XP Pack for 10 - 2013Windows8[.]1[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

XP Pack for 10 - 2013Windows8.1.zip
Size

57.6MB
MD5

9626c0f7310723f26efef5270bf7ba9a
SHA1

5e16842d07316e3626d8a04486a421113e621004
SHA256

48b2d206eb6b4d2e08e7a088d09d40ef7cd2075fcaf84470d70c9b6769c7e99e
SHA512

6498677cabefa417e11d7f97f459077ea3509f5d07893598ed14fed467edcec633ff9ca3bdc47d72cbfe428af4bfabd34ce5b08b8f67b50113a52f8b988f9367
SSDEEP

1572864:uDYQ5+S0nzKbo4H4zfPJxeMpanJEEJXljj72xjc:uPAnv4Y9XouEJlaxjc

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/10 to XP Remake/Windows XP Icons/WinXP Iconpack By 2013Windows8.1.exe	upx

Files

XP Pack for 10 - 2013Windows8.1.zip
.zip

Password: 2013windows8.1
10 to XP Remake/Branding/Basebrd/basebrd.dll
.dll windows x64

Password: 2013windows8.1

61bda503407aef3d81bc2fb259a787bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_lock
__C_specific_handler
_initterm
malloc
free
__dllonexit
_onexit
_amsg_exit
_unlock
_XcptFilter

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-2-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter

Exports

Exports

BrandingGetProductInfoValue
BrandingLoadNeutralString

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 423KB - Virtual size: 422KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
10 to XP Remake/Branding/Basebrd/basebrd.dll.backup
.dll windows x64

Password: 2013windows8.1

61bda503407aef3d81bc2fb259a787bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_lock
__C_specific_handler
_initterm
malloc
free
__dllonexit
_onexit
_amsg_exit
_unlock
_XcptFilter

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-2-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter

Exports

Exports

BrandingGetProductInfoValue
BrandingLoadNeutralString

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 423KB - Virtual size: 422KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
10 to XP Remake/Branding/Basebrd/en-US/basebrd.dll.mui
.dll windows x86

Password: 2013windows8.1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Branding/Shellbrd/shellbrd.dll
.dll windows x64

Password: 2013windows8.1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Branding/Shellbrd/shellbrd.dll.backup
.dll windows x64

Password: 2013windows8.1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.rdata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Build In Windows XP Apps/calc.exe
.exe windows x86

Password: 2013windows8.1

08f6a1b121da8cedde2d1089d0906ed8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellAboutW

msvcrt

__CxxFrameHandler
_CxxThrowException
wcstoul
toupper
wcschr
memmove
wcslen
_wcsrev
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??3@YAXPAX@Z
??1type_info@@UAE@XZ
_controlfp
_except_handler3
?terminate@@YAXXZ

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

kernel32

GetModuleHandleA
LoadLibraryA
GetProcAddress
GlobalCompact
GlobalAlloc
GlobalFree
GlobalReAlloc
lstrcmpW
Sleep
WriteProfileStringW
GetStartupInfoA
GlobalSize
GlobalUnlock
CreateEventW
CreateThread
ResetEvent
lstrcpynW
SetEvent
WaitForSingleObject
CloseHandle
lstrcatW
lstrlenW
LocalReAlloc
LocalFree
LocalAlloc
GetProfileStringW
GlobalLock
GetCommandLineW
lstrcpyW
GetProfileIntW

gdi32

SetBkColor
SetTextColor
SetBkMode

user32

GetMenu
SetDlgItemInt
GetWindowTextW
CheckDlgButton
HideCaret
CallWindowProcW
DrawTextW
WinHelpW
PostQuitMessage
GetDlgCtrlID
ScreenToClient
ChildWindowFromPoint
DefWindowProcW
IsClipboardFormatAvailable
EnableMenuItem
TrackPopupMenuEx
GetDesktopWindow
OpenClipboard
GetClipboardData
CharNextA
CloseClipboard
GetSysColor
DialogBoxParamW
EndDialog
MessageBeep
GetSubMenu
CheckRadioButton
SetWindowTextW
SetFocus
SetCursor
CharNextW
RegisterClassExW
GetSysColorBrush
LoadCursorW
LoadIconW
InvalidateRect
UpdateWindow
ShowWindow
SendMessageW
SetDlgItemTextW
CheckMenuItem
CheckMenuRadioItem
SetWindowPos
OffsetRect
MapWindowPoints
GetClientRect
EnableWindow
LoadMenuW
SetWindowLongW
GetWindowLongW
CreateDialogParamW
GetDlgItem
DestroyMenu
DestroyWindow
SetMenu
GetWindowRect
SystemParametersInfoW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
IsChild
IsDialogMessageW
GetMessageW
LoadAcceleratorsW
CreateWindowExW
MessageBoxW
LoadStringW
SetProcessDefaultLayout
GetProcessDefaultLayout

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Build In Windows XP Apps/cmd.exe
.exe windows x86

Password: 2013windows8.1

dbe5febb7a19ba19945a8e8ba6534abf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushConsoleInputBuffer
LoadLibraryA
InterlockedExchange
FreeLibrary
LocalAlloc
GetVDMCurrentDirectories
CmdBatNotification
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetThreadLocale
GetDiskFreeSpaceExW
CompareFileTime
RemoveDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
CopyFileW
SetFileAttributesW
DeleteFileW
SetFileTime
CreateDirectoryW
FillConsoleOutputAttribute
SetConsoleTextAttribute
ScrollConsoleScreenBufferW
FormatMessageW
DuplicateHandle
FlushFileBuffers
HeapReAlloc
HeapSize
GetFileAttributesExW
LocalFree
GetDriveTypeW
InitializeCriticalSection
SetConsoleCtrlHandler
GetWindowsDirectoryW
GetConsoleTitleW
GetModuleFileNameW
GetVersion
EnterCriticalSection
LeaveCriticalSection
ExpandEnvironmentStringsW
SearchPathW
WriteFile
GetVolumeInformationW
SetLastError
MoveFileW
SetConsoleTitleW
MoveFileExW
GetBinaryTypeW
GetFileAttributesW
GetCurrentThreadId
CreateProcessW
LoadLibraryW
ReadProcessMemory
SetErrorMode
GetConsoleMode
SetConsoleMode
VirtualAlloc
VirtualFree
SetEnvironmentVariableW
GetEnvironmentVariableW
GetCommandLineW
GetEnvironmentStringsW
GetLocalTime
GetTimeFormatW
FileTimeToLocalFileTime
GetDateFormatW
GetLastError
CloseHandle
SetThreadLocale
GetProcAddress
GetModuleHandleW
SetFilePointer
lstrcmpW
lstrcmpiW
HeapAlloc
GetProcessHeap
HeapFree
MultiByteToWideChar
ReadFile
WriteConsoleW
FillConsoleOutputCharacterW
SetConsoleCursorPosition
ReadConsoleW
GetConsoleScreenBufferInfo
GetStdHandle
GetFileType
VirtualQuery
RaiseException
GetCPInfo
GetConsoleOutputCP
WideCharToMultiByte
GetFileSize
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
GetFullPathNameW
GetUserDefaultLCID
GetLocaleInfoW
SetLocalTime
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime

msvcrt

__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
_cexit
_XcptFilter
_exit
_c_exit
calloc
_wcslwr
qsort
_vsnwprintf
wcsstr
_dup2
_dup
_open_osfhandle
_close
swscanf
_ultoa
_pipe
_seh_longjmp_unwind
_setmode
wcsncmp
iswxdigit
fflush
exit
_wtol
time
srand
__set_app_type
wcsrchr
malloc
free
wcstoul
_errno
iswalpha
printf
rand
swprintf
_iob
fprintf
towlower
realloc
setlocale
_snwprintf
wcscat
_wcsupr
wcsncpy
_wpopen
fgets
_pclose
memmove
wcschr
iswspace
_tell
longjmp
wcscmp
_wcsnicmp
_wcsicmp
wcstol
iswdigit
_getch
_get_osfhandle
_controlfp
_setjmp3
_except_handler3
wcscpy
wcslen
wcsspn
towupper

user32

GetUserObjectInformationW
GetThreadDesktop
MessageBeep
GetProcessWindowStation

Sections

.text
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Build In Windows XP Apps/mspaint.exe
.exe windows x86

