloseHandle
CreateMutexW
TerminateThread
WaitForSingleObject
LoadLibraryW
GetTickCount
GetProcAddress
GetModuleFileNameW
GetCurrentProcessId
FreeLibrary
ExpandEnvironmentStringsW
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

iphlpapi

CreateIpForwardEntry

wsock32

closesocket

ws2_32

WSCGetProviderPath
WSCEnumProtocols
ntohs
inet_ntoa

Exports

Exports

GetData
SetData
WSPStartup

Sections

.text
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 28KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 118B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ET2.0/SDOImage.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9c:be:40:fd:b9:3c:bf:cd:84:c0:36:1e:66:9c:ac:b6:ce:78:38:62
Signer

Actual PE Digest

9c:be:40:fd:b9:3c:bf:cd:84:c0:36:1e:66:9c:ac:b6:ce:78:38:62

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InsertGifToRichedit2A
InsertGifToRichedit2W
InsertGifToRicheditA
InsertGifToRicheditW

Sections

.text
Size: 73KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.orpc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ET2.0/SNDAVideoEngine.dll
.dll windows:4 windows x86 arch:x86

4fc48e5d8836ab8e7f7bbafb2a25c609

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

18:a5:ba:de:01:35:bc:c1:bc:11:0e:f2:c8:8e:df:13:36:69:e6:fc
Signer

Actual PE Digest

18:a5:ba:de:01:35:bc:c1:bc:11:0e:f2:c8:8e:df:13:36:69:e6:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\Project\SNDAVideoEngine\TestVideoEngine\TestVideoEngine\bin\SNDAVideoEngine.pdb

Imports

winmm

timeKillEvent
timeGetTime
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeSetEvent

kernel32

LocalFree
GetEnvironmentStrings
EnterCriticalSection
LeaveCriticalSection
GetLastError
OutputDebugStringA
GetLocaleInfoA
GetACP
InterlockedExchange
GetThreadLocale
GetVersionExA
InitializeCriticalSection
DeleteCriticalSection
Sleep
GetSystemInfo
CloseHandle
WaitForSingleObject
CreateThread
HeapAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
RtlUnwind
RaiseException
VirtualProtect
VirtualAlloc
VirtualQuery
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
IsBadWritePtr
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
SetUnhandledExceptionFilter
HeapSize
GetCPInfo
GetStringTypeA
GetStringTypeW
GetOEMCP
SetFilePointer
LoadLibraryA
SetStdHandle
FlushFileBuffers
CreateFileA
IsBadReadPtr
IsBadCodePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetEndOfFile
ReadFile

