58b814f90bb23329c97afeb6bfd12f1b

Sharing

Copy URL Twitter E-mail

General

Target

58b814f90bb23329c97afeb6bfd12f1b
Size

26.6MB
MD5

58b814f90bb23329c97afeb6bfd12f1b
SHA1

465bce99ce17360c59b0f95ffa9e55ef64492ec4
SHA256

375c28f9b18cb48af28851ff19d43f9648a6a6950134051c251bba7f78e57665
SHA512

967e73061f368936e69d45ef85e3325a737978a294fc026726381935c6fb6e874c85634f603867d47b6bc2e6386513a763db8188702ea5b31bb73e07a295c060
SSDEEP

393216:lyuxehrjINfsrHPJ+eGX8Teksqk21Z6ZXu4mWBFIJa3RNoSLn5St25yyhlTgI1+:lQFjwGvQ4eZqkiZWXcOB37HnQAyyQI1+

Score

7^/10

upx aspackv2

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/Powerword2007_V10.0.0.1/KAVPassport.DLL	acprotect
static1/unpack001/Powerword2007_V10.0.0.1/SNProber.dll	acprotect
static1/unpack001/Powerword2007_V10.0.0.1/check.dll	acprotect

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/Powerword2007_V10.0.0.1/xdict.exe	aspack_v212_v242

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Powerword2007_V10.0.0.1/SNProber.dll	upx
static1/unpack001/Powerword2007_V10.0.0.1/check.dll	upx

Unsigned PE 29 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Powerword2007_V10.0.0.1/AccountActivate.dll
unpack001/Powerword2007_V10.0.0.1/Cjktl32.dll
unpack001/Powerword2007_V10.0.0.1/Cjktl95.dll
unpack001/Powerword2007_V10.0.0.1/DBCore10.dll
unpack001/Powerword2007_V10.0.0.1/DictionaryManager.dll
unpack001/Powerword2007_V10.0.0.1/GBTOB5.dll
unpack001/Powerword2007_V10.0.0.1/Grabgdip.dll
unpack001/Powerword2007_V10.0.0.1/IJL11.DLL
unpack001/Powerword2007_V10.0.0.1/ITTSEngine.dll
unpack001/Powerword2007_V10.0.0.1/ITextOut.dll
unpack001/Powerword2007_V10.0.0.1/KAVPassport.DLL
unpack001/Powerword2007_V10.0.0.1/KPic10.dll
unpack001/Powerword2007_V10.0.0.1/NormGrab.dll
unpack001/Powerword2007_V10.0.0.1/SNProber.dll
unpack004/out.upx
unpack001/Powerword2007_V10.0.0.1/XFavHist.dll
unpack001/Powerword2007_V10.0.0.1/XImage32.dll
unpack001/Powerword2007_V10.0.0.1/XdictGrb.dll
unpack001/Powerword2007_V10.0.0.1/Xml2Xdata.dll
unpack001/Powerword2007_V10.0.0.1/check.dll
unpack005/out.upx
unpack001/Powerword2007_V10.0.0.1/doshow.dll
unpack001/Powerword2007_V10.0.0.1/newword.dll
unpack001/Powerword2007_V10.0.0.1/shfolder.dll
unpack001/Powerword2007_V10.0.0.1/statistics.dll
unpack001/Powerword2007_V10.0.0.1/toTTSEngine50.dll
unpack001/Powerword2007_V10.0.0.1/xdict.exe
unpack001/Powerword2007_V10.0.0.1/xdict_helper.dll
unpack001/Powerword2007_V10.0.0.1/xfile.dll

Files

58b814f90bb23329c97afeb6bfd12f1b
.rar
Powerword2007_V10.0.0.1/AccountActivate.dll
.dll windows:4 windows x86 arch:x86

9a3adb86900dd774321275b397406449

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

socket
WSAStartup
closesocket
ioctlsocket
htons
connect
gethostbyname
recv
send
WSAGetLastError
select
__WSAFDIsSet

msvcp60

?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0logic_error@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??_7out_of_range@std@@6B@
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Xlen@std@@YAXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0PBD1@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ

msvcrt

_CxxThrowException
_adjust_fdiv
malloc
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
free
_purecall
_ftime
_ftol
floor
isspace
_vsnprintf
_strnicmp
strncmp
sprintf
atoi
__CxxFrameHandler
memmove
??2@YAPAXI@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
sscanf
strtol
_snprintf
strtod
memchr

kernel32

DisableThreadLibraryCalls

Exports

Exports

ActivateAccount

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/CJKTL16.DLL
Powerword2007_V10.0.0.1/CONFIG.INI
Powerword2007_V10.0.0.1/Cjktl32.dll
.dll windows:4 windows x86 arch:x86

c81206b5f9bf47c717810a6643f7eb35

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnterCriticalSection
VirtualProtect
VirtualLock
GetProcAddress
GetModuleHandleA
IsBadCodePtr
IsBadReadPtr
VirtualUnlock
MulDiv
lstrlenA
ReadConsoleOutputCharacterW
GetVersionExA
InitializeCriticalSection
GetCurrentProcessId
LeaveCriticalSection
GetStdHandle
GetConsoleScreenBufferInfo

user32

GetWindowThreadProcessId
UpdateWindow
GetMenu
IsMenu
MenuItemFromPoint
IsWindowUnicode
GetMenuStringW
GetMenuStringA
GetMenuItemRect
GetClientRect
ScreenToClient
MapWindowPoints
GetDC
ReleaseDC
PtInRect
DrawTextExW
DrawTextExA
DrawTextW
DrawTextA
WindowFromDC
IsWindow
GetSystemMetrics
CallNextHookEx
UnhookWindowsHookEx
SendMessageA
SetWindowsHookExA

gdi32

GetCharWidth32W
GetTextExtentPoint32W
GetCurrentObject
GetObjectA
GetTextCharacterExtra
GetCharWidthA
GetTextExtentPoint32A
LPtoDP
GetDCOrgEx
SaveDC
SetWindowOrgEx
SetViewportOrgEx
GetWindowExtEx
GetViewportExtEx
RestoreDC
GetDeviceCaps
GetMapMode
GetTextAlign
GetViewportOrgEx
TextOutA
GetCurrentPositionEx
GetTextMetricsA
TextOutW
ExtTextOutA
ExtTextOutW
BitBlt
DeleteObject
SetTextAlign
SelectObject
CreateFontIndirectA
GetStockObject
GetCharWidthW
StretchBlt

msvcrt

__mb_cur_max
_isctype
_pctype
wcslen
iswctype
_local_unwind2
_except_handler3

Exports

Exports

_xeMenuSelectProc@12
_xeMouseProc@12
_xe_BitBlt@36
_xe_DrawText@20
_xe_DrawTextEx@24
_xe_DrawTextExW@24
_xe_DrawTextW@20
_xe_ExtTextOut@32
_xe_ExtTextOutW@32
_xe_StretchBlt@44
_xe_TextOut@20
_xe_TextOutW@20
xeCleanup
xeCodeSet
xeDoHook
xeEnableHook
xeGetLastBouns
xeGetString
xeInit
xePeek
xeSetBouns