Password: 2013windows8.1

39d030d5578d4c069903ba6c5e5684f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord2933
ord2634
ord3087
ord4050
ord2755
ord6195
ord2810
ord1771
ord940
ord942
ord2286
ord2354
ord755
ord470
ord2281
ord2362
ord6153
ord5147
ord4225
ord2371
ord5784
ord5790
ord5783
ord4358
ord5244
ord3578
ord298
ord620
ord4753
ord3687
ord3867
ord2066
ord1257
ord1196
ord4470
ord5947
ord5977
ord3090
ord4768
ord4532
ord858
ord922
ord5579
ord4124
ord5679
ord5706
ord536
ord4199
ord5641
ord4315
ord816
ord562
ord4018
ord6115
ord6190
ord1941
ord4270
ord5286
ord818
ord4215
ord2576
ord3649
ord2430
ord2858
ord1637
ord3133
ord567
ord1230
ord3747
ord6124
ord6266
ord3490
ord3016
ord4357
ord5083
ord4444
ord4665
ord4679
ord1878
ord4246
ord4940
ord3249
ord2433
ord1688
ord5000
ord4464
ord2715
ord2382
ord3054
ord5094
ord5097
ord4461
ord4298
ord5006
ord975
ord5472
ord3398
ord2874
ord2873
ord4149
ord4072
ord5233
ord5281
ord2641
ord1658
ord4430
ord5248
ord4421
ord739
ord747
ord736
ord4407
ord5728
ord5491
ord2096
ord4454
ord5652
ord5028
ord439
ord450
ord442
ord4237
ord4787
ord3345
ord5468
ord4146
ord5278
ord674
ord366
ord2084
ord4451
ord5048
ord5092
ord4614
ord4612
ord1886
ord4249
ord4010
ord4951
ord4855
ord4820
ord3182
ord4944
ord2429
ord2163
ord4511
ord4634
ord4910
ord4996
ord4485
ord5015
ord3101
ord4599
ord4994
ord4410
ord5497
ord4622
ord2986
ord3412
ord5019
ord3509
ord6340
ord5623
ord1003
ord3444
ord3782
ord3245
ord4691
ord3055
ord3061
ord6332
ord2502
ord5240
ord4417
ord2394
ord4381
ord3449
ord3193
ord6077
ord6171
ord3256
ord4617
ord4424
ord748
ord5650
ord5738
ord4610
ord5014
ord6193
ord4488
ord5734
ord4615
ord5573
ord2776
ord4651
ord1255
ord2721
ord6466
ord2719
ord2722
ord957
ord2007
ord962
ord750
ord603
ord1262
ord6386
ord1985
ord1961
ord273
ord2247
ord458
ord5200
ord4819
ord4854
ord4950
ord1740
ord456
ord4356
ord5082
ord4442
ord4675
ord1263
ord1229
ord3865
ord4493
ord3480
ord4904
ord4504
ord4589
ord5024
ord4989
ord5153
ord6191
ord4609
ord3614
ord4269
ord743
ord4480
ord2546
ord2504
ord5727
ord3917
ord4847
ord2388
ord3341
ord5296
ord5298
ord4074
ord5303
ord5285
ord5710
ord4616
ord3733
ord815
ord2717
ord6371
ord1197
ord4604
ord459
ord561
ord5496
ord2550
ord5712
ord5713
ord2028
ord986
ord6133
ord520
ord1202
ord6112
ord1149
ord925
ord927
ord4692
ord3442
ord3191
ord3998
ord5228
ord1173
ord1561
ord5264
ord6238
ord1897
ord1937
ord4268
ord4583
ord5070
ord4335
ord4525
ord4539
ord4537
ord4520
ord4523
ord4518
ord4958
ord4955
ord4103
ord5236
ord3743
ord1719
ord560
ord5256
ord4364
ord4893
ord4343
ord4426
ord4607
ord4608
ord813
ord1891
ord4884
ord4458
ord4502
ord4294
ord4141
ord2486
ord2618
ord2619
ord1651
ord4369
ord4846
ord3379
ord482
ord2527
ord2238
ord2529
ord3512
ord1807
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6017
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord5788
ord2518
ord469
ord3517
ord3516
ord4154
ord6399
ord6398
ord1887
ord4952
ord3402
ord4984
ord4921
ord4711
ord5102
ord4906
ord4640
ord4974
ord4516
ord4531
ord5069
ord4033
ord3276
ord3348
ord4620
ord749
ord5012
ord4682
ord2378
ord2379
ord457
ord2548
ord4647
ord4987
ord4851
ord2958
ord430
ord4931
ord4926
ord1821
ord656
ord5871
ord3397
ord3605
ord6376
ord3871
ord6375
ord2081
ord1930
ord1809
ord5878
ord4263
ord3290
ord4360
ord5080
ord1703
ord1708
ord5058
ord554
ord807
ord4230
ord5076
ord1705
ord6049
ord642
ord2403
ord2015
ord4213
ord2570
ord4392
ord3577
ord616
ord4143
ord2079
ord3312
ord5879
ord2112
ord327
ord1259
ord2455
ord1644
ord1795
ord5855
ord4491
ord1704
ord414
ord4128
ord4292
ord6137
ord1258
ord713
ord5808
ord3570
ord610
ord6135
ord287
ord3974
ord2767
ord996
ord3971
ord5438
ord3313
ord1567
ord6381
ord6006
ord765
ord3693
ord5677
ord2100
ord4704
ord5949
ord1775
ord6330
ord5777
ord2109
ord1569
ord4229
ord2914
ord324
ord3592
ord4419
ord2438
ord5257
ord5276
ord5996
ord268
ord289
ord3477
ord6063
ord613
ord825
ord4155
ord5047
ord1710
ord323
ord5785
ord2397
ord640
ord529
ord540
ord796
ord800
ord4418
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142

msvcrt

wcschr
_ftol
_itow
_except_handler3
wcstok
_beginthreadex
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_controlfp
?terminate@@YAXXZ
__CxxFrameHandler
_wsplitpath
_wtoi
_ltow
_wtol
_CxxThrowException
wcscmp
free
_getdcwd
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
__dllonexit
_onexit
wcscat
_wcsdup
_wcsicmp
_purecall
rand

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyW
RegEnumKeyW
RegQueryValueExA

kernel32

QueryPerformanceCounter
GetExitCodeThread
TerminateThread
InterlockedDecrement
InterlockedIncrement
GlobalReAlloc
lstrcmpW
IsDBCSLeadByte
lstrcpyW
LoadLibraryW
GetACP
GetThreadLocale
GetModuleHandleA
GetTickCount
GetModuleHandleW
lstrcpynW
GetLastError
GetCommandLineW
lstrcmpiW
GetProcAddress
SetEndOfFile
FindFirstFileW
FindClose
GetCurrentThreadId
LocalAlloc
LocalFree
lstrlenA
MultiByteToWideChar
GetTempPathW
GetTempFileNameW
GetFileAttributesW
CreateDirectoryW
CreateFileW
GetFileSize
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
CloseHandle
GetNumberFormatW
MulDiv
GetLocaleInfoW
lstrcatW
GlobalLock
GlobalUnlock
GlobalFree
GlobalAlloc
lstrlenW
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetErrorMode
LoadLibraryA
FreeLibrary
InterlockedExchange
RaiseException
GetStartupInfoW

gdi32

SetDIBitsToDevice
GetNearestColor
CreatePalette
SetViewportExtEx
PlayMetaFile
SaveDC
SetMapMode
LPtoDP
RestoreDC
Rectangle
SetDIBColorTable
GetStockObject
FillRgn
GetDIBColorTable
GetCurrentObject
CreatePatternBrush
CreateSolidBrush
ResizePalette
GetNearestPaletteIndex
SetPaletteEntries
GetPaletteEntries
GetDeviceCaps
SetDIBits
DeleteObject
DeleteDC
CreateCompatibleBitmap
CreateBitmap
SelectPalette
RealizePalette
SetBkMode
SetTextColor
SetBkColor
PatBlt
CreateDIBSection
SetTextAlign
ExtTextOutW
GetTextMetricsW
GetTextExtentPoint32W
BitBlt
CreateCompatibleDC
CreateICW
CreateRectRgnIndirect
GetObjectW
CreateDIBitmap
StretchBlt
OffsetRgn
Polygon
GetPixel
CreateHalftonePalette
GetDIBits
CreatePen
SetPixel
LineTo
MoveToEx
UnrealizeObject
SetBrushOrgEx
ExtFloodFill
RoundRect
CreatePolygonRgn
CreateFontIndirectW
CreateDCW
PtVisible
RectVisible
TextOutW
Escape
StretchDIBits
TranslateCharsetInfo
GetBkMode
GetTextColor
EnumFontFamiliesW
EnumFontFamiliesExW
PolyBezier
SetROP2
Polyline
SelectObject
Ellipse
SetStretchBltMode

