General

Malware Config

Signatures

Files

• 1a2bedd15436c6bf168ca435bfc7e9fa_JaffaCakes118

  .exe windows:4 windows x86 arch:x86

  7fa974366048f9c551ef45714595665e

  
  

  Code Sign

  38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

  Certificate

  Issuer

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Not Before

  15-06-2007 00:00

  Not After

  14-06-2012 23:59

  Subject

  CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  04-12-2003 00:00

  Not After

  03-12-2013 23:59

  Subject

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  35:82:52:72:4c:20:51:f6:c0:e9:84:51:e5:97:f3:00

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  21-07-2011 00:00

  Not After

  20-07-2012 23:59

  Subject

  CN=ZhongXiang ZhiXing Network Service Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software Department,O=ZhongXiang ZhiXing Network Service Co.\, Ltd.,L=ZhongXiang,ST=HuBei,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  86:fa:2a:a7:da:20:5a:fb:fb:1f:9a:ae:27:52:fb:01:16:52:bb:8a

  Signer

  Actual PE Digest

  86:fa:2a:a7:da:20:5a:fb:fb:1f:9a:ae:27:52:fb:01:16:52:bb:8a

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CompareFileTime

  SearchPathA

  GetShortPathNameA

  GetFullPathNameA

  MoveFileA

  SetCurrentDirectoryA

  GetFileAttributesA

  GetLastError

  CreateDirectoryA

  SetFileAttributesA

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameA

  GetCurrentProcess

  CopyFileA

  ExitProcess

  GetWindowsDirectoryA

  SetFileTime

  GetCommandLineA

  SetErrorMode

  LoadLibraryA

  lstrcpynA

  GetDiskFreeSpaceA

  GlobalUnlock

  GlobalLock

  CreateThread

  CreateProcessA

  RemoveDirectoryA

  CreateFileA

  GetTempFileNameA

  lstrlenA

  lstrcatA

  GetSystemDirectoryA

  GetVersion

  CloseHandle

  lstrcmpiA

  lstrcmpA

  ExpandEnvironmentStringsA

  GlobalFree

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GetModuleHandleA

  LoadLibraryExA

  GetProcAddress

  FreeLibrary

  MultiByteToWideChar

  WritePrivateProfileStringA

  GetPrivateProfileStringA

  WriteFile

  ReadFile

  MulDiv

  SetFilePointer

  FindClose

  FindNextFileA

  FindFirstFileA

  DeleteFileA

  GetTempPathA

  user32

  EndDialog

  ScreenToClient

  GetWindowRect

  EnableMenuItem

  GetSystemMenu

  SetClassLongA

  IsWindowEnabled

  SetWindowPos

  GetSysColor

  GetWindowLongA

  SetCursor

  LoadCursorA

  CheckDlgButton

  GetMessagePos

  LoadBitmapA

  CallWindowProcA

  IsWindowVisible

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  RegisterClassA

  TrackPopupMenu

  AppendMenuA

  CreatePopupMenu

  GetSystemMetrics

  SetDlgItemTextA

  GetDlgItemTextA

  MessageBoxIndirectA

  CharPrevA

  DispatchMessageA

  PeekMessageA

  DestroyWindow

  CreateDialogParamA

  SetTimer

  SetWindowTextA

  PostQuitMessage

  SetForegroundWindow

  wsprintfA

  SendMessageTimeoutA

  FindWindowExA

  SystemParametersInfoA

  CreateWindowExA

  GetClassInfoA

  DialogBoxParamA

  CharNextA

  OpenClipboard

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongA

  LoadImageA

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageA

  DefWindowProcA

  BeginPaint

  GetClientRect

  FillRect

  DrawTextA

  EndPaint

  ShowWindow

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectA

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHGetPathFromIDListA

  SHBrowseForFolderA

  SHGetFileInfoA

  ShellExecuteA

  SHFileOperationA

  SHGetSpecialFolderLocation

  advapi32

  RegQueryValueExA

  RegSetValueExA

  RegEnumKeyA

  RegEnumValueA

  RegOpenKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegCloseKey

  RegCreateKeyExA

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  VerQueryValueA

  Sections

  .text

  Size: 23KB - Virtual size: 22KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 107KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 44KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/InstallOptions.dll

  .dll windows:4 windows x86 arch:x86

  b1cd0d78f652ce5fc63f0879371af012

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  SetCurrentDirectoryA

  GetCurrentDirectoryA

  MultiByteToWideChar

  GetPrivateProfileIntA

  GlobalLock

  GetModuleHandleA

  lstrcmpiA

  GetPrivateProfileStringA

  lstrcatA

  lstrcpynA

  WritePrivateProfileStringA

  lstrlenA

  lstrcpyA

  GlobalFree

  GlobalUnlock

  GlobalAlloc

  user32

  MapWindowPoints

  GetDlgCtrlID

  CloseClipboard

  GetClipboardData

  OpenClipboard

  PtInRect

  SetWindowRgn

  LoadIconA

  LoadImageA

  SetWindowLongA

  CreateWindowExA

  MapDialogRect

  SetWindowPos

  GetWindowRect

  CreateDialogParamA

  ShowWindow

  EnableMenuItem

  GetSystemMenu

  EnableWindow

  GetDlgItem

  DestroyIcon

  DestroyWindow

  DispatchMessageA

  TranslateMessage

  GetMessageA

  IsDialogMessageA

  LoadCursorA

  SetCursor

  DrawTextA

  GetWindowLongA

  DrawFocusRect

  CallWindowProcA

  PostMessageA

  MessageBoxA

  CharNextA

  wsprintfA

  GetWindowTextA

  SetWindowTextA

  SendMessageA

  GetClientRect

  gdi32

  SetTextColor

  CreateCompatibleDC

  GetObjectA

  GetDIBits

  CreateRectRgn

  CombineRgn

  DeleteObject

  SelectObject

  shell32

  SHBrowseForFolderA

  SHGetDesktopFolder

  SHGetPathFromIDListA

  ShellExecuteA

  comdlg32

  GetOpenFileNameA

  GetSaveFileNameA

  CommDlgExtendedError

  ole32

  CoTaskMemFree

  Exports

  Exports

  dialog

  initDialog

  show

  Sections

  .text

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 152B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/System.dll

  .dll windows:4 windows x86 arch:x86

  2017f2acbdaa42ab3e4adeb8b4c37e7b

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalAlloc

  GlobalFree

  GlobalSize

  GetLastError

  lstrcpyA

  lstrcpynA

  FreeLibrary

  lstrcatA

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  MultiByteToWideChar

  lstrlenA

  WideCharToMultiByte

  VirtualAlloc

  VirtualProtect

  user32

  wsprintfA

  ole32

  StringFromGUID2

  CLSIDFromString

  Exports

  Exports

  Alloc

  Call

  Copy

  Free

  Get

  Int64Op

  Store

  Sections

  .text

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 784B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 100B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 1024B - Virtual size: 520B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/ToolTips.dll

  .dll windows:4 windows x86 arch:x86

  04338c58e26f4ac6ae89608ac6276429

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GetProcessHeap

  GlobalFree

  HeapAlloc

  user32

  GetClientRect

  SendMessageA

  CreateWindowExA

  comctl32

  ord17

  Exports

  Exports

  Author

  Classic

  Modern

  Sections

  .text

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 512B - Virtual size: 409B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 68B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 186B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/WebCtrl.dll

  .dll windows:4 windows x86 arch:x86

  edf01e434638f2238a21d45d26ed9a7d

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  lstrcpyA

  GlobalAlloc

  MultiByteToWideChar

  GlobalFree

  user32

  DefWindowProcA

  GetWindowLongA

  GetClientRect

  SetWindowLongA

  ole32

  OleCreate

  OleSetContainedObject

  OleUninitialize

  OleInitialize

  oleaut32

  VariantInit

  VariantClear

  SafeArrayCreate

  SafeArrayAccessData

  SafeArrayDestroy

  SysAllocString

  Exports

  Exports

  ShowWebInCtrl

  Sections

  .text

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 828B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 336B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 348B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/header.bmp
• $PLUGINSDIR/ioSpecial.ini
• $PLUGINSDIR/modern-header.bmp
• $PLUGINSDIR/modern-wizard.bmp
• $PROGRAMFILES/hao123icon/hao123.ico
• Baidu-TB-ASBar.exe

