7fbd15325d3f421b075f959820430ef7

Sharing

Copy URL Twitter E-mail

General

Target

7fbd15325d3f421b075f959820430ef7
Size

3.6MB
MD5

7fbd15325d3f421b075f959820430ef7
SHA1

4d631487c26331899c01f2019bd5ae32fbe02408
SHA256

678288e00db12641df43ea7b975e92a101a94728e4e9e8d60e4cae8942b58732
SHA512

44f5ba32d79bf08b7cb99b7f8e59492c291236144dc15302b3ba4848f26d3da6748a674e79a7e705ce6bb53b4abf40816ceed3e7a446909edacac654ac205345
SSDEEP

98304:mRRaVpRqPx6X3P7NwG2RYvZSY9h/LBuBVaQiymlv:mIR84X36GFZSc/kVPs

Score

3^/10

Malware Config

Signatures

Unsigned PE 19 IoCs

Checks for missing Authenticode signature.

resource
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$SYSDIR/atl71.dll
unpack003/$PLUGINSDIR/InstallOptions.dll
unpack003/$PLUGINSDIR/KillProcDLL.dll
unpack003/$PLUGINSDIR/NSISdl.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/KanKan/IDesktop.dll
unpack003/KanKan/zlib.dll
unpack002/$WINDIR/msgctl.dll
unpack002/52hxw.exe
unpack002/Feedback.dll
unpack002/FlashWordGeneral.dll
unpack002/HttpDownLoad.exe
unpack002/Message.dll
unpack002/Uninstall.dll
unpack002/atl71.dll
unpack002/hxw.dll
unpack002/msgctl.dll

NSIS installer 3 IoCs

installer

resource	yara_rule
static1/unpack001/52hxw-v2.94.exe	nsis_installer_1
static1/unpack001/52hxw-v2.94.exe	nsis_installer_2
static1/unpack002/$TEMP/KanKan_1020.exe	nsis_installer_1

Files

7fbd15325d3f421b075f959820430ef7
.rar
52hxw-v2.94.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:b3:be:a8:9d:64:8e:0d:36:19:5d:2a:76:5a:9c:6b
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

03/12/2009, 00:00

Not After

01/02/2012, 23:59

Subject

CN=厦门网之源信息科技有限公司,O=厦门网之源信息科技有限公司,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

ad:80:65:62:aa:84:02:b4:c6:59:88:49:4a:94:3a:f1:5f:53:b5:fd
Signer

Actual PE Digest

ad:80:65:62:aa:84:02:b4:c6:59:88:49:4a:94:3a:f1:5f:53:b5:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$FAVORITES/520ҳ_www.520.net.url
$FAVORITES/뷨ٷվ 52hxw.com.url
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$SYSDIR/atl71.dll
.dll windows:4 windows x86 arch:x86

7c3004ebf21f282412fa952c164aa2bb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

atl71.pdb

Imports

kernel32

InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
lstrlenW
lstrcpyW
GetLastError
DisableThreadLibraryCalls
GetVersionExA
InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrcmpiW
lstrcpynW
CloseHandle
ReadFile
GetFileSize
CreateFileW
GetModuleHandleW
GetModuleFileNameW
WideCharToMultiByte
HeapFree
GetProcessHeap
WaitForSingleObject
GlobalAlloc
FindResourceA
MulDiv
lstrcatW
HeapAlloc
FlushInstructionCache
GetCurrentProcess
GlobalUnlock
GlobalLock
lstrcmpW
SetLastError
GlobalFree
GlobalHandle
LockResource
lstrcmpA
GetModuleHandleA
GetTickCount
GetProcAddress
ExitProcess
HeapSize
DebugBreak
HeapReAlloc
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
lstrcatA
lstrcpyA
lstrlenA
GetModuleFileNameA
RtlUnwind
VirtualQuery
LocalAlloc
LoadLibraryA

shlwapi

PathFindExtensionW

Exports

Exports

AtlAdvise
AtlAxAttachControl
AtlAxCreateControl
AtlAxCreateControlEx
AtlAxCreateControlLic
AtlAxCreateControlLicEx
AtlAxCreateDialogA
AtlAxCreateDialogW
AtlAxDialogBoxA
AtlAxDialogBoxW
AtlAxGetControl
AtlAxGetHost
AtlAxWinInit
AtlCallTermFunc
AtlComModuleGetClassObject
AtlComModuleRegisterClassObjects
AtlComModuleRegisterServer
AtlComModuleRevokeClassObjects
AtlComModuleUnregisterServer
AtlComPtrAssign
AtlComQIPtrAssign
AtlCreateRegistrar
AtlCreateTargetDC
AtlDevModeW2A
AtlFreeMarshalStream
AtlGetObjectSourceInterface
AtlGetVersion
AtlHiMetricToPixel
AtlIPersistPropertyBag_Load
AtlIPersistPropertyBag_Save
AtlIPersistStreamInit_Load
AtlIPersistStreamInit_Save
AtlInternalQueryInterface
AtlLoadTypeLib
AtlMarshalPtrInProc
AtlModuleAddTermFunc
AtlPixelToHiMetric
AtlRegisterClassCategoriesHelper
AtlRegisterTypeLib
AtlSetErrorInfo
AtlUnRegisterTypeLib
AtlUnadvise
AtlUnmarshalPtr
AtlUpdateRegistryFromResourceD
AtlWaitWithMessageLoop
AtlWinModuleAddCreateWndData
AtlWinModuleExtractCreateWndData
AtlWinModuleInit
AtlWinModuleRegisterClassExA
AtlWinModuleRegisterClassExW
AtlWinModuleRegisterWndClassInfoA
AtlWinModuleRegisterWndClassInfoW
AtlWinModuleTerm

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/KanKan_1020.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:b3:be:a8:9d:64:8e:0d:36:19:5d:2a:76:5a:9c:6b
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

03/12/2009, 00:00

Not After

01/02/2012, 23:59

Subject

CN=厦门网之源信息科技有限公司,O=厦门网之源信息科技有限公司,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

85:8b:76:9b:5d:9c:fe:49:da:0f:1d:db:f9:c2:4d:67:65:61:be:e8
Signer

Actual PE Digest

85:8b:76:9b:5d:9c:fe:49:da:0f:1d:db:f9:c2:4d:67:65:61:be:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Chose.ini
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
RtlUnwind
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP

Exports

Exports

KillProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/introduce.bmp
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/meituWel.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
KanKan/CrashReport.exe
.exe windows:4 windows x86 arch:x86

b9516cc50ef65b89bb7dceee4019ba0b

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:b3:be:a8:9d:64:8e:0d:36:19:5d:2a:76:5a:9c:6b
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

03/12/2009, 00:00

Not After

01/02/2012, 23:59

Subject

CN=厦门网之源信息科技有限公司,O=厦门网之源信息科技有限公司,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

7e:55:8b:10:b7:0c:33:b7:75:f6:b9:ea:01:98:11:77:31:76:e7:75
Signer

Actual PE Digest

7e:55:8b:10:b7:0c:33:b7:75:f6:b9:ea:01:98:11:77:31:76:e7:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord4418
ord3733
ord800
ord815
ord540
ord561
ord825
ord641
ord609
ord781
ord2506
ord2613
ord1131
ord858
ord4273
ord2756
ord4272
ord861
ord617
ord538
ord2810
ord2910
ord5208
ord296
ord6433
ord5261
ord4847
ord4992
ord4704
ord6048
ord4073
ord1767
ord4401
ord5237
ord2377
ord5157
ord6370
ord4347
ord5276
ord3793
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord4616
ord4621
ord4419
ord3592
ord324
ord4229
ord3703
ord2567
ord6051
ord1768
ord4390
ord5286
ord3397
ord3569
ord1143
ord1165
ord567
ord2294
ord6195
ord5949
ord4155
ord2858
ord2371
ord3658
ord3566
ord3621
ord2406
ord686
ord2088
ord384
ord1634
ord755
ord470
ord2634
ord3087
ord665
ord940
ord1971
ord6381
ord5769
ord5180
ord354
ord942
ord5706
ord4124
ord5679
ord535
ord3871
ord860
ord537
ord3084
ord4470
ord823
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5710
ord5285
ord5303
ord4692
ord4074
ord2717
ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord4269
ord5273
ord4667
ord1569

msvcrt

__p__fmode
__set_app_type
_except_handler3
_controlfp
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
wcsncpy
wcstoul
wcscat
calloc
__p__commode
swprintf
_CxxThrowException
??0exception@@QAE@ABV0@@Z
wcscpy
??1exception@@UAE@XZ
??0exception@@QAE@XZ
free
_vsnwprintf
_vsnprintf
_wcsicoll
_wcsnicmp
malloc
_splitpath
_wcsicmp
_adjust_fdiv
__setusermatherr
__CxxFrameHandler
wcslen
wcscmp
_beginthreadex
strncat
_initterm

kernel32

FileTimeToDosDateTime
CreateFileA
lstrlenW
WideCharToMultiByte
FindClose
FileTimeToLocalFileTime
FindFirstFileA
WaitForSingleObject
GetLastError
ReadFile
MultiByteToWideChar
GetFileSize
CreateFileW
SetFilePointer
GetStartupInfoW
DeleteFileW
CloseHandle
OutputDebugStringW
GetModuleHandleW
GetCommandLineW
GetModuleFileNameW

user32

LoadIconW
SendMessageW
AppendMenuW
GetClientRect
GetSystemMetrics
IsIconic
PostMessageW
DrawIcon
GetSystemMenu
LoadBitmapW
EnableWindow

gdi32

GetObjectW

shell32

ShellExecuteW

comctl32

ImageList_Draw
ImageList_AddMasked

ole32

CoTaskMemFree
CoCreateGuid

urlmon

FindMimeFromData

zlib

ord84
ord72
ord62
ord80
ord81
ord82
ord83

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

wininet

InternetReadFile
InternetSetOptionW
HttpQueryInfoW
HttpSendRequestExW
InternetConnectW
InternetGetConnectedState
InternetCloseHandle
HttpOpenRequestA
HttpAddRequestHeadersA
HttpEndRequestW
InternetWriteFile
InternetOpenW

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KanKan/IDesktop.dll
.dll windows:4 windows x86 arch:x86

fa9e838d6ed38ad0fd8aec0dc2550827

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetCursor
LoadCursorW
SetCursor

ole32

CoUninitialize
CoCreateInstance
CoInitialize

msvcrt

_initterm
free
_adjust_fdiv
malloc

Exports

Exports

SetWallPaper

Sections

.text
Size: 4KB - Virtual size: 558B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KanKan/ImgFmt.dll
.dll windows:4 windows x86 arch:x86

