9ad5b71354a87ef191d56e7748d1c5e3

Sharing

Copy URL Twitter E-mail

General

Target

9ad5b71354a87ef191d56e7748d1c5e3
Size

566KB
MD5

9ad5b71354a87ef191d56e7748d1c5e3
SHA1

92d576b9b7bce8ade3e08e2f6c95f334692cf4d6
SHA256

41f6a9706cd3ffa87c1bcb57a13f9afa49ad4e2b4a0d5f88c07ed65b007de88b
SHA512

6c0fb7b4368d78abb47266249c8c318735740b3c6bccf01f125ffda2e7c1f3bb90e95849af91eccfa44c82bda3c59141810c73dceff7c321a581fee875d345ec
SSDEEP

12288:vtvkDBrHRFfOOntuRZojJjGWYHtGVRrpYq:1vkD5xxlno8jaNeRrpt

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/BetterWMF 6.00/BClipbrd.exe
unpack001/BetterWMF 6.00/Bwmf2007.arx
unpack001/BetterWMF 6.00/Bwmf2008x64.arx
unpack001/BetterWMF 6.00/Bwmf2010.arx
unpack001/BetterWMF 6.00/Bwmf2010x64.arx

Files

9ad5b71354a87ef191d56e7748d1c5e3
.rar
BetterWMF 6.00/BClipbrd.exe
.exe windows:4 windows x86 arch:x86

025cdffcb3a4f736b0124c8a783ae7ce

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
HeapSize
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
Sleep
TerminateProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetOEMCP
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
VirtualAlloc
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
HeapReAlloc
RaiseException
GetSystemTimeAsFileTime
RtlUnwind
GetStartupInfoW
GetProcessHeap
HeapAlloc
HeapFree
SetErrorMode
GlobalFlags
lstrlenA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
InterlockedIncrement
GetVersionExW
GetFileTime
GetFileAttributesW
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileW
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
GlobalGetAtomNameW
GetCurrentProcessId
GetCurrentThread
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
CloseHandle
WaitForSingleObject
GetModuleHandleA
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryW
CompareStringW
lstrcmpW
GetVersionExA
WideCharToMultiByte
FreeLibrary
InterlockedDecrement
GetModuleFileNameW
GetModuleHandleW
SetLastError
GlobalFree
LoadLibraryA
GetProcAddress
lstrlenW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
CreateMutexW
MultiByteToWideChar
GetLastError
FormatMessageW
LocalFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FindResourceW
LoadResource
LockResource
GetACP
SizeofResource

user32

UnpackDDElParam
GetTabbedTextExtentA
CharUpperW
GetMenuItemInfoW
SystemParametersInfoW
GetSysColorBrush
TranslateMessage
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
CheckMenuItem
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
IsWindowEnabled
ShowWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
ReuseDDElParam
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
IsWindowVisible
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
PtInRect
GetDlgCtrlID
SetWindowPos
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
UnhookWindowsHookEx
GetMenuState
GetMenu
GetMenuItemCount
LoadBitmapW
MessageBeep
GetClientRect
EnumClipboardFormats
GetClipboardFormatNameW
GetClipboardData
GetParent
TrackPopupMenu
GetSystemMetrics
SetMenuDefaultItem
IsWindow
ReleaseDC
GetDC
LoadMenuW
GetSubMenu
GetMenuItemID
RegisterWindowMessageW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetClipboardViewer
ChangeClipboardChain
IsClipboardFormatAvailable
PostMessageW
FindWindowW
SetCursor
KillTimer
SetTimer
DestroyMenu
ReleaseCapture
LoadAcceleratorsW
InsertMenuItemW
CreatePopupMenu
SetRectEmpty
BringWindowToTop
RedrawWindow
UpdateWindow
SetMenu
TranslateAcceleratorW
ShowOwnedPopups
PostQuitMessage
GetDlgItem
GetMessageW
MessageBoxW
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetPropW
RemovePropW
SetWindowLongW
GetPropW
CallWindowProcW
GetDesktopWindow
GetKeyState
SetForegroundWindow
GetSysColor
GetCursorPos
SendMessageW
GetWindowLongW
EnableWindow
InvalidateRect
ScreenToClient
GetWindowRect
DrawEdge
FrameRect
FillRect
OffsetRect
InflateRect
CopyRect
UnregisterClassW
LoadIconW
LoadCursorW
DefWindowProcW
UnregisterClassA

