fb34776824c542b05dfaae9c8e18ffdb9e450c9dc9e7237c59596bdddbfa4440

Sharing

Copy URL Twitter E-mail

General

Target

fb34776824c542b05dfaae9c8e18ffdb9e450c9dc9e7237c59596bdddbfa4440
Size

23.1MB
MD5

9f2a9bdf12131e52b27f5262460cc873
SHA1

41829a4a5b834ac2fe3c6e616624b3f4ef0df8ea
SHA256

fb34776824c542b05dfaae9c8e18ffdb9e450c9dc9e7237c59596bdddbfa4440
SHA512

3243c9a3fac4bd546e9ca29f768146c385b37129ccc537ca2b89fcd13ac79c3661dc593be8730fb105f2748f0d5908ca7f3f2bc0258e9fb1d51ff3a1e2171329
SSDEEP

393216:b8XBSWmhEVkqCT9ECwmiiPfLsiVgh7y9/AW4uz3VJoKAPJExv/d41pA:AXBchEVDCT1P7oqPjVJoKwJa/daA

Score

N/A

Malware Config

Signatures

Files

fb34776824c542b05dfaae9c8e18ffdb9e450c9dc9e7237c59596bdddbfa4440
.rar
大海啊故乡(初中音乐)/amfilter.dll
.dll regsvr32 windows x86

1c195a2e33d0fec6ffcc15e3c2038e20

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_CIpow
_ftol
??3@YAXPAX@Z
_purecall
??2@YAPAXI@Z

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod
timeKillEvent
timeSetEvent

kernel32

FreeLibrary
LoadLibraryA
MultiByteToWideChar
GetModuleFileNameA
WideCharToMultiByte
GetProcAddress
CreateEventA
SetThreadPriority
GetThreadPriority
GetCurrentThread
GetTickCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreA
ReleaseSemaphore
WaitForSingleObject
MulDiv
InterlockedDecrement
InterlockedIncrement
ResetEvent
Sleep
WaitForMultipleObjects
CreateFileMappingA
SetEvent
lstrcmpiA
GetCurrentThreadId
CloseHandle
GetLastError
GetVersionExA
InitializeCriticalSection
DisableThreadLibraryCalls
lstrlenA

advapi32

RegCloseKey
RegCreateKeyA
RegSetValueA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA

user32

CreateWindowExA
RegisterClassA
LoadCursorA
GetClassInfoA
InvalidateRect
DefWindowProcA
SetForegroundWindow
PostThreadMessageA
GetParent
MapWindowPoints
PostMessageA
InSendMessage
SetWindowTextA
GetWindowTextA
PeekMessageA
GetSystemMetrics
IsZoomed
IsIconic
SetParent
GetQueueStatus
MoveWindow
CreateDialogParamA
MsgWaitForMultipleObjects
DispatchMessageA
LoadStringA
LoadStringW
ShowWindow
GetWindowThreadProcessId
SendMessageA
AdjustWindowRectEx
RegisterWindowMessageA
SendDlgItemMessageA
SetCursor
ClientToScreen
GetDC
ReleaseDC
GetClientRect
SetRectEmpty
IsWindowVisible
GetDesktopWindow
GetWindowRect
GetWindowLongA
SystemParametersInfoA
SetWindowPos
GetWindowPlacement
DestroyWindow
wsprintfA
SetWindowLongA

gdi32

CreateDCA
GetSystemPaletteEntries
CreatePalette
GetDIBits
CreateCompatibleBitmap
GetStockObject
GetDeviceCaps
TextOutA
GetObjectA
SetDIBitsToDevice
StretchDIBits
SetBkMode
GdiFlush
SetTextColor
SelectPalette
CreateDIBSection
DeleteDC
SetStretchBltMode
RealizePalette
CreateCompatibleDC
DeleteObject

ole32

CoCreateInstance
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoFreeUnusedLibraries
StringFromGUID2

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
大海啊故乡(初中音乐)/amplay.dll
.dll windows x86

d27ae8e0b47e73fd96f271a54a5e7088

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
LoadLibraryA
WideCharToMultiByte
GetProcAddress
lstrcpyA
lstrlenA
GetStartupInfoA
GetStdHandle
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetModuleHandleA
GetVersion
HeapFree
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
FreeLibrary
TerminateProcess
GetCurrentProcess
SetHandleCount
SetFilePointer
GetFileType
IsBadReadPtr
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
SetUnhandledExceptionFilter
GetStringTypeA
IsBadWritePtr
IsBadCodePtr
GetStringTypeW
GetLocaleInfoA
GetLocaleInfoW
FlushFileBuffers
CloseHandle
SetStdHandle

