dfaa03c22c896c43c2c46efd8e6bb195_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

dfaa03c22c896c43c2c46efd8e6bb195_JaffaCakes118
Size

1.2MB
MD5

dfaa03c22c896c43c2c46efd8e6bb195
SHA1

fd99b7bf751606753d9b6a7c60669f36e32687e8
SHA256

1976a5f86fb36278dbc2219a1fcab8548200945f8709b605b8a36e4427a6b04f
SHA512

6eca6d601b974548c25958a017e576badfcee44f96bbf1a109da8b847aba25b45be712d5eb37715ffc42eb594c9ed1a629656d63b699b5b1fe580cbe154bdb01
SSDEEP

24576:8lN9sBPDxM6lZs261f3y2rgG4X95Rk1CIkYH/aEEZKjXT9:8fE+X2616209X9qCIrUKjXT9

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/PPLive/FWUpnp.dll	aspack_v212_v242
static1/unpack001/PPLive/PPlist.exe	aspack_v212_v242

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PPLive/PP/TEN.dll
unpack001/PPLive/PPlist.exe

Files

dfaa03c22c896c43c2c46efd8e6bb195_JaffaCakes118
.rar
PPLive/Config.Ini
PPLive/FWUpnp.dll
.dll windows:4 windows x86 arch:x86

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

23/09/2005, 00:00

Not After

23/09/2006, 23:59

Subject

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8d:11:4f:3c:6e:d2:11:a8:10:0c:bf:59:92:cf:89:b4:55:49:fa:ae
Signer

Actual PE Digest

8d:11:4f:3c:6e:d2:11:a8:10:0c:bf:59:92:cf:89:b4:55:49:fa:ae

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

FWAppAdd
FWAppIsEnable
FWExceptionSetAllowed
FWExcptionAllowed
FWFree
FWInit
FWOff
FWOn
FWPortAdd
FWison
GetExIP
GetMapPort
GetSessionState
GetUPnPVersion
SetCallBack
SetQuitFlag
SetSessionState
SetUPnPWaitTime
UPNPGetExIp
UPNPaddPort
UPNPdelPort
UPnPGetMapPort
addPortmap
delPortmap

Sections

.text
Size: 32KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PPLive/Language/CA.ini
PPLive/Language/CHTW.ini
PPLive/Language/CHU.ini
PPLive/Language/DE.ini
PPLive/Language/EN.ini
PPLive/Language/ES.ini
PPLive/PP/ERoc.dll
.dll windows:4 windows x86 arch:x86

06360b8a176e4358699ff162d040df3b

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

23/09/2005, 00:00

Not After

23/09/2006, 23:59

Subject

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

41:ae:df:f5:9a:8d:ac:f7:3c:6f:25:e2:5c:4f:ba:38:28:21:f6:1e
Signer

Actual PE Digest

41:ae:df:f5:9a:8d:ac:f7:3c:6f:25:e2:5c:4f:ba:38:28:21:f6:1e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetUnhandledExceptionFilter
GetCurrentThread
GetCurrentProcess
OutputDebugStringA
GetProcAddress
LoadLibraryA
FreeLibrary
CloseHandle
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
GetLocalTime
GetLastError
lstrcatA
lstrcpyA
GetModuleFileNameA
FindFirstFileA
VirtualQuery
AllocConsole
GetConsoleTitleA
WaitForMultipleObjects
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
GetTickCount
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventA
SetEvent
ResetEvent
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
Sleep
InterlockedExchange
RtlUnwind
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
RaiseException
ExitProcess
TerminateProcess
HeapReAlloc
HeapSize
FlushFileBuffers
WriteFile
FatalAppExitA
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetStdHandle
SetFilePointer
InterlockedDecrement
InterlockedIncrement
CreateFileA
IsBadReadPtr
IsBadCodePtr
UnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
SetEndOfFile
ReadFile
SetConsoleCtrlHandler
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
SetEnvironmentVariableA

user32

MessageBoxA

shlwapi

PathRemoveFileSpecA
PathAppendA
PathFindFileNameA

Exports

Exports

TS_XXXX

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PPLive/PP/GAL.dll
.dll windows:4 windows x86 arch:x86

4d2cdd36d9426ae3098ceb76eb125167

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

23/09/2005, 00:00

Not After

23/09/2006, 23:59

Subject

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2b:9f:21:33:07:e3:d9:06:56:21:b0:59:7f:00:7e:1c:88:6b:17:fd
Signer

Actual PE Digest

2b:9f:21:33:07:e3:d9:06:56:21:b0:59:7f:00:7e:1c:88:6b:17:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

rpcrt4

UuidToStringA

ws2_32

closesocket
socket
WSAGetLastError
bind
ioctlsocket
sendto
recvfrom
connect
send
gethostbyname
htons
inet_addr

ole32

CoCreateGuid

kernel32

TlsFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
LCMapStringW
LCMapStringA
ReadFile
GetStringTypeW
GetStringTypeA
CloseHandle
DeviceIoControl
CreateFileA
GetVersionExA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateThread
CreateEventA
GetCurrentProcessId
InitializeCriticalSection
DeleteCriticalSection
TerminateThread
WaitForSingleObject
SetEvent
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
Sleep
WritePrivateProfileStructA
GetPrivateProfileStructA
GetSystemDirectoryA
GetTickCount
RtlUnwind
HeapAlloc
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
HeapFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
HeapDestroy
HeapCreate
VirtualFree
ExitProcess
VirtualAlloc
HeapReAlloc
IsBadWritePtr
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetFilePointer
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
MultiByteToWideChar
GetCPInfo
GetACP
GetOEMCP
SetStdHandle

Exports

Exports

TS_XXXX

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PPLive/PP/KOM.dll
.dll windows:4 windows x86 arch:x86