gdi32

RestoreDC
GetPixel
PtVisible
RectVisible
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
CreatePatternBrush
CreatePen
SaveDC
SetBkColor
SetTextColor
GetClipBox
CreateFontW
BitBlt
SetTextAlign
MoveToEx
SetMapMode
SetPolyFillMode
CreateSolidBrush
PatBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
CreateMetaFileW
CloseMetaFile
GetMetaFileBitsEx
CopyMetaFileW
EnumMetaFile
DeleteEnhMetaFile
DeleteDC
GetTextExtentPoint32W
DeleteMetaFile
CloseEnhMetaFile
CreateEnhMetaFileW
GetCurrentObject
GetTextMetricsW
GetTextAlign
SelectObject
GetDeviceCaps
CreateDCW
PlayMetaFileRecord
GetStockObject
GetObjectW
CreateFontIndirectW
DeleteObject
TextOutW
Rectangle
Polygon
SetBkMode

comdlg32

GetFileTitleW
GetSaveFileNameW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

RegCreateKeyExW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyW
RegOpenKeyExA
RegQueryValueExA
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyW

shell32

Shell_NotifyIconW
DragFinish
DragQueryFileW
ShellExecuteW

comctl32

ord17

shlwapi

PathFindFileNameW
PathStripToRootW
PathFindExtensionW
PathIsUNCW

oleaut32

VariantClear
VariantChangeType
VariantInit

Sections

.text
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 324KB - Virtual size: 322KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
BetterWMF 6.00/BWMFREG.INI
BetterWMF 6.00/BetterWMF.chm
.chm
BetterWMF 6.00/Bwmf2007.arx
.dll windows:4 windows x86 arch:x86

e3d6d8a4af49d499fda4b903f4740dd4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

acdb17

?xrefSubCommandStart@AcRxEventReactor@@UAEXPAVAcDbDatabase@@W4AcXrefSubCommand@@ABV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@PBQB_W3AA_N@Z
?xrefSubCommandAborted@AcRxEventReactor@@UAEXPAVAcDbDatabase@@W4AcXrefSubCommand@@ABV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@PBQB_W3@Z
?preXrefLockFile@AcRxEventReactor@@UAEXPAVAcDbDatabase@@VAcDbObjectId@@@Z
s_pServices
?tilemode@AcDbDatabase@@QBE_NXZ
acrxSysRegistry
?acrxUnlockApplication@@YA_NPAX@Z
?getSymbolTable@AcDbDatabase@@QAE?AW4ErrorStatus@Acad@@AAPAVAcDbBlockTable@@W4OpenMode@AcDb@@@Z
?desc@AcDbViewport@@SAPAVAcRxClass@@XZ
?step@AcDbBlockTableRecordIterator@@QAEX_N0@Z
?centerPoint@AcDbViewport@@QBE?AVAcGePoint3d@@XZ
?width@AcDbViewport@@QBENXZ
?number@AcDbViewport@@QBEFXZ
?height@AcDbViewport@@QBENXZ
?getEntity@AcDbBlockTableRecordIterator@@QBE?AW4ErrorStatus@Acad@@AAPAVAcDbEntity@@W4OpenMode@AcDb@@_N@Z
?done@AcDbBlockTableRecordIterator@@QBE_NXZ
?newIterator@AcDbBlockTableRecord@@QBE?AW4ErrorStatus@Acad@@AAPAVAcDbBlockTableRecordIterator@@_N1@Z
?close@AcDbObject@@QAE?AW4ErrorStatus@Acad@@XZ
?desc@AcRxDynamicLinker@@SAPAVAcRxClass@@XZ
??0AcRxObject@@IAE@XZ
?comparedTo@AcRxObject@@UBE?AW4Ordering@AcRx@@PBV1@@Z
?isEqualTo@AcRxObject@@UBEHPBV1@@Z
?copyFrom@AcRxObject@@UAE?AW4ErrorStatus@Acad@@PBV1@@Z
?clone@AcRxObject@@UBEPAV1@XZ
?getAt@AcDbBlockTable@@QBE?AW4ErrorStatus@Acad@@PB_WAAPAVAcDbBlockTableRecord@@W4OpenMode@AcDb@@_N@Z
acutPrintf

