9a1459707abbac87b8b95ebdd65e9028
- SHA256 5ea85ac874b09f5b8d48f1490926fa2997ea570a6c62ecdd901f883dd24dc792
Overview
overview
7Static
static
7BException.dll
windows7-x64
7BException.dll
windows10-2004-x64
7NTPerf.dll
windows7-x64
1NTPerf.dll
windows10-2004-x64
1PSAPI.dll
windows7-x64
1PSAPI.dll
windows10-2004-x64
1SpeederXP.chm
windows7-x64
1SpeederXP.chm
windows10-2004-x64
1WinIo.dll
windows7-x64
1WinIo.dll
windows10-2004-x64
1WinIo.dll
windows7-x64
1WinIo.dll
windows10-2004-x64
1cooper.dll
windows7-x64
1cooper.dll
windows10-2004-x64
1hook.dll
windows7-x64
3hook.dll
windows10-2004-x64
3inproc.dll
windows7-x64
1inproc.dll
windows10-2004-x64
1qmsd.dll
windows7-x64
1qmsd.dll
windows10-2004-x64
1skin/defau...r1.exe
windows7-x64
1skin/defau...r1.exe
windows10-2004-x64
1skin/defau...��.exe
windows7-x64
1skin/defau...��.exe
windows10-2004-x64
1unins000.exe
windows7-x64
7unins000.exe
windows10-2004-x64
7变速精�...mp.exe
windows7-x64
5变速精�...mp.exe
windows10-2004-x64
5所有小�...��.url
windows7-x64
1所有小�...��.url
windows10-2004-x64
1Behavioral task
behavioral1
Sample
BException.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
BException.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
NTPerf.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
NTPerf.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
PSAPI.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
PSAPI.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
SpeederXP.chm
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
SpeederXP.chm
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
WinIo.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
WinIo.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
WinIo.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
WinIo.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
cooper.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
cooper.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
hook.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
hook.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
inproc.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
inproc.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
qmsd.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
qmsd.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
skin/default/SkinEditor1.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
skin/default/SkinEditor1.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
skin/default/皮肤制作工具.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
skin/default/皮肤制作工具.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
unins000.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
unins000.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
变速精灵VIP版.vmp.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral28
Sample
变速精灵VIP版.vmp.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral29
Sample
所有小软件列表！.url
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
所有小软件列表！.url
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 9a1459707abbac87b8b95ebdd65e9028
- Size 1.0MB
- Sample240213-2ffg2aae9z
- SHA256 5ea85ac874b09f5b8d48f1490926fa2997ea570a6c62ecdd901f883dd24dc792
- MD5 9a1459707abbac87b8b95ebdd65e9028
- SHA1 84bb0fcf17c7c1605a8858a27dbbce27f550a0cf
- SHA512 ab029c94e9192e300e1dd71316ccae244a94c7312d67862fcef269ebb7579f4d1d8780302cabc8a10e727671f097f83745ba8ab53605c5599ec86475b69ee2e2
- SSDEEP 24576:IaPcwHwE0nUX+uMW24V1rdirL7aAEhkZ1Jc5Oe5qL5iQu:If68UX+uXirKAEW125F5/
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/BException.dll acprotect static1/unpack001/WinIo.dll acprotect static1/unpack001/cooper.dll acprotect -
resource yara_rule static1/unpack001/BException.dll upx - Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/BException.dll unpack002/out.upx unpack001/WinIo.dll unpack001/WinIo.sys unpack001/cooper.dll unpack001/skin/default/SkinEditor1.exe unpack001/skin/default/皮肤制作工具.exe unpack001/unins000.exe unpack001/变速精灵VIP版.vmp.exe
File Explorer
-
9a1459707abbac87b8b95ebdd65e9028.rar 1.0MB
-
BException.dll.dll 7KB
-
out.upx.dll 28KB
-
NTPerf.dll.dll 29KB
-
PSAPI.DLL.dll 23KB
-
SpeederXP.chm.chm 133KB
-
WinIo.dll.dll 12KB
-
WinIo.sys.dll 17KB
-
WinIo.vxd5KB
-
cooper.dll.dll 70KB
-
hook.dll.dll 61KB
-
inproc.dll.dll 53KB
-
logo.gif.gif 3KB
-
oem_sp.dat21B
-
qmsd.sys.dll 40KB
-
skin/default/SkinEditor1.exe.exe 110KB
-
skin/default/clock.gif.gif 2KB
-
skin/default/clock1.gif.gif 16KB
-
skin/default/down.bmp333KB
-
skin/default/main.bmp333KB
-
skin/default/mask.bmp14KB
-
skin/default/over.bmp333KB
-
skin/default/skin.ini871B
-
skin/default/trackmove.bmp1KB
-
skin/default/trackstop.bmp1KB
-
skin/default/皮肤制作工具.exe.exe 110KB
-
speeder.ini896B
-
tips.txt474B
-
unins000.dat4KB
-
unins000.exe.exe 655KB
-
version.ini25B
-
whatsnew.txt2KB
-
变速精灵VIP版.vmp.exe.exe 944KB
-
所有小软件列表！.url.url 267B
-
说明.txt738B
BException.dll
- SHA256 7c6323205b69d6c3f95e1989dac6f7cf4a4aa66625a6b626085caa71372dedf8
- MD5 00a9f8cc6fb5766e2b303e129d3ca96a
- SHA1 52cd862b2c88b90b357fbece693a6d19cff656a7
- SHA512 bef2606d181b0513157d5cdd8855ff6155f1c23b3e9c0d8b67a1f55238f471764a727dcde4e237d5c1da0dcd977cb2f1e91634c592806f02f164757280f07f07
- SSDEEP 96:91zQ9iVDjkH0/s68dwJnAc7Tbuxuwb3fmqPQbAHoAxVmTzUuNTnT:9RQefG0/s61JAcTburJIRTzUQT
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
SetExceptionReport
SetSoftwareName
Name
UPX0
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=4, id=19, version=8034,
count=1, id=14, version=7299,
count=4, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=134, id=1, productName=Unmarked objects,
count=7, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=6, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
out.upx
- SHA256 f41f345f02bf8f13f574f7b002c10d8fd681d6aec60aae9a70ab82b755bd1970
- MD5 54ead4aeb9b7a087fa734ac896243b6b
- SHA1 916807061fc54837ba08940477346f1bcbdc1561
- SHA512 5ad2113046aa104a1318c1ba2328844faf502ef5b6ca529180eb097c40e87fb91402d3384b1f96d6dedb777626d8be8f9848b2c9a851c8120469bd5b74f64651
- SSDEEP 192:9UL7mmk9LUddHiT22AwauxHHcBBiJQZxT:e2mk4Hf2AwauJcPyCx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8331
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
898B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=19, version=8034,