  .exe windows:4 windows x86 arch:x86

  b711f65a9aff6a22fb2f57f0ac8bda33

  
  

  Code Sign

  47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  10-05-2010 00:00

  Not After

  10-05-2015 23:59

  Subject

  CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

  Certificate

  Issuer

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Not Before

  21-05-2009 00:00

  Not After

  20-05-2019 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

  Not Before

  31-07-2009 00:00

  Not After

  30-07-2012 23:59

  Subject

  CN=Baidu Online Network Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  Signer

  Actual PE Digest

  Digest Algorithm

  PE Digest Matches

  false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CompareFileTime

  SearchPathA

  GetShortPathNameA

  GetFullPathNameA

  MoveFileA

  lstrcatA

  SetCurrentDirectoryA

  GetFileAttributesA

  GetLastError

  CreateDirectoryA

  SetFileAttributesA

  Sleep

  CreateFileA

  GetFileSize

  GetModuleFileNameA

  GetTickCount

  GetCurrentProcess

  CopyFileA

  ExitProcess

  lstrcpynA

  SetFileTime

  GetWindowsDirectoryA

  GetTempPathA

  GetUserDefaultLangID

  GetDiskFreeSpaceA

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  CreateThread

  CreateProcessA

  RemoveDirectoryA

  GetTempFileNameA

  SetEndOfFile

  UnmapViewOfFile

  MapViewOfFile

  CreateFileMappingA

  lstrcpyA

  lstrlenA

  GetSystemDirectoryA

  CloseHandle

  lstrcmpiA

  GetEnvironmentVariableA

  ExpandEnvironmentStringsA

  GlobalFree

  WaitForSingleObject

  GetExitCodeProcess

  SetErrorMode

  GetModuleHandleA

  LoadLibraryA

  GetProcAddress

  FreeLibrary

  MultiByteToWideChar

  WritePrivateProfileStringA

  MulDiv

  GetPrivateProfileStringA

  WriteFile

  ReadFile

  SetFilePointer

  FindClose

  FindNextFileA

  FindFirstFileA

  DeleteFileA

  GetCommandLineA

  user32

  SystemParametersInfoA

  RegisterClassA

  EndDialog

  ScreenToClient

  GetWindowRect

  SetClassLongA

  IsWindowEnabled

  SetWindowPos

  GetSysColor

  GetWindowLongA

  LoadCursorA

  SetCursor

  CheckDlgButton

  GetMessagePos

  LoadBitmapA

  CallWindowProcA

  IsWindowVisible

  CloseClipboard

  SetClipboardData

  CreateWindowExA

  OpenClipboard

  TrackPopupMenu

  AppendMenuA

  CreatePopupMenu

  GetSystemMetrics

  SetDlgItemTextA

  GetDlgItemTextA

  MessageBoxA

  CharPrevA

  SetTimer

  SetWindowTextA

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfA

  SendMessageTimeoutA

  FindWindowExA

  IsWindow

  GetClassInfoA

  DialogBoxParamA

  CharNextA

  ExitWindowsEx

  CreateDialogParamA

  EmptyClipboard

  DestroyWindow

  SetWindowLongA

  LoadImageA

  GetDC

  EnableWindow

  PeekMessageA

  DispatchMessageA

  InvalidateRect

  SendMessageA

  DefWindowProcA

  BeginPaint

  GetClientRect

  FillRect

  DrawTextA

  EndPaint

  GetDlgItem

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectA

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHGetMalloc

  SHGetPathFromIDListA

  SHBrowseForFolderA

  ShellExecuteA

  SHFileOperationA

  SHGetSpecialFolderLocation

  advapi32

  RegQueryValueExA

  RegSetValueExA

  RegEnumKeyA

  RegEnumValueA

  RegOpenKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegCloseKey

  RegCreateKeyExA

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  VerQueryValueA

  Sections

  .text

  Size: 22KB - Virtual size: 22KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 109KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 32KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 9KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• $PROGRAM_FILES/Baidu/ASBarBroker.exe

  .exe windows:4 windows x86 arch:x86

  8cb73f23fc4ffce04345bba981c347fe

  
  

  Code Sign

  38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

  Certificate

  Issuer

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Not Before

  15-06-2007 00:00

  Not After

  14-06-2012 23:59

  Subject

  CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  04-12-2003 00:00

  Not After

  03-12-2013 23:59

  Subject

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

  Certificate

  Issuer

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Not Before

  21-05-2009 00:00

  Not After

  20-05-2019 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

  Not Before

  31-07-2009 00:00

  Not After

  30-07-2012 23:59

  Subject

  CN=Baidu Online Network Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  Signer

  Actual PE Digest

  Digest Algorithm

  PE Digest Matches

  false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  psapi

  GetModuleFileNameExW

  kernel32

  OutputDebugStringW

  FreeLibrary

  MultiByteToWideChar

  SizeofResource

  LoadResource

  FindResourceW

  LoadLibraryExW

  GetModuleHandleW

  Sleep

  GetProcAddress

  LoadLibraryW

  GetLongPathNameW

  GetCurrentThreadId

  GetCommandLineW

  EnterCriticalSection

  LeaveCriticalSection

  VirtualFreeEx

  CreateRemoteThread

  WriteProcessMemory

  DebugBreak

  GetShortPathNameW

  OpenProcess

  CreateFileW

  DeviceIoControl

  GetVersionExW

  GlobalFree

  GlobalAlloc

  GetCurrentProcess

  GetLocaleInfoA

  GetStringTypeW

  GetStringTypeA

  LCMapStringW

  LCMapStringA

  GetConsoleMode

  lstrlenA

  InterlockedIncrement

  GetModuleFileNameW

  CreateEventW

  CreateThread

  SetEvent

  lstrcmpiW

  InterlockedDecrement

  GetLastError

  DeleteCriticalSection

  InitializeCriticalSection

  RaiseException

  lstrlenW

  WideCharToMultiByte

  WaitForSingleObject

  CloseHandle

  VirtualAllocEx

  GetConsoleCP

  SetFilePointer

  LoadLibraryA

  SetStdHandle

  FlushFileBuffers

  CreateFileA

  WriteConsoleW

  GetConsoleOutputCP

  WriteConsoleA

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  GetTickCount

  QueryPerformanceCounter

  GetStartupInfoA

  GetFileType

  SetHandleCount

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  FreeEnvironmentStringsA

  HeapSize

  GetVersionExA

  HeapAlloc

  HeapFree

  RtlUnwind

  HeapReAlloc

  TerminateProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  GetProcessHeap

  GetStartupInfoW

  VirtualFree

  VirtualAlloc

  HeapDestroy

  HeapCreate

  GetModuleHandleA

  ExitProcess

  WriteFile

  GetStdHandle

  GetModuleFileNameA

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  SetLastError

  user32

  GetMessageW

  TranslateMessage

  DispatchMessageW

  LoadStringW

  CharNextW

  PostThreadMessageW

  UnregisterClassA

  CharLowerBuffW

  advapi32

  RegCreateKeyW

  OpenProcessToken

  GetTokenInformation

  AllocateAndInitializeSid

  EqualSid

  FreeSid

  RegEnumKeyExW

  RegQueryInfoKeyW

  RegSetValueExW

  RegOpenKeyExW

  RegCreateKeyExW

  RegCloseKey

  RegDeleteValueW

  RegDeleteKeyW

  shell32

  ShellExecuteExW

  SHGetFolderPathW

  ole32

  CoInitialize

  CoUninitialize

  CoCreateInstance

  CoTaskMemFree

  CoRegisterClassObject

  CoRevokeClassObject

  CoTaskMemRealloc

  CoTaskMemAlloc

  StringFromGUID2

  oleaut32

  SysAllocString

  LoadTypeLi

  UnRegisterTypeLi

  RegisterTypeLi

  SysStringLen

  SysFreeString

  VarUI4FromStr

  shlwapi

  PathFileExistsW

  StrCmpNIW

  SHGetValueW

  Sections

  .text

  Size: 68KB - Virtual size: 67KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 20KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 24KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• $PROGRAM_FILES/Baidu/AddressBar.dll