user32

SetRect

gdi32

StretchDIBits
SetStretchBltMode

ole32

OleInitialize
CoCreateInstance
OleUninitialize

Exports

Exports

AMAnimUpdate
AMCaptureAnimFrame
AMCloseAnim
AMCloseSound
AMFreeEventByLParam
AMGetAnimCurPos
AMGetAnimDIBs
AMGetAnimDestWindow
AMGetAnimLength
AMGetAnimPalHandle
AMGetAnimPopulorColor
AMGetAnimRect
AMGetAnimWH
AMGetAnimWindowRect
AMGetEventByLParam
AMGetSoundCurPos
AMGetSoundIdLength
AMGetSoundLength
AMOpenAnim
AMOpenSound
AMPauseAnim
AMPauseSound
AMPlayAnim
AMPlaySound
AMPlaySoundID
AMRegMyFilter
AMResumeAnim
AMResumeSound
AMSeekAnim
AMSeekSound
AMSetAnimDestWindow
AMSetAnimMouseEnable
AMSetAnimPalHandle
AMSetAnimRect
AMSetAnimWindowOwner
AMSetAnimWindowPos
AMSetAnimWindowVisible
AMSetAnimWriteBackPtr
AMTestSound
AMUnregMyFilter
IsAMovieInstalled

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
大海啊故乡(初中音乐)/autophon.tbl
大海啊故乡(初中音乐)/driver/gemimg.idr
大海啊故乡(初中音乐)/driver/gif.idr
大海啊故乡(初中音乐)/driver/jpeg.idr
大海啊故乡(初中音乐)/driver/pcx.idr
大海啊故乡(初中音乐)/driver/put.idr
大海啊故乡(初中音乐)/driver/tga.idr
大海啊故乡(初中音乐)/driver/tiff.idr
大海啊故乡(初中音乐)/driver/winbmp.idr
大海啊故乡(初中音乐)/english.hyp
大海啊故乡(初中音乐)/flash/muisc.swf
大海啊故乡(初中音乐)/flash/一.swf
大海啊故乡(初中音乐)/flash/二.swf
大海啊故乡(初中音乐)/flash/后.swf
大海啊故乡(初中音乐)/flash/曲1.swf
大海啊故乡(初中音乐)/flash/曲2.swf
大海啊故乡(初中音乐)/flash/曲3.swf
大海啊故乡(初中音乐)/flash/曲4.swf
大海啊故乡(初中音乐)/flash/曲5.swf
大海啊故乡(初中音乐)/flash/曲6.swf
大海啊故乡(初中音乐)/flash/曲7.swf
大海啊故乡(初中音乐)/flash/曲谱.swf
大海啊故乡(初中音乐)/flash/未命名-1.swf
大海啊故乡(初中音乐)/flash/标.swf
大海啊故乡(初中音乐)/flash/节拍.swf
大海啊故乡(初中音乐)/flash/课件三标题.swf
大海啊故乡(初中音乐)/flash/课题.swf
大海啊故乡(初中音乐)/flash/首页.swf
大海啊故乡(初中音乐)/font/cjkh.vct
大海啊故乡(初中音乐)/font/cjkss.vct
大海啊故乡(初中音乐)/font/usymh.vct
大海啊故乡(初中音乐)/font/usyms.vct
大海啊故乡(初中音乐)/gbk.ltr
大海啊故乡(初中音乐)/image/下边退出.bmp
大海啊故乡(初中音乐)/image/下边.bmp
大海啊故乡(初中音乐)/image/北.gif
.gif
大海啊故乡(初中音乐)/image/北1.gif
.gif
大海啊故乡(初中音乐)/image/按.gif
.gif
大海啊故乡(初中音乐)/image/未标题-3 拷贝.gif
.gif
大海啊故乡(初中音乐)/image/背景1 h拷贝.bmp
大海啊故乡(初中音乐)/image/首页 111贝.bmp
大海啊故乡(初中音乐)/image/首页下.bmp
大海啊故乡(初中音乐)/lpk.dll
.dll windows x86

00c5fd00087020a0645079ce30f4148b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetProcAddress
RtlMoveMemory
LoadLibraryW
lstrcatW
GetSystemDirectoryW
FreeLibrary
lstrcpynA
LockResource
LoadResource
SizeofResource
FindResourceW
CreateProcessW
RtlZeroMemory
CloseHandle
WriteFile
CreateFileW
GetTempFileNameW
GetTempPathW
GetLastError
CreateMutexA
lstrcmpiW
GetModuleFileNameW
GetExitCodeProcess
TerminateProcess
WaitForSingleObject
GetCurrentThreadId
GetFileAttributesW
lstrcpyW
GetTickCount
GetLogicalDrives
FindNextFileW
SetFileAttributesW
CopyFileW
FindClose
FindFirstFileW
WaitForMultipleObjects
TerminateThread
ResumeThread
SetThreadPriority
CreateThread
SetEvent
CreateEventW
DisableThreadLibraryCalls

user32

wsprintfW

shell32

ord64
ord92

shlwapi

SHRegGetValueW
PathFindExtensionW
PathFindFileNameW
PathAppendW
PathRemoveFileSpecW
StrStrIW

