d9f531f8b18a9914f632731af788d2c0_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

d9f531f8b18a9914f632731af788d2c0_JaffaCakes118
Size

3.8MB
MD5

d9f531f8b18a9914f632731af788d2c0
SHA1

a119423de58ba2383c77a4648d9a42e6c41b41bf
SHA256

863616af2c73be2bb2ea1251dab017b057b1be8984d05e95258abaaa72511db1
SHA512

e1db2d6b1f2c7b2eae38a545b917d6eb45cb2e7a75f2fc5e8f404eef2dbcdfe9c56e4add900969d2edfda7e25fa54230a91120883e826adda760f1b8a528c860
SSDEEP

98304:cSK14RnstEyOzvTM5W7gelE6eXgNjpLXE6BNexRJSu5xY5lEV:cf2iOzvTeW7ge+6eXgNlLXELRJSW6EV

Score

3^/10

Malware Config

Signatures

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
d9f531f8b18a9914f632731af788d2c0_JaffaCakes118
unpack001/$PLUGINSDIR/FileInfo.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Uninstall.exe
unpack005/$PLUGINSDIR/InstallOptions.dll
unpack005/$PLUGINSDIR/KillProcDLL.dll
unpack005/$PLUGINSDIR/System.dll
unpack001/msvcr80.dll

Files

d9f531f8b18a9914f632731af788d2c0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/CoralExplorer/FavIcon/1860F34853BBC50F66BF81B679989830.ico
$APPDATA/CoralExplorer/FavIcon/3D6A8AC8F2013B0D7A1EA53076E96320.ico
$APPDATA/CoralExplorer/FavIcon/6E086A7049DD129DF69051413AC6AB3A.ico
$APPDATA/CoralExplorer/FavIcon/81C6AF03AC3E2B181DD99A3C1AFD1AA3.ico
$APPDATA/CoralExplorer/FavIcon/85131C29C8F7B398A345BD7F1A51DAB1.ico
$APPDATA/CoralExplorer/FavIcon/8FDEAD446A8D607C20207D38D669E349.ico
$APPDATA/CoralExplorer/FavIcon/A4C4A052651124668E8F829A3AA6D63C.ico
$APPDATA/CoralExplorer/FavIcon/F2A7BED2A1035F9E4EC022B3ECA481A8.ico
$APPDATA/CoralExplorer/FavIcon/default_page.ico
$APPDATA/CoralExplorer/FavIcon/home.ico
$APPDATA/CoralExplorer/Users/Default/SystemUrl.data
$PLUGINSDIR/FileInfo.dll
.dll windows:4 windows x86 arch:x86

f6e384a477f8efc14029bba8fca9bd0f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\program files\nsis\nsis-2.42.6-unicode-src\plugins\FileInfo.pdb

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

SetLastError
lstrcpynW
GlobalFree
lstrcpyW
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
LCMapStringA
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
WriteFile
InitializeCriticalSection
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
GetStringTypeW

user32

wsprintfW

Exports

Exports

GetSpecialBuild

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

cc7109b9c3b24bf2e4cc2be1f2650012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExW
GlobalFree
lstrcpyW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
LCMapStringW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteFile
InitializeCriticalSection
RtlUnwind
HeapSize

Exports

Exports

KillProc

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:5 windows x86 arch:x86

45d25ca52c312b2254c60dbcb30342d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynW
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 753B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
2345浏览器免责声明.txt
Config/FavIcon/1860F34853BBC50F66BF81B679989830.ico
Config/FavIcon/3D6A8AC8F2013B0D7A1EA53076E96320.ico
Config/FavIcon/6E086A7049DD129DF69051413AC6AB3A.ico
Config/FavIcon/81C6AF03AC3E2B181DD99A3C1AFD1AA3.ico
Config/FavIcon/85131C29C8F7B398A345BD7F1A51DAB1.ico
Config/FavIcon/8FDEAD446A8D607C20207D38D669E349.ico
Config/FavIcon/A4C4A052651124668E8F829A3AA6D63C.ico
Config/FavIcon/F2A7BED2A1035F9E4EC022B3ECA481A8.ico
Config/FavIcon/default_page.ico
Config/FavIcon/home.ico
Config/Users/Default/SystemUrl.data
Coral.dll
.dll windows:4 windows x86 arch:x86

690d1b0efd5a7640f56cf464996d8103

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:a0:7b:db:e3:25:9f:fb:84:3e:4d:e2:39:3d:60:b8:e0:d3:55:86
Signer

Actual PE Digest

0e:a0:7b:db:e3:25:9f:fb:84:3e:4d:e2:39:3d:60:b8:e0:d3:55:86

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\Code2\coral\branches\CoralExplorer_v1.2.4386\build_temp\Win32\Release\CoralCore\Coral.pdb

Imports

kernel32

GetFileSize
InterlockedExchangeAdd
GetFileAttributesW
ResumeThread
ReleaseMutex
CreateMutexW
GetACP
WideCharToMultiByte
DeleteFileW
CreateDirectoryW
RemoveDirectoryW
GetTempPathW
GetTempFileNameW
GetWindowsDirectoryW
GetLongPathNameW
SetFileAttributesW
GetFullPathNameW
FindClose
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
DisconnectNamedPipe
ConnectNamedPipe
WaitForMultipleObjects
CopyFileW
ReadFile
PeekNamedPipe
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
LoadLibraryW
GlobalLock
GlobalUnlock
GetVersionExW
GetTickCount
GlobalFree
GlobalAlloc
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
InterlockedExchange
HeapFree
GetProcessHeap
HeapAlloc
CreateFileW
TerminateThread
WriteFile
OpenThread
CloseHandle
OpenProcess
WaitForSingleObject
CreateProcessW
GetCurrentProcess
GetCurrentProcessId
LoadLibraryExW
GetLastError
GetModuleFileNameW
LeaveCriticalSection
lstrlenW
FindResourceW
GetCurrentThreadId
InterlockedDecrement
EnterCriticalSection
RaiseException
MultiByteToWideChar
GetProcAddress
Sleep
GetPrivateProfileStringW
ResetEvent
CreateEventW
GetUserDefaultLangID
SetEvent
lstrcmpiW
LoadResource
DeleteCriticalSection
GetModuleHandleW
SizeofResource
FreeLibrary
InitializeCriticalSection
DisableThreadLibraryCalls
InterlockedIncrement
CreateNamedPipeW

user32

SetForegroundWindow
GetWindowThreadProcessId
IsWindow
CharNextW
UnregisterClassA
SetClipboardData
GetClipboardData
CloseClipboard
RegisterClipboardFormatW
LoadStringW
DestroyWindow
MessageBoxW
OpenClipboard
SetWindowPos
SendMessageTimeoutW
PostMessageW
SetFocus
InvalidateRect
GetWindowRect
SystemParametersInfoW
AllowSetForegroundWindow
SendMessageW
GetActiveWindow

advapi32

SetSecurityDescriptorDacl
RegSetKeySecurity
RegOpenKeyExW
RegDeleteKeyW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegQueryInfoKeyW
InitializeAcl
AddAce
GetSidSubAuthorityCount
RegGetKeySecurity
GetSidSubAuthority
GetLengthSid
GetTokenInformation
CopySid
InitializeSecurityDescriptor
OpenProcessToken
FreeSid
GetSidIdentifierAuthority
RegEnumKeyW
RegQueryValueExW
AllocateAndInitializeSid

shell32

ShellExecuteExW
ShellExecuteW
SHChangeNotify
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHFileOperationW

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
StringFromGUID2
CoUninitialize
CoTaskMemAlloc
OleInitialize
OleUninitialize
CoCreateGuid

oleaut32

VarUI4FromStr

shlwapi

SHDeleteKeyW

msvcr80

memchr
strstr
toupper
strchr
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
memset
__CxxFrameHandler3
_CxxThrowException
memcpy
tolower
_splitpath_s
_stricmp
_beginthreadex
wcsstr
??3@YAXPAX@Z
memcpy_s
wcsncpy_s
free
??2@YAPAXI@Z
??_V@YAXPAX@Z
_recalloc
malloc
_purecall
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
memmove_s
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
_wcsdup
isalnum
ldiv
_swprintf
wcschr
towupper
_vsnwprintf_s
towlower
_errno

urlmon

IsValidURL
URLDownloadToFileW

wininet

DeleteUrlCacheEntryW
InternetSetOptionA
InternetSetOptionW
FindNextUrlCacheEntryW
InternetOpenA
InternetQueryOptionW
InternetCrackUrlW
GetUrlCacheEntryInfoW
FindCloseUrlCache
FindFirstUrlCacheEntryW
InternetCloseHandle

dnsapi

DnsQuery_W
DnsRecordListFree

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Exports

Exports

CoralCreateObject

Sections

.text
Size: 495KB - Virtual size: 494KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Coral.exe
.exe windows:4 windows x86 arch:x86

d822f3a651c14853f1d1287d99641a21

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:d2:62:1b:59:bb:fa:03:d6:55:41:8d:47:5f:1a:61:04:7a:66:64
Signer

Actual PE Digest

79:d2:62:1b:59:bb:fa:03:d6:55:41:8d:47:5f:1a:61:04:7a:66:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\Code2\coral\branches\CoralExplorer_v1.2.4386\build_temp\Win32\Release\Coral\Coral.pdb

Imports

kernel32

FreeLibrary
LoadLibraryW
GetModuleFileNameW
GetProcAddress
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CoralApp.dll
.dll windows:4 windows x86 arch:x86

4825620788c5738ef06afad84b437ca0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:8b:21:46:cf:e6:a0:d2:06:aa:a9:a3:5a:f1:95:be:a6:1a:1d:b0
Signer

Actual PE Digest

2a:8b:21:46:cf:e6:a0:d2:06:aa:a9:a3:5a:f1:95:be:a6:1a:1d:b0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\Code2\coral\branches\CoralExplorer_v1.2.4386\build_temp\Win32\Release\CoralApp\CoralApp.pdb