399a36fc8a9e944bc7390a7dede4352d

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

23/09/2005, 00:00

Not After

23/09/2006, 23:59

Subject

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a4:0d:16:25:8b:c9:01:37:1d:f0:03:17:91:54:5d:b0:25:5b:40:a9
Signer

Actual PE Digest

a4:0d:16:25:8b:c9:01:37:1d:f0:03:17:91:54:5d:b0:25:5b:40:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
GetLastError
LoadLibraryA
GetVersion
GetCurrentProcessId
GetCommandLineA
GetTickCount
CreateEventA
CloseHandle
GetLocalTime
OutputDebugStringA
lstrcpyA
GetModuleFileNameA
SetEvent
CreateThread
ResetEvent
TerminateThread
WaitForSingleObject
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetStringTypeW
GetStringTypeA
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
RtlUnwind
HeapFree
RaiseException
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
FlushFileBuffers
WriteFile
FatalAppExitA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
UnhandledExceptionFilter
SetFilePointer
InterlockedDecrement
InterlockedIncrement
SetStdHandle
CreateFileA
GetCPInfo
GetACP
GetOEMCP
SetConsoleCtrlHandler
SetEndOfFile
ReadFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
SetEnvironmentVariableA

ole32

CoCreateGuid

ws2_32

gethostbyname
gethostname

rpcrt4

UuidToStringA

shlwapi

StrStrIA
PathAppendA
PathRemoveFileSpecA

Exports

Exports

TS_0001
TS_0002
TS_0003
TS_0004
TS_0005
TS_0006
TS_0007
TS_0008
TS_0009

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PPLive/PP/MIR.dll
.dll windows:4 windows x86 arch:x86

93498cde60c05f46271d112d0131b674

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

23/09/2005, 00:00

Not After

23/09/2006, 23:59

Subject

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

14:84:30:0e:07:f4:d4:a4:37:fd:24:33:9f:9a:7a:6d:3f:da:dd:95
Signer

Actual PE Digest

14:84:30:0e:07:f4:d4:a4:37:fd:24:33:9f:9a:7a:6d:3f:da:dd:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTickCount
GetProcAddress
LoadLibraryA
OutputDebugStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
GetLastError
CreateFileMappingA
OpenFileMappingA
CloseHandle
MapViewOfFile
UnmapViewOfFile
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
FlushFileBuffers
LCMapStringW
LCMapStringA
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
RtlUnwind
GetCommandLineA
GetVersion
HeapFree
RaiseException
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
FatalAppExitA
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
UnhandledExceptionFilter
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP
GetOEMCP
SetConsoleCtrlHandler
SetStdHandle
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
SetEnvironmentVariableA

user32

PostMessageA
wsprintfA

ws2_32

inet_addr
gethostbyname
WSAGetLastError
htons
ntohs
gethostname

rpcrt4

UuidFromStringA

Exports

Exports

TS_XXXX

Sections

.text
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PPLive/PP/MUL.DLL
.dll windows:4 windows x86 arch:x86

2f0dd867954be99030bbe38f0364b509

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

23/09/2005, 00:00

Not After

23/09/2006, 23:59

Subject

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

db:9f:be:6c:e4:78:79:c6:39:4e:d8:ac:59:6d:4b:7e:c7:87:36:90
Signer

Actual PE Digest

db:9f:be:6c:e4:78:79:c6:39:4e:d8:ac:59:6d:4b:7e:c7:87:36:90

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
GetCurrentProcessId
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
CloseHandle
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
Sleep
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
HeapSize

ws2_32

inet_addr
htons
inet_ntoa

rpcrt4

UuidToStringA

Exports

Exports

TS_XXXX

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PPLive/PP/TEN.dll
.dll windows:4 windows x86 arch:x86

c4942e20d957cfea76a763743e67b8ab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
CloseHandle
EnterCriticalSection
GetTickCount
GetModuleFileNameA
GetLocalTime
GetLastError
CreateThread
CancelIo
TerminateThread
GetVersionExA
GetModuleHandleA
CreateEventA
WaitForSingleObject
SetEvent
WaitForMultipleObjects
CreateIoCompletionPort
GetSystemInfo
PostQueuedCompletionStatus
GetQueuedCompletionStatus
GetProcAddress
LoadLibraryA
InterlockedIncrement
InterlockedDecrement
HeapFree
HeapAlloc
HeapCreate
GetCurrentProcessId
SetEndOfFile
CreateFileA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
SetStdHandle
GetOEMCP
GetACP
LCMapStringW
LCMapStringA
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
SetFilePointer
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ReadFile
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapDestroy
HeapSize
Sleep
InterlockedExchange
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetCommandLineA
GetVersion
RaiseException
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc

user32

PeekMessageA
PostThreadMessageA
DestroyWindow
RegisterClassExA
CreateWindowExA
GetMessageA

iphlpapi

GetIfTable
GetIpAddrTable
SetTcpEntry

ws2_32

WSAEnumNetworkEvents
WSACancelAsyncRequest
WSACleanup
WSAStartup
WSACloseEvent
getsockname
shutdown
closesocket
getpeername
listen
WSAWaitForMultipleEvents
gethostbyname
WSAEventSelect
connect
WSAGetLastError
WSASocketA
setsockopt
htons
htonl
bind
inet_addr
WSASetLastError
WSACreateEvent
WSAAsyncGetHostByName
WSASend
WSASendTo
WSARecvFrom
WSAGetOverlappedResult
WSAAccept
WSARecv

shlwapi

PathRemoveFileSpecA

Exports

Exports

TS_XXXX

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 567KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PPLive/PPLive.exe
.exe windows:4 windows x86 arch:x86

d9fb0ca3dd7c29a3020587453f70d7de

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

23/09/2005, 00:00

Not After

23/09/2006, 23:59

Subject

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

23:e7:6f:38:00:cc:3e:8f:b6:be:ea:9f:1c:e6:48:50:21:4c:0e:7a
Signer

Actual PE Digest

23:e7:6f:38:00:cc:3e:8f:b6:be:ea:9f:1c:e6:48:50:21:4c:0e:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrIW
PathAppendW
PathRemoveFileSpecW