Exports

Exports

LpkDllInitialize
LpkDrawTextEx
LpkEditControl
LpkExtTextOut
LpkGetCharacterPlacement
LpkGetTextExtentExPoint
LpkInitialize
LpkPSMTextOut
LpkTabbedTextOut
LpkUseGDIWidthCache
ftsWordBreak

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
大海啊故乡(初中音乐)/mpplay.dll
.dll windows x86

6a1e14aae4e33c963b226e0edd1d8fdb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseMutex
CloseHandle
SetFilePointer
ReadFile
lstrcpyA
CreateFileA
WaitForSingleObject
CreateMutexA
TerminateThread
SetThreadPriority
GetFileSize
CreateThread
FindClose
FindFirstFileA
SuspendThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateEventA
DeleteCriticalSection
WaitForMultipleObjects
ExitProcess
ResumeThread
TlsFree
FreeEnvironmentStringsA
FreeEnvironmentStringsW
SetHandleCount
RaiseException
LCMapStringW
RtlUnwind
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
HeapAlloc
HeapFree
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
TlsSetValue
TlsAlloc
lstrcatA
SetLastError
TlsGetValue
GetLastError
GetFileType
WriteFile
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
SetUnhandledExceptionFilter
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA

user32

MessageBoxA
GetDesktopWindow
PostMessageA
GetForegroundWindow

winmm

mmioOpenA
mmioSetInfo
mmioClose
mmioAdvance
mmioCreateChunk
mmioWrite
mmioAscend
mmioGetInfo

dsound

ord1

Exports

Exports

?GetBitrateString@@YGPBDPAVMPEG_Args@@@Z
?GetCurrentFrame@@YGHPAVMPEG_Args@@@Z
?GetFileSize@@YGHPAVMPEG_Args@@@Z
?GetLayer@@YGPBDPAVMPEG_Args@@@Z
?GetMaxFrameNum@@YGHPAVMPEG_Args@@@Z
?GetMinFrameNum@@YGHPAVMPEG_Args@@@Z
?GetMode@@YGPBDPAVMPEG_Args@@@Z
?GetMp3Version@@YGPBDPAVMPEG_Args@@@Z
?GetOneFrameTime@@YGMPAVMPEG_Args@@@Z
?GetSampleFrequency@@YGPBDPAVMPEG_Args@@@Z
?GetTotalTime@@YGMPAVMPEG_Args@@@Z
?MPEG_play@@YGHPAVMPEG_Args@@@Z
?SetCurrentPos@@YGXPAVMPEG_Args@@H@Z
?SetEndPos@@YGXPAVMPEG_Args@@H@Z
?audio_pause@@YGXPAVMPEG_Args@@@Z
?clear_sound@@YGXPAVMPEG_Args@@@Z
?file_load@@YGHPAVMPEG_Args@@PAD@Z
MP3CloseSound
MP3GetSoundCurPos
MP3GetSoundLength
MP3GetSoundLength2
MP3Open
MP3PauseSound
MP3PlaySound
MP3PlaySoundID
MP3ResumeSound
MP3SeekSound

Sections

.text
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
大海啊故乡(初中音乐)/mtinit.tbl
大海啊故乡(初中音乐)/run_chn.dll
.dll windows x86

0bf9a29529417d2063eea104055535b0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

CloseHandle
CreateFileA
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentThreadId
GetDateFormatA
GetEnvironmentStrings
GetFileAttributesA
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetVersion
GetVersionExA
GlobalMemoryStatus
InitializeCriticalSection
LeaveCriticalSection
LocalAlloc
LocalFree
MultiByteToWideChar
RaiseException
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WideCharToMultiByte
WriteFile

user32

EnumThreadWindows
MessageBoxA

Exports

Exports

@__lockDebuggerData$qv
@__unlockDebuggerData$qv
__DebuggerHookData

Sections

.text
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 65KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
大海啊故乡(初中音乐)/sound/月光女神0.mp3
大海啊故乡(初中音乐)/sound/背景音乐低1.mp3
大海啊故乡(初中音乐)/westfont.dot
大海啊故乡(初中音乐)/westfont.vct
大海啊故乡(初中音乐)/创作说明.doc
.doc windows office2003
大海啊故乡(初中音乐)/大海啊故乡.exe
.exe windows x86