user32

SetClassLongW
LoadIconW
DestroyCaret
CreateCaret
ShowCaret
SendDlgItemMessageW
GetDlgItemInt
CheckDlgButton
SetDlgItemInt
GetDlgItem
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
PeekMessageW
EnableScrollBar
DestroyWindow
GetKeyboardLayout
SetRectEmpty
InflateRect
LoadBitmapW
SendMessageW
GetWindowRect
UpdateWindow
InvalidateRect
EnableWindow
GetSysColor
wsprintfW
IsWindow
GetSystemMetrics
SetRect
FillRect
MessageBeep
GetParent
MessageBoxW
wvsprintfW
SetWindowTextW
ReleaseDC
DrawFocusRect
GetDC
PtInRect
OffsetRect
WinHelpW
GetClientRect
FrameRect
GetCapture
IsClipboardFormatAvailable
RegisterClipboardFormatW
CopyRect
CharNextW
IntersectRect
UnionRect
ScreenToClient
WindowFromPoint
GetCursorPos
GetKeyState
IsRectEmpty
EqualRect
SetTimer
KillTimer
ReleaseCapture
GetSubMenu
LoadMenuW
BringWindowToTop
ClientToScreen
SetActiveWindow
SetCapture
GetFocus
LoadCursorW
GetWindowLongW
SetCursor
GetDesktopWindow
RemoveMenu
PostMessageW
GetSystemMenu
HideCaret
GetClassInfoW
IsWindowVisible
SystemParametersInfoW
DestroyIcon
LoadStringW
EnableMenuItem
GetMenu
IsMenu
SetWindowLongW
TabbedTextOutW
DrawTextW
GrayStringW
GetWindowDC
CheckMenuItem
BeginPaint
EndPaint
GetUpdateRect
ValidateRect
RedrawWindow
GetWindow
GetCaretPos
SetCaretPos
ShowCursor

comdlg32

CommDlgExtendedError
GetSaveFileNameW
GetFileTitleW
GetOpenFileNameW

ole32

CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
PropVariantClear
CoTaskMemFree
CoCreateInstance
CLSIDFromString
WriteClassStg
WriteFmtUserTypeStg
OleGetClipboard
ReleaseStgMedium
CoInitialize

oleaut32

SysFreeString
SysAllocString

shell32

ShellAboutW
CommandLineToArgvW
SHChangeNotify

imm32

ImmGetCompositionStringW
ImmGetCompositionWindow
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
ImmAssociateContext
ImmNotifyIME

Sections

.text
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Build In Windows XP Apps/notepad.exe
.exe windows x86

419c3fe8c1eefea9336b96f74f0951dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comdlg32

PageSetupDlgW
FindTextW
PrintDlgExW
ChooseFontW
GetFileTitleW
GetOpenFileNameW
ReplaceTextW
CommDlgExtendedError
GetSaveFileNameW

shell32

DragFinish
DragQueryFileW
DragAcceptFiles
ShellAboutW

winspool.drv

GetPrinterDriverW
ClosePrinter
OpenPrinterW

comctl32

CreateStatusWindowW

msvcrt

_XcptFilter
_exit
_c_exit
time
localtime
_cexit
iswctype
_except_handler3
_wtol
wcsncmp
_snwprintf
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
wcsncpy

advapi32

RegQueryValueExW
RegCloseKey
RegCreateKeyW
IsTextUnicode
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLocalTime
GetUserDefaultLCID
GetDateFormatW
GetTimeFormatW
GlobalLock
GlobalUnlock
GetFileInformationByHandle
CreateFileMappingW
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
LoadLibraryA
GetModuleHandleA
GetStartupInfoA
GlobalFree
GetLocaleInfoW
LocalFree
LocalAlloc
lstrlenW
LocalUnlock
CompareStringW
LocalLock
FoldStringW
CloseHandle
lstrcpyW
ReadFile
CreateFileW
lstrcmpiW
GetCurrentProcessId
GetProcAddress
GetCommandLineW
lstrcatW
FindClose
FindFirstFileW
GetFileAttributesW
lstrcmpW
MulDiv
lstrcpynW
LocalSize
GetLastError
WriteFile
SetLastError
WideCharToMultiByte
LocalReAlloc
FormatMessageW
GetUserDefaultUILanguage
SetEndOfFile
DeleteFileW
GetACP
UnmapViewOfFile
MultiByteToWideChar
MapViewOfFile
UnhandledExceptionFilter

gdi32

EndPage
AbortDoc
EndDoc
DeleteDC
StartPage
GetTextExtentPoint32W
CreateDCW
SetAbortProc
GetTextFaceW
TextOutW
StartDocW
EnumFontsW
GetStockObject
GetObjectW
GetDeviceCaps
CreateFontIndirectW
DeleteObject
GetTextMetricsW
SetBkMode
LPtoDP
SetWindowExtEx
SetViewportExtEx
SetMapMode
SelectObject

user32

GetClientRect
SetCursor
ReleaseDC
GetDC
DialogBoxParamW
SetActiveWindow
GetKeyboardLayout
DefWindowProcW
DestroyWindow
MessageBeep
ShowWindow
GetForegroundWindow
IsIconic
GetWindowPlacement
CharUpperW
LoadStringW
LoadAcceleratorsW
GetSystemMenu
RegisterClassExW
LoadImageW
LoadCursorW
SetWindowPlacement
CreateWindowExW
GetDesktopWindow
GetFocus
LoadIconW
SetWindowTextW
PostQuitMessage
RegisterWindowMessageW
UpdateWindow
SetScrollPos
CharLowerW
PeekMessageW
EnableWindow
DrawTextExW
CreateDialogParamW
GetWindowTextW
GetSystemMetrics
MoveWindow
InvalidateRect
WinHelpW
GetDlgCtrlID
ChildWindowFromPoint
ScreenToClient
GetCursorPos
SendDlgItemMessageW
SendMessageW
CharNextW
CheckMenuItem
CloseClipboard
IsClipboardFormatAvailable
OpenClipboard
GetMenuState
EnableMenuItem
GetSubMenu
GetMenu
MessageBoxW
SetWindowLongW
GetWindowLongW
GetDlgItem
SetFocus
SetDlgItemTextW
wsprintfW
GetDlgItemTextW
EndDialog
GetParent
UnhookWinEvent
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
IsDialogMessageW
PostMessageW
GetMessageW
SetWinEventHook

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Build In Windows XP Apps/sndrec32.exe
.exe windows x86

c86d10d715e0a8f08cc68ae46e3fc52f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExA
RegQueryValueExA

kernel32

GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
GetModuleHandleA
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapAlloc
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
GetStartupInfoA
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
GetStringTypeA
GetStringTypeW
LCMapStringA
MultiByteToWideChar
LCMapStringW
VirtualProtect
GetSystemInfo
GetLocaleInfoA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetTempFileNameW
lstrcpynW
GlobalReAlloc
WaitForSingleObject
CreateThread
GlobalMemoryStatus
GetLocaleInfoW
GetCommandLineW
GetFullPathNameW
lstrlenW
lstrcatW
DeleteFileW
CreateFileW
CloseHandle
GlobalAlloc
GlobalLock
GlobalSize
GetCurrentThreadId
lstrcmpiW
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
FreeResource
lstrcmpW
MulDiv
lstrcpyW
GlobalFree
GlobalUnlock
GlobalHandle
VirtualAlloc

gdi32

SetMapMode
GetStockObject
CreateMetaFileW
SetWindowOrgEx
SetWindowExtEx
StretchBlt
CloseMetaFile
DeleteMetaFile
GetDeviceCaps
CreateCompatibleBitmap
GetObjectW
SelectPalette
RealizePalette
GetDIBits
PatBlt
BitBlt
DeleteDC
CreateCompatibleDC
CreateBitmap
SetTextColor
SelectObject
SetBkColor
GetTextExtentPointW
ExtTextOutW
DeleteObject
CreateSolidBrush
SetBrushOrgEx
CreateHatchBrush