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/Cjktl95.dll
.dll windows:4 windows x86 arch:x86

352f9aca7b210e5858f2ec2757e7b962

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
GetModuleHandleA
GetVersionExA
FT_Thunk
FT_Exit12
FT_Exit20
SMapLS
SUnMapLS
SMapLS_IP_EBP_20
SUnMapLS_IP_EBP_20
ThunkConnect32
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetProcAddress
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind
GetModuleFileNameA
GetModuleHandleA
GetVersionExA
FT_Thunk
FT_Exit12
FT_Exit20
SMapLS
SUnMapLS
SMapLS_IP_EBP_20
SUnMapLS_IP_EBP_20
ThunkConnect32
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetProcAddress
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind

Exports

Exports

CT95_ThunkData32
xeCleanup
xeCodeSet
xeEnable
xeEnableDisp
xeEnableHook
xeGetLastBouns
xeGetString
xeInit
xeSetBouns
xeSetMemDCOrg

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/DBCore10.dll
.dll regsvr32 windows:4 windows x86 arch:x86

4dd90d920ab5ec2c83a9b40ef1a72892

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WritePrivateProfileStringA
GlobalFindAtomA
GlobalGetAtomNameA
GetProcessVersion
GlobalAddAtomA
GetCurrentProcess
FlushFileBuffers
GlobalFlags
GetCPInfo
GetOEMCP
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
HeapSize
GetCommandLineA
ExitProcess
TerminateProcess
GetEnvironmentVariableA
HeapCreate
GetVersion
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
SizeofResource
FreeLibrary
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
TlsAlloc
LocalAlloc
SetLastError
LocalFree
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
GetCurrentThread
GetCurrentThreadId
CompareStringW
CompareStringA
GetVersionExA
GetSystemDefaultLCID
InitializeCriticalSection
GetFileSize
GetACP
GetTickCount
WriteFile
SetEndOfFile
SetFilePointer
ReadFile
CloseHandle
CreateFileA
lstrcpyA
GetFileAttributesA
lstrcatA
HeapDestroy
LoadLibraryA
GetProcAddress
lstrcmpiA
IsDBCSLeadByte
lstrcpynA
FindResourceA
LoadLibraryExA
GetLastError
VirtualFree
LoadResource
VirtualAlloc
RaiseException

user32

GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
GetMenuItemID
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
MapWindowPoints
DefWindowProcA
DestroyWindow
GrayStringA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
GetMenuItemCount
wsprintfA
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
UnregisterClassA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
EnableWindow
SetCursor
SendMessageA
PostMessageA
GetForegroundWindow
PostQuitMessage
CharNextA
GetMessageTime
GetMessagePos
GetDlgItem
SetForegroundWindow
PtInRect

gdi32

SelectObject
GetStockObject
RestoreDC
SetBkColor
SetMapMode
SetViewportOrgEx
SetTextColor
SetViewportExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetWindowExtEx
GetClipBox
ScaleWindowExtEx
DeleteObject
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetObjectA
CreateBitmap
DeleteDC
SaveDC

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegSetValueExA
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA

comctl32

ord17

ole32

CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

SysFreeString
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
SysAllocString
SafeArrayPutElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantInit
LoadRegTypeLi
SysStringLen

ws2_32

WSAStartup
gethostbyname
ntohl
WSACleanup

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/DICTS.INI
Powerword2007_V10.0.0.1/DictionaryManager.dll
.dll regsvr32 windows:4 windows x86 arch:x86

2bf53584e2a6d55699df90a5730ffc07

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFlags
GetFullPathNameA
WritePrivateProfileStringA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
GetVolumeInformationA
CreateDirectoryA
GetCommandLineA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetACP
RaiseException
ExitProcess
TerminateProcess
HeapSize
GetEnvironmentVariableA
HeapFree
RtlUnwind
SetEndOfFile
VirtualAlloc
IsBadWritePtr
SetHandleCount
HeapReAlloc
HeapAlloc
FlushFileBuffers
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
Sleep
LCMapStringA
LCMapStringW
GetDriveTypeA
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
WideCharToMultiByte
GetModuleHandleA
GetShortPathNameA
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
LoadLibraryA
GetProcAddress
lstrlenA
GetTempPathA
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
lstrlenW
InterlockedDecrement
InterlockedIncrement
ReadFile
SetFilePointer
WriteFile
GetVersion
GetCurrentProcess
LocalReAlloc
SetErrorMode
TlsGetValue
TlsFree
TlsSetValue
GlobalReAlloc
GlobalFree
GlobalHandle
GlobalUnlock
TlsAlloc
LocalAlloc
GlobalLock
GetCurrentThread
GlobalAlloc
GlobalDeleteAtom
GetStdHandle
SetFileAttributesA
GetCurrentThreadId
MultiByteToWideChar
lstrcmpA
CloseHandle
CreateFileA
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileA
LocalFree
FindClose
FindFirstFileA
SetLastError
lstrcpyA
GetFileAttributesA
lstrcatA
lstrcpynA
HeapDestroy
IsDBCSLeadByte
GetLastError
lstrcmpiA
LoadLibraryExA
SizeofResource
FindResourceA
LoadResource
GetFileType
FreeLibrary
GetStartupInfoA
GetVersionExA
HeapCreate
VirtualFree

user32

WinHelpA
GetCapture
GetTopWindow
RegisterClassA
GetClassInfoA
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
DestroyMenu
GetForegroundWindow
SetForegroundWindow
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
GetDlgItem
GetSysColorBrush
GrayStringA
GetSubMenu
GetClassLongA
GetMenu
ReleaseDC
GetDC
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetClassNameA
GetSystemMetrics
CharUpperA
LoadStringA
UnregisterClassA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
GetMenuItemID
DefWindowProcA
DestroyWindow
CreateWindowExA
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
EnableWindow
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
wsprintfA
SetPropA
CharNextA
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
DrawTextA
TabbedTextOutA
PtInRect
GetWindowRect
GetMenuItemCount

gdi32

SaveDC
GetStockObject
SelectObject
SetBkColor
SetTextColor
SetViewportOrgEx
OffsetViewportOrgEx
SetMapMode
ScaleViewportExtEx
SetViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
DeleteObject
DeleteDC
GetDeviceCaps
RectVisible
TextOutA
PtVisible
Escape
ExtTextOutA
GetObjectA
CreateBitmap
RestoreDC