96a8ec412858a637750b430c36c75b02

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:b3:be:a8:9d:64:8e:0d:36:19:5d:2a:76:5a:9c:6b
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

03/12/2009, 00:00

Not After

01/02/2012, 23:59

Subject

CN=厦门网之源信息科技有限公司,O=厦门网之源信息科技有限公司,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

5d:0d:7b:eb:5b:b1:2a:1e:2f:3c:23:22:48:74:81:ab:23:7e:b3:03
Signer

Actual PE Digest

5d:0d:7b:eb:5b:b1:2a:1e:2f:3c:23:22:48:74:81:ab:23:7e:b3:03

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
malloc
_initterm
free

kernel32

DisableThreadLibraryCalls

Sections

.text
Size: 4KB - Virtual size: 366B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 520KB - Virtual size: 516KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KanKan/KanKan.exe
.exe windows:4 windows x86 arch:x86

3291318b135a0be79216b1507a1154a3

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:b3:be:a8:9d:64:8e:0d:36:19:5d:2a:76:5a:9c:6b
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

03/12/2009, 00:00

Not After

01/02/2012, 23:59

Subject

CN=厦门网之源信息科技有限公司,O=厦门网之源信息科技有限公司,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

c6:99:7e:02:88:97:74:b8:5d:31:7b:27:d3:97:28:d7:79:42:42:32
Signer

Actual PE Digest

c6:99:7e:02:88:97:74:b8:5d:31:7b:27:d3:97:28:d7:79:42:42:32

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord5830
ord2036
ord2858
ord1143
ord4237
ord4461
ord3054
ord3364
ord3618
ord674
ord5278
ord4078
ord4451
ord2225
ord5651
ord5048
ord4407
ord4787
ord1263
ord1229
ord925
ord927
ord1099
ord4124
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord5298
ord5710
ord3733
ord815
ord561
ord617
ord551
ord3332
ord3806
ord2084
ord6867
ord5208
ord296
ord1131
ord1196
ord1202
ord3948
ord4692
ord4351
ord2756
ord860
ord2812
ord4273
ord3395
ord3732
ord2706
ord2527
ord2092
ord922
ord5706
ord2373
ord2572
ord4394
ord2560
ord6267
ord3220
ord3907
ord2536
ord2535
ord2503
ord978
ord1724
ord2878
ord2390
ord2410
ord6220
ord6222
ord2421
ord2242
ord2251
ord4830
ord4434
ord6144
ord1231
ord1920
ord4279
ord3774
ord3087
ord3566
ord5781
ord1761
ord665
ord1971
ord547
ord3313
ord5180
ord354
ord6266
ord1172
ord1177
ord6748
ord2621
ord2455
ord1561
ord5714
ord2855
ord5801
ord2755
ord6865
ord4128
ord4292
ord562
ord5778
ord2235
ord4524
ord5681
ord3269
ord2574
ord4396
ord3635
ord686
ord384
ord439
ord3288
ord3211
ord4037
ord3905
ord736
ord5491
ord2088
ord2400
ord6238
ord2550
ord1972
ord668
ord3176
ord3305
ord3314
ord3173
ord2773
ord2762
ord356
ord3296
ord6754
ord6892
ord3991
ord6003
ord3281
ord729
ord2496
ord1699
ord430
ord5142
ord2505
ord293
ord6563
ord3494
ord4162
ord556
ord809
ord1088
ord2114
ord2631
ord2423
ord2538
ord291
ord2248
ord1258
ord4282
ord5945
ord5857
ord6331
ord1173
ord663
ord348
ord1567
ord536
ord6920
ord5784
ord472
ord4120
ord6668
ord3909
ord489
ord768
ord4829
ord5283
ord2857
ord4371
ord4352
ord4942
ord4970
ord4736
ord4899
ord5154
ord5156
ord5155
ord3634
ord4395
ord2573
ord4214
ord2016
ord2405
ord6362
ord1764
ord1899
ord783
ord3706
ord933
ord3933
ord5147
ord2673
ord4448
ord4225
ord1709
ord298
ord6365
ord1702
ord1795
ord1150
ord533
ord539
ord5627
ord6654
ord3898
ord4280
ord3652
ord4652
ord4810
ord4791
ord4789
ord4804
ord4989
ord4695
ord5047
ord6316
ord1850
ord2089
ord6816
ord6586
ord6793
ord6561
ord6595
ord620
ord6487
ord2436
ord5244
ord6851
ord5275
ord6922
ord5230
ord6585
ord6853
ord2381
ord6868
ord5777
ord3701
ord2440
ord500
ord5856
ord5602
ord2397
ord772
ord942
ord4118
ord3808
ord5274
ord2634
ord5933
ord3056
ord3871
ord781
ord3703
ord3574
ord2615
ord2372
ord2559
ord1165
ord6437
ord2442
ord3591
ord5860
ord6057
ord5567
ord5575
ord5732
ord5674
ord5790
ord5869
ord6017
ord6185
ord4324
ord6182
ord5752
ord6188
ord5755
ord2966
ord5006
ord4146
ord542
ord6565
ord802
ord6896
ord5679
ord4272
ord2813
ord537
ord940
ord6278
ord6279
ord2914
ord2606
ord5024
ord6211
ord2879
ord3792
ord5480
ord5248
ord1637
ord2430
ord3649
ord4116
ord5467
ord4051
ord4358
ord1569
ord2522
ord6150
ord6771
ord857
ord6568
ord2885
ord879
ord878
ord2576
ord4215
ord4421
ord4430
ord1658
ord2641
ord5233
ord4072
ord2873
ord2874
ord3398
ord5468
ord975
ord3345
ord4298
ord5097
ord5094
ord2382
ord2715
ord4155
ord3133
ord4016
ord656
ord3348
ord5456
ord6567
ord4502
ord2705
ord3915
ord2859
ord289
ord613
ord470
ord323
ord1633
ord2745
ord640
ord755
ord6871
ord6597
ord6193
ord521
ord6303
ord803
ord567
ord543
ord818
ord3579
ord5257
ord4270
ord6051
ord1941
ord535
ord6390
ord5446
ord6379
ord5436
ord2746
ord4458
ord2910
ord5568
ord560
ord813
ord4426
ord5256
ord1719
ord3743
ord5236
ord4103
ord4955
ord4958
ord4518
ord4523
ord4520
ord4537
ord4539
ord4525
ord4884
ord4717
ord4343
ord4335
ord5070
ord4886
ord4364
ord4893
ord4582
ord4583
ord4268
ord1937
ord2854
ord6168
ord5785
ord355
ord2507
ord3447
ord6874
ord641
ord5977
ord858
ord861
ord6195
ord2244
ord3476
ord5906
ord1106
ord801
ord541
ord4197
ord4199
ord2718
ord817
ord565
ord4616
ord5711
ord5285
ord5303
ord4693
ord4074
ord5299
ord5296
ord3341
ord2388
ord4221
ord1940
ord823
ord6451
ord2371
ord4294
ord540
ord2810
ord5871
ord538
ord800
ord1634
ord3614
ord2406
ord3621
ord3658
ord825
ord3737
ord4418
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord1720
ord5059
ord3744
ord6372

msvcrt

floor
wcstod
calloc
strrchr
atof
iswdigit
printf
strncpy
_filbuf
isprint
_swab
wcscpy
_setjmp3
__CxxLongjmpUnwind
longjmp
strncmp
sprintf
sscanf
getenv
fprintf
_iob
_stricmp
putc
strchr
_getcwd
fopen
_pctype
__mb_cur_max
iswalpha
fgetc
perror
strstr
mktime
tmpfile
atoi
_strnicmp
gmtime
puts
abort
_snprintf
strtod
strlen
strcpy
exp
log
sqrt
fabs
atan2
toupper
tolower
localtime
strncat
_splitpath
wcsncmp
_vsnprintf
_vsnwprintf
strtoul
wcstoul
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memset
strcat
strcmp
memcmp
memcpy
__CxxFrameHandler
_CIpow
wcslen
swprintf
_purecall
fclose
qsort
_isctype
fread
fwrite
fseek
ftell
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
swscanf
_strcmpi
wcstol
_wmakepath
_wcsnicmp
_wcsdup
_wtoi64
_wtol
vswprintf
wcsncpy
_wmkdir
malloc
_wstat
_wrename
_errno
wcsstr
_endthreadex
_beginthreadex
free
realloc
time
srand
rand
_sleep
_wtoi
_wcsicmp
wcscmp
_wfopen
_CxxThrowException
??0exception@@QAE@ABV0@@Z
memmove
_ftol
_wsplitpath
wcscat
wcschr
wcsrchr
_wcslwr
_wcsupr
fscanf
fgets
getc
fputc
fflush

kernel32

GetFileSize
UnlockFile
LockFile
LockFileEx
GetFullPathNameA
GetFullPathNameW
GetSystemTime
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
FileTimeToDosDateTime
GetCurrentProcess
FindFirstFileA
IsDBCSLeadByteEx
FlushInstructionCache
SetEndOfFile
FlushFileBuffers
WriteFile
GetTempPathA
CreateFileA
GetFileAttributesA
GetVersionExA
DeleteFileA
InterlockedDecrement
LocalSize
GetModuleFileNameA
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
LoadLibraryExW
FormatMessageW
GetTempPathW
GetTempFileNameW
GetPrivateProfileSectionNamesW
lstrcmpA
GetCurrentDirectoryW
EnumResourceLanguagesW
EnumResourceNamesW
EnumResourceTypesW
FindFirstChangeNotificationW
FindNextChangeNotification
FindCloseChangeNotification
WaitForMultipleObjects
GetVersion
FindFirstFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
LoadLibraryA
SetFilePointer
CreateFileW
ReadFile
FindResourceW
InterlockedIncrement
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetModuleHandleA
GetCurrentThreadId
SizeofResource
LoadResource
LockResource
CompareStringW
GetExitCodeThread
OutputDebugStringW
LocalFree
SetLastError
LocalAlloc
MultiByteToWideChar
SuspendThread
GetTickCount
MulDiv
GetFileTime
GetCommandLineW
CreateSemaphoreW
GetLastError
GetCurrentProcessId
SetCurrentDirectoryW
GetPrivateProfileStringW
WritePrivateProfileSectionW
WritePrivateProfileStringW
DeleteFileW
GetStartupInfoW
GetVersionExW
CreateProcessW
lstrlenA
GetShortPathNameW
lstrcmpiW
GetFileAttributesW
SetFileAttributesW
GetModuleFileNameW
LoadLibraryW
FreeLibrary
lstrcatW
WideCharToMultiByte
WinExec
GetLocaleInfoW
GetNumberFormatW
GetPrivateProfileIntW
TerminateThread
SetEvent
ResetEvent
CreateEventW
ResumeThread
Sleep
QueryPerformanceFrequency
QueryPerformanceCounter
TerminateProcess
OpenProcess
GetModuleHandleW
GetProcAddress
lstrlenW
GlobalAlloc
GlobalLock
lstrcpyW
GlobalUnlock
GlobalFree
LeaveCriticalSection
EnterCriticalSection
GetCurrentThread
SetThreadPriority
CloseHandle
CreateThread
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateDirectoryW
CopyFileW
lstrcpynW
DeviceIoControl