user32

SetCursor
LoadCursorW
GetClipboardData
OpenClipboard
wsprintfW
MessageBoxW
wvsprintfW
GetWindowLongW
MessageBeep
CharPrevW
CharNextW
SetClassLongW
SetWindowTextW
LoadAcceleratorsW
DefDlgProcW
RegisterClassW
LoadIconW
GetDlgItem
ShowWindow
GetWindowTextW
ReleaseDC
GetDC
EndPaint
BeginPaint
DefWindowProcW
InflateRect
PeekMessageW
InvalidateRect
SetDlgItemTextW
GetActiveWindow
EnableWindow
GetFocus
SetTimer
KillTimer
RegisterWindowMessageW
DrawIcon
SetRect
GetSystemMetrics
ModifyMenuW
DrawMenuBar
DeleteMenu
GetMenu
IsWindow
EndDialog
SetPropW
RemovePropW
CloseClipboard
GetDlgCtrlID
DialogBoxParamW
MoveWindow
IsIconic
GetWindowRect
DrawFocusRect
CopyRect
DrawEdge
CallWindowProcW
SetWindowLongW
MapWindowPoints
CreateWindowExW
SetForegroundWindow
SetFocus
RemoveMenu
GetMenuStringW
GetSubMenu
InsertMenuW
GetParent
SetWindowPos
DestroyMenu
CreateMenu
RedrawWindow
RegisterClipboardFormatW
DispatchMessageW
UnhookWindowsHookEx
GetSysColor
GetClientRect
FillRect
DestroyWindow
PostQuitMessage
LoadStringW
ScreenToClient
UpdateWindow
IsWindowEnabled
SetActiveWindow
PostMessageW
GetWindow
GetKeyState
EnableMenuItem
IsClipboardFormatAvailable
SetWindowsHookExW
CreateDialogParamW
GetMessageW
TranslateAcceleratorW
IsDialogMessageW
GetPropW
TranslateMessage
WinHelpW
GetDesktopWindow
IsWindowVisible
GetAsyncKeyState
SendMessageW
CallNextHookEx
ClientToScreen

winmm

waveOutUnprepareHeader
mmioOpenW
mmioWrite
mmioAscend
mmioCreateChunk
mmioRead
mmioSeek
mmioDescend
waveOutGetNumDevs
waveInGetNumDevs
waveInOpen
waveOutWrite
waveInAddBuffer
waveOutPrepareHeader
waveInPrepareHeader
waveInUnprepareHeader
waveOutOpen
waveInReset
waveOutReset
mmioGetInfo
waveInStart
waveOutPause
waveOutRestart
waveOutClose
waveInClose
waveOutGetPosition
waveInGetPosition
mmioClose

comdlg32

GetSaveFileNameW
GetOpenFileNameW

shell32

ShellAboutW
DragQueryFileW
DragFinish
SHGetFileInfoW
ShellExecuteW
DragAcceptFiles

ole32

OleFlushClipboard
OleUninitialize
OleInitialize
OleBuildVersion
CoRevokeClassObject
CoLockObjectExternal
CoCreateInstance
OleSetClipboard
WriteClassStg
OleNoteObjectVisible
StgCreateDocfile
OleSave
CreateFileMoniker
OleIsCurrentClipboard
CoRegisterClassObject
CLSIDFromString
OleDraw
WriteClassStm
CreateStreamOnHGlobal
ReleaseStgMedium
CreateDataAdviseHolder
WriteFmtUserTypeStg
StgOpenStorage
CreateOleAdviseHolder
GetRunningObjectTable
CreateBindCtx
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CoGetMalloc

msacm32

acmFormatSuggest
acmStreamOpen
acmStreamSize
acmFormatDetailsW
acmStreamPrepareHeader
acmStreamConvert
acmStreamUnprepareHeader
acmStreamClose
acmMetrics
acmFormatChooseW
acmFormatTagDetailsW

comctl32

ord17
ord8
PropertySheetW

Sections

.text
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Build In Windows XP Apps/taskmgr.exe
.exe windows x86

a91ce4b8d930e2a6762727a205af58c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
IsValidSid
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
RegOpenKeyExA
RegQueryValueExA
LookupPrivilegeValueW

kernel32

GetProcessAffinityMask
OpenProcess
MultiByteToWideChar
GetThreadTimes
TerminateProcess
GetPriorityClass
lstrcmpW
SetEvent
CreateEventW
GetComputerNameW
Sleep
FreeLibrary
SetProcessAffinityMask
LoadLibraryA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentDirectoryW
SetUnhandledExceptionFilter
lstrcmpiW
GetTickCount
HeapSize
GetProcAddress
GetNumberFormatW
HeapReAlloc
lstrlenW
GetCurrentProcess
SetPriorityClass
GetCommandLineW
GetStartupInfoW
GetModuleHandleW
ExitProcess
CreateMutexW
GetCurrentProcessId
ProcessIdToSessionId
ReleaseMutex
SetProcessShutdownParameters
WaitForSingleObject
ExpandEnvironmentStringsW
CreateProcessW
GetCurrentThreadId
FormatMessageW
lstrcatW
GetVersionExW
GetLocaleInfoW
LocalAlloc
LocalFree
HeapFree
HeapAlloc
GetProcessHeap
CreateThread
CloseHandle
lstrcpynW
lstrcpyW
GetLastError
LoadLibraryW
InterlockedCompareExchange
GetVersionExA
IsBadWritePtr
SetLastError
GetCurrentThread
DelayLoadFailureHook
UnhandledExceptionFilter

gdi32

CreateFontIndirectW
GetCharWidth32W
CreateCompatibleBitmap
Rectangle
SetBkMode
SetTextColor
CreateCompatibleDC
DeleteDC
GetCurrentObject
GetObjectW
BitBlt
SelectObject
MoveToEx
LineTo
CreatePen
GetStockObject
CreateRectRgn
DeleteObject
CreateSolidBrush
CombineRgn
SetRectRgn
GetDeviceCaps
FillRgn

user32

DestroyIcon
LoadImageW
BeginDeferWindowPos
GetMenuItemCount
EnableMenuItem
GetSystemMetrics
SetMenuItemInfoW
LoadMenuW
DestroyMenu
ExitWindowsEx
LockWorkStation
GetAsyncKeyState
SetForegroundWindow
OpenIcon
LoadAcceleratorsW
MessageBoxW
CheckDlgButton
EndDialog
GetWindowTextW
IsDlgButtonChecked
GetSubMenu
InvalidateRect
GetSysColor
MonitorFromRect
SetTimer
LoadIconW
GetThreadDesktop
GetDialogBaseUnits
KillTimer
GetDesktopWindow
DestroyWindow
MessageBeep
MoveWindow
PostQuitMessage
IsZoomed
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
CreateDialogParamW
SendMessageTimeoutW
AllowSetForegroundWindow
GetWindowThreadProcessId
FindWindowW
RegisterWindowMessageW
FillRect
DrawTextW
UpdateWindow
GetDlgCtrlID
SetFocus
CreateWindowExW
DialogBoxParamW
GetShellWindow
SetScrollPos
GetScrollInfo
IsWindow
EnableWindow
GetFocus
CharLowerBuffW
TrackPopupMenuEx
GetGuiResources
EnumWindowStationsW
GetClassLongW
IsHungAppWindow
InternalGetWindowText
IsWindowVisible
GetWindow
SetMenuDefaultItem
EnumWindows
CloseDesktop
SetThreadDesktop
OpenDesktopW
EnumDesktopsW
CloseWindowStation
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
CascadeWindows
TileWindows
SwitchToThisWindow
GetLastActivePopup
EndTask
PostMessageW
ShowWindowAsync
GetCursorPos
SetDlgItemTextW
GetParent
GetWindowTextLengthW
SetRect
SetCursor
LoadCursorW
GetWindowRect
DeferWindowPos
EndDeferWindowPos
GetMenuItemInfoW
IsIconic
BeginPaint
EndPaint
DrawEdge
GetForegroundWindow
GetKeyState
PostThreadMessageW
wsprintfW
GetClientRect
SetScrollInfo
ShowWindow
SetWindowPos
SetMenu
GetDlgItem
MapWindowPoints
SendMessageW
GetMenu
CheckMenuRadioItem
CheckMenuItem
DeleteMenu
LoadStringW
SetWindowTextW
GetClassInfoW
RegisterClassW
GetDC
ReleaseDC
SystemParametersInfoW
GetWindowLongW
SetWindowLongW
CallWindowProcW
DefWindowProcW
RemoveMenu
GetWindowLongA