user32

CreateWindowExA
GetWindowRect
DestroyWindow

ole32

CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance

oleaut32

OleCreatePropertyFrame
VariantClear
VariantInit

Exports

Exports

CreateVideoEngine

Sections

.text
Size: 352KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rotext
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/Skin/BigDefaultImage.PNG
.png
ET2.0/Skin/BigForbidImage.PNG
.png
ET2.0/Skin/BigFrame.png
.png
ET2.0/Skin/DefaultImage.PNG
.png
ET2.0/Skin/ForbidImage.PNG
.png
ET2.0/Skin/SmallDefaultImage.PNG
.png
ET2.0/Skin/SmallForbidImage.PNG
.png
ET2.0/Skin/SmallFrame.png
.png
ET2.0/Skin/SmileFace.png
.png
ET2.0/Skin/UserCard.PNG
.png
ET2.0/Skin/Window.bmp
ET2.0/Skin/bar-不可用.png
.png
ET2.0/Skin/bar-正常状态.png
.png
ET2.0/Skin/bg.png
.png
ET2.0/Skin/blank.gif
ET2.0/Skin/bottomRight.PNG
.png
ET2.0/Skin/btnpchatdown.PNG
.png
ET2.0/Skin/btnpchathover.PNG
.png
ET2.0/Skin/btnpchatnormal.PNG
.png
ET2.0/Skin/caption.png
.png
ET2.0/Skin/cbbNm.png
.png
ET2.0/Skin/cbbPrs.png
.png
ET2.0/Skin/cbbhl.png
.png
ET2.0/Skin/cbbunable.png
.png
ET2.0/Skin/channelstyle.xml
ET2.0/Skin/channelstyle2.xml
ET2.0/Skin/clientmark.png
.png
ET2.0/Skin/controlMic.png
.png
ET2.0/Skin/disableMesage_Unable_hov.png
.png
ET2.0/Skin/disableMesage_Unable_nor.png
.png
ET2.0/Skin/disableMesage_Unable_prs.png
.png
ET2.0/Skin/disableMesage_enable_hov.png
.png
ET2.0/Skin/disableMesage_enable_nor.png
.png
ET2.0/Skin/disableMesage_enable_prs.png
.png
ET2.0/Skin/etblank.html
.html
ET2.0/Skin/etchanneltype.xml
ET2.0/Skin/etconfig.xml
ET2.0/Skin/etconfig1.xml
ET2.0/Skin/faceClick.png
.png
ET2.0/Skin/faceHover.png
.png
ET2.0/Skin/faceInit.png
.png
ET2.0/Skin/female.png
.png
ET2.0/Skin/frame.bmp
ET2.0/Skin/icon.gif
.gif
ET2.0/Skin/inqueue_hov.png
.png
ET2.0/Skin/inqueue_nor.png
.png
ET2.0/Skin/inqueue_prs.png
.png
ET2.0/Skin/limitless.png
.png
ET2.0/Skin/line.png
.png
ET2.0/Skin/loginFail_nor.png
.png
ET2.0/Skin/login_page.png
.png
ET2.0/Skin/loginfail_hov.png
.png
ET2.0/Skin/loginfail_prs.png
.png
ET2.0/Skin/loginsucc_hov.png
.png
ET2.0/Skin/loginsucc_nor.png
.png
ET2.0/Skin/loginsucc_prs.png
.png
ET2.0/Skin/main_sleep_hov.PNG
.png
ET2.0/Skin/main_sleep_nor.PNG
.png
ET2.0/Skin/main_sleep_press.PNG
.png
ET2.0/Skin/main_sleep_selected.PNG
.png
ET2.0/Skin/male.png
.png
ET2.0/Skin/mciboostPress.PNG
.png
ET2.0/Skin/mic_hover.PNG
.png
ET2.0/Skin/mic_mute_hover.PNG
.png
ET2.0/Skin/mic_mute_nor.PNG
.png
ET2.0/Skin/mic_mute_press.PNG
.png
ET2.0/Skin/mic_nor.PNG
.png
ET2.0/Skin/mic_press.PNG
.png
ET2.0/Skin/micboostHover.PNG
.png
ET2.0/Skin/micboostNor.PNG
.png
ET2.0/Skin/micboostPress.PNG
.png
ET2.0/Skin/micboostdisable.png
.png
ET2.0/Skin/micvolumebar.PNG
.png
ET2.0/Skin/nm.png
.png
ET2.0/Skin/normal.png
.png
ET2.0/Skin/pchatdown.png
.png
ET2.0/Skin/pchatdownafter.png
.png
ET2.0/Skin/pchatgif.gif
.gif
ET2.0/Skin/pchathover.png
.png
ET2.0/Skin/pchaticon.PNG
.png
ET2.0/Skin/pchatnormal.png
.png
ET2.0/Skin/people_small.png
.png
ET2.0/Skin/people_window.png
.png
ET2.0/Skin/skin6.ini
ET2.0/Skin/skin6.png
.png
ET2.0/Skin/sleep_hov.PNG
.png
ET2.0/Skin/sleep_nor.PNG
.png
ET2.0/Skin/sleep_press.PNG
.png
ET2.0/Skin/sleep_selected.PNG
.png
ET2.0/Skin/smallFrame.bmp
ET2.0/Skin/state_Change_Press.png
.png
ET2.0/Skin/state_Change_hov.png
.png
ET2.0/Skin/status/away.bmp
ET2.0/Skin/status/busy.bmp
ET2.0/Skin/status/hide.bmp
ET2.0/Skin/status/offline.bmp
ET2.0/Skin/status/online.bmp
ET2.0/Skin/superMic_nor.png
.png
ET2.0/Skin/supermic_hover.png
.png
ET2.0/Skin/supermic_mute_hover.png
.png
ET2.0/Skin/supermic_mute_nor.png
.png
ET2.0/Skin/supermic_mute_press.png
.png
ET2.0/Skin/supermic_press.png
.png
ET2.0/Skin/sysMenu/01.bmp
ET2.0/Skin/sysMenu/02.bmp
ET2.0/Skin/sysMenu/03.bmp
ET2.0/Skin/sysMenu/04.bmp
ET2.0/Skin/sysMenu/05.bmp
ET2.0/Skin/sysMenu/06.bmp
ET2.0/Skin/sysMenu/07.bmp
ET2.0/Skin/sysMenu/08.bmp
ET2.0/Skin/sysMenu/09.bmp
ET2.0/Skin/sysMenu/10.bmp
ET2.0/Skin/sysMenu/11.bmp
ET2.0/Skin/sysMenu/12.bmp
ET2.0/Skin/sysMenu/13.bmp
ET2.0/Skin/sysMenu/sysMenu.cfg
ET2.0/Skin/systips.bmp
ET2.0/Skin/tips.bmp
ET2.0/Skin/tips.gif
ET2.0/Skin/tips1.bmp
ET2.0/Skin/triangle.png
.png
ET2.0/Skin/watermark.png
.png
ET2.0/Skin/下拉三角.png
.png
ET2.0/Skin/下拉按钮-初始.png
.png
ET2.0/Skin/下拉按钮-鼠标滑过.png
.png
ET2.0/Skin/下拉按钮-鼠标点击.png
.png
ET2.0/Skin/出现问题icon.png
.png
ET2.0/Skin/录音按钮-初始状态.png
.png
ET2.0/Skin/录音按钮-鼠标划过.png
.png
ET2.0/Skin/录音按钮-鼠标点击.png
.png
ET2.0/Skin/录音记时区域.PNG
.png
ET2.0/Skin/按钮-不可用.png
.png
ET2.0/Skin/按钮-鼠标滑过.PNG
.png
ET2.0/Skin/按钮-鼠标点击.PNG
.png
ET2.0/Skin/操作正常icon.png
.png
ET2.0/Skin/普通按钮-初始.PNG
.png
ET2.0/Skin/状态切换-鼠标滑过.png
.png
ET2.0/Skin/状态切换-鼠标点击.png
.png
ET2.0/Skin/调节按钮-不可用.png
.png
ET2.0/Skin/调节按钮-初始状态.PNG
.png
ET2.0/Skin/调节按钮-鼠标滑过.PNG
.png
ET2.0/Skin/调节按钮-鼠标点击.PNG
.png
ET2.0/Skin/轨道.PNG
.png
ET2.0/Skin/麦克与麦克风增强/mic_hover.PNG
.png
ET2.0/Skin/麦克与麦克风增强/mic_mute_hover.PNG
.png
ET2.0/Skin/麦克与麦克风增强/mic_mute_nor.PNG
.png
ET2.0/Skin/麦克与麦克风增强/mic_mute_press.PNG
.png
ET2.0/Skin/麦克与麦克风增强/mic_nor.PNG
.png
ET2.0/Skin/麦克与麦克风增强/mic_press.PNG
.png
ET2.0/Skin/麦克与麦克风增强/superMic_nor.png
.png
ET2.0/Skin/麦克与麦克风增强/supermic_hover.png
.png
ET2.0/Skin/麦克与麦克风增强/supermic_mute_hover.png
.png
ET2.0/Skin/麦克与麦克风增强/supermic_mute_nor.png
.png
ET2.0/Skin/麦克与麦克风增强/supermic_mute_press.png
.png
ET2.0/Skin/麦克与麦克风增强/supermic_press.png
.png
ET2.0/TCPCoreC.dll
.dll windows:5 windows x86 arch:x86

2d62329123f2744c259e0f731a4a6014

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4b:07:d4:1e:81:df:e5:9f:c2:e2:5e:9d:08:fd:97:86:ec:98:10:c3
Signer

Actual PE Digest

4b:07:d4:1e:81:df:e5:9f:c2:e2:5e:9d:08:fd:97:86:ec:98:10:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\work\SNDA\SD_NetSpeed\Src\product\TCPCoreC.pdb

Imports

ws2_32

WSAStartup
getsockopt
setsockopt
recv
socket
send
connect
WSASocketW
select
WSAGetLastError
shutdown
__WSAFDIsSet
closesocket
WSACleanup

exceptionhandler

WriteMinidumpWithException

kernel32

WriteConsoleW
CreateFileW
SetStdHandle
CompareStringW
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
SetFilePointer
ReadFile
IsValidLocale
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
Sleep
GetProcAddress
LoadLibraryW
MultiByteToWideChar
GetTickCount
GetModuleFileNameW
GetModuleFileNameA
WideCharToMultiByte
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStringTypeW
IsValidCodePage
GetOEMCP
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetCurrentThreadId
GetCommandLineA
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
RaiseException
RtlUnwind
SetEnvironmentVariableA
HeapFree
LCMapStringW
GetCPInfo
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetLocaleInfoW
HeapSize
GetModuleHandleW
ExitProcess
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetACP

Exports

Exports

CreateProtocol_TCP

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/TalkEngine.dll
.dll windows:4 windows x86 arch:x86

abaedbd70a9b2fe0a3e3725e818336d4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3f:e3:12:ca:51:70:38:c7:38:75:da:1c:25:bb:ca:de:74:58:ac:76
Signer

Actual PE Digest

3f:e3:12:ca:51:70:38:c7:38:75:da:1c:25:bb:ca:de:74:58:ac:76

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Project\NetBuffer\NetBuffer\bin\TalkEngine.pdb

Imports

user32

GetForegroundWindow
GetDesktopWindow

kernel32

_lclose
_lwrite
GetCurrentProcessId
_llseek
_lcreat
_lopen
CreateDirectoryA
GetLocalTime
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
CreateEventA
SetEvent
Sleep
CloseHandle
WaitForSingleObject
OutputDebugStringA
SetThreadPriority
GetTickCount
LoadLibraryA
GetProcAddress
lstrcatA
GetModuleFileNameA
CreateMutexA
ReleaseMutex
UnmapViewOfFile
CreateFileMappingA
GetLastError
MapViewOfFile
GetCurrentThreadId
ResetEvent
GlobalUnlock
GlobalFree
GetCurrentThread
GetFileType
CreateFileA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
GetLocaleInfoA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
SetFilePointer
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
GetStartupInfoA
ResumeThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
ExitThread
CreateThread
GetSystemTimeAsFileTime
HeapReAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
GetModuleHandleA
ExitProcess
RaiseException
RtlUnwind
WriteFile
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapSize
FreeEnvironmentStringsA

winmm

mmioWrite
mmioSetInfo
mmioSeek
mmioAscend
mmioDescend
mmioClose
waveInAddBuffer
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
timeKillEvent
timeSetEvent
timeGetTime

dsound

ord12
ord11

Exports

Exports

CreateDSPLoader
CreatePCMSoftMixer
CreateRAWPlayOut
CreateResampler
CreateTalkEngine

Sections

.text
Size: 452KB - Virtual size: 450KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/UDPCore.dll
.dll windows:5 windows x86 arch:x86

cceddc046db72ffcd9c37d21f85df24c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

15:c6:18:3b:42:4c:f3:af:82:fb:c2:2f:36:96:d5:55:8f:c8:67:3f
Signer

Actual PE Digest

15:c6:18:3b:42:4c:f3:af:82:fb:c2:2f:36:96:d5:55:8f:c8:67:3f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Work\SD_NetSpeed\Src\Product\UDPCore.pdb

Imports

ws2_32

closesocket
WSACleanup
WSAStartup
recvfrom
sendto
socket
setsockopt
bind
htons
gethostname
gethostbyname

exceptionhandler

WriteMinidumpWithException

kernel32

WriteConsoleW
CreateFileW
SetStdHandle
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
IsProcessorFeaturePresent
SetFilePointer
ReadFile
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
Sleep
GetProcAddress
LoadLibraryW
MultiByteToWideChar
GetTickCount
GetModuleFileNameW
GetModuleFileNameA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetCurrentThreadId
GetCommandLineA
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
HeapFree
LCMapStringW
GetCPInfo
HeapAlloc
FlushFileBuffers
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
WriteFile
GetStdHandle
GetLocaleInfoW
ExitProcess
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetEnvironmentVariableA

Exports

Exports

CreateProtocol_UDP

Sections

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/UDPStream.dll
.dll windows:4 windows x86 arch:x86

3f7173cf8ac9d87f348e0a0be54ba3ea

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7f:e7:b7:7e:17:9c:04:8b:92:86:ab:32:f4:de:09:65:4a:9e:42:65
Signer

Actual PE Digest

7f:e7:b7:7e:17:9c:04:8b:92:86:ab:32:f4:de:09:65:4a:9e:42:65

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\Project\UDPStreamTest\UDPStreamTest\Client\Bin\UDPStream.pdb

Imports

kernel32

GetLocalTime
_lopen
_lcreat
GetFileSize
_llseek
SetEndOfFile
_lwrite
_lclose
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetTickCount
OutputDebugStringA
InterlockedExchange
SetEvent
Sleep
InterlockedIncrement
CreateEventA
CloseHandle
WaitForSingleObject
InterlockedDecrement
GetModuleFileNameA
lstrcatA
CreateDirectoryA
ResumeThread
IsBadCodePtr
IsBadReadPtr
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
HeapReAlloc
ExitThread
GetCurrentThreadId
GetLastError
CreateThread
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
WriteFile
SetFilePointer
RtlUnwind
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetLocaleInfoA
LCMapStringA
LCMapStringW
LoadLibraryA
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
VirtualProtect
GetSystemInfo
FlushFileBuffers
RaiseException
SetUnhandledExceptionFilter