count=1, id=14, version=7299,
count=4, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=134, id=1, productName=Unmarked objects,
count=7, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=6, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
NTPerf.dll
- IMPHASH 7571cb143055b7eff1b9a2cadc69d87e
- SHA256 c5a9d9e945cb6a3fb924ce4544021db1ed8e64115eb2df07f35ceebeaeba89a7
- MD5 3ef2826c29ec2c0933987d2dadb50389
- SHA1 35ce1d65370f1eac82bb12e9c1452752315a46ab
- SHA512 dde01a863adfd14f9d411dac86b4602f4075261d84db966bc11bdda8860ba92d8dc52f83fe71e3edaee7c08a02defb9e53008c8470d57439b5e8b5066f73439c
- SSDEEP 192:0R95/lXOd04Al2G2HuDNcXsy1PxO4SLvYivihh8iEqnN8+V:Et+el2G2Oxccy1ZOLLvYivcos8+V
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Serial Number
42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning, ExtKeyUsageClientAuth
Timespan
Apr 25, 2007 - Jul 9, 2019
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Jul 9, 1999 - Jul 9, 2019
Subject
CN=Fuzhou TianxiaChuangshi Digital Co.\,Ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Fuzhou TianxiaChuangshi Digital Co.\,Ltd.,L=Fuzhou,ST=Fujian,C=CN
Serial Number
03:b3:e8:07:89:fe:e6:ab:e9:3d:d9:72:81:7e:53:f8
Issuer
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
Jan 13, 2010 - Jan 13, 2011
Subject
CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US
Serial Number
43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 30, 2007 - Apr 29, 2012
Minor OS version
0
Major OS version
4
Entry point
7179
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
pdh
PdhGetRawCounterValue
PdhGetFormattedCounterValue
PdhCollectQueryData
PdhAddCounterA
PdhCloseQuery
PdhOpenQueryA
mfc42
ord1168
ord1577
ord1182
ord342
ord1243
ord1197
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3953
ord2982
ord3147
ord3259
ord4465
ord1575
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord1116
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord6467
ord3663
ord823
ord5440
ord6383
ord5450
ord6394
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord1176
ord3136
ord4080
msvcrt
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
__CxxFrameHandler
kernel32
LocalFree
LocalAlloc
GetCPU_NT
NTPerf_Initialize
NTPerf_Uninitialize
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=11, version=8047,
count=2, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=4, version=9782,
count=81, id=1, productName=Unmarked objects,
count=5, id=93, version=2179,
count=6, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
PSAPI.DLL
- IMPHASH 3b5b4bad881057af15fc35648ebcf206
- SHA256 8b71453190acdb402604bded4a9fa3a9df2443d52a45f0a1c7022d7a21808ec8
- MD5 b35897da879180f4a377ad6efb93bc5e
- SHA1 c46483917708b0524adce3fc84c9fe21ce45d038
- SHA512 035be82ce39c4cb9b81adc37d7b6e9eff7bdbe6b56aeeda91204d54a9fcb3ef5df733d09885ddd027ba46bab953b1d85e328a10a187992191b62a2ee1e2a1c93
- SSDEEP 384:21ncyubrbVlgocG1FAt7PyrdORoGDrbgL5ZWZkYWOLOLLvYivcos4+f6:2OyyvVlV1FAt7PsdODbgLpnLHvs4+y
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Serial Number
42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning, ExtKeyUsageClientAuth
Timespan
Apr 25, 2007 - Jul 9, 2019
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Jul 9, 1999 - Jul 9, 2019
Subject
CN=Fuzhou TianxiaChuangshi Digital Co.\,Ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Fuzhou TianxiaChuangshi Digital Co.\,Ltd.,L=Fuzhou,ST=Fujian,C=CN
Serial Number
03:b3:e8:07:89:fe:e6:ab:e9:3d:d9:72:81:7e:53:f8
Issuer
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
Jan 13, 2010 - Jan 13, 2011
Subject
CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US
Serial Number
43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 30, 2007 - Apr 29, 2012
Minor OS version
0
Major OS version
4
Entry point
10295
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
ntdll
NtAllocateVirtualMemory
RtlNtStatusToDosError
_stricmp
RtlUnwind
atoi
_chkstk
NtStopProfile
sprintf
RtlMultiByteToUnicodeN
RtlAdjustPrivilege
RtlUnicodeToOemN
NtCreateProfile
NtSetIntervalProfile
NtStartProfile
DbgPrint
NtWriteFile
NtSetInformationProcess
NtQueryInformationProcess
NtQueryVirtualMemory
NtQuerySystemInformation
kernel32
MultiByteToWideChar
GetProcessWorkingSetSize
WideCharToMultiByte
ReadProcessMemory
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
CreateFileA
CloseHandle
DisableThreadLibraryCalls
lstrcpyA
GetProcessHeap
LocalFree
SetLastError
LocalAlloc
SetProcessWorkingSetSize
lstrlenA
GetSystemInfo
HeapAlloc
imagehlp
SymLoadModule
SymGetModuleInfo
SymGetSymFromAddr
SymUnloadModule
SymSetOptions
SymInitialize
SymGetSearchPath
EmptyWorkingSet
EnumDeviceDrivers
EnumProcessModules
EnumProcesses
GetDeviceDriverBaseNameA
GetDeviceDriverBaseNameW
GetDeviceDriverFileNameA
GetDeviceDriverFileNameW
GetMappedFileNameA
GetMappedFileNameW
GetModuleBaseNameA
GetModuleBaseNameW
GetModuleFileNameExA
GetModuleFileNameExW
GetModuleInformation
GetProcessMemoryInfo
GetWsChanges
InitializeProcessForWsWatch
QueryWorkingSet
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
914B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
SpeederXP.chm
- SHA256 0fa315495940fef433c72acedf5b45c4a0ae2678fcadb218807654d3fff6a090
- MD5 625b7c74f73b4d550663fc03911b7bbb
- SHA1 d2fdb55ac6affc11f81fcb8d440c7b11922bfd52
- SHA512 e98f90ae108950a3977e422e8da2002d8fe3f08ab8c90346a25e6defc8cfa25ad9b8afa780cb2ad4e6e29ce517aa4f36e977dac73c946797c5cc18f3cd512ced
- SSDEEP 3072:KRtkfrGnfF5XBp9EpGUPw5+SCzW5UQJstcxiaooOYHT/UW1ML:KRCfr2NRboS5+SCqCqxwyDML
- MD5 SHA1 SHA512 SSDEEP
WinIo.dll
- SHA256 e2f3e20bbb6379bf04028d69c5d250d8d01d7c7714cbe6e24132a0ddd2db15c4
- MD5 194062d46bbbb73aac4207507b330a35
- SHA1 7dc3fbbacd4d66415b9b1b21860a3a9d0e31710b
- SHA512 3f6e58ef02f41245ffbc67196a981e6641a7629f1815c1137c6fe06a5f8a5aa26db6eee520921739700f8e4ba162c7aa555529e60bfaefb7b7c88c118c90b84b
- SSDEEP 192:t2RLjWzDNeEsrpGRIZKCVp6TzNjRz1ivxEpiEq:tYjWz+uMlVwnP1xi
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42224
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
GetPhysLong
GetPortVal
InitializeWinIo
InstallWinIoDriver
MapPhysToLin
RemoveWinIoDriver
SetPhysLong
SetPortVal
ShutdownWinIo
UnmapPhysicalMemory
Name
CODE
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DATA