ntdll

_chkstk
_snwprintf
RtlUnwind
_wcsicmp
NtQueryVirtualMemory
NtOpenThread
NtClose
strrchr
RtlLargeIntegerToChar
RtlAnsiStringToUnicodeString
_ui64tow
mbstowcs
memmove
NtQuerySystemInformation
wcstol
NtShutdownSystem
NtInitiatePowerAction
NtPowerInformation
RtlTimeToElapsedTimeFields

iphlpapi

GetInterfaceInfo
GetNumberOfInterfaces
NhGetInterfaceNameFromDeviceGuid
GetIfEntry

comctl32

ord17
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetIconSize
ImageList_Create
CreateStatusWindowW

shlwapi

StrStrIW
ord413
StrFormatByteSizeW
ord437
wnsprintfW

shell32

Shell_NotifyIconW
ord245
ShellAboutW
ord236
ord241
ord100
ord61

secur32

GetUserNameExW

vdmdbg

VDMEnumTaskWOWEx
VDMTerminateTaskWOW

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Build In Windows XP Apps/wordpad.exe
.exe windows x86

d5da56aa722c8e874cd0a79f94da852d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord5497
ord4622
ord4651
ord5748
ord4150
ord2986
ord3412
ord5019
ord5623
ord1003
ord3444
ord4691
ord3055
ord3061
ord6332
ord2502
ord2534
ord5738
ord1740
ord5573
ord3167
ord5650
ord4417
ord4950
ord4854
ord4819
ord4381
ord3449
ord3193
ord3256
ord3275
ord3376
ord4617
ord4424
ord456
ord6076
ord6171
ord3782
ord2006
ord6391
ord5451
ord3293
ord4477
ord1773
ord2785
ord2853
ord5648
ord5013
ord5100
ord4915
ord4997
ord4724
ord4663
ord4484
ord4339
ord4332
ord4641
ord5016
ord4486
ord4506
ord4956
ord4649
ord4376
ord4639
ord2540
ord5504
ord4032
ord3263
ord3348
ord4616
ord4418
ord5820
ord720
ord420
ord5952
ord1868
ord1886
ord1797
ord260
ord826
ord4294
ord2859
ord2371
ord1662
ord2644
ord5506
ord2937
ord2550
ord4458
ord6195
ord2385
ord2793
ord4017
ord3295
ord6466
ord744
ord3765
ord2515
ord993
ord1079
ord447
ord2386
ord6336
ord1258
ord2154
ord1262
ord6335
ord5994
ord3211
ord2246
ord2153
ord2170
ord4037
ord1640
ord429
ord748
ord2394
ord1984
ord3437
ord3792
ord4487
ord3490
ord1722
ord1130
ord824
ord1255
ord738
ord1196
ord3764
ord2167
ord2513
ord441
ord3023
ord4583
ord4886
ord4526
ord5070
ord4335
ord4343
ord4525
ord4539
ord4537
ord4520
ord4523
ord4518
ord4958
ord4955
ord6051
ord1768
ord5236
ord5286
ord3743
ord1719
ord4426
ord341
ord303
ord654
ord448
ord2082
ord357
ord535
ord858
ord2776
ord6211
ord861
ord3450
ord3397
ord1941
ord589
ord764
ord1172
ord4370
ord4847
ord325
ord4229
ord4282
ord5155
ord5156
ord5154
ord4899
ord4736
ord4970
ord4942
ord4352
ord4371
ord4848
ord5283
ord4829
ord3694
ord489
ord4253
ord4254
ord4709
ord1683
ord2520
ord5284
ord4433
ord2046
ord4425
ord3695
ord496
ord768
ord771
ord2877
ord3658
ord3621
ord2406
ord3568
ord2855
ord4215
ord2576
ord3649
ord2430
ord1637
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6017
ord6168
ord5869
ord5785
ord5790
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord3591
ord2442
ord5783
ord4155
ord540
ord5871
ord283
ord1764
ord6362
ord2405
ord2016
ord4214
ord2573
ord4395
ord3634
ord567
ord692
ord2332
ord2294
ord2729
ord5268
ord2606
ord1197
ord1145
ord3087
ord2293
ord2350
ord1560
ord1137
ord268
ord5706
ord941
ord940
ord665
ord1971
ord3784
ord5180
ord354
ord4224
ord4602
ord4710
ord6238
ord1173
ord1561
ord5977
ord2634
ord922
ord4273
ord4272
ord5679
ord5568
ord2914
ord5061
ord4629
ord4601
ord4744
ord5010
ord4828
ord355
ord2331
ord616
ord772
ord4263
ord6138
ord5856
ord4270
ord1634
ord3614
ord3566
ord1143
ord5781
ord2403
ord2015
ord4213
ord2570
ord4392
ord5084
ord500
ord6193
ord5878
ord3312
ord2854
ord3871
ord2836
ord2099
ord3290
ord6150
ord2522
ord4360
ord4051
ord5467
ord4116
ord2381
ord1703
ord1708
ord5230
ord6365
ord5275
ord5058
ord5244
ord2436
ord3725
ord807
ord554
ord3084
ord2072
ord4448
ord4491
ord6451
ord5080
ord2290
ord609
ord4118
ord2567
ord4390
ord3569
ord3867
ord319
ord4357
ord5083
ord4358
ord5078
ord1702
ord1704
ord3375
ord3680
ord450
ord747
ord1878
ord4246
ord4497
ord5950
ord3099
ord3133
ord4143
ord5491
ord2096
ord4454
ord6142
ord5879
ord2112
ord2879
ord5652
ord5472
ord6060
ord2486
ord2619
ord2618
ord6266
ord2004
ord4940
ord3249
ord2433
ord1688
ord5000
ord4464
ord2715
ord2382
ord3054
ord5094
ord5097
ord4461
ord4298
ord3345
ord5006
ord975
ord3398
ord2874
ord2873
ord4149
ord4072
ord5233
ord5281
ord2641
ord1658
ord4430
ord5248
ord4421
ord739
ord439
ord442
ord736
ord5082
ord1834
ord4237
ord5996
ord2109
ord4504
ord4356
ord2992
ord5193
ord4695
ord1263
ord1229
ord5047
ord6191
ord3865
ord5024
ord1946
ord5468
ord4146
ord5278
ord674
ord796
ord6373
ord4451
ord529
ord366
ord2912
ord2795
ord958
ord6308
ord4172
ord3313
ord6006
ord5769
ord2593
ord3175
ord3178
ord3171
ord3502
ord3609
ord1259
ord6023
ord6381
ord6022
ord5438
ord1105
ord3785
ord703
ord603
ord6397
ord5441
ord1961
ord273
ord403
ord6398
ord6385
ord2885
ord3515
ord3516
ord1008
ord1192
ord4128
ord4292
ord4225
ord5784
ord5035
ord3688
ord6115
ord562
ord3578
ord620
ord1230
ord1709
ord5147
ord298
ord3749
ord1887
ord4952
ord3402
ord4984
ord4921
ord4926
ord4931
ord4711
ord4682
ord4851

msvcrt

_ftol
memmove
setlocale
_wcsdup
free
_wcsicmp
_c_exit
_exit
wcstod
_cexit
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
_vsnwprintf
wcscoll
wcscmp
iswspace
_XcptFilter
__p__commode
__p__fmode
__set_app_type
_except_handler3
??1type_info@@UAE@XZ
__dllonexit
__CxxFrameHandler
_purecall
wcslen
_controlfp
?terminate@@YAXXZ
_onexit

advapi32

RegOpenKeyExA
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegDeleteKeyW
RegQueryValueExA

kernel32

SetEvent
GlobalGetAtomNameW
lstrlenW
GetModuleFileNameW
GetFileAttributesW
GetLocalTime
GetUserDefaultLCID
EnumDateFormatsW
EnumTimeFormatsW
GetDateFormatW
GetCurrentThreadId
FreeLibrary
lstrcmpW
lstrcmpiW
ResetEvent
GlobalLock
GlobalUnlock
GlobalFree
InterlockedIncrement
LoadLibraryW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetStartupInfoW
GetProcAddress
GlobalAlloc
lstrlenA
WideCharToMultiByte
CloseHandle
CreateEventW
FindResourceW
GlobalSize
lstrcmpA
DeleteAtom
GetModuleHandleW
FormatMessageW
MultiByteToWideChar
SetThreadPriority
ResumeThread
GlobalAddAtomW
GetLocaleInfoW
Sleep
GetShortPathNameW
GetVersion
GlobalDeleteAtom
SetCurrentDirectoryW
AddAtomW
LoadLibraryExA
ReadFile
CreateFileW
GetLastError
MulDiv
GetModuleHandleA
GetTimeFormatW
LoadLibraryA
SetUnhandledExceptionFilter