netlib

CreateNetModule

Exports

Exports

CreateUDPModule

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/Version.ini
ET2.0/back/login/BKGFORMLOGINING.png
.png
ET2.0/back/login/BTNFORMBASE.png
.png
ET2.0/back/login/EDITMOUSEENTER.PNG
.png
ET2.0/back/login/EDITMOUSELEAVE.PNG
.png
ET2.0/back/login/LOGINFINDPASS.png
.png
ET2.0/back/login/LOGINFIXNET.png
.png
ET2.0/back/login/LOGINREGISTER.png
.png
ET2.0/back/login/LOGINSPEAKSETUP.png
.png
ET2.0/back/login/LOGOFORMLOGIN.gif
.gif
ET2.0/back/login/unlogin.ico
ET2.0/back/main/ACTIVELOGO.png
.png
ET2.0/back/main/ADDGAMEBKG.png
.png
ET2.0/back/main/ARROWDOWN.png
.png
ET2.0/back/main/ARROWRIGHT.png
.png
ET2.0/back/main/BAKSERVERPOINT.png
.png
ET2.0/back/main/BKGABOUT.png
.png
ET2.0/back/main/BKGCHILDGAME.png
.png
ET2.0/back/main/BKGCHILDGAMEFOCUS.png
.png
ET2.0/back/main/BKGCHILDGAMEHOVER.png
.png
ET2.0/back/main/BKGCONFIG.png
.png
ET2.0/back/main/BKGERRORMSG.png
.png
ET2.0/back/main/BKGMAINMENU.png
.png
ET2.0/back/main/BKGNODESELECT.png
.png
ET2.0/back/main/BKGNODEUNSELECT.png
.png
ET2.0/back/main/BKGROOTGAME.png
.png
ET2.0/back/main/BKGSERVER.png
.png
ET2.0/back/main/BUTTONSPEEDDISABLE.bmp
ET2.0/back/main/BUTTONSPEEDHOVER.bmp
ET2.0/back/main/BUTTONSPEEDNORMAL.bmp
ET2.0/back/main/BUTTONSPEEDSELECT.bmp
ET2.0/back/main/DIALOGFRAME.png
.png
ET2.0/back/main/EDITMOUSEENTER.png
.png
ET2.0/back/main/EDITMOUSELEAVE.png
.png
ET2.0/back/main/EDIT_SEARCH_FRAME.png
.png
ET2.0/back/main/ENTERHALLFRAME.png
.png
ET2.0/back/main/FORMMAINCLIENT.png
.png
ET2.0/back/main/GAMEICONFOCUS.png
.png
ET2.0/back/main/GAMEICONSMALL.png
.png
ET2.0/back/main/GAMEICONSMALLBACK.png
.png
ET2.0/back/main/GAMEREFOCUSBACK.png
.png
ET2.0/back/main/INACTIVELOGO.png
.png
ET2.0/back/main/MENUICOABOUT.png
.png
ET2.0/back/main/MENUICOADDGAME.png
.png
ET2.0/back/main/MENUICOBBS.png
.png
ET2.0/back/main/MENUICOCONFIG.png
.png
ET2.0/back/main/MENUICOEXIT.png
.png
ET2.0/back/main/MENUICOSHOWMAIN.png
.png
ET2.0/back/main/MENUICOSTOPSPEED.png
.png
ET2.0/back/main/MENUITEMSELECTBKG.png
.png
ET2.0/back/main/NODESELECT.png
.png
ET2.0/back/main/NODETOP1.png
.png
ET2.0/back/main/NODETOP2.png
.png
ET2.0/back/main/NODETOP3.png
.png
ET2.0/back/main/NODETOP4.png
.png
ET2.0/back/main/NODETOP5.png
.png
ET2.0/back/main/RESTABDISABLE.png
.png
ET2.0/back/main/RESTABHOVER.png
.png
ET2.0/back/main/RESTABNORMAL.png
.png
ET2.0/back/main/RESTABSELECT.png
.png
ET2.0/back/main/RES_PNG_SPEED_FACE.png
.png
ET2.0/back/main/RES_PNG_SPEED_HOVER.png
.png
ET2.0/back/main/RES_PNG_SPEED_SELECTED.png
.png
ET2.0/back/main/RES_SPEEDTAB_HOVER.png
.png
ET2.0/back/main/RES_SPEEDTAB_SELECTED.png
.png
ET2.0/back/main/RES_TAB_HOVER.png
.png
ET2.0/back/main/RES_TAB_SELECTED.png
.png
ET2.0/back/main/SEARCHHOVER.png
.png
ET2.0/back/main/SIGNAL0.png
.png
ET2.0/back/main/SIGNAL1.png
.png
ET2.0/back/main/SIGNAL2.png
.png
ET2.0/back/main/SIGNAL3.png
.png
ET2.0/back/main/SIGNAL4.png
.png
ET2.0/back/main/SIGNAL5.png
.png
ET2.0/back/main/STOPSPEEDBACK.png
.png
ET2.0/back/main/TRAYMENUBACK1.png
.png
ET2.0/back/main/TRAYMENUBACK2.png
.png
ET2.0/back/main/TRAYMENUITEMSELECTBKG.png
.png
ET2.0/back/main/bg.png
.png
ET2.0/back/ntheme/BKGFORMLOGIN.png
.png
ET2.0/back/ntheme/BKGFORMLOGINING.png
.png
ET2.0/back/ntheme/FORMMAINBOTTOM.png
.png
ET2.0/back/ntheme/FORMMAINTOP.png
.png
ET2.0/back/theme/BKGFORMLOGIN.png
.png
ET2.0/back/theme/BKGFORMLOGINING.png
.png
ET2.0/back/theme/FORMMAINBOTTOM.png
.png
ET2.0/back/theme/FORMMAINTOP.png
.png
ET2.0/chatcontent.dll
ET2.0/et.ini
ET2.0/etamset.dll
.dll windows:5 windows x86 arch:x86

5c55d3a65e770a2485af8ac547f5b551

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1a:b3:b8:0f:5c:24:02:ad:88:1d:21:4f:6b:88:48:c8:72:f1:55:ef
Signer

Actual PE Digest

1a:b3:b8:0f:5c:24:02:ad:88:1d:21:4f:6b:88:48:c8:72:f1:55:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateDirectoryA
CreateFileA
SetFilePointer
WriteFile
CloseHandle
OutputDebugStringW
lstrcpynA
lstrlenW
WideCharToMultiByte
GetFileAttributesExW
CreateFileW
ReadFile
MultiByteToWideChar
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
DeleteFileW
GetModuleFileNameW
CompareStringA
FlushFileBuffers
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringA
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
LoadLibraryA
CompareStringW
GetVersionExW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
Sleep
ExitProcess
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
SetEnvironmentVariableA

ole32

CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoUninitialize
StringFromGUID2

oleaut32

SysFreeString

winmm

waveInOpen
waveOutClose
mixerGetID
waveOutOpen
mixerSetControlDetails
waveInClose
mixerGetLineInfoW
mixerClose
mixerGetDevCapsW
mixerOpen
mixerGetNumDevs
mixerGetLineControlsW
mixerGetControlDetailsW