3d04e2918c0647d678f18dbd88ec34ff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

amplay

AMAnimUpdate
AMCaptureAnimFrame
AMCloseAnim
AMCloseSound
AMFreeEventByLParam
AMGetAnimCurPos
AMGetAnimDIBs
AMGetAnimDestWindow
AMGetAnimLength
AMGetAnimPalHandle
AMGetAnimRect
AMGetAnimWH
AMGetAnimWindowRect
AMGetEventByLParam
AMGetSoundCurPos
AMGetSoundIdLength
AMGetSoundLength
AMOpenAnim
AMOpenSound
AMPauseAnim
AMPauseSound
AMPlayAnim
AMPlaySoundID
AMRegMyFilter
AMResumeAnim
AMResumeSound
AMSeekAnim
AMSeekSound
AMSetAnimDestWindow
AMSetAnimMouseEnable
AMSetAnimPalHandle
AMSetAnimRect
AMSetAnimWindowOwner
AMSetAnimWindowPos
AMSetAnimWindowVisible
AMSetAnimWriteBackPtr
AMTestSound
AMUnregMyFilter
IsAMovieInstalled

mpplay

MP3CloseSound
MP3GetSoundCurPos
MP3GetSoundLength
MP3GetSoundLength2
MP3Open
MP3PauseSound
MP3PlaySound
MP3PlaySoundID
MP3ResumeSound
MP3SeekSound

advapi32

CloseServiceHandle
ControlService
CreateServiceA
DeleteService
GetFileSecurityA
OpenSCManagerA
OpenServiceA
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueA
RegQueryValueExA
RegSetValueA
RegSetValueExA
SetFileSecurityA
StartServiceA

kernel32

CloseHandle
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileW
CreateProcessA
CreateThread
DeleteCriticalSection
DeleteFileA
DeviceIoControl
DosDateTimeToFileTime
DuplicateHandle
EnterCriticalSection
ExitProcess
ExitThread
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FlushFileBuffers
FormatMessageA
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetDateFormatA
GetDiskFreeSpaceA
GetDriveTypeA
GetEnvironmentStrings
GetFileAttributesA
GetFileAttributesW
GetFileSize
GetFileTime
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetProcessVersion
GetShortPathNameA
GetStartupInfoA
GetStdHandle
GetStringTypeExA
GetStringTypeW
GetSystemDirectoryA
GetTempFileNameA
GetThreadLocale
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GetVolumeInformationA
GetWindowsDirectoryA
GlobalAddAtomA
GlobalAlloc
GlobalDeleteAtom
GlobalFlags
GlobalFree
GlobalGetAtomNameA
GlobalLock
GlobalMemoryStatus
GlobalReAlloc
GlobalSize
GlobalUnlock
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsDBCSLeadByte
LeaveCriticalSection
LoadLibraryA
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LocalReAlloc
LockFile
LockResource
MapViewOfFile
MoveFileA
MulDiv
MultiByteToWideChar
RaiseException
ReadFile
ResumeThread
RtlUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryA
SetEndOfFile
SetErrorMode
SetEvent
SetFileAttributesA
SetFilePointer
SetFileTime
SetHandleCount
SetLastError
SetThreadPriority
SizeofResource
Sleep
SuspendThread
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnlockFile
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
WritePrivateProfileStringA
_lclose
_llseek
_lopen
_lread
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
GlobalHandle

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

comctl32

ImageList_Create
ImageList_Destroy
ImageList_LoadImageA
ImageList_Merge
ImageList_Read
ImageList_Write
InitCommonControls
LBItemFromPt
MakeDragList