Imports

kernel32

GetCurrentProcessId
Sleep
InterlockedExchangeAdd
ResumeThread
GetACP
WideCharToMultiByte
GetFileAttributesW
ResetEvent
CreateEventW
SetEvent
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
FindFirstFileW
FindClose
FindNextFileW
GetVersionExW
LoadLibraryW
OpenProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
SizeofResource
InitializeCriticalSection
GetModuleFileNameA
GetProcAddress
CreateDirectoryA
WriteProcessMemory
TerminateThread
OpenThread
TerminateProcess
GetModuleHandleW
LoadResource
DisableThreadLibraryCalls
FreeLibrary
GetLastError
GetModuleFileNameW
InterlockedIncrement
GetCurrentThreadId
FindResourceW
lstrlenW
LoadLibraryExW
LeaveCriticalSection
RaiseException
EnterCriticalSection
DeleteCriticalSection
lstrcmpiW
MultiByteToWideChar
GetCurrentProcess
CloseHandle
InterlockedDecrement
InterlockedExchange
GetFullPathNameW

user32

GetActiveWindow
DestroyWindow
CharNextW
UnregisterClassA
FindWindowExA
GetDlgItem
GetWindowThreadProcessId
GetClassNameA
MessageBoxW

advapi32

RegSetValueExW
RegQueryValueExA
RegCreateKeyA
RegOpenKeyExA
RegCreateKeyExA
RegOpenKeyW
RegCreateKeyW
RegOpenKeyA
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegDeleteValueW

shell32

SHGetFolderPathW
SHGetFolderPathA
SHFileOperationW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW

ole32

CoTaskMemFree
CoTaskMemAlloc
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemRealloc

oleaut32

VarUI4FromStr

msvcr80

_splitpath_s
_wcsicmp
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
??3@YAXPAX@Z
free
memmove_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
malloc
??0exception@std@@QAE@ABV01@@Z
wcsncpy_s
_recalloc
??_V@YAXPAX@Z
memcpy_s
??2@YAPAXI@Z
_purecall
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
strrchr
wcsncpy
strncpy
_vsnwprintf_s
towlower
_errno
wcschr
towupper
_beginthreadex
_stricmp
memcpy
_CxxThrowException
__CxxFrameHandler3
memset
_unlock

gdiplus

GdiplusShutdown
GdiplusStartup

imagehlp

ImageDirectoryEntryToDataEx

psapi

EnumProcessModules

Exports

Exports

LoadCoralApp

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralDb.dll
.dll windows:4 windows x86 arch:x86

22d6e87b37d846db434bf80610d7cf9a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:d9:04:6a:cf:c5:89:1d:65:4b:b3:1e:43:c1:53:db:63:40:16:38
Signer

Actual PE Digest

5b:d9:04:6a:cf:c5:89:1d:65:4b:b3:1e:43:c1:53:db:63:40:16:38

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\Code2\coral\branches\CoralExplorer_v1.2.4386\build_temp\Win32\Release\CoralDb\CoralDb.pdb

Imports

kernel32

GetFileAttributesW
CopyFileW
DeleteFileW
CreateDirectoryW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
FindFirstFileW
FindClose
FindNextFileW
GetProcAddress
GetModuleFileNameW
LoadLibraryW
FreeLibrary
GetTempPathW
GetTempFileNameW
MoveFileExW
GetWindowsDirectoryW
GetLongPathNameW
SetFileAttributesW
MoveFileW
lstrlenW
GetFullPathNameW
GetVersionExW
OpenProcess
WaitForSingleObject
FormatMessageW
SetEndOfFile
FlushFileBuffers
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
GetFullPathNameA
CreateFileMappingW
CreateFileA
GetDiskFreeSpaceA
GetSystemInfo
MapViewOfFile
UnmapViewOfFile
GetFileAttributesExW
QueryPerformanceCounter
GetCurrentProcessId
GetTempPathA
UnlockFile
LocalFree
GetSystemTime
LockFile
AreFileApisANSI
GetTickCount
DeleteFileA
UnlockFileEx
GetSystemTimeAsFileTime
FormatMessageA
InterlockedCompareExchange
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
ReleaseMutex
CreateMutexW
GetLastError
WriteFile
GetFileSize
Sleep
CloseHandle
CreateFileW
SetFilePointer
ReadFile
DisableThreadLibraryCalls
InterlockedExchangeAdd
GetSystemDefaultLangID
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedExchange
FindResourceW
GetModuleHandleW
GetFileAttributesA

user32

LoadStringW
DrawIconEx
GetDesktopWindow
GetDC
LoadImageW
ReleaseDC
DestroyIcon

gdi32

BitBlt
DeleteObject
CreateCompatibleDC
SelectObject
CreateSolidBrush
GetObjectW
DeleteDC

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

SHFileOperationW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CoTaskMemFree

msvcr80

?terminate@@YAXXZ
memcpy
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
??2@YAPAXI@Z
??3@YAXPAX@Z
?what@exception@std@@UBEPBDXZ
_purecall
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
memcpy_s
memmove_s
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
free
??_V@YAXPAX@Z
malloc
_errno
wcschr
towupper
towlower
_vsnwprintf_s
swprintf_s
memmove
_localtime64
_splitpath_s
_stricmp
realloc
strncmp
_localtime64_s
qsort
_CxxThrowException
__CxxFrameHandler3
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
memset
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook

shlwapi

StrCmpNIW

gdiplus

GdipGetImageEncodersSize
GdipAlloc
GdipFree
GdipSaveImageToFile
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdipDisposeImage

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wininet

InternetCrackUrlW

Exports

Exports

CoralCreateObject

Sections

.text
Size: 858KB - Virtual size: 858KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralDownload.dll
.dll windows:4 windows x86 arch:x86

98b5383d8a1bd7bc30db77f980648d79

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

dd:5a:5d:d6:7f:d0:39:13:c7:aa:f1:4b:95:54:8f:2e:43:e1:ea:58
Signer

Actual PE Digest

dd:5a:5d:d6:7f:d0:39:13:c7:aa:f1:4b:95:54:8f:2e:43:e1:ea:58

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\Code2\coral\branches\CoralExplorer_v1.2.4386\build_temp\Win32\Release\CoralDownload\CoralDownload.pdb

Imports

wininet

InternetCrackUrlW
FtpOpenFileW
InternetCloseHandle
InternetReadFile
FtpFindFirstFileW
FtpCommandW
InternetConnectW
InternetSetFilePointer
HttpEndRequestW
InternetOpenUrlW
InternetWriteFile
InternetSetOptionW
InternetQueryOptionW
InternetOpenW
HttpOpenRequestW
HttpSendRequestExW
HttpQueryInfoW

kernel32

TryEnterCriticalSection
GetFileAttributesW
DeleteFileW
CreateDirectoryW
CreateMutexW
WaitForSingleObject
ReleaseMutex
ResetEvent
CreateEventW
SetEvent
ResumeThread
GetFileSize
SetFilePointer
SetEndOfFile
GetProcAddress
LoadLibraryW
GetACP
FindFirstFileW
FindClose
GetLongPathNameW
SetFileAttributesW
MoveFileW
GetFullPathNameW
GetTempPathW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GlobalLock
GlobalUnlock
ExpandEnvironmentStringsW
QueryPerformanceFrequency
QueryPerformanceCounter
OpenProcess
GetVersionExW
InterlockedExchangeAdd
CloseHandle
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetThreadLocale
GetLocaleInfoA
VirtualAlloc
VirtualFree
EnterCriticalSection
GetCurrentThreadId
SetLastError
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
RaiseException
GetTickCount
Sleep
WaitForMultipleObjects
GetCurrentProcessId
lstrlenW
CompareStringW
lstrcmpiW
GetLastError
LoadLibraryExW
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
DisableThreadLibraryCalls
MultiByteToWideChar
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
FindResourceW
FreeLibrary
LoadResource
InterlockedDecrement
SizeofResource
GetModuleHandleW
GetModuleFileNameW
InterlockedExchange
SystemTimeToFileTime
CreateFileW
WriteFile

user32

SetMenuInfo
GetMenuState
GetSystemMetrics
CallNextHookEx
SetWindowsHookExW
ClientToScreen
InflateRect
CopyRect
GetWindowDC
SetRect
MenuItemFromPoint
MessageBoxW
GetMenuItemInfoW
GetMenuItemCount
IsMenu
UnhookWindowsHookEx
CloseClipboard
OpenClipboard
GetClipboardData
LoadStringW
RemovePropW
GetPropW
KillTimer
SetTimer
TrackPopupMenu
SetWindowTextW
SystemParametersInfoW
ReleaseDC
PtInRect
IsWindowEnabled
GetClientRect
DrawTextW
GetSysColor
CreateWindowExW
GetMonitorInfoW
CallWindowProcW
EndPaint
DestroyWindow
SetWindowPos
DestroyIcon
SetCapture
MoveWindow
DefWindowProcW
LoadCursorW
SetCursor
SetFocus
InvalidateRect
MapWindowPoints
GetFocus
SetPropW
MonitorFromPoint
UpdateWindow
GetWindowTextLengthW
ShowWindow
EnableWindow
LoadIconW
GetWindowLongW
AppendMenuW
ReleaseCapture
GetWindow
LoadImageW
GetDC
EndDialog
CharNextW
CreatePopupMenu
BeginPaint
GetCapture
GetDlgCtrlID
FillRect
GetWindowTextW
OffsetRect
GetCursorPos
PostMessageW
GetParent
DrawFocusRect
SetRectEmpty
GetDlgItem
ScreenToClient
SendMessageW
GetWindowRect
IsWindow
GetClassNameW
DialogBoxParamW
SetWindowLongW
UnregisterClassA

gdi32

MoveToEx
IntersectClipRect
BitBlt
SetViewportOrgEx
CreateCompatibleDC
CreateSolidBrush
GetCurrentObject
DeleteObject
GetStockObject
DeleteDC
GetObjectW
SetBkMode
SelectObject
SetTextColor
CreateFontIndirectW
ExtTextOutW
LineTo
GetBkMode
SetBkColor
CreatePen
CreateCompatibleBitmap
GetTextExtentPoint32W

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW

shell32

ShellExecuteW
SHGetSpecialFolderLocation
SHFileOperationW
SHGetPathFromIDListW
SHGetFileInfoW