dsound

ord8

Exports

Exports

?EnumAudioCaptureFiltersA@@YGJP6GHPBDPAUIMoniker@@K@ZK@Z
?EnumAudioCaptureFiltersW@@YGJP6GHPB_WPAUIMoniker@@K@ZK@Z
?EnumAudioCapturePinsA@@YGIPBDP6GHPAUtagMIXERLINEA@@K@ZK@Z
?EnumAudioCapturePinsW@@YGIPB_WP6GHPAUtagMIXERLINEW@@K@ZK@Z
?FindAudioCapturePinByNameA@@YGJPAUIBaseFilter@@PBDPAPAUIPin@@@Z
?FindAudioCapturePinByNameW@@YGJPAUIBaseFilter@@PB_WPAPAUIPin@@@Z
?SetAudioCaptureOutputProperties@@YGJPAUIBaseFilter@@PAUtagAC_PCMFORMAT@@@Z
AutoSetKaraOKAudioMixer
AutoSetMiscAudioMixer
EnumAudioDevices
FindExternalSoundCardA
FindExternalSoundCardW
FindMicMixerWithKeywordA
FindMicMixerWithKeywordW
FindMicOutWithKeywordA
FindMicOutWithKeywordW
FindMicboostWithKeywordA
FindMicboostWithKeywordW
FindMixerWithKeywordA
FindMixerWithKeywordW
FindNoMicMixerWithKeywordA
FindNoMicMixerWithKeywordW
GetAudioCaptureInputMixerA
GetAudioCaptureInputMixerExA
GetAudioCaptureInputMixerExW
GetAudioCaptureInputMixerW
GetExternalSoundCard
GetMicMixerKeyword
GetMicOutKeyword
GetMicboostKeyword
GetMiscMuteA
GetMiscMuteW
GetMiscVolumeA
GetMiscVolumeW
GetMixerControlBoolean
GetMixerControlSigned
GetMixerControlUnsigned
GetMixerKeyword
GetMuxControlValue
GetNoMicMixerKeyword
GetWaveoutMuteA
GetWaveoutMuteW
GetWaveoutVolumeA
GetWaveoutVolumeW
SetAudioCaptureInputMixerA
SetAudioCaptureInputMixerExA
SetAudioCaptureInputMixerExW
SetAudioCaptureInputMixerW
SetMiscBoostA
SetMiscBoostW
SetMiscMuteA
SetMiscMuteW
SetMiscVolumeA
SetMiscVolumeW
SetMixerControlBoolean
SetMixerControlSigned
SetMixerControlUnsigned
SetMuxControlValue
SetWaveoutMuteA
SetWaveoutMuteW
SetWaveoutVolumeA
SetWaveoutVolumeW

Sections

.text
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/etauclt.exe
.exe windows:4 windows x86 arch:x86

ccbf18315cfd27312ea85bd147924573

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9d:bf:87:ec:fa:43:2c:06:1a:8c:9f:af:b9:8f:fb:af:6a:a5:f2:fd
Signer

Actual PE Digest

9d:bf:87:ec:fa:43:2c:06:1a:8c:9f:af:b9:8f:fb:af:6a:a5:f2:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

sducore

CreateUpdateSession
InitLog
SDDownloadFile

kernel32

ExitProcess
RtlUnwind
HeapFree
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
GetCommandLineA
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
SetErrorMode
HeapCreate
VirtualFree
IsBadWritePtr
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
LocalAlloc
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
lstrcmpA
ConvertDefaultLocale
EnumResourceLanguagesA
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
LoadLibraryA
FreeLibrary
lstrcatA
lstrcmpW
GetModuleHandleA
GetProcAddress
SetLastError
FormatMessageA
lstrcpynA
LocalFree
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcpyA
WritePrivateProfileStringA
CreateThread
ResumeThread
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
lstrlenA
lstrcmpiA
GetVersion
RaiseException
MultiByteToWideChar
CreateProcessA
WaitForSingleObject
CreateMutexA
DeleteFileA
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Module32First
GetLongPathNameA
Process32Next
GetCurrentProcess
GetLastError
GetFileAttributesExA
MulDiv
EnterCriticalSection
GetFileSize
CopyFileA
LeaveCriticalSection
GetModuleFileNameA
CreateDirectoryA
InitializeCriticalSection
GetFileAttributesA
CreateFileA
OutputDebugStringA
SetFilePointer
ReadFile
WriteFile
FlushFileBuffers
GetLocalTime
DeleteCriticalSection
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
CloseHandle
HeapDestroy

user32

GetSysColorBrush
wsprintfA
DestroyMenu
GetDesktopWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
GetMessageA
TranslateMessage
GetActiveWindow
GetCursorPos
ValidateRect
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
EndPaint
BeginPaint
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
IsWindowEnabled
ShowWindow
SetWindowTextA
IsDialogMessageA
WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
RemovePropA
SendDlgItemMessageA
GetFocus
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
SetActiveWindow
DispatchMessageA
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
LoadIconA
PeekMessageA
MapWindowPoints
MessageBoxA
GetKeyState
IsWindowVisible
GetMenu
AdjustWindowRectEx
ScreenToClient
GetClassInfoA
RegisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
CopyRect
PtInRect
GetWindow
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
RegisterWindowMessageA
LoadCursorA
LoadImageA
UnregisterClassA
PostQuitMessage
GetSystemMetrics
DrawIconEx
DestroyIcon
GetWindowLongA
SetForegroundWindow
IsIconic
GetPropA
GetSystemMenu
AppendMenuA
FindWindowA
SendMessageTimeoutA
PostMessageA
GetSysColor
IsWindow
SetCursor
EnableWindow
GetParent
KillTimer
SetTimer
RedrawWindow
InvalidateRect
UpdateWindow
GetClientRect
GetWindowRect
SendMessageA
OffsetRect
GetLastActivePopup

gdi32

DPtoLP
SetTextAlign
CreateBitmap
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetObjectA
GetDeviceCaps
DeleteDC
SetMapMode
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
CreateDIBSection
SetDIBColorTable
SelectObject
CreateCompatibleDC
GetViewportOrgEx
SetViewportOrgEx
GetStockObject
DeleteObject
CreateSolidBrush
CreateFontIndirectA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA

shell32

ShellExecuteA

comctl32

InitCommonControlsEx
ord17

shlwapi

PathFindFileNameA
PathFindExtensionA

ole32

CreateStreamOnHGlobal

oleaut32

VariantChangeType
VariantInit
VariantClear

gdiplus

GdipGetImageHeight
GdipCloneImage
GdipAlloc
GdipDrawImageI
GdipGetImageGraphicsContext
GdipFree
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImagePixelFormat

version

VerQueryValueA

Sections

.text
Size: 128KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ET2.0/etgame.ini
ET2.0/faces/000.jpg
.jpg
ET2.0/faces/001.jpg
.jpg
ET2.0/faces/002.jpg
.jpg
ET2.0/faces/003.jpg
.jpg
ET2.0/faces/004.jpg
.jpg
ET2.0/faces/005.jpg
.jpg
ET2.0/faces/006.jpg
.jpg
ET2.0/faces/007.jpg
.jpg
ET2.0/faces/008.jpg
.jpg
ET2.0/faces/009.jpg
.jpg
ET2.0/faces/010.jpg
.jpg
ET2.0/faces/011.jpg
.jpg
ET2.0/faces/012.jpg
.jpg
ET2.0/faces/013.jpg
.jpg
ET2.0/faces/014.jpg
.jpg
ET2.0/faces/015.jpg
.jpg
ET2.0/faces/016.jpg
.jpg
ET2.0/faces/017.jpg
.jpg
ET2.0/faces/018.jpg
.jpg
ET2.0/faces/019.jpg
.jpg
ET2.0/faces/020.jpg
.jpg
ET2.0/faces/021.jpg
.jpg
ET2.0/faces/022.jpg
.jpg
ET2.0/faces/023.jpg
.jpg
ET2.0/faces/024.jpg
.jpg
ET2.0/faces/025.jpg
.jpg
ET2.0/faces/026.jpg
.jpg
ET2.0/faces/027.jpg
.jpg
ET2.0/faces/028.jpg
.jpg
ET2.0/faces/029.JPG
.jpg
ET2.0/faces/030.JPG
.jpg
ET2.0/faces/031.JPG
.jpg
ET2.0/faces/032.JPG
.jpg
ET2.0/faces/033.jpg
.jpg
ET2.0/faces/034.jpg
.jpg
ET2.0/faces/035.jpg
.jpg
ET2.0/faces/036.jpg
.jpg
ET2.0/faces/037.jpg
.jpg
ET2.0/faces/038.jpg
.jpg
ET2.0/faces/039.jpg
.jpg
ET2.0/faces/040.jpg
.jpg
ET2.0/faces/041.jpg
.jpg
ET2.0/faces/ImgList.cfg
ET2.0/game.dat
ET2.0/icon/CSOL/16x16.ico
ET2.0/icon/CSOL/32x32.ico
ET2.0/icon/QQ三国/16x16.ico
ET2.0/icon/QQ三国/32x32.ico
ET2.0/icon/QQ华夏/16X16.ico
ET2.0/icon/QQ华夏/32X32.ico
ET2.0/icon/QQ堂/16X16.ico
ET2.0/icon/QQ堂/32X32.ico
ET2.0/icon/QQ幻想世界/16x16.ico
ET2.0/icon/QQ幻想世界/32x32.ico
ET2.0/icon/QQ炫舞/16X16.ico
ET2.0/icon/QQ炫舞/32X32.ico
ET2.0/icon/QQ西游/16x16.ico
ET2.0/icon/QQ西游/32x32.ico
ET2.0/icon/QQ音速/16x16.ico
ET2.0/icon/QQ音速/32x32.ico
ET2.0/icon/QQ飞车/16X16.ico
ET2.0/icon/QQ飞车/32X32.ico
ET2.0/icon/SD敢达Online/16x16.ico
ET2.0/icon/SD敢达Online/32x32.ico
ET2.0/icon/VS电竞平台/16x16.ico
ET2.0/icon/VS电竞平台/32x32.ico
ET2.0/icon/三国杀/16X16.ico
ET2.0/icon/三国杀/32X32.ico
ET2.0/icon/三国杀桌面版/16x16.ico
ET2.0/icon/三国杀桌面版/32x32.ico
ET2.0/icon/传世群英传/16x16.ico
ET2.0/icon/传世群英传/32x32.ico
ET2.0/icon/传奇3/16X16.ico
ET2.0/icon/传奇3/32X32.ico
ET2.0/icon/传奇世界/16x16.ico
ET2.0/icon/传奇世界/32x32.ico
ET2.0/icon/冒险岛/16x16.ico
ET2.0/icon/冒险岛/32x32.ico
ET2.0/icon/剑侠世界/16x16.ico
ET2.0/icon/剑侠世界/32x32.ico
ET2.0/icon/剑侠情缘三盛大版/16x16.ico
ET2.0/icon/剑侠情缘三盛大版/32x32.ico
ET2.0/icon/劲舞团/16x16.ico
ET2.0/icon/劲舞团/32x32.ico
ET2.0/icon/古域/16X16.ico
ET2.0/icon/古域/32X32.ico
ET2.0/icon/地下城与勇士-台服/16X16.ico
ET2.0/icon/地下城与勇士-台服/32X32.ico
ET2.0/icon/地下城与勇士/16x16.ico
ET2.0/icon/地下城与勇士/32x32.ico
ET2.0/icon/坦克世界/16x16.ico
ET2.0/icon/坦克世界/32x32.ico
ET2.0/icon/大明龙权/16X16.ico
ET2.0/icon/大明龙权/32x32.ico
ET2.0/icon/天堂2/16x16.ico
ET2.0/icon/天堂2/32x32.ico
ET2.0/icon/天朝/16x16.ico
ET2.0/icon/天朝/32x32.ico
ET2.0/icon/天龙八部2/16x16.ico
ET2.0/icon/天龙八部2/32x32.ico
ET2.0/icon/夺宝传世/16x16.ico
ET2.0/icon/夺宝传世/32x32.ico
ET2.0/icon/奇迹/16x16.ico
ET2.0/icon/奇迹/32x32.ico
ET2.0/icon/完美世界/16x16.ico
ET2.0/icon/完美世界/32x32.ico
ET2.0/icon/完美世界国际版/16x16.ico
ET2.0/icon/完美世界国际版/32x32.ico
ET2.0/icon/寻仙/16x16.ico
ET2.0/icon/寻仙/32x32.ico
ET2.0/icon/巨人时空争霸/16x16.ico
ET2.0/icon/巨人时空争霸/32x32.ico
ET2.0/icon/巨星2/16x16.ico
ET2.0/icon/巨星2/32x32.ico
ET2.0/icon/彩虹岛/16x16.ico
ET2.0/icon/彩虹岛/32x32.ico
ET2.0/icon/征途/16x16.ico
ET2.0/icon/征途/32x32.ico
ET2.0/icon/成吉思汗2盛大版/16x16.ico
ET2.0/icon/成吉思汗2盛大版/32X32.ico
ET2.0/icon/战地之王/16x16.ico
ET2.0/icon/战地之王/32x32.ico
ET2.0/icon/新传奇外传/16x16.ico
ET2.0/icon/新传奇外传/32X32.ico
ET2.0/icon/新奇迹世界/16x16.ico
ET2.0/icon/新奇迹世界/32x32.ico
ET2.0/icon/新热血英豪/16X16.ico