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegEnumKeyA
RegQueryValueExA
RegDeleteValueA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegEnumValueA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
GetUserNameA

comctl32

ord17

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
OleRun
CoCreateInstance

oleaut32

SysFreeString
SysAllocStringLen
SysStringLen
SysAllocString
LoadRegTypeLi
SafeArrayGetElement
VarUI4FromStr
LoadTypeLi
RegisterTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/Dicts.inf
Powerword2007_V10.0.0.1/Display.ini
Powerword2007_V10.0.0.1/Fonts/21TH2.FON
Powerword2007_V10.0.0.1/Fonts/21TH4.FON
Powerword2007_V10.0.0.1/Fonts/21TH9.FON
Powerword2007_V10.0.0.1/Fonts/21th2b.fon
Powerword2007_V10.0.0.1/Fonts/ATA BLOG.gif
.gif
Powerword2007_V10.0.0.1/Fonts/ATA.JPG
.jpg
Powerword2007_V10.0.0.1/Fonts/BASEMIC_.TTF
Powerword2007_V10.0.0.1/Fonts/BASES___.TTF
Powerword2007_V10.0.0.1/Fonts/BASET___.TTF
Powerword2007_V10.0.0.1/Fonts/IFontb.fon
Powerword2007_V10.0.0.1/Fonts/Ifonts.fon
Powerword2007_V10.0.0.1/Fonts/Ksphonet.ttf
Powerword2007_V10.0.0.1/Fonts/Phonetic.fon
Powerword2007_V10.0.0.1/Fonts/Phoneticb.fon
Powerword2007_V10.0.0.1/Fonts/Phoneticu.fon
Powerword2007_V10.0.0.1/Fonts/★ATA★博客.url
.url
Powerword2007_V10.0.0.1/Fonts/金山词霸 2007 V1.0.0.1 绿色旗舰专业精简版.txt
Powerword2007_V10.0.0.1/GBTOB5.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 77B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/Grabgdip.dll
.dll regsvr32 windows:4 windows x86 arch:x86

af0256e715452ec3350c1c0e6be698a0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
FindResourceA
lstrcmpiA
LoadResource
LoadLibraryExA
IsDBCSLeadByte
GetProcAddress
lstrcpynA
VirtualProtect
CloseHandle
MapViewOfFile
LoadLibraryW
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
Process32Next
Process32First
GetCurrentProcessId
DisableThreadLibraryCalls
HeapAlloc
GetSystemInfo
GetVersionExA
HeapCreate
InitializeCriticalSection
CreateToolhelp32Snapshot
SizeofResource
LeaveCriticalSection
EnterCriticalSection
lstrcpyA
lstrcatA
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
VirtualFreeEx
WaitForSingleObject
FreeLibrary
WriteProcessMemory
VirtualAllocEx
OpenProcess
Module32NextW
lstrcmpiW
Module32FirstW
SetLastError
DebugBreak
HeapReAlloc
HeapFree
GetModuleFileNameW
Sleep
lstrlenW
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
DeleteCriticalSection
HeapDestroy
CreateRemoteThread
RtlUnwind

user32

GetDesktopWindow
PtInRect
GetWindowRect
GetWindowThreadProcessId
GetWindow
GetParent
WindowFromPoint
RedrawWindow
LoadStringA
IsWindow
ScreenToClient
IsWindowVisible
CharNextA

advapi32

RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumValueA

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree

oleaut32

RegisterTypeLi
SysAllocString
SysFreeString
VarUI4FromStr
LoadRegTypeLi
SysStringLen
LoadTypeLi
SysAllocStringLen

gdiplus

GdipCloneFont
GdipReleaseDC
GdipDeleteRegion
GdipTransformPoints
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDeleteFont
GdipDeleteBrush
GdipMeasureString
GdipCloneBrush
GdipStringFormatGetGenericDefault
GdipCloneStringFormat
GdipMeasureCharacterRanges
GdipCreateRegion
GdipCreateFromHDC
GdipGetDC
GdipGetRegionBoundsI
GdipSetStringFormatMeasurableCharacterRanges
GdipAlloc
GdipGetStringFormatMeasurableCharacterRangeCount
GdipFree

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/Home/ATA BLOG.gif
.gif
Powerword2007_V10.0.0.1/Home/ATA.JPG
.jpg
Powerword2007_V10.0.0.1/Home/home.XDATA
Powerword2007_V10.0.0.1/Home/mobile.mht
.eml
- http://web.iciba.com/sms/daily.html
- http://web.iciba.com/sms/neworilarge.html
- http://web.iciba.com/sms/spoken.html
- http://dt.iciba.com/mt
- http://web.iciba.com/sms/office.html
- http://web.iciba.com/sms/business.html
- http://web.iciba.com/sms/foreign.html
- http://web.iciba.com/sms/cet4.html
- http://web.iciba.com/sms/cet6.html
- http://web.iciba.com/sms/netem.html
- http://web.iciba.com/sms/900.html
- http://web.iciba.com/sms/kzxy.html
- Show all
attachment-3
email-html-2.txt
email-plain-1.txt
Powerword2007_V10.0.0.1/Home/news.mht
.eml
- http://sl.iciba.com
attachment-3
attachment-4
.gif
email-html-2.txt
email-plain-1.txt
Powerword2007_V10.0.0.1/Home/welcome.mht
.eml .js polyglot
Powerword2007_V10.0.0.1/Home/★ATA★博客.url
.url
Powerword2007_V10.0.0.1/Home/绿色旗舰站-博客.url
.url
Powerword2007_V10.0.0.1/HomePage.mht
.eml .js polyglot
Powerword2007_V10.0.0.1/IJL11.DLL
.dll windows:4 windows x86 arch:x86

eb6df2cdc437fbaf0d983ed099e6f072

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OutputDebugStringA
CloseHandle
WriteFile
LocalFree
LocalAlloc
SetFilePointer
ReadFile
GetCurrentThreadId
GetModuleFileNameA
GetLastError
FreeEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsA
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
GetProcAddress
GetModuleHandleA
HeapAlloc
HeapFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
CreateFileA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetACP
FlushFileBuffers
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
InterlockedDecrement
InterlockedIncrement
VirtualAlloc
HeapReAlloc
GetCPInfo
GetOEMCP
LoadLibraryA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle

user32

PostQuitMessage
wsprintfA
MessageBoxA
PeekMessageA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Exports

Exports

ijlErrorStr
ijlFree
ijlGetLibVersion
ijlInit
ijlRead
ijlWrite

Sections

.text
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/ITTSEngine.dll
.dll windows:4 windows x86 arch:x86

7d4cc37398a5b027fa2c435cd312740c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