acad.exe

acedSSGet
?acDocManagerPtr@@YAPAVAcApDocManager@@XZ
?acedGetAcadDwgView@@YAPAVCView@@XZ
acedGetKword
acedInitGet
acedGetVar
acedRetStr
acedRetT
acedGetArgs
acedRetNil
acedRetReal
?acedCoordFromPixelToWorld@@YAXABVCPoint@@QAN@Z
acedUsrBrk
acedSSSetFirst
acedSetVar
acedGetString
?acedGetRGB@@YAKH@Z
acedSSFree
ads_queueexpr
acedDefun
acedRegFunc
adsw_acadMainWnd
acedSSLength
acedCommand
acedRetInt

acge17

??0AcGePoint3d@@QAE@XZ

mfc80u

ord577
ord2155
ord2651
ord6232
ord4729
ord1479
ord870
ord2895
ord6111
ord282
ord6700
ord1472
ord3204
ord1925
ord3157
ord1271
ord572
ord3158
ord4255
ord4480
ord3943
ord2638
ord3703
ord3713
ord3712
ord2985
ord2527
ord2640
ord2534
ord2856
ord2708
ord4301
ord2829
ord2725
ord2531
ord5196
ord1590
ord1646
ord1647
ord1955
ord5171
ord1353
ord4961
ord3339
ord6275
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2397
ord2409
ord2386
ord2402
ord2407
ord2390
ord2392
ord2394
ord2388
ord2404
ord2384
ord931
ord927
ord929
ord925
ord920
ord5229
ord5231
ord5956
ord1591
ord4276
ord4716
ord3397
ord5210
ord293
ord6271
ord5067
ord1899
ord5148
ord4226
ord1393
ord3940
ord1608
ord1611
ord5911
ord6721
ord1536
ord2077
ord587
ord3223
ord4231
ord1561
ord2082
ord4093
ord1475
ord1924
ord6262
ord1388
ord657
ord605
ord354
ord3176
ord4256
ord5199
ord4238
ord1392
ord5908
ord6720
ord1542
ord1661
ord1662
ord2011
ord4884
ord4206
ord5178
ord1784
ord1769
ord1876
ord1785
ord6063
ord2311
ord5609
ord4574
ord5637
ord502
ord5636
ord774
ord3990
ord5558
ord5934
ord326
ord2361
ord2010
ord333
ord4098
ord3635
ord4347
ord283
ord1894
ord1058
ord4100
ord860
ord280
ord5803
ord6086
ord2159
ord894
ord2366
ord6061
ord6279
ord1386
ord3678
ord4314
ord776
ord5705
ord2260
ord3927
ord1155
ord4109
ord5727
ord3198
ord3311
ord4234
ord1582
ord2086
ord741
ord3756
ord290
ord287
ord4078
ord277
ord281
ord762
ord2362
ord1270
ord1299
ord1118
ord2167
ord1957
ord3249
ord5128
ord6058
ord434
ord1908
ord1430
ord6284
ord5083
ord629
ord384
ord602
ord668
ord5716
ord1920
ord347
ord5319
ord5621
ord383
ord896
ord3383
ord1476
ord3082
ord630
ord2012
ord385
ord3165
ord4228
ord1538
ord2080
ord4092
ord1474
ord1922
ord591
ord1864
ord1782
ord1765
ord1883
ord5829
ord2893
ord3155
ord5633
ord760
ord3331
ord1156
ord709
ord501
ord5398
ord2460
ord6031
ord5638
ord6033
ord5723
ord589
ord330
ord2247
ord2365
ord1781
ord2046
ord1087
ord332
ord899
ord1168
ord371
ord1093
ord1079
ord764
ord4179
ord1086

msvcr80

_time64
swscanf
_vswprintf
isalnum
free
malloc
_CIcos
_CIsin
_swprintf
floor
memset
_wcsnicmp
wcstok
_waccess
fclose
_wfopen
_wmakepath
_wsplitpath
_wunlink
_unlock
_encode_pointer
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
wcsftime
__CxxFrameHandler3
memcpy
_localtime64_s