ET2.0/icon/新热血英豪/32X32.ico
ET2.0/icon/新英雄年代/16x16.ico
ET2.0/icon/新英雄年代/32X32.ico
ET2.0/icon/星尘传说/16x16.ico
ET2.0/icon/星尘传说/32x32.ico
ET2.0/icon/星辰变/16x16.ico
ET2.0/icon/星辰变/32x32.ico
ET2.0/icon/极光世界/16x16.ico
ET2.0/icon/极光世界/32x32.ico
ET2.0/icon/极光世界/5.ico
ET2.0/icon/极光世界/6.ico
ET2.0/icon/梦三国/16x16.ico
ET2.0/icon/梦三国/32x32.ico
ET2.0/icon/梦幻西游/16x16.ico
ET2.0/icon/梦幻西游/32x32.ico
ET2.0/icon/梦想世界/16x16.ico
ET2.0/icon/梦想世界/3.ico
ET2.0/icon/梦想世界/32x32.ico
ET2.0/icon/武林外传/16x16.ico
ET2.0/icon/武林外传/32x32.ico
ET2.0/icon/永恒之塔/16x16.ico
ET2.0/icon/永恒之塔/32x32.ico
ET2.0/icon/泡泡堂/16x16.ico
ET2.0/icon/泡泡堂/32x32.ico
ET2.0/icon/泡泡战士/16x16.ico
ET2.0/icon/泡泡战士/32x32.ico
ET2.0/icon/浩方电竞平台/16x16.ico
ET2.0/icon/浩方电竞平台/32x32.ico
ET2.0/icon/热血传奇/16x16.ico
ET2.0/icon/热血传奇/32x32.ico
ET2.0/icon/盟区/16x16.ico
ET2.0/icon/盟区/32x32.ico
ET2.0/icon/神鬼世界/16x16.ico
ET2.0/icon/神鬼世界/32x32.ico
ET2.0/icon/神魔大陆/16x16.ico
ET2.0/icon/神魔大陆/32x32.ico
ET2.0/icon/穿越火线/16x16.ico
ET2.0/icon/穿越火线/32x32.ico
ET2.0/icon/突击风暴/16x16.ico
ET2.0/icon/突击风暴/32x32.ico
ET2.0/icon/绿色征途腾讯版/16x16.ico
ET2.0/icon/绿色征途腾讯版/32X32.ico
ET2.0/icon/英雄年代2/16X16.ico
ET2.0/icon/英雄年代2/32X32.ico
ET2.0/icon/英雄联盟/16x16.ico
ET2.0/icon/英雄联盟/32x32.ico
ET2.0/icon/蜀门/16x16.ico
ET2.0/icon/蜀门/32x32.ico
ET2.0/icon/街头篮球/16x16.ico
ET2.0/icon/街头篮球/32x32.ico
ET2.0/icon/诛仙2/16x16.ico
ET2.0/icon/诛仙2/32x32.ico
ET2.0/icon/诺亚传说/16x16.ico
ET2.0/icon/诺亚传说/32x32.ico
ET2.0/icon/起凡/16X16.ico
ET2.0/icon/起凡/32X32.ico
ET2.0/icon/跑跑卡丁车/16X16.ico
ET2.0/icon/跑跑卡丁车/32X32.ico
ET2.0/icon/远征Online/16x16.ico
ET2.0/icon/远征Online/32x32.ico
ET2.0/icon/酷派天空/16X16.ico
ET2.0/icon/酷派天空/32X32.ico
ET2.0/icon/醉逍遥/16X16.ico
ET2.0/icon/醉逍遥/32X32.ico
ET2.0/icon/问道/16x16.ico
ET2.0/icon/问道/32x32.ico
ET2.0/icon/风云/16x16.ico
ET2.0/icon/风云/32x32.ico
ET2.0/icon/飙车世界/16x16.ico
ET2.0/icon/飙车世界/32x32.ico
ET2.0/icon/飚车世界/16x16.ico
ET2.0/icon/飚车世界/32x32.ico
ET2.0/icon/魔兽世界台服/16x16.ico
ET2.0/icon/魔兽世界台服/32x32.ico
ET2.0/icon/魔兽世界国服/16x16.ico
ET2.0/icon/魔兽世界国服/32x32.ico
ET2.0/icon/魔界2/16x16.ico
ET2.0/icon/魔界2/32x32.ico
ET2.0/icon/龙之谷/16x16.ico
ET2.0/icon/龙之谷/32x32.ico
ET2.0/icon/龙神传说/16X16.ico
ET2.0/icon/龙神传说/32X32.ico
ET2.0/images/FemaleLite.bmp
ET2.0/images/FemaleLite.png
.png
ET2.0/images/MaleLite.bmp
ET2.0/images/MaleLite.png
.png
ET2.0/images/TribeBig.jpg
.jpg
ET2.0/images/arrow_down.png
.png
ET2.0/images/arrow_up.png
.png
ET2.0/images/b_arrow.jpg
.jpg
ET2.0/images/b_bottombg.jpg
.jpg
ET2.0/images/b_l1.jpg
.jpg
ET2.0/images/b_l2.jpg
.jpg
ET2.0/images/b_leftbg.jpg
.jpg
ET2.0/images/b_r1.jpg
.jpg
ET2.0/images/b_r2.jpg
.jpg
ET2.0/images/b_rightbg.jpg
.jpg
ET2.0/images/b_topbg.jpg
.jpg
ET2.0/images/emotionProcessing.gif
.gif
ET2.0/images/hand1.jpg
.jpg
ET2.0/images/smile.gif
.gif
ET2.0/images/status_away.png
.png
ET2.0/images/status_busy.png
.png
ET2.0/images/status_invisible.png
.png
ET2.0/images/status_offline.png
.png
ET2.0/images/status_online.png
.png
ET2.0/images/status_silence.png
.png
ET2.0/images/tempTribeIcon.jpg
.jpg
ET2.0/images/tribeIconLite.jpg
.jpg
ET2.0/images/y_arrow.jpg
.jpg
ET2.0/images/y_bottombg.jpg
.jpg
ET2.0/images/y_l1.jpg
.jpg
ET2.0/images/y_l2.jpg
.jpg
ET2.0/images/y_leftbg.jpg
.jpg
ET2.0/images/y_r1.jpg
.jpg
ET2.0/images/y_r2.jpg
.jpg
ET2.0/images/y_rightbg.jpg
.jpg
ET2.0/images/y_topbg.jpg
.jpg
ET2.0/output.htm
.html
ET2.0/output_private.htm
.html
ET2.0/readme.txt
ET2.0/sducore.dat
ET2.0/sducore.dll
.dll windows:4 windows x86 arch:x86