IsBadReadPtr
WideCharToMultiByte
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
IsBadStringPtrA
GetOEMCP
GetACP
LoadLibraryA
RtlUnwind
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetThreadLocale
DeleteCriticalSection
GetCPInfo
GetStringTypeW
GetProcAddress
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadCodePtr
LCMapStringA
LCMapStringW
GetStringTypeA

ole32

CoUninitialize
CoInitialize
CoCreateInstance

Exports

Exports

TTS_Cleanup
TTS_Continue
TTS_GetEngine
TTS_GetEnginesCount
TTS_Init
TTS_IsSpeaking
TTS_Pause
TTS_SetEngine
TTS_SpeakText
TTS_Stop

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/ITextOut.dll
.dll windows:4 windows x86 arch:x86

2203b6a9dd9dcef06e238310d5051050

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

IsBadReadPtr
MultiByteToWideChar
WideCharToMultiByte
GetVersionExA
TlsAlloc
TlsSetValue
InterlockedDecrement
InterlockedIncrement
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
LCMapStringA
LCMapStringW
GetLastError
ReadFile
SetFilePointer
GetModuleHandleA
GetEnvironmentVariableA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
RtlUnwind
CloseHandle
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetCPInfo
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
CreateFileA
LoadLibraryA
GetACP
GetOEMCP
GetProcAddress
SetEndOfFile

user32

MessageBoxA
DrawTextA

gdi32

SetBitmapBits
SetBkColor
SelectObject
CreateSolidBrush
GetTextColor
TextOutA
GetBkMode
GetTextMetricsA
DeleteObject
DeleteDC
BitBlt
GetTextExtentPoint32W
SetTextColor
CreateCompatibleDC
CreateBitmap
TextOutW
LineTo
MoveToEx
CreatePen

Exports

Exports

xeCleanupPointFont
xeDrawText
xeDrawTextW
xeGetACP
xeGetTextExtentPoint32
xeGetTextExtentPoint32W
xeInitPointFont
xeSetACP
xeSymbolGetTextExtent
xeSymbolGetTextExtentW
xeSymbolTextOut
xeSymbolTextOutW
xeTextOut
xeTextOutW

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/KAVPassport.DLL
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

MYCRACK
Size: - Virtual size: 264KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

MYCRACK
Size: 169KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Powerword2007_V10.0.0.1/KAddin.ini
Powerword2007_V10.0.0.1/KPic10.dll
.dll windows:4 windows x86 arch:x86

64e709166bb12af1c0bfb605e3bbbbe8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileSize
ReadFile
CreateThread
GetTickCount
Sleep
CreateFileA
WriteFile
CloseHandle
MultiByteToWideChar
DeleteFileA
LoadLibraryA
GetProcAddress
lstrlenA
FreeLibrary
HeapDestroy
LCMapStringW
WideCharToMultiByte
LCMapStringA
SetEndOfFile
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
MulDiv
HeapCreate
VirtualFree
VirtualAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
GetFileType
GetLastError
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetStringTypeW
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
InterlockedDecrement
InterlockedIncrement
SetStdHandle
FlushFileBuffers
SetFilePointer

user32

FillRect
ReleaseDC
LoadImageA
CopyImage
GetSystemMetrics
GetDC
LoadBitmapA

gdi32

StretchDIBits
SetBkColor
BitBlt
SetTextColor
DeleteDC
GetDIBits
DeleteObject
CreateDIBitmap
CreateCompatibleDC
GetDeviceCaps
GetObjectA
GetPixel
OffsetViewportOrgEx
CreateSolidBrush
CreateBitmap
SelectObject
CreateCompatibleBitmap

ijl11

ord2
ord4
ord3

Exports

Exports

KPIC_Draw
KPIC_DrawFrame
KPIC_DrawTransparent
KPIC_FreePicture
KPIC_GetBitmap
KPIC_GetFrameCount
KPIC_GetFrameDelayTime
KPIC_GetPictureFileType
KPIC_GetPictureSize
KPIC_LoadPictureFile
KPIC_LoadPictureResource
KPIC_RefreshPicture
KPIC_SavePicture

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/KSSetting.exe.manifest
.xml
Powerword2007_V10.0.0.1/Language/LANGUAGE.INI
Powerword2007_V10.0.0.1/Language/cb1033.ini
Powerword2007_V10.0.0.1/Language/cb2052.ini
Powerword2007_V10.0.0.1/NETWORK.INI
Powerword2007_V10.0.0.1/NetCheck.ini
Powerword2007_V10.0.0.1/NormGrab.dll
.dll windows:4 windows x86 arch:x86

7a5c504bdf2df8e1dfac39eb093ef781

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
GetModuleFileNameA
WideCharToMultiByte
FreeLibrary
DisableThreadLibraryCalls
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
lstrlenA
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
GetVersionExA
HeapDestroy
InitializeCriticalSection
lstrlenW
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
TlsFree
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetOEMCP
GetACP
GetCPInfo
GetLastError
TlsGetValue
SetLastError
FreeEnvironmentStringsA
HeapReAlloc
HeapAlloc
TlsSetValue
GetCurrentThreadId
IsBadWritePtr
GetCurrentProcessId
TlsAlloc
GetCommandLineA
VirtualFree
HeapCreate
VirtualAlloc
GetModuleHandleA
HeapSize
GetEnvironmentVariableA
LocalFree
HeapFree
RtlUnwind
TerminateProcess
ExitProcess
GetVersion
RaiseException
GetCurrentProcess

user32

PeekMessageA
GetDesktopWindow
IsWindowVisible
GetWindowThreadProcessId
ShowWindow
UpdateWindow
CreateWindowExA
GetClassInfoA
RegisterClassA
DefWindowProcA
LoadStringA
DestroyWindow
IsWindow
GetWindowPlacement
SetWindowPos
WindowFromPoint
SetWindowPlacement
ScreenToClient
GetClientRect
GetWindow
GetWindowRect
PtInRect
GetWindowLongA
ClientToScreen
GetWindowTextA
GetDC
ReleaseDC
SendMessageA
GetParent
GetClassNameA
KillTimer
SetTimer

gdi32

SelectObject
GetStockObject
GetTextExtentPoint32A

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

oleaut32

LoadRegTypeLi
VariantInit
SysAllocStringLen
SysAllocString
SysStringLen
VariantClear
SysFreeString
GetActiveObject
CreateErrorInfo
VariantChangeType

Exports

Exports

CleanupHookDll
InitHookDll

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/SNProber.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

UPX0
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 42KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/Tips_CN.txt
Powerword2007_V10.0.0.1/Tips_EN.txt
Powerword2007_V10.0.0.1/XFavHist.dll
.dll regsvr32 windows:4 windows x86 arch:x86