Size
10KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=10, id=14, version=7299,
count=5, id=19, version=8034,
count=61, id=1, productName=Unmarked objects,
count=24, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=5, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
WinIo.sys
- IMPHASH 5d021bf7b510ffc70bc03c557e8d5130
- SHA256 5139f9de85e3c40286bfad5b90a169385b75f8f8a372b4411033b89c038e9ee6
- MD5 ea563fc36c0bb1fa29bc64a5702a8378
- SHA1 30d18109d4f997329d4ce02c6bbdd3ed5bef4e99
- SHA512 087b17963e14c1bc66454e9c66d0ec3b1f56e2fa448c9d12f3dc43679dd540bb11e73c1f5ce31305bbe978de496863ab9cf9170122d486f19bbad227d6295586
- SSDEEP 192:ueeRsnK66OkYjVF7aL6CN6J3rrwl0TfiOt5jGK7XupF5fphIma+M/xq03guGIebb:ueeRsKo/aLG5rXiNtLVta/cYzeb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9232
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ntoskrnl.exe
PsGetCurrentProcessId
DbgPrint
KeServiceDescriptorTable
MmIsAddressValid
KeAddSystemServiceTable
_except_handler3
PsGetVersion
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IofCompleteRequest
ExFreePool
ZwDeviceIoControlFile
NtOpenProcess
ExAllocatePoolWithTag
MmGetPhysicalAddress
MmFreeNonCachedMemory
Ke386SetIoAccessMap
Ke386IoSetAccessProcess
IoGetCurrentProcess
MmAllocateNonCachedMemory
IoDeleteSymbolicLink
ZwClose
ZwMapViewOfSection
ZwOpenSection
ZwUnmapViewOfSection
ZwQuerySystemInformation
PsLookupThreadByThreadId
NtDeviceIoControlFile
ObReferenceObjectByHandle
hal
HalTranslateBusAddress
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
200B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=32, id=1, productName=Unmarked objects,
count=5, id=19, version=9049,
count=5, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=10, productName=VS98 (6.0) build 8168, version=8168,
WinIo.vxd
- SHA256 f849acfbd18def13f6a3d53268ee31b7ae904b2e7b66b9ccbb9f17c359f23173
- MD5 7a5af5dd62c4bc97c1654790e8d2f307
- SHA1 d90af8fa0da44b6b010b7c3d0fa8d03a71737e91
- SHA512 ea7435347f063df5ded4fe4d721317bf1115862f6c270eaa6563b17cae56900dad92ab68c45b2db3cdd9d3f39bf57c513475322162afc9581f55ea5c8cdcd439
- SSDEEP 24:eH1GSzWQm8EqEZADBIukl9pzdxvdgi1JjMAnEaLfNm:yA8EPZA8FzdxVXvzEiVm
- MD5 SHA1 SHA512 SSDEEP
cooper.dll
- SHA256 9d33495f94cf75a30d91e87239ce1262e495de4290838d5c478546ed5d560824
- MD5 3f0d2710a3f1c43c1c246d6bdb90c485
- SHA1 d7c13ff87ccaebe989bb8dba060a8dc8c1917a33
- SHA512 9a41f6915834072fcf7dc077304509a829214a3a7bde8e3a025354360ea36d8d683e5d69ede1601280bd4c9af2623e903069cea723b41bac10c1b4ede616b9c0
- SSDEEP 1536:eQMwQUefQut6GwgDv/TM9jp2gkZYbz1Yw4fveNFkFS:edwZucgvM9F2gkCzKwKokF
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
226992
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Initialize
ShowNewsWindow
UpgradeSoftware
Name
CODE
Size
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DATA
Size
66KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=12, version=7291,
count=2, id=37, version=8755,
count=12, id=25, version=9210,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=11, version=8569,
count=3, id=4, version=8569,
count=371, id=1, productName=Unmarked objects,
count=13, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
hook.dll
- IMPHASH 66c135644bf8a735369e761719ac3c8a
- SHA256 6fe4157605a28fa3842b9ffc5db266bfcd04ee49c423061d2c8cfa2136822f61
- MD5 aea4c6398baa752ea05904a3f236f731
- SHA1 d2f10ff8241a5e49a5b9316feacfa099bf49404f
- SHA512 84233b15cdc649e80b24de998d0591ad807f73b3eb133b33014c7991a922e37b4fce493e4c96853852113e3fe081637073149143e06f95ae2eb389e3721f195a
- SSDEEP 768:GrbF8V2RNjCytT7YF6JoUtXRDMMsi5jiB9pAhnU8g6xGl+Jbl5A/Td2LHvsuhW:GN5LCytT7PoHi5KAU8hxYil5mT4TLA
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Serial Number
42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning, ExtKeyUsageClientAuth
Timespan
Apr 25, 2007 - Jul 9, 2019
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Jul 9, 1999 - Jul 9, 2019
Subject
CN=Fuzhou TianxiaChuangshi Digital Co.\,Ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Fuzhou TianxiaChuangshi Digital Co.\,Ltd.,L=Fuzhou,ST=Fujian,C=CN
Serial Number
03:b3:e8:07:89:fe:e6:ab:e9:3d:d9:72:81:7e:53:f8
Issuer
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
Jan 13, 2010 - Jan 13, 2011
Subject
CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US
Serial Number
43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 30, 2007 - Apr 29, 2012
Minor OS version
0
Major OS version
4
Entry point
7639
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
QueryPerformanceCounter
ReadProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
GetTickCount
GetCurrentProcessId
MapViewOfFile
CreateFileMappingA
RtlUnwind
GetCommandLineA
GetVersion
GetModuleHandleA
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
ExitProcess
TerminateProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
HeapAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
user32
FindWindowA
GetWindowThreadProcessId
GetDesktopWindow
winmm
timeGetTime
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=14, version=7299,
count=73, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=7, id=93, version=2179,
count=79, id=1, productName=Unmarked objects,
count=8, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
inproc.dll
- IMPHASH 5bde2055b698e3c0bff5fba667fee162
- SHA256 e4b3ad12a170ed3a3d0f3848282d8a4241621a39eea41c34a47c12d5f0a79d42
- MD5 5f05ee1e30365c2dda5f0170bf685c6e
- SHA1 d27e7ba2c255f6ee369855bfaba237bd305e6343
- SHA512 4d17fedfd917e714540f4e2368fedcac8117ad588c79ade08a5d5973ae3a81fff1d16b55f5246e7dc9344406b8cd4ada0e4a373a30fb744b6fff87d1aca3d7ac
- SSDEEP 384:fSrArFxqzNWRemYMoprRJ1C5cR8QqyWMLveFcurQg3GCBHdFE96KJCOLLvYivcoT:OkzK4G9J1C2pjLvk3WEH3EIKJrLHvsi
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Serial Number
42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning, ExtKeyUsageClientAuth
Timespan
Apr 25, 2007 - Jul 9, 2019
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Jul 9, 1999 - Jul 9, 2019
Subject
CN=Fuzhou TianxiaChuangshi Digital Co.\,Ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Fuzhou TianxiaChuangshi Digital Co.\,Ltd.,L=Fuzhou,ST=Fujian,C=CN
Serial Number
03:b3:e8:07:89:fe:e6:ab:e9:3d:d9:72:81:7e:53:f8
Issuer