b4d8a96aa565383d7454ec9706f4fb25

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/07/2010, 00:00

Not After

08/08/2011, 23:59

Subject

CN=Shanda Computer (Shanghai) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shanda Computer (Shanghai) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:38:f8:75:d1:6a:c9:c4:f4:b6:2a:77:0d:57:cc:47:36:77:81:a2
Signer

Actual PE Digest

6d:38:f8:75:d1:6a:c9:c4:f4:b6:2a:77:0d:57:cc:47:36:77:81:a2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpynA
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetDiskFreeSpaceExA
CreateThread
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
WaitForMultipleObjects
SetFileAttributesA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
GetModuleFileNameA
GetEnvironmentVariableA
GetTickCount
lstrcmpiA
WaitForSingleObject
FindNextFileA
RemoveDirectoryA
FindClose
FindFirstFileA
lstrlenA
ResumeThread
SetThreadPriority
Sleep
MultiByteToWideChar
RaiseException
FreeLibrary
GetProcAddress
LoadLibraryA
GetLocalTime
FlushFileBuffers
WriteFile
ReadFile
SetFilePointer
OutputDebugStringA
CreateFileA
lstrcpyA
GetFileSize
CreateDirectoryA
GetFileAttributesExA
GetCurrentProcess
Process32Next
OpenProcess
GetLongPathNameA
Module32First
Process32First
CreateToolhelp32Snapshot
Module32Next
TerminateProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
SetEvent
SystemTimeToFileTime
ResetEvent
CreateEventA
MoveFileA
SetEndOfFile
SetFileTime
GetFullPathNameA
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
lstrcatA
GetShortPathNameA
MoveFileExA
CreateProcessA
SetEnvironmentVariableA
SetStdHandle
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
CopyFileA
WritePrivateProfileStringA
DeleteFileA
GetPrivateProfileStringA
InterlockedExchange
GetPrivateProfileIntA
WideCharToMultiByte
FindResourceExA
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetFileAttributesA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
IsBadWritePtr
VirtualFree
HeapCreate
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetCPInfo
GetOEMCP
LCMapStringW
LCMapStringA
GetCommandLineA
GetCurrentThreadId
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
RtlUnwind
ExitProcess
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy

user32

EnumChildWindows
PostMessageA
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId
EnumWindows
SendMessageTimeoutA
KillTimer
SetTimer

advapi32

RegDeleteValueA
RegCreateKeyExA
GetTokenInformation
LookupAccountSidA
DuplicateTokenEx
ImpersonateLoggedOnUser
CreateProcessAsUserA
RevertToSelf
OpenProcessToken
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

SHGetSpecialFolderPathA

ole32

CoInitializeEx
OleUninitialize
OleInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysAllocStringLen
SysFreeString
SysStringLen
SysAllocString

shlwapi

PathFileExistsA
PathFindExtensionA
PathGetDriveNumberA

wininet

HttpOpenRequestA
InternetOpenUrlA
InternetReadFileExA
InternetOpenA
InternetSetOptionA
HttpQueryInfoA
InternetConnectA
InternetSetStatusCallback
InternetCloseHandle
InternetCrackUrlA
InternetCanonicalizeUrlA
HttpSendRequestA

wsock32

socket
ioctlsocket
setsockopt
htons
inet_addr
bind
WSAStartup
WSACleanup
closesocket
sendto
recvfrom
WSASetLastError

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Exports

Exports

CreateUpdateSession
InitLog
SDDnsQuery
SDDownloadFile

Sections

.text
Size: 280KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ET2.0/server.dat

Sharing

General

Malware Config

Signatures

Files

40b764df47ff7fd5581abe75efec414e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:daCertificate

Extended Key Usages

Key Usages

fb:f2:3b:e0:e2:b6:5b:3f:31:8b:72:13:36:00:fc:5c:8e:0a:ed:efSigner

Headers

File Characteristics

PDB Paths

Imports

user32

kernel32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 9KB

sharedat Size: 4KB - Virtual size: 276B

.rsrc Size: 16KB - Virtual size: 14KB

.reloc Size: 8KB - Virtual size: 4KB

1aa0c6e7cc026ce293af4581be7ba111

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:daCertificate

Extended Key Usages

Key Usages

4c:a1:cf:fd:96:50:80:b0:0e:6e:8c:62:8a:c2:69:dd:6b:1b:07:fcSigner

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

msimg32

gdi32

version

eztalkcore

ole32

comctl32

urlmon

shell32

winmm

netapi32

msvcrt

netspeedplatform

oleacc

ws2_32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.itext Size: 6KB - Virtual size: 5KB

.data Size: 42KB - Virtual size: 41KB

.bss Size: - Virtual size: 22KB

.idata Size: 16KB - Virtual size: 15KB

.didata Size: 1024B - Virtual size: 806B

.tls Size: - Virtual size: 60B

.rdata Size: 512B - Virtual size: 24B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

fb:f2:3b:e0:e2:b6:5b:3f:31:8b:72:13:36:00:fc:5c:8e:0a:ed:ef
Signer

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 9KB

sharedat
Size: 4KB - Virtual size: 276B

.rsrc
Size: 16KB - Virtual size: 14KB

.reloc
Size: 8KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

4c:a1:cf:fd:96:50:80:b0:0e:6e:8c:62:8a:c2:69:dd:6b:1b:07:fc
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.itext
Size: 6KB - Virtual size: 5KB

.data
Size: 42KB - Virtual size: 41KB

.bss
Size: - Virtual size: 22KB

.idata
Size: 16KB - Virtual size: 15KB

.didata
Size: 1024B - Virtual size: 806B

.tls
Size: - Virtual size: 60B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 135KB - Virtual size: 134KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

74:f4:11:de:7a:2b:fe:51:83:21:16:71:fb:0b:74:f2:ef:4d:46:99
Signer

.text
Size: 200KB - Virtual size: 197KB

.rdata
Size: 76KB - Virtual size: 73KB

.data
Size: 8KB - Virtual size: 115KB

.rsrc
Size: 16KB - Virtual size: 14KB

.reloc
Size: 12KB - Virtual size: 9KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate

f2:14:db:6b:c2:b0:e3:b2:91:1f:7a:08:05:a9:28:6c:cd:e6:30:85
Signer

CODE
Size: 109KB - Virtual size: 109KB

DATA
Size: 4KB - Virtual size: 3KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 3KB

.edata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 840B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

69:cb:0e:69:cc:53:6d:14:c6:43:23:79:28:38:75:da
Certificate