comdlg32

GetFileTitleA
GetOpenFileNameA
GetSaveFileNameA

gdi32

AbortPath
AngleArc
AnimatePalette
Arc
ArcTo
BeginPath
BitBlt
Chord
CloseFigure
CombineRgn
CopyMetaFileA
CreateBitmap
CreateBitmapIndirect
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
CreateDIBPatternBrush
CreateDIBPatternBrushPt
CreateDIBSection
CreateDIBitmap
CreateFontA
CreateFontIndirectA
CreateHatchBrush
CreatePalette
CreatePatternBrush
CreatePen
CreatePenIndirect
CreatePolyPolygonRgn
CreatePolygonRgn
CreateRectRgn
CreateRectRgnIndirect
CreateRoundRectRgn
CreateSolidBrush
DPtoLP
DeleteDC
DeleteEnhMetaFile
DeleteMetaFile
DeleteObject
Ellipse
EndPath
EnumFontFamiliesA
EnumFontFamiliesExA
EnumMetaFile
Escape
ExcludeClipRect
ExtCreatePen
ExtCreateRegion
ExtFloodFill
ExtSelectClipRgn
ExtTextOutA
FillPath
FillRgn
FlattenPath
FloodFill
FrameRgn
GdiFlush
GetBkColor
GetBkMode
GetCharWidthA
GetClipBox
GetClipRgn
GetCurrentObject
GetCurrentPositionEx
GetDIBits
GetDeviceCaps
GetEnhMetaFileA
GetEnhMetaFileHeader
GetGlyphOutlineA
GetKerningPairsA
GetMapMode
GetMetaFileA
GetMetaFileBitsEx
GetObjectA
GetObjectType
GetOutlineTextMetricsA
GetPaletteEntries
GetPixel
GetStockObject
GetStretchBltMode
GetSystemPaletteEntries
GetTextAlign
GetTextColor
GetTextExtentPoint32A
GetTextExtentPointA
GetTextMetricsA
GetViewportExtEx
GetViewportOrgEx
GetWindowExtEx
GetWindowOrgEx
IntersectClipRect
InvertRgn
LPtoDP
LineTo
MaskBlt
ModifyWorldTransform
MoveToEx
OffsetClipRgn
OffsetViewportOrgEx
OffsetWindowOrgEx
PaintRgn
PatBlt
Pie
PlayMetaFile
PlayMetaFileRecord
PlgBlt
PolyBezier
PolyBezierTo
PolyDraw
PolyPolygon
PolyPolyline
PolyTextOutA
Polygon
Polyline
PolylineTo
PtVisible
RealizePalette
RectInRegion
RectVisible
Rectangle
ResizePalette
RestoreDC
RoundRect
SaveDC
ScaleViewportExtEx
ScaleWindowExtEx
SelectClipPath
SelectClipRgn
SelectObject
SelectPalette
SetArcDirection
SetBitmapBits
SetBkColor
SetBkMode
SetBoundsRect
SetBrushOrgEx
SetColorAdjustment
SetDIBits
SetDIBitsToDevice
SetGraphicsMode
SetMapMode
SetMapperFlags
SetMetaFileBitsEx
SetMetaRgn
SetMiterLimit
SetPaletteEntries
SetPixelV
SetPolyFillMode
SetROP2
SetRectRgn
SetStretchBltMode
SetTextAlign
SetTextCharacterExtra
SetTextColor
SetTextJustification
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
SetWorldTransform
StartDocA
StretchBlt
StretchDIBits
StrokeAndFillPath
StrokePath
TextOutA
UnrealizeObject
WidenPath

shell32

DragAcceptFiles
DragFinish
DragQueryFileA
ExtractIconA
SHBrowseForFolderA
SHGetFileInfoA
SHGetMalloc
SHGetPathFromIDListA

user32

AdjustWindowRectEx
AppendMenuA
BeginDeferWindowPos
BeginPaint
BringWindowToTop
CallNextHookEx
CallWindowProcA
CharLowerA
CharNextA
CharToOemA
CharUpperA
CheckDlgButton
CheckMenuItem
CheckRadioButton
ClientToScreen
CopyAcceleratorTableA
CopyRect
CreateDialogIndirectParamA
CreateMenu
CreatePopupMenu
CreateWindowExA
DefFrameProcA
DefMDIChildProcA
DefWindowProcA
DeferWindowPos
DeleteMenu
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageA
DrawMenuBar
DrawTextA
EnableMenuItem
EnableWindow
EndDeferWindowPos
EndDialog
EndPaint
EnumThreadWindows
EqualRect
FillRect
GetActiveWindow
GetAsyncKeyState
GetCapture
GetClassInfoA
GetClassNameA
GetClientRect
GetCursorPos
GetDC
GetDesktopWindow
GetDialogBaseUnits
GetDlgCtrlID
GetDlgItem
GetDlgItemInt
GetDlgItemTextA
GetDoubleClickTime
GetFocus
GetForegroundWindow
GetKeyState
GetLastActivePopup
GetMenu
GetMenuCheckMarkDimensions
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMenuStringA
GetMessageA
GetMessagePos
GetMessageTime
GetNextDlgGroupItem
GetNextDlgTabItem
GetParent
GetPropA
GetScrollInfo
GetScrollPos
GetScrollRange
GetSubMenu
GetSysColor
GetSystemMetrics
GetTopWindow
GetWindow
GetWindowDC
GetWindowLongA
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
GrayStringA
InflateRect
InsertMenuA
IntersectRect
InvalidateRect
InvertRect
IsChild
IsDialogMessageA
IsDlgButtonChecked
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
KillTimer
LoadAcceleratorsA
LoadBitmapA
LoadCursorA
LoadIconA
LoadMenuA
LoadStringA
MapDialogRect
MapWindowPoints
MessageBeep
MessageBoxA
ModifyMenuA
MoveWindow
OemToCharA
OffsetRect
PeekMessageA
PostMessageA
PostQuitMessage
PostThreadMessageA
PtInRect
RedrawWindow
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemoveMenu
RemovePropA
ReuseDDElParam
ScreenToClient
ScrollWindow
ScrollWindowEx
SendDlgItemMessageA
SendMessageA
SetActiveWindow
SetCapture
SetCursor
SetCursorPos
SetDlgItemInt
SetDlgItemTextA
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemBitmaps
SetMessageQueue
SetParent
SetPropA
SetRect
SetRectEmpty
SetScrollInfo
SetScrollPos
SetScrollRange
SetTimer
SetWindowLongA
SetWindowPlacement
SetWindowPos
SetWindowTextA
SetWindowsHookExA
ShowOwnedPopups
ShowScrollBar
ShowWindow
SystemParametersInfoA
TabbedTextOutA
TrackPopupMenu
TranslateAcceleratorA
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnionRect
UnpackDDElParam
UnregisterClassA
UpdateWindow
ValidateRect
WinHelpA
WindowFromPoint
wsprintfA
wvsprintfA