user32

GetWindowRect
KillTimer
ShowWindow
IsRectEmpty
SetCursor
ReleaseCapture
DispatchMessageW
GetMessageW
GetCapture
SetFocus
SetCapture
SetTimer
ClientToScreen
UpdateWindow
PeekMessageW
LoadAcceleratorsW
DestroyAcceleratorTable
GetClassNameW
DestroyIcon
LoadIconW
CreatePopupMenu
InsertMenuW
GetMenuItemCount
IsMenu
DeleteMenu
GetMenuStringW
CloseClipboard
GetClipboardData
OpenClipboard
RegisterClipboardFormatW
EmptyClipboard
IsWindowVisible
TabbedTextOutW
GetClientRect
SetWindowLongW
PtInRect
InflateRect
LoadCursorW
GetParent
GetWindowThreadProcessId
SendMessageTimeoutW
EnumWindows
GetSystemMetrics
GetMonitorInfoW
MonitorFromWindow
ShowCursor
GetNextDlgGroupItem
FindWindowExW
GetClipboardFormatNameW
DefMDIChildProcW
DefMDIChildProcA
DefFrameProcW
DefFrameProcA
DefWindowProcA
CallWindowProcA
IsWindowUnicode
GetWindowLongA
SetWindowLongA
EndPaint
BeginPaint
AdjustWindowRectEx
AppendMenuW
EnableMenuItem
GetDoubleClickTime
DeferWindowPos
SetClassLongW
GetCursor
WindowFromPoint
GetDlgItem
DrawEdge
LoadMenuIndirectW
LookupIconIdFromDirectoryEx
FillRect
EnableWindow
SendMessageW
DrawTextW
SetRect
InvalidateRect
CopyRect
OffsetRect
IsWindow
GetWindowTextW
IsZoomed
GetWindowLongW
PostThreadMessageW
GetFocus
SetWindowTextW
GrayStringW
SetWindowsHookExW
UnionRect
IsChild
GetMenu
GetMenuItemID
DrawIconEx
GetWindow
SetMenuDefaultItem
RegisterWindowMessageW
GetMessagePos
CallWindowProcW
GetPropW
GetWindowDC
RemovePropW
GetClassNameA
SetPropW
GetCursorPos
BringWindowToTop
GetKeyState
SystemParametersInfoW
DrawFocusRect
SetWindowRgn
IsWindowEnabled
MessageBeep
GetSystemMenu
GetActiveWindow
SetActiveWindow
IntersectRect
BeginDeferWindowPos
EndDeferWindowPos
LoadStringW
GetDesktopWindow
SetWindowPos
RedrawWindow
GetDlgCtrlID
CreateMenu
LoadImageW
SetForegroundWindow
EnableScrollBar
ShowScrollBar
SetScrollRange
GetScrollRange
GetScrollPos
SetScrollPos
GetScrollInfo
SetScrollInfo
GetDC
ReleaseDC
FindWindowW
DestroyMenu
SetClipboardData
MessageBoxW
SetWindowPlacement
GetWindowPlacement
GetClassInfoW
DefWindowProcW
wsprintfW
IsIconic
SetMenu
LoadMenuW
GetSubMenu
RemoveMenu
TranslateMessage
SetRectEmpty
EqualRect
ScreenToClient
DrawStateW
UnhookWindowsHookEx
DrawFrameControl
CallNextHookEx
InvertRect
GetDCEx
LockWindowUpdate
GetLastActivePopup
GetForegroundWindow
GetMenuItemInfoW
GetMenuDefaultItem
MapVirtualKeyW
GetNextDlgTabItem
ShowCaret
HideCaret
GetWindowRgn
CreateIconFromResourceEx
CopyIcon
GetIconInfo
CreateIconIndirect
LoadBitmapW
TrackPopupMenu
IsClipboardFormatAvailable
IsDialogMessageW
MapWindowPoints
SetParent
GetSysColor
SetCursorPos
MoveWindow
TranslateAcceleratorW
CopyAcceleratorTableW
IsCharLowerW
GetKeyNameTextW
MapVirtualKeyExW
GetKeyboardLayout
ToUnicodeEx
GetKeyboardState
GetKeyboardLayoutList
CharUpperW
CreateAcceleratorTableW
EnumChildWindows
DrawAnimatedRects
CheckMenuItem
GetMenuState
GetClassLongW
PostMessageW

gdi32

GetDIBits
GetBitmapBits
GetTextExtentPoint32W
SetPixel
CreateRoundRectRgn
SetStretchBltMode
ExcludeClipRect
SelectClipRgn
StretchDIBits
StretchBlt
SetBkColor
SetDIBitsToDevice
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
CreateCompatibleBitmap
CreateDIBSection
BitBlt
DeleteObject
CreateCompatibleDC
SelectObject
DeleteDC
GetObjectW
CreateFontIndirectW
GetTextColor
GetStockObject
GetTextMetricsW
GetDeviceCaps
GetPixel
GetCurrentObject
RestoreDC
SaveDC
CreateSolidBrush
SetRectRgn
SetEnhMetaFileBits
GetEnhMetaFileHeader
SetWinMetaFileBits
DeleteEnhMetaFile
SetBkMode
SetBrushOrgEx
Ellipse
ExtFloodFill
OffsetRgn
GetBkColor
GetTextCharsetInfo
Rectangle
CreateFontW
GetViewportOrgEx
PatBlt
SelectPalette
CreateDIBitmap
CreatePalette
ExtCreateRegion
CreatePatternBrush
RoundRect
CreatePolygonRgn
GetRgnBox
GetObjectType
GetTextAlign
GetMapMode
CombineRgn
SetDIBits
SetTextColor
CreateBitmap
CreateRectRgn
PtInRegion
Polygon
EnumFontFamiliesExW
CreatePen

advapi32

RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegCreateKeyW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegEnumValueW

shell32

SHBrowseForFolderW
SHFreeNameMappings
DragQueryFileW
SHGetFileInfoW
SHChangeNotify
ShellExecuteW
SHGetPathFromIDListW
SHFileOperationW
ShellExecuteExW
SHAppBarMessage
SHGetFolderLocation
Shell_NotifyIconW
SHGetMalloc
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW

comctl32

ImageList_GetBkColor
_TrackMouseEvent
ImageList_DrawEx
ImageList_GetImageInfo
ord17
ImageList_Draw
ImageList_SetBkColor
ImageList_AddMasked
ImageList_DrawIndirect
ImageList_Destroy
ImageList_GetImageCount
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_Add
ImageList_Create
PropertySheetW
ImageList_Remove
FlatSB_GetScrollProp
ImageList_GetIcon

ole32

OleRun
OleUninitialize
OleInitialize
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
CoTaskMemFree
CoCreateGuid
CoInitialize

urlmon

URLDownloadToFileW
FindMimeFromData

gdiplus

GdipDisposeImageAttributes
GdipDrawImageRectRectI
GdipSetImageAttributesColorMatrix
GdipCreateImageAttributes
GdipGetImageGraphicsContext
GdipCreateBitmapFromGdiDib
GdipDisposeImage
GdipDeleteFontFamily
GdipCreateFont
GdipCreateFontFamilyFromName
GdipDeleteFont
GdipFree
GdipFillRectangleI
GdipCloneBrush
GdipAlloc
GdipSetTextRenderingHint
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipGetStringFormatFlags
GdipSetStringFormatTabStops
GdipCreateSolidFill
GdipDrawString
GdipDeleteBrush
GdipCreateFromHDC
GdipStringFormatGetGenericDefault
GdipCloneStringFormat
GdipSetStringFormatHotkeyPrefix
GdipSetStringFormatFlags
GdipMeasureString
GdipDeleteStringFormat
GdipDeleteGraphics
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePixelFormat
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusShutdown
GdiplusStartup
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipCreateBitmapFromStreamICM
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipSaveImageToFile
GdipGetImageThumbnail
GdipDrawImageRectI
GdipCreatePath
GdipAddPathRectangle
GdipCreateMatrix
GdipSaveImageToStream
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromStream
GdipCreateTexture
GdipCloneImage
GdipRotateMatrix
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipBitmapSetResolution
GdipBitmapSetPixel
GdipBitmapGetPixel
GdipSetImagePalette
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGraphicsClear
GdipImageSelectActiveFrame
GdipCloneBitmapAreaI
GdipImageRotateFlip
GdipDeletePath
GdipDeleteMatrix
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipSetInterpolationMode
GdipGetPathWorldBounds

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??0logic_error@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??_7out_of_range@std@@6B@
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

InternetWriteFile
InternetGetConnectedState
InternetReadFile
InternetSetOptionW
HttpQueryInfoW
HttpSendRequestExW
HttpSendRequestW
InternetConnectW
InternetOpenW
InternetSetOptionA
DeleteUrlCacheEntryW
HttpEndRequestW
HttpQueryInfoA
HttpSendRequestExA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetOpenA

psapi

GetModuleBaseNameW
EnumProcessModules
EnumProcesses

zlib

ord80
ord62
ord72
ord82
ord83
ord84
ord81

imm32

ImmAssociateContext

winmm

PlaySoundW

imagehlp

ImageDirectoryEntryToData

ws2_32

htonl
ntohl
ntohs
htons

iphlpapi

GetAdaptersInfo

oleaut32

CreateErrorInfo
VariantChangeType
SetErrorInfo
GetErrorInfo
OleLoadPicturePath
VariantClear
VariantChangeTypeEx
SysAllocString
VariantInit
SysFreeString