8603ab295aead4f5c7b407cca6790153

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCPInfo
GetOEMCP
HeapFree
HeapReAlloc
GetCommandLineA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetACP
RaiseException
ExitProcess
TerminateProcess
HeapSize
GetEnvironmentVariableA
GetVersionExA
RtlUnwind
HeapAlloc
VirtualAlloc
IsBadWritePtr
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
lstrlenW
GetModuleHandleA
GetShortPathNameA
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GetModuleFileNameA
GetSystemDirectoryA
LoadLibraryA
WriteFile
FlushFileBuffers
SetFilePointer
GetCurrentProcess
GetProcessVersion
GlobalFindAtomA
GlobalGetAtomNameA
GlobalAddAtomA
WritePrivateProfileStringA
GlobalFlags
SetErrorMode
SetLastError
GetVersion
TlsSetValue
TlsGetValue
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsAlloc
GlobalUnlock
GlobalFree
LocalAlloc
SetHandleCount
GetProcAddress
GlobalLock
CloseHandle
GetCurrentThread
GlobalAlloc
GlobalDeleteAtom
GetCurrentThreadId
lstrcmpA
LocalFree
HeapDestroy
lstrcatA
lstrcpyA
lstrcmpiA
IsDBCSLeadByte
lstrcpynA
FindResourceA
LoadLibraryExA
GetLastError
FreeLibrary
LoadResource
SizeofResource
GetStdHandle
WideCharToMultiByte
GetFileType
HeapCreate
VirtualFree

user32

GetTopWindow
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetSubMenu
GetMenu
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
GetSysColorBrush
DestroyMenu
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
GetDlgItem
LoadCursorA
GetPropA
SetPropA
GetMenuItemID
ReleaseDC
GetDC
GetMenuItemCount
GetWindowTextA
SetWindowTextA
ClientToScreen
GetDlgCtrlID
GetWindowRect
PtInRect
GetClassNameA
LoadStringA
UnregisterClassA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetParent
DefWindowProcA
DestroyWindow
CreateWindowExA
GetClassLongA
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
EnableWindow
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
wsprintfA
TabbedTextOutA
CallWindowProcA
CharNextA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
RegisterWindowMessageA
GrayStringA
DrawTextA
GetWindow

gdi32

DeleteDC
RestoreDC
SelectObject
SaveDC
SetBkColor
GetStockObject
SetTextColor
SetMapMode
OffsetViewportOrgEx
SetViewportExtEx
SetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetClipBox
SetWindowExtEx
DeleteObject
GetDeviceCaps
PtVisible
RectVisible
ExtTextOutA
Escape
TextOutA
GetObjectA
CreateBitmap

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA

comctl32

ord17

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
OleRun
CoCreateInstance

oleaut32

SysAllocString
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocStringByteLen
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
VariantClear

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 116KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/XImage32.dll
.dll windows:4 windows x86 arch:x86

0311aea9d77c4309de3c0ad4367ddeaa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalHandle
GlobalLock
GlobalAlloc
ReadFile
CreateFileA
_lclose
GlobalUnlock
_lread
_lopen
GlobalFree
CloseHandle
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
LocalAlloc
LocalFree
FindResourceA
LoadResource
LockResource
_hread
FreeResource
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
FlushFileBuffers
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetEndOfFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

GetDC
ReleaseDC
FillRect

gdi32

GetStockObject
CreateCompatibleDC
CreateDIBitmap
SelectObject
SelectPalette
RealizePalette
BitBlt
DeleteObject
GetDeviceCaps
CreatePalette
StretchDIBits
RectVisible

Exports

Exports

XBMP_DrawFile
XBMP_DrawFile32
XBMP_DrawMemFile
XBMP_GetFileInfo
XBMP_GetMemFileInfo
XDIB_Draw
XDIB_DrawFile
XDIB_DrawPattern
XDIB_DrawTransparent
XDIB_GetFileInfo
XDIB_GetInfo
XDIB_MergeDraw
XGIF_DrawFile
XGIF_GetFileInfo

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/XdictGrb.dll
.dll regsvr32 windows:4 windows x86 arch:x86

a17506dd1e0c36261edae3dd5533bc9d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
lstrlenW
LeaveCriticalSection
EnterCriticalSection
lstrcpyA
ReadConsoleOutputCharacterW
GetConsoleScreenBufferInfo
GetStdHandle
HeapFree
HeapAlloc
GetProcessHeap
DeleteCriticalSection
InitializeCriticalSection
VirtualProtect
lstrlenA
DisableThreadLibraryCalls
GetShortPathNameA
GetModuleHandleA
WideCharToMultiByte
SizeofResource
LoadResource
FindResourceA
GetLastError
LoadLibraryExA
lstrcpynA
IsDBCSLeadByte
HeapDestroy
lstrcatA
VirtualProtectEx
SetPriorityClass
IsBadReadPtr
SuspendThread
VirtualFree
ResumeThread
FlushInstructionCache
GetThreadContext
SetThreadContext
Sleep
InterlockedIncrement
InterlockedDecrement
VirtualFreeEx
VirtualAllocEx
WriteProcessMemory
GetModuleHandleW
GetVersionExW
CreateRemoteThread
VirtualAlloc
FlushFileBuffers
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
IsBadCodePtr
SetUnhandledExceptionFilter
WriteFile
SetLastError
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetVersionExA
ExitThread
GetFileType
SetHandleCount
IsBadWritePtr
RtlUnwind
HeapCreate
GetEnvironmentVariableA
HeapSize
GetCurrentProcess
TerminateProcess
WaitForSingleObject
ReadProcessMemory
GetCurrentProcessId
OpenProcess
lstrcmpiA
CloseHandle
LoadLibraryA
GetProcAddress
GetModuleFileNameA
FreeLibrary
GetVersion
ExitProcess
TlsGetValue
TlsFree
TlsAlloc
GetCommandLineA
GetCurrentThreadId
HeapReAlloc
TlsSetValue

user32

GetWindowLongA
GetClassNameA
SendMessageA
GetWindowRect
KillTimer
GetSystemMetrics
GetMenuItemRect
GetMenuStringW
MenuItemFromPoint
GetMenuBarInfo
wsprintfA
MessageBoxA
PeekMessageA
GetAsyncKeyState
PtInRect
GetCursorPos
ScreenToClient
GetWindowThreadProcessId
LoadStringA
SendMessageTimeoutA
RegisterWindowMessageA
WindowFromPoint
ClientToScreen
GetWindowTextW
GetParent
CharNextExA
IsWindowVisible
SetTimer
CharNextA
GetDesktopWindow
GetWindow
IsWindow
SendMessageW
GetMenu
WindowFromDC
GetClassNameW
RedrawWindow
GetClientRect
GetDC
ReleaseDC

gdi32

GetStockObject
GetTextAlign
GetTextExtentExPointW
CreateFontIndirectW
SelectObject
DeleteObject
GetMapMode
GetDCOrgEx
GetTextExtentPoint32W
GetCurrentPositionEx
GetDeviceCaps
GetTextMetricsW
StretchBlt
BitBlt
LPtoDP
ExtTextOutA
TextOutW
ExtTextOutW
GetPixel
TextOutA

advapi32

RegEnumKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

oleaut32

SysStringLen
SysAllocStringLen
RevokeActiveObject
RegisterActiveObject
GetActiveObject
LoadRegTypeLi
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
VariantClear
SysFreeString
VariantCopy
SysAllocString

psapi

GetModuleFileNameExA
GetModuleBaseNameA
EnumProcessModules

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/Xml2Xdata.dll
.dll regsvr32 windows:4 windows x86 arch:x86