winmm

mciGetErrorStringA
mciSendCommandA
timeGetTime

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoDisconnectObject
CoFreeUnusedLibraries
CoGetClassObject
CoInitialize
CoRegisterClassObject
CoRegisterMessageFilter
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CoTreatAsClass
CoUninitialize
CreateBindCtx
CreateILockBytesOnHGlobal
CreateStreamOnHGlobal
OleDuplicateData
OleFlushClipboard
OleGetAutoConvert
OleInitialize
OleIsCurrentClipboard
OleRegGetUserType
OleRun
OleSetClipboard
OleUninitialize
ReadClassStg
ReadFmtUserTypeStg
ReleaseStgMedium
SetConvertStg
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
StringFromCLSID
WriteClassStg
WriteFmtUserTypeStg

oleaut32

LoadTypeLib
SafeArrayAccessData
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayRedim
SafeArrayUnaccessData
SysAllocString
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysReAllocStringLen
SysStringByteLen
SysStringLen
VarBstrFromCy
VarBstrFromDate
VarCyFromStr
VarDateFromStr
VariantChangeType
VariantClear
VariantCopy

oledlg

OleUIBusyA

olepro32

OleCreateFontIndirect

Exports

Exports

@CodeBUFFER@$bctr$qv
@CodeBUFFER@$bdtr$qv
@CodeBUFFER@AddCode$qp4CODE
@CodeBUFFER@AddCommCode$qus
@CodeBUFFER@AddConst$qiul
@CodeBUFFER@AddData$qiul
@CodeBUFFER@AddFuncDecl$qp13ExFuncDECLARE
@CodeBUFFER@AddIndexCode$qusi
@CodeBUFFER@AddTypeDef$qp12StructDEFINE
@CodeBUFFER@AddVarDefine$qpxciipii
@CodeBUFFER@FindCode$qp4CODEii
@CodeBUFFER@GetItemNode$qii
@CodeBUFFER@LookupComponent$qpxci
@CodeBUFFER@LookupFunction$qpxc
@CodeBUFFER@LookupStruct$qpxc
@CodeBUFFER@LookupVarDefine$qpxc
@GlobalCONTEXT@AddFuncDecl$qp13ExFuncDECLARE
@GlobalCONTEXT@AddTypeDef$qp12StructDEFINE
@GlobalCONTEXT@AddVarDefine$qpxciipii
@GlobalCONTEXT@CallFunction$qipp5VALUEt2
@GlobalCONTEXT@FreeAllVar$qv
@GlobalCONTEXT@GetFuncDeclare$qi
@GlobalCONTEXT@GetItemNode$qii
@GlobalCONTEXT@GetTypeDef$qi
@GlobalCONTEXT@InitValue$qp5VALUEusi
@GlobalCONTEXT@InitVarValue$qp8VarVALUEi
@GlobalCONTEXT@KillValue$qp5VALUEus
@GlobalCONTEXT@KillVarValue$qp8VarVALUE
@GlobalCONTEXT@LookupComponent$qpxci
@GlobalCONTEXT@LookupFunction$qpxc
@GlobalCONTEXT@LookupStruct$qpxc
@GlobalCONTEXT@LookupVaribal$qpxc
@GlobalCONTEXT@PrepareRunning$qp12ScriptRUNNER
@GlobalCONTEXT@PrepareVar$qv
@OnFlcIdle$qqsv
@OnGifIdle$qqsv
@ScriptRUNNER@$bctr$qi
@ScriptRUNNER@CallDllFunction$qp13ExFuncDECLAREpp5VALUEt2
@ScriptRUNNER@CallFunction$qp13ExFuncDECLAREpp5VALUEt2
@ScriptRUNNER@CallNativeFunction$qp13ExFuncDECLAREpp5VALUEt2
@ScriptRUNNER@CompareValue$qp5VALUEust1usiri
@ScriptRUNNER@ConvertType$qp5VALUEususi
@ScriptRUNNER@CopyValue$qp5VALUEt1us
@ScriptRUNNER@CopyVarValue$qp8VarVALUEt1
@ScriptRUNNER@DoRun$qi
@ScriptRUNNER@EvalCondition$qpi
@ScriptRUNNER@ExecAssignment$qv
@ScriptRUNNER@ExecCode$qi
@ScriptRUNNER@ExecDo$qv
@ScriptRUNNER@ExecElse$qv
@ScriptRUNNER@ExecElseIf$qv
@ScriptRUNNER@ExecEnd$qv
@ScriptRUNNER@ExecEndIf$qv
@ScriptRUNNER@ExecExit$qv
@ScriptRUNNER@ExecFor$qv
@ScriptRUNNER@ExecGosub$qv
@ScriptRUNNER@ExecGoto$qv
@ScriptRUNNER@ExecIf$qv
@ScriptRUNNER@ExecInput$qv
@ScriptRUNNER@ExecLoop$qv
@ScriptRUNNER@ExecNext$qv
@ScriptRUNNER@ExecPrint$qv
@ScriptRUNNER@ExecRead$qv
@ScriptRUNNER@ExecRedim$qv
@ScriptRUNNER@ExecRestore$qv
@ScriptRUNNER@ExecReturn$qv
@ScriptRUNNER@ExecUntil$qv
@ScriptRUNNER@ExecWhile$qv
@ScriptRUNNER@FreeAllVar$qv
@ScriptRUNNER@FreeDll$qv
@ScriptRUNNER@FreeVarList$qp8VarVALUEp9VarDEFINEi