  .dll regsvr32 windows:4 windows x86 arch:x86

  c6079cff13dd538f8c2b93227d9d6d6c

  
  

  Code Sign

  38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

  Certificate

  Issuer

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Not Before

  15-06-2007 00:00

  Not After

  14-06-2012 23:59

  Subject

  CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  04-12-2003 00:00

  Not After

  03-12-2013 23:59

  Subject

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

  Certificate

  Issuer

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Not Before

  21-05-2009 00:00

  Not After

  20-05-2019 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

  Not Before

  31-07-2009 00:00

  Not After

  30-07-2012 23:59

  Subject

  CN=Baidu Online Network Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  Signer

  Actual PE Digest

  Digest Algorithm

  PE Digest Matches

  false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  c:\cygwin\home\scmpf\compiler_src\pupeng_213326_win32\app\gensoft\bar\address-search\Res\Chinese\Baidudg\AddressBar.pdb

  Imports

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  ws2_32

  gethostname

  WSAStartup

  gethostbyname

  inet_ntoa

  WSACleanup

  shlwapi

  StrDupW

  PathRemoveFileSpecW

  StrCmpNW

  UrlCanonicalizeW

  UrlUnescapeA

  StrCmpIW

  PathRemoveFileSpecA

  PathIsDirectoryA

  SHDeleteValueW

  PathFileExistsW

  StrStrIW

  SHGetValueW

  StrCpyNW

  SHDeleteKeyW

  SHSetValueW

  dbghelp

  ImageDirectoryEntryToData

  winmm

  timeGetTime

  iphlpapi

  GetAdaptersInfo

  GetNetworkParams

  wininet

  InternetConnectA

  InternetConnectW

  HttpOpenRequestA

  HttpOpenRequestW

  InternetCloseHandle

  InternetSetStatusCallbackA

  InternetSetStatusCallbackW

  HttpSendRequestW

  InternetOpenW

  InternetQueryOptionW

  DeleteUrlCacheEntryW

  InternetGetCookieW

  InternetCrackUrlW

  InternetOpenUrlW

  InternetSetOptionW

  HttpQueryInfoW

  InternetQueryDataAvailable

  InternetReadFile

  GetUrlCacheEntryInfoW

  rpcrt4

  UuidCreate

  setupapi

  SetupIterateCabinetW

  imm32

  ImmGetOpenStatus

  ImmGetDefaultIMEWnd

  ImmGetContext

  ImmReleaseContext

  ImmGetCompositionStringW

  ImmGetCompositionWindow

  kernel32

  GetConsoleCP

  GetModuleFileNameA

  GetConsoleMode

  LoadLibraryA

  LoadLibraryW

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetFileAttributesW

  GetVersion

  RaiseException

  InterlockedDecrement

  lstrlenW

  EnterCriticalSection

  LeaveCriticalSection

  GetLastError

  SetLastError

  GetModuleFileNameW

  OutputDebugStringA

  InterlockedIncrement

  OutputDebugStringW

  InitializeCriticalSection

  DeleteCriticalSection

  lstrcmpiW

  LoadLibraryExW

  lstrlenA

  DebugBreak

  FreeLibrary

  MultiByteToWideChar

  SizeofResource

  LoadResource

  FindResourceW

  DisableThreadLibraryCalls

  LocalFree

  CloseHandle

  ResumeThread

  SetThreadPriority

  ReleaseMutex

  WaitForSingleObject

  CreateMutexW

  DeleteFileW

  GetACP

  GetCurrentThreadId

  WideCharToMultiByte

  GetTickCount

  GlobalUnlock

  GlobalLock

  CreateFileW

  DeviceIoControl

  GetVersionExW

  FlushInstructionCache

  GetCurrentProcess

  lstrcmpW

  SwitchToThread

  GetCurrentProcessId

  GetCommandLineW

  Sleep

  GetPrivateProfileIntW

  GetPrivateProfileStringW

  MoveFileExW

  CreateDirectoryW

  GetCurrentDirectoryA

  GetSystemDirectoryW

  GetLongPathNameW

  TerminateThread

  CopyFileW

  MapViewOfFile

  CreateFileMappingW

  UnmapViewOfFile

  TryEnterCriticalSection

  GetLocalTime

  CompareStringW

  GetWindowsDirectoryW

  QueryPerformanceCounter

  QueryPerformanceFrequency

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  SetFilePointer

  ReadFile

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetCurrentDirectoryW

  SetFileTime

  WriteFile

  GetTempFileNameW

  GetTempPathW

  LockResource

  GlobalFree

  GlobalAlloc

  SetErrorMode

  GetFileSize

  FileTimeToSystemTime

  GetShortPathNameW

  lstrcatW

  lstrcpyW

  WritePrivateProfileStringW

  FindNextFileW

  FindClose

  FindFirstFileW

  FreeResource

  WriteProcessMemory

  ReadProcessMemory

  VirtualProtect

  VirtualQuery

  lstrcmpiA

  GetFileInformationByHandle

  HeapAlloc

  HeapReAlloc

  HeapFree

  HeapSize

  LocalAlloc

  GetProcessHeap

  GlobalReAlloc

  GetFileAttributesA

  DeleteFileA

  AreFileApisANSI

  CreateFileA

  GetTempPathA

  FlushFileBuffers

  SetEndOfFile

  UnlockFile

  LockFile

  LockFileEx

  GetFullPathNameA

  GetFullPathNameW

  GetSystemTime

  GetSystemTimeAsFileTime

  SetCurrentDirectoryA

  LCMapStringA

  LCMapStringW

  SetHandleCount

  GetFileType

  GetStartupInfoA

  FreeEnvironmentStringsA

  CreateThread

  FileTimeToLocalFileTime

  GetDriveTypeW

  GetDriveTypeA

  GetEnvironmentStrings

  FindFirstFileA

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  IsValidCodePage

  GetCurrentThread

  HeapDestroy

  HeapCreate

  FatalAppExitA

  ExitProcess

  GetStdHandle

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetStringTypeA

  GetStringTypeW

  GetTimeZoneInformation

  GetTimeFormatA

  GetDateFormatA

  GetUserDefaultLCID

  GetLocaleInfoA

  EnumSystemLocalesA

  IsValidLocale

  SetConsoleCtrlHandler

  InterlockedExchange

  GetLocaleInfoW

  SetStdHandle

  ExitThread

  IsDebuggerPresent

  GetVersionExA