kernel32

GlobalLock
GlobalAlloc
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrlenW
GetModuleFileNameW
GetCurrentThreadId
CreateMutexW
GetProcAddress
LoadLibraryA
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
WritePrivateProfileStringW
MulDiv
GetTickCount
GlobalUnlock
LocalFree
FormatMessageW
GetLastError

user32

SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
PostMessageW
FindWindowW
DestroyWindow
CreateWindowExW
GetMenu
RemoveMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetSystemMetrics
GetClientRect
LoadBitmapW
IsClipboardFormatAvailable
EnumClipboardFormats
GetClipboardFormatNameW
GetClipboardData
RegisterWindowMessageW
DefWindowProcW
LoadCursorW
LoadIconW
UnregisterClassW
CopyRect
InflateRect
OffsetRect
FillRect
FrameRect
DrawEdge
GetWindowRect
ScreenToClient
InvalidateRect
EnableWindow
GetWindowLongW
SendMessageW
GetSysColor
GetCursorPos
SetForegroundWindow
GetKeyState
GetDesktopWindow
MessageBoxW
UpdateWindow
RedrawWindow
SetTimer
KillTimer
SetCursor
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
MessageBeep

gdi32

DeleteObject
GetObjectW
Rectangle
Polygon
CreateSolidBrush
TextOutW
CreateFontIndirectW
PatBlt
PlayMetaFileRecord
CreateFontW
BitBlt
CreateCompatibleDC
SetMetaFileBitsEx
CopyMetaFileW
DeleteEnhMetaFile
DeleteDC
EnumMetaFile
GetMetaFileBitsEx
GetTextExtentPoint32W
DeleteMetaFile
CloseEnhMetaFile
CreateEnhMetaFileW
CloseMetaFile
CreateMetaFileW
GetCurrentObject
GetStockObject
GetTextMetricsW
GetTextAlign
SelectObject
CreateDCW
GetDeviceCaps

advapi32

RegCreateKeyW
RegOpenKeyW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegQueryValueExA
RegOpenKeyExA

shell32

ShellExecuteW

comctl32

ord17

Exports

Exports

acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 328KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BetterWMF 6.00/Bwmf2008x64.arx
.dll windows:4 windows x64 arch:x64

87bbfe6a97e16715f8b7543ab7fb0af3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

acdb17

?xrefSubCommandStart@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@W4AcXrefSubCommand@@AEBV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@PEBQEB_W3AEA_N@Z
?xrefSubCommandAborted@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@W4AcXrefSubCommand@@AEBV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@PEBQEB_W3@Z
?preXrefLockFile@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@VAcDbObjectId@@@Z
s_pServices
?tilemode@AcDbDatabase@@QEBA_NXZ
acrxSysRegistry
?acrxUnlockApplication@@YA_NPEAX@Z
?getSymbolTable@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAVAcDbBlockTable@@W4OpenMode@AcDb@@@Z
?desc@AcDbViewport@@SAPEAVAcRxClass@@XZ
?step@AcDbBlockTableRecordIterator@@QEAAX_N0@Z
?centerPoint@AcDbViewport@@QEBA?AVAcGePoint3d@@XZ
?width@AcDbViewport@@QEBANXZ
?number@AcDbViewport@@QEBAFXZ
?height@AcDbViewport@@QEBANXZ
?getEntity@AcDbBlockTableRecordIterator@@QEBA?AW4ErrorStatus@Acad@@AEAPEAVAcDbEntity@@W4OpenMode@AcDb@@_N@Z
?done@AcDbBlockTableRecordIterator@@QEBA_NXZ
?newIterator@AcDbBlockTableRecord@@QEBA?AW4ErrorStatus@Acad@@AEAPEAVAcDbBlockTableRecordIterator@@_N1@Z
?close@AcDbObject@@QEAA?AW4ErrorStatus@Acad@@XZ
?desc@AcRxDynamicLinker@@SAPEAVAcRxClass@@XZ
??0AcRxObject@@IEAA@XZ
?comparedTo@AcRxObject@@UEBA?AW4Ordering@AcRx@@PEBV1@@Z
?isEqualTo@AcRxObject@@UEBAHPEBV1@@Z
?copyFrom@AcRxObject@@UEAA?AW4ErrorStatus@Acad@@PEBV1@@Z
?clone@AcRxObject@@UEBAPEAV1@XZ
?getAt@AcDbBlockTable@@QEBA?AW4ErrorStatus@Acad@@PEB_WAEAPEAVAcDbBlockTableRecord@@W4OpenMode@AcDb@@_N@Z
acutPrintf