1c0b842288b0139437521ce2073cec30

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
LeaveCriticalSection
EnterCriticalSection
HeapCreate
lstrlenW
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
DeleteCriticalSection
InitializeCriticalSection
GetFileSize
WideCharToMultiByte
CreateFileA
GetSystemInfo
GetVersionExA
TlsAlloc
HeapDestroy
VirtualFree
GetLocaleInfoW
SetEndOfFile
Sleep
InterlockedExchange
MultiByteToWideChar
RtlUnwind
RaiseException
HeapFree
GetCommandLineA
GetVersion
HeapReAlloc
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
GetCurrentThreadId
TlsSetValue
CloseHandle
TlsFree
SetLastError
TlsGetValue
GetLastError
WriteFile
SetFilePointer
FlushFileBuffers
SetUnhandledExceptionFilter
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
IsValidCodePage
SetEnvironmentVariableA
VirtualAlloc
IsBadWritePtr
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
IsValidLocale
IsBadReadPtr
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetProcAddress
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
ReadFile
IsBadCodePtr
SetStdHandle
GetACP
GetOEMCP
LoadLibraryA

oleaut32

SysFreeString
LoadRegTypeLi
SysStringLen

atl

ord57
ord18
ord32
ord21
ord23
ord15
ord58
ord30
ord16

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 144KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/check.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

check
check2
check3

Sections

UPX0
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 22KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/dicts/PWQEC.DIC
Powerword2007_V10.0.0.1/doshow.dll
.dll windows:4 windows x86 arch:x86

78c70a85793d276774dfed0191ee9b25

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GetModuleFileNameA
GetFileAttributesA
lstrlenA
lstrcpyA
TlsAlloc
GetStdHandle
SetHandleCount
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
RtlUnwind
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
GetCurrentThreadId
TlsSetValue
GetTickCount
TlsFree
SetLastError
TlsGetValue
GetLastError
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetEnvironmentStringsW
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
HeapReAlloc
IsBadWritePtr
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc

user32

DestroyWindow
KillTimer
GetWindowRect
EndPaint
DrawTextA
FillRect
GetClientRect
BeginPaint
ReleaseCapture
SetCapture
PtInRect
PostMessageA
ScreenToClient
ShowWindow
UpdateWindow
GetDC
ReleaseDC
GetSystemMetrics
InvalidateRect
SetWindowPos
LoadBitmapA
LoadCursorA
RegisterClassExA
SetWindowLongA
GetWindowLongA
DefWindowProcA
GetCursorPos
SendMessageA
SetTimer
CreateWindowExA

gdi32

CreateFontIndirectA
CreatePen
SetBkMode
DeleteDC
BitBlt
CreateCompatibleDC
GetObjectA
CreateSolidBrush
LineTo
SelectObject
MoveToEx
DeleteObject

ole32

CoCreateInstance

Exports

Exports

CreatePlayer

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/images/ABOUT.BMP
Powerword2007_V10.0.0.1/images/ATA BLOG.gif
.gif
Powerword2007_V10.0.0.1/images/ATA.JPG
.jpg
Powerword2007_V10.0.0.1/images/SPLASH.BMP
Powerword2007_V10.0.0.1/images/Thumbs.db
Powerword2007_V10.0.0.1/newword.dll
.dll windows:4 windows x86 arch:x86

e8658ba2b13fe4a351aa6a9eca086fc8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalGetAtomNameA
FreeLibrary
GetFileTime
GlobalAddAtomA
GlobalFindAtomA
GetCPInfo
GetOEMCP
RtlUnwind
GetCurrentDirectoryA
WritePrivateProfileStringA
RaiseException
ExitProcess
TerminateProcess
HeapSize
HeapReAlloc
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
GetCommandLineA
GetTimeZoneInformation
GetSystemTime
SetHandleCount
GetStdHandle
GetLocalTime
lstrcatA
lstrcmpiA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
GetDriveTypeA
IsBadCodePtr
SetStdHandle
CompareStringW
SetEnvironmentVariableA
CreateDirectoryA
GetTempPathA
GetModuleHandleA
GetProcAddress
GetDiskFreeSpaceA
WinExec
GetModuleFileNameA
GetVersionExA
IsBadReadPtr
IsBadWritePtr
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
GetProcessVersion
GlobalFlags
LocalReAlloc
SetErrorMode
TlsGetValue
GlobalReAlloc
TlsSetValue
EnterCriticalSection
GlobalHandle
LeaveCriticalSection
TlsFree
TlsAlloc
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
LocalAlloc
GetFullPathNameA
GetVolumeInformationA
LockFile
SetEndOfFile
UnlockFile
WriteFile
FlushFileBuffers
SetFilePointer
DuplicateHandle
ReadFile
GetCurrentProcess
lstrcmpA
GlobalAlloc
GlobalDeleteAtom
GetFileType
GetCurrentThread
GetFileAttributesA
GetCurrentThreadId
FindNextFileA
lstrcpyA
FindFirstFileA
GetLastError
FindClose
GlobalLock
GlobalUnlock
SetLastError
lstrcpynA
LocalFree
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrlenA
MultiByteToWideChar
GetACP
GetPrivateProfileIntA
GetVersion
CompareStringA
LoadLibraryA
GetNumberFormatA
CreateFileA
GetFileSize
CloseHandle
GetProcessHeap
HeapAlloc
HeapFree
FindResourceA
LoadResource
LockResource
FreeResource
GetStartupInfoA
FreeEnvironmentStringsA
VirtualAlloc
LCMapStringA
LCMapStringW

user32

GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetSubMenu
GetTopWindow
AdjustWindowRectEx
LoadIconA
DestroyMenu
GetForegroundWindow
SetForegroundWindow
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetMenuItemCount
SetFocus
ShowWindow
SetWindowPos
GetDlgItem
GetSysColor
GetSysColorBrush
LoadCursorA
GetWindowTextA
GetWindow
DefWindowProcA
GetMenuItemID
LoadStringA
UnregisterClassA
UnhookWindowsHookEx
CharUpperA
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
MessageBoxA
EnableWindow
SetCursor
SendMessageA
PostQuitMessage
GrayStringA
DrawTextA
TabbedTextOutA
ClientToScreen
GetDC
ReleaseDC
CopyRect
IntersectRect
GetWindowLongA
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
SetWindowLongA
GetClientRect
MapWindowPoints
GetCursorPos
PtInRect
WindowFromPoint
KillTimer
PostMessageA
IsWindow
SetTimer
DestroyIcon
RemovePropA
GetClassNameA
SetWindowTextA
GetMessageTime
SetRect
GetSystemMetrics
wsprintfA
GetMessagePos
GetDlgCtrlID
GetWindowRect
GetMessageA
GetNextDlgTabItem
GetMenuCheckMarkDimensions