mfc42u

ord4401
ord5237
ord2377
ord5157
ord6370
ord4347
ord5286
ord3793
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord5273
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4621
ord4418
ord3605
ord567
ord656
ord4270
ord2371
ord2855
ord6195
ord3871
ord1941
ord818
ord3792
ord2144
ord1134
ord6211
ord5977
ord1937
ord6193
ord6375
ord1258
ord2225
ord613
ord289
ord3084
ord3087
ord6871
ord283
ord2746
ord3215
ord4312
ord4282
ord755
ord470
ord3397
ord556
ord809
ord4294
ord6354
ord2810
ord1088
ord2114
ord1230
ord1165
ord6597
ord2567
ord4390
ord3569
ord609
ord4279
ord5047
ord4768
ord6266
ord4155
ord5261
ord4370
ord4847
ord4992
ord2506
ord6048
ord1767
ord5276
ord4419
ord3592
ord641
ord324
ord2127
ord2294
ord4229
ord6376
ord4704
ord1197
ord2445
ord925
ord3716
ord795
ord2680
ord5798
ord3491
ord6451
ord3693
ord765
ord5949
ord1130
ord2637
ord4219
ord690
ord1980
ord5351
ord5804
ord1075
ord5198
ord3224
ord1225
ord389
ord2362
ord3523
ord6090
ord4029
ord927
ord1826
ord4744
ord5010
ord4369
ord4846
ord355
ord4224
ord5228
ord1177
ord1173
ord1561
ord5264
ord4828
ord4602
ord4710
ord1768
ord4629
ord5061
ord3706
ord783
ord1787
ord1833
ord4583
ord4582
ord4893
ord4364
ord4886
ord4527
ord5070
ord4334
ord4341
ord4883
ord4525
ord4539
ord4537
ord4520
ord4523
ord4518
ord4957
ord4954
ord4103
ord6050
ord5236
ord3743
ord1718
ord5256
ord2083
ord4426
ord364
ord784
ord4236
ord5031
ord4714
ord2078
ord5277
ord2350
ord2293
ord2287
ord2356
ord3915
ord6330
ord2403
ord2015
ord4213
ord2570
ord4392
ord3577
ord802
ord616
ord542
ord2281
ord2291
ord3312
ord6565
ord5597
ord1086
ord3494
ord3626
ord683
ord3221
ord4803
ord1808
ord2634
ord4667
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5710
ord4616
ord3733
ord815
ord561
ord2613
ord1131
ord1196
ord1244
ord801
ord6921
ord6919
ord5706
ord2717
ord5285
ord4118
ord6237
ord541
ord1569
ord562
ord860
ord3865
ord3016
ord3701
ord2104
ord6373
ord2706
ord922
ord6655
ord6122
ord5857
ord6139
ord6105
ord291
ord713
ord5855
ord414
ord937
ord835
ord1763
ord857
ord6865
ord6191
ord4470
ord4450
ord3516
ord3517
ord3393
ord3728
ord810
ord5274
ord3490
ord3808
ord2836
ord2099
ord326
ord4266
ord2290
ord1921
ord3633
ord6466
ord1151
ord1105
ord665
ord1971
ord2385
ord6381
ord5349
ord5352
ord1256
ord5180
ord354
ord5777
ord4073
ord6051
ord6379
ord5436
ord6390
ord5446
ord472
ord537
ord1192
ord2745
ord2444
ord536
ord5852
ord4197
ord2756
ord1614
ord4292
ord4128
ord5783
ord942
ord941
ord940
ord2910
ord5568
ord1143
ord1637
ord1172
ord554
ord2112
ord4158
ord3284
ord2004
ord2915
ord807
ord538
ord5856
ord2400
ord2088
ord2859
ord2397
ord323
ord1633
ord5781
ord6190
ord640
ord3591
ord5860
ord6057
ord5567
ord5575
ord5732
ord5674
ord5790
ord5785
ord5869
ord6168
ord6017
ord6185
ord4324
ord6182
ord5752
ord6188
ord5755
ord2966
ord3614
ord1634
ord858
ord2606
ord5784
ord2559
ord2406
ord5679
ord4272
ord2755
ord4124
ord5871
ord3621
ord3688
ord3568
ord3566
ord2854
ord5602
ord2858
ord4078
ord6138
ord823
ord2430
ord3658
ord3649
ord2576
ord4215
ord1854
ord825
ord500
ord3696
ord772
ord540
ord861
ord535
ord800
ord686
ord384
ord4601
ord816

msvcrt

fclose
_controlfp
??1type_info@@UAE@XZ
free
memset
malloc
__CxxFrameHandler
_EH_prolog
wcscpy
wcslen
_ftol
wcscmp
memcpy
memmove
wcsncpy
rand
_wtol
_wcsicmp
sprintf
wcscat
_CxxThrowException
srand
strlen
swprintf
_wtoi
swscanf
fwrite
fopen
isspace
isalnum
wcstoul
atoi
tolower
isupper
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
__dllonexit
_onexit
?terminate@@YAXXZ

kernel32

MultiByteToWideChar
GetVersion
GetVersionExW
lstrlenA
GetCPInfo
LockResource
LoadResource
FindResourceW
lstrcmpiW
lstrlenW
lstrcpyW
MulDiv
LoadLibraryW
GetWindowsDirectoryW
GetProcAddress
GetLastError
FreeLibrary
GetModuleFileNameW
GetTempPathW
CloseHandle
CreateProcessW
InitializeCriticalSection
CreateEventW
DeleteCriticalSection
SetEvent
LeaveCriticalSection
EnterCriticalSection
CreateThread
GetCurrentThreadId
WaitForSingleObject
CreateEventA
GetCurrentProcessId
GetTickCount
WideCharToMultiByte
OpenEventW
GetCommandLineW
GlobalFree
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
CreateDirectoryW
SetProcessWorkingSetSize
GetCurrentProcess
GetPrivateProfileStringA
DeleteFileW
GetModuleHandleW
GetStartupInfoW
GetACP