acad.exe

?acedGetAcadDwgView@@YAPEAVCView@@XZ
?acedCoordFromPixelToWorld@@YAXAEBVCPoint@@QEAN@Z
acedUsrBrk
acedSSSetFirst
acedSetVar
acedGetString
acedSSGet
acedSSFree
ads_queueexpr
acedDefun
acedRegFunc
adsw_acadMainWnd
acedSSLength
acedCommand
acedRetInt
acedRetReal
acedRetNil
acedGetArgs
acedRetT
acedRetStr
acedGetVar
acedInitGet
acedGetKword
?acedGetRGB@@YAKH@Z
?acDocManagerPtr@@YAPEAVAcApDocManager@@XZ

mfc80u

ord2183
ord2682
ord6276
ord4766
ord1498
ord884
ord2925
ord6154
ord285
ord2958
ord1491
ord3238
ord1952
ord3191
ord1289
ord583
ord3192
ord4292
ord4517
ord3977
ord2669
ord3737
ord3747
ord3746
ord3017
ord2558
ord2671
ord2565
ord2886
ord2738
ord4338
ord2859
ord2755
ord2562
ord5234
ord1609
ord1670
ord1671
ord1982
ord5209
ord1371
ord4999
ord3373
ord6319
ord3830
ord6317
ord1532
ord2191
ord2197
ord2430
ord2412
ord2410
ord2428
ord2440
ord2417
ord2433
ord2438
ord2421
ord2423
ord2425
ord2419
ord2435
ord2415
ord946
ord942
ord944
ord940
ord935
ord5267
ord5269
ord5996
ord1610
ord4313
ord4753
ord3431
ord5248
ord4216
ord6315
ord588
ord1926
ord5186
ord4263
ord1412
ord3974
ord1633
ord1636
ord5951
ord3080
ord1555
ord2105
ord598
ord3257
ord4268
ord1580
ord2110
ord4128
ord1494
ord1951
ord6306
ord1406
ord669
ord617
ord362
ord3210
ord4293
ord5237
ord4275
ord1411
ord5948
ord3079
ord1561
ord1685
ord1686
ord2039
ord4922
ord4243
ord5216
ord1811
ord1796
ord1903
ord1812
ord6104
ord2342
ord5648
ord4611
ord5676
ord513
ord5675
ord786
ord4025
ord5597
ord5974
ord332
ord2392
ord2038
ord339
ord4133
ord3669
ord4384
ord286
ord1921
ord1073
ord4135
ord874
ord280
ord5842
ord6129
ord2187
ord908
ord2397
ord6102
ord6323
ord1404
ord3712
ord4351
ord788
ord5744
ord2289
ord3961
ord1102
ord296
ord4144
ord5766
ord3232
ord3345
ord4271
ord1601
ord2114
ord753
ord3790
ord293
ord290
ord4113
ord277
ord281
ord774
ord2393
ord1288
ord1317
ord1134
ord2195
ord1984
ord3283
ord5166
ord6099
ord442
ord1935
ord1449
ord6328
ord5121
ord641
ord392
ord614
ord680
ord5755
ord1947
ord355
ord5357
ord5660
ord391
ord910
ord3417
ord1495
ord3116
ord642
ord2040
ord393
ord3199
ord4265
ord1557
ord2108
ord4127
ord1493
ord1949
ord602
ord1891
ord1809
ord1792
ord1910
ord5868
ord2923
ord3189
ord5672
ord772
ord3365
ord1173
ord721
ord512
ord5437
ord2491
ord6072
ord5677
ord6074
ord5762
ord600
ord336
ord2275
ord2396
ord1808
ord2074
ord1103
ord338
ord913
ord1185
ord379
ord1109
ord1171
ord1095
ord776
ord5105