Exports

Exports

??0CxExifInfo@@QAE@ABV0@@Z
??0CxFile@@QAE@ABV0@@Z
??0CxFile@@QAE@XZ
??0CxIOFile@@QAE@ABV0@@Z
??0CxIOFile@@QAE@PAU_iobuf@@@Z
??0CxMemFile@@QAE@ABV0@@Z
??1CxFile@@UAE@XZ
??1CxIOFile@@UAE@XZ
??4CxFile@@QAEAAV0@ABV0@@Z
??4CxIOFile@@QAEAAV0@ABV0@@Z
??4CxMemFile@@QAEAAV0@ABV0@@Z
??_7CxExifInfo@@6B@
??_7CxFile@@6B@
??_7CxIOFile@@6B@
??_7CxMemFile@@6B@
??_FCxIOFile@@QAEXXZ
??_FCxMemFile@@QAEXXZ
?Close@CxIOFile@@UAE_NXZ
?Eof@CxIOFile@@UAE_NXZ
?Error@CxIOFile@@UAEJXZ
?Flush@CxIOFile@@UAE_NXZ
?GetBuffer@CxFile@@UAEPAE_N@Z
?GetC@CxIOFile@@UAEJXZ
?GetFilePath@CxMemFile@@UAEPBGXZ
?GetS@CxIOFile@@UAEPADPADH@Z
?Open@CxIOFile@@QAE_NPBG0@Z
?PutC@CxFile@@UAE_NE@Z
?PutC@CxIOFile@@UAE_NE@Z
?Read@CxIOFile@@UAEIPAXII@Z
?Scanf@CxIOFile@@UAEJPBDPAX@Z
?Seek@CxIOFile@@UAE_NJH@Z
?Size@CxIOFile@@UAEJXZ
?Tell@CxIOFile@@UAEJXZ
?Write@CxIOFile@@UAEIPBXII@Z

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 432KB - Virtual size: 429KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KanKan/KanKanGengxin.exe
.exe windows:4 windows x86 arch:x86

a1d4a17f2d5f5d69ba10a5ce45cb1e99

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:b3:be:a8:9d:64:8e:0d:36:19:5d:2a:76:5a:9c:6b
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

03/12/2009, 00:00

Not After

01/02/2012, 23:59

Subject

CN=厦门网之源信息科技有限公司,O=厦门网之源信息科技有限公司,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

3b:db:06:9a:ca:77:06:e5:ad:c0:52:53:ed:46:b2:e3:9a:9c:d7:fb
Signer

Actual PE Digest

3b:db:06:9a:ca:77:06:e5:ad:c0:52:53:ed:46:b2:e3:9a:9c:d7:fb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord861
ord2810
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord5298
ord2717
ord4692
ord5710
ord3733
ord815
ord561
ord2606
ord4272
ord2755
ord2084
ord5480
ord942
ord5568
ord2613
ord1131
ord1834
ord4237
ord2715
ord2382
ord3054
ord5094
ord5097
ord4461
ord4298
ord3345
ord5006
ord975
ord5468
ord3398
ord2874
ord2873
ord2756
ord6051
ord4072
ord1768
ord4401
ord5233
ord2377
ord5157
ord6370
ord4347
ord5278
ord2641
ord1658
ord3793
ord4831
ord4430
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord2438
ord2116
ord5273
ord4621
ord4421
ord366
ord674
ord1106
ord6279
ord6278
ord4451
ord5248
ord537
ord4407
ord2371
ord1263
ord1229
ord1165
ord860
ord5438
ord354
ord5180
ord6381
ord1971
ord665
ord538
ord2718
ord6868
ord925
ord922
ord858
ord535
ord2910
ord5679
ord4124
ord825
ord565
ord540
ord817
ord1569
ord800
ord4418
ord4616
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5711
ord5285
ord5303
ord4693
ord4074
ord5299
ord5296
ord3341
ord2388
ord4221
ord1940
ord4146
ord823

msvcrt

_controlfp
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_wcsnicmp
wcstoul
wcscat
swprintf
_CxxThrowException
__set_app_type
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_vsnwprintf
_vsnprintf
sprintf
_ftol
wcscmp
realloc
wcsrchr
malloc
_wtoi
wcsstr
wcscpy
wcslen
wcschr
_wstat
wcsncpy
_wmkdir
_makepath
__p__fmode
??0exception@@QAE@ABV0@@Z
__p__commode
__CxxFrameHandler
_wcsicmp
_splitpath
free
strrchr
_strdup
_except_handler3

kernel32

lstrlenA
GetLastError
CreateDirectoryA
GetFileAttributesA
CloseHandle
WriteFile
CreateFileA
WaitForSingleObject
GetVersionExW
OpenProcess
GetPrivateProfileStringW
GetModuleFileNameW
GetCommandLineW
CreateSemaphoreW
lstrcmpiA
GetProcAddress
LoadLibraryW
MultiByteToWideChar
ResumeThread
GetModuleHandleW
GetFileSize
ReadFile
GetStartupInfoW
CopyFileW
Sleep
DeleteFileW
lstrlenW
FreeLibrary
WideCharToMultiByte

user32

PostThreadMessageW
SetTimer
PostMessageW
LoadCursorW
DefWindowProcW
wsprintfW
KillTimer
GetClassInfoW

advapi32

RegOpenKeyW
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegQueryValueExW

shell32

SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoCreateGuid

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ

zlib

ord67
ord84
ord65
ord64
ord66
ord61
ord63
ord72
ord62
ord68

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

EnumProcessModules
GetModuleBaseNameW
EnumProcesses

wininet

HttpQueryInfoW
InternetSetOptionW
InternetConnectW
InternetOpenW
InternetReadFile
HttpSendRequestW
InternetCloseHandle
HttpEndRequestW
InternetWriteFile
InternetGetConnectedState
HttpOpenRequestA
HttpAddRequestHeadersA

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KanKan/Skin/Default/control/box_bg2.png
.png
KanKan/Skin/Default/control/button_hover.png
.png
KanKan/Skin/Default/control/button_normal.png
.png
KanKan/Skin/Default/control/bx_bg.png
.png
KanKan/Skin/Default/control/bx_close.png
.png
KanKan/Skin/Default/control/bx_close_hover.png
.png
KanKan/Skin/Default/control/checkbox_1.png
.png
KanKan/Skin/Default/control/checkbox_1_hover.png
.png
KanKan/Skin/Default/control/checkbox_2.png
.png
KanKan/Skin/Default/control/checkbox_2_hover.png
.png
KanKan/Skin/Default/control/combolistbg.png
.png
KanKan/Skin/Default/control/doing.png
.png
KanKan/Skin/Default/control/edit.png
.png
KanKan/Skin/Default/control/edit_dis.png
.png
KanKan/Skin/Default/control/edit_hover.png
.png
KanKan/Skin/Default/control/empty_blank.png
.png
KanKan/Skin/Default/control/fcit.hover.png
.png
KanKan/Skin/Default/control/fcit.pressed.png
.png
KanKan/Skin/Default/control/fcparent.hover.png
.png
KanKan/Skin/Default/control/fcparent.png
.png
KanKan/Skin/Default/control/fcsepr.png
.png
KanKan/Skin/Default/control/fcsepr1.png
.png
KanKan/Skin/Default/control/filmctrlbg.png
.png
KanKan/Skin/Default/control/folderctrl.png
.png
KanKan/Skin/Default/control/history.png
.png
KanKan/Skin/Default/control/history_hover.png
.png
KanKan/Skin/Default/control/layerclose.hover.png
.png
KanKan/Skin/Default/control/layerclose.png
.png
KanKan/Skin/Default/control/left.png
.png
KanKan/Skin/Default/control/left_hover.png
.png
KanKan/Skin/Default/control/list.dragover.png
.png
KanKan/Skin/Default/control/list.nor.png
.png
KanKan/Skin/Default/control/list.sel.png
.png
KanKan/Skin/Default/control/mainframe.png
.png
KanKan/Skin/Default/control/menuItem_bg_hover.png
.png
KanKan/Skin/Default/control/mover.png
.png
KanKan/Skin/Default/control/mover_hover.png
.png
KanKan/Skin/Default/control/ok.png
.png
KanKan/Skin/Default/control/panetab_bg.png
.png
KanKan/Skin/Default/control/pgbg.png
.png
KanKan/Skin/Default/control/pgface.png
.png
KanKan/Skin/Default/control/question.png
.png
KanKan/Skin/Default/control/radio_1.png
.png
KanKan/Skin/Default/control/radio_1_hover.png
.png
KanKan/Skin/Default/control/radio_2.png
.png
KanKan/Skin/Default/control/radio_2_hover.png
.png
KanKan/Skin/Default/control/right.png
.png
KanKan/Skin/Default/control/right_hover.png
.png
KanKan/Skin/Default/control/seethrough.png
.png
KanKan/Skin/Default/control/shadow.png
.png
KanKan/Skin/Default/control/sidebar_tab_active.png
.png
KanKan/Skin/Default/control/sidebar_tab_hover.png
.png
KanKan/Skin/Default/control/sidebar_tab_inactive.png
.png
KanKan/Skin/Default/control/sliderchannel.png
.png
KanKan/Skin/Default/control/sliderthumb_hover.png
.png
KanKan/Skin/Default/control/sliderthumb_nor.png
.png
KanKan/Skin/Default/control/splitter.png
.png
KanKan/Skin/Default/control/status_bar_bg.png
.png
KanKan/Skin/Default/control/tab_active.png
.png
KanKan/Skin/Default/control/tab_hover.png
.png
KanKan/Skin/Default/control/tab_normal.png
.png
KanKan/Skin/Default/control/tbut_bg_checked.png
.png
KanKan/Skin/Default/control/tbut_bg_hover.png
.png
KanKan/Skin/Default/control/tbut_bg_pressed.png
.png
KanKan/Skin/Default/control/title_bg.png
.png
KanKan/Skin/Default/control/viewdockbar_bg.png
.png
KanKan/Skin/Default/control/vschannel.png
.png
KanKan/Skin/Default/control/vsdown.hover.png
.png
KanKan/Skin/Default/control/vsdown.png
.png
KanKan/Skin/Default/control/vsdown.pressed.png
.png
KanKan/Skin/Default/control/vsthumb.hover.png
.png
KanKan/Skin/Default/control/vsthumb.png
.png
KanKan/Skin/Default/control/vsthumb.pressed.png
.png
KanKan/Skin/Default/control/vsup.hover.png
.png
KanKan/Skin/Default/control/vsup.png
.png
KanKan/Skin/Default/control/vsup.pressed.png
.png
KanKan/Skin/Default/control/warn.png
.png
KanKan/Skin/Default/control/win_close.png
.png
KanKan/Skin/Default/control/win_close_hover.png
.png
KanKan/Skin/Default/control/win_maximum.png
.png
KanKan/Skin/Default/control/win_maximum_hover.png
.png
KanKan/Skin/Default/control/win_minimize.png
.png
KanKan/Skin/Default/control/win_minimize_hover.png
.png
KanKan/Skin/Default/control/win_restore.png
.png
KanKan/Skin/Default/control/win_restore_hover.png
.png
KanKan/Skin/Default/fmt/bmp.png
.png
KanKan/Skin/Default/fmt/emf.png
.png
KanKan/Skin/Default/fmt/gif.PNG
.png
KanKan/Skin/Default/fmt/icon.png
.png
KanKan/Skin/Default/fmt/jpg.png
.png
KanKan/Skin/Default/fmt/pcx.png
.png
KanKan/Skin/Default/fmt/png.png
.png
KanKan/Skin/Default/fmt/psd.png
.png
KanKan/Skin/Default/fmt/raf.png
.png
KanKan/Skin/Default/fmt/tga.png
.png
KanKan/Skin/Default/fmt/tiff.png
.png
KanKan/Skin/Default/fmt/wmf.png
.png
KanKan/Skin/Default/plugin/adaptwin.png
.png
KanKan/Skin/Default/plugin/add.png
.png
KanKan/Skin/Default/plugin/back.png
.png
KanKan/Skin/Default/plugin/batch.png
.png
KanKan/Skin/Default/plugin/delete.png
.png
KanKan/Skin/Default/plugin/front.png
.png
KanKan/Skin/Default/plugin/max.hover.png
.png
KanKan/Skin/Default/plugin/max.png
.png
KanKan/Skin/Default/plugin/reduce.png
.png
KanKan/Skin/Default/plugin/restore.hover.png
.png
KanKan/Skin/Default/plugin/restore.png
.png
KanKan/Skin/Default/plugin/trimsize.png
.png
KanKan/Skin/Default/plugin/warn.png
.png
KanKan/Skin/Default/plugin/xiuxiu.png
.png
KanKan/Skin/Default/plugin/zoomin.png
.png
KanKan/Skin/Default/plugin/zoomout.png
.png
KanKan/Skin/Default/setting/about.png
.png
KanKan/Skin/Default/setting/opitem.hover.png
.png
KanKan/Skin/Default/setting/opitem.nor.png
.png
KanKan/Skin/Default/setting/opitem.sel.png
.png
KanKan/Skin/Default/setting/optionctrbg.png
.png
KanKan/Skin/Default/setting/sepr.png
.png
KanKan/Skin/Default/setting/sheetbg.png
.png
KanKan/Skin/Default/skin.ini
KanKan/Skin/Default/toolbar/anticlockwise.hover.png
.png
KanKan/Skin/Default/toolbar/anticlockwise.png
.png
KanKan/Skin/Default/toolbar/batchadd.hover.png
.png
KanKan/Skin/Default/toolbar/batchadd.png
.png
KanKan/Skin/Default/toolbar/deasil.hover.png
.png
KanKan/Skin/Default/toolbar/deasil.png
.png
KanKan/Skin/Default/toolbar/edit.png
.png
KanKan/Skin/Default/toolbar/film.hover.png
.png
KanKan/Skin/Default/toolbar/film.png
.png
KanKan/Skin/Default/toolbar/filmeffect.hover.png
.png
KanKan/Skin/Default/toolbar/filmeffect.png
.png
KanKan/Skin/Default/toolbar/filmexit.hover.png
.png
KanKan/Skin/Default/toolbar/filmexit.png
.png
KanKan/Skin/Default/toolbar/filmlay.hover.png
.png
KanKan/Skin/Default/toolbar/filmlay.png
.png
KanKan/Skin/Default/toolbar/folder.png
.png
KanKan/Skin/Default/toolbar/head.png
.png
KanKan/Skin/Default/toolbar/mffilm.png
.png
KanKan/Skin/Default/toolbar/moremenu.hover.png
.png
KanKan/Skin/Default/toolbar/moremenu.png
.png
KanKan/Skin/Default/toolbar/see_adaptwin.hover.png
.png
KanKan/Skin/Default/toolbar/see_adaptwin.png
.png
KanKan/Skin/Default/toolbar/see_back.hover.png
.png
KanKan/Skin/Default/toolbar/see_back.png
.png
KanKan/Skin/Default/toolbar/see_browse.hover.png
.png
KanKan/Skin/Default/toolbar/see_browse.png
.png
KanKan/Skin/Default/toolbar/see_delete.hover.png
.png
KanKan/Skin/Default/toolbar/see_delete.png
.png
KanKan/Skin/Default/toolbar/see_front.hover.png
.png
KanKan/Skin/Default/toolbar/see_front.png
.png
KanKan/Skin/Default/toolbar/see_trimsize.hover.png
.png
KanKan/Skin/Default/toolbar/see_trimsize.png
.png
KanKan/Skin/Default/toolbar/separator.png
.png
KanKan/Skin/Default/toolbar/spinner+.hover.png
.png
KanKan/Skin/Default/toolbar/spinner+.png
.png
KanKan/Skin/Default/toolbar/spinner-.hover.png
.png
KanKan/Skin/Default/toolbar/spinner-.png
.png
KanKan/Skin/Default/toolbar/spinnerbg.png
.png
KanKan/Skin/Default/toolbar/upparent.png
.png
KanKan/Skin/Default/toolbar/xiuxiu.hover.png
.png
KanKan/Skin/Default/toolbar/xiuxiu.png
.png
KanKan/Skin/Default/toolbar/zoomin.hover.png
.png
KanKan/Skin/Default/toolbar/zoomin.png
.png
KanKan/Skin/Default/toolbar/zoomout.hover.png
.png
KanKan/Skin/Default/toolbar/zoomout.png
.png
KanKan/uninst.exe.nsis
KanKan/zlib.dll
.dll windows:4 windows x86 arch:x86