  InterlockedCompareExchange

  IsProcessorFeaturePresent

  VirtualFree

  VirtualAlloc

  RtlUnwind

  TerminateProcess

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  CompareStringA

  SetEnvironmentVariableA

  UnhandledExceptionFilter

  RemoveDirectoryW

  SetUnhandledExceptionFilter

  user32

  GetCapture

  CreateIconFromResourceEx

  CharLowerBuffW

  SetForegroundWindow

  GetForegroundWindow

  AttachThreadInput

  GetClassLongW

  KillTimer

  SetTimer

  wsprintfW

  RemovePropW

  SetPropW

  GetPropW

  OffsetRect

  SetCursor

  IsWindowEnabled

  GetWindowDC

  ScreenToClient

  MoveWindow

  GetWindowTextLengthW

  SetFocus

  GetWindow

  MapWindowPoints

  SetWindowPos

  GetDlgItem

  EndDialog

  MessageBoxW

  CharLowerW

  FindWindowW

  SetWindowTextW

  GetActiveWindow

  DialogBoxParamW

  FindWindowExW

  PostThreadMessageW

  GetMessageW

  TranslateMessage

  DispatchMessageW

  GetDlgCtrlID

  IsWindowVisible

  EnumChildWindows

  GetKeyState

  GetClassNameW

  GetParent

  GetWindowThreadProcessId

  WindowFromPoint

  GetWindowRect

  CreateWindowExW

  GetClassInfoExW

  RegisterClassExW

  DestroyWindow

  PtInRect

  LoadCursorW

  IsWindow

  ShowWindow

  PostMessageW

  UpdateWindow

  SetRectEmpty

  CreateDialogParamW

  BeginPaint

  EndPaint

  RegisterWindowMessageW

  InvalidateRect

  FillRect

  GetClientRect

  SystemParametersInfoW

  GetWindowTextW

  ReleaseDC

  GetDC

  GetFocus

  CharLowerBuffA

  SetWindowsHookExW

  UnhookWindowsHookEx

  CallNextHookEx

  DefWindowProcW

  GetWindowLongW

  SetWindowLongW

  CharNextW

  LoadIconW

  GetSysColor

  DrawFocusRect

  LoadStringW

  InflateRect

  CopyRect

  DrawTextW

  SendMessageW

  DrawIconEx

  SetScrollPos

  ReleaseCapture

  UpdateLayeredWindow

  SetRect

  GetSystemMetrics

  RegisterClassW

  SetCapture

  DestroyIcon

  GetScrollInfo

  SetScrollInfo

  ShowScrollBar

  PeekMessageW

  GetDesktopWindow

  CharUpperBuffW

  CharUpperW

  MonitorFromRect

  GetMonitorInfoW

  GetCursorPos

  LoadImageW

  UnregisterClassA

  CallWindowProcW

  gdi32

  GetTextExtentPoint32W

  CreateFontIndirectW

  DeleteDC

  SelectObject

  TextOutW

  DeleteObject

  ExtCreateRegion

  CombineRgn

  SetStretchBltMode

  StretchBlt

  GetDIBits

  SetTextColor

  SetBkMode

  SetBkColor

  GetPixel

  ExtTextOutW

  GetTextExtentPointW

  BitBlt

  CreateCompatibleDC

  CreateDIBSection

  CreateFontW

  GetStockObject

  GetCurrentObject

  MoveToEx

  CreateCompatibleBitmap

  LineTo

  CreatePen

  GetObjectW

  CreateSolidBrush

  advapi32

  CryptAcquireContextW

  CryptCreateHash

  CryptHashData

  CryptDeriveKey

  CryptDestroyHash

  CryptDuplicateKey

  CryptDecrypt

  CryptEncrypt

  RegOpenKeyW

  RegEnumKeyExA

  RegEnumKeyExW

  RegDeleteKeyW

  RegDeleteValueW

  RegCloseKey

  RegCreateKeyExW

  RegOpenKeyExW

  RegSetValueExW

  RegQueryInfoKeyW

  RegEnumValueW

  CryptDestroyKey

  RegQueryValueExW

  RegCreateKeyW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  shell32

  ShellExecuteW

  SHGetFolderPathW

  ShellExecuteExW

  ExtractIconW

  SHGetSpecialFolderPathW

  DragQueryFileA

  ord85

  ole32

  GetHGlobalFromStream

  CreateStreamOnHGlobal

  CoTaskMemAlloc

  CoGetClassObject

  RevokeDragDrop

  CoInitialize

  CoUninitialize

  ReleaseStgMedium

  RegisterDragDrop

  CoCreateInstance

  CoTaskMemFree

  CoTaskMemRealloc

  OleUninitialize

  OleInitialize

  oleaut32

  SysAllocString

  LoadTypeLi

  RegisterTypeLi

  VarUI4FromStr

  LoadRegTypeLi

  VariantInit

  SysFreeString

  SysAllocStringLen

  SafeArrayDestroy

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayCreate

  VariantCopy

  SysStringLen

  VariantClear

  GetErrorInfo

  VariantChangeType

  SetErrorInfo

  CreateErrorInfo

  msimg32

  AlphaBlend

  urlmon

  CoInternetGetSession

  Exports

  Exports

  DllCanUnloadNow

  DllCreateObject

  DllGetClassObject

  DllRegisterServer

  DllUnregisterServer

  RemoveOldVersion

  RunOnceUpdate

  SVCUninstall

  UpdateASBar

  _sqlite3_key_interop@12

  _sqlite3_rekey_interop@12

  Sections

  .text

  Size: 872KB - Virtual size: 872KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 155KB - Virtual size: 154KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 27KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 56KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 38KB - Virtual size: 38KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll

  .dll regsvr32 windows:4 windows x86 arch:x86

  8a5151241d661d0fc763cad0cc4438a1

  
  

  Code Sign

  47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  10-05-2010 00:00

  Not After

  10-05-2015 23:59

  Subject

  CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

  Certificate

  Issuer

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Not Before

  21-05-2009 00:00

  Not After

  20-05-2019 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

  Not Before

  31-07-2009 00:00

  Not After

  30-07-2012 23:59

  Subject

  CN=Baidu Online Network Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  Signer

  Actual PE Digest

  Digest Algorithm

  PE Digest Matches

  false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  c:\cygwin\home\scmpf\compiler_src\wujie01_431756_win32\0\app\gensoft\bar\toolbar\chinese_unicode_release\BaiduBarX.pdb