msvcr80

swscanf
_vswprintf
isalnum
free
malloc
cos
sin
_swprintf
floor
memset
_wcsnicmp
wcstok
_waccess
fclose
_wfopen
_wmakepath
_wsplitpath
_wunlink
__C_specific_handler
_unlock
_encode_pointer
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
_initterm
_initterm_e
_encoded_null
_amsg_exit
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
__clean_type_info_names_internal
_localtime64_s
wcsftime
__CxxFrameHandler3
memcpy
_time64

kernel32

GlobalAlloc
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
lstrlenW
GetModuleFileNameW
GetCurrentThreadId
CreateMutexW
GetProcAddress
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LoadLibraryA
GlobalUnlock
GetCurrentProcessId
GlobalLock
LocalFree
FormatMessageW
GetLastError
MulDiv

user32

SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
PostMessageW
FindWindowW
DestroyWindow
CreateWindowExW
GetMenu
RemoveMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetSystemMetrics
GetClientRect
LoadBitmapW
IsClipboardFormatAvailable
EnumClipboardFormats
GetClipboardFormatNameW
GetClipboardData
RegisterWindowMessageW
DefWindowProcW
LoadCursorW
LoadIconW
UnregisterClassW
CopyRect
InflateRect
OffsetRect
FillRect
FrameRect
DrawEdge
GetWindowRect
ScreenToClient
InvalidateRect
EnableWindow
GetWindowLongW
SendMessageW
GetSysColor
GetCursorPos
SetForegroundWindow
GetKeyState
GetDesktopWindow
MessageBoxW
UpdateWindow
RedrawWindow
SetTimer
KillTimer
SetCursor
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
MessageBeep

gdi32

GetStockObject
GetObjectW
CreateFontIndirectW
DeleteObject
PlayMetaFileRecord
Rectangle
Polygon
CreateSolidBrush
CreateDCW
GetDeviceCaps
CloseEnhMetaFile
SelectObject
GetTextAlign
GetTextMetricsW
GetCurrentObject
CreateMetaFileW
CloseMetaFile
TextOutW
PatBlt
CreateFontW
BitBlt
CreateEnhMetaFileW
CreateCompatibleDC
SetMetaFileBitsEx
CopyMetaFileW
DeleteEnhMetaFile
DeleteDC
EnumMetaFile
GetMetaFileBitsEx
GetTextExtentPoint32W
DeleteMetaFile

advapi32

RegOpenKeyW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyW

shell32

ShellExecuteW

comctl32

ord17

Exports

Exports

acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 326KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BetterWMF 6.00/Bwmf2010.arx
.dll windows:5 windows x86 arch:x86

c162b3d96af00db64bc1ab766e6e00b0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