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateGuid
StringFromGUID2

oleaut32

SysAllocStringLen
VarUI4FromStr
VarBstrCat
SysFreeString
SysStringLen

comctl32

ImageList_Remove
ImageList_Destroy
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_Draw
ImageList_Create

urlmon

CreateURLMonikerEx
RegisterBindStatusCallback
RevokeBindStatusCallback

msvcr80

_purecall
??3@YAXPAX@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
memcpy
memmove_s
memcpy_s
??_V@YAXPAX@Z
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
_wtoi
wcscpy_s
_recalloc
wcsncpy_s
free
malloc
_beginthreadex
wcschr
towupper
_vsnwprintf_s
_errno
_stricmp
_splitpath_s
_CxxThrowException
__CxxFrameHandler3
memset
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
__clean_type_info_names_internal
towlower
?_type_info_dtor_internal_method@type_info@@QAEXXZ

dnsapi

DnsQuery_W
DnsRecordListFree

Exports

Exports

CoralCreateObject

Sections

.text
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralRender.dll
.dll windows:4 windows x86 arch:x86

5d0a38f6d3616734377fabfa028193fa

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:55:70:11:19:10:4a:c8:bb:a8:e1:9b:a8:3c:a5:a7:27:b0:05:9e
Signer

Actual PE Digest

42:55:70:11:19:10:4a:c8:bb:a8:e1:9b:a8:3c:a5:a7:27:b0:05:9e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\Code2\coral\branches\CoralExplorer_v1.2.4386\build_temp\Win32\Release\CoralRender\CoralRender.pdb

Imports

wininet

InternetSetOptionA
InternetGetCookieA
InternetSetCookieExA
InternetSetCookieA
InternetSetOptionW
InternetCloseHandle
InternetQueryOptionW
InternetOpenA

kernel32

GetCurrentThreadId
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ResetEvent
GetLastError
CreateEventW
SetEvent
GetFileAttributesW
CreateDirectoryW
CreateFileW
SetFileAttributesW
GetFullPathNameW
RemoveDirectoryW
lstrlenW
DeleteFileW
FindFirstFileW
WaitForSingleObject
FindNextFileW
ResumeThread
GetProcAddress
LoadLibraryW
FreeLibrary
SetUnhandledExceptionFilter
WriteProcessMemory
WriteFile
ReadFile
PeekNamedPipe
SetNamedPipeHandleState
WaitNamedPipeW
GetModuleHandleW
GlobalFree
InterlockedIncrement
InterlockedDecrement
GetTickCount
GetModuleFileNameW
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
InterlockedExchangeAdd
TerminateProcess
GetCurrentProcess
Sleep
GetCurrentProcessId
OpenProcess
WaitForMultipleObjects
DisableThreadLibraryCalls
FindClose
WideCharToMultiByte
GetVersionExW

user32

FindWindowExA
PostThreadMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetMessageW
GetWindowThreadProcessId
GetDlgItem
GetClassNameA

advapi32

RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHFileOperationW

ole32

StringFromGUID2
CoTaskMemFree
CoCreateGuid

msvcr80

_except_handler4_common
__clean_type_info_names_internal
toupper
strchr
memset
memcpy
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
??0exception@std@@QAE@ABV01@@Z
memmove_s
memcpy_s
??_V@YAXPAX@Z
_invalid_parameter_noinfo
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
_beginthreadex
towlower
towupper
_vsnwprintf_s
_errno
wcschr
memchr
_vswprintf_c_l
_stricmp
_splitpath_s
tolower
_CxxThrowException
__CxxFrameHandler3
?terminate@@YAXXZ
_encode_pointer

urlmon

UrlMkSetSessionOption
UrlMkGetSessionOption

gdiplus

GdiplusStartup
GdiplusShutdown

winmm

midiStreamOut
waveOutWrite

Exports

Exports

CoralCreateObject

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralTrident.dll
.dll windows:4 windows x86 arch:x86

77a9cd537614c645fa235d0f65cd23ff

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0f:ca:1c:67:6b:10:c6:d6:f0:a6:d6:22:04:c6:63:f5:f7:6a:52:f2
Signer

Actual PE Digest

0f:ca:1c:67:6b:10:c6:d6:f0:a6:d6:22:04:c6:63:f5:f7:6a:52:f2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\Code2\coral\branches\CoralExplorer_v1.2.4386\build_temp\Win32\Release\CoralTrident\CoralTrident.pdb

Imports

kernel32

FindFirstFileW
FindClose
GetFullPathNameW
GlobalFree
LocalFree
LocalAlloc
GetUserDefaultLangID
GetCurrentProcessId
OpenProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
CreateMutexW
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
GetVersionExA
GetProcessHeap
HeapFree
ProcessIdToSessionId
GetFileAttributesW
WideCharToMultiByte
GetACP
ResumeThread
ResetEvent
SetEvent
CreateEventW
FreeResource
WaitForMultipleObjects
FindResourceExW
LockResource
GetVersionExW
lstrcpynA
GetSystemDefaultLangID
InterlockedExchangeAdd
MulDiv
GetProcAddress
GlobalAlloc
GlobalUnlock
GlobalLock
lstrcmpW
LoadLibraryW
TerminateThread
Sleep
CloseHandle
OpenThread
WaitForSingleObject
GetTickCount
FlushInstructionCache
GetCurrentProcess
LoadLibraryExW
SetLastError
InterlockedExchange
RaiseException
EnterCriticalSection
FreeLibrary
GetModuleFileNameW
LeaveCriticalSection
FindResourceW
GetCurrentThreadId
DisableThreadLibraryCalls
lstrlenW
InitializeCriticalSection
GetModuleHandleW
SizeofResource
InterlockedIncrement
MultiByteToWideChar
DeleteCriticalSection
InterlockedDecrement
LoadResource
GetLastError
lstrcmpiW

user32

ScreenToClient
GetCursorPos
GetWindowRect
CharUpperBuffW
CharNextW
DestroyWindow
UnregisterClassA
GetKeyState
MonitorFromPoint
EnableMenuItem
GetMonitorInfoW
CreateWindowExW
EndPaint
LoadIconW
SetWindowPos
FindWindowExW
MoveWindow
CreateAcceleratorTableW
GetSysColor
SetCapture
SetFocus
GetWindowLongW
RegisterWindowMessageW
GetFocus
SendMessageTimeoutW
ShowWindow
GetClientRect
InvalidateRect
GetTopWindow
AllowSetForegroundWindow
GetClassInfoExW
SetActiveWindow
LoadCursorW
GetDesktopWindow
RegisterClassExW
IsWindowVisible
RedrawWindow
ReleaseDC
GetSystemMetrics
GetClassNameW
SetClassLongW
IsWindowEnabled
FillRect
GetDlgItem
GetClassLongW
InvalidateRgn
EnableWindow
PostQuitMessage
GetWindow
WindowFromPoint
GetWindowTextW
DefWindowProcW
SendDlgItemMessageW
BeginPaint
ReleaseCapture
EndDialog
ClientToScreen
GetParent
GetKeyboardLayout
CallWindowProcW
GetWindowTextLengthW
GetDC
GetNextDlgGroupItem
GetWindowThreadProcessId
DestroyAcceleratorTable
IsChild
GetPropW
ActivateKeyboardLayout
IsRectEmpty
SystemParametersInfoW
SetRect
OffsetRect
DrawTextW
SetWindowsHookExW
MenuItemFromPoint
RemovePropW
CallNextHookEx
SetPropW
SetMenuInfo
UnhookWindowsHookEx
CopyRect
GetWindowDC
SetTimer
UpdateWindow
SetCursor
PtInRect
InflateRect
KillTimer
SetWindowLongW
TrackPopupMenu
GetMenuItemID
SetForegroundWindow
InsertMenuW
GetMenuItemInfoW
GetSubMenu
GetForegroundWindow
GetMenuState
DestroyMenu
GetMenuStringW
SetMenuItemInfoW
SendMessageW
IsWindow
GetMenuItemCount
LoadMenuW
IsMenu
DeleteMenu
PostMessageW
MessageBoxW
LoadStringW
DispatchMessageW
TranslateMessage
PeekMessageW
GetMessageW
SetWindowTextW

gdi32

CreatePen
MoveToEx
GetBkMode
IntersectClipRect
CreateDCW
CreateFontIndirectW
SetViewportOrgEx
GetCurrentObject
GetTextExtentPoint32W
SetBkColor
SetBkMode
LineTo
SetTextColor
ExtCreatePen
Polyline
StretchBlt
CreateDIBSection
DeleteDC
CreateCompatibleBitmap
GetObjectW
DeleteObject
GetStockObject
CreateCompatibleDC
GetDeviceCaps
SelectObject
BitBlt
ExtTextOutW
CreateSolidBrush

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueExW
GetUserNameW
RegQueryInfoKeyW

shell32

DragQueryFileW

ole32

CoTaskMemRealloc
CoCreateInstance
CoInitialize
CoUninitialize
ReleaseStgMedium
OleInitialize
StringFromGUID2
CoGetInterfaceAndReleaseStream
CLSIDFromString
CoGetClassObject
CoMarshalInterThreadInterfaceInStream
CreateStreamOnHGlobal
OleUninitialize
CLSIDFromProgID
OleLockRunning
StringFromCLSID
CoTaskMemFree
CoTaskMemAlloc

oleaut32

OleCreateFontIndirect
SysAllocString
VarUI4FromStr
SysFreeString
VariantInit
SysStringLen
VariantChangeType
VarBstrCmp
SysStringByteLen
SysAllocStringLen
DispCallFunc
SafeArrayGetUBound
SafeArrayUnaccessData
SafeArrayGetLBound
SafeArrayAccessData
LoadTypeLi
VariantClear
GetErrorInfo
LoadRegTypeLi

shlwapi

PathFindExtensionW

comctl32

ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Draw
ImageList_Create

msimg32

AlphaBlend

urlmon

CoInternetGetSession
CreateURLMonikerEx

msvcr80

_CIexp
_CIsqrt
strchr
strstr
toupper
_mktime64
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
memset
__CxxFrameHandler3
_CxxThrowException
tolower
isspace
_vswprintf_c_l
_splitpath_s
_stricmp
_CIacos
_time64
_errno
towlower
_vsnwprintf_s
towupper
wcschr
wcsstr
_wcsicmp
wcsspn
wcscspn
_resetstkoflw
wcscpy_s
swprintf_s
_beginthreadex
_purecall
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
memmove_s
??2@YAPAXI@Z
malloc
??_V@YAXPAX@Z
wcsncpy_s
memcpy
free
_recalloc
??3@YAXPAX@Z
memchr
memcpy_s

gdiplus

GdipCreateBitmapFromStream
GdipDeleteGraphics
GdipGetImageThumbnail
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdiplusShutdown
GdipGetImageEncoders
GdipDisposeImage
GdiplusStartup
GdipGetImageEncodersSize
GdipAlloc
GdipGraphicsClear
GdipSaveImageToFile
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipCreateHBITMAPFromBitmap
GdipFree