e5c5650f0b0c0414d7e983aacdedc6c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crtdll

fwrite
fread
_errno
fclose
free
vsprintf
fflush
fseek
rewind
fputc
malloc
ftell
fprintf
_fdopen
fopen
sprintf
calloc
_initterm

kernel32

GlobalAlloc
GetVersion
GlobalFree

Exports

Exports

adler32
compress
compress2
crc32
deflate
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflateReset
deflateSetDictionary
get_crc_table
gzclose
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgets
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzwrite
inflate
inflateEnd
inflateInit2_
inflateInit_
inflateReset
inflateSetDictionary
inflateSync
inflateSyncPoint
uncompress
unzClose
unzCloseCurrentFile
unzGetCurrentFileInfo
unzGetGlobalComment
unzGetGlobalInfo
unzGetLocalExtrafield
unzGoToFirstFile
unzGoToNextFile
unzLocateFile
unzOpen
unzOpen2
unzOpenCurrentFile
unzOpenCurrentFile2
unzReadCurrentFile
unzStringFileNameCompare
unzeof
unztell
zError
zipClose
zipCloseFileInZip
zipCloseFileInZipRaw
zipOpen
zipOpenNewFileInZip
zipOpenNewFileInZip2
zipWriteInFileInZip
zlibVersion

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$WINDIR/msgctl.dll
.dll regsvr32 windows:4 windows x86 arch:x86

82d76e97a8c09b8d3c0b101350f716a2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
DisableThreadLibraryCalls
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
lstrlenW
MultiByteToWideChar
FlushInstructionCache
GetModuleFileNameA
FreeLibrary
LoadLibraryA
lstrcatA
lstrcmpiA
DebugBreak
GetPrivateProfileIntA
GetPrivateProfileStringA
EnterCriticalSection
OutputDebugStringA
GetCurrentThreadId
LeaveCriticalSection
CompareStringA
GetModuleHandleA
GetProcAddress
lstrcpyA
lstrcmpA
lstrcpynA
lstrlenA
GetShortPathNameA

user32

wvsprintfA
LoadImageA
InvalidateRect
SetFocus
UpdateWindow
SetRectEmpty
CallWindowProcA
CharNextA
GetParent
LoadStringA
CharLowerA
LoadCursorA
wsprintfA
RegisterClassExA
ReleaseDC
EndPaint
CreateWindowExA
DefWindowProcA
SetWindowPos
SetWindowTextA
IsWindowEnabled
DestroyWindow
GetCapture
GetSysColor
GetFocus
DrawFocusRect
FillRect
GetClassNameA
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetWindowLongA
GetWindowRect
GetCursorPos
ScreenToClient
GetClassInfoExA
SetCursor
SetWindowRgn
ReleaseCapture
PtInRect
SetCapture
GetDC
InflateRect
DrawTextA
SetTimer
SystemParametersInfoA
MoveWindow
ShowWindow
SetWindowLongA
SendMessageA
BeginPaint
KillTimer
GetClientRect
OffsetRect
CharUpperA
GetDesktopWindow
IsWindow

gdi32

CreateRoundRectRgn
CombineRgn
SetBkMode
SetTextColor
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
DeleteObject
GetStockObject
GetObjectA
CreateFontIndirectA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteA

ole32

CoCreateInstance

oleaut32

RegisterTypeLi
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysFreeString

comctl32

_TrackMouseEvent

shlwapi

PathRemoveFileSpecA
PathIsURLA
PathFileExistsA

msvcrt

memset
_vsnprintf
_purecall
??3@YAXPAX@Z
atoi
??2@YAPAXI@Z
malloc
free
realloc
memcpy
wcslen
memcmp
_mbsstr
_mbspbrk
_mbschr
sscanf
_ismbcdigit
_initterm
_adjust_fdiv

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$WINDIR/wann.ico
52hxw.exe
.exe windows:4 windows x86 arch:x86

586e2e9a63152b60d413ce559d99013b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\mitta\Desktop\公司项目\火星文软件\Release\52hxw.pdb