@ScriptRUNNER@GetConditionResult$qpi
@ScriptRUNNER@GetDigitResult$qpd
@ScriptRUNNER@GetParam$qp11FuncDECLARErpcrpp5VALUE
@ScriptRUNNER@GetStringResult$qppc
@ScriptRUNNER@GetStructSize$qi
@ScriptRUNNER@GetTypeDef$qi
@ScriptRUNNER@GetVarAddress$qpp8VarVALUEpp5VALUEpus
@ScriptRUNNER@GetVarSize$qp8VarVALUE
@ScriptRUNNER@InitRunner$qp10CodeBUFFERp13SystemCONTEXTp13GlobalCONTEXT
@ScriptRUNNER@InitValue$qp5VALUEusi
@ScriptRUNNER@InitVarList$qp9VarDEFINEi
@ScriptRUNNER@InitVarValue$qp8VarVALUEi
@ScriptRUNNER@KillValue$qp5VALUEus
@ScriptRUNNER@KillVarValue$qp8VarVALUE
@ScriptRUNNER@LoadStruct$qpcp5VALUEi
@ScriptRUNNER@LoadVarValue$qpcp8VarVALUE
@ScriptRUNNER@ReadStruct$qp5VALUEus
@ScriptRUNNER@RestoreStruct$qpcp5VALUEi
@ScriptRUNNER@RestoreVarValue$qpcp8VarVALUE
@ScriptRUNNER@SkipFunction$qv
@ScriptRUNNER@eval_cond1$qp5VALUEpus
@ScriptRUNNER@eval_cond2$qp5VALUEpus
@ScriptRUNNER@eval_cond3$qp5VALUEpus
@ScriptRUNNER@eval_cond4$qp5VALUEpus
@ScriptRUNNER@eval_exp1$qp5VALUEpus
@ScriptRUNNER@eval_exp2$qp5VALUEpus
@ScriptRUNNER@eval_exp3$qp5VALUEpus
@ScriptRUNNER@eval_exp4$qp5VALUEpus
@ScriptRUNNER@eval_exp5$qp5VALUEpus
@ScriptRUNNER@eval_exp6$qp5VALUEpus
@ScriptSCANNER@$bctr$qv
@ScriptSCANNER@AddLabel$qiii
@ScriptSCANNER@AddParamDef$qpccii
@ScriptSCANNER@DoScan$qpcp13SystemCONTEXTip13GlobalCONTEXTrp10CodeBUFFER
@ScriptSCANNER@FreeParamDef$qv
@ScriptSCANNER@GetItemNode$qii
@ScriptSCANNER@GetTypeDef$qi
@ScriptSCANNER@LookupComponent$qpxci
@ScriptSCANNER@LookupLabTable$qi
@ScriptSCANNER@LookupNameUsed$qpxc
@ScriptSCANNER@LookupParam$qpxc
@ScriptSCANNER@LookupReturn$qpxc
@ScriptSCANNER@LookupStruct$qpxc
@ScriptSCANNER@ScanDATA$qv
@ScriptSCANNER@ScanDIM$qi
@ScriptSCANNER@ScanDeclare$qi
@ScriptSCANNER@ScanFuncBegin$qi
@ScriptSCANNER@ScanFuncEnd$qv
@ScriptSCANNER@ScanFunction$qpcip13ExFuncDECLAREppc
@ScriptSCANNER@ScanNumber$qrdri
@ScriptSCANNER@ScanString$qpccri
@ScriptSCANNER@ScanTYPE$qi
@ScriptSCANNER@ScanTreat$qv
@__lockDebuggerData$qv
@__unlockDebuggerData$qv
@flcClose$qqsp7flcFILE
@flcFirstFrame$qqsp7flcFILEp7tagRECT
@flcFrameTimeOut$qqsp7flcFILE
@flcMostPopulorColor$qqsp7flcFILE
@flcNextFrame$qqsp7flcFILElp7tagRECT
@flcOpen$qqspxcliul
@flcSeekFirstFrame$qqsp7flcFILE
@flcSeekNextFrame$qqsp7flcFILE
@flcSeekPrevFrame$qqsp7flcFILE
@flcSeekToFrame$qqsp7flcFILEl
@mciFlcClose$qqsi
@mciFlcGetDibs$qqsipp13tagBITMAPINFOppuct2t3
@mciFlcGetHwnd$qqsipp6HWND__
@mciFlcOpen$qqspxcululp6HWND__ulpul
@mciFlcPalette$qqsipp10HPALETTE__
@mciFlcPause$qqsi
@mciFlcPlay$qqsiulululp6HWND__
@mciFlcPopulorColor$qqsipul
@mciFlcPut$qqsip7tagRECTul
@mciFlcResume$qqsi
@mciFlcScaleSpeed$qqsiul
@mciFlcSeek$qqsilul
@mciFlcSetPalette$qqsip10HPALETTE__
@mciFlcStatus$qqsiulpul
@mciFlcStop$qqsi
@mciFlcUpdate$qqsip5HDC__p7tagRECT
@mciFlcWhere$qqsip7tagRECTul
@mciFlcWindow$qqsip6HWND__uspc
@mciGifClose$qqsi
@mciGifGetDibs$qqsipp13tagBITMAPINFOppuct2t3
@mciGifGetHwnd$qqsipp6HWND__
@mciGifOpen$qqspxcululp6HWND__ulpul
@mciGifPalette$qqsipp10HPALETTE__
@mciGifPause$qqsi
@mciGifPlay$qqsiulululp6HWND__
@mciGifPopulorColor$qqsipul
@mciGifPut$qqsip7tagRECTul
@mciGifResume$qqsi
@mciGifScaleSpeed$qqsiul
@mciGifSeek$qqsilul
@mciGifSetPalette$qqsip10HPALETTE__
@mciGifStatus$qqsiulpul
@mciGifStop$qqsi
@mciGifUpdate$qqsip5HDC__p7tagRECT
@mciGifWhere$qqsip7tagRECTul
@mciGifWindow$qqsip6HWND__uspc
__DebuggerHookData
__GetExceptDLLinfo
___CPPdebugHook