  Imports

  setupapi

  SetupIterateCabinetW

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  imm32

  ImmReleaseContext

  ImmGetContext

  ImmGetCompositionStringW

  shlwapi

  PathFindFileNameW

  StrCpyW

  SHDeleteKeyW

  SHSetValueW

  PathRemoveExtensionW

  PathIsDirectoryW

  PathFileExistsW

  SHDeleteValueW

  UrlCombineW

  PathIsDirectoryA

  PathRemoveFileSpecA

  StrCmpIW

  StrStrIW

  PathFindExtensionW

  UrlUnescapeA

  UrlCanonicalizeW

  StrRetToStrW

  StrRetToStrA

  UrlEscapeW

  SHCopyKeyW

  UrlUnescapeW

  SHGetValueW

  PathRemoveFileSpecW

  wininet

  HttpAddRequestHeadersW

  HttpSendRequestW

  InternetReadFile

  GetUrlCacheEntryInfoW

  InternetCanonicalizeUrlW

  InternetCloseHandle

  HttpOpenRequestW

  InternetConnectW

  InternetSetOptionW

  InternetOpenW

  InternetSetStatusCallbackW

  InternetQueryDataAvailable

  InternetQueryOptionW

  FindFirstUrlCacheGroup

  DeleteUrlCacheGroup

  FindNextUrlCacheGroup

  FindCloseUrlCache

  FindFirstUrlCacheEntryW

  FindNextUrlCacheEntryW

  InternetOpenUrlW

  InternetGetCookieW

  HttpSendRequestExW

  HttpEndRequestW

  InternetGetConnectedState

  InternetOpenA

  InternetSetOptionA

  InternetConnectA

  HttpOpenRequestA

  HttpAddRequestHeadersA

  HttpSendRequestExA

  InternetWriteFile

  HttpEndRequestA

  InternetSetCookieW

  DeleteUrlCacheEntryW

  HttpQueryInfoW

  InternetCrackUrlW

  urlmon

  URLDownloadToFileW

  CoInternetGetSession

  rpcrt4

  UuidCreate

  iphlpapi

  GetAdaptersInfo

  GetNetworkParams

  ws2_32

  gethostname

  gethostbyname

  kernel32

  DebugBreak

  OutputDebugStringW

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetFileAttributesW

  GetVersion

  RaiseException

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  DeleteCriticalSection

  LoadLibraryW

  GetLastError

  SetLastError

  GetModuleFileNameW

  OutputDebugStringA

  GetCurrentThreadId

  InterlockedIncrement

  CreateProcessW

  WideCharToMultiByte

  CreateDirectoryW

  GetTempPathW

  CreateFileW

  CloseHandle

  WriteFile

  GlobalReAlloc

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  WaitForSingleObject

  CreateMutexW

  ReleaseMutex

  DeleteFileW

  ResumeThread

  SetThreadPriority

  SizeofResource

  LockResource

  LoadResource

  FindResourceW

  LocalFree

  FreeLibrary

  lstrcmpiW

  TryEnterCriticalSection

  LoadLibraryExW

  MultiByteToWideChar

  DisableThreadLibraryCalls

  CopyFileW

  DeviceIoControl

  GetSystemDirectoryW

  GetVersionExW

  FlushInstructionCache

  GetTickCount

  CompareStringW

  LoadLibraryA

  GetACP

  GetCurrentProcessId

  FindClose

  FindNextFileW

  FindFirstFileW

  TerminateThread

  GetExitCodeThread

  OpenMutexW

  GetFullPathNameW

  GlobalFree

  MulDiv

  RemoveDirectoryW

  Sleep

  ReadFile

  GetFileSize

  Thread32Next

  SuspendThread

  OpenThread

  Thread32First

  CreateToolhelp32Snapshot

  UnmapViewOfFile

  SetUnhandledExceptionFilter

  MapViewOfFile

  CreateFileMappingW

  TerminateProcess

  OpenProcess

  SwitchToThread

  GetCommandLineW

  ExpandEnvironmentStringsW

  GetExitCodeProcess

  GetPrivateProfileIntW

  Process32NextW

  Process32FirstW

  InterlockedExchange

  FindResourceExW

  SetEvent

  lstrlenA

  GetSystemTime

  ResetEvent

  WritePrivateProfileStringW

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  SetFileAttributesW

  lstrcmpW

  HeapFree

  HeapAlloc

  GetProcessHeap

  GetEnvironmentVariableW

  GlobalSize

  MoveFileExW

  SetErrorMode

  FreeResource

  GetShortPathNameW

  GetSystemDefaultLCID

  ReadProcessMemory

  SetFilePointer

  lstrcatW

  lstrcpyW

  GetTempFileNameW

  GetVersionExA

  InterlockedCompareExchange

  IsProcessorFeaturePresent

  VirtualFree

  VirtualAlloc

  HeapDestroy

  HeapReAlloc

  HeapSize

  RtlUnwind

  UnhandledExceptionFilter

  IsDebuggerPresent

  GetSystemTimeAsFileTime

  ExitThread

  CreateThread

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  GetDriveTypeW

  VirtualProtect

  GetSystemInfo

  VirtualQuery

  GetFileAttributesA

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  IsValidCodePage

  GetCurrentThread

  GetStdHandle

  GetModuleFileNameA

  FatalAppExitA

  HeapCreate

  ExitProcess

  GetConsoleCP

  GetConsoleMode

  GetCurrentDirectoryA

  SetCurrentDirectoryA

  GetTimeZoneInformation

  LCMapStringA

  LCMapStringW

  SetHandleCount

  GetFileType

  GetStartupInfoA

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  QueryPerformanceCounter

  FlushFileBuffers

  GetStringTypeA

  GetStringTypeW

  GetTimeFormatA

  GetDateFormatA

  GetUserDefaultLCID

  GetLocaleInfoA

  EnumSystemLocalesA

  IsValidLocale

  SetConsoleCtrlHandler

  GetLocaleInfoW

  SetStdHandle

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  CreateFileA

  SetEndOfFile

  GetDriveTypeA

  GetFullPathNameA

  CompareStringA

  lstrlenW

  InterlockedDecrement

  CreateEventW

  GetCurrentProcess

  SetEnvironmentVariableA

  GetPrivateProfileStringW

  user32

  ShowCursor

  UnregisterHotKey

  RegisterHotKey

  PrintWindow

  EnumDisplayMonitors

  PeekMessageW

  EndMenu

  GetMenuItemRect

  RemovePropW

  GetPropW

  SetPropW

  SetMenuItemInfoW

  DrawStateW

  TrackPopupMenuEx

  ModifyMenuW

  MessageBeep

  LoadBitmapW

  GetSubMenu

  CharLowerBuffA

  WaitForInputIdle

  CreateIconFromResourceEx

  CharNextA

  EqualRect

  SetActiveWindow

  ScrollWindow

  MonitorFromPoint

  RemoveMenu

  AppendMenuW

  CreatePopupMenu

  SetWindowsHookExW

  UnhookWindowsHookEx

  CallNextHookEx

  RegisterClipboardFormatW

  GetAsyncKeyState

  GetMessagePos

  IsRectEmpty

  GetScrollInfo

  SetScrollPos

  ClientToScreen

  FrameRect

  EnableWindow

  SetWindowRgn

  SetScrollInfo

  GetScrollPos

  DestroyCursor

  DestroyIcon

  GetClassLongW

  SetClassLongW

  MonitorFromRect

  GetMonitorInfoW

  CopyRect

  InflateRect

  WindowFromPoint

  IsChild

  FindWindowW

  MessageBoxW

  AdjustWindowRectEx

  GetCapture

  ReleaseCapture

  GetSysColor

  SetCursor

  GetDlgCtrlID

  SetCapture

  GetSysColorBrush

  UpdateWindow

  DrawFocusRect

  SetRectEmpty

  OffsetRect

  SetFocus

  GetWindowTextLengthW

  DrawTextW

  DrawIconEx

  FillRect

  TrackMouseEvent

  MoveWindow

  CharLowerBuffW

  GetCursorPos

  GetWindowThreadProcessId

  GetGUIThreadInfo

  GetClassNameW

  PtInRect

  ScreenToClient

  GetFocus

  ReleaseDC

  TranslateMessage

  DispatchMessageW

  InvalidateRect

  GetWindowTextW

  RegisterWindowMessageW

  SetRect

  GetActiveWindow

  LoadIconW

  IsWindowVisible

  GetParent

  GetWindow

  GetWindowRect

  SystemParametersInfoW

  GetClientRect

  MapWindowPoints

  SendMessageW

  DialogBoxParamW

  DestroyMenu

  IsMenu

  GetKeyState

  CharLowerW

  CreateWindowExW

  GetClassInfoExW

  RegisterClassExW

  InsertMenuItemW

  GetMenuItemInfoW

  GetMenuItemCount

  EnableMenuItem

  DeleteMenu

  UpdateLayeredWindow

  SetForegroundWindow

  GetForegroundWindow

  AttachThreadInput

  CharUpperBuffW

  GetMessageW

  IsIconic

  PostThreadMessageW

  FindWindowExW

  UnregisterClassA

  EnumChildWindows

  SendMessageA

  GetUpdateRect

  GetTopWindow

  MenuItemFromPoint

  GetMenuItemID

  GetDlgItemTextW

  AdjustWindowRect

  GetWindowDC

  CreateDialogParamW

  SetDlgItemTextW

  RedrawWindow

  EnumWindows

  IsDialogMessageW

  LoadImageW

  OpenClipboard

  EmptyClipboard

  SetClipboardData

  CloseClipboard

  DestroyWindow

  LoadCursorW

  KillTimer

  SetTimer

  PostMessageW

  CharNextW

  EndPaint

  BeginPaint

  DefWindowProcW

  LoadStringW

  SetWindowPos

  IsWindow

  GetDlgItem

  ShowWindow

  GetDC

  SetWindowTextW

  GetWindowLongW

  SetWindowLongW

  CallWindowProcW

  EndDialog

  CharUpperW

  CreateMenu

  InsertMenuW

  IsWindowEnabled

  TrackPopupMenu

  GetSystemMetrics

  gdi32

  PatBlt

  GetTextColor

  CreateRoundRectRgn

  FillRgn

  CreateRectRgn

  SetPixel

  Rectangle

  SetROP2

  CreateDCW

  CreateFontW

  CreateBitmap

  ExcludeClipRect

  GetDeviceCaps

  DPtoLP

  SetViewportOrgEx

  GetObjectW

  CreatePen

  LineTo

  MoveToEx

  SelectObject

  CreateCompatibleBitmap

  ExtTextOutW

  RoundRect

  RestoreDC

  SaveDC

  GetCurrentObject

  CreatePolygonRgn

  CreateSolidBrush

  CreateFontIndirectW

  GetTextExtentPoint32W

  TextOutW

  GetPixel

  SetTextColor

  ExtCreateRegion

  CombineRgn

  SetStretchBltMode

  StretchBlt

  BitBlt

  DeleteObject

  GetStockObject

  CreateCompatibleDC

  GetDIBits

  SetBkColor

  SetBkMode

  DeleteDC

  CreateDIBSection

  GetClipBox

  advapi32

  RegQueryInfoKeyW

  GetSecurityDescriptorSacl

  SetSecurityInfo

  EqualSid

  GetUserNameW

  RegSetKeySecurity

  RegEnumKeyW

  AllocateAndInitializeSid

  InitializeAcl

  AddAce

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  FreeSid

  RegGetKeySecurity

  GetTokenInformation

  CopySid

  RegCreateKeyW

  RegOpenKeyW

  OpenProcessToken

  DuplicateTokenEx

  ConvertStringSidToSidW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegOpenKeyExW

  RegSetValueExW

  RegEnumKeyExW

  RegQueryValueExW

  RegEnumValueW

  CreateProcessAsUserW

  SetTokenInformation

  GetLengthSid

  shell32

  ShellExecuteW

  DragQueryFileA

  DuplicateIcon

  SHFileOperationW

  ShellExecuteExW

  SHCreateDirectoryExW

  ExtractIconW

  SHGetMalloc

  SHGetFileInfoW

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHGetSpecialFolderPathW

  ole32

  OleInitialize

  CLSIDFromProgID

  GetHGlobalFromStream

  CreateStreamOnHGlobal

  OleDraw

  CoCreateGuid

  RegisterDragDrop

  DoDragDrop

  ReleaseStgMedium

  RevokeDragDrop

  StringFromGUID2

  CoTaskMemFree

  CoTaskMemRealloc

  CoTaskMemAlloc

  CoCreateInstance

  CoInitialize

  OleDuplicateData

  CoUninitialize

  OleUninitialize

  oleaut32

  VariantClear

  SysAllocString

  SysAllocStringByteLen

  SysStringByteLen

  SysAllocStringLen

  VarBstrCmp

  VariantCopy

  LoadTypeLi

  VariantInit

  RegisterTypeLi

  VarUI4FromStr

  LoadRegTypeLi

  VarBstrCat

  SafeArrayDestroy

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayCreate

  SysFreeString

  UnRegisterTypeLi

  SysStringLen

  SetErrorInfo

  VariantChangeType

  GetErrorInfo

  CreateErrorInfo

  msimg32

  AlphaBlend

  GradientFill

  gdiplus

  GdipCreateBitmapFromHBITMAP

  GdipCreateBitmapFromScan0

  GdipCloneImage

  GdipSaveImageToFile

  GdiplusStartup

  GdipGetImageEncoders

  GdipGetImageEncodersSize

  GdipFree

  GdipDisposeImage

  GdiplusShutdown

  GdipAlloc

  uxtheme

  DrawThemeBackground

  OpenThemeData

  CloseThemeData

  Exports

  Exports

  ClearDefSearch

  ClearHomePage

  CloseIEUpdate

  DllCanUnloadNow

  DllCreateObject

  DllGetClassObject

  DllRegisterServer

  MyCopyFile

  RunOnceRemove

  RunOnceUpdate

  SVCUninstall

  SetDefSearch

  SetHomePageToBaidu

  Uninstall

  UpdateBaiduToolbar

  UpdateBaiduToolbarWithUI

  Sections

  .text

  Size: 1.4MB - Virtual size: 1.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 306KB - Virtual size: 305KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 17KB - Virtual size: 31KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .Shared

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 737KB - Virtual size: 737KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 93KB - Virtual size: 93KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe

  .exe windows:4 windows x86 arch:x86

  94f6cb58c75c90f3be7ae4e45c80a52d

  
  

  Code Sign

  47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  10-05-2010 00:00

  Not After

  10-05-2015 23:59

  Subject

  CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

  Certificate

  Issuer

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Not Before

  21-05-2009 00:00

  Not After

  20-05-2019 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

  Not Before

  31-07-2009 00:00

  Not After

  30-07-2012 23:59

  Subject

  CN=Baidu Online Network Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  Signer

  Actual PE Digest

  Digest Algorithm

  PE Digest Matches

  false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  psapi

  GetModuleFileNameExW

  dbghelp

  SymGetOptions

  SymSetOptions

  StackWalk

  SymGetModuleInfo

  SymFunctionTableAccess

  SymInitialize

  SymLoadModule

  wininet

  InternetCrackUrlW

  InternetCloseHandle

  InternetOpenA

  InternetSetOptionA

  InternetConnectA

  HttpOpenRequestA

  HttpAddRequestHeadersA

  HttpSendRequestExA

  InternetWriteFile

  HttpEndRequestA

  kernel32

  GetStringTypeW

  GetStringTypeA

  FlushFileBuffers

  GetSystemTimeAsFileTime

  GetTickCount

  QueryPerformanceCounter

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  FreeEnvironmentStringsA

  LCMapStringW

  LCMapStringA

  GetStartupInfoA

  GetFileType

  SetHandleCount

  LocalFree

  InitializeCriticalSection

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  FreeLibrary

  GetProcAddress

  LoadLibraryW

  CloseHandle

  WaitForSingleObject

  WideCharToMultiByte

  lstrlenW

  RaiseException

  GetLastError

  InterlockedDecrement

  lstrcmpiW

  SetEvent

  CreateThread

  CreateEventW

  GetModuleFileNameW

  InterlockedIncrement

  lstrlenA

  DebugBreak

  OutputDebugStringW

  MultiByteToWideChar

  SizeofResource

  LoadResource

  FindResourceW

  LoadLibraryExW

  GetModuleHandleW

  Sleep

  GetCurrentThreadId

  GetCommandLineW

  VirtualFreeEx

  CreateRemoteThread

  WriteProcessMemory

  VirtualAllocEx

  OpenProcess

  GetModuleFileNameA

  VirtualQueryEx

  UnmapViewOfFile

  FlushInstructionCache

  GetCurrentProcess

  MapViewOfFile

  CreateFileMappingW

  OpenThread

  CreateFileW

  DeleteFileW

  GetTempPathW

  ReadFile

  GetFileSize

  InterlockedExchange

  GetSystemDefaultLCID

  GetVersionExW

  WriteFile

  GlobalFree

  GlobalAlloc

  GetCurrentProcessId

  SetFilePointer

  GetShortPathNameW

  FindClose

  FindFirstFileW

  ExitProcess

  TlsFree

  TlsSetValue

  TlsAlloc

  TlsGetValue

  GetModuleHandleA

  GetStartupInfoW

  GetFileAttributesA

  GetDriveTypeW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  TerminateProcess

  HeapReAlloc

  RtlUnwind

  VirtualAlloc

  VirtualFree

  IsProcessorFeaturePresent

  LoadLibraryA

  HeapAlloc

  GetProcessHeap

  HeapFree

  InterlockedCompareExchange

  GetVersionExA

  GetStdHandle

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  HeapSize

  GetLocaleInfoA

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  SetStdHandle

  HeapDestroy

  GetTimeZoneInformation

  CreateFileA

  SetEndOfFile

  GetDriveTypeA

  CompareStringA

  CompareStringW

  SetEnvironmentVariableA

  HeapCreate

  SetLastError

  GetConsoleCP

  GetConsoleMode

  GetFullPathNameW

  GetCurrentDirectoryA

  user32

  CharLowerBuffW

  LoadImageW

  GetParent

  GetWindow

  GetWindowRect

  SystemParametersInfoW

  GetClientRect

  MapWindowPoints

  SetWindowPos

  SendMessageW

  GetDlgItem

  ShowWindow

  GetWindowLongW

  GetActiveWindow

  DestroyWindow

  EndDialog

  DialogBoxParamW

  LoadStringW

  SetWindowLongW

  GetMessageW

  TranslateMessage

  DispatchMessageW

  CharNextW

  PostThreadMessageW

  GetSystemMetrics

  UnregisterClassA

  advapi32

  RegOpenKeyW

  RegCreateKeyW

  OpenProcessToken

  GetTokenInformation

  AllocateAndInitializeSid

  EqualSid

  FreeSid

  RegQueryValueExW

  RegEnumKeyExW

  RegQueryInfoKeyW

  RegSetValueExW

  RegOpenKeyExW

  RegCreateKeyExW

  RegDeleteValueW

  RegDeleteKeyW

  RegCloseKey

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  shell32

  SHGetFolderPathW

  ShellExecuteExW

  ole32

  CoInitialize

  CoUninitialize

  StringFromGUID2

  CoTaskMemFree

  CoRegisterClassObject

  CoRevokeClassObject

  CoTaskMemRealloc

  CoCreateInstance

  CoTaskMemAlloc

  oleaut32

  RegisterTypeLi

  UnRegisterTypeLi

  LoadTypeLi

  SysAllocString

  SysFreeString

  SysStringLen

  VarUI4FromStr

  shlwapi

  PathFileExistsW

  StrCmpNIW

  Sections

  .text

  Size: 140KB - Virtual size: 139KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 44KB - Virtual size: 40KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 12KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 24KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll

  .dll windows:4 windows x86 arch:x86

  d811d71710ad58776155b7a8da1fa9db

  
  

  Code Sign

  47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  10-05-2010 00:00

  Not After

  10-05-2015 23:59

  Subject

  CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

  Certificate

  Issuer

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Not Before

  21-05-2009 00:00

  Not After

  20-05-2019 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

  Not Before

  31-07-2009 00:00

  Not After

  30-07-2012 23:59

  Subject

  CN=Baidu Online Network Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  Signer

  Actual PE Digest

  Digest Algorithm

  PE Digest Matches

  false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GetCurrentThreadId

  GetCommandLineA

  HeapFree

  GetVersionExA

  HeapAlloc

  GetProcessHeap

  GetProcAddress

  GetModuleHandleA

  ExitProcess

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  InterlockedIncrement

  SetLastError

  GetLastError

  InterlockedDecrement

  Sleep

  SetHandleCount

  GetStdHandle

  GetFileType

  GetStartupInfoA

  DeleteCriticalSection

  GetModuleFileNameA

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  WideCharToMultiByte

  GetEnvironmentStringsW

  HeapDestroy

  HeapCreate

  VirtualFree

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  WriteFile

  LeaveCriticalSection

  EnterCriticalSection

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  LoadLibraryA

  InitializeCriticalSection

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  VirtualAlloc

  HeapReAlloc

  RtlUnwind

  HeapSize

  MultiByteToWideChar

  GetLocaleInfoA

  GetStringTypeA

  GetStringTypeW

  LCMapStringA

  LCMapStringW

  Sections

  .text

  Size: 28KB - Virtual size: 24KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 8KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 412KB - Virtual size: 408KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 8KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PROGRAM_FILES/Baidu/conf.xml

  .xml
• Config/Top10.ini
• Data/Apps/CoolTools/QQ±íÇé.ico
• Data/Apps/CoolTools/QQ¿Õ¼ä´úÂë.ico
• Data/Apps/CoolTools/QQ¿Õ¼äËزÄ.ico
• Data/Apps/CoolTools/QQÔÚÏß²éѯ.ico
• Data/Apps/CoolTools/Thumbs.db
• Data/Apps/CoolTools/WebQQ.ico
• Data/Apps/CoolTools/config.txt
• Data/Apps/CoolTools/¸öÐÔÇ©Ãû.ico
• Data/Apps/CoolTools/¹ÉƱÐÐÇé.ico
• Data/Apps/CoolTools/ÃÀͼÐãÐã.ico
• Data/Apps/CoolTools/Ë«É«Çò×ßÊÆ.ico
• Data/Apps/CoolTools/ͼѾѾ.ico
• Data/Apps/CoolTools/ÓÐȤ¸öÐÔÍ·Ïñ.ico
• Data/Apps/CoolTools/ÔÚÏßPS.ico
• Data/Apps/Lives/365ÈÕÀú.ico
• Data/Apps/Lives/Thumbs.db
• Data/Apps/Lives/Web·ÉÐÅ.ico
• Data/Apps/Lives/config.txt
• Data/Apps/Lives/douguo.ico
• Data/Apps/Lives/±ØÓ¦´Êµä.ico
• Data/Apps/Lives/²Ø×å¼ÇÕË.ico
• Data/Apps/Lives/¶¨Ê±ÌáÐÑ.ico
• Data/Apps/Lives/·¢ÐÍÉè¼Æ.ico
• Data/Apps/Lives/·¨±¦Íø.ico
• Data/Apps/Lives/·Ç³ÏÎðÈÅ.ico
• Data/Apps/Lives/¹«½»²éѯ.ico
• Data/Apps/Lives/»ð³µ»úƱ.ico
• Data/Apps/Lives/¼ÇÕËÀ².ico
• Data/Apps/Lives/¼ÒÎñ÷»×Ó.ico
• Data/Apps/Lives/½¡¿µÊ±¿Ì.ico
• Data/Apps/Lives/¿áѶÂÃÓÎ.ico
• Data/Apps/Lives/ÃÀÈݹËÎÊ.ico
• Data/Apps/Lives/ÃûÈËÃûÑÔ.ico
• Data/Apps/Lives/ÄÖÖÓÌáÐÑ.ico
• Data/Apps/Lives/ÊÔÒ¼ä.ico
• Data/Apps/Lives/ÊÖ»ú³äÖµ.ico
• Data/Apps/Lives/ÌìÆøÔ¤±¨.ico
• Data/Apps/Lives/Íâ»ã¶Ò»».ico
• Data/Apps/Lives/ÍòÄêÀú.ico
• Data/Apps/Lives/ÍøËÙ²âÊÔ.ico
• Data/Apps/Lives/лª×Öµä.ico
• Data/Apps/Lives/ÓͺļÆËã.ico
• Data/Apps/Lives/ÔÚÏßµØͼ.ico
• Data/Apps/Lives/ÕË×å¼ÇÕË.ico
• Data/Apps/Lives/Õä°®Íø.ico
• Data/Apps/Lives/Ö°Òµ²âÊÔ.ico
• Data/Apps/Lives/ÖÐÒ½ÌåÖÊ.ico
• Data/Apps/Lives/Öܹ«½âÃÎ.ico
• Data/Apps/Lives/×£¸£¶ÌÐÅ.ico
• Data/Apps/News/Thumbs.db
• Data/Apps/News/config.txt
• Data/Apps/News/·ïÃùÐù.ico
• Data/Apps/News/ºìÐäÌíÏã.ico
• Data/Apps/News/»Ã½£ÊéÃË.ico
• Data/Apps/News/ÆðµãÖÐÎÄÍø.ico
• Data/Apps/News/Ìå̳Öܱ¨.ico
• Data/Apps/News/×ݺáÖÐÎÄ.ico
• Data/Apps/News/äìÏæÊéÔº.ico
• Data/Apps/Videos/PPLIVEÁ¬Ðø¾ç.ico
• Data/Apps/Videos/PPTVµçÊÓ¾ç.ico
• Data/Apps/Videos/PPTVµçÓ°.ico
• Data/Apps/Videos/Thumbs.db
• Data/Apps/Videos/config.txt
• Data/Apps/Videos/¶¹°êµç̨.ico
• Data/Apps/Videos/¶àÃ×ÒôÀÖ.ico
• Data/Apps/Videos/·ï»Ë¿íƵ.ico
• Data/Apps/Videos/¸ßÇåµçÊǪ́.ico
• Data/Apps/Videos/ºÃ°®ÊÕÒô»ú.ico
• Data/Apps/Videos/¿áÁùÓ°ÊÓ.ico
• Data/Apps/Videos/¿áÃ׶¯»­.ico
• Data/Apps/Videos/èÀ´µçÊÓ.ico
• Data/Apps/Videos/ÆæÒì¸ßÇå.ico
• Data/Apps/Videos/ÈËÈ˵ç̨.ico
• Data/Apps/Videos/ËѺü¸ßÇå.ico
• Data/Apps/Videos/ÍÁ¶¹ÊÓƵ.ico
• Data/Apps/Videos/ѸÀ׸ßÇå.ico
• Data/Apps/Videos/ÒôÔĄ̃.ico
• Data/Apps/Videos/ÔÆÊÓµçÊÓ.ico
• Data/Apps/WebGames/Thumbs.db
• Data/Apps/WebGames/config.txt
• Data/Apps/WebGames/defaul.png