gdi32

GetObjectW
SetPixel
CreateFontIndirectW
CreatePen
DeleteObject
EnumFontFamiliesW
EnumFontFamiliesExW
GetTextMetricsW
BitBlt
CreateCompatibleDC
CreateSolidBrush
GetStockObject
Escape
ExtTextOutW
RectVisible
PtVisible
GetTextExtentPoint32W
TextOutW
Rectangle
GetTextColor
GetBkColor
CreateICW
GetPaletteEntries
ScaleWindowExtEx
DPtoLP
GetDeviceCaps
CreateDCW
SelectObject

user32

SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
DefWindowProcW
GetAsyncKeyState
KillTimer
SetTimer
LoadMenuW
RemoveMenu
GetSubMenu
GetMenuItemCount
DeleteMenu
GetWindow
FindWindowW
ReleaseDC
GetDC
EnumWindows
IntersectRect
GetClassNameW
SendMessageTimeoutW
SendMessageW
RegisterWindowMessageW
EnableWindow
RegisterClipboardFormatW
PtInRect
SetRect
OffsetRect
GetWindowRect
GetClientRect
ClientToScreen
UpdateWindow
InvalidateRect
SetActiveWindow
SetCapture
ReleaseCapture
GetKeyState
IsClipboardFormatAvailable
CountClipboardFormats
GetMonitorInfoW
MonitorFromWindow
WinHelpW
CopyRect
FillRect
DrawFocusRect
CreatePopupMenu
AppendMenuW
TabbedTextOutW
DrawTextW
GrayStringW
LoadStringW
GetSysColor
SetWindowLongW
GetWindowLongW
SetWindowTextW
GetWindowTextW
SetFocus
IsWindow
IsWindowEnabled
GetFocus
GetParent
IsChild
LoadBitmapW
GetNextDlgTabItem
DispatchMessageW
TranslateMessage
GetDlgItem
GetDesktopWindow
BringWindowToTop
ScreenToClient
GetSystemMetrics
PostMessageW
LoadIconW
GetClassInfoW
PeekMessageW
MsgWaitForMultipleObjects
CharToOemBuffA
CharToOemA
OemToCharBuffA
SetRectEmpty
EqualRect
LoadCursorW
DrawEdge
GetCapture
SetForegroundWindow

comdlg32

CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW
ChooseFontW

shell32

DragQueryFileW
SHGetSettings
ShellAboutW
SHGetSpecialFolderPathW
DragFinish

ole32

StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
StringFromCLSID
OleInitialize
OleUninitialize
OleRegGetUserType
CoTaskMemFree
ReleaseStgMedium
ReadClassStg

shlwapi

PathFindFileNameW
SHRegGetValueW

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Preview.png
.png
10 to XP Remake/QueroToolbarInstaller_x64.exe
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Readme.txt
10 to XP Remake/Windows XP Extras/7tt_setup_4.4.6.exe
.exe windows x86

32f3282581436269b3a75b6675fe3e08

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
10 to XP Remake/Windows XP Extras/InstallTakeOwnership.reg
10 to XP Remake/Windows XP Extras/NavBar Remover (By anixx).exe
.exe windows x64

713e93bfdf16fe149bec10141f7bfbbd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wsock32

gethostbyname
inet_addr
WSACleanup
gethostname
WSAStartup

winmm

mixerGetLineInfoW
mixerGetDevCapsW
mixerOpen
mciSendStringW
joyGetPosEx
mixerGetLineControlsW
mixerGetControlDetailsW
mixerSetControlDetails
waveOutGetVolume
mixerClose
waveOutSetVolume
joyGetDevCapsW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

comctl32

ImageList_Create
CreateStatusWindowW
ImageList_ReplaceIcon
ImageList_GetIconSize
ImageList_Destroy
ImageList_AddMasked

psapi

GetModuleFileNameExW
GetProcessImageFileNameW
GetModuleBaseNameW

wininet

InternetOpenW
InternetOpenUrlW
InternetCloseHandle
InternetReadFileExA
InternetReadFile

kernel32

GetModuleFileNameW
GetSystemTimeAsFileTime
FindResourceW
SizeofResource
LoadResource
LockResource
GetFullPathNameW
GetShortPathNameW
FindFirstFileW
FindNextFileW
FindClose
FileTimeToLocalFileTime
SetEnvironmentVariableW
Beep
MoveFileW
OutputDebugStringW
CreateProcessW
GetFileAttributesW
WideCharToMultiByte
MultiByteToWideChar
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
GetCurrentProcessId
OpenProcess
TerminateProcess
SetPriorityClass
SetLastError
GetEnvironmentVariableW
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetDiskFreeSpaceExW
SetVolumeLabelW
CreateFileW
DeviceIoControl
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceW
GetCurrentDirectoryW
CreateDirectoryW
ReadFile
WriteFile
DeleteFileW
SetFileAttributesW
LocalFileTimeToFileTime
SetFileTime
GetFileSizeEx
GetSystemTime
DeleteCriticalSection
GetComputerNameW
GetWindowsDirectoryW
GetTempPathW
EnterCriticalSection
LeaveCriticalSection
VirtualProtect
QueryDosDeviceW
CompareStringW
RemoveDirectoryW
CopyFileW
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FormatMessageW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
WritePrivateProfileSectionW
SetEndOfFile
GetACP
GetFileType
GetStdHandle
SetFilePointerEx
SystemTimeToFileTime
FileTimeToSystemTime
GetFileSize
IsWow64Process
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesW
LoadLibraryExW
GlobalSize
RtlPcToFileHeader
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCommandLineA
GetCommandLineW
ExitProcess
GetModuleHandleExW
HeapSize
HeapReAlloc
GetCPInfo
GetVersionExW
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
GetLastError
CreateMutexW
CloseHandle
GetExitCodeThread
SetThreadPriority
CreateThread
GetStringTypeExW
lstrcmpiW
GetCurrentThreadId
GlobalUnlock
GlobalFree
GlobalAlloc
GlobalLock
SetErrorMode
InitializeCriticalSection
SetCurrentDirectoryW
Sleep
GetTickCount
MulDiv
HeapQueryInformation
HeapFree
HeapAlloc
LCMapStringW
EncodePointer
RaiseException
RtlUnwindEx
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetProcessHeap
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetSystemDefaultUILanguage
ReadConsoleW