gdi32

Rectangle
CreatePen
CreateSolidBrush
PatBlt
UnrealizeObject
CreatePatternBrush
CreateBitmap
SetDIBitsToDevice
StretchDIBits
CreateCompatibleBitmap
BitBlt
SetPixel
ExtTextOutA
SetBkColor
SaveDC
RestoreDC
GetStockObject
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
ScaleWindowExtEx
GetClipBox
SetWindowExtEx
CreateCompatibleDC
GetDeviceCaps
PtVisible
RectVisible
Escape
TextOutA
DeleteObject
SelectObject
DeleteDC
GetObjectA

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegCloseKey
RegQueryValueA
RegOpenKeyExA
GetUserNameA
RegCreateKeyExA
RegSetValueExA

shell32

SHGetSpecialFolderPathA
SHGetFileInfoA

comctl32

ord17

ole32

CoCreateInstance
CoInitialize
CoUninitialize
OleRun

oleaut32

SysAllocStringByteLen
SysAllocString
SysFreeString
SysStringLen
SysAllocStringLen
GetErrorInfo
VariantClear

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Exports

Exports

WriteRecord
WriteRecordEx

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/newword.exe.manifest
.xml
Powerword2007_V10.0.0.1/shfolder.dll
.dll windows:5 windows x86 arch:x86

a8568b57714f17bea2cb443650a1c951

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDefaultLangID
EnumResourceNamesW
lstrcatA
lstrcpyA
CompareStringW
CreateDirectoryA
CreateDirectoryW
GetLastError
ExpandEnvironmentStringsA
EnumResourceLanguagesW
DisableThreadLibraryCalls
GlobalAlloc
GlobalFree
GetFileAttributesA
GetFileAttributesW
GetSystemDirectoryA
GetSystemDirectoryW
IsBadWritePtr
FindResourceExW
LoadResource
LockResource
GetWindowsDirectoryW
GetWindowsDirectoryA
ExpandEnvironmentStringsW
lstrlenA
lstrlenW
MultiByteToWideChar
GetVersionExA
LoadLibraryA
FreeLibrary
GetProcAddress
lstrcpynW
WideCharToMultiByte

advapi32

SetSecurityDescriptorDacl
SetFileSecurityW
InitializeAcl
GetAce
LookupAccountSidW
AddAccessAllowedAce
RegSetValueExA
RegSetValueExW
RegCreateKeyExA
RegOpenKeyA
RegQueryValueExW
RegQueryValueExA
RegCloseKey
InitializeSecurityDescriptor

Exports

Exports

SHGetFolderPathA
SHGetFolderPathW

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 482B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/statistics.dll
.dll windows:4 windows x86 arch:x86

80497a801b9be7a941ad0fde098e70cb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TlsFree
GlobalHandle
GlobalUnlock
GlobalLock
GlobalAlloc
TlsSetValue
LocalReAlloc
GlobalReAlloc
SetErrorMode
TlsGetValue
GetModuleFileNameA
GetVersion
SetLastError
FindClose
TlsAlloc
GlobalFree
DuplicateHandle
lstrcatA
CreateFileA
ReadFile
WriteFile
FlushFileBuffers
GetCurrentThreadId
SetEndOfFile
GetProcAddress
GetFullPathNameA
FindFirstFileA
GetCurrentProcess
GetFileAttributesA
GetFileSize
GetFileTime
GetSystemDirectoryA
SetFilePointer
FileTimeToSystemTime
FileTimeToLocalFileTime
GetModuleHandleA
GlobalDeleteAtom
GlobalFindAtomA
GlobalGetAtomNameA
GetProcessVersion
LockFile
UnlockFile
GlobalAddAtomA
GetCPInfo
GetOEMCP
RtlUnwind
GetCommandLineA
HeapAlloc
HeapFree
RaiseException
HeapSize
SetStdHandle
GetFileType
GetTimeZoneInformation
GetACP
HeapReAlloc
ExitProcess
TerminateProcess
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
MultiByteToWideChar
WaitForSingleObject
CloseHandle
InterlockedIncrement
WideCharToMultiByte
InterlockedDecrement
lstrcmpA
InitializeCriticalSection
GetVolumeInformationA
LeaveCriticalSection
DeleteCriticalSection
LocalFree
LoadLibraryA
FormatMessageA
lstrcpyA
LocalAlloc
FreeLibrary
EnterCriticalSection
lstrcpynA
lstrlenA
GlobalFlags
GetLastError
lstrcmpiA
GetStringTypeW

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

comctl32

ord17

wininet

InternetGetLastResponseInfoA
HttpQueryInfoA
InternetCrackUrlA
InternetQueryDataAvailable
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetCloseHandle
InternetQueryOptionA
InternetCanonicalizeUrlA
InternetSetOptionExA
InternetSetStatusCallback
InternetOpenA
InternetOpenUrlA

iphlpapi

GetAdaptersInfo

user32

RegisterWindowMessageA
SetWindowPos
SetWindowLongA
GetWindowLongA
SystemParametersInfoA
GetWindow
SetForegroundWindow
GetForegroundWindow
GetLastActivePopup
GetMessagePos
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
DefWindowProcA
GetDlgCtrlID
GetWindowTextA
GetDlgItem
GetMenuItemID
GetSubMenu
GetMenuItemCount
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
MessageBoxA
GetTopWindow
EnableWindow
CopyRect
GetClientRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
PostMessageA
GetWindowPlacement
IsIconic
SetWindowTextA
IsWindowEnabled
LoadCursorA
GetSysColorBrush
ReleaseDC
GetDC
GetClassNameA
PtInRect
ClientToScreen
PostQuitMessage
DestroyMenu
TabbedTextOutA
DrawTextA
GrayStringA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetParent
GetNextDlgTabItem
LoadStringA
GetSystemMetrics
CharUpperA
UnregisterClassA
UnhookWindowsHookEx
DispatchMessageA
GetKeyState
CallNextHookEx
PeekMessageA
SetWindowsHookExA
GetWindowRect
LoadIconA
SendMessageA

gdi32

SetBkColor
GetObjectA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteObject
DeleteDC
GetDeviceCaps
SaveDC
RestoreDC
GetStockObject
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetMapMode
ScaleViewportExtEx
SetViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
CreateBitmap
GetClipBox
SetTextColor