acdb18

?desc@AcDbViewport@@SAPAVAcRxClass@@XZ
?getSymbolTable@AcDbDatabase@@QAE?AW4ErrorStatus@Acad@@AAPAVAcDbBlockTable@@W4OpenMode@AcDb@@@Z
?getAt@AcDbBlockTable@@QBE?AW4ErrorStatus@Acad@@PB_WAAPAVAcDbBlockTableRecord@@W4OpenMode@AcDb@@_N@Z
?newIterator@AcDbBlockTableRecord@@QBE?AW4ErrorStatus@Acad@@AAPAVAcDbBlockTableRecordIterator@@_N1@Z
?step@AcDbBlockTableRecordIterator@@QAEX_N0@Z
?done@AcDbBlockTableRecordIterator@@QBE_NXZ
?getEntity@AcDbBlockTableRecordIterator@@QBE?AW4ErrorStatus@Acad@@AAPAVAcDbEntity@@W4OpenMode@AcDb@@_N@Z
?height@AcDbViewport@@QBENXZ
?number@AcDbViewport@@QBEFXZ
?width@AcDbViewport@@QBENXZ
?centerPoint@AcDbViewport@@QBE?AVAcGePoint3d@@XZ
?desc@AcRxDynamicLinker@@SAPAVAcRxClass@@XZ
?acrxUnlockApplication@@YA_NPAX@Z
?preXrefLockFile@AcRxEventReactor@@UAEXPAVAcDbDatabase@@VAcDbObjectId@@@Z
?xrefSubCommandAborted@AcRxEventReactor@@UAEXPAVAcDbDatabase@@W4AcXrefSubCommand@@ABV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@PBQB_W3@Z
?xrefSubCommandStart@AcRxEventReactor@@UAEXPAVAcDbDatabase@@W4AcXrefSubCommand@@ABV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@PBQB_W3AA_N@Z
?endRestore@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?abortRestore@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?beginRestore@AcRxEventReactor@@UAEXPAVAcDbDatabase@@PB_W0@Z
?comandeered@AcRxEventReactor@@UAEXPAVAcDbDatabase@@VAcDbObjectId@@0@Z
?redirected@AcRxEventReactor@@UAEXVAcDbObjectId@@0@Z
?endAttach@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?abortAttach@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?otherAttach@AcRxEventReactor@@UAEXPAVAcDbDatabase@@0@Z
?beginAttach@AcRxEventReactor@@UAEXPAVAcDbDatabase@@PB_W0@Z
?partialOpenNotice@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?endDeepClone@AcRxEventReactor@@UAEXAAVAcDbIdMapping@@@Z
?abortDeepClone@AcRxEventReactor@@UAEXAAVAcDbIdMapping@@@Z
?beginDeepCloneXlation@AcRxEventReactor@@UAEXAAVAcDbIdMapping@@PAW4ErrorStatus@Acad@@@Z
?beginDeepClone@AcRxEventReactor@@UAEXPAVAcDbDatabase@@AAVAcDbIdMapping@@@Z
?beginWblockObjects@AcRxEventReactor@@UAEXPAVAcDbDatabase@@AAVAcDbIdMapping@@@Z
?endWblock@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?abortWblock@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?otherWblock@AcRxEventReactor@@UAEXPAVAcDbDatabase@@AAVAcDbIdMapping@@0@Z
?beginWblock@AcRxEventReactor@@UAEXPAVAcDbDatabase@@0AAPBVAcGePoint3d@@@Z
?beginWblock@AcRxEventReactor@@UAEXPAVAcDbDatabase@@0VAcDbObjectId@@@Z
?beginWblock@AcRxEventReactor@@UAEXPAVAcDbDatabase@@0@Z
?wblockNotice@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?endInsert@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?abortInsert@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?otherInsert@AcRxEventReactor@@UAEXPAVAcDbDatabase@@AAVAcDbIdMapping@@0@Z
?beginInsert@AcRxEventReactor@@UAEXPAVAcDbDatabase@@PB_W0@Z
?beginInsert@AcRxEventReactor@@UAEXPAVAcDbDatabase@@ABVAcGeMatrix3d@@0@Z
?dxfOutComplete@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?abortDxfOut@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?beginDxfOut@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?dxfInComplete@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?abortDxfIn@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?beginDxfIn@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?abortSave@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?saveComplete@AcRxEventReactor@@UAEXPAVAcDbDatabase@@PB_W@Z
?beginSave@AcRxEventReactor@@UAEXPAVAcDbDatabase@@PB_W@Z
?databaseToBeDestroyed@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?databaseConstructed@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?initialDwgFileOpenComplete@AcRxEventReactor@@UAEXPAVAcDbDatabase@@@Z
?dwgFileOpened@AcRxEventReactor@@UAEXPAVAcDbDatabase@@PA_W@Z
?comparedTo@AcRxObject@@UBE?AW4Ordering@AcRx@@PBV1@@Z
?isEqualTo@AcRxObject@@UBEHPBV1@@Z
?copyFrom@AcRxObject@@UAE?AW4ErrorStatus@Acad@@PBV1@@Z
?clone@AcRxObject@@UBEPAV1@XZ
?isA@AcRxEventReactor@@UBEPAVAcRxClass@@XZ
acutPrintf
??0AcRxObject@@IAE@XZ
acrxSysRegistry
?acdbHostApplicationServices@@YAPAVAcDbHostApplicationServices@@XZ
?tilemode@AcDbDatabase@@QBE_NXZ
?close@AcDbObject@@QAE?AW4ErrorStatus@Acad@@XZ