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 240KB - Virtual size: 392KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
大海啊故乡(初中音乐)/登记表.doc
.doc windows office2003
大海啊故乡(初中音乐)/音乐.mtr

Sharing

General

Malware Config

Signatures

Files

1c195a2e33d0fec6ffcc15e3c2038e20

Headers

File Characteristics

Imports

msvcrt

winmm

kernel32

advapi32

user32

gdi32

ole32

Exports

Exports

Sections

.text Size: 46KB - Virtual size: 45KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 252B

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

d27ae8e0b47e73fd96f271a54a5e7088

Headers

File Characteristics

Imports

kernel32

user32

gdi32

ole32

Exports

Exports

Sections

.text Size: 41KB - Virtual size: 41KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 14KB - Virtual size: 19KB

.idata Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

00c5fd00087020a0645079ce30f4148b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

shlwapi

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: - Virtual size: 672B

.rsrc Size: 39KB - Virtual size: 38KB

.reloc Size: 512B - Virtual size: 494B

6a1e14aae4e33c963b226e0edd1d8fdb

Headers

File Characteristics

Imports

kernel32

user32

winmm

dsound

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 69KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 68KB - Virtual size: 67KB

.reloc Size: 8KB - Virtual size: 6KB

0bf9a29529417d2063eea104055535b0

Headers

File Characteristics

Imports

kernel32

user32

Exports

.text
Size: 46KB - Virtual size: 45KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 252B

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 41KB - Virtual size: 41KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 14KB - Virtual size: 19KB

.idata
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 672B

.rsrc
Size: 39KB - Virtual size: 38KB

.reloc
Size: 512B - Virtual size: 494B

.text
Size: 72KB - Virtual size: 69KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 68KB - Virtual size: 67KB

.reloc
Size: 8KB - Virtual size: 6KB

.text
Size: 33KB - Virtual size: 36KB

.data
Size: 8KB - Virtual size: 12KB

.tls
Size: 512B - Virtual size: 4KB

.idata
Size: 1KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 65KB - Virtual size: 68KB

.reloc
Size: 2KB - Virtual size: 4KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 240KB - Virtual size: 392KB

.tls
Size: 512B - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.idata
Size: 16KB - Virtual size: 20KB

.edata
Size: 7KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 71KB - Virtual size: 72KB