Imports

kernel32

GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
GetCommandLineA
TerminateProcess
ExitThread
HeapSize
SetStdHandle
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetStdHandle
HeapFree
FreeEnvironmentStringsA
HeapAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
SetUnhandledExceptionFilter
GetTimeZoneInformation
GetDriveTypeA
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
RtlUnwind
ExitProcess
InterlockedExchange
GetEnvironmentStrings
HeapReAlloc
SetErrorMode
GetFileTime
GetFileAttributesA
GetOEMCP
GetCPInfo
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
GlobalFlags
GetCurrentDirectoryA
GetProfileIntA
GetTickCount
LeaveCriticalSection
EnterCriticalSection
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
FreeResource
CreateEventA
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
GlobalAddAtomA
SetLastError
GlobalFree
GlobalSize
GetCurrentThread
GetCurrentThreadId
GlobalDeleteAtom
ConvertDefaultLocale
EnumResourceLanguagesA
GetFileSize
ReadFile
CreateThread
WaitForSingleObject
GlobalAlloc
GlobalLock
GlobalUnlock
CompareStringW
CompareStringA
lstrlenW
GetVersion
DeleteCriticalSection
InitializeCriticalSection
GetLocalTime
InterlockedDecrement
Sleep
InterlockedIncrement
DeviceIoControl
GetPrivateProfileIntA
FindFirstFileA
RemoveDirectoryA
DeleteFileA
FindNextFileA
FindClose
GetModuleHandleA
GetProcAddress
GetTempFileNameA
MoveFileExA
MulDiv
FormatMessageA
LocalFree
OutputDebugStringA
GetPrivateProfileSectionNamesA
GetLastError
RaiseException
GetPrivateProfileSectionA
WritePrivateProfileSectionA
MultiByteToWideChar
CreateFileA
SetFilePointer
WriteFile
CloseHandle
CreateDirectoryA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetModuleFileNameA
lstrcatA
GetPrivateProfileStringA
lstrlenA
lstrcpynA
lstrcmpiA
lstrcpyA
CopyFileA
lstrcmpA
WritePrivateProfileStringA
LoadLibraryA
FreeLibrary
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
UnhandledExceptionFilter

user32

DestroyMenu
EndPaint
BeginPaint
GrayStringA
DrawTextExA
TabbedTextOutA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
CheckRadioButton
CheckDlgButton
WinHelpA
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
SetFocus
IsChild
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
GetMenu
AdjustWindowRectEx
EqualRect
RegisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
IntersectRect
GetWindowPlacement
SetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
GetWindowLongA
GetLastActivePopup
GetWindow
SetWindowContextHelpId
MapDialogRect
SetMenuItemBitmaps
GetFocus
GetMenuCheckMarkDimensions
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
PeekMessageA
ValidateRect
GetMenuState
GetMenuItemID
GetMenuItemCount
PostQuitMessage
ShowScrollBar
MessageBoxA
PostMessageA
FindWindowA
ReleaseCapture
DrawFocusRect
IsRectEmpty
PtInRect
OffsetRect
LoadBitmapA
EnableMenuItem
SendMessageA
GetSystemMenu
IsIconic
CreateWindowExA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
GetParent
UnregisterClassA
CharUpperA
GetDC
UpdateLayeredWindow
RegisterWindowMessageA
GetMenuStringA
DestroyIcon
LoadImageA
BringWindowToTop
CharNextA
CopyAcceleratorTableA
InvalidateRgn
GetNextDlgGroupItem
DrawTextA
MessageBeep
TrackPopupMenu
IsCharAlphaA
AnimateWindow
IsWindow
DestroyWindow
KillTimer
SetTimer
RedrawWindow
UpdateWindow
GetDlgItem
IsWindowVisible
PostThreadMessageA
RegisterClipboardFormatA
IsWindowEnabled
SetWindowRgn
GetWindowRect
GetClientRect
ClientToScreen
SetCapture
SetForegroundWindow
EnableWindow
LoadIconA
GetSystemMetrics
RegisterHotKey
UnregisterHotKey
SystemParametersInfoA
GetDCEx
InflateRect
GetSubMenu
LoadMenuA
InvalidateRect
TrackMouseEvent
SetWindowPos
CopyRect
ReleaseDC
GetWindowDC
GetSysColor
FillRect
GetSysColorBrush
SetRect
ScreenToClient
GetCapture
GetDesktopWindow
GetClassInfoA
SetCursor
LoadCursorA
GetCursorPos
CreatePopupMenu
DeleteMenu
AppendMenuA
CheckMenuItem
ModifyMenuA
wsprintfA

gdi32

CreateRectRgnIndirect
GetTextMetricsA
GetBkColor
GetTextColor
GetRgnBox
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
CreateFontIndirectA
MoveToEx
LineTo
SetBkMode
RestoreDC
SaveDC
SetTextColor
GetClipBox
CopyMetaFileA
GetDeviceCaps
Rectangle
GetTextExtentPoint32A
EnumFontFamiliesExA
CreateSolidBrush
CreatePen
SelectObject
GetObjectA
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
SetBkColor
DeleteObject
DeleteDC
GetStockObject
BitBlt
CreateCompatibleDC
CombineRgn
CreateRoundRectRgn
CreateRectRgn
CreateCompatibleBitmap

comdlg32

GetSaveFileNameA
GetFileTitleA
GetOpenFileNameA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegOpenKeyExA
RegQueryValueExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumKeyExA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCreateKeyExA
RegCloseKey
RegSetValueExA

shell32

ShellExecuteA
SHGetSpecialFolderPathA
Shell_NotifyIconA

comctl32

ord17
InitCommonControlsEx
ImageList_Destroy

shlwapi

PathFileExistsA
PathFindExtensionA
PathUnquoteSpacesA
PathStripPathA
PathRemoveExtensionA
SHDeleteValueA
SHGetValueA
PathRemoveFileSpecA
SHSetValueA
PathRemoveArgsA
PathIsUNCA
PathStripToRootA
PathFindFileNameA
SHDeleteKeyA

oledlg

ord8

ole32

CoTaskMemAlloc
CoRegisterMessageFilter
CoUninitialize
CoInitialize
StgOpenStorage
CoCreateInstance
CLSIDFromProgID
OleInitialize
OleUninitialize
CoTaskMemFree
CoRevokeClassObject
ReleaseStgMedium
OleDuplicateData
CLSIDFromString
OleIsCurrentClipboard
OleFlushClipboard
DoDragDrop
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CreateStreamOnHGlobal
CoFreeUnusedLibraries

oleaut32

SysAllocString
SysStringLen
SysAllocStringByteLen
VariantInit
VariantClear
VariantCopy
VariantChangeType
DispCallFunc
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
SysAllocStringLen
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysFreeString
GetErrorInfo

hxw

EnableConversion

gdiplus

GdiplusStartup
GdipDrawImageI
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdiplusShutdown
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipCloneImage
GdipFree
GdipCreateFromHDC

wininet

InternetOpenA
HttpOpenRequestA
InternetConnectA
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetGetLastResponseInfoA
InternetQueryDataAvailable
InternetOpenUrlA
HttpSendRequestA
HttpQueryInfoA
InternetCloseHandle
InternetReadFile
InternetGetConnectedState

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

netapi32

Netbios

Sections

.text
Size: 296KB - Virtual size: 294KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Feedback.dll
.dll regsvr32 windows:4 windows x86 arch:x86

6f5b5480168178e32945d7e7fff86ab4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LockResource
SizeofResource
LoadResource
GlobalAlloc
GlobalFree
MulDiv
GlobalLock
GlobalUnlock
FreeResource
GetCurrentThreadId
lstrlenA
DeleteCriticalSection
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetVersionExA
InterlockedIncrement
DisableThreadLibraryCalls
OutputDebugStringA
DebugBreak
InterlockedDecrement
GetCurrentProcess
FlushInstructionCache
FindResourceA

user32

SetWindowPos
AdjustWindowRectEx
GetMenu
MapWindowPoints
GetWindow
wvsprintfA
CharNextA
LoadStringA
LoadCursorA
DialogBoxParamA
GetActiveWindow
GetSystemMetrics
DrawFocusRect
EndPaint
GetWindowLongA
SetWindowLongA
KillTimer
ClientToScreen
PtInRect
GetDlgCtrlID
GetParent
ReleaseCapture
SetCapture
CallWindowProcA
InflateRect
ScreenToClient
SetWindowRgn
OffsetRect
GetClientRect
DrawEdge
CreateWindowExA
GetCapture
SystemParametersInfoA
SetTimer
DestroyWindow
InvalidateRect
UpdateWindow
GetWindowRect
GetDlgItem
EndDialog
SetCursor
MessageBoxA
GetDlgItemTextA
FrameRect
IsWindow
DefWindowProcA
SendMessageA
BeginPaint
IsWindowEnabled

gdi32

GetDeviceCaps
SetTextColor
SetBkMode
GetStockObject
CreateRoundRectRgn
DeleteObject
CreateSolidBrush

advapi32

RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA

ole32

CoUninitialize
CoInitialize
CreateStreamOnHGlobal

oleaut32

OleLoadPicture

comctl32

ImageList_LoadImageA
_TrackMouseEvent
ImageList_Destroy
ImageList_GetIconSize
ImageList_Draw

wininet

InternetCrackUrlA
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA

msvcrt

??3@YAXPAX@Z
memset
_mbsicoll
memcpy
??2@YAPAXI@Z
wcslen
_ismbcdigit
atoi
_mbsstr
free
malloc
_adjust_fdiv
_initterm

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ShowFeedbackDialog

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1002B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FlashWordGeneral.dll
.dll windows:4 windows x86 arch:x86

7902ef2ab2bc6f616724a9c6683c70c7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LockResource
LoadResource
FindResourceA
FindResourceExA
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
lstrcatA
GetModuleFileNameA
GetLastError
SizeofResource
GetPrivateProfileStringA
WriteFile
ReadFile
CloseHandle
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
ExitProcess
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
LCMapStringW
LCMapStringA
GetCommandLineA
VirtualQuery
GetSystemInfo
SetFilePointer
lstrlenA
MultiByteToWideChar
RaiseException
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetPrivateProfileIntA
VirtualAlloc
VirtualProtect
GetStringTypeW
GetSystemTimeAsFileTime
GetStringTypeA
SetEndOfFile
LoadLibraryA
GetCPInfo
GetOEMCP
SetStdHandle
CreateFileA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RtlUnwind
VirtualFree
HeapCreate
FlushFileBuffers
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap

user32

GetDC
ReleaseDC
wvsprintfA

gdi32

GetStockObject
SelectPalette
RealizePalette
GetDIBits
GetObjectA

ole32

CoCreateInstance

oleaut32

SysFreeString
SysStringLen
SysAllocStringLen

atl71

ord61
ord23
ord64

shlwapi

PathRemoveFileSpecA

gdiplus

GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipCloneBrush
GdipCreateFont
GdipDrawString
GdipFillRectangleI
GdipSetTextRenderingHint
GdipGetImageGraphicsContext
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteGraphics
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteBrush
GdipFree
GdipAlloc

Exports

Exports

??0CxFile@@QAE@ABV0@@Z
??0CxFile@@QAE@XZ
??0CxIOFile@@QAE@ABV0@@Z
??0CxIOFile@@QAE@PAU_iobuf@@@Z
??1CxFile@@UAE@XZ
??1CxIOFile@@UAE@XZ
??4CxFile@@QAEAAV0@ABV0@@Z
??4CxIOFile@@QAEAAV0@ABV0@@Z
??_7CxFile@@6B@
??_7CxIOFile@@6B@
??_FCxIOFile@@QAEXXZ
?Close@CxIOFile@@UAE_NXZ
?Eof@CxIOFile@@UAE_NXZ
?Error@CxIOFile@@UAEJXZ
?Flush@CxIOFile@@UAE_NXZ
?GetC@CxIOFile@@UAEJXZ
?GetS@CxIOFile@@UAEPADPADH@Z
?Open@CxIOFile@@QAE_NPBD0@Z
?PutC@CxFile@@UAE_NE@Z
?PutC@CxIOFile@@UAE_NE@Z
?Read@CxIOFile@@UAEIPAXII@Z
?Scanf@CxIOFile@@UAEJPBDPAX@Z
?Seek@CxIOFile@@UAE_NJH@Z
?Size@CxIOFile@@UAEJXZ
?Tell@CxIOFile@@UAEJXZ
?Write@CxIOFile@@UAEIPBXII@Z
FlashWord