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wininet

GetUrlCacheEntryInfoW
DeleteUrlCacheEntryW
InternetCrackUrlW

dnsapi

DnsQuery_W
DnsRecordListFree

imm32

ImmGetContext
ImmNotifyIME
ImmReleaseContext

Exports

Exports

CoralCreateObject

Sections

.text
Size: 406KB - Virtual size: 405KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralUI.dll
.dll windows:4 windows x86 arch:x86

c38cac86e980376a7458458fcd9c9ebb

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e5:52:75:88:79:40:2f:6c:70:62:e1:b9:a1:e6:21:a4:93:3f:c6:e9
Signer

Actual PE Digest

e5:52:75:88:79:40:2f:6c:70:62:e1:b9:a1:e6:21:a4:93:3f:c6:e9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\Code2\coral\branches\CoralExplorer_v1.2.4386\build_temp\Win32\Release\CoralUI\CoralUI.pdb

Imports

gdiplus

GdipDisposeImage
GdipGetImageThumbnail
GdipGraphicsClear
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipGetImageGraphicsContext
GdipAlloc
GdipFree
GdipDrawImageRectI

kernel32

FileTimeToSystemTime
GetLongPathNameW
SetFileAttributesW
GetFullPathNameW
GetTempPathW
GetTempFileNameW
GetWindowsDirectoryW
LocalAlloc
LocalFree
GlobalFree
OpenProcess
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
ProcessIdToSessionId
GetLogicalDriveStringsW
FindNextFileW
FindClose
FindFirstFileW
SetFilePointer
CreateFileW
ReadFile
GetFileSize
WriteFile
IsDebuggerPresent
SetUnhandledExceptionFilter
FormatMessageW
ReleaseMutex
CreateMutexW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
DisableThreadLibraryCalls
lstrcmpiW
FindResourceW
RaiseException
InitializeCriticalSection
LoadLibraryExW
InterlockedDecrement
FreeLibrary
EnterCriticalSection
InterlockedIncrement
LoadResource
GetModuleHandleW
GetModuleFileNameW
SizeofResource
LeaveCriticalSection
MultiByteToWideChar
DeleteCriticalSection
lstrlenW
GetLastError
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
SetLastError
Sleep
lstrcmpW
MulDiv
GlobalUnlock
GlobalAlloc
GetCurrentProcessId
GlobalLock
CompareStringW
GetVersionExW
GetTickCount
InterlockedExchange
GetProcAddress
LoadLibraryW
InterlockedExchangeAdd
LockResource
FreeResource
SwitchToThread
UnhandledExceptionFilter
CreateEventW
WaitForSingleObject
SetEvent
CloseHandle
ResetEvent
ResumeThread
GetFileAttributesW
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetSystemTimeAsFileTime
WideCharToMultiByte
GetACP
DeleteFileW
RemoveDirectoryW
CreateDirectoryW
InterlockedCompareExchange
TerminateProcess
QueryPerformanceCounter

user32

DrawMenuBar
GetMenu
DrawEdge
SetMenuInfo
GetMenuStringW
ModifyMenuW
GetMenuState
DeleteMenu
SetPropW
SetTimer
RemovePropW
KillTimer
GetPropW
IsDialogMessageW
SetMenuItemInfoW
FrameRect
DrawIconEx
GetWindowDC
HideCaret
GetSysColorBrush
GetDoubleClickTime
GetCaretPos
SetForegroundWindow
DrawFocusRect
GetForegroundWindow
CopyRect
SetWindowRgn
SendMessageTimeoutW
GetSystemMenu
GetMenuItemInfoW
MenuItemFromPoint
EnableMenuItem
GetMenuItemCount
GetDlgCtrlID
GetWindowPlacement
DestroyMenu
SetRectEmpty
GetLastActivePopup
TranslateAcceleratorW
GetMessagePos
SetMenu
IsRectEmpty
SetRect
GetMenuItemID
GetClassInfoW
IsClipboardFormatAvailable
OpenClipboard
CloseClipboard
GetClipboardData
SetCaretPos
IsIconic
GetMonitorInfoW
MonitorFromPoint
GetKeyState
GetWindowRect
MapWindowPoints
IsHungAppWindow
WindowFromPoint
AllowSetForegroundWindow
SetCursor
CheckMenuItem
OffsetRect
ShowWindow
UpdateWindow
PostQuitMessage
DrawTextW
LoadStringA
GetKeyNameTextW
GetSubMenu
IsMenu
SetWindowPlacement
SetClassLongW
GetClassLongW
EnableWindow
RegisterClipboardFormatW
SetClipboardData
CallNextHookEx
InflateRect
SetWindowsHookExW
UnhookWindowsHookEx
FindWindowW
CreatePopupMenu
MessageBeep
TrackPopupMenuEx
GetMenuItemRect
SystemParametersInfoW
keybd_event
AttachThreadInput
MonitorFromWindow
TrackPopupMenu
PtInRect
AppendMenuW
RemoveMenu
DialogBoxParamW
GetCapture
MapVirtualKeyW
IsWindowEnabled
BringWindowToTop
SetActiveWindow
GetActiveWindow
ClientToScreen
GetSysColor
InvalidateRgn
ReleaseCapture
IsWindow
GetWindow
GetWindowTextLengthW
GetMessageW
GetFocus
InvalidateRect
SetWindowTextW
DispatchMessageW
DestroyAcceleratorTable
LoadStringW
GetClientRect
BeginPaint
RegisterWindowMessageW
GetDC
GetWindowTextW
TranslateMessage
CreateAcceleratorTableW
GetClassNameW
IsChild
LoadMenuW
PostThreadMessageW
ReleaseDC
GetDlgItem
SetFocus
LoadAcceleratorsW
SendMessageW
SetCapture
GetParent
ScreenToClient
EndPaint
MoveWindow
DestroyWindow
RedrawWindow
GetDesktopWindow
PeekMessageW
FillRect
RegisterClassExW
PostMessageW
CallWindowProcW
DefWindowProcW
SetWindowPos
GetClassInfoExW
SetWindowLongW
CharLowerBuffW
GetKeyboardLayout
MapVirtualKeyExW
LoadCursorW
GetWindowLongW
GetSystemMetrics
IsWindowVisible
GetCursorPos
CreateWindowExW
DestroyIcon
LoadIconW
LoadImageW
CharNextW
UnregisterClassA
MessageBoxW
GetWindowThreadProcessId
CreateDialogParamW
EndDialog

gdi32

SetTextAlign
StretchBlt
GetDIBits
CreateDIBSection
GetBkColor
GetTextColor
CreateRectRgn
CombineRgn
GetTextExtentPoint32W
OffsetWindowOrgEx
MoveToEx
IntersectClipRect
GetCurrentObject
GetBkMode
LineTo
SelectClipRgn
SetDIBits
PatBlt
CreateRectRgnIndirect
TextOutW
GetTextMetricsW
CreatePen
SetViewportOrgEx
ExtTextOutW
SetTextColor
SetBkColor
SetBkMode
CreateFontIndirectW
CreatePolygonRgn
SelectObject
BitBlt
CreatePatternBrush
CreateBitmap
CreateDCW
CreateCompatibleBitmap
GetDeviceCaps
DeleteObject
GetObjectW
CreateCompatibleDC
DeleteDC
CreateSolidBrush
SetWindowOrgEx
GetStockObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegCloseKey
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
GetUserNameW
RegQueryInfoKeyW

shell32

SHGetMalloc
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHFileOperationW
ShellExecuteW
ShellExecuteExW
SHGetFileInfoW
SHBrowseForFolderW

ole32

StringFromGUID2
CLSIDFromProgID
OleUninitialize
OleLockRunning
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
OleInitialize
CoGetClassObject
CreateStreamOnHGlobal
OleDuplicateData
ReleaseStgMedium
DoDragDrop
RegisterDragDrop
RevokeDragDrop
CoInitialize
CoUninitialize
CLSIDFromString

oleaut32

VariantInit
LoadRegTypeLi
LoadTypeLi
SysAllocString
SysAllocStringLen
SysStringByteLen
SysStringLen
OleCreateFontIndirect
VariantClear
VarUI4FromStr
SysFreeString

msvcr80

??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
??_V@YAXPAX@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
memcpy_s
free
malloc
_recalloc
wcsncpy_s
memmove_s
??0exception@std@@QAE@XZ
swprintf_s
vswprintf_s
wcscpy_s
_wtoi
strncpy_s
__RTDynamicCast
wcsstr
wcschr
towupper
_vsnwprintf_s
towlower
_errno
_beginthreadex
_time64
memcpy
_mktime64
_localtime64
memmove
memchr
_stricmp
_splitpath_s
_CxxThrowException
__CxxFrameHandler3
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_invalid_parameter_noinfo
memset
_decode_pointer

comctl32

ImageList_SetBkColor
_TrackMouseEvent
InitCommonControlsEx
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon
ImageList_LoadImageW
ImageList_GetIcon
ImageList_Draw
ImageList_GetImageCount

msimg32

AlphaBlend
GradientFill

winmm

timeKillEvent
timeSetEvent

imm32

ImmAssociateContext
ImmNotifyIME
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wininet

InternetReadFile
InternetCloseHandle
InternetOpenW
InternetSetOptionA
InternetOpenA
InternetQueryOptionW
InternetCrackUrlW
InternetOpenUrlW

dnsapi

DnsRecordListFree
DnsQuery_W

Exports

Exports

CoralCreateObject

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralUI2.dll
.dll windows:4 windows x86 arch:x86