  .png
• Data/Apps/WebGames/ÊÇÄÐÈ˾Í.ico
• Data/Games/GAME.htm

  .html
• Data/Games/YXZH.txt
• Data/Games/config.txt
• Data/Games/defaul.png

  .png
• Data/MyUrls/RecomUrls.txt
• Data/Nav1/DH1.htm

  .html
• Data/Nav1/DH2.htm

  .html
• Data/Nav1/DH3.htm

  .html
• Data/Nav1/DH4.htm

  .html
• Data/Nav1/DH5.htm

  .html
• Data/Nav1/Nav1Ver.txt
• Data/Nav1/SYCX.txt
• Data/Taobao/360buy.png

  .png
• Data/Taobao/GW.htm

  .html
• Data/Taobao/SSGW.txt
• Data/Taobao/Thumbs.db
• Data/Taobao/config.txt
• Data/Taobao/µ±µ±Íø.png

  .png
• Data/Taobao/·²¿Í³ÏÆ·.png

  .png
• Data/Taobao/ÌÔ±¦.png

  .png
• Data/Taobao/ÌÔ±¦É̳Ç.png

  .png
• Data/Taobao/׿ԽÍø.png

  .png
• Data/Tools/PPSÍøÊÓ.ico
• Data/Tools/RecomSofts.txt
• Data/Tools/Software/ÓͺļÆËãÆ÷/Oil.dat
• Data/Tools/Software/ÓͺļÆËãÆ÷/Oil.exe

  .exe windows:4 windows x86 arch:x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Sections

  UPX0

  Size: - Virtual size: 176KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 87KB - Virtual size: 88KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 36KB - Virtual size: 36KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• out.upx

  .exe windows:4 windows x86 arch:x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 132KB - Virtual size: 130KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 36KB - Virtual size: 32KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 32KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 48KB - Virtual size: 47KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Data/Tools/Thumbs.db
• Data/Tools/°Ù¶È°éÂÂ.ico
• Qdesk.exe

  .exe windows:4 windows x86 arch:x86

  
  

  Code Sign

  38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

  Certificate

  Issuer

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Not Before

  15-06-2007 00:00

  Not After

  14-06-2012 23:59

  Subject

  CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  04-12-2003 00:00

  Not After

  03-12-2013 23:59

  Subject

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  35:82:52:72:4c:20:51:f6:c0:e9:84:51:e5:97:f3:00

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  21-07-2011 00:00

  Not After

  20-07-2012 23:59

  Subject

  CN=ZhongXiang ZhiXing Network Service Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software Department,O=ZhongXiang ZhiXing Network Service Co.\, Ltd.,L=ZhongXiang,ST=HuBei,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:77:74:6e:1f:f9:8f:ee:db:32:6c:71:6b:29:18:25:dd:d2:de:51

  Signer

  Actual PE Digest

  7c:77:74:6e:1f:f9:8f:ee:db:32:6c:71:6b:29:18:25:dd:d2:de:51

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 1.4MB - Virtual size: 1.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 104KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 16B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 95KB - Virtual size: 94KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 806KB - Virtual size: 806KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• QdeskApp.exe

  .exe windows:4 windows x86 arch:x86

  
  

  Code Sign

  38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

  Certificate

  Issuer

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Not Before

  15-06-2007 00:00

  Not After

  14-06-2012 23:59

  Subject

  CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  04-12-2003 00:00

  Not After

  03-12-2013 23:59

  Subject

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  35:82:52:72:4c:20:51:f6:c0:e9:84:51:e5:97:f3:00

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  21-07-2011 00:00

  Not After

  20-07-2012 23:59

  Subject

  CN=ZhongXiang ZhiXing Network Service Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software Department,O=ZhongXiang ZhiXing Network Service Co.\, Ltd.,L=ZhongXiang,ST=HuBei,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  8f:1d:17:6d:5d:56:ea:7f:9e:18:ae:fb:73:d3:50:b8:34:00:51:7b

  Signer

  Actual PE Digest

  8f:1d:17:6d:5d:56:ea:7f:9e:18:ae:fb:73:d3:50:b8:34:00:51:7b

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 626KB - Virtual size: 625KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 18KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 4KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 16B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 635KB - Virtual size: 635KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• uninst.exe

  .exe windows:4 windows x86 arch:x86

  7fa974366048f9c551ef45714595665e

  
  

  Code Sign

  38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

  Certificate

  Issuer

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Not Before

  15-06-2007 00:00

  Not After

  14-06-2012 23:59

  Subject

  CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  04-12-2003 00:00

  Not After

  03-12-2013 23:59

  Subject

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  35:82:52:72:4c:20:51:f6:c0:e9:84:51:e5:97:f3:00

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  21-07-2011 00:00

  Not After

  20-07-2012 23:59

  Subject

  CN=ZhongXiang ZhiXing Network Service Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software Department,O=ZhongXiang ZhiXing Network Service Co.\, Ltd.,L=ZhongXiang,ST=HuBei,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  cf:2e:a3:dc:40:f4:20:92:74:55:e9:73:9e:fa:ff:2e:c6:27:59:01

  Signer

  Actual PE Digest

  cf:2e:a3:dc:40:f4:20:92:74:55:e9:73:9e:fa:ff:2e:c6:27:59:01

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CompareFileTime

  SearchPathA

  GetShortPathNameA

  GetFullPathNameA

  MoveFileA

  SetCurrentDirectoryA

  GetFileAttributesA

  GetLastError

  CreateDirectoryA

  SetFileAttributesA

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameA

  GetCurrentProcess

  CopyFileA

  ExitProcess

  GetWindowsDirectoryA

  SetFileTime

  GetCommandLineA

  SetErrorMode

  LoadLibraryA

  lstrcpynA

  GetDiskFreeSpaceA

  GlobalUnlock

  GlobalLock

  CreateThread

  CreateProcessA

  RemoveDirectoryA

  CreateFileA

  GetTempFileNameA

  lstrlenA

  lstrcatA

  GetSystemDirectoryA

  GetVersion

  CloseHandle

  lstrcmpiA

  lstrcmpA

  ExpandEnvironmentStringsA

  GlobalFree

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GetModuleHandleA

  LoadLibraryExA

  GetProcAddress

  FreeLibrary

  MultiByteToWideChar

  WritePrivateProfileStringA

  GetPrivateProfileStringA

  WriteFile

  ReadFile

  MulDiv

  SetFilePointer

  FindClose

  FindNextFileA

  FindFirstFileA

  DeleteFileA

  GetTempPathA

  user32

  EndDialog

  ScreenToClient

  GetWindowRect

  EnableMenuItem

  GetSystemMenu

  SetClassLongA

  IsWindowEnabled

  SetWindowPos

  GetSysColor

  GetWindowLongA

  SetCursor

  LoadCursorA

  CheckDlgButton

  GetMessagePos

  LoadBitmapA

  CallWindowProcA

  IsWindowVisible

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  RegisterClassA

  TrackPopupMenu

  AppendMenuA

  CreatePopupMenu

  GetSystemMetrics

  SetDlgItemTextA

  GetDlgItemTextA

  MessageBoxIndirectA

  CharPrevA

  DispatchMessageA

  PeekMessageA

  DestroyWindow

  CreateDialogParamA

  SetTimer

  SetWindowTextA

  PostQuitMessage

  SetForegroundWindow

  wsprintfA

  SendMessageTimeoutA

  FindWindowExA

  SystemParametersInfoA

  CreateWindowExA

  GetClassInfoA

  DialogBoxParamA

  CharNextA

  OpenClipboard

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongA

  LoadImageA

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageA

  DefWindowProcA

  BeginPaint

  GetClientRect

  FillRect

  DrawTextA

  EndPaint

  ShowWindow

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectA

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHGetPathFromIDListA

  SHBrowseForFolderA

  SHGetFileInfoA

  ShellExecuteA

  SHFileOperationA

  SHGetSpecialFolderLocation

  advapi32

  RegQueryValueExA

  RegSetValueExA

  RegEnumKeyA

  RegEnumValueA

  RegOpenKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegCloseKey

  RegCreateKeyExA

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  VerQueryValueA

  Sections

  .text

  Size: 23KB - Virtual size: 22KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 107KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 44KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/modern-header.bmp