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
Jan 13, 2010 - Jan 13, 2011
Subject
CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US
Serial Number
43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 30, 2007 - Apr 29, 2012
Minor OS version
0
Major OS version
4
Entry point
13553
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
winmm
timeSetEvent
timeGetTime
mfc42
ord4698
ord5307
ord5289
ord5714
ord3953
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4079
ord4424
ord3738
ord815
ord561
ord823
ord1570
ord1253
ord1255
ord1578
ord1197
ord600
ord826
ord269
ord1243
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord1116
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord825
ord6467
ord4622
msvcrt
malloc
_initterm
free
_onexit
_adjust_fdiv
?terminate@@YAXXZ
_EH_prolog
__CxxFrameHandler
??1type_info@@UAE@XZ
__dllonexit
_except_handler3
time
srand
wcscat
wcsrchr
wcscpy
_ftol
rand
kernel32
LocalAlloc
LocalFree
Sleep
GetModuleHandleA
CreateMutexA
CloseHandle
WaitForSingleObject
GetCurrentProcessId
ReleaseMutex
QueryPerformanceCounter
GetTickCount
GetCurrentProcess
FlushInstructionCache
VirtualProtect
SetLastError
user32
FindWindowA
GetDesktopWindow
EnumWindows
UnhookWindowsHookEx
SetWindowsHookExA
IsWindowVisible
GetWindowThreadProcessId
PostThreadMessageA
PostMessageA
SendMessageA
CallNextHookEx
SetTimer
msvcp60
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
Name
.text
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
SHARESEG
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=93, version=2067,
count=1, id=14, version=7299,
count=4, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=111, id=1, productName=Unmarked objects,
count=5, id=93, version=2179,
count=11, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=7, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
logo.gif
- SHA256 f64ddfd908b825d9201f634f84007083d08af490769ca94ccfbb304995f7d8bf
- MD5 4e2772472b99015f6a832a14317beb90
- SHA1 be72827be8d049b8dc40ef6da91ddf965b7451cb
- SHA512 c57d8acbd3f2c58e4ce27de637100f041ce958ef8704ca758c07380f47a4def19ad396f45f15f3dea4c405808c16b7fa60cf4904a98645070dac0b543487d58d
- MD5 SHA1 SHA512
oem_sp.dat
- SHA256 064e23a56d9b1a290f09ce9914f9009a0d0b3acb970d46fdd925651def7d490d
- MD5 199eb6aa052ec5f77624b5f72d043075
- SHA1 1165800bd17131a9b1b2484abd23fb0ed12feef2
- SHA512 c7f5669a68f5839d44ed1f146ae6d8aa8ea131cde5b740f0900ade41fb366cfd1e45e17935d94b3d262f4b6875cb459d0ab1ee561fa7b068e8dc80ec44024807
- MD5 SHA1 SHA512
qmsd.sys
- IMPHASH c4f523cff80b1f6ca7dbd7f3da270492
- SHA256 e7bc2a0ac4b038502e8fd68e85f98f784e9de07904ce24eda583660d612834b9
- MD5 5050b48b952a5df457c4f2e0dca42a05
- SHA1 d8b11a0f5cae4f9230b9053999560f385295cdc7
- SHA512 77017fe06ea5c9490dcd60160844bf82587ad3eef6b8b8bc20f291e539428aac2b1193877e0ebe8d2f3f910f1beaf529dbf370afb1f72106659e1ee2346a3280
- SSDEEP 768:URoKWHILFL5a+5HTd0nbCBwJRL1vZIsgbULHvsc:Bu/V5HR1wD4bUTB
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Serial Number
42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning, ExtKeyUsageClientAuth
Timespan
Apr 25, 2007 - Jul 9, 2019
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Jul 9, 1999 - Jul 9, 2019
Subject
CN=Fuzhou TianxiaChuangshi Digital Co.\,Ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Fuzhou TianxiaChuangshi Digital Co.\,Ltd.,L=Fuzhou,ST=Fujian,C=CN
Serial Number
03:b3:e8:07:89:fe:e6:ab:e9:3d:d9:72:81:7e:53:f8
Issuer
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
Jan 13, 2010 - Jan 13, 2011
Subject
CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US
Serial Number
43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 30, 2007 - Apr 29, 2012
Minor OS version
0
Major OS version
4
Entry point
11920
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ntoskrnl.exe
ObfDereferenceObject
PsProcessType
MmIsAddressValid
PsGetCurrentProcessId
PsLookupProcessByProcessId
KeAttachProcess
_stricmp
DbgPrint
_except_handler3
ExAllocatePoolWithTag
ExFreePool
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
PsGetVersion
IofCompleteRequest
ZwDeviceIoControlFile
NtDeviceIoControlFile
MmGetPhysicalAddress
IoGetCurrentProcess
Ke386SetIoAccessMap
Ke386IoSetAccessProcess
MmAllocateNonCachedMemory
IoDeleteSymbolicLink
ZwClose
ZwMapViewOfSection
ZwOpenSection
ZwUnmapViewOfSection
ZwLoadDriver
KeServiceDescriptorTable
ZwQuerySystemInformation
ObReferenceObjectByName
IoDriverObjectType
PsLookupThreadByThreadId
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
ZwQueryValueKey
ZwOpenKey
KeAddSystemServiceTable
ObOpenObjectByPointer
NtOpenProcess
MmFreeNonCachedMemory
ObReferenceObjectByHandle
hal
KeRaiseIrqlToDpcLevel
KfLowerIrql
HalTranslateBusAddress
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=47, id=1, productName=Unmarked objects,
count=5, id=19, version=9049,
count=5, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=3, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
skin/default/SkinEditor1.exe
- IMPHASH 371f5c9f7d3244514204c2f8c2eb9228
- SHA256 d5c4bddebf0af01eb2812dc8ddf71899b70f4863407cbd1721076216bbe49879
- MD5 1c15bdda957b8321d974e94acaa26437
- SHA1 0de70b680ad339930159da926bc26c7a4be81037
- SHA512 73b423285867ef96235a7544474885c482c0c9158b9fdfe53954491bb59310ed6eed1f3a4a8aeafaf3ca977bbf1814a4294265bef4772bfce20f705cad51b279
- SSDEEP 1536:tNuYdJMMH2DRDlCnY5Nf12dOZamvKsMGhYB+BS4xEjwieOGLM/g:LHHICcNfYk/hYk04xc7eOGL+g
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mfc42
ord3079
ord4080
ord3825
ord3831
ord4627
ord3574
ord3571
ord3619
ord800
ord4424
ord860
ord540
ord825
ord3626
ord3663
ord2414
ord858
ord6199
ord2859
ord535
ord1641
ord640
ord755
ord5875
ord939
ord926
ord6648
ord1640
ord323
ord470
ord2575
ord5290
ord5277
ord3402
ord609
ord556
ord567
ord809
ord4275
ord2405
ord4284
ord2379
ord6172
ord2122
ord6358
ord1088
ord2864
ord3716
ord790
ord3797
ord823
ord1907
ord5161
ord5162
ord5160
ord4905
ord4742
ord4976
ord4948
ord4358
ord5265
ord4377
ord4854
ord4998
ord4710
ord2514
ord6052
ord1775
ord5287
ord4835
ord4425
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord768
ord489
ord692
ord2302
ord4258
ord4055
ord2818
ord4407
ord1779
ord5953
ord3986
ord3803
ord5606
ord801
ord5860
ord2976
ord3830
ord772
ord3701
ord500
ord6142
ord4204
ord5861
ord6143
ord1168
ord923
ord6663
ord6283
ord6282
ord2764
ord4234
ord4376
ord4853
ord5280
ord3597
ord641
ord6055
ord4224
ord6197
ord6379
ord922
ord2078
ord2113
ord2243
ord4220
ord2584
ord3654
ord2438
ord6270
ord2863
ord1644
ord1146
ord2642
ord4694
ord5148
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2621
ord4287
ord2109
ord3092
ord1008
ord497
ord4160
ord5850
ord2516
ord361
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord2124
ord2446
ord5261
ord537
ord541
ord3097
ord324
ord1576
msvcrt
_except_handler3
__set_app_type
__p__fmode
__dllonexit
__CxxFrameHandler
_mbscmp
atol
atoi
sprintf
_access
_setmbcp
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
_controlfp
kernel32
ReadFile
GetFullPathNameA
GlobalReAlloc
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
WritePrivateProfileStringA
GetPrivateProfileStringA
GetFileSize
CreateFileA
GetModuleHandleA
GetStartupInfoA
CloseHandle
user32
PostMessageA
GetWindowRect
GetActiveWindow
LoadMenuA
AppendMenuA
GetSystemMenu
DrawIcon
GetSystemMetrics
IsIconic
SetRect
PtInRect
SetWindowRgn
GetParent
GetCapture
SetCapture
ClientToScreen
WindowFromPoint
ReleaseCapture
GetWindowLongA
SendMessageA
EnableWindow
DrawTextA
KillTimer
GetClientRect
GetDC
SetTimer
InvalidateRect
GetSubMenu
GetCursorPos
LoadIconA
gdi32
DeleteDC
CreateFontIndirectA
GetObjectA
GetStockObject
GetTextExtentPoint32A
BitBlt
SelectObject
CreateCompatibleDC
DeleteObject
CombineRgn
ExtCreateRegion
CreateDIBSection
StretchBlt
CreateCompatibleBitmap
comdlg32
GetOpenFileNameA
ole32
CreateStreamOnHGlobal
olepro32
ord251
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.cas
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=4, productName=Unmarked objects (old),
count=10, id=19, version=8034,
count=1, id=14, version=7299,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=5, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=292, id=1, productName=Unmarked objects,
count=23, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
skin/default/clock.gif
- SHA256 b75cddf7f344f8719d44267027e575f9c00e06994317308f9a386d6fcd854b94
- MD5 8c1ca9326f0193c25cf849d2ab6d8094
- SHA1 304246359fa6253f12eec810f0c2ae52ade11445
- SHA512 5aef09a7abf6f565b1319c2d5084669cc08555783ff8b14876105659b7236fc3cddcf4115748740465782fb595e63fd2e25951522e845a8b35836d24cffda516
- MD5 SHA1 SHA512
skin/default/clock1.gif
- SHA256 d92bd6139aed3b3ae1a523674e062dc29f846d0e8b2bf4b86f079371000dd8b6
- MD5 940b3d14a586c163621c187ebe550c7f
- SHA1 85e75f97b6da126bb0e300339e13b2c246cf4d21
- SHA512 9f3fc0a2d0c5f409898db581cd407436ab69b634f22565d614c85d45a0fbcd72453eac4fc4e057536a6ae5e68c3e759416229a8f373423d569bc6cc04a10b47f
- SSDEEP 192:7zZB1Wl44LlXyQ34LlwEhEfdKuYSVEGbYBuJA7C+:nZB1WPRi7RrKwmEse7C+
- MD5 SHA1 SHA512 SSDEEP
skin/default/down.bmp
- SHA256 df7f546cb17058321de9ab5f9960a833f91c175a51bbe25ffb96df3d3499814e
- MD5 9f541ebf6dab41d7dae782b5792638fa
- SHA1 f1a085e0e46e3bc6f5da3f123918fee6b5a31cb1
- SHA512 1c9f22388cefc766d26d7dd0ff1d41abb8c913c1a2d9e358844f27c01758caae303e80b3e7964dadf24371afe578bfc2ceff75af5b7be6b59d33dc22643c3a06
- SSDEEP 1536:cliXheIXb649vkDYmtDlKNUpi7agJzT5zv/yNya5bkm37IXsyHYW7xy4jEzOz5Th:ckXbHRkDBpKwihRTwHj3poLty+EzQSe
- MD5 SHA1 SHA512 SSDEEP
skin/default/main.bmp
- SHA256 cdd94f354509f171cc6bb4263e212efdca6f4f5d753d7dd18094017fab772990
- MD5 57c9a2c299cd5fd37c6b8d8bf1a17725
- SHA1 e53800bdc13623916602ddd4d3a83257f0c107c4
- SHA512 055d1331cd111b47e2f6b54961717313184267b02aa74f63b2d595f3f84b0eecc21be916d0781c0ff5ce25273326344c3f43b7d09f2c4ee86de8be6326625bbc
- SSDEEP 1536:clin3eJrwLH4KWFJ35bkJD5zv/yNya5bkm37Ip02HeZxDXRWC4y7Etcl3xK6t3:c7wk3J3+ZwHj3b0yFRWClE4hKW
- MD5 SHA1 SHA512 SSDEEP
skin/default/mask.bmp
- SHA256 fdce58269d43151604c3aaa71628eadc2ef0500d3e93f6e4ad868c94723650a0
- MD5 a297434bbabc085a621b023ba1489216
- SHA1 b71b514aeae312137ef0072a9875055c75cf433c
- SHA512 519a3f515c0e58b91439a9ae28f03bfa751d892a313e0cdd59c64fcbe06b1531e07e251be8bd6b6d81266714ef5f283d05310ef2cd0d083ce3dd12b84a8d5bec
- SSDEEP 3:m/plnklBlVlNPjdtGl/e2Xelll9l1lfvllvll1l9l9lfvlPlcllluXVu:mAlTPftyQUyu
- MD5 SHA1 SHA512 SSDEEP
skin/default/over.bmp
- SHA256 1ba8c0256e2973158e77d40323eaa9e040a5204a3cb71194dcaa03a3e74973f9
- MD5 1e14a153a9184320e258bbd85de340a1
- SHA1 a3d79fd752cfc14e69bb708b40a972c18f5f293e
- SHA512 209665362b2ce45a7c621c1e44cb2b3abb6abeaab4f1496e6673cee4191f95835ff9fb78540e21b4b5c2b79d1bba6b1668f095db6e3d7267440b55d3b6bb691e
- SSDEEP 1536:clin3etYsUNzYds72wYAazP0J95zv/yNya5bkm37IYugdHl2BYcfVtogxHd6KKKY:czYsUC2LYTQfwHj3CgVoBbfV6gFdz+E+
- MD5 SHA1 SHA512 SSDEEP
skin/default/skin.ini
- SHA256 c60d18bfe3760743e3cc89920a5c8e0f1dcab3344a46e55a384a52b693e6098d
- MD5 e944e4a25cebb1fa048b06434e82f2cf
- SHA1 8af945406fda9e20b4dc7e7dfb88ed89a1b441fa
- SHA512 7cf9da144dac042d360221a89146dd848b855171c0ed3c20caf0b49c6a0d43c616c33fd330dbc009baace5554b08f911ba8195b6d9fd9510a2f002da17b118e4
- MD5 SHA1 SHA512
skin/default/trackmove.bmp
- SHA256 cca4059c2971bef60b7e0446ecf32a8e55e71dcc9e32b21701e868249b22c802
- MD5 f4f8fb73128d3b00e108d35ff2aa2985
- SHA1 f69d5f22dd21c28349c290c2556c4d580a936d13
- SHA512 8717b6ef9fc02796dc8567ddaab0df094a7bcf8f13293fd60bc3df048407614bd357855f9e4638e54f28750056b7e143e6508709dd829e560f10b355b8e40b55
- MD5 SHA1 SHA512
skin/default/trackstop.bmp
- SHA256 d04616c44c1115acc64e09420c45776aaa7775a3869fd9076a22e34c0f78c8c9
- MD5 51f6da569c207d0f58df81f449a4f512
- SHA1 58998a6cf12bc5445c105ddd3ae75c8c81fabf55
- SHA512 1216c86990de9909f3af681ad1b51155e5168a41bee5182cb4afa8a68da66866eba97e4469c638808bb50e8297ca6ed940f686cd9197c82afff5adab7b294e3f
- MD5 SHA1 SHA512
skin/default/皮肤制作工具.exe
- IMPHASH 371f5c9f7d3244514204c2f8c2eb9228
- SHA256 d5c4bddebf0af01eb2812dc8ddf71899b70f4863407cbd1721076216bbe49879
- MD5 1c15bdda957b8321d974e94acaa26437
- SHA1 0de70b680ad339930159da926bc26c7a4be81037
- SHA512 73b423285867ef96235a7544474885c482c0c9158b9fdfe53954491bb59310ed6eed1f3a4a8aeafaf3ca977bbf1814a4294265bef4772bfce20f705cad51b279
- SSDEEP 1536:tNuYdJMMH2DRDlCnY5Nf12dOZamvKsMGhYB+BS4xEjwieOGLM/g:LHHICcNfYk/hYk04xc7eOGL+g
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mfc42
ord3079
ord4080
ord3825
ord3831
ord4627
ord3574
ord3571
ord3619
ord800
ord4424
ord860
ord540
ord825
ord3626
ord3663
ord2414
ord858
ord6199
ord2859
ord535
ord1641
ord640
ord755
ord5875
ord939
ord926
ord6648
ord1640
ord323
ord470
ord2575
ord5290
ord5277
ord3402
ord609
ord556
ord567
ord809
ord4275
ord2405
ord4284
ord2379
ord6172
ord2122
ord6358
ord1088
ord2864
ord3716
ord790
ord3797
ord823
ord1907
ord5161
ord5162
ord5160
ord4905
ord4742
ord4976
ord4948
ord4358
ord5265
ord4377
ord4854
ord4998
ord4710
ord2514
ord6052
ord1775
ord5287
ord4835
ord4425
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord768
ord489
ord692
ord2302
ord4258
ord4055
ord2818
ord4407
ord1779
ord5953
ord3986
ord3803
ord5606
ord801
ord5860
ord2976
ord3830
ord772
ord3701
ord500
ord6142
ord4204
ord5861
ord6143
ord1168
ord923
ord6663
ord6283
ord6282
ord2764
ord4234
ord4376
ord4853
ord5280
ord3597
ord641
ord6055
ord4224
ord6197
ord6379
ord922
ord2078
ord2113
ord2243
ord4220
ord2584
ord3654
ord2438
ord6270
ord2863
ord1644
ord1146
ord2642
ord4694
ord5148
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2621
ord4287
ord2109
ord3092
ord1008
ord497
ord4160
ord5850
ord2516
ord361
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord2124
ord2446
ord5261
ord537
ord541
ord3097
ord324
ord1576
msvcrt
_except_handler3
__set_app_type
__p__fmode
__dllonexit
__CxxFrameHandler
_mbscmp
atol
atoi
sprintf
_access
_setmbcp
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
_controlfp
kernel32
ReadFile
GetFullPathNameA
GlobalReAlloc
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
WritePrivateProfileStringA
GetPrivateProfileStringA
GetFileSize
CreateFileA
GetModuleHandleA
GetStartupInfoA
CloseHandle
user32
PostMessageA
GetWindowRect
GetActiveWindow
LoadMenuA
AppendMenuA
GetSystemMenu
DrawIcon
GetSystemMetrics
IsIconic
SetRect
PtInRect
SetWindowRgn
GetParent
GetCapture
SetCapture
ClientToScreen
WindowFromPoint
ReleaseCapture
GetWindowLongA
SendMessageA
EnableWindow
DrawTextA
KillTimer
GetClientRect
GetDC
SetTimer
InvalidateRect
GetSubMenu
GetCursorPos
LoadIconA
gdi32
DeleteDC
CreateFontIndirectA
GetObjectA
GetStockObject
GetTextExtentPoint32A
BitBlt
SelectObject
CreateCompatibleDC
DeleteObject
CombineRgn
ExtCreateRegion
CreateDIBSection
StretchBlt
CreateCompatibleBitmap
comdlg32
GetOpenFileNameA
ole32
CreateStreamOnHGlobal
olepro32
ord251
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.cas
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=4, productName=Unmarked objects (old),
count=10, id=19, version=8034,
count=1, id=14, version=7299,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=5, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=292, id=1, productName=Unmarked objects,
count=23, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
speeder.ini
- SHA256 8504870ecb05a186db12344bdabf77591afede7bbb8b03f91d565be7b8b77e7a
- MD5 223399814d7d441e7fa837652ffd3349
- SHA1 ca2a7af9d9f288b9b1c698599012ac331159f9ba
- SHA512 5b8f6c06dd0fefb10d84b65db61d389d545569e8ff1dbab71b55f816d498fde1ae3f912b5c800be09668fca8968fb955e6a192f1436d29af770bb741480492e0
- MD5 SHA1 SHA512
tips.txt
- SHA256 16f9d7bd00b47fc79cea7c558bebc61e30e2671759b558fc2d36e916cf7db655
- MD5 58b94b65f77845c6e57c4a45bbdc9271
- SHA1 d821249777a18b96778f3c596451ecb25ffa4ac8
- SHA512 26cdbf6c70c131db228b777260e231023a4918f1d806a44873ca5603fff9d7d71073aaaa865252f6e361b220b7040cce7e7dc0ac2705130a70b39b8073b94f66
- MD5 SHA1 SHA512
unins000.dat
- SHA256 3187cf48e8954890eee59cc3d174648017ecf02c7bbf3bd8d1807fde89f33e0e
- MD5 c041b70b34b547a89744fc4649cd4d95
- SHA1 31bd698f01afb8ee6bd44dc01f9666743d05ab4b
- SHA512 38fbcf1092401dc5d4bc6770b359998bcb8b6b17bdf72ea134ca636c671ade966a34c26239c1de77a0487dff653555cd28f07d46a6aa82385be390727ea804b5
- SSDEEP 96:emJE/oDv+Plqi9qpuzKvxKvB34Tb/t0C7nqi9qpuzKvxKvBO:3JE/oDIlk7Tb/t0ckn
- MD5 SHA1 SHA512 SSDEEP
unins000.exe
- SHA256 fac08e28a9e5afd479cb1d06a5d53e57f4fb9c9271b1a8808ab2f2d25f9b4d43
- MD5 232f461e129448ce8ee00506a1bce7a9
- SHA1 caac66ff18e87c2bf0a1e4fa3ab48e40a7d0c8cf
- SHA512 21c278d801aaad1ace6a8dd63a46a4619d3275f6fae3252b14ea85bc45de8cea08904aedb6df863f7dbbcc0a312094ab24931983183292e3c9b5e03839741066
- SSDEEP 12288:2OuHrGgy7Q6VRrPja37nzHtA6owEicLzmpN4/kRY7ZXcmLJTfxdr:PuLs7Q6VRrP+37nzHtA63cH/BcOJTfxV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
577976
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
561KB
Virtual Size
560KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
73KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
version.ini
- SHA256 83c4624f8ff28af585574ae49d4f0db52b6968365cc4412ad31a81d7b4e2f669
- MD5 75814fb167bb7985933de9fa9a65c7ae
- SHA1 107951c6a6fbefcfce37aee30a32e3bbff186867
- SHA512 e268770c816648bbb5d4f1eb9a29463ca3a95463a6fe1223dad495e01a662b1465ea9898b629764df3f3440b5761fbcef516d23bf47cacf1ab11262118b0aa67
- MD5 SHA1 SHA512
whatsnew.txt
- SHA256 565a7864c84803424fedf05724240e7ee0017c0aa77f8cde2ada681d58e2deee
- MD5 4a5c8a91cba9e4e128540728e073ec1b
- SHA1 05167e2e0092ca1805fc40290e7bc4f7142f4dc6
- SHA512 bf3645e33a14fff92249ef5cc938e2d76a3a579bd8a6bd05fc69509bd32285eab5f8d9f56c6cf2ef109b8d73bc7910e67d06bee06bd4d0ce3fe91d8d7dca7c45
- MD5 SHA1 SHA512
变速精灵VIP版.vmp.exe
- IMPHASH 235f1ac7ce4874e3ed68932daae60a6f
- SHA256 8dc5e64f798136b21b402c487202e5d08074b6b0cb57fff6f2d67f15c10f4f9e
- MD5 b16155b174e7dc559a7f73bccae862a7
- SHA1 4d4425567670bc2d47a20b0ae0394b3570552a57
- SHA512 fb069fc52f805fc4f22ba47560649633012609c68d447c5f98ccd8542b2ba1cc28957141a6ccc10d55d76f25fb7a61f6914301601027e394fcac42bcdcb1b058
- SSDEEP 6144:g9ZMS4VI3yGql4ve1s5fe7W3DSNfLk22qIlpBRXGx6XLAd+HXwBClqIBKpF8erH:hVSyGql4vV5TzXcolMT3HvfLW5HfOz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
934330
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
inproc
ord1
ord8
ord6
ord2
ord5
ord3
ord7
hook
ord2
ord4
ord3
ord1
winmm
timeGetTime
mfc42
ord6242
ord3092
ord4710
ord4853
ord6569
ord2777
ord6927
ord4129
ord5710
ord6930
ord3301
ord2379
ord5450
ord5440
ord6383
ord6394
ord4247
ord4248
ord4245
ord4246
ord1644
ord2455
ord4457
ord4724
ord5053
ord2863
ord4499
ord1133
ord4810
ord4774
ord3021
ord6453
ord4458
ord4500
ord4501
ord4775
ord2575
ord4396
ord3574
ord3721
ord795
ord609
ord2301
ord2302
ord3619
ord3626
ord2414
ord2817
ord4160
ord1641
ord5981
ord2642
ord6334
ord6673
ord1948
ord2396
ord3346
ord5300
ord5303
ord4079
ord4699
ord5307
ord5289
ord5715
ord4622
ord565
ord817
ord2726
ord4226
ord1988
ord1200
ord926
ord3573
ord3610
ord656
ord3571
ord5787
ord284
ord1146
ord5875
ord2243
ord413
ord711
ord755
ord470
ord4220
ord2584
ord3654
ord941
ord2614
ord5572
ord2919
ord2438
ord5823
ord3664
ord996
ord640
ord5785
ord1640
ord323
ord2859
ord415
ord613
ord289
ord715
ord5641
ord1867
ord1168
ord2866
ord816
ord5789
ord562
ord283
ord2754
ord1871
ord384
ord686
ord5607
ord2762
ord896
ord2096
ord2408
ord1642
ord2453
ord1862
ord3701
ord500
ord772
ord1176
ord6142
ord2567
ord5788
ord2971
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord6021
ord6172
ord5873
ord5794
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord4277
ord3920
ord472
ord6194
ord2860
ord6877
ord5860
ord3702
ord1083
ord501
ord1175
ord1621
ord4202
ord5856
ord536
ord5606
ord2753
ord696
ord1265
ord5642
ord4185
ord5628
ord6467
ord3706
ord2452
ord4023
ord909
ord1816
ord2546
ord3815
ord858
ord1110
ord1724
ord5256
ord706
ord408
ord1865
ord5101
ord2101
ord5104
ord3351
ord976
ord4152
ord2382
ord5283
ord5254
ord2445
ord401
ord1858
ord2102
ord5473
ord407
ord645
ord1864
ord1842
ord5805
ord4145
ord5484
ord3232
ord1137
ord1140
ord2152
ord6696
ord1819
ord3102
ord6154
ord2531
ord4364
ord4057
ord5471
ord4121
ord2389
ord5083
ord1709
ord1713
ord5234
ord6369
ord5279
ord5248
ord2444
ord331
ord4236
ord6652
ord2714
ord3643
ord394
ord773
ord812
ord1270
ord1232
ord559
ord6144
ord3089
ord6605
ord2405
ord2380
ord5781
ord6119
ord3797
ord5862
ord940
ord4133
ord4297
ord1233
ord4204
ord3337
ord1158
ord2370
ord4287
ord6380
ord2289
ord6282
ord6283
ord1199
ord6928
ord4400
ord3630
ord2450
ord5786
ord3370
ord2582
ord4402
ord3640
ord693
ord682
ord4243
ord801
ord6907
ord6883
ord5861
ord541
ord3998
ord6007
ord3286
ord6143
ord3996
ord6675
ord6888
ord3631
ord3719
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord809
ord683
ord616
ord793
ord556
ord2297
ord2363
ord3226
ord1087
ord2122
ord5148
ord4673
ord4274
ord6375
ord4486
ord1105
ord2512
ord5731
ord3922
ord1089
ord5199
ord5302
ord4698
ord5714
ord3738
ord561
ord815
ord692
ord790
ord1106
ord1134
ord2820
ord2725
ord3716
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord2358
ord2460
ord850
ord6241
ord6111
ord4694
ord6302
ord4168
ord1088
ord6358
ord4299
ord6270
ord6779
ord3803
ord6403
ord3522
ord3521
ord6402
ord4476
ord1949
ord4034
ord4284
ord665
ord924
ord2915
ord823
ord2841
ord825
ord567
ord540
ord2864
ord2124
ord818
ord3742
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord3663
ord4275
ord923
ord6663
ord4224
ord6379
ord2078
ord6905
ord3874
ord4234
ord324
ord542
ord3597
ord4425
ord5280
ord1775
ord6052
ord4998
ord4376
ord5265
ord353
ord6010
ord2514
ord802
ord641
ord2763
ord5683
ord6648
ord1768
ord537
ord6199
ord6880
ord535
ord4467
ord2135
ord366
ord2092
ord674
ord3623
ord4427
ord5252
ord4436
ord1665
ord2649
ord5282
ord5237
ord4077
ord4151
ord2878
ord2879
ord3403
ord5472
ord975
ord5012
ord3350
ord4303
ord5103
ord5100
ord3059
ord2390
ord2723
ord3402
ord5290
ord389
ord268
ord5207
ord1567
ord690
ord2107
ord3811
ord860
ord2113
ord5953
ord5216
ord3758
ord3408
ord3227
ord3054
ord3425
ord3880
ord551
ord2818
ord939
ord354
ord922
ord5186
ord3318
ord5442
ord1859
ord1979
ord2688
ord4242
ord5030
ord539
ord2764
ord800
ord6197
ord6215
ord1576
ord291
ord2554
msvcrt
__p__commode
__p__fmode
__set_app_type
_controlfp
_strnicmp
strchr
isspace
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
?terminate@@YAXXZ
_except_handler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
_mbsnbcpy
_fstat
ctime
fwrite
_purecall
_ftol
strncpy
_splitpath
exit
fputs
isupper
isdigit
_mbsicmp
strtoul
_mbsstr
strstr
strncmp
ftell
rewind
fread
free
fgets
fopen
fseek
fgetc
fclose
fputc
rand
_mbscmp
time
srand
__CxxFrameHandler
sscanf
atoi
_mbschr
tolower
_ismbcspace
_mbspbrk
_mbsnbicmp
_CxxThrowException
malloc
strrchr
sprintf
_access
atol
fprintf
_setmbcp
_adjust_fdiv
kernel32
CreateToolhelp32Snapshot
Module32Next
GetCurrentProcess
GetCurrentThread
SetUnhandledExceptionFilter
GetFileSize
ReadFile
GetFullPathNameA
GlobalReAlloc
GlobalFree
GetModuleFileNameA
GetStartupInfoA
GetModuleHandleA
GetFileAttributesA
SizeofResource
OpenProcess
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
SetCurrentDirectoryA
GetCommandLineA
GetPrivateProfileIntA
GlobalAlloc
GlobalLock
GlobalUnlock
DeviceIoControl
GetCurrentProcessId
lstrcatA
lstrlenA
WinExec
lstrcpyA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetCurrentThreadId
SetLastError
MulDiv
GetLastError
FormatMessageA
LocalFree
GetVersion
GetVersionExA
FreeLibrary
LoadLibraryA
GetProcAddress
FindResourceA
LoadResource
LockResource
GetWindowsDirectoryA
SuspendThread
ResumeThread
CreateThread
Sleep
GetLocalTime
GetPrivateProfileStringA
WritePrivateProfileStringA
CreateFileA
CloseHandle
QueryPerformanceFrequency
SetLocalTime
QueryPerformanceCounter
CreateProcessA
WaitForSingleObject
GetTempPathA
CreateDirectoryA
DeleteFileA
IsBadReadPtr
SetFileAttributesA
MoveFileExA
GetTickCount
Module32First
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowRect
GetClientRect
DestroyCursor
GetNextDlgTabItem
TrackPopupMenuEx
IsWindowVisible
GetDesktopWindow
MessageBeep
SetDoubleClickTime
GetWindowTextA
FindWindowA
GetWindowThreadProcessId
EnumWindows
SetForegroundWindow
RegisterHotKey
UnregisterHotKey
SetCursor
GetDoubleClickTime
LoadIconA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
PtInRect
ChildWindowFromPointEx
GetDC
LoadImageA
SetWindowRgn
WindowFromPoint
GetActiveWindow
ScreenToClient
GetClassInfoA
DefWindowProcA
LoadCursorA
CallNextHookEx
GetClassNameA
GetWindowLongA
SetPropA
FrameRect
GetPropA
RemovePropA
UnhookWindowsHookEx
SetWindowsHookExA
IntersectRect
DeleteMenu
IsRectEmpty
ClientToScreen
GetMenuState
AppendMenuA
ModifyMenuA
GrayStringA
GetMenuDefaultItem
DrawTextA
TabbedTextOutA
DrawEdge
SetRect
DrawFocusRect
GetMessagePos
DrawStateA
GetMenuItemCount
GetMenuItemID
WindowFromDC
CopyRect
DestroyIcon
GetIconInfo
FillRect
MessageBoxA
GetMenuItemRect
GetMenuItemInfoA
OffsetRect
IsMenu
GetWindowDC
GetSystemMetrics
ReleaseDC
ReleaseCapture
SetCapture
GetCapture
LoadMenuA
PostMessageA
SetTimer
GetSubMenu
GetMenuStringA
InflateRect
InvalidateRect
LoadBitmapA
GetSysColor
GetFocus
IsChild
MenuItemFromPoint
KillTimer
CallWindowProcA
SetWindowPos
SetWindowLongA
SystemParametersInfoA
RedrawWindow
GetParent
IsWindow
EnableWindow
SendMessageA
GetSystemMenu
GetCursorPos
GetMenu
DestroyMenu
gdi32
DeleteObject
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
CreateDIBSection
CreateSolidBrush
Rectangle
CreateFontA
CreatePatternBrush
CreateCompatibleBitmap
GetDeviceCaps
CreateFontIndirectA
GetNearestColor
SetPixel
GetPixel
GetObjectA
RoundRect
GetTextExtentPoint32A
CreatePen
SetBrushOrgEx
UnrealizeObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateRectRgnIndirect
CombineRgn
CreateRectRgn
SelectClipRgn
FrameRgn
FillRgn
OffsetRgn
CreatePolygonRgn
CreateRoundRectRgn
GetTextMetricsA
StretchBlt
GetTextColor
SetDIBitsToDevice
GetStockObject
ExtCreateRegion
advapi32
RegCloseKey
RegDeleteKeyA
StartServiceA
OpenServiceA
DeleteService
OpenSCManagerA
CreateServiceA
RegOpenKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueA
RegCreateKeyA
CloseServiceHandle
ControlService
shell32
ExtractIconA
ShellExecuteExA
Shell_NotifyIconA
ShellExecuteA
comctl32
ImageList_Add
ImageList_Replace
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_GetIcon
_TrackMouseEvent
ImageList_SetBkColor
ImageList_Draw
ImageList_GetImageCount
ImageList_GetIconSize
ole32
CoInitialize
CreateStreamOnHGlobal
oleaut32
VariantClear
SysFreeString
urlmon
URLDownloadToFileA
msvcp60
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0logic_error@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??_7out_of_range@std@@6B@
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
??0Init@ios_base@std@@QAE@XZ
msvcirt
?close@ifstream@@QAEXXZ
?get@istream@@QAEHXZ
??1ios@@UAE@XZ
??1ifstream@@UAE@XZ
?read@istream@@QAEAAV1@PADH@Z
??0ifstream@@QAE@PBDHH@Z
?openprot@filebuf@@2HB
?seekg@istream@@QAEAAV1@J@Z
?tellg@istream@@QAEJXZ
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
??_Difstream@@QAEXXZ
olepro32
ord251
O�dxR��F{�.}(��\4��f�9���Z@�`�FM�RP \�n�Cj�E��ޙ&�!��`ҵQ��6��o��k�K��q!���
y �D��/�*� �I�W��y$G�V�2�4�6���p$����,J�a��r8J�S��K-9t����� 1��/�
!30 Wr� ���R"�L ���t�i�6�{�J�19X�DE�QW=�7�_$J:Z�ݦh����5�#�F����ǫ����p��Re���ޖ��{? ؽh�����# �'CJN �=?J���f�Z̉���'��0SQܑ�N`�`;a%�V�wGԃ)�� Kv���QE<f�NQ�f��Ρ_�y8Nl��30�'~�� � ���(c�Q
�d�}�� "��V���}C<m"@:�s��4ٱ���F 4M2W'�MQ n 0גAӂ�P� P/�b~�*�o�5f#ԛ
E�d��GC}����!�Y���V��2����(��
�O"iR �Vu��͐Þ�/�)J��A毘U�g��X���l=a�{M�]��{�%Vٺ�X�������b���H�S@ ���5����qN�����~O\~>2����Afi"58
5)}#[j���E�s��Fhσ���, !�Ý������
��C�R��;h 1��� �R
u�����`2|���r,��҄�ɪ�j�и���Y�1WQ_��щ��Yqb�� �|��b�ɹ' W���Al�I�R��� ����o\� r��a�C'���p�&�ߙ�er��Y.u�6�?��M��dQR˸�s��e������ƣ��D����R�C0BӠ��-�c�w~� \�m@H���o��W���8p.)�OD%��w!���eح��ޚ�`�$_uz�X�X��N����$��f@
*;�Q#@KH���Z{�n�lx35\��v<�t�=������ �Y�+����T�vLd��Z��/$�j�� -*xz���:\�?# #��ݨ�c�1��ZFg�N �K�X��ߌO�&�id�~]�z-��Z5�Ug�<�pW��L:��i��1��@�3x�`qE|h�� �W��T� �U��LRۯYy~���`z��S��`
R�K��I$�E-Szh� j�VY ��h)d�ys�"�Ncf��X AR� ��̐� ��Pb�
����M��o�cK� �Yv��^1��%`w;�q2D��D�&V�C�[¦Y�\ �TPK3M&�{t�C*��C�k0�J�j�J}E ��ȀK'�f�p��- �&�z�x"F���칭Vch��v$���ȁ_&��%�j��Z˜���%�|Y�b�_�w��"�\����Bvmb#����@W��$��9�:v�F���{��q��i��;�V�
���d�D���̶pa*����Y`�n� �~(Y-*��0��~(���¬'y�Dv��/2n���4@��K�|�5.�S׳�Q�,3f����-�k x3�b�,�rl1�د��۹�Z�g,(���6 AX����� ~`Dž ��;hE)O�����,�@[�T�����U��i�-a����g�]+(����!�?!��}�>ݵ
���^0/0���o�!� 21��ʠ�Mo��H��I��쟚,��O�P���E��\�,���D
,�la����DЋ�c�,w�����x�P�}��zX]2�>�+��O�OR�* �
�L�� ƄQZ�O�Lљ����Փ �O=[?A��&L���� nx��߲��+���F\JN"�SPr"k k�x��.HN2���������LF,�!���s����`�رb���oTo�V�Wk c ���m�8Q[�tP��Z������h�!�:]��$��� ���.��ܘ�L���(��A@�0`0���r晕'4�+t
?E�*H1r%��F��A~ o�L
D! b�+ˬ��e� �Fgw��¸d0�@S i�R� :��i��)�Y��mn/<Å��� e�f�� �z2���U�R]a
Zo_���+�eVg>�{ǜ U &5e�䠥���c
p���uD�O����@^e��F �t�|g�����Ϝ�A�����p @˗�P�ԅ���������>`�i�ۚ%6��u��Ν��[�w�
�����N|Jh櫛�;�E��r���KȏZ̩.����^��/��b/����р~�'��Ū64����e�V��j��T��L��-$�`��7�8$�?���ff��fz�-{�.��G�{�)SQ G �QHen��F�K`)��b�����*|�Tgӌ�����Lr} �+��ϰ������������6 Kn��� �i��nvDf�r;#���&��x�'?�r_섹�2f,�D��~=e]yik?WP?--a9}s;��
���ڬ΅ӫ�E.�KL5� ���&'\¯�Mk�-X]6+l��
'�=P �U��PlԆ���O��4KU.?�ڢ�PF#�Jr���uu� v�;쥧w�l��H���
�h���r�xAU���
� ��8�s*��Ѥ)_O��gƃ��=#�lt������!IζF����A��X0d4�r�;����O ��r��W��9���qP�
#AXw����H?0��!�[��H��\S�
��X���gv>{��{˳U�JJWqL���.����x���4�1�fҁ�!�~>|w�Mk������gy_��S0�����~�]�
Ci�1}��d��"m�O�L@�t_��C���d*�,u�;bX�aw�Y�3Y����� 6�Ӝ�#�N�:Z���e-nQ��;��'��*�c��d���4������'E� � �"�5�yQ��Cؚ�7�u�n A n��Xv�*�|$�8L������,�� 4xi1�'3W�4 �A"��>�7�� "7���j�P�Zsp�*����3R�f�^�l1��/��>L(!25�?�%q���ij-�>`.fn�y*���� ��9h�����
vC(����&N��tTHc�=r�� #[�o���=\��*�!�'6�wK���
%��E�����͚�L�W_{�����ɹ�y����\����A��8S��D�\�V-%�2-�7�ڟ·'haNJ�_���bF�?ۂ��$d'��np�i�(�n�h~ IFw��� �B�<ȅ�OF�iS�)�E�
Name
.text
Size
232KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
460KB
Virtual Size
459KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.sp0
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp0
Size
4KB
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp1
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.tls
Size
4KB
Virtual Size
24B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vmp2
Size
56KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=3, id=11, version=8966,
count=3, id=12, version=7291,
count=4, id=19, version=8022,
count=20, productName=Unmarked objects (old),
count=3, id=14, version=7299,
count=2, id=11, version=8047,
count=11, id=10, version=8047,
count=4, id=4, version=8047,
count=2, id=4, version=9782,
count=7, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=18, id=19, version=8034,
count=976, id=1, productName=Unmarked objects,
count=7, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=47, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
所有小软件列表！.url
- SHA256 7f70f6d00d81fa760f1217d75883cfe32799e7ba3a1acd9a0877095b5be13e63
- MD5 db15929d25d16817236a085a3a991374
- SHA1 394aba9a05fe0cd3e8a757474314d1655c46fc07
- SHA512 36dcdcb980b24fd52438d5f8d07ec0d158bdaa0d4b015b4309836d8f450a8a39ed692a8214d5c959fab67d1edb7243113aaba1cca1684c882b8b737d95de103f
- MD5 SHA1 SHA512
说明.txt
- SHA256 104f22cd6279c824400ed4dd8aa9bf601e1d1f8d5291c4fb2041a867d90881bf
- MD5 5ae9cf29c13a07cf5c9c8347614d3f3c
- SHA1 d3fc87e32cd289ec1a09f790768cddbee242d126
- SHA512 ffae4898cd30c0d4ad5d3e626e83dea9988da043741d585a8ea6b3fc6fc024d669766c4761750f69d5a6d3fa0f98f0796f2d0b17f39cad628ff0bf1124838c1f
- MD5 SHA1 SHA512