2e6fe2fe20e4104b9b6fb3b99042f053

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:3e:1c:e0:02:32:3d:75:65:43:27:a5:84:b7:33:46:ab:f6:56:4d
Signer

Actual PE Digest

10:3e:1c:e0:02:32:3d:75:65:43:27:a5:84:b7:33:46:ab:f6:56:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\Code2\coral\branches\DirectUI\SVNServer\DirectUI\Build\CoralUI2.pdb

Imports

kernel32

GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
Sleep
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FlushInstructionCache
SetLastError
GetCurrentThreadId
GetVersionExA
FileTimeToSystemTime
GetFileInformationByHandle
GetFileSize
FileTimeToDosDateTime
GetLocalTime
EnterCriticalSection
GetFileType
ReadFile
SetFilePointer
SystemTimeToFileTime
LoadLibraryA
LockResource
FreeResource
CopyFileW
DeleteFileW
SetProcessWorkingSetSize
GetCurrentProcess
CreateEventW
GetTickCount
lstrlenA
GetTempPathW
GetCurrentDirectoryW
WideCharToMultiByte
UnmapViewOfFile
LoadLibraryExW
RaiseException
DisableThreadLibraryCalls
SizeofResource
lstrcmpiW
LoadResource
GetLastError
GetModuleHandleW
FindResourceW
MultiByteToWideChar
InterlockedIncrement
FreeLibrary
IsBadReadPtr
LoadLibraryW
GetVersionExW
DeleteCriticalSection
InitializeCriticalSection
GetProcAddress
GlobalUnlock
CreateFileW
CloseHandle
GlobalLock
WriteFile
GlobalAlloc
GlobalFree
InterlockedDecrement
lstrlenW
GetModuleFileNameW
LeaveCriticalSection
InterlockedExchange

user32

DrawIconEx
ReleaseDC
GetDC
LoadCursorW
GetIconInfo
CopyRect
IsRectEmpty
UnregisterClassA
SetCursor
IsWindow
SetParent
GetDlgItem
MessageBoxW
GetCapture
CloseWindow
SetWindowTextW
RedrawWindow
KillTimer
SetWindowPos
GetWindowTextW
GetParent
MoveWindow
SetTimer
GetDlgCtrlID
GetActiveWindow
CharNextW
GetWindow
SendMessageW
SetActiveWindow
IsWindowEnabled
BringWindowToTop
LockWindowUpdate
GetWindowLongW
SetCapture
InvalidateRect
CreateWindowExW
IsZoomed
GetSystemMenu
PostMessageW
SetFocus
EnableWindow
UpdateWindow
SetWindowLongW
ShowWindow
DestroyWindow
GetWindowRect
GetWindowTextLengthW
IsWindowVisible
GetClientRect
RemovePropW
SetPropW
SetRectEmpty
GetPropW
GetDesktopWindow
SetWindowRgn
OffsetRect
GetCursorPos
ScreenToClient
EqualRect
GetSystemMetrics
DefWindowProcW
GetTopWindow
BeginDeferWindowPos
MonitorFromWindow
UpdateLayeredWindow
GetMonitorInfoW
DestroyCursor
ReleaseCapture
PtInRect
SystemParametersInfoW
ClientToScreen
BeginPaint
EndDeferWindowPos
InflateRect
GetKeyState
IntersectRect
EnableMenuItem
EndPaint
GetSysColor
UnionRect
DrawTextW
GetClassLongW
InsertMenuW
GetMenuItemID
CreatePopupMenu
DestroyMenu
AppendMenuW
GetMenuStringW
GetSubMenu
GetMenuItemCount
SetRect
ModifyMenuW
IsMenu
DeleteMenu
GetMenuItemInfoW
CallWindowProcW
GetAsyncKeyState
LoadStringW
DrawFrameControl
SetWindowsHookExW
TrackPopupMenuEx
CallNextHookEx
UnhookWindowsHookEx
RemoveMenu
MonitorFromPoint
GetForegroundWindow
LoadMenuW
DeferWindowPos
GetWindowDC
GetMessagePos
TrackPopupMenu
GetDoubleClickTime
EndDialog
GetFocus
DialogBoxParamW
FillRect
DestroyIcon
LoadImageW
WindowFromPoint
IsIconic
GetClassNameW

gdi32

CreateRectRgnIndirect
SetRectRgn
OffsetRgn
SelectClipRgn
SetViewportOrgEx
CreateBitmap
PatBlt
EndPath
ExtCreateRegion
LineTo
SetBkMode
GetRegionData
SetTextColor
PolyDraw
GetViewportOrgEx
MoveToEx
GetWindowOrgEx
CreatePen
WidenPath
PolyBezierTo
BeginPath
GetPath
CreateFontIndirectW
CreatePatternBrush
CreateSolidBrush
CreateICW
SetBkColor
SetDIBits
GetCurrentObject
SaveDC
SetROP2
RestoreDC
IntersectClipRect
SetWindowOrgEx
Rectangle
CreateRectRgn
GetClipBox
CreateCompatibleBitmap
PtInRegion
CombineRgn
CreateDIBSection
CreateCompatibleDC
DeleteObject
SelectPalette
BitBlt
GetObjectW
DeleteDC
GetStockObject
GetDIBits
GetDeviceCaps
SelectObject
CreateDCW
FillPath
ExtTextOutW
RealizePalette

advapi32

RegQueryInfoKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW

shell32

ShellExecuteW

ole32

CoCreateGuid
CoFreeUnusedLibraries
CreateStreamOnHGlobal
StringFromGUID2
CoUninitialize
CoInitialize
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromString

oleaut32

SafeArrayCreate
VariantChangeType
LoadTypeLi
SysStringLen
VariantClear
VariantInit
VarBstrCmp
VarUI4FromStr
SysAllocStringLen
VariantCopy
SysStringByteLen
VarBstrCat
SysAllocStringByteLen
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
OleTranslateColor
SysFreeString
LoadRegTypeLi

comctl32

_TrackMouseEvent
ImageList_GetImageCount
ImageList_GetImageInfo
ImageList_GetIcon
ImageList_LoadImageW
ImageList_Destroy

msimg32

AlphaBlend

gdiplus

GdipCloneBitmapAreaI
GdipFillPieI
GdipCreateTexture
GdipCreateHICONFromBitmap
GdipDrawImageI
GdipSetStringFormatHotkeyPrefix
GdipGetImageHeight
GdipGetStringFormatFlags
GdipGetImageGraphicsContext
GdipSetCompositingQuality
GdipCreateBitmapFromStream
GdipSetStringFormatFlags
GdipCreateFontFromLogfontW
GdipCreateHBITMAPFromBitmap
GdipSetStringFormatLineAlign
GdipCreateBitmapFromScan0
GdipSetSmoothingMode
GdipMeasureString
GdipBitmapUnlockBits
GdipDeleteFont
GdipBitmapLockBits
GdipDrawString
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipCreateBitmapFromFile
GdipSetTextRenderingHint
GdipGetImageWidth
GdipSetInterpolationMode
GdipSetStringFormatTrimming
GdipCreateStringFormat
GdipCreateLineBrushFromRectWithAngleI
GdipDisposeImage
GdipDrawImageRectI
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipDeleteBrush
GdipDeleteGraphics
GdipCreateSolidFill
GdipFillRectangleI
GdipCloneBrush
GdipAlloc
GdipFree
GdipCreateFromHDC

msvcr80

_stricmp
strcpy_s
fread
strcat_s
_wfopen_s
fwrite
ftell
wcscpy_s
wcsncpy_s
malloc
_resetstkoflw
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
calloc
memcpy_s
_recalloc
_invalid_parameter_noinfo
memmove_s
_purecall
free
??2@YAPAXI@Z
??_V@YAXPAX@Z
??3@YAXPAX@Z
fseek
swprintf_s
fclose
wcscat_s
strncpy_s
_waccess
_wcsicmp
strstr
__RTDynamicCast
vswprintf_s
atoi
wcstoul
wcschr
_tzset
_mktime64
_wcsnicmp
toupper
strchr
sprintf_s
atof
memset
__CxxFrameHandler3
_CxxThrowException
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_wtoi
floor
memcpy

rpcrt4

UuidFromStringW

Exports

Exports

CloseSkin
OpenSkin

Sections

.text
Size: 829KB - Virtual size: 828KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CoralUpdate.dll
.dll windows:4 windows x86 arch:x86

ffdc6e7311af21e15fb385a6b2c0014b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

df:97:08:fb:44:2d:65:aa:f0:1e:1a:cb:b1:8e:a2:a7:90:03:43:a3
Signer

Actual PE Digest

df:97:08:fb:44:2d:65:aa:f0:1e:1a:cb:b1:8e:a2:a7:90:03:43:a3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\Code2\coral\branches\CoralExplorer_v1.2.4386\build_temp\Win32\Release\CoralUpdate\CoralUpdate.pdb