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
HttpDownLoad.exe
.exe windows:4 windows x86 arch:x86

04ed8bf66faba42abf3761e8da86bc42

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord860
ord540
ord350
ord354
ord825
ord1105
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord3626
ord641
ord609
ord795
ord765
ord2414
ord6215
ord2086
ord2621
ord1134
ord5265
ord4853
ord4998
ord4710
ord2514
ord535
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord4234
ord3698
ord2575
ord4396
ord3574
ord6055
ord1776
ord5290
ord3402
ord3721
ord3571
ord823
ord1146
ord1168
ord567
ord2302
ord2379
ord755
ord470
ord3092
ord5953
ord4224
ord2645
ord858
ord6199
ord1641
ord939
ord2818
ord941
ord537
ord940
ord5710
ord5683
ord6453
ord5186
ord800
ord665
ord3810
ord920
ord6385
ord1979
ord3663
ord3616
ord3127
ord6052
ord5651
ord1576

msvcrt

__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_mbscmp
vsprintf
_ftol
__CxxFrameHandler
atol
_setmbcp
_initterm

kernel32

WaitForSingleObject
CreateProcessA
lstrlenA
DeleteFileA
GetPrivateProfileSectionNamesA
GetModuleFileNameA
GetPrivateProfileStringA
lstrcpynA
GetModuleHandleA
GetStartupInfoA
GetLastError

user32

IsIconic
ShowWindow
LoadImageA
GetSystemMetrics
EnableWindow
GetClientRect
SetDlgItemTextA
DrawIcon
PostMessageA
LoadIconA
IsWindowVisible
SendMessageA

shell32

Shell_NotifyIconA
ShellExecuteA

wininet

InternetOpenA
HttpQueryInfoA
InternetReadFile
InternetOpenUrlA
InternetCloseHandle

shlwapi

PathRemoveFileSpecA

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Message.dll
.dll regsvr32 windows:4 windows x86 arch:x86

10ad169f55307776d7ced68ee453178a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetPrivateProfileSectionNamesA
DisableThreadLibraryCalls
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
DeleteCriticalSection
MultiByteToWideChar
GlobalUnlock
GlobalLock
GlobalAlloc
DeleteFileA
lstrlenW
GetCurrentThreadId
lstrcmpA
FlushInstructionCache
GetCurrentProcess
GetTickCount
WideCharToMultiByte
lstrcatA
GetModuleFileNameA
DebugBreak
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetLocalTime
GetPrivateProfileStringA
lstrcmpiA
GetPrivateProfileIntA
CreateFileA
lstrlenA
WriteFile
CloseHandle
CreateThread

user32

PostQuitMessage
wsprintfA
GetClassNameA
CreateWindowExA
GetDlgItem
SendMessageA
DestroyWindow
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
CreateAcceleratorTableA
GetParent
KillTimer
GetDesktopWindow
wvsprintfA
CharNextA
LoadStringA
RegisterClassExA
LoadCursorA
GetClassInfoExA
RegisterWindowMessageA
DefWindowProcA
GetWindow
SetWindowLongA
SetWindowTextA
SetTimer
ShowWindow
MessageBoxA
PostMessageA
CharLowerA
DispatchMessageA
SystemParametersInfoA
GetWindowRect
OffsetRect
AnimateWindow
GetMessageA
TranslateMessage
GetDC
GetWindowTextA
GetWindowTextLengthA
GetWindowLongA
IsWindow
GetSysColor
SetFocus
IsChild
GetFocus
CallWindowProcA
EndPaint
ReleaseDC
RedrawWindow
SetWindowPos
BeginPaint
GetClientRect
FillRect
SetWindowRgn

gdi32

CreateRoundRectRgn
CombineRgn
GetStockObject
GetObjectA
GetDeviceCaps
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC

advapi32

RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey

ole32

CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
OleLockRunning

oleaut32

LoadRegTypeLi
SysAllocString
VariantClear
SysAllocStringLen
SysStringLen
DispCallFunc
OleCreateFontIndirect
SysFreeString

shlwapi

PathIsURLA
PathRemoveFileSpecA
SHSetValueA
SHGetValueA

wininet

InternetOpenUrlA
InternetReadFile
InternetOpenA
HttpQueryInfoA
InternetCloseHandle

msvcrt

time
_mbscmp
difftime
abs
??3@YAXPAX@Z
__CxxFrameHandler
atoi
memset
_vsnprintf
_ftol
memcpy
??2@YAPAXI@Z
_mbsstr
wcslen
_ismbcdigit
realloc
free
memcmp
_mbschr
atol
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
malloc
_adjust_fdiv
_initterm

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SoftUpdate.dll
.dll windows:4 windows x86 arch:x86

7a1ecdc0d45651cd7d33a946c9103a57

Code Sign

5f:d2:26:25:cb:3f:82:5b:d0:72:62:43:f1:7f:19:ef
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

24/12/2008, 00:00

Not After

24/12/2009, 23:59

Subject

CN=厦门网之源信息科技有限公司,O=厦门网之源信息科技有限公司,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\项目\自动升级系统\SoftUpdate\Release\SoftUpdate.pdb

Imports

kernel32

CreateFileA
lstrcatA
lstrcpyA
GetModuleFileNameA
lstrcpynA
MultiByteToWideChar
WideCharToMultiByte
RaiseException
GetLastError
InitializeCriticalSection
DeleteCriticalSection
lstrlenA
WriteFile
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
WritePrivateProfileStringA
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
MoveFileA
MoveFileExA
DeleteFileA
CreateDirectoryA
GetShortPathNameA
FlushFileBuffers
SetStdHandle
SetFilePointer
CloseHandle
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
LoadLibraryA
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
ExitProcess
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCurrentThreadId
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
HeapCreate
VirtualFree
IsBadWritePtr
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GetOEMCP
GetCPInfo
LCMapStringA
LCMapStringW
SetHandleCount

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegEnumKeyExA
RegCloseKey
RegSetValueExA

shell32

ShellExecuteA

shlwapi

PathRemoveFileSpecA
SHDeleteKeyA

wininet

InternetReadFile
InternetCloseHandle
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetOpenUrlA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Exports

Exports

GetPEFileVersion
RebootUpdate
SetReplaceFileMode
Update
UpdateEx

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Uninstall.dll
.dll windows:4 windows x86 arch:x86

c99f1cdce31bccdd41ab23762c76a41c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpynA

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
atol
free
_initterm
malloc
_adjust_fdiv

wininet

InternetOpenUrlA
HttpQueryInfoA
InternetReadFile
InternetOpenA
InternetCloseHandle

Exports

Exports

Uninstall

Sections

.text
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 538B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
atl71.dll
.dll windows:4 windows x86 arch:x86

7c3004ebf21f282412fa952c164aa2bb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

atl71.pdb

Imports

kernel32

InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
lstrlenW
lstrcpyW
GetLastError
DisableThreadLibraryCalls
GetVersionExA
InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrcmpiW
lstrcpynW
CloseHandle
ReadFile
GetFileSize
CreateFileW
GetModuleHandleW
GetModuleFileNameW
WideCharToMultiByte
HeapFree
GetProcessHeap
WaitForSingleObject
GlobalAlloc
FindResourceA
MulDiv
lstrcatW
HeapAlloc
FlushInstructionCache
GetCurrentProcess
GlobalUnlock
GlobalLock
lstrcmpW
SetLastError
GlobalFree
GlobalHandle
LockResource
lstrcmpA
GetModuleHandleA
GetTickCount
GetProcAddress
ExitProcess
HeapSize
DebugBreak
HeapReAlloc
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
lstrcatA
lstrcpyA
lstrlenA
GetModuleFileNameA
RtlUnwind
VirtualQuery
LocalAlloc
LoadLibraryA

shlwapi

PathFindExtensionW

Exports

Exports

AtlAdvise
AtlAxAttachControl
AtlAxCreateControl
AtlAxCreateControlEx
AtlAxCreateControlLic
AtlAxCreateControlLicEx
AtlAxCreateDialogA
AtlAxCreateDialogW
AtlAxDialogBoxA
AtlAxDialogBoxW
AtlAxGetControl
AtlAxGetHost
AtlAxWinInit
AtlCallTermFunc
AtlComModuleGetClassObject
AtlComModuleRegisterClassObjects
AtlComModuleRegisterServer
AtlComModuleRevokeClassObjects
AtlComModuleUnregisterServer
AtlComPtrAssign
AtlComQIPtrAssign
AtlCreateRegistrar
AtlCreateTargetDC
AtlDevModeW2A
AtlFreeMarshalStream
AtlGetObjectSourceInterface
AtlGetVersion
AtlHiMetricToPixel
AtlIPersistPropertyBag_Load
AtlIPersistPropertyBag_Save
AtlIPersistStreamInit_Load
AtlIPersistStreamInit_Save
AtlInternalQueryInterface
AtlLoadTypeLib
AtlMarshalPtrInProc
AtlModuleAddTermFunc
AtlPixelToHiMetric
AtlRegisterClassCategoriesHelper
AtlRegisterTypeLib
AtlSetErrorInfo
AtlUnRegisterTypeLib
AtlUnadvise
AtlUnmarshalPtr
AtlUpdateRegistryFromResourceD
AtlWaitWithMessageLoop
AtlWinModuleAddCreateWndData
AtlWinModuleExtractCreateWndData
AtlWinModuleInit
AtlWinModuleRegisterClassExA
AtlWinModuleRegisterClassExW
AtlWinModuleRegisterWndClassInfoA
AtlWinModuleRegisterWndClassInfoW
AtlWinModuleTerm