user32

SetFocus
IsWindowEnabled
GetFocus
DestroyMenu
TrackPopupMenuEx
LoadIconW
GetSystemMenu
DrawIcon
IsIconic
MessageBoxW
IsWindowVisible
GetWindow
GetWindowTextW
LoadAcceleratorsW
SetForegroundWindow
EnumWindows
ModifyMenuW
UnregisterHotKey
GetNextDlgGroupItem
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetWindowRgn
RegisterHotKey
GetTopWindow
SetWindowLongW
IsChild
MessageBeep
GetMenuItemInfoW
SetWindowRgn
GetIconInfo
DrawStateW
DrawFocusRect
PostMessageW
WindowFromPoint
GetActiveWindow
GetNextDlgTabItem
GetClassNameW
GetWindowLongW
DestroyCursor
ClientToScreen
SubtractRect
GetCapture
GetCursorPos
ScreenToClient
SetCursor
EqualRect
ReleaseCapture
PtInRect
OffsetRect
SetCapture
LoadCursorW
IsRectEmpty
IntersectRect
UpdateWindow
InflateRect
FrameRect
SetRectEmpty
SetActiveWindow
GetWindowRect
RedrawWindow
GetClientRect
GetParent
IsWindow
SendMessageW
EnableWindow
InvalidateRect
LoadImageW
GrayStringW
DrawTextW
TabbedTextOutW
GetMenuItemCount
InsertMenuW
AppendMenuW
GetSubMenu
RemoveMenu
LoadBitmapW
CopyIcon
CheckMenuItem
LoadMenuW
DrawFrameControl
GetSysColorBrush
GetMenuStringW
CreateMenu
GetMessagePos
KillTimer
IsMenu
SetTimer
GetSystemMetrics
CreatePopupMenu
GetMenuItemID
IsZoomed
GetMenuState
GetDesktopWindow
GetDC
ReleaseDC
DrawIconEx
DestroyIcon
SystemParametersInfoW
GetSysColor
CopyRect
FillRect
DrawEdge
TranslateAcceleratorW
SetRect

gdi32

CreateFontW
GetRgnBox
CreateRectRgn
CreateRectRgnIndirect
SetRectRgn
ExtCreateRegion
CombineRgn
GetDIBits
SetBkColor
SetTextColor
GetStockObject
CreateBitmap
MaskBlt
GetGlyphOutlineW
StretchDIBits
StretchBlt
SetBkMode
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
PatBlt
GetObjectW
GetPixel
SetPixel
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
Ellipse
GetTextExtentPoint32W
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontIndirectW
CreateSolidBrush
CreatePen
GetDeviceCaps
GetBkMode

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

SHBrowseForFolderW
ShellExecuteW
SHGetMalloc
Shell_NotifyIconW
ShellExecuteExW
SHGetPathFromIDListW

comctl32

ImageList_GetImageCount
ImageList_Draw
_TrackMouseEvent
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_GetIcon

oleaut32

SysAllocString
SysFreeString
VariantClear

wsock32

inet_addr
gethostbyname
gethostname
ioctlsocket

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z

winmm

PlaySoundW

Sections

.text
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PPLive/PPlist.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 211KB - Virtual size: 540KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 73KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 34KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PPLive/ReadMe.Txt
PPLive/SynacastEWA.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

84f1e8d96c5645713003d6074b8d2f1e

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

23/09/2005, 00:00

Not After

23/09/2006, 23:59

Subject

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:d3:98:4e:e8:64:9b:a7:5d:26:d7:45:9d:e5:30:c8:46:70:29:a0
Signer

Actual PE Digest

0b:d3:98:4e:e8:64:9b:a7:5d:26:d7:45:9d:e5:30:c8:46:70:29:a0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42u