Imports

wininet

InternetWriteFile
InternetSetOptionW
HttpAddRequestHeadersW
HttpQueryInfoW
InternetReadFile
HttpOpenRequestW
HttpSendRequestW
InternetConnectW
InternetCrackUrlW
InternetCloseHandle
InternetOpenW
InternetOpenUrlW
HttpEndRequestW
HttpSendRequestExW

kernel32

LoadLibraryExW
GetModuleHandleW
FindResourceW
InterlockedDecrement
FlushInstructionCache
InterlockedExchange
lstrlenW
SetLastError
FreeLibrary
GetCurrentProcess
EnterCriticalSection
RaiseException
CreateMutexW
InitializeCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
LoadResource
SizeofResource
CreateFileW
DeviceIoControl
GetVersionExW
CloseHandle
SetPriorityClass
DeleteFileW
GetFileAttributesW
CopyFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetTickCount
LoadLibraryW
GetComputerNameW
MoveFileW
WriteFile
WaitForSingleObject
SystemTimeToFileTime
InterlockedExchangeAdd
GetACP
WideCharToMultiByte
GetWindowsDirectoryW
GetModuleFileNameW
GetCurrentDirectoryW
CreateDirectoryW
GetLongPathNameW
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
GetTempPathW
GetTempFileNameW
SetFileTime
FindNextFileW
FindFirstFileW
FindClose
GetFileSize
ReadFile
SetFilePointer
SetEndOfFile
ResumeThread
GetSystemTime
FileTimeToSystemTime
FileTimeToLocalFileTime
ResetEvent
CreateEventW
SetEvent
LocalFree
FormatMessageW
ExpandEnvironmentStringsW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
OpenProcess
GetLastError
VirtualAlloc
MultiByteToWideChar
lstrcmpiW
Sleep
GetCurrentThreadId
LoadLibraryA
GetProcAddress
DisableThreadLibraryCalls
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetVersionExA
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
VirtualFree
TerminateProcess

user32

LoadStringW
SetMenuDefaultItem
TrackPopupMenu
LoadMenuW
RegisterWindowMessageW
LoadCursorW
RegisterClassExW
CreateWindowExW
GetCursorPos
CallWindowProcW
GetClassInfoExW
GetSubMenu
GetMenuDefaultItem
GetActiveWindow
PostMessageW
IsMenu
GetSystemMenu
ModifyMenuW
DestroyMenu
SetDlgItemTextW
IsWindowVisible
EnableWindow
IsIconic
KillTimer
IsDialogMessageW
PostQuitMessage
SetTimer
GetMessageW
DispatchMessageW
DestroyWindow
TranslateMessage
MessageBoxW
CharNextW
PeekMessageW
DefWindowProcW
CreateDialogParamW
GetParent
SetForegroundWindow
ShowWindow
MapWindowPoints
GetWindow
LoadIconW
SetWindowPos
SystemParametersInfoW
IsWindow
SetWindowLongW
GetClientRect
GetWindowRect
EndDialog
SendMessageW
DestroyIcon
LoadImageW
GetWindowLongW
GetSystemMetrics
SetWindowTextW
GetDlgItem
UnregisterClassA
DialogBoxParamW

gdi32

CreateFontIndirectW
DeleteObject

advapi32

RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW
GetUserNameW
RegEnumKeyW
RegQueryValueExW
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW

shell32

SHFileOperationW
SHGetSpecialFolderLocation
ShellExecuteExW
ShellExecuteW
SHChangeNotify
SHGetPathFromIDListW
Shell_NotifyIconW

ole32

CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx
CoInitialize

oleaut32

VarUI4FromStr

msvcr80

wcscpy_s
_beginthreadex
??2@YAPAXI@Z
swprintf_s
towlower
_vsnwprintf_s
towupper
wcschr
_errno
memmove
rand
srand
_wtoi
_localtime64_s
vswprintf_s
swscanf_s
_vswprintf_c_l
_invalid_parameter_noinfo
strncpy
_vswprintf
_recalloc
free
malloc
_purecall
??0exception@std@@QAE@XZ
_time64
wcsncpy_s
memcpy_s
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
memmove_s
_splitpath_s
memcpy
_CxxThrowException
__CxxFrameHandler3
?terminate@@YAXXZ
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
??3@YAXPAX@Z
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_localtime64
__clean_type_info_names_internal
memset
_stricmp
??_V@YAXPAX@Z