user32

GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringW
ExitWindowsEx
SetMenu
FlashWindow
GetPropW
SetPropW
RemovePropW
MapWindowPoints
RedrawWindow
SetWindowLongPtrW
SetParent
GetClassInfoExW
GetAncestor
UpdateWindow
GetMessagePos
GetClassLongPtrW
DefDlgProcW
CallWindowProcW
CheckRadioButton
IntersectRect
GetUpdateRect
PtInRect
CreateDialogIndirectParamW
GetWindowLongPtrW
CreateAcceleratorTableW
DestroyAcceleratorTable
InsertMenuItemW
SetMenuDefaultItem
RemoveMenu
SetMenuItemInfoW
IsMenu
GetMenuItemInfoW
CreateMenu
CreatePopupMenu
SetMenuInfo
AppendMenuW
DestroyMenu
TrackPopupMenuEx
GetDesktopWindow
CopyImage
CreateIconIndirect
CreateIconFromResourceEx
EnumClipboardFormats
GetWindow
BringWindowToTop
MessageBoxW
GetTopWindow
GetQueueStatus
IsWindowVisible
BlockInput
CheckMenuItem
GetSystemMenu
ChangeClipboardChain
SetClipboardViewer
LoadAcceleratorsW
EnableMenuItem
GetMenu
CreateWindowExW
LoadCursorW
DestroyIcon
DestroyWindow
IsCharAlphaW
GetSysColor
VkKeyScanExW
MapVirtualKeyExW
GetKeyboardLayoutNameW
ActivateKeyboardLayout
GetGUIThreadInfo
GetWindowTextW
mouse_event
WindowFromPoint
GetSystemMetrics
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
GetAsyncKeyState
AttachThreadInput
SendInput
UnregisterHotKey
RegisterHotKey
PostQuitMessage
SendMessageTimeoutW
UnhookWindowsHookEx
SetWindowsHookExW
PostThreadMessageW
IsCharAlphaNumericW
IsCharUpperW
IsCharLowerW
ToUnicodeEx
GetKeyboardLayout
CallNextHookEx
CharLowerW
ReleaseDC
GetDC
OpenClipboard
GetClipboardData
GetClipboardFormatNameW
CloseClipboard
SetClipboardData
EmptyClipboard
PostMessageW
FindWindowW
EndDialog
IsWindow
DispatchMessageW
TranslateMessage
GetLastInputInfo
GetCursorInfo
ClientToScreen
MessageBeep
SetDlgItemTextW
GetDlgItem
SendDlgItemMessageW
DialogBoxParamW
SetForegroundWindow
DefWindowProcW
FillRect
DrawIconEx
LoadImageW
GetSysColorBrush
ShowWindow
CountClipboardFormats
SetWindowLongW
ScreenToClient
IsDialogMessageW
SendMessageW
IsWindowEnabled
GetWindowLongW
GetKeyState
TranslateAcceleratorW
KillTimer
RegisterWindowMessageW
GetMonitorInfoW
EnumDisplayMonitors
IsIconic
IsZoomed
EnumWindows
GetWindowTextLengthW
EnableWindow
InvalidateRect
SetLayeredWindowAttributes
SetWindowPos
SetWindowRgn
SetFocus
SetActiveWindow
EnumChildWindows
MoveWindow
GetWindowRect
GetClientRect
SystemParametersInfoW
AdjustWindowRectEx
DrawTextW
PeekMessageW
GetFocus
GetClassNameW
GetWindowThreadProcessId
GetForegroundWindow
GetMessageW
SetTimer
GetParent
GetDlgCtrlID
CharUpperW
IsClipboardFormatAvailable
SetRect
GetIconInfo
MapVirtualKeyW
SetWindowTextW
RegisterClassExW

gdi32

GetPixel
GetClipRgn
GetCharABCWidthsW
SetBkMode
CreatePatternBrush
SetBrushOrgEx
EnumFontFamiliesExW
CreateDIBSection
GdiFlush
SetBkColor
ExcludeClipRect
SetTextColor
GetClipBox
BitBlt
CreateCompatibleBitmap
GetSystemPaletteEntries
GetDIBits
CreateCompatibleDC
CreatePolygonRgn
CreateRectRgn
CreateRoundRectRgn
CreateEllipticRgn
DeleteDC
GetObjectW
GetTextMetricsW
GetTextFaceW
SelectObject
GetStockObject
CreateDCW
CreateSolidBrush
CreateFontW
FillRgn
GetDeviceCaps
DeleteObject

comdlg32

CommDlgExtendedError
GetSaveFileNameW
GetOpenFileNameW

advapi32

RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CloseServiceHandle
UnlockServiceDatabase
LockServiceDatabase
OpenSCManagerW
GetUserNameW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegConnectRegistryW
RegDeleteValueW

shell32

DragQueryPoint
SHEmptyRecycleBinW
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetDesktopFolder
SHGetMalloc
SHGetFolderPathW
ShellExecuteExW
Shell_NotifyIconW
DragFinish
DragQueryFileW
ExtractIconW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
CoInitialize
CoUninitialize
CLSIDFromString
CLSIDFromProgID
CoGetObject
StringFromGUID2
CreateStreamOnHGlobal

oleaut32

SafeArrayGetLBound
GetActiveObject
SysStringLen
OleLoadPicture
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnlock
SafeArrayPtrOfIndex
SafeArrayLock
SafeArrayGetDim
SafeArrayDestroy
SafeArrayGetUBound
VariantCopyInd
SafeArrayCopy
SysAllocString
VariantChangeType
VariantClear
SafeArrayCreate
SysFreeString

Sections

.text
Size: 788KB - Virtual size: 788KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Windows XP Extras/NetAnimate.exe
.exe windows x86

48aa5c8931746a9655524f67b25a47ef

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d8:69:e9:2f:ff:d5:43:63:ac:4e:21:4a:d1:41:f5:f4
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

21/05/2013, 00:00

Not After

21/05/2018, 23:59

Subject

CN=Ilgam Zyulkorneev,O=Ilgam Zyulkorneev,POSTALCODE=420088,STREET=Ak. Gubkina 52a\, 28,L=Kazan,ST=Tatarstan,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bb:bc:19:c8:1d:02:6b:8a:54:0a:b6:1a:14:74:67:fc:b6:b8:38:9c
Signer

Actual PE Digest

bb:bc:19:c8:1d:02:6b:8a:54:0a:b6:1a:14:74:67:fc:b6:b8:38:9c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Ilgam Zyulkorneev,O=Ilgam Zyulkorneev,POSTALCODE=420088,STREET=Ak. Gubkina 52a\, 28,L=Kazan,ST=Tatarstan,C=RU

22/05/2013, 17:55
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

user32

GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
TranslateMessage
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
ExitWindowsEx
DispatchMessageW
DestroyWindow
CharUpperBuffW
CallWindowProcW

kernel32

GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
SignalObjectAndWait
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LoadLibraryW
GetWindowsDirectoryW
GetVersionExW
GetUserDefaultLangID
GetThreadLocale
GetSystemInfo
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
DeleteFileW
CreateProcessW
CreateFileW
CreateEventW
CreateDirectoryW
CloseHandle
Sleep

comctl32

InitCommonControls

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 21KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Windows XP Extras/OldNewExplorer.rar
.rar
10 to XP Remake/Windows XP Extras/Windows Media Player 8 Setup.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Windows XP Extras/Windows XP Build In Games.rar
.rar
10 to XP Remake/Windows XP Icons/WinXP Iconpack By 2013Windows8.1.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 168KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 57KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/How to Make WIndows XP Taskbar.txt
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/Menu Settings By 2013Windows8.1.xml
.xml
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/Read Before Using.txt
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Computer.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Connect .ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Control Panel.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Documents.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Fav.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Help.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Music.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Network places.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/People.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Pictures.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Printer.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Programs (2).ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Programs.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Rec Docs.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Recycle Bin.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Run.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Search files.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Search.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Security.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Settings.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Taskbarmenu.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/Video.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/modLOGOFF.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/modSHUTDOWN.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/shell32_325.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/WinXP/shell32_329.ico
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/XP Blue BBT revB.skin
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/XPBlue Luna Taskbar.zip
.zip
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/ClassicShell/classicshell.exe
.exe windows x86

846beeaaa47aac39313849b60d047ffe

Code Sign

03:bc:33:0e:fa:73:04:56:25:64:15:07:8b:cf:a4:10
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

15/07/2018, 00:00

Not After

19/09/2019, 12:00

Subject

CN=Ivaylo Beltchev,O=Ivaylo Beltchev,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

38:ef:c9:03:16:b4:78:e7:fa:f8:3c:18:fb:85:cf:8c:31:f7:7e:e2
Signer

Actual PE Digest

38:ef:c9:03:16:b4:78:e7:fa:f8:3c:18:fb:85:cf:8c:31:f7:7e:e2

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Ivaylo Beltchev,O=Ivaylo Beltchev,L=Redmond,ST=WA,C=US

15/07/2018, 20:15
Valid: true

Chain 1

CN=Ivaylo Beltchev,O=Ivaylo Beltchev,L=Redmond,ST=WA,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

WriteFile
CloseHandle
CreateFileW
SizeofResource
LockResource
LoadResource
FindResourceW
GetExitCodeProcess
WaitForSingleObject
DeleteFileW
CreateProcessW
SetEnvironmentVariableW
CreateFileA
GetCurrentProcess
GetProcAddress
GetModuleHandleW
GetVersion
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
FlushFileBuffers
OpenProcess
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetCPInfo
GetLastError
MultiByteToWideChar
WideCharToMultiByte
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetStartupInfoW
HeapAlloc
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

user32

DialogBoxParamW
FindWindowW
GetWindowThreadProcessId
LoadStringW
CharUpperW
EndDialog
MessageBoxW
GetDlgItemTextW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