ord5047
ord3871
ord5871
ord613
ord289
ord4155
ord538
ord858
ord927
ord535
ord861
ord922
ord6868
ord940
ord5261
ord4370
ord4847
ord4992
ord2506
ord6048
ord1767
ord5276
ord4419
ord3592
ord641
ord324
ord4229
ord5491
ord4704
ord4037
ord3211
ord4273
ord6654
ord2127
ord2294
ord4124
ord6237
ord6195
ord3087
ord541
ord801
ord2559
ord6375
ord925
ord2855
ord2078
ord2057
ord6139
ord6874
ord802
ord542
ord2680
ord1131
ord5571
ord433
ord6565
ord5706
ord6655
ord3491
ord5618
ord4199
ord3701
ord283
ord6638
ord6107
ord6330
ord690
ord1980
ord5351
ord5804
ord1075
ord5198
ord3224
ord1225
ord389
ord815
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord3396
ord4616
ord3665
ord561
ord3947
ord2716
ord6350
ord1213
ord6466
ord1224
ord3452
ord6038
ord1869
ord4244
ord2478
ord2679
ord6360
ord3321
ord6361
ord4466
ord5494
ord3273
ord3348
ord3676
ord446
ord743
ord1174
ord4001
ord3253
ord2719
ord2722
ord2721
ord1223
ord1207
ord2431
ord1686
ord5614
ord994
ord4336
ord4681
ord4633
ord5670
ord2148
ord4850
ord4914
ord5998
ord2129
ord1955
ord5207
ord2948
ord3863
ord5144
ord4699
ord4701
ord2871
ord2993
ord5645
ord4108
ord4655
ord4654
ord4762
ord4644
ord4897
ord4542
ord4515
ord4588
ord4982
ord4919
ord4924
ord4929
ord4653
ord4903
ord4902
ord4662
ord4661
ord4660
ord4642
ord4270
ord5017
ord4648
ord4637
ord4348
ord4774
ord4643
ord4631
ord4630
ord5054
ord4578
ord4365
ord4355
ord4350
ord4733
ord4735
ord4732
ord4403
ord4597
ord5002
ord4409
ord4279
ord4973
ord2480
ord3399
ord4533
ord4528
ord2949
ord2376
ord6366
ord2978
ord3143
ord3255
ord4460
ord2981
ord3075
ord4076
ord4618
ord5821
ord723
ord3941
ord423
ord5310
ord5330
ord2533
ord4943
ord1594
ord6026
ord4453
ord5027
ord2787
ord6374
ord6376
ord6266
ord1884
ord4247
ord1209
ord4564
ord4666
ord4837
ord5005
ord4707
ord6367
ord5282
ord4432
ord3274
ord4619
ord449
ord746
ord2270
ord1863
ord4524
ord5681
ord3269
ord3574
ord439
ord736
ord3231
ord4517
ord4078
ord1937
ord4522
ord4536
ord4538
ord4519
ord2745
ord4142
ord5142
ord816
ord6213
ord562
ord2706
ord1941
ord4029
ord3614
ord713
ord6137
ord414
ord5777
ord5855
ord5446
ord6390
ord5436
ord6379
ord1921
ord942
ord5568
ord2910
ord4028
ord384
ord686
ord772
ord3696
ord500
ord1854
ord4215
ord2576
ord3649
ord2430
ord6138
ord2858
ord5602
ord3568
ord3688
ord2755
ord4272
ord5679
ord5784
ord2606
ord2088
ord2400
ord5856
ord1172
ord807
ord2915
ord2004
ord4158
ord2112
ord554
ord1637
ord941
ord5783
ord4128
ord4292
ord2444
ord1192
ord1129
ord1115
ord1173
ord1568
ord1570
ord1179
ord342
ord1240
ord1194
ord1563
ord1248
ord1250
ord1571
ord600
ord826
ord269
ord809
ord609
ord567
ord3397
ord2566
ord556
ord3567
ord4418
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord6370
ord5157
ord2377
ord5237
ord3569
ord2567
ord6597
ord1165
ord1230
ord818
ord3737
ord540
ord2810
ord800
ord823
ord4294
ord6211
ord3792
ord6871
ord790
ord3711
ord6451
ord3084
ord2859
ord5977
ord6193
ord6017
ord6190
ord2746
ord3591
ord5860
ord6057
ord5567
ord5575
ord5732
ord5674
ord5790
ord5785
ord5869
ord6168
ord6185
ord4324
ord6182
ord5752
ord6188
ord5755
ord2966
ord470
ord755
ord795
ord3716
ord4401
ord2114
ord1088
ord6354
ord2854
ord4986
ord2371
ord4390
ord1768
ord4073
ord6051
ord2397
ord1143
ord1634
ord2406
ord3658
ord3621
ord825
ord323
ord1633
ord5781
ord640
ord4683
ord3566
ord1128

msvcrt

memcmp
strcmp
islower
toupper
atoi
time
strlen
wcscpy
wcsncpy
wcslen
_ftol
abs
_EH_prolog
__CxxFrameHandler
memset
strcpy
sprintf
wcscmp
fclose
swprintf
fputws
_wfopen
_wtol
wcstoul
_wcsicmp
fgetws
wcscat
memcpy
rand
srand
memmove
_snprintf
_purecall
fprintf
fread
ftell
fseek
fopen
fputc
fputs
isalpha
isalnum
isspace
strncmp
strchr
tolower
free
malloc
__dllonexit
_onexit
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ

kernel32

LocalFree
lstrcmpiW
FindResourceW
LoadResource
LockResource
GetCPInfo
GetVersion
GetVersionExW
lstrcpyW
lstrcatW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetTickCount
GetCurrentThreadId
GetLastError
GetWindowsDirectoryW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
OutputDebugStringW
GlobalLock
GlobalUnlock
FreeLibrary
GetModuleFileNameW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
LoadLibraryW
GetProcAddress
GetCurrentProcessId
ResetEvent
DeleteFileW
Sleep
GetACP
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
CreateEventW
CreateThread
SetEvent
WaitForSingleObject
TerminateThread
CloseHandle
LocalAlloc

user32

GetSysColorBrush
GetMenuStringW
CreateMenu
CreatePopupMenu
GetMenuItemID
ModifyMenuW
AppendMenuW
GetSystemMetrics
GetDesktopWindow
DrawIconEx
DrawEdge
GetMenuItemInfoW
PeekMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
GetMessagePos
MessageBeep
SubtractRect
GetWindow
RedrawWindow
GetMenuItemCount
EnableMenuItem
EnableWindow
SendMessageW
InvalidateRect
CheckMenuItem
UnhookWindowsHookEx
IsChild
CallNextHookEx
SetWindowsHookExW
RegisterClipboardFormatW
IsWindowVisible
UpdateWindow
ReleaseDC
GetDC
SetCursor
OffsetRect
GetWindowRect
GetCursorPos
DrawFocusRect
TabbedTextOutW
GetKeyState
GetParent
PostMessageW
SetCapture
GetClientRect
LoadBitmapW
CopyRect
PtInRect
LoadCursorW
ScreenToClient
CopyIcon
SystemParametersInfoW
SetForegroundWindow
mouse_event
KillTimer
SetTimer
SetRect
IsWindow
LoadImageW
GetSysColor
FillRect
DrawStateW
InflateRect
GetSubMenu
DrawTextW
GrayStringW
ReleaseCapture
ClientToScreen
DestroyMenu
DestroyCursor
DestroyIcon
GetWindowLongW
GetNextDlgTabItem
GetActiveWindow
WindowFromPoint
TrackPopupMenuEx

gdi32

TextOutW
ExtTextOutW
Escape
GetPixel
CreateBitmap
GetStockObject
DeleteObject
DeleteDC
SetTextColor
SetBkColor
SelectObject
SetPixel
GetTextExtentPoint32W
FillRgn
CombineRgn
CreateRectRgnIndirect
RectVisible
CreateDIBSection
MaskBlt
CreateFontIndirectW
RealizePalette
SelectPalette
SetMapMode
SetBitmapDimensionEx
CreateDCW
GetDeviceCaps
GetBkMode
CreatePen
CreateSolidBrush
Ellipse
PatBlt
PtVisible
LPtoDP
GetMapMode
GetWindowExtEx
GetViewportExtEx
DPtoLP
GetBkColor
CreateCompatibleBitmap
BitBlt
StretchBlt
CreateCompatibleDC
GetObjectW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

ShellExecuteW
ShellExecuteExW

comctl32

ImageList_GetIcon
_TrackMouseEvent
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_Draw
ImageList_GetImageCount

ole32

CoUninitialize
CoCreateInstance
StringFromGUID2
CoCreateGuid
CoInitialize

oleaut32

LoadRegTypeLi

shlwapi

PathFileExistsW
PathFindExtensionW
PathRemoveExtensionW
PathStripPathW
PathRemoveFileSpecW
PathAppendW
StrStrIA
StrStrIW

winmm

PlaySoundW

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADPADD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

rpcrt4

UuidFromStringA
UuidToStringA

ws2_32

inet_addr
gethostbyname
gethostname
inet_ntoa

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PPLive/SynacastList.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

ca7448b6d42d95ed6e2468e411b37df3

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

23/09/2005, 00:00

Not After

23/09/2006, 23:59

Subject

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

84:c9:3a:52:07:06:cc:fa:25:60:4c:a4:7d:7b:0a:d5:56:14:55:f3
Signer

Actual PE Digest

84:c9:3a:52:07:06:cc:fa:25:60:4c:a4:7d:7b:0a:d5:56:14:55:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42u

ord2858
ord4768
ord3491
ord2440
ord5830
ord5446
ord6390
ord4272
ord2036
ord609
ord795
ord4983
ord4920
ord4925
ord4930
ord3348
ord3574
ord729
ord2496
ord613
ord640
ord3253
ord2444
ord5781
ord1633
ord323
ord289
ord1699
ord430
ord941
ord4370
ord5276
ord2567
ord4390
ord3569
ord6051
ord1768
ord3397
ord3716
ord567
ord2293
ord2362
ord5949
ord6195
ord2855
ord6038
ord3452
ord1869
ord2478
ord2679
ord4244
ord2078
ord5491
ord1088
ord2114
ord4453
ord5027
ord4496
ord4754
ord3016
ord4078
ord5884
ord4759
ord283
ord2746
ord4037
ord3211
ord2787
ord6354
ord942
ord4729
ord4737
ord4990
ord4782
ord5977
ord3194
ord4002
ord1698
ord4524
ord5681
ord3269
ord439
ord736
ord3231
ord4517
ord1937
ord4522
ord4536
ord4538
ord4519
ord3737
ord3792
ord3810
ord1105
ord537
ord2756
ord3517
ord3915
ord815
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord3396
ord3665
ord561
ord3947
ord2716
ord6350
ord1213
ord1224
ord6360
ord3321
ord6361
ord4466
ord5494
ord3273
ord3676
ord446
ord743
ord1174
ord4001
ord1223
ord1207
ord2431
ord1686
ord5614
ord994
ord4336
ord4681
ord4633
ord5670
ord2148
ord4850
ord4914
ord5998
ord2129
ord1955
ord5207
ord2948
ord3863
ord5144
ord4699
ord4701
ord2871
ord2993
ord5645
ord4108
ord4655
ord4654
ord4762
ord4644
ord4897
ord4542
ord4515
ord4588
ord4982
ord4919
ord4924
ord4929
ord4653
ord4903
ord4902
ord4662
ord4661
ord4660
ord4642
ord4683
ord5017
ord4648
ord4637
ord4348
ord4774
ord4643
ord4631
ord4630
ord5054
ord4578
ord4365
ord4355
ord4350
ord4733
ord4735
ord4732
ord4403
ord4597
ord5002
ord4409
ord4986
ord4973
ord2480
ord3399
ord4533
ord2949
ord2376
ord6366
ord2978
ord3143
ord3255
ord4460
ord2981
ord3075
ord4076
ord4618
ord5821
ord5059
ord723
ord3941
ord556
ord423
ord5329
ord2533
ord6655
ord4943
ord1884
ord4247
ord1209
ord4564
ord4666
ord4837
ord5005
ord4707
ord6367
ord5282
ord4432
ord2538
ord4619
ord449
ord746
ord2270
ord4124
ord2755
ord3693
ord765
ord4270
ord3701
ord755
ord6168
ord5777
ord470
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6017
ord5869
ord5785
ord5790
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord3591
ord6190
ord818
ord1263
ord1229
ord2144
ord5784
ord2559
ord3568
ord6193
ord6375
ord1836
ord2572
ord3625
ord3614
ord4394
ord682
ord2631
ord4128
ord4292
ord3084
ord472
ord1891
ord2857
ord5047
ord1258
ord6900
ord6712
ord5436
ord6379
ord6771
ord6640
ord4583
ord4582
ord4893
ord4364
ord4886
ord5070
ord4335
ord4343
ord4884
ord4525
ord4539
ord4537
ord4520
ord4523
ord4518
ord4958
ord4955
ord4103
ord5236
ord3743
ord1719
ord4426
ord813
ord560
ord5256
ord4717
ord4268
ord1941
ord3687
ord2085
ord2854
ord3749
ord2081
ord6456
ord816
ord6871
ord562
ord2706
ord5787
ord4118
ord3605
ord656
ord2070
ord3871
ord2403
ord2015
ord4213
ord2570
ord4392
ord616
ord6437
ord5706
ord4197
ord2836
ord2099
ord1821
ord4155
ord2072
ord2225
ord4040
ord1794
ord772
ord3696
ord500
ord1854
ord4215
ord2576
ord3649
ord2430
ord6138
ord5602
ord3688
ord5679
ord2397
ord2400
ord5856
ord3981
ord1172
ord807
ord2915
ord2004
ord3284
ord4158
ord2112
ord554
ord1637
ord5783
ord1614
ord5852
ord2745
ord1192
ord2914
ord6865
ord6868
ord6279
ord4199
ord6918
ord6278
ord3750
ord1912
ord1129
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord4347
ord5157
ord6597
ord5286
ord6451
ord6398
ord1115
ord1173
ord1568
ord1570
ord1179
ord342
ord1240
ord1194
ord1563
ord1248
ord1250
ord1571
ord600
ord826
ord269
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4847
ord5261
ord538
ord1243
ord291
ord2608
ord5887
ord6105
ord354
ord5180
ord665
ord858
ord536
ord2910
ord5568
ord927
ord925
ord940
ord2721
ord2722
ord6466
ord2719
ord3998
ord6654
ord4273
ord3133
ord6266
ord6370
ord2810
ord4704
ord4282
ord3516
ord4279
ord2371
ord4294
ord4219
ord6211
ord389
ord1225
ord3224
ord5198
ord1075
ord1074
ord5804
ord5352
ord5351
ord2606
ord5349
ord6006
ord6381
ord2385
ord1971
ord1980
ord690
ord4229
ord2294
ord324
ord1165
ord922
ord861
ord641

msvcrt

atol
_waccess
strchr
strcmp
toupper
islower
wcscpy
free
wcsncpy
swscanf
memmove
_snprintf
_purecall
wcscat
strcpy
wcscmp
wcslen
strlen
memcmp
atoi
_ftol
_CxxThrowException
_wtol
wcsstr
wcschr
memcpy
memset
__CxxFrameHandler
_wcsdup
fprintf
fread
fclose
ftell
fseek
fopen
fputc
fputs
isalpha
isalnum
isspace
strncmp
tolower
wcspbrk
swprintf
_wtoi
iswdigit
wcstoul
malloc
??1type_info@@UAE@XZ
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_initterm
_adjust_fdiv

kernel32

LocalFree
GetVersionExA
GetWindowsDirectoryW
MulDiv
lstrcpyW
lstrcatW
WinExec
LoadLibraryExW
lstrcmpiW
FindResourceW
LoadResource
LockResource
GetCPInfo
GetVersion
GetVersionExW
GetLastError
GetModuleHandleW
GetPrivateProfileIntW
GetLocalTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetSystemTime
LoadLibraryW
GetProcAddress
FreeLibrary
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
IsBadReadPtr
lstrlenA
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
WaitForSingleObject
TerminateThread
CloseHandle
CreateThread
GetModuleFileNameW
CreateDirectoryW
SystemTimeToFileTime
SetFileTime
GetFileAttributesExW
FileTimeToSystemTime
GetACP
GetModuleHandleA
HeapAlloc
GetProcessHeap
HeapFree
LocalAlloc

user32

IsWindow
SetTimer
SendMessageW
GetSysColor
CopyRect
LoadBitmapW
InvalidateRect
PtInRect
IsRectEmpty
OffsetRect
GetFocus
GetWindowTextW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
RedrawWindow
LoadIconW
GetTopWindow
ReleaseCapture
ScreenToClient
GetCursorPos
UpdateWindow
GetKeyState
SetRect
GetClassNameW
ChildWindowFromPoint
IsWindowEnabled
ModifyMenuW
GetMenuState
DestroyCursor
CopyIcon
CreateIconIndirect
GetIconInfo
GetMenuStringW
RemoveMenu
GetSysColorBrush
CreateMenu
RegisterClipboardFormatW
SetRectEmpty
GetClientRect
TabbedTextOutW
PostMessageW
GetParent
BringWindowToTop
DrawTextW
GrayStringW
CreatePopupMenu
InsertMenuW
AppendMenuW
GetDesktopWindow
DrawIconEx
DestroyIcon
SystemParametersInfoW
GetMenuItemInfoW
WindowFromPoint
EqualRect
DragDetect
DrawEdge
ShowScrollBar
SetMenuDefaultItem
GetMenuItemID
GetMenuItemCount
GetSubMenu
EnableWindow
IsChild
SetFocus
IsMenu
EnumWindows
KillTimer
GetWindow
LoadCursorW
DefWindowProcW
GetClassInfoW
IntersectRect
DrawFrameControl
DrawFocusRect
IsWindowVisible
GetDC
ReleaseDC
LoadImageW
GetWindowLongW
SetCapture
GetCapture
GetClipCursor
ClipCursor
SetCursor
GetSystemMetrics
ClientToScreen
InvertRect
GetWindowRect
FillRect
SetWindowRgn
GetPropA
SendMessageA
CreateWindowExA
SetWindowLongA
SetPropA
GetWindowLongA
GetScrollInfo
EnableScrollBar
SetWindowPos
SetScrollInfo
RemovePropA
GetWindowDC
CallWindowProcA
MapWindowPoints
FrameRect
WindowFromDC
GetMessagePos
InflateRect
GetForegroundWindow

gdi32

CreateFontIndirectW
GetTextMetricsW
CreateHalftonePalette
CreatePalette
GetDIBColorTable
GetBkColor
RealizePalette
GetDeviceCaps
GetBkMode
CreatePen
Ellipse
DeleteDC
CreateDIBSection
SetPixel
GetPixel
PatBlt
GetObjectW
CreateBitmap
SetTextColor
LineTo
MoveToEx
CreateDCW
SetBkColor
SetBkMode
SetTextJustification
FrameRgn
SelectClipRgn
FillRgn
OffsetRgn
CreateRoundRectRgn
GetTextExtentPoint32W
CreatePolygonRgn
CombineRgn
CreateSolidBrush
GetCurrentObject
StretchBlt
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
BitBlt
CreateRectRgn
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
ExtTextOutA
UnrealizeObject
SetBrushOrgEx
CreatePatternBrush
IntersectClipRect
GetObjectA
PlayEnhMetaFile
SetWindowOrgEx
SelectObject
GetStockObject

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueW
RegQueryValueExW

shell32

ShellExecuteW

comctl32

ImageList_GetIcon
ImageList_Draw
ImageList_ReplaceIcon
ImageList_AddMasked
ImageList_GetImageInfo
ImageList_GetImageCount
ord17
_TrackMouseEvent
InitCommonControlsEx

ole32

CoTaskMemAlloc
StringFromGUID2
CoCreateInstance

oleaut32

LoadRegTypeLi
OleLoadPicturePath

urlmon

URLDownloadToFileW

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

rpcrt4

UuidFromStringA
UuidToStringW
UuidFromStringW
RpcStringFreeW

msimg32

GradientFill

shlwapi

PathAppendW
PathRemoveFileSpecW
StrStrIA

wininet

InternetTimeFromSystemTimeW
InternetTimeToSystemTimeW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 252KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PPLive/XML/ChannelList.xml
.xml
PPLive/common.dll
.dll windows:4 windows x86 arch:x86

4af413a6eee4fec07c0985b05516f3f9

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

23/09/2005, 00:00

Not After

23/09/2006, 23:59

Subject

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b8:e0:4c:39:35:55:f8:01:52:29:8b:0e:38:be:c2:15:1d:1c:6d:20
Signer

Actual PE Digest

b8:e0:4c:39:35:55:f8:01:52:29:8b:0e:38:be:c2:15:1d:1c:6d:20

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42u

ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord3948
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4616
ord4418
ord3733
ord561
ord825
ord815
ord823
ord3579
ord543
ord803
ord698
ord800
ord861
ord2388
ord540
ord668
ord3176
ord2773
ord2762
ord356
ord858
ord925
ord1165
ord6466
ord911
ord398
ord913
ord4182
ord6279
ord6278
ord4273
ord2755
ord5461
ord798
ord5444
ord532
ord3432
ord4184
ord5588
ord6868
ord1173
ord1568
ord1570
ord1179
ord342
ord1240
ord1194
ord1563
ord1248
ord1250
ord1571
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord396
ord4269
ord600
ord826
ord269
ord1115

msvcrt

__CxxFrameHandler
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
_wtol
wcscmp

kernel32

LocalFree
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LocalAlloc

shlwapi

PathRemoveFileSpecW

Exports

Exports

GetLanguageResW

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PPLive/下载说明.htm
.html .js polyglot
PPLive/卸载.bat
PPLive/绿化.bat
PPLive/非常世纪资源网.url
.url

Sharing

General

Malware Config

Signatures

Files

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0aCertificate

Extended Key Usages

Key Usages

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1Certificate

Extended Key Usages

Key Usages

8d:11:4f:3c:6e:d2:11:a8:10:0c:bf:59:92:cf:89:b4:55:49:fa:aeSigner

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 68KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 1024B - Virtual size: 12KB

.reloc Size: 3KB - Virtual size: 8KB

.aspack Size: 4KB - Virtual size: 8KB

.adata Size: - Virtual size: 4KB

06360b8a176e4358699ff162d040df3b

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0aCertificate

Extended Key Usages

Key Usages

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1Certificate

Extended Key Usages

Key Usages

41:ae:df:f5:9a:8d:ac:f7:3c:6f:25:e2:5c:4f:ba:38:28:21:f6:1eSigner

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 66KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 16KB - Virtual size: 29KB

.rsrc Size: 4KB - Virtual size: 912B

.reloc Size: 8KB - Virtual size: 5KB

4d2cdd36d9426ae3098ceb76eb125167

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0aCertificate

Extended Key Usages

Key Usages

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1Certificate

Extended Key Usages

Key Usages

2b:9f:21:33:07:e3:d9:06:56:21:b0:59:7f:00:7e:1c:88:6b:17:fdSigner

Headers

File Characteristics

Imports

rpcrt4

ws2_32

ole32

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

8d:11:4f:3c:6e:d2:11:a8:10:0c:bf:59:92:cf:89:b4:55:49:fa:ae
Signer

.text
Size: 32KB - Virtual size: 68KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 1024B - Virtual size: 12KB

.reloc
Size: 3KB - Virtual size: 8KB

.aspack
Size: 4KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

41:ae:df:f5:9a:8d:ac:f7:3c:6f:25:e2:5c:4f:ba:38:28:21:f6:1e
Signer

.text
Size: 68KB - Virtual size: 66KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 16KB - Virtual size: 29KB

.rsrc
Size: 4KB - Virtual size: 912B

.reloc
Size: 8KB - Virtual size: 5KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

2b:9f:21:33:07:e3:d9:06:56:21:b0:59:7f:00:7e:1c:88:6b:17:fd
Signer

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 888B

.reloc
Size: 8KB - Virtual size: 4KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

a4:0d:16:25:8b:c9:01:37:1d:f0:03:17:91:54:5d:b0:25:5b:40:a9
Signer

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 16KB - Virtual size: 47KB

.rsrc
Size: 4KB - Virtual size: 904B

.reloc
Size: 8KB - Virtual size: 5KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

6d:c9:83:68:62:49:9c:49:6b:a8:b5:36:8c:4f:21:d1
Certificate

14:84:30:0e:07:f4:d4:a4:37:fd:24:33:9f:9a:7a:6d:3f:da:dd:95
Signer

.text
Size: 184KB - Virtual size: 183KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 16KB - Virtual size: 20KB

.reloc
Size: 12KB - Virtual size: 9KB