shlwapi

SHDeleteKeyW

comctl32

InitCommonControlsEx

Exports

Exports

CoralCreateObject

Sections

.text
Size: 274KB - Virtual size: 273KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Microsoft.VC80.CRT.manifest
Skins/Coral.dui
.zip
objects.xml
.xml
plugin.xml
.xml
Skins/Coral.skn
.zip
3btn_Button.png
.png
Close_Btn.png
.png
CoralSkinPreview.png
.png
Coral_Logo.png
.png
Download_Background.png
.png
Download_Button .png
.png
Find_Next.png
.png
Find_Prev.png
.png
Findbar_Resault_Icon.png
.png
Findbar_Select item_big.png
.png
Findbar_select item_small.png
.png
Float 2.png
.png
Float.png
.png
FullScreenExitButton.png
.png
IE6_Menubar.png
.png
IE6_devide.PNG
.png
LeftRight.png
.png
Left_Border.png
.png
Main_Background.png
.png
Main_Background_Line.png
.png
ProgressBar.png
.png
ProgressBar_bule.png
.png
Rebar_Background.png
.png
Rebar_Background_line.png
.png
Right.png
.png
Right_Border.png
.png
Searchbar_list_btn.png
.png
SideBarSplitterBar.png
.png
SideBar_Topbar.png
.png
StatusBar_Background.png
.png
System_Button.png
.png
Tab_Thumb.png
.png
ToolBar_Separator.png
.png
Toolbar_Gripper.png
.png
add.png
.png
add_btn.png
.png
adressbar_list_btn.png
.png
back.png
.png
back_bar.png
.png
cal.png
.png
close_btn_small.png
.png
default_page.png
.png
delete.png
.png
done.png
.png
down_Logo.png
.png
down_arrow.png
.png
download-14.png
.png
download.png
.png
download_list_bg.png
.png
download_list_bg_ie.png
.png
edit.png
.png
fav.png
.png
favorites.png
.png
find.png
.png
findbar_backgroung.png
.png
findbar_bg.png
.png
fivebtn.png
.png
forward.png
.png
go_btn.png
.png
history.png
.png
history_site.png
.png
home.png
.png
menubar_selecte_item.png
.png
more_btn.png
.png
more_list_btn.png
.png
most.png
.png
new_tab.png
.png
no_traces_btn.png
.png
non-trace_tab.png
.png
notice.png
.png
objects.xml
.xml
on_arrow.png
.png
on_right_bar.png
.png
outevery.png
.png
pen.png
.png
pen_highlight_icon.png
.png
pen_selecte_highlight.png
.png
privacy1.png
.png
privacy2.png
.png
prop.xml
.xml
refresh.png
.png
restore.png
.png
right_bar.png
.png
rightbar.png
.png
safe1.png
.png
safe2.png
.png
search_btn.png
.png
search_del.png
.png
search_on.png
.png
searchbar.png
.png
searchbar_bg.png
.png
select item.png
.png
select item_small.png
.png
set_btn.png
.png
shareres.xml
.xml
sidebar_bg.png
.png
sidebar_bg_right.png
.png
sidebar_btn.png
.png
sidebar_searchbar_bg.png
.png
sidebar_view_bg.png
.png
size-contrl.png
.png
statusbar_select_item.png
.png
statusbar_zoomlist_arrow.png
.png
stop.png
.png
tab1.png
.png
tab2.png
.png
tab_background.png
.png
tab_close_btn_small.png
.png
tab_del.png
.png
tab_item.png
.png
tab_list.png
.png
tab_loading.png
.png
tab_move_left.png
.png
tab_move_right.png
.png
tab_states.png
.png
tick.png
.png
voice1.png
.png
voice2.png
.png
waite.png
.png
wuhen.png
.png
zoom.png
.png
Skins/Coral.xml
.xml
Skins/CoralIE.skn
.zip
3btn_Button.png
.png
Close_Btn.png
.png
CoralSkinPreview.png
.png
Coral_Logo.png
.png
Download_Background.png
.png
Download_Button .png
.png
Find_Next.png
.png
Find_Prev.png
.png
Findbar_Resault_Icon.png
.png
Findbar_Select item_big.png
.png
Findbar_select item_small.png
.png
Float 2.png
.png
Float.png
.png
FullScreenExitButton.png
.png
IE6_Menubar.png
.png
IE6_devide.PNG
.png
LeftRight.png
.png
Left_Border.png
.png
Main_Background.png
.png
Main_Background_Line.png
.png
ProgressBar.png
.png
ProgressBar_bule.png
.png
Rebar_Background.png
.png
Rebar_Background_line.png
.png
Right.png
.png
Right_Border.png
.png
Searchbar_list_btn.png
.png
SideBarSplitterBar.png
.png
SideBar_Topbar.png
.png
StatusBar_Background.png
.png
System_Button.png
.png
Tab_Thumb.png
.png
ToolBar_Separator.png
.png
Toolbar_Gripper.png
.png
add.png
.png
add_btn.png
.png
adressbar_list_btn.png
.png
back.png
.png
back_bar.png
.png
cal.png
.png
close_btn_small.png
.png
default_page.png
.png
delete.png
.png
done.png
.png
down_Logo.png
.png
down_arrow.png
.png
download-14.png
.png
download.png
.png
download_list_bg.png
.png
download_list_bg_ie.png
.png
edit.png
.png
fav.png
.png
favorites.png
.png
find.png
.png
findbar_backgroung.png
.png
findbar_bg.png
.png
fivebtn.png
.png
forward.png
.png
go_btn.png
.png
history.png
.png
history_site.png
.png
home.png
.png
menubar_selecte_item.png
.png
more_btn.png
.png
more_list_btn.png
.png
most.png
.png
new_tab.png
.png
no_traces_btn.png
.png
non-trace_tab.png
.png
notice.png
.png
objects.xml
.xml
on_arrow.png
.png
on_right_bar.png
.png
outevery.png
.png
pen.png
.png
pen_highlight_icon.png
.png
pen_selecte_highlight.png
.png
privacy1.png
.png
privacy2.png
.png
prop.xml
.xml
refresh.png
.png
restore.png
.png
right_bar.png
.png
rightbar.png
.png
safe1.png
.png
safe2.png
.png
search_btn.png
.png
search_del.png
.png
search_on.png
.png
searchbar.png
.png
searchbar_bg.png
.png
select item.png
.png
select item_small.png
.png
set_btn.png
.png
shareres.xml
.xml
sidebar_bg.png
.png
sidebar_bg_right.png
.png
sidebar_btn.png
.png
sidebar_searchbar_bg.png
.png
sidebar_view_bg.png
.png
size-contrl.png
.png
statusbar_select_item.png
.png
statusbar_zoomlist_arrow.png
.png
stop.png
.png
tab1.png
.png
tab2.png
.png
tab_background.png
.png
tab_close_btn_small.png
.png
tab_del.png
.png
tab_item.png
.png
tab_list.png
.png
tab_loading.png
.png
tab_move_left.png
.png
tab_move_right.png
.png
tab_states.png
.png
tick.png
.png
voice1.png
.png
voice2.png
.png
waite.png
.png
wuhen.png
.png
zoom.png
.png
StartPage/css/css.css
StartPage/css/home.css
StartPage/css/jquery.loadmask.css
StartPage/fancybox/jquery.fancybox-1.3.4.css
StartPage/fancybox/jquery.fancybox-1.3.4.js
.js
StartPage/guide.htm
.html
StartPage/guide1.htm
.html .js polyglot
StartPage/guide2.htm
.html .js polyglot
StartPage/guide3.htm
.html .js polyglot
StartPage/guide4.htm
.html .js polyglot
StartPage/guide5.htm
.html .js polyglot
StartPage/images/all_search_icon_baidu.gif
.gif
StartPage/images/blank.gif
.gif
StartPage/images/close_tab.png
.png
StartPage/images/close_tab2.png
.png
StartPage/images/gradient_bg.png
.png
StartPage/images/gradient_bottom.png
.png
StartPage/images/gradient_top.png
.png
StartPage/images/guide_bg.jpg
.jpg
StartPage/images/guide_box_bg.gif
.gif
StartPage/images/guide_box_bg.png
.png
StartPage/images/guide_box_bottom.png
.png
StartPage/images/guide_box_ks.jpg
.jpg
StartPage/images/guide_box_ks.png
.png
StartPage/images/guide_box_line.jpg
.jpg
StartPage/images/guide_box_ls.jpg
.jpg
StartPage/images/guide_box_ls.png
.png
StartPage/images/guide_box_ss.jpg
.jpg
StartPage/images/guide_box_ss.png
.png
StartPage/images/guide_box_title1.png
.png
StartPage/images/guide_box_title2.png
.png
StartPage/images/guide_box_title3.png
.png
StartPage/images/guide_box_title4.png
.png
StartPage/images/guide_box_title5.png
.png
StartPage/images/guide_box_wd.jpg
.jpg
StartPage/images/guide_box_wd.png
.png
StartPage/images/guide_btn1.png
.png
StartPage/images/guide_btn2.png
.png
StartPage/images/guide_btn3.png
.png
StartPage/images/guide_btn4.png
.png
StartPage/images/guide_btn5.png
.png
StartPage/images/guide_btn6.gif
.gif
StartPage/images/guide_btn6.png
.png
StartPage/images/guide_btn7.gif
.gif
StartPage/images/guide_btn7.png
.png
StartPage/images/guide_ie.gif
.gif
StartPage/images/guide_img1.jpg
.jpg
StartPage/images/guide_img2.jpg
.jpg
StartPage/images/guide_img3.jpg
.jpg
StartPage/images/guide_img4.jpg
.jpg
StartPage/images/guide_logo.jpg
.jpg
StartPage/images/guide_logo.png
.png
StartPage/images/guide_nav1.png
.png
StartPage/images/guide_nav1a.png
.png
StartPage/images/guide_nav2.png
.png
StartPage/images/guide_nav2a.png
.png
StartPage/images/guide_nav3.png
.png
StartPage/images/guide_nav3a.png
.png
StartPage/images/guide_nav4.png
.png
StartPage/images/guide_nav4a.png
.png
StartPage/images/guide_nav5.png
.png
StartPage/images/guide_nav5a.png
.png
StartPage/images/home/163_big.jpg
.jpg
StartPage/images/home/163_small.jpg
.jpg
StartPage/images/home/2345_big.jpg
.jpg
StartPage/images/home/2345_small.jpg
.jpg
StartPage/images/home/baidu_big.jpg
.jpg
StartPage/images/home/baidu_small.jpg
.jpg
StartPage/images/home/fenghuang_big.jpg
.jpg
StartPage/images/home/fenghuang_small.jpg
.jpg
StartPage/images/home/google_big.jpg
.jpg
StartPage/images/home/google_small.jpg
.jpg
StartPage/images/home/kaixin_big.jpg
.jpg
StartPage/images/home/kaixin_small.jpg
.jpg
StartPage/images/home/qq_big.jpg
.jpg
StartPage/images/home/qq_small.jpg
.jpg
StartPage/images/home/sina_big.jpg
.jpg
StartPage/images/home/sina_small.jpg
.jpg
StartPage/images/home/sohu_big.jpg
.jpg
StartPage/images/home/sohu_small.jpg
.jpg
StartPage/images/home/taobao_big.jpg
.jpg
StartPage/images/home/taobao_small.jpg
.jpg
StartPage/images/home/youku_big.jpg
.jpg
StartPage/images/home/youku_small.jpg
.jpg
StartPage/images/hot.png
.png
StartPage/images/list_bg.png
.png
StartPage/images/loading.gif
.gif
StartPage/images/main_bottombar_report.gif
.gif
StartPage/images/main_bottombar_report2.gif
.gif
StartPage/images/main_bottombar_report3.gif
.gif
StartPage/images/main_content_error.gif
.gif
StartPage/images/main_grid_bar_bj.gif
.gif
StartPage/images/main_grid_bar_blank.gif
.gif
StartPage/images/main_grid_bar_blank_hover.gif
.gif
StartPage/images/main_grid_bar_edit.gif
.gif
StartPage/images/main_grid_bar_edit_hover.gif
.gif
StartPage/images/main_grid_bar_remove.gif
.gif
StartPage/images/main_grid_bar_remove2.png
.png
StartPage/images/main_grid_bar_remove_hover.gif
.gif
StartPage/images/main_grid_item1-03.png
.png
StartPage/images/main_grid_item1.png
.png
StartPage/images/main_grid_item1b.png
.png
StartPage/images/main_grid_item_add.jpg
.jpg
StartPage/images/main_grid_item_add.png
.png
StartPage/images/main_grid_item_add_bak.png
.png
StartPage/images/main_grid_item_add_hover.png
.png
StartPage/images/main_grid_item_hover1.png
.png
StartPage/images/main_grid_item_hover1b.png
.png
StartPage/images/main_grid_item_loading.gif
.gif
StartPage/images/main_search_bg1.png
.png
StartPage/images/main_search_bg2.png
.png
StartPage/images/main_search_bigicon_baidu.png
.png
StartPage/images/main_search_bigicon_bing.png
.png
StartPage/images/main_search_bigicon_google.png
.png
StartPage/images/main_search_bigicon_sogou.png
.png
StartPage/images/main_search_bigicon_soso.png
.png
StartPage/images/main_search_bigicon_yahoo.png
.png
StartPage/images/main_search_bigicon_youdao.png
.png
StartPage/images/main_search_button_bg1.png
.png
StartPage/images/main_search_button_bg2.png
.png
StartPage/images/main_search_button_bg3.png
.png
StartPage/images/main_search_smallicon_baidu.gif
.gif
StartPage/images/main_search_smallicon_bing.gif
.gif
StartPage/images/main_search_smallicon_google.gif
.gif
StartPage/images/main_search_smallicon_sogou.gif
.gif
StartPage/images/main_search_smallicon_soso.gif
.gif
StartPage/images/main_search_smallicon_yahoo.gif
.gif
StartPage/images/main_search_smallicon_youdao.gif
.gif
StartPage/images/main_search_xl_arrow.png
.png
StartPage/images/main_search_xl_background1.gif
.gif
StartPage/images/main_search_xl_background2.gif
.gif
StartPage/images/page_white.png
.png
StartPage/images/popup_dialog_background.gif
.gif
StartPage/images/popup_dialog_background.png
.png
StartPage/images/popup_dialog_close.gif
.gif
StartPage/images/popup_dialog_close2.gif
.gif
StartPage/images/popup_dialog_edit_background.gif
.gif
StartPage/images/popup_dialog_edit_background2.gif
.gif
StartPage/images/popup_dialog_edit_bg.gif
.gif
StartPage/images/popup_dialog_edit_bg1.gif
.gif
StartPage/images/popup_dialog_edit_bg2.gif
.gif
StartPage/images/popup_dialog_list_button.gif
.gif
StartPage/images/popup_dialog_list_button2.gif
.gif
StartPage/images/popup_dialog_list_button3.gif
.gif
StartPage/images/popup_dialog_list_icon.gif
.gif
StartPage/images/popup_dialog_list_icon1.gif
.gif
StartPage/images/popup_dialog_list_icon2.gif
.gif
StartPage/images/popup_dialog_list_icon3.gif
.gif
StartPage/images/popup_dialog_list_icon4.gif
.gif
StartPage/images/popup_dialog_list_icon4_2.gif
.gif
StartPage/images/popup_dialog_list_tit.gif
.gif
StartPage/images/popup_dialog_list_tit2.gif
.gif
StartPage/images/popup_dialog_list_tit_hover.gif
.gif
StartPage/images/popup_dialog_list_tit_hover2.gif
.gif
StartPage/images/popup_dialog_preview_but.gif
.gif
StartPage/images/popup_dialog_preview_but2.gif
.gif
StartPage/images/quan.gif
.gif
StartPage/images/search/main_search_icon_baidu.png
.png
StartPage/images/search/main_search_icon_bing.png
.png
StartPage/images/search/main_search_icon_dbaidu.png
.png
StartPage/images/search/main_search_icon_dgoogle.png
.png
StartPage/images/search/main_search_icon_gdangdang.png
.png
StartPage/images/search/main_search_icon_gjingdong.png
.png
StartPage/images/search/main_search_icon_gjyjo.png
.png
StartPage/images/search/main_search_icon_google.png
.png
StartPage/images/search/main_search_icon_gpaipai.png
.png
StartPage/images/search/main_search_icon_gtaobao.png
.png
StartPage/images/search/main_search_icon_ibaidu.png
.png
StartPage/images/search/main_search_icon_igoogle.png
.png
StartPage/images/search/main_search_icon_isoso.png
.png
StartPage/images/search/main_search_icon_mbaidu.png
.png
StartPage/images/search/main_search_icon_mgoogle.png
.png
StartPage/images/search/main_search_icon_msoso.png
.png
StartPage/images/search/main_search_icon_none.png
.png
StartPage/images/search/main_search_icon_sogou.png
.png
StartPage/images/search/main_search_icon_soso.png
.png
StartPage/images/search/main_search_icon_vbaidu.png
.png
StartPage/images/search/main_search_icon_vgoogle.png
.png
StartPage/images/search/main_search_icon_vsoso.png
.png
StartPage/images/search/main_search_icon_vtudou.png
.png
StartPage/images/search/main_search_icon_vyouku.png
.png
StartPage/images/search/main_search_icon_wbaidu.png
.png
StartPage/images/search/main_search_icon_wsoso.png
.png
StartPage/images/search/main_search_icon_wwiki.png
.png
StartPage/images/search/main_search_icon_xduote.png
.png
StartPage/images/search/main_search_icon_xshooter.png
.png
StartPage/images/search/main_search_icon_xverycd.png
.png
StartPage/images/search/main_search_icon_xxunlei.png
.png
StartPage/images/search/main_search_icon_yahoo.png
.png
StartPage/images/search/main_search_icon_youdao.png
.png
StartPage/images/search/main_search_logo_baidu.png
.png
StartPage/images/search/main_search_logo_bing.png
.png
StartPage/images/search/main_search_logo_dbaidu.png
.png
StartPage/images/search/main_search_logo_dgoogle.png
.png
StartPage/images/search/main_search_logo_gdangdang.png
.png
StartPage/images/search/main_search_logo_gjingdong.png
.png
StartPage/images/search/main_search_logo_gjyjo.png
.png
StartPage/images/search/main_search_logo_google.png
.png
StartPage/images/search/main_search_logo_gpaipai.png
.png
StartPage/images/search/main_search_logo_gtaobao.png
.png
StartPage/images/search/main_search_logo_ibaidu.png
.png
StartPage/images/search/main_search_logo_igoogle.png
.png
StartPage/images/search/main_search_logo_isoso.png
.png
StartPage/images/search/main_search_logo_mbaidu.png
.png
StartPage/images/search/main_search_logo_mgoogle.png
.png
StartPage/images/search/main_search_logo_msoso.png
.png
StartPage/images/search/main_search_logo_none.png
.png
StartPage/images/search/main_search_logo_sogou.png
.png
StartPage/images/search/main_search_logo_soso.png
.png
StartPage/images/search/main_search_logo_vbaidu.png
.png
StartPage/images/search/main_search_logo_vgoogle.png
.png
StartPage/images/search/main_search_logo_vsoso.png
.png
StartPage/images/search/main_search_logo_vtudou.png
.png
StartPage/images/search/main_search_logo_vyouku.png
.png
StartPage/images/search/main_search_logo_wbaidu.png
.png
StartPage/images/search/main_search_logo_wsoso.png
.png
StartPage/images/search/main_search_logo_wwiki.png
.png
StartPage/images/search/main_search_logo_xduote.png
.png
StartPage/images/search/main_search_logo_xshooter.png
.png
StartPage/images/search/main_search_logo_xverycd.png
.png
StartPage/images/search/main_search_logo_xxunlei.png
.png
StartPage/images/search/main_search_logo_yahoo.png
.png
StartPage/images/search/main_search_logo_youdao.png
.png
StartPage/images/switch_bj.gif
.gif
StartPage/images/switch_combar_icon1.gif
.gif
StartPage/images/switch_widbar_icon2.gif
.gif
StartPage/index.htm
.html .js polyglot
StartPage/js/clear.gif
.gif
StartPage/js/coral_commom.js
.js
StartPage/js/coral_lib_min.js
.js
StartPage/js/coral_myfav.js
.js
StartPage/js/coral_se.js
.js
StartPage/js/iepng.js
.js
StartPage/js/jquery.loadmask.js
.js
StartPage/js/move.js
.js
StartPage/js/unitpngfix.js
.js
StartPage/pop_edit.html
.html .js polyglot
StartPage/search.htm
.html
Uninstall.exe
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