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

comdlg32

GetFileTitleA

Exports

Exports

Statistics_DailyUse
Statistics_Install
Statistics_Online
Statistics_UnInstall

Sections

.text
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/themes/ClassicBlue/Backward.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/BottomBorder.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/ClassicBlue.ini
Powerword2007_V10.0.0.1/themes/ClassicBlue/ContentTitle.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/DlgBkgrd.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/Foreward.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/GO.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/HideLeft.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/LeftPanel.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/LeftTitleBar.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/MainTitle.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/Menus.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/MoveBottom.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/MoveDown.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/MoveTop.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/MoveUp.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/OnlineGo.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/OptionBand.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/OptionPanel.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/RightBorder.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/RightTitleBar.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/ShowLeft.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/TabAdvertisement.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/TabAppendix.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/TabBkgrd.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/TabIndex.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/TabSentence.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/TabWizard.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/Thumbs.db
Powerword2007_V10.0.0.1/themes/ClassicBlue/ViewBkgrd.bmp
Powerword2007_V10.0.0.1/themes/ClassicBlue/XButton.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/Backward.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/BottomBorder.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/ContentTitle.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/DlgBkgrd.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/ElegantWhite.ini
Powerword2007_V10.0.0.1/themes/ElegantWhite/Foreward.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/GO.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/HideLeft.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/LeftPanel.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/LeftTitleBar.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/MainTitle.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/Menus.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/MoveBottom.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/MoveDown.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/MoveTop.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/MoveUp.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/OnlineGo.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/OptionBand.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/OptionPanel.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/RightBorder.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/RightTitleBar.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/ShowLeft.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/TabAdvertisement.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/TabAppendix.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/TabBkgrd.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/TabIndex.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/TabSentence.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/TabWizard.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/Thumbs.db
Powerword2007_V10.0.0.1/themes/ElegantWhite/ViewBkgrd.bmp
Powerword2007_V10.0.0.1/themes/ElegantWhite/XButton.bmp
Powerword2007_V10.0.0.1/toTTSEngine50.dll
.dll windows:4 windows x86 arch:x86

6a97f7e94e39de4d8dfe58f9574dc0d3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapCreate
CloseHandle
CreateThread
WriteFile
VirtualFree
RtlUnwind
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
IsBadWritePtr
GetOEMCP
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetStringTypeA
GetProcAddress
LoadLibraryA
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeW
FlushFileBuffers

ole32

CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree

Exports

Exports

eFreeKVA
eTTSChooseVoice
eTTSClean
eTTSFirstVoice
eTTSGetFormat
eTTSGetPitch
eTTSGetRate
eTTSGetVolume
eTTSInit
eTTSIsPaused
eTTSIsSpeaking
eTTSNextVoice
eTTSPauseResume
eTTSSetFormat
eTTSSetPitch
eTTSSetRate
eTTSSetVolume
eTTSSkip
eTTSSpeak
eTTSStop

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/xdict.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

MYCRACK0
Size: - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

MYCRACK1
Size: 612KB - Virtual size: 632KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

MYCRACK2
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 249KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ATA
Size: 68KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Powerword2007_V10.0.0.1/xdict.ini
Powerword2007_V10.0.0.1/xdict_helper.dll
.dll regsvr32 windows:4 windows x86 arch:x86

da396556118c84afa0020e2b9906213a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenW
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
GetLastError
LoadLibraryExA
lstrcmpiA
lstrcpynA
GetCurrentProcess
HeapDestroy
GetProcAddress
LoadLibraryA
lstrcpyA
lstrcatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushInstructionCache
lstrlenA
MultiByteToWideChar
GetCurrentProcessId
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsDBCSLeadByte
DisableThreadLibraryCalls
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
SetUnhandledExceptionFilter
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
LocalFree
HeapFree
RtlUnwind
HeapReAlloc
HeapAlloc
GetCommandLineA
GetVersion
RaiseException
ExitProcess
TerminateProcess
HeapSize
GetEnvironmentVariableA
GetVersionExA
HeapCreate
VirtualFree
VirtualAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW

user32

InflateRect
PtInRect
KillTimer
SetTimer
CharNextA
LoadStringA

advapi32

RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegEnumValueA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree

oleaut32

LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysAllocString
DispCallFunc
VariantClear
SysStringLen
SysAllocStringLen
SysFreeString
VariantChangeType
CreateErrorInfo
GetActiveObject
VariantInit

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/xfile.dll
.dll windows:4 windows x86 arch:x86

a7ec50d97535089ebfbb2251ff2b06b9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TlsAlloc
GetModuleHandleA
HeapFree
GetProcessHeap
ReadFile
SetFilePointer
CloseHandle
HeapAlloc
CreateFileA
FreeEnvironmentStringsA
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
ExitProcess
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
GetModuleFileNameA
TlsFree
SetLastError
TlsGetValue
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetStdHandle
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
SetEndOfFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

winmm

timeGetTime

Exports

Exports

CFMGR_Cleanup
CFMGR_FreeDisabledBlock
CFMGR_Init
CF_FreeFile
CF_LoadFile
CF_ReadFile
CF_SetSize

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Powerword2007_V10.0.0.1/安装必读.url
.url

Sharing

General

Malware Config

Signatures

Files

9a3adb86900dd774321275b397406449

Headers

File Characteristics

Imports

ws2_32

msvcp60

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 3KB

c81206b5f9bf47c717810a6643f7eb35

Headers

File Characteristics

Imports

kernel32

user32

gdi32

msvcrt

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 15KB

.sdata Size: 16KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 10KB

.reloc Size: 4KB - Virtual size: 1KB

352f9aca7b210e5858f2ec2757e7b962

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 1KB

4dd90d920ab5ec2c83a9b40ef1a72892

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

ole32

oleaut32

ws2_32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 119KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 20KB - Virtual size: 33KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 12KB

2bf53584e2a6d55699df90a5730ffc07

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

ole32

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 16KB - Virtual size: 15KB

.sdata
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 10KB

.reloc
Size: 4KB - Virtual size: 1KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 1KB

.text
Size: 120KB - Virtual size: 119KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 20KB - Virtual size: 33KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 12KB

.text
Size: 140KB - Virtual size: 139KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 16KB - Virtual size: 30KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 16KB - Virtual size: 15KB

.text
Size: 4KB - Virtual size: 1KB

.rdata
Size: 4KB - Virtual size: 77B

.data
Size: 48KB - Virtual size: 44KB

.rsrc
Size: 4KB - Virtual size: 904B

.reloc
Size: 4KB - Virtual size: 72B

.text
Size: 20KB - Virtual size: 17KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 144KB - Virtual size: 143KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 5KB

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 1KB