CommandLineToArgvW
DoEnvironmentSubstW

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.8MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/StartIsBack/[PiratePC.Net] StartIsBack++ 2.9.0 Full _ed Version.zip
.zip
10 to XP Remake/Windows XP Start Menu (Only Windows 10)/StartIsBack/xp_styles_pack_for_windows_10_by_sagorpirbd-d9pmwg2.rar
.rar
10 to XP Remake/Windows XP Theme+Theme Patcher/UxthemePatcher Win10 1903.zip
.zip
10 to XP Remake/Windows XP Theme+Theme Patcher/xp_themes_final_for_win10_by_sagorpirbd-d8lstfo.rar
.rar
10 to XP Remake/Windows XP Wallpaper/.DS_Store
10 to XP Remake/Windows XP Wallpaper/Ascent.jpg
.jpg
10 to XP Remake/Windows XP Wallpaper/Autumn.jpg
.jpg
10 to XP Remake/Windows XP Wallpaper/Azul.jpg
.jpg
10 to XP Remake/Windows XP Wallpaper/Bliss.bmp
10 to XP Remake/Windows XP Wallpaper/Crystal.jpg
.jpg
10 to XP Remake/Windows XP Wallpaper/Follow.jpg
.jpg
10 to XP Remake/Windows XP Wallpaper/Radiance.jpg
.jpg
10 to XP Remake/Windows XP Wallpaper/Red moon desert.jpg
.jpg
10 to XP Remake/Windows XP Wallpaper/Ripple.jpg
.jpg
10 to XP Remake/Windows XP Wallpaper/Stonehenge.jpg
.jpg
10 to XP Remake/Windows XP Wallpaper/Thumbs.db
10 to XP Remake/Windows XP Wallpaper/Tulips.jpg
.jpg
10 to XP Remake/Windows XP Wallpaper/Vortec space.jpg
.jpg
10 to XP Remake/Windows XP Wallpaper/Wind.jpg
.jpg
10 to XP Remake/Windows XP Wallpaper/Windows Energy Bliss.jpg
.jpg
10 to XP Remake/Windows XP Wallpaper/Windows XP.jpg
.jpg
10 to XP Remake/Windows XP buttons/1.ico
10 to XP Remake/Windows XP buttons/10.ico
10 to XP Remake/Windows XP buttons/11.ico
10 to XP Remake/Windows XP buttons/12.ico
10 to XP Remake/Windows XP buttons/13.ico
10 to XP Remake/Windows XP buttons/14.ico
10 to XP Remake/Windows XP buttons/15.ico
10 to XP Remake/Windows XP buttons/16.ico
10 to XP Remake/Windows XP buttons/17.ico
10 to XP Remake/Windows XP buttons/18.ico
10 to XP Remake/Windows XP buttons/19.ico
10 to XP Remake/Windows XP buttons/2.ico
10 to XP Remake/Windows XP buttons/20.ico
10 to XP Remake/Windows XP buttons/21.ico
10 to XP Remake/Windows XP buttons/22.ico
10 to XP Remake/Windows XP buttons/23.ico
10 to XP Remake/Windows XP buttons/24.ico
10 to XP Remake/Windows XP buttons/25.ico
10 to XP Remake/Windows XP buttons/3.ico
10 to XP Remake/Windows XP buttons/4.ico
10 to XP Remake/Windows XP buttons/5.ico
10 to XP Remake/Windows XP buttons/6.ico
10 to XP Remake/Windows XP buttons/7.ico
10 to XP Remake/Windows XP buttons/8.ico
10 to XP Remake/Windows XP buttons/9.ico
10 to XP Remake/Windows XP buttons/Explorer Settings 2013Win8.1.xml
.xml
10 to XP Remake/Windows XP buttons/Readme.txt
10 to XP Remake/Windows XP buttons/logo.ico
10 to XP Remake/Winrar If you Dont have one.exe
.exe windows x86

50610e34092d6ce13e51e7c9d5197081

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

kernel32

DeleteFileA
DeleteFileW
CreateDirectoryA
CreateDirectoryW
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GlobalAlloc
lstrlenA
GetModuleFileNameA
FindResourceA
GetModuleHandleA
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
CompareStringA
ExitProcess
GetLocaleInfoA
GetNumberFormatA
GetProcAddress
DosDateTimeToFileTime
GetDateFormatA
GetTimeFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsA
WaitForSingleObject
SetCurrentDirectoryA
Sleep
GetTempPathA
MoveFileExA
GetModuleFileNameW
SetEnvironmentVariableA
GetCommandLineA
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTime
IsDBCSLeadByte
GetCPInfo
FreeLibrary
LoadLibraryA
GetCurrentDirectoryA
GetFullPathNameA
SetFileAttributesW
SetFileAttributesA
GetFileAttributesW
GetFileAttributesA
WriteFile
GetStdHandle
ReadFile
SetLastError
CreateFileW
CreateFileA
GetFileType
SetEndOfFile
SetFilePointer
MoveFileA
SetFileTime
GetCurrentProcess
CloseHandle
GetLastError
lstrcmpiA

user32

ReleaseDC
GetDC
SendMessageA
wsprintfA
SetDlgItemTextA
EndDialog
DestroyIcon
SendDlgItemMessageA
GetDlgItemTextA
DialogBoxParamA
IsWindowVisible
WaitForInputIdle
GetSysColor
PostMessageA
SetMenu
SetFocus
LoadBitmapA
LoadIconA
CharToOemA
OemToCharA
GetClassNameA
CharUpperA
GetWindowRect
GetParent
MapWindowPoints
CreateWindowExA
UpdateWindow
SetWindowTextA
LoadCursorA
RegisterClassExA
SetWindowLongA
GetWindowLongA
DefWindowProcA
PeekMessageA
GetMessageA
DispatchMessageA
DestroyWindow
GetClientRect
CopyRect
IsWindow
MessageBoxA
ShowWindow
GetDlgItem
EnableWindow
FindWindowExA
wvsprintfA
CharToOemBuffA
LoadStringA
SetWindowPos
GetWindowTextA
GetWindow
GetSystemMetrics
OemToCharBuffA
TranslateMessage

gdi32

GetDeviceCaps
GetObjectA
CreateCompatibleBitmap
SelectObject
StretchBlt
CreateCompatibleDC
DeleteObject
DeleteDC

comdlg32

GetSaveFileNameA
CommDlgExtendedError
GetOpenFileNameA

advapi32

LookupPrivilegeValueA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
SetFileSecurityW
SetFileSecurityA
OpenProcessToken
AdjustTokenPrivileges

shell32

ShellExecuteExA
SHFileOperationA
SHGetFileInfoA
SHGetSpecialFolderLocation
SHGetMalloc
SHBrowseForFolderA
SHGetPathFromIDListA
SHChangeNotify

ole32

CreateStreamOnHGlobal
OleInitialize
CoCreateInstance
OleUninitialize
CLSIDFromString

oleaut32

VariantInit

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 128KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 2013windows8.1

Password: 2013windows8.1

61bda503407aef3d81bc2fb259a787bc

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 384B

.rsrc Size: 423KB - Virtual size: 422KB

.reloc Size: 512B - Virtual size: 32B

Password: 2013windows8.1

61bda503407aef3d81bc2fb259a787bc

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 384B

.rsrc Size: 423KB - Virtual size: 422KB

.reloc Size: 512B - Virtual size: 32B

Password: 2013windows8.1

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 112B

.rsrc Size: 2KB - Virtual size: 4KB

Password: 2013windows8.1

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 112B

.rsrc Size: 1.0MB - Virtual size: 1.0MB

Password: 2013windows8.1

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 112B

.rsrc Size: 1.3MB - Virtual size: 1.3MB

Password: 2013windows8.1

08f6a1b121da8cedde2d1089d0906ed8

Headers

DLL Characteristics

File Characteristics

Imports

shell32

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 384B

.rsrc
Size: 423KB - Virtual size: 422KB

.reloc
Size: 512B - Virtual size: 32B

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 384B

.rsrc
Size: 423KB - Virtual size: 422KB

.reloc
Size: 512B - Virtual size: 32B

.rdata
Size: 512B - Virtual size: 112B

.rsrc
Size: 2KB - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 112B

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 512B - Virtual size: 112B

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.text
Size: 74KB - Virtual size: 73KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 34KB - Virtual size: 34KB

.text
Size: 126KB - Virtual size: 125KB

.data
Size: 114KB - Virtual size: 114KB

.rsrc
Size: 138KB - Virtual size: 138KB

.text
Size: 239KB - Virtual size: 239KB

.data
Size: 6KB - Virtual size: 9KB

.rsrc
Size: 88KB - Virtual size: 88KB

.text
Size: 30KB - Virtual size: 29KB

.data
Size: 2KB - Virtual size: 6KB

.rsrc
Size: 34KB - Virtual size: 34KB