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bk.bmp
fh.dat
fh_tj.html
.html .vbs polyglot
filter.dat
flash.ini
ft.bin
html/help.html
.html
html/hxw.js
.js
html/hxw_ui.css
html/images/bg_00.gif
.gif
html/images/bg_01.gif
.gif
html/images/bg_02.gif
.gif
html/images/bg_03.gif
.gif
html/images/bg_04.gif
.gif
html/images/bg_05.gif
.gif
html/images/bg_06.gif
.gif
html/images/bg_07.gif
.gif
html/images/bg_08.gif
.gif
html/images/bg_09.gif
.gif
html/images/bg_10.gif
.gif
html/images/button_bg_01.gif
.gif
html/images/button_bg_02.gif
.gif
html/images/button_bg_03.gif
.gif
html/images/button_bg_04.gif
.gif
html/images/button_tool_01_a.gif
.gif
html/images/button_tool_01_b.gif
.gif
html/images/button_tool_02_a.gif
.gif
html/images/button_tool_02_b.gif
.gif
html/images/button_tool_03_a.gif
.gif
html/images/button_tool_03_b.gif
.gif
html/images/button_tool_04_a.gif
.gif
html/images/button_tool_04_b.gif
.gif
html/images/button_tool_more.gif
.gif
html/images/greyline.gif
.gif
html/images/ico_arrow_01.gif
.gif
html/images/ico_arrow_02.gif
.gif
html/images/ico_bbs_01.gif
.gif
html/images/ico_feedback.gif
.gif
html/images/ico_help_a.gif
.gif
html/images/ico_help_b.gif
.gif
html/images/ico_home.gif
.gif
html/images/ico_light.gif
.gif
html/images/ico_settings_a.gif
.gif
html/images/ico_settings_b.gif
.gif
html/images/ico_tool_a.gif
.gif
html/images/ico_tool_b.gif
.gif
html/images/ico_update.gif
.gif
html/images/logo_hxw.gif
.gif
html/images/pic_question.jpg
.jpg
html/main.html
.html
html/tool_01.html
.html .js polyglot
html/tool_02.html
.html .js polyglot
html/tool_03.html
.html .js polyglot
html/tool_04.html
.html .js polyglot
hxw.bin
hxw.dll
.dll windows:4 windows x86 arch:x86

9ca78f69dad8f44090dc1a2e4a67739e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatA
lstrcpyA
GetPrivateProfileSectionA
lstrcmpA
MultiByteToWideChar
GetPrivateProfileStringA
WideCharToMultiByte
FreeLibrary
DeleteFileA
GetTempFileNameA
WritePrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileSectionA
lstrlenW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
FlushFileBuffers
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
Sleep
SetStdHandle
SetConsoleCtrlHandler
GetOEMCP
GetCurrentThreadId
GetCPInfo
InterlockedIncrement
InterlockedDecrement
UnhandledExceptionFilter
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
SetUnhandledExceptionFilter
HeapSize
LocalAlloc
LocalLock
LocalUnlock
GlobalSize
GetFileSize
ReadFile
GlobalReAlloc
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcpynA
FormatMessageA
LocalFree
CreateFileA
SetFilePointer
lstrlenA
WriteFile
CloseHandle
GetModuleHandleA
OutputDebugStringA
GetProcessHeap
HeapAlloc
HeapFree
VirtualProtect
GetModuleFileNameA
GetLastError
FlushInstructionCache
VirtualQuery
lstrcmpiA
GetCurrentProcess
WriteProcessMemory
CreateToolhelp32Snapshot
Module32First
Module32Next
GetProcAddress
LoadLibraryExW
LoadLibraryExA
TerminateProcess
FatalAppExitA
ExitProcess
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetCurrentThread
LoadLibraryW
LoadLibraryA
GetACP
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetVersion
GetCommandLineA
RaiseException
HeapReAlloc
GetLocalTime
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocaleInfoW

user32

SetCursor
GetDC
LoadCursorA
ReleaseDC
RegisterWindowMessageA
SendMessageTimeoutA
IsRectEmpty
GetWindowRect
ClientToScreen
GetClientRect
ScreenToClient
FindWindowA
CallNextHookEx
CallWindowProcA
IsCharAlphaNumericA
CallWindowProcW
IsWindow
IsWindowUnicode
GetWindowLongW
SetWindowLongW
GetWindowLongA
SetWindowLongA
MessageBoxA
keybd_event
GetClassNameA
RegisterClipboardFormatA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetWindowsHookExA
UnhookWindowsHookEx
GetFocus

gdi32

CreateHalftonePalette
GetDIBits
GetObjectA
CreatePen
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
SetBkColor
GetNearestPaletteIndex
SetSystemPaletteUse
ResizePalette
SetPaletteEntries
CreateSolidBrush
Rectangle
StretchDIBits
CreateDCA
CreateCompatibleBitmap
GetDIBColorTable
GetPaletteEntries
CreateDIBSection
CreateCompatibleDC
SelectObject
SetDIBColorTable
SetStretchBltMode
StretchBlt
BitBlt
DeleteDC
GdiFlush
DeleteObject
GetStockObject
SelectPalette
RealizePalette
CreateDIBitmap
GetDeviceCaps
GetSystemPaletteEntries
CreatePalette

ole32

CoInitialize
StgCreateDocfile
CoUninitialize
CreateStreamOnHGlobal
StgOpenStorage

oleaut32

SysFreeString
OleLoadPicture
SysAllocStringLen

shlwapi

PathFindFileNameA
SHGetValueA
PathFileExistsA
PathRemoveFileSpecA

imm32

ImmGetCompositionStringW
ImmGetCompositionStringA

imagehlp

ImageDirectoryEntryToData

oleacc

ObjectFromLresult

winmm

timeGetTime

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Exports

Exports

EnableConversion

Sections

.text
Size: 108KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sdata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
hxw_old.bin
messageconfig.ini
msgSkin.ini
msgctl.dll
.dll regsvr32 windows:4 windows x86 arch:x86

82d76e97a8c09b8d3c0b101350f716a2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
DisableThreadLibraryCalls
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
lstrlenW
MultiByteToWideChar
FlushInstructionCache
GetModuleFileNameA
FreeLibrary
LoadLibraryA
lstrcatA
lstrcmpiA
DebugBreak
GetPrivateProfileIntA
GetPrivateProfileStringA
EnterCriticalSection
OutputDebugStringA
GetCurrentThreadId
LeaveCriticalSection
CompareStringA
GetModuleHandleA
GetProcAddress
lstrcpyA
lstrcmpA
lstrcpynA
lstrlenA
GetShortPathNameA

user32

wvsprintfA
LoadImageA
InvalidateRect
SetFocus
UpdateWindow
SetRectEmpty
CallWindowProcA
CharNextA
GetParent
LoadStringA
CharLowerA
LoadCursorA
wsprintfA
RegisterClassExA
ReleaseDC
EndPaint
CreateWindowExA
DefWindowProcA
SetWindowPos
SetWindowTextA
IsWindowEnabled
DestroyWindow
GetCapture
GetSysColor
GetFocus
DrawFocusRect
FillRect
GetClassNameA
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetWindowLongA
GetWindowRect
GetCursorPos
ScreenToClient
GetClassInfoExA
SetCursor
SetWindowRgn
ReleaseCapture
PtInRect
SetCapture
GetDC
InflateRect
DrawTextA
SetTimer
SystemParametersInfoA
MoveWindow
ShowWindow
SetWindowLongA
SendMessageA
BeginPaint
KillTimer
GetClientRect
OffsetRect
CharUpperA
GetDesktopWindow
IsWindow

gdi32

CreateRoundRectRgn
CombineRgn
SetBkMode
SetTextColor
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
DeleteObject
GetStockObject
GetObjectA
CreateFontIndirectA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteA

ole32

CoCreateInstance

oleaut32

RegisterTypeLi
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysFreeString

comctl32

_TrackMouseEvent

shlwapi

PathRemoveFileSpecA
PathIsURLA
PathFileExistsA

msvcrt

memset
_vsnprintf
_purecall
??3@YAXPAX@Z
atoi
??2@YAPAXI@Z
malloc
free
realloc
memcpy
wcslen
memcmp
_mbsstr
_mbspbrk
_mbschr
sscanf
_ismbcdigit
_initterm
_adjust_fdiv

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pf.ini
skins/HELLO KITTY.hxws
skins/ĬƤ.hxws
skins/ȫ.hxws
skins/ɫ.hxws
skins/ʥ.hxws
skins/ˮƿ.hxws
skins/ϲ.hxws
skins/Ԫ.hxws
skins/.hxws
skins/.hxws
skins/ں.hxws
skins/С.hxws
skins/чӭ.hxws
skins/̫.hxws
skins/ţ.hxws
skins/з.hxws
skins/.hxws
skins/Ϸ籭.hxws
skins/.hxws
skins/.hxws
skins/.hxws
th.exe
.exe windows:4 windows x86 arch:x86

12b5598c39f5e57d5b1b7d20d90fb178

Code Sign

5f:d2:26:25:cb:3f:82:5b:d0:72:62:43:f1:7f:19:ef
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

24/12/2008, 00:00

Not After

24/12/2009, 23:59

Subject

CN=厦门网之源信息科技有限公司,O=厦门网之源信息科技有限公司,L=xiamen,ST=fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringA
CloseHandle
WriteFile
lstrlenA
SetFilePointer
LocalFree
FormatMessageA
GetLastError
DeleteFileA
GetPrivateProfileSectionNamesA
Sleep
lstrcatA
GetModuleFileNameA
MoveFileA
GetPrivateProfileIntA
GetPrivateProfileStringA
MoveFileExA
GetTempFileNameA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetStdHandle
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
FlushFileBuffers

user32

PostMessageA
FindWindowA

shell32

ShellExecuteA

shlwapi

PathRemoveFileSpecA
PathFileExistsA

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
uninst.exe.nsis
新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

14:b3:be:a8:9d:64:8e:0d:36:19:5d:2a:76:5a:9c:6bCertificate

Extended Key Usages

ad:80:65:62:aa:84:02:b4:c6:59:88:49:4a:94:3a:f1:5f:53:b5:fdSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 56KB

.rsrc Size: 30KB - Virtual size: 29KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

7c3004ebf21f282412fa952c164aa2bb

Headers

File Characteristics

PDB Paths

Imports

kernel32

shlwapi

Exports

Exports

Sections

.text Size: 51KB - Virtual size: 50KB

.rdata Size: 14KB - Virtual size: 13KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

14:b3:be:a8:9d:64:8e:0d:36:19:5d:2a:76:5a:9c:6b
Certificate

ad:80:65:62:aa:84:02:b4:c6:59:88:49:4a:94:3a:f1:5f:53:b5:fd
Signer

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 56KB

.rsrc
Size: 30KB - Virtual size: 29KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 51KB - Virtual size: 50KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 5KB - Virtual size: 5KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

14:b3:be:a8:9d:64:8e:0d:36:19:5d:2a:76:5a:9c:6b
Certificate

85:8b:76:9b:5d:9c:fe:49:da:0f:1d:db:f9:c2:4d:67:65:61:be:e8
Signer

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 44KB

.rsrc
Size: 27KB - Virtual size: 26KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 1012B

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 2KB