cc7109b9c3b24bf2e4cc2be1f2650012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExW
GlobalFree
lstrcpyW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
LCMapStringW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteFile
InitializeCriticalSection
RtlUnwind
HeapSize

Exports

Exports

KillProc

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/un.option.ini
lang/CoralLang_chs.dll
.dll windows:4 windows x86 arch:x86

a41ee06935c52cf69ebe02770a700852

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/05/2011, 00:00

Not After

15/05/2012, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,O=上海瑞创网络科技股份有限公司,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:68:27:c1:73:7f:35:f2:22:89:9e:a4:71:dd:c1:57:7b:ae:15:db
Signer

Actual PE Digest

53:68:27:c1:73:7f:35:f2:22:89:9e:a4:71:dd:c1:57:7b:ae:15:db

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\Code2\coral\branches\CoralExplorer_v1.2.4386\build_temp\Win32\Release\CoralLang_chs\CoralLang_chs.pdb

Imports

kernel32

DisableThreadLibraryCalls
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Exports

Exports

CoralCreateObject

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 777KB - Virtual size: 777KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
msvcr80.dll
.dll windows:4 windows x86 arch:x86

7fecbc4a16a5dc85a5394a1df6217680

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msvcr80.i386.pdb

Imports

msvcrt

_getdrives

kernel32

GetStringTypeA
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetSystemDirectoryW
GetLongPathNameW
GetCurrentThreadId
TlsGetValue
DebugBreak
OutputDebugStringA
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
FindNextFileA
FindFirstFileA
FindClose
FindNextFileW
FindFirstFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
Sleep
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
VirtualAlloc
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteConsoleW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
MultiByteToWideChar
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
WideCharToMultiByte
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
SetLocalTime
GetStringTypeW
LoadLibraryW
GetLocaleInfoA
GetLocaleInfoW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
RtlUnwind
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
CreateFileA
CompareStringA
CompareStringW
Beep
GetDiskFreeSpaceA
GetLogicalDrives
SetErrorMode
GetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetDriveTypeA
CreateDirectoryA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
DeleteFileW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
MoveFileA
RaiseException
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
CreateProcessW
HeapValidate
HeapCompact
HeapWalk
VirtualProtect
GetSystemInfo
VirtualQuery
IsDBCSLeadByteEx
ReadConsoleA
ReadConsoleW
SetConsoleMode
SetEndOfFile
DuplicateHandle
GetFileInformationByHandle
PeekNamedPipe
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
LockFile
UnlockFile
CreatePipe
ReadFile
CreateFileW
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime

Exports

Exports

$I10_OUTPUT
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1exception@std@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@@6B@
??_7exception@std@@6B@
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZH@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?raw_name@type_info@@QBEPBDXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?unexpected@@YAXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?what@exception@std@@UBEPBDXZ
@_calloc_crt@8
@_malloc_crt@4
@_realloc_crt@8
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_Strftime
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindStdDelDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___fls_getvalue@4
___fls_setvalue@8
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringW
__crtGetLocaleInfoW
__crtGetStringTypeW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_app_type
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lc_clike
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__amblksiz
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__osplatform
__p__osver
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__winmajor
__p__winminor
__p__winver
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__set_flsgetvalue
__setlc_active
__setusermatherr
__strncnt
__swprintf_l
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__unDNameHelper
__uncaught_exception
__unguarded_readlc_active
__vswprintf_l
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_amsg_exit
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_crt
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_commode
_configthreadlocale
_control87
_controlfp
_controlfp_s
_copysign
_cprintf
_cprintf_l
_cprintf_p
_cprintf_p_l
_cprintf_s
_cprintf_s_l
_cputs
_cputws
_creat
_create_locale
_crt_debugger_hook
_cscanf
_cscanf_l
_cscanf_s
_cscanf_s_l
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_cwait
_cwprintf
_cwprintf_l
_cwprintf_p
_cwprintf_p_l
_cwprintf_s
_cwprintf_s_l
_cwscanf
_cwscanf_l
_cwscanf_s
_cwscanf_s_l
_daylight
_decode_pointer
_difftime32
_difftime64
_dosmaperr
_dstbias
_dup
_dup2
_dupenv_s
_ecvt
_ecvt_s
_encode_pointer
_encoded_null
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_except_handler4_common
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fclose_nolock
_fcloseall
_fcvt
_fcvt_s
_fdopen
_fflush_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filbuf
_filelength
_filelengthi64
_fileno
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_free_locale
_freea
_freea_s
_freefls
_fscanf_l
_fscanf_s_l
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_ftell_nolock
_ftelli64
_ftelli64_nolock
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_ftol
_fullpath
_futime32
_futime64
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwrite_nolock
_fwscanf_l
_fwscanf_s_l
_gcvt
_gcvt_s
_get_amblksiz
_get_current_locale
_get_daylight
_get_doserrno
_get_dstbias
_get_errno
_get_fmode
_get_heap_handle
_get_invalid_parameter_handler
_get_osfhandle
_get_osplatform
_get_osver
_get_output_format
_get_pgmptr
_get_printf_count_output
_get_purecall_handler
_get_sbh_threshold
_get_terminate
_get_timezone
_get_tzname
_get_unexpected
_get_winmajor
_get_winminor
_get_winver
_get_wpgmptr
_getch
_getch_nolock
_getche
_getche_nolock
_getcwd
_getdcwd
_getdcwd_nolock
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp

Sections

.text
Size: 396KB - Virtual size: 393KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 1.5MB

.rsrc Size: 19KB - Virtual size: 18KB

f6e384a477f8efc14029bba8fca9bd0f

Headers

File Characteristics

PDB Paths

Imports

version

kernel32

user32

Exports

Exports

Sections

.text Size: 26KB - Virtual size: 26KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 3KB - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 5KB - Virtual size: 4KB

cc7109b9c3b24bf2e4cc2be1f2650012

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 28KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 4KB - Virtual size: 3KB

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 899B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 574B

45d25ca52c312b2254c60dbcb30342d1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 696B

.rdata Size: 1024B - Virtual size: 753B

.data Size: 512B - Virtual size: 48B

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 1.5MB

.rsrc
Size: 19KB - Virtual size: 18KB

.text
Size: 26KB - Virtual size: 26KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 3KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 5KB - Virtual size: 4KB

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 899B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 574B

.text
Size: 1024B - Virtual size: 696B

.rdata
Size: 1024B - Virtual size: 753B

.data
Size: 512B - Virtual size: 48B

.reloc
Size: 512B - Virtual size: 240B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 48B

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 590B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

74:63:f5:d8:a2:57:12:84:72:01:be:f3:4d:27:08:f4
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:a0:7b:db:e3:25:9f:fb:84:3e:4d:e2:39:3d:60:b8:e0:d3:55:86
Signer

.text
Size: 495KB - Virtual size: 494KB

.rdata
Size: 79KB - Virtual size: 78KB

.data
Size: 7KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 36KB - Virtual size: 36KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate