0d1e8472efebc24f68041336e5a7b406_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0d1e8472efebc24f68041336e5a7b406_JaffaCakes118
Size

2.0MB
MD5

0d1e8472efebc24f68041336e5a7b406
SHA1

ee1e043619ddb73512d0871f5c49760d409a4553
SHA256

71446ba744f01c41d23db10576a6d1e8e5431cca898c6d4fc99e2b7cbd6a72e9
SHA512

b4ff6efb8448f5d0c40bf4a0460e4893c2cb811b495b93137eb15c401d9f921db2b7654f5e45a2ac1547dc2dadbccabc02730c8b7aea8c4d222614c8a59fa348
SSDEEP

49152:wE6VuJDpgfqGs0W2/kxMxQwOVy+1c4tjW7del+9j:+Vgiqd2/n1gyatjWBeWj

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/CoCode.dll	acprotect
static1/unpack001/updateC2.ocx	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/CoCode.dll	upx
static1/unpack001/updateC2.ocx	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack002/out.upx
unpack003/out.upx

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

0d1e8472efebc24f68041336e5a7b406_JaffaCakes118
.exe windows:4 windows x86 arch:x86

170729c4965736ee8f8f4d1bab77cf38

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

37:4d:f9:a6:8c:71:46:f6:b7:94:bd:02:8f:2c:5b:21:ad:b7:12:98
Signer

Actual PE Digest

37:4d:f9:a6:8c:71:46:f6:b7:94:bd:02:8f:2c:5b:21:ad:b7:12:98

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
GetCommandLineA
CloseHandle
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
MulDiv
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SendMessageTimeoutA

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 272KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

57354bdeea3dfae6e948101add87501a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
GetPrivateProfileIntA
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
MultiByteToWideChar
GlobalAlloc

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
MapWindowPoints
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadIconA

gdi32

SetTextColor
GetObjectA
SelectObject
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
CreateCompatibleDC

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
RtlUnwind
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP

Exports

Exports

KillProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
CoCode.dll
.dll windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:be:c6:c0:7a:72:06:31:ba:4c:7f:9e:e7:bd:75:60
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

25/05/2007, 00:00

Not After

24/05/2008, 23:59

Subject

CN=UUSee Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Multimedia Dept.,O=UUSee Inc.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

41:7f:d6:05:29:13:a3:54:77:80:f5:11:64:98:cc:52:f8:f8:b9:ed
Signer

Actual PE Digest

41:7f:d6:05:29:13:a3:54:77:80:f5:11:64:98:cc:52:f8:f8:b9:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

eric
erichahaha
ericzsq
zsq
zsqeric

Sections

UPX0
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 43KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UFDeMux.ax
.dll regsvr32 windows:4 windows x86 arch:x86

786ee325c3e2aa5901e262dfaacf54dd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:89:a5:17:b7:e2:cf:12:67:39:62:bf:01:fb:ea:f6:e3:6f:5f:19
Signer

Actual PE Digest

01:89:a5:17:b7:e2:cf:12:67:39:62:bf:01:fb:ea:f6:e3:6f:5f:19

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

waveOutGetNumDevs

kernel32

CloseHandle
InterlockedExchange
SetThreadPriority
Sleep
InterlockedIncrement
InterlockedDecrement
CreateEventA
VirtualFree
GetCurrentProcess
GetCurrentThreadId
VirtualAlloc
FreeLibrary
LoadLibraryA
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetTickCount
GetLastError
GetVersionExA
CreateThread
lstrlenA
GetModuleFileNameA
DisableThreadLibraryCalls
RaiseException
HeapFree
RtlUnwind
HeapAlloc
GetCommandLineA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
ResetEvent
IsDebuggerPresent
HeapDestroy
HeapCreate
HeapReAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
WaitForSingleObject
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetUnhandledExceptionFilter
WriteFile

user32

wsprintfA

advapi32

RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteValueA
RegEnumKeyExA
RegSetValueA
RegCreateKeyA
RegDeleteKeyA
RegEnumValueA

ole32

CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoCreateInstance
StringFromGUID2
CoFreeUnusedLibraries

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UFSource.ax
.dll regsvr32 windows:4 windows x86 arch:x86

376d0c418d10c2eeaba61ca79a12d2e1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b2:d8:c9:12:95:30:01:63:5b:86:3b:28:3a:83:cd:8c:26:7c:22:83
Signer

Actual PE Digest

b2:d8:c9:12:95:30:01:63:5b:86:3b:28:3a:83:cd:8c:26:7c:22:83

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\FFormat\UFSource\Release\UFSource.pdb

Imports

kernel32

CloseHandle
WaitForMultipleObjects
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersion
CreateEventA
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetCurrentThreadId
GetTickCount
GetVersionExA
CreateSemaphoreA
InterlockedIncrement
WaitForSingleObject
ReleaseSemaphore
GetSystemInfo
VirtualFree
GetCurrentProcess
VirtualAlloc
FreeLibrary
LoadLibraryA
lstrlenA
GetModuleFileNameA
DisableThreadLibraryCalls
GetLocaleInfoA
IsValidCodePage
GetOEMCP
GetCPInfo
HeapSize
GetLastError
CreateThread
ResetEvent
SetEvent
InterlockedDecrement
HeapReAlloc
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
WriteFile
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
ExitProcess
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
QueryPerformanceCounter

user32

wsprintfA

advapi32

RegCreateKeyA
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA

ole32

StringFromGUID2
CoTaskMemFree
CoFreeUnusedLibraries
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoInitialize

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UUPlayer.exe
.exe windows:4 windows x86 arch:x86

cdc28a82c5f93ee4c8db41c7ffe0dc6b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

dd:28:0e:b8:c0:0f:42:50:25:d5:5f:ee:48:75:91:8e:05:68:51:ab
Signer

Actual PE Digest

dd:28:0e:b8:c0:0f:42:50:25:d5:5f:ee:48:75:91:8e:05:68:51:ab

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord2977
ord3142
ord3254
ord4459
ord4480
ord3257
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4616
ord4418
ord3733
ord561
ord825
ord815
ord4272
ord2756
ord4199
ord1569
ord6371
ord4269
ord540
ord538
ord858
ord800
ord3131
ord535
ord1165

msvcrt

__p__fmode
__set_app_type
_except_handler3
__dllonexit
_onexit
_controlfp
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
__CxxFrameHandler
__p__commode

kernel32

GetStartupInfoW
GetCommandLineW
GetModuleHandleW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shell32

ShellExecuteW

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UUPlayer.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

f1b092d618f56cc6568ea27e4b33d894

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:be:c6:c0:7a:72:06:31:ba:4c:7f:9e:e7:bd:75:60
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

25/05/2007, 00:00

Not After

24/05/2008, 23:59

Subject

CN=UUSee Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Multimedia Dept.,O=UUSee Inc.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c0:c4:15:57:6e:b7:ba:c3:70:41:94:ab:78:b6:f7:c1:a6:8a:9f:2d
Signer

Actual PE Digest

c0:c4:15:57:6e:b7:ba:c3:70:41:94:ab:78:b6:f7:c1:a6:8a:9f:2d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3401
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3670
ord561
ord825
ord3952
ord2724
ord6354
ord1216
ord1168
ord6467
ord1227
ord535
ord800
ord858
ord537
ord540
ord823
ord1877
ord4249
ord2486
ord2687
ord6364
ord3326
ord6365
ord4472
ord5498
ord3278
ord3353
ord3681
ord446
ord743
ord1177
ord1226
ord1210
ord2439
ord1693
ord5618
ord994
ord4342
ord4687
ord4639
ord5674
ord2156
ord4856
ord4920
ord6002
ord2137
ord1963
ord5213
ord2953
ord3868
ord5150
ord4705
ord4707
ord2876
ord2998
ord5649
ord4113
ord4661
ord4660
ord4768
ord4650
ord4903
ord4548
ord4521
ord4594
ord4988
ord4925
ord4930
ord4935
ord4659
ord4909
ord4908
ord4668
ord4667
ord4666
ord4648
ord4689
ord2396
ord4654
ord3922
ord4354
ord4780
ord4649
ord4637
ord4636
ord5060
ord4584
ord4371
ord4361
ord4356
ord4739
ord4741
ord4738
ord4409
ord4603
ord5008
ord4415
ord4992
ord4979
ord2488
ord3404
ord4539
ord2954
ord6055
ord4078
ord1776
ord4407
ord5241
ord2384
ord5163
ord6370
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2983
ord3148
ord3260
ord4466
ord3269
ord2986
ord3080
ord4081
ord4624
ord5825
ord723
ord3946
ord423
ord2860
ord2541
ord4949
ord2864
ord926
ord1892
ord4252
ord1212
ord4570
ord4672
ord4843
ord5011
ord5265
ord4376
ord4853
ord4998
ord4713
ord2514
ord6052
ord1775
ord2385
ord6371
ord5286
ord4438
ord3279
ord4625
ord4425
ord449
ord746
ord2278
ord1132
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord5199
ord5023
ord1089
ord1255
ord1578
ord600
ord826
ord5731
ord2554
ord2512
ord4486
ord6375
ord4643
ord815
ord269
ord1131

msvcrt

wcsncpy
wcslen
__CxxFrameHandler
__dllonexit
_onexit
??1type_info@@UAE@XZ
free
_adjust_fdiv
malloc
_initterm

kernel32

LocalFree
LocalAlloc

user32

EnableWindow
SendMessageA
FillRect

gdi32

Ellipse
GetStockObject

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

ole32

CoCreateInstance

oleaut32

LoadRegTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UUSeeMediaCenter.exe
.exe windows:4 windows x86 arch:x86

9a69cc52f2d9326f27ddb5b289784558

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b5:ac:64:bf:4f:33:dc:27:a7:c9:1e:36:ac:ca:27:da:dc:da:c7:8a
Signer

Actual PE Digest

b5:ac:64:bf:4f:33:dc:27:a7:c9:1e:36:ac:ca:27:da:dc:da:c7:8a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord3312
ord861
ord2910
ord6279
ord6278
ord2756
ord5706
ord1570
ord1568
ord711
ord413
ord2078
ord6266
ord4294
ord1940
ord2388
ord3341
ord5296
ord5299
ord4074
ord4693
ord5303
ord5285
ord4616
ord817
ord565
ord521
ord6303
ord2718
ord6655
ord4221
ord2248
ord996
ord613
ord289
ord5819
ord3659
ord415
ord715
ord5637
ord3568
ord640
ord323
ord2854
ord1859
ord2861
ord816
ord5785
ord562
ord283
ord2746
ord1863
ord686
ord5603
ord2754
ord897
ord2400
ord1635
ord2445
ord1854
ord3696
ord500
ord772
ord1173
ord2430
ord6138
ord2559
ord5784
ord5783
ord5871
ord2755
ord4272
ord3915
ord472
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6017
ord6168
ord5869
ord5790
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord3591
ord6190
ord3688
ord3614
ord3566
ord2855
ord1633
ord5781
ord4215
ord2576
ord3649
ord5568
ord2914
ord807
ord2915
ord2004
ord2112
ord554
ord1172
ord4197
ord5852
ord1192
ord5602
ord4158
ord2745
ord696
ord1258
ord4018
ord2444
ord1808
ord2538
ord3810
ord291
ord1109
ord2715
ord2382
ord3054
ord5094
ord5097
ord4461
ord4298
ord3345
ord5006
ord975
ord5468
ord3398
ord2874
ord2873
ord4146
ord4072
ord5233
ord5278
ord2641
ord1658
ord4430
ord1717
ord5252
ord4421
ord706
ord1857
ord5095
ord2093
ord5098
ord3346
ord976
ord4147
ord2374
ord5279
ord5250
ord2437
ord674
ord1850
ord2094
ord5469
ord645
ord1856
ord5248
ord1834
ord4140
ord5480
ord3227
ord1134
ord1137
ord4155
ord5801
ord2144
ord1851
ord4689
ord5935
ord5191
ord1995
ord5726
ord3943
ord2177
ord2176
ord4209
ord3102
ord5612
ord988
ord3439
ord3188
ord4157
ord3348
ord6449
ord709
ord411
ord1811
ord3097
ord6150
ord2523
ord4358
ord4052
ord5467
ord4116
ord2381
ord5077
ord1702
ord1706
ord5230
ord6365
ord5275
ord5244
ord2436
ord331
ord4231
ord6644
ord2933
ord5856
ord1614
ord3981
ord3651
ord407
ord326
ord3652
ord408
ord3645
ord401
ord3618
ord366
ord3638
ord394
ord4180
ord909
ord5624
ord3697
ord1083
ord5638
ord773
ord501
ord5446
ord6390
ord5436
ord6379
ord2294
ord2680
ord3792
ord5431
ord1676
ord1666
ord2620
ord5976
ord2633
ord4117
ord6210
ord6192
ord4293
ord5944
ord3083
ord3866
ord3869
ord3868
ord6194
ord4281
ord4278
ord3132
ord3791
ord5715
ord6088
ord3519
ord4027
ord6091
ord4030
ord2541
ord2425
ord3574
ord726
ord426
ord3785
ord920
ord3805
ord833
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord5298
ord4692
ord5710
ord3733
ord561
ord815
ord826
ord1197
ord6113
ord1202
ord1131
ord824
ord4041
ord2137
ord2136
ord6221
ord5227
ord5243
ord2124
ord4595
ord2717
ord3313
ord5180
ord354
ord1155
ord2822
ord1941
ord4029
ord6191
ord3865
ord6376
ord2070
ord2081
ord2072
ord2108
ord2105
ord2106
ord2100
ord2086
ord6608
ord2092
ord2115
ord6437
ord4270
ord1229
ord755
ord470
ord4042
ord3716
ord795
ord556
ord809
ord2372
ord4118
ord1088
ord2114
ord2567
ord4390
ord3569
ord609
ord3084
ord2403
ord2015
ord4213
ord2570
ord4392
ord3577
ord616
ord6316
ord4474
ord6238
ord3605
ord656
ord6919
ord6921
ord6920
ord3711
ord790
ord3714
ord793
ord3693
ord765
ord3626
ord683
ord6735
ord6511
ord6354
ord3747
ord2574
ord3635
ord693
ord4238
ord3288
ord956
ord3296
ord6597
ord6688
ord3281
ord4396
ord3728
ord810
ord4266
ord3298
ord3285
ord3292
ord3291
ord3282
ord6153
ord3365
ord2631
ord5491
ord729
ord2496
ord1699
ord430
ord3993
ord6003
ord3211
ord5778
ord4037
ord3393
ord2085
ord3703
ord781
ord2572
ord4394
ord3625
ord682
ord5681
ord3269
ord439
ord736
ord4517
ord4078
ord1937
ord4522
ord4536
ord4538
ord4519
ord4524
ord536
ord2634
ord1775
ord4050
ord1771
ord925
ord6871
ord6211
ord860
ord5977
ord2857
ord1235
ord857
ord1143
ord2233
ord465
ord4219
ord535
ord353
ord6381
ord1971
ord665
ord942
ord2810
ord6898
ord6896
ord2606
ord1105
ord823
ord538
ord5679
ord4124
ord940
ord384
ord2088
ord4279
ord5949
ord818
ord2127
ord567
ord3397
ord5286
ord4769
ord4495
ord4494
ord4452
ord3016
ord4768
ord4804
ord1130
ord4493
ord2858
ord5047
ord4718
ord4451
ord2447
ord1637
ord4241
ord4237
ord4240
ord4243
ord4242
ord2859
ord2637
ord1165
ord540
ord3087
ord3871
ord6868

msvcrt

_wcsnicmp
__CxxFrameHandler
strlen
sprintf
memset
memcpy
wcstod
_wcsicmp
_wtoi
wcscmp
_ftol
_except_handler3
memcmp
strcpy
strcmp
localtime
time
exit
atoi
strtok
sscanf
atol
strstr
_purecall
wcslen
printf
_mbstok
wcscpy
wcscat
memmove
_beginthreadex
swprintf
free
malloc
_wremove
fflush
fwrite
fclose
_wfopen
rand
_vsnprintf
fread
_wsplitpath
fgets
_itoa
fgetws
fopen
_exit
_XcptFilter
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__dllonexit
_onexit
?terminate@@YAXXZ
_controlfp

kernel32

GetProcAddress
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
lstrlenW
CreateFileW
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcpyW
LoadLibraryW
IsBadCodePtr
lstrcpynW
CreateDirectoryW
GetVersionExW
CreateProcessW
CloseHandle
ResumeThread
GetExitCodeThread
WideCharToMultiByte
WaitForSingleObject
GetModuleFileNameW
WriteFile
VirtualQuery
SetFilePointer
OutputDebugStringW
GetSystemInfo
GetFileSize
FileTimeToDosDateTime
GlobalMemoryStatus
GetSystemTimeAsFileTime
CompareStringW
GetTickCount
LocalFree
GetCommandLineW
FreeLibrary
GetLastError
MultiByteToWideChar
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
Sleep
TerminateProcess
OpenProcess
FreeResource
LockResource
LoadResource
FindResourceW
GetVersion
FormatMessageW
MulDiv
SetLastError
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GetSystemDirectoryW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CopyFileW
OpenFileMappingW
GetProcessTimes
LoadLibraryExW
GetTempPathW
GetProcessHeap
HeapFree
HeapAlloc
GlobalMemoryStatusEx
HeapReAlloc
GetPrivateProfileIntW
IsDebuggerPresent
GetPrivateProfileStructW
WritePrivateProfileStringW
GetPrivateProfileStringW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetComputerNameW
GetModuleHandleW
IsBadReadPtr
GetStartupInfoW

user32

InvalidateRect
PtInRect
IsWindowVisible
GetKeyState
GetWindowRgn
TrackMouseEvent
GetCapture
ScreenToClient
GetDlgCtrlID
RegisterClipboardFormatW
GetClassNameW
CallWindowProcW
GetPropW
UnhookWindowsHookEx
SetWindowsHookExW
IntersectRect
CreatePopupMenu
DeleteMenu
RemoveMenu
SetWindowPos
IsRectEmpty
ClientToScreen
RedrawWindow
GetMenuState
LoadMenuW
GetDesktopWindow
GetMenuStringW
InsertMenuW
ModifyMenuW
AppendMenuW
GetMenuDefaultItem
GetSubMenu
GetMenuItemID
GetMenuItemCount
GrayStringW
DrawTextW
TabbedTextOutW
ReleaseCapture
DrawEdge
SetRect
SetCapture
FillRect
GetMessagePos
GetMenuItemInfoW
InflateRect
GetClientRect
CopyRect
OffsetRect
WindowFromDC
GetMenuInfo
DestroyIcon
GetIconInfo
SystemParametersInfoW
GetMenuItemRect
IsMenu
SetMenuInfo
GetWindowDC
ReleaseDC
GetSysColor
LoadBitmapW
IsWindow
DefWindowProcW
SetRectEmpty
LoadCursorW
SetCursor
TranslateAcceleratorW
LoadAcceleratorsW
IsZoomed
CallNextHookEx
GetWindow
SetTimer
RemovePropW
PostQuitMessage
GetSystemMetrics
SetForegroundWindow
GetWindowLongW
SetWindowLongW
SetPropW
BringWindowToTop
wvsprintfW
SendMessageW
RegisterWindowMessageW
SetWindowRgn
DrawStateW
UpdateWindow
GetWindowRect
EnableWindow
GetDC
DrawMenuBar
SetMenu
DrawFocusRect
MessageBoxW
wsprintfW
PostMessageW
keybd_event
LoadIconW
ShowWindow
IsChild
GetFocus
MenuItemFromPoint
GetCursorPos
KillTimer
GetMenu
DestroyMenu
GetSystemMenu
LoadImageW
GetParent

gdi32

GetCurrentObject
GetBrushOrgEx
CreateBitmap
StretchBlt
SetBkColor
SetTextColor
DeleteDC
GetObjectType
OffsetRgn
SelectObject
CreateRectRgnIndirect
SelectClipRgn
CreateHatchBrush
Escape
ExtTextOutW
TextOutW
SetPixel
GetPixel
BitBlt
RoundRect
Rectangle
RectVisible
PtVisible
GetNearestColor
SetBrushOrgEx
GetDeviceCaps
CreateCompatibleDC
UnrealizeObject
CreateCompatibleBitmap
CreateFontIndirectW
CreatePatternBrush
CreateSolidBrush
CreatePen
GetTextExtentPoint32W
GetObjectW
DeleteObject
CombineRgn
CreateRoundRectRgn
CreateRectRgn
SetStretchBltMode

advapi32

RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyW
GetUserNameW

shell32

Shell_NotifyIconW
CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHChangeNotify
ShellExecuteW
SHGetSpecialFolderPathW

comctl32

ImageList_ReplaceIcon
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Add
ImageList_AddMasked
ImageList_Replace
ImageList_GetIcon
ImageList_Draw
ImageList_GetImageInfo

ole32

CoInitialize
CoUninitialize
CLSIDFromString
ProgIDFromCLSID
CoGetMalloc
CoCreateInstance

oleaut32

SysAllocString
VariantInit
VariantClear

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

imagehlp

CheckSumMappedFile
ImageNtHeader

wininet

InternetQueryOptionW
InternetGetConnectedState
InternetOpenA
InternetReadFile
HttpQueryInfoW
InternetOpenUrlW
InternetCloseHandle

iphlpapi

GetAdaptersInfo
GetIpAddrTable
GetBestInterface
GetIpForwardTable

ws2_32

recvfrom
WSAGetLastError
setsockopt
connect
send
recv
socket
WSAStartup
WSACleanup
closesocket
htons
inet_addr
sendto
inet_ntoa
gethostbyname

winmm

waveOutGetNumDevs

shlwapi

PathFileExistsW

msimg32

AlphaBlend
TransparentBlt

Exports

Exports

?interfaceMap@CCustomControlSite@@1UAFX_INTERFACEMAP@@B

Sections

.text
Size: 468KB - Virtual size: 465KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 148KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UUUpgrade.exe
.exe windows:4 windows x86 arch:x86

639e80e0155c9662a1f9ed3441e82f3a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ff:29:dc:2e:ac:bd:8e:99:31:8a:30:5d:1e:97:38:b7:20:c9:6c:23
Signer

Actual PE Digest

ff:29:dc:2e:ac:bd:8e:99:31:8a:30:5d:1e:97:38:b7:20:c9:6c:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW

psapi

EnumProcessModules
EnumProcesses
GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

mfc42u

ord5286
ord3397
ord4418
ord3634
ord567
ord692
ord2294
ord4270
ord956
ord3798
ord3614
ord3716
ord809
ord795
ord2606
ord556
ord3621
ord3658
ord2406
ord5871
ord1088
ord2114
ord1634
ord2855
ord6195
ord3871
ord3792
ord6354
ord858
ord535
ord6193
ord2854
ord6871
ord2859
ord942
ord5568
ord2910
ord927
ord2810
ord6451
ord823
ord537
ord538
ord4667
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord4395
ord5193
ord2388
ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord3733
ord815
ord561
ord6865
ord6920
ord6867
ord922
ord925
ord2613
ord1131
ord1196
ord1244
ord4272
ord4124
ord5679
ord5706
ord818
ord663
ord6279
ord6278
ord2755
ord6330
ord2634
ord940
ord3566
ord1143
ord1165
ord348
ord2127
ord1172
ord4219
ord4155
ord2858
ord6211
ord2371
ord1569
ord470
ord4294
ord2078
ord2680
ord3806
ord2637
ord536
ord1941
ord4029
ord1768
ord6051
ord2573
ord4214
ord2016
ord2405
ord6362
ord1764
ord3087
ord4229
ord2362
ord825
ord324
ord540
ord861
ord641
ord800
ord3592
ord4419
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5276
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4704
ord4992
ord4847
ord4370
ord5261
ord1089
ord755

msvcrt

_controlfp
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
swscanf
_beginthreadex
__p__wpgmptr
_wcsicmp
_wcsnicmp
wcscmp
vswprintf
swprintf
fwrite
fflush
wcscpy
_wfopen
fseek
fclose
wcsstr
wcslen
wcscat
__CxxFrameHandler
ftell

kernel32

ReadProcessMemory
CloseHandle
GetLocalTime
WideCharToMultiByte
GetModuleFileNameW
InitializeCriticalSection
EnterCriticalSection
GetPrivateProfileIntW
GetLastError
FormatMessageW
LocalFree
LeaveCriticalSection
DeleteCriticalSection
lstrcatW
lstrcpyW
GetWindowsDirectoryW
LoadLibraryW
FreeLibrary
GetVersion
GetCommandLineA
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
GetProcAddress
LoadLibraryExW
SetErrorMode
ExitProcess
GetModuleFileNameA
CreateProcessW
MoveFileExW
DeleteFileW
CopyFileW
GetCommandLineW
GetPrivateProfileSectionW
GetPrivateProfileStringW
TerminateThread
WaitForSingleObject
SetEvent
ResetEvent
GetStartupInfoW
GetCurrentProcess
OpenProcess
GetShortPathNameW
Sleep
lstrcpynW
GetModuleHandleW
TerminateProcess

user32

GetWindowRect
GetParent
LoadCursorW
RedrawWindow
GetCursorPos
KillTimer
FindWindowExW
FindWindowW
SetCursorPos
GetWindowThreadProcessId
PostMessageW
EnumWindows
MessageBoxA
GetActiveWindow
SetForegroundWindow
IntersectRect
GetWindow
LoadIconW
GetSystemMetrics
LoadBitmapW
AppendMenuW
GetSystemMenu
DrawIcon
IsIconic
GetDC
ReleaseDC
InflateRect
InvalidateRect
IsWindow
SetWindowTextW
EnableWindow
SendMessageW
PtInRect
SetWindowLongW
GetClientRect
SetTimer
SetCursor
DestroyCursor
CopyIcon

gdi32

GetTextExtentPoint32W
GetObjectW
CreateFontIndirectW
GetStockObject

advapi32

LookupPrivilegeValueW
RegQueryValueExW
OpenProcessToken
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueW

shell32

CommandLineToArgvW
ShellExecuteW

ole32

OleInitialize
OleUninitialize

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UUUpgrade.ini
UUUpgrade.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

7ebbea0e0ea4ac46ca21902e6d28d1d9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9b:25:fe:04:48:b4:6b:c8:da:b3:9e:73:77:fa:eb:d1:bc:a6:43:17
Signer

Actual PE Digest

9b:25:fe:04:48:b4:6b:c8:da:b3:9e:73:77:fa:eb:d1:bc:a6:43:17

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupIterateCabinetW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

shlwapi

PathFileExistsW
SHDeleteKeyW

shell32

ShellExecuteW
SHFileOperationW
SHCreateDirectoryExW
Shell_NotifyIconW

iphlpapi

GetAdaptersInfo

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

mfc42u

ord4075
ord4418
ord3658
ord1165
ord1143
ord6193
ord6211
ord4294
ord4270
ord2371
ord6451
ord755
ord5871
ord5785
ord6168
ord470
ord6597
ord815
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord3396
ord4616
ord3665
ord561
ord3947
ord2716
ord6350
ord1213
ord6466
ord1224
ord1869
ord4244
ord2478
ord2679
ord6360
ord3321
ord6361
ord4466
ord5494
ord3273
ord3348
ord3676
ord446
ord743
ord1174
ord1223
ord1207
ord348
ord663
ord2431
ord1686
ord5614
ord994
ord4336
ord4681
ord4633
ord5670
ord2148
ord4850
ord4914
ord5998
ord2129
ord1955
ord5207
ord2948
ord3863
ord5144
ord4699
ord4701
ord2871
ord2993
ord5645
ord4108
ord4655
ord4654
ord4762
ord4644
ord4897
ord4542
ord4515
ord4588
ord3074
ord4919
ord4924
ord4929
ord4653
ord4903
ord4902
ord4662
ord4661
ord4660
ord4642
ord4683
ord5017
ord4648
ord4637
ord4348
ord4774
ord4643
ord4631
ord4630
ord5054
ord4578
ord4365
ord4355
ord4350
ord4733
ord4735
ord4732
ord4403
ord4597
ord5002
ord4409
ord4986
ord4973
ord2480
ord3399
ord4533
ord2949
ord2376
ord6366
ord2978
ord3143
ord3255
ord4460
ord3264
ord2981
ord3075
ord4076
ord4618
ord5821
ord723
ord3941
ord423
ord2855
ord2533
ord4943
ord641
ord2506
ord324
ord922
ord5706
ord4273
ord1128
ord6867
ord1594
ord2787
ord941
ord536
ord3806
ord940
ord1244
ord4453
ord668
ord3176
ord4053
ord2773
ord2762
ord356
ord942
ord4215
ord2576
ord3649
ord2430
ord6266
ord2858
ord1637
ord711
ord4163
ord413
ord1884
ord4247
ord1209
ord4564
ord4666
ord4837
ord5005
ord5261
ord4370
ord4847
ord4992
ord4707
ord6048
ord1767
ord6367
ord5282
ord4432
ord3274
ord4619
ord4419
ord449
ord746
ord2270
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord5157
ord2377
ord5237
ord4401
ord1768
ord4073
ord6051
ord1941
ord927
ord538
ord925
ord389
ord6055
ord3224
ord5199
ord5804
ord5352
ord2385
ord6868
ord4272
ord2755
ord6414
ord537
ord354
ord5180
ord6381
ord1971
ord2810
ord665
ord860
ord823
ord861
ord5679
ord4124
ord858
ord540
ord2910
ord535
ord800
ord825
ord269
ord826
ord600
ord1571
ord1250
ord1248
ord1563
ord1194
ord1240
ord342
ord1179
ord1570
ord1568
ord1173
ord1115
ord1129
ord4982
ord2756

msvcrt

_initterm
_onexit
__dllonexit
malloc
strncpy
swscanf
wcsncpy
_adjust_fdiv
??1type_info@@UAE@XZ
free
realloc
wcslen
__CxxFrameHandler
sprintf
fclose
ftell
fseek
_wfopen
wcscpy
atoi
strtok
strstr
_beginthreadex
fflush
fwrite
swprintf
vswprintf
localtime
time
isalpha
_wcsicmp
wcscmp
_ftol

kernel32

lstrlenW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetVersionExW
GetLocalTime
WaitForSingleObject
CloseHandle
GetModuleFileNameW
InitializeCriticalSection
EnterCriticalSection
GetPrivateProfileIntW
TerminateThread
LocalFree
LeaveCriticalSection
Sleep
DeleteCriticalSection
WideCharToMultiByte
GetTickCount
MoveFileExW
PulseEvent
ResetEvent
SetEvent
CreateMutexW
DeviceIoControl
CreateFileA
CreateProcessW
LocalAlloc
GetCurrentProcess
OpenProcess
GetShortPathNameW
TerminateProcess
GetModuleHandleW
GetTempPathW
DeleteFileW
FormatMessageW
lstrcatW
lstrcpyW
GetPrivateProfileSectionW
WriteFile
ReadFile
GetFileSize
GetLastError
GetFileAttributesW
CreateFileW

user32

SetWindowPos
SystemParametersInfoW
GetSystemMetrics
SetTimer
KillTimer
RedrawWindow
UpdateWindow
DrawIcon
PostMessageW
GetWindowRect
GetCursorPos
CharLowerW
EnableWindow
FillRect
PtInRect
GetSysColor
SetForegroundWindow
LoadCursorW
InflateRect
DrawTextW
SetCursor
GetClientRect
LoadIconW
DrawEdge
LoadMenuW
SetRect
GetSubMenu
FindWindowExW
FindWindowW
SetCursorPos

gdi32

CreateSolidBrush
GetDeviceCaps
SelectObject
Rectangle
SetBkMode
SetTextColor
GetStockObject
CreateFontW
DeleteObject
GetObjectW
Ellipse

advapi32

OpenProcessToken
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
LookupPrivilegeValueW
RegEnumValueW

comctl32

_TrackMouseEvent

ole32

CoInitialize
CoCreateInstance

oleaut32

LoadRegTypeLi

ws2_32

inet_addr
gethostbyname
htons
sendto
WSACleanup
connect
closesocket
send
recv
WSAStartup
socket

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
check_cmd.exe
.exe windows:4 windows x86 arch:x86

5bb0949a332b2dedf4049800738c00f0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c0:f8:ff:d0:df:74:8c:95:b6:49:01:16:6b:4a:08:a5:03:bb:94:13
Signer

Actual PE Digest

c0:f8:ff:d0:df:74:8c:95:b6:49:01:16:6b:4a:08:a5:03:bb:94:13

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileSize
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetSystemDirectoryW
GetVersionExW
GetModuleHandleW
GetCommandLineW
GetConsoleTitleW
CreateFileW
CopyFileW
CloseHandle

user32

EnableWindow
ShowWindow
FindWindowW

mfc42u

ord5261
ord4847
ord4992
ord2506
ord6048
ord4073
ord1767
ord4401
ord5237
ord2377
ord5157
ord6370
ord4347
ord5276
ord3793
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2116
ord5273
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4621
ord4419
ord3592
ord800
ord641
ord861
ord540
ord324
ord825
ord2286
ord2354
ord2362
ord4229
ord858
ord6330
ord2634
ord3087
ord4704
ord940
ord2810
ord942
ord4370
ord2438
ord823
ord537
ord561
ord815
ord1568

msvcrt

exit
__p___winitenv
__wgetmainargs
_initterm
__setusermatherr
_XcptFilter
__p__commode
__p__fmode
__set_app_type
_itoa
_controlfp
_exit
_onexit
__dllonexit
wcscpy
_wtoi
_except_handler3
memmove
wcslen
wcscat
__CxxFrameHandler
_adjust_fdiv

msvcp60

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

imagehlp

ImageNtHeader
CheckSumMappedFile

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
download.dll
.dll windows:4 windows x86 arch:x86

d503f2d14a12e983d914a7d0ec76b1ed

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

68:97:75:81:02:c2:8f:66:0a:d8:18:ce:1f:d3:49:63:d3:d1:1e:89
Signer

Actual PE Digest

68:97:75:81:02:c2:8f:66:0a:d8:18:ce:1f:d3:49:63:d3:d1:1e:89

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord1199
ord1247
ord2725
ord4275
ord755
ord470
ord5875
ord3573
ord3693
ord5787
ord5788
ord1641
ord3626
ord2414
ord2379
ord3346
ord4234
ord5810
ord5481
ord2031
ord4335
ord4863
ord5796
ord5478
ord1971
ord966
ord3570
ord605
ord278
ord4411
ord4447
ord4919
ord939
ord1158
ord4975
ord354
ord665
ord668
ord1980
ord3319
ord3010
ord3178
ord4058
ord2781
ord2770
ord356
ord1116
ord1176
ord1575
ord1168
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord6394
ord5450
ord6383
ord5440
ord924
ord2818
ord6282
ord6283
ord2763
ord4129
ord2077
ord537
ord2029
ord6663
ord2764
ord6662
ord5710
ord5683
ord4278
ord858
ord535
ord941
ord922
ord540
ord860
ord6467
ord800
ord3663
ord823
ord825

msvcrt

calloc
malloc
isalpha
printf
fopen
fclose
strstr
??1type_info@@UAE@XZ
_adjust_fdiv
memmove
free
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
_EH_prolog
fseek
ftell
fread
strrchr
_mbscmp
atoi
_ftol
sprintf
_itoa
_mbsicmp
__CxxFrameHandler
_purecall
_initterm

kernel32

GetPrivateProfileStringA
GetPrivateProfileIntA
CreateThread
GetTickCount
SetFilePointer
Sleep
CreateFileA
WriteFile
ReadFile
CloseHandle
DeleteCriticalSection
GetTempPathA
CreateDirectoryA
InitializeCriticalSection
lstrlenA
GetModuleFileNameA
DeleteFileA
TerminateThread
EnterCriticalSection
LeaveCriticalSection
MoveFileA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
LocalAlloc
LocalFree

user32

PostThreadMessageA
DispatchMessageA
TranslateMessage
GetMessageA
InvalidateRect
PostMessageA

gdi32

CreatePen
CreateSolidBrush
Rectangle
BitBlt

wsock32

setsockopt
shutdown
WSAGetLastError
WSACleanup
closesocket
socket
gethostbyname
ioctlsocket
htons
WSAStartup
sendto

Exports

Exports

AddIERequest
AddURI
AddWatchURL
CreateDownLoadMgr
Dump
GetData
GetStatusInfo
ReleaseDownLoadMgr
SetTaskParams
ShowStatusInfo

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
in_net.dll
.dll windows:4 windows x86 arch:x86

22d50d98242a7c0b374bed94e8f38697

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:9a:83:14:3c:03:e2:e3:e1:77:b6:10:a1:8f:e3:9c:f8:9c:da:5a
Signer

Actual PE Digest

0a:9a:83:14:3c:03:e2:e3:e1:77:b6:10:a1:8f:e3:9c:f8:9c:da:5a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
CreateErrorInfo
GetErrorInfo
SetErrorInfo
GetActiveObject
SysFreeString
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegFlushKey
RegCloseKey

user32

GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExA
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClassLongA
SetCapture
SetActiveWindow
SendMessageW
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageW
PeekMessageA
OffsetRect
OemToCharA
MsgWaitForMultipleObjects
MessageBoxA
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageW
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMessageTime
GetMessagePos
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassLongA
GetClassInfoA
GetCapture
GetActiveWindow
FrameRect
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerBuffA
CharLowerA
CharUpperBuffA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout

kernel32

GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
CompareStringA
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
lstrcpyA
WriteFile
WaitForSingleObject
VirtualQuery
VirtualAlloc
TryEnterCriticalSection
Sleep
SizeofResource
SetThreadLocale
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
RemoveDirectoryA
ReleaseMutex
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
OpenMutexA
MultiByteToWideChar
MulDiv
MoveFileA
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalSize
GlobalLock
GlobalFree
GlobalFindAtomA
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomA
GetVersionExA
GetVersion
GetUserDefaultLCID
GetTimeZoneInformation
GetTickCount
GetThreadLocale
GetTempPathA
GetSystemTime
GetSystemInfo
GetStdHandle
GetQueuedCompletionStatus
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetFileAttributesA
GetExitCodeThread
GetDiskFreeSpaceExA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetComputerNameA
GetCPInfo
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateThread
CreateMutexA
CreateIoCompletionPort
CreateFileA
CreateEventA
CreateDirectoryA
CompareStringA
CloseHandle
Sleep

gdi32

UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetMapMode
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
RectVisible
RealizePalette
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
LPtoDP
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionA
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateEnhMetaFileA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
CloseEnhMetaFile
BitBlt

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

ole32

CLSIDFromString
CoTaskMemFree
StringFromCLSID
CoCreateGuid
CreateStreamOnHGlobal
IsAccelerator
OleDraw
OleSetMenuDescriptor
CoTaskMemFree
ProgIDFromCLSID
StringFromCLSID
CoCreateInstance
CoGetClassObject
CoUninitialize
CoInitialize
IsEqualGUID

comctl32

_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create

wsock32

__WSAFDIsSet
WSACleanup
WSAStartup
WSAGetLastError
gethostname
getservbyname
gethostbyname
socket
shutdown
setsockopt
sendto
send
select
recvfrom
recv
ntohs
listen
ioctlsocket
inet_ntoa
inet_addr
htons
htonl
connect
closesocket
bind

ws2_32

WSAAccept
WSARecv
WSASend
WSASocketA
WSAGetLastError
closesocket

iphlpapi

GetIpAddrTable
GetBestInterface

Exports

Exports

uuseePSPmodlePlugin
uuseePSPmodlePlugin2
uuseePSPmodlePlugin3
uuseePSPmodlePlugin4

Sections

.text
Size: 746KB - Virtual size: 745KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 22KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 174B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
out_mmshttp.dll
.dll windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e4:f4:e1:db:26:56:4f:62:10:f9:a5:84:a4:6e:da:eb:01:e5:c5:00
Signer

Actual PE Digest

e4:f4:e1:db:26:56:4f:62:10:f9:a5:84:a4:6e:da:eb:01:e5:c5:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

RebootServer2
TestPortUp2
uuseeOutmodulePlugin
uuseeOutmodulePlugin2

Sections

CODE
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 165B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
rmsp011.ax
.dll regsvr32 windows:4 windows x86 arch:x86

651a28cffd0b0a93b306e41f7806b0ee

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e9:bc:12:9a:84:c6:9b:76:48:a1:2f:c0:6d:f8:0b:81:60:6f:1d:c5
Signer

Actual PE Digest

e9:bc:12:9a:84:c6:9b:76:48:a1:2f:c0:6d:f8:0b:81:60:6f:1d:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

i:\progs\guliverkli\src\filters\parser\realmediasplitter\release unicode\RealMediaSplitter.pdb

Imports

kernel32

LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetModuleHandleA
GetVersionExA
LoadLibraryA
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GlobalFlags
CompareStringA
HeapFree
RtlUnwind
HeapAlloc
GetCommandLineA
GetProcessHeap
GetFullPathNameW
SetStdHandle
GetFileType
HeapSize
ExitProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
GetCPInfo
GetACP
GetOEMCP
GetStdHandle
LCMapStringA
LCMapStringW
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
GetFileTime
GetFileSize
GetFileAttributesW
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
SetLastError
DeleteFileW
Sleep
RaiseException
GetModuleFileNameW
GetVersion
CreateFileW
GetVolumeInformationW
FindFirstFileW
FindClose
GetCurrentProcessId
CreateThread
GetTickCount
SetThreadPriority
GetModuleHandleW
InterlockedExchange
VirtualAlloc
CreateSemaphoreW
GetCurrentThreadId
GetCurrentProcess
DuplicateHandle
VirtualFree
GetSystemInfo
ReleaseSemaphore
WaitForSingleObject
ResetEvent
SetEvent
CreateEventW
CloseHandle
lstrcpynW
InterlockedDecrement
InterlockedIncrement
lstrcmpW
DisableThreadLibraryCalls
GetVersionExW
GetLastError
lstrlenA
lstrlenW
GetModuleFileNameA
LoadLibraryW
GetProcAddress
FreeLibrary
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
HeapReAlloc

user32

SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
LoadIconW
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
IsWindow
UnregisterClassA
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
ClientToScreen
GrayStringW
DrawTextW
TabbedTextOutW
SetWindowsHookExW
CallNextHookEx
GetKeyState
ValidateRect
GetWindowTextW
LoadCursorW
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
PostMessageW
PostQuitMessage
DestroyMenu
SetWindowTextW
CreateWindowExW
CharUpperW
GetSystemMetrics
GetWindowThreadProcessId
SendMessageW
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
SetRect
DispatchMessageW
RegisterWindowMessageW
PeekMessageW
DrawTextExW
GetForegroundWindow

gdi32

SetWindowExtEx
ScaleWindowExtEx
DeleteDC
CreateBitmap
GetStockObject
ScaleViewportExtEx
RectVisible
PtVisible
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
SetBkColor
RestoreDC
SaveDC
GetDeviceCaps
DeleteObject
GetClipBox
SetMapMode
SetTextColor
TextOutW

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegCreateKeyExW
RegCreateKeyW
RegSetValueW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shlwapi

PathIsUNCW
PathStripToRootW
PathFindFileNameW
PathRemoveFileSpecA
PathAddBackslashA

ole32

StringFromGUID2
CoCreateInstance
CoUninitialize
CoFreeUnusedLibraries
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromString

oleaut32

SysAllocString
VariantChangeType
SysAllocStringLen
VariantClear
VariantInit
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 252KB - Virtual size: 251KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT64
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
seeplayer.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

4f2cb166af1f8a9a4096b5fb764076ec

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:9d:68:b0:48:32:7b:92:1c:22:e1:41:da:41:3d:06:37:fa:57:00
Signer

Actual PE Digest

08:9d:68:b0:48:32:7b:92:1c:22:e1:41:da:41:3d:06:37:fa:57:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wmvcore

WMCreateWriter
WMCreateReader

iphlpapi

GetIpAddrTable
GetBestInterface
GetAdaptersInfo

quartz

AMGetErrorTextA

kernel32

FindClose
FindFirstFileA
GetFileAttributesA
GetFileTime
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationA
GetFullPathNameA
GetShortPathNameA
WritePrivateProfileStringA
FindResourceExA
GetProfileIntA
HeapAlloc
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
GetSystemInfo
GetOEMCP
HeapReAlloc
ExitProcess
GetCommandLineA
RtlUnwind
HeapSize
SetStdHandle
GetFileType
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetACP
IsValidCodePage
SetHandleCount
GetStartupInfoA
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileW
SetEnvironmentVariableA
GetCPInfo
GlobalFlags
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetUserDefaultLCID
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleFileNameW
GetThreadLocale
FreeResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
GlobalSize
FormatMessageA
LocalFree
ReleaseMutex
CreateMutexA
GetProcessHeap
HeapFree
CreateProcessA
LoadLibraryExA
IsDBCSLeadByte
GetModuleHandleA
FreeLibrary
GlobalFree
GetProcAddress
LoadLibraryA
CompareStringA
GetVersion
InterlockedExchange
CompareStringW
lstrcmpiA
OpenFileMappingA
CopyFileA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
GetSystemDirectoryA
GetVersionExA
CreateThread
GetPrivateProfileStringA
GlobalLock
InitializeCriticalSection
GetModuleFileNameA
EnterCriticalSection
GlobalUnlock
MulDiv
LeaveCriticalSection
lstrlenW
SetLastError
RaiseException
lstrcmpA
DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
GlobalAlloc
SetEvent
WaitForSingleObject
CloseHandle
CreateEventA
InterlockedIncrement
Sleep
DeleteFileA
FindResourceA
LoadResource
LockResource
SizeofResource
InterlockedDecrement
GetCurrentThreadId
lstrlenA
GetTempPathA
WideCharToMultiByte
GetTickCount
GetLastError
GetCurrentProcessId
MultiByteToWideChar
OutputDebugStringA
InterlockedCompareExchange
VirtualQuery
IsProcessorFeaturePresent

user32

GetDCEx
PostThreadMessageA
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
SetWindowRgn
IsRectEmpty
CreateMenu
DestroyMenu
DrawEdge
SetCursor
PostQuitMessage
GetMessageA
GetActiveWindow
ValidateRect
GetCursorPos
InflateRect
IsDialogMessageA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
LoadIconA
SendDlgItemMessageA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
SetActiveWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
IsWindowVisible
GetMenu
GetDialogBaseUnits
RegisterClassA
AdjustWindowRectEx
EqualRect
PtInRect
SetWindowPlacement
GetDlgCtrlID
OffsetRect
IntersectRect
IsIconic
GetWindowPlacement
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
SetRectEmpty
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
GetMenuState
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
SystemParametersInfoA
UpdateWindow
GetSystemMetrics
SetParent
SetForegroundWindow
GetForegroundWindow
WindowFromPoint
CharUpperA
LoadImageA
wsprintfW
SetRect
CopyRect
EnableWindow
GetWindowRect
ShowWindow
DestroyWindow
GetSysColor
FillRect
UnhookWindowsHookEx
GetClassInfoExA
CallWindowProcA
InvalidateRect
SetWindowsHookExA
CallNextHookEx
SendMessageA
RegisterClassExA
RedrawWindow
IsWindow
InvalidateRgn
MessageBeep
GetNextDlgGroupItem
GetTabbedTextExtentA
EndPaint
CreateAcceleratorTableA
DestroyIcon
CopyAcceleratorTableA
GetSysColorBrush
UnregisterClassA
GetClassInfoA
LockWindowUpdate
GetDlgItem
DestroyAcceleratorTable
GetDC
GetClientRect
ReleaseDC
EnumChildWindows
ClientToScreen
GetDesktopWindow
DefWindowProcA
ScreenToClient
GetWindowLongA
SetWindowPos
SetWindowLongA
MoveWindow
RegisterWindowMessageA
GetClassNameA
GetParent
GetWindowTextLengthA
CreateWindowExA
SetCapture
IsChild
ReleaseCapture
GetFocus
LoadCursorA
GetWindowTextA
BeginPaint
SetFocus
CharNextA
SetWindowTextA
GetWindow
MessageBoxA
wsprintfA
PostMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
TabbedTextOutA
RegisterClipboardFormatA
GetMenuStringA

gdi32

ExtSelectClipRgn
CreatePatternBrush
CreateBitmap
CreatePen
CreateFontIndirectA
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
SetViewportOrgEx
GetBkColor
GetTextColor
LPtoDP
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
GetTextExtentPoint32A
GetRgnBox
GetTextAlign
GetTextMetricsA
EnumFontFamiliesExA
Rectangle
UnrealizeObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SelectObject
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
GetObjectA
CreateCompatibleBitmap
CreateCompatibleDC
SetViewportExtEx
PatBlt
CreateSolidBrush
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
SetTextAlign
MoveToEx
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
CreateFontA
StretchBlt
BitBlt
OffsetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegQueryInfoKeyA
RegCreateKeyA
RegQueryValueA
RegEnumKeyA
RegOpenKeyA
RegSetValueA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegSetValueExA
RegDeleteValueA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA

shell32

ExtractIconA

comctl32

_TrackMouseEvent

shlwapi

PathFindFileNameA
PathFileExistsA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

OleInitialize
CoCreateInstance
CLSIDFromProgID
CreateStreamOnHGlobal
CoGetClassObject
OleRun
StgCreateDocfileOnILockBytes
OleUninitialize
OleLockRunning
CoTaskMemAlloc
CLSIDFromString
StringFromGUID2
GetRunningObjectTable
CreateItemMoniker
CoTaskMemRealloc
CoTaskMemFree
ReadFmtUserTypeStg
StringFromCLSID
ReleaseStgMedium
OleDuplicateData
CoRegisterClassObject
CoRevokeClassObject
CreateDataCache
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CreateOleAdviseHolder
OleSaveToStream
CreateDataAdviseHolder
CoDisconnectObject
StgOpenStorageOnILockBytes
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleFlushClipboard
OleIsCurrentClipboard
OleLoadFromStream
ReadClassStm
CreateILockBytesOnHGlobal
CoInitialize

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
OleCreatePropertyFrame
RegisterTypeLi
GetErrorInfo
VarUI4FromStr
SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysStringLen
SysAllocString
VariantInit
SysFreeString
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
OleLoadPicture
OleCreatePictureIndirect
VariantClear

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

ws2_32

gethostbyname
inet_ntoa
socket
WSAStartup
sendto
htons
inet_addr
WSACleanup
closesocket

wininet

HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
HttpQueryInfoA
InternetQueryDataAvailable
InternetConnectA
HttpOpenRequestA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 540KB - Virtual size: 538KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
skins/UUPlayer/About.bmp
skins/UUPlayer/Ctrl_CheckBox_1.bmp
skins/UUPlayer/Ctrl_CheckBox_2.bmp
skins/UUPlayer/Ctrl_CheckBox_3.bmp
skins/UUPlayer/Ctrl_CheckBox_4.bmp
skins/UUPlayer/Ctrl_CheckBox_C1.bmp
skins/UUPlayer/Ctrl_CheckBox_C2.bmp
skins/UUPlayer/Ctrl_CheckBox_C3.bmp
skins/UUPlayer/Ctrl_CheckBox_C4.bmp
skins/UUPlayer/Ctrl_ComboBox_1.bmp
skins/UUPlayer/Ctrl_ComboBox_2.bmp
skins/UUPlayer/Ctrl_ComboBox_3.bmp
skins/UUPlayer/Ctrl_ComboBox_4.bmp
skins/UUPlayer/Ctrl_Edit_1.bmp
skins/UUPlayer/Ctrl_Edit_4.bmp
skins/UUPlayer/Ctrl_PushButton_1.bmp
skins/UUPlayer/Ctrl_PushButton_2.bmp
skins/UUPlayer/Ctrl_PushButton_3.bmp
skins/UUPlayer/Ctrl_PushButton_4.bmp
skins/UUPlayer/Ctrl_RadioButton_1.bmp
skins/UUPlayer/Ctrl_RadioButton_2.bmp
skins/UUPlayer/Ctrl_RadioButton_3.bmp
skins/UUPlayer/Ctrl_RadioButton_4.bmp
skins/UUPlayer/Ctrl_RadioButton_C1.bmp
skins/UUPlayer/Ctrl_RadioButton_C2.bmp
skins/UUPlayer/Ctrl_RadioButton_C3.bmp
skins/UUPlayer/Ctrl_RadioButton_C4.bmp
skins/UUPlayer/Dlg_Back.bmp
skins/UUPlayer/Dlg_Detect.bmp
skins/UUPlayer/Dlg_Frame_1.bmp
skins/UUPlayer/Dlg_Frame_2.bmp
skins/UUPlayer/Dlg_Frame_3.bmp
skins/UUPlayer/Icon_Information.bmp
skins/UUPlayer/Icon_Question.bmp
skins/UUPlayer/Icon_Stop.bmp
skins/UUPlayer/ListHeader_1.bmp
skins/UUPlayer/ListHeader_2.bmp
skins/UUPlayer/ListHeader_3.bmp
skins/UUPlayer/ListHeader_ArrowD.bmp
skins/UUPlayer/ListHeader_ArrowU.bmp
skins/UUPlayer/ListHeader_SP.bmp
skins/UUPlayer/Resource.h
skins/UUPlayer/Setting_Group_1_1.bmp
skins/UUPlayer/Setting_Group_1_2.bmp
skins/UUPlayer/Setting_Group_1_3.bmp
skins/UUPlayer/Setting_Group_2_1.bmp
skins/UUPlayer/Setting_Group_2_2.bmp
skins/UUPlayer/Setting_Group_2_3.bmp
skins/UUPlayer/Setting_Group_3_1.bmp
skins/UUPlayer/Setting_Group_3_2.bmp
skins/UUPlayer/Setting_Group_3_3.bmp
skins/UUPlayer/Setting_Group_4_1.bmp
skins/UUPlayer/Setting_Group_4_2.bmp
skins/UUPlayer/Setting_Group_4_3.bmp
skins/UUPlayer/UUSEE.ui
skins/UUPlayer/Wnd_Setting_1.bmp
skins/UUPlayer/Wnd_Setting_2.bmp
skins/UUPlayer/Wnd_Setting_3.bmp
trafficlight.dll
.dll windows:4 windows x86 arch:x86

4cae1096e60ed4a32f3efda37329ca04

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

29:8c:67:39:70:2c:d6:cb:0d:5a:e8:79:2e:ca:ea:8e:71:74:62:a6
Signer

Actual PE Digest

29:8c:67:39:70:2c:d6:cb:0d:5a:e8:79:2e:ca:ea:8e:71:74:62:a6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WritePrivateProfileStringA
GlobalFlags
GetCPInfo
GetOEMCP
MoveFileA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetCurrentProcess
RtlUnwind
RaiseException
ExitThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
VirtualAlloc
HeapAlloc
HeapFree
HeapReAlloc
GetProcessHeap
ExitProcess
HeapSize
GetStdHandle
GetACP
IsValidCodePage
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
VirtualFree
HeapDestroy
HeapCreate
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileW
SetEnvironmentVariableA
GlobalAddAtomA
GlobalFindAtomA
lstrcmpW
GetThreadLocale
GlobalGetAtomNameA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
SetErrorMode
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
ReleaseMutex
CreateMutexA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
CreateThread
FreeLibrary
GetCommandLineA
GetModuleHandleA
lstrlenA
CompareStringA
CompareStringW
MultiByteToWideChar
InterlockedExchange
GetVersion
OpenFileMappingA
GetVersionExA
CopyFileA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetFileSize
GetSystemDirectoryA
CreateFileA
DeleteFileA
GetWindowsDirectoryA
GetCurrentThreadId
GetTickCount
SetEvent
WaitForMultipleObjects
TerminateThread
GetLastError
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
ResetEvent
WaitForSingleObject
CloseHandle
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceA
Sleep
OutputDebugStringA

user32

ShowWindow
SetWindowTextA
SetCursor
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetWindowTextA
LoadCursorA
GetSystemMetrics
GetSysColorBrush
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DestroyMenu
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
UnhookWindowsHookEx
GetWindowThreadProcessId
SendMessageA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
PostMessageA
PostQuitMessage
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindowRect

gdi32

DeleteDC
CreateBitmap
GetStockObject
ScaleWindowExtEx
PtVisible
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
GetDeviceCaps
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
RectVisible

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey

shlwapi

PathFindFileNameA
PathFindExtensionA

oleaut32

VariantInit
VariantClear
VariantChangeType

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

imagehlp

ImageNtHeader
CheckSumMappedFile

ws2_32

listen
WSACreateEvent
WSAEventSelect
WSAWaitForMultipleEvents
bind
WSAAccept
WSACleanup
WSACloseEvent
closesocket
WSASend
WSAGetLastError
WSASocketA
WSAStartup
htons
WSARecv
WSAEnumNetworkEvents

Exports

Exports

GetChannelCtrl
GetDownloadCtrl

Sections

.text
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uninst.exe.nsis
updateC2.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:be:c6:c0:7a:72:06:31:ba:4c:7f:9e:e7:bd:75:60
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

25/05/2007, 00:00

Not After

24/05/2008, 23:59

Subject

CN=UUSee Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Multimedia Dept.,O=UUSee Inc.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7d:6e:ca:05:38:9a:f5:cf:7c:8a:a0:b5:9e:82:5c:86:6b:b1:b5:e7
Signer

Actual PE Digest

7d:6e:ca:05:38:9a:f5:cf:7c:8a:a0:b5:9e:82:5c:86:6b:b1:b5:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

UPX0
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uusee_base_update.ini
vermini.ini
vermini_x.ini
vermini_x1.ini
videoAccDll.dll
.dll windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/04/2008, 00:00

Not After

28/04/2009, 23:59

Subject

CN=Beijing Shi Yue Network Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=development,O=Beijing Shi Yue Network Technology Co.\, Ltd.,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c5:13:09:f2:2f:33:df:db:62:5c:93:81:67:2b:0e:e3:23:68:fb:85
Signer

Actual PE Digest

c5:13:09:f2:2f:33:df:db:62:5c:93:81:67:2b:0e:e3:23:68:fb:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

binddll
destroydll
getstatus
getstatusInfo
initdll
setoutdll
settrueoutdll
startdll
startdllex

Sections

CODE
Size: 469KB - Virtual size: 468KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 241B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

170729c4965736ee8f8f4d1bab77cf38

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77Certificate

Extended Key Usages

Key Usages

37:4d:f9:a6:8c:71:46:f6:b7:94:bd:02:8f:2c:5b:21:ad:b7:12:98Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 262KB

.ndata Size: - Virtual size: 272KB

.rsrc Size: 4KB - Virtual size: 4KB

57354bdeea3dfae6e948101add87501a

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 940B

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 2KB

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

4c:be:c6:c0:7a:72:06:31:ba:4c:7f:9e:e7:bd:75:60Certificate

Extended Key Usages

Key Usages

41:7f:d6:05:29:13:a3:54:77:80:f5:11:64:98:cc:52:f8:f8:b9:edSigner

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

37:4d:f9:a6:8c:71:46:f6:b7:94:bd:02:8f:2c:5b:21:ad:b7:12:98
Signer

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 262KB

.ndata
Size: - Virtual size: 272KB

.rsrc
Size: 4KB - Virtual size: 4KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 940B

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 2KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

4c:be:c6:c0:7a:72:06:31:ba:4c:7f:9e:e7:bd:75:60
Certificate

41:7f:d6:05:29:13:a3:54:77:80:f5:11:64:98:cc:52:f8:f8:b9:ed
Signer

UPX0
Size: - Virtual size: 72KB

UPX1
Size: 43KB - Virtual size: 44KB

.rsrc
Size: 1KB - Virtual size: 4KB

.text
Size: 64KB - Virtual size: 62KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 888B

.reloc
Size: 8KB - Virtual size: 6KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

01:89:a5:17:b7:e2:cf:12:67:39:62:bf:01:fb:ea:f6:e3:6f:5f:19
Signer

.text
Size: 96KB - Virtual size: 95KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 4KB - Virtual size: 928B

.reloc
Size: 12KB - Virtual size: 9KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

14:19:69:ea:ed:e5:7e:56:5d:a9:f3:80:6b:3b:cf:77
Certificate

b2:d8:c9:12:95:30:01:63:5b:86:3b:28:3a:83:cd:8c:26:7c:22:83
Signer