acad.exe

acedRetNil
acedGetVar
?acedGetRGB@@YAKH@Z
acedRetT
acedGetArgs
acedRetReal
acedRetInt
acedCommand
acedSSLength
acedSSFree
acedSSGet
acedGetString
acedGetKword
acedInitGet
adsw_acadMainWnd
ads_queueexpr
acedRegFunc
acedDefun
acedSetVar
acedSSSetFirst
acedUsrBrk
?acedCoordFromPixelToWorld@@YAXABVCPoint@@QAN@Z
?acedGetAcadDwgView@@YAPAVCView@@XZ
?acDocManagerPtr@@YAPAVAcApDocManager@@XZ
acedRetStr

mfc90u

ord3537
ord4530
ord4527
ord6187
ord4131
ord293
ord290
ord4494
ord277
ord281
ord3589
ord2084
ord1552
ord663
ord5770
ord403
ord3729
ord6079
ord5582
ord6574
ord1353
ord454
ord799
ord2141
ord1383
ord636
ord703
ord6175
ord2097
ord367
ord2593
ord935
ord6813
ord5535
ord404
ord2372
ord1603
ord3399
ord664
ord2209
ord405
ord3496
ord4654
ord1667
ord2277
ord4510
ord1601
ord2103
ord615
ord2038
ord1935
ord1918
ord2057
ord3183
ord6311
ord797
ord3674
ord3486
ord1222
ord6091
ord744
ord524
ord613
ord5851
ord2694
ord6096
ord337
ord6545
ord6547
ord6183
ord2455
ord1934
ord2243
ord2596
ord1145
ord339
ord938
ord1239
ord391
ord1152
ord2283
ord1719
ord4660
ord3654
ord778
ord4324
ord2478
ord6164
ord1250
ord1254
ord5603
ord933
ord1333
ord2364
ord2597
ord1486
ord6808
ord6577
ord813
ord4741
ord4044
ord286
ord4774
ord6604
ord2069
ord1108
ord6275
ord899
ord4518
ord2106
ord1183
ord3543
ord3220
ord285
ord6630
ord1607
ord280
ord5167
ord4516
ord4630
ord5166
ord3236
ord3498
ord340
ord2207
ord3488
ord3622
ord2592
ord333
ord6094
ord525
ord6095
ord6444
ord1354
ord6013
ord1599
ord3185
ord4405
ord811
ord5008
ord6065
ord6760
ord2537
ord909
ord2904
ord6579
ord2360
ord4000
ord1938
ord2050
ord1922
ord1937
ord692
ord1488
ord6791
ord2105
ord1602
ord4511
ord2279
ord1695
ord4657
ord3562
ord2274
ord1665
ord3355
ord6411
ord1493
ord4652
ord5664
ord3286
ord4681
ord3489
ord5632
ord4631
ord5324
ord2208
ord1810
ord1809
ord1675
ord3353
ord6408
ord1754
ord1751
ord4345
ord1492
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord5653
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord2615
ord2635
ord2619
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3682
ord5404
ord6376
ord3226
ord1442
ord5625
ord2139
ord1792
ord1791
ord1727
ord5650
ord2771
ord2983
ord3112
ord4728
ord2966
ord3140
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4910
ord4682
ord3515
ord374
ord595
ord639
ord611
ord600
ord296
ord1137
ord1220
ord801
ord1144

msvcr90

__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_wunlink
wcscmp
_wsplitpath
_wmakepath
_wfopen
fclose
_waccess
wcstok
_wcsnicmp
floor
_swprintf
sin
cos
malloc
free
isalnum
wcscpy
_vswprintf
swscanf
_time64
_localtime64_s
wcsftime
memset
wcslen
__CxxFrameHandler3
memcpy
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
?terminate@@YAXXZ

kernel32

GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryA
GetProcAddress
ExpandEnvironmentStringsA
CreateMutexW
GetCurrentThreadId
GetModuleFileNameW
lstrlenW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
OutputDebugStringW
GetLastError
FormatMessageW
LocalFree
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTickCount
QueryPerformanceCounter

user32

GetMenuItemCount
GetSubMenu
GetMenuItemID
RemoveMenu
GetClientRect
GetSystemMetrics
LoadBitmapW
MessageBeep
IsClipboardFormatAvailable
EnumClipboardFormats
GetClipboardFormatNameW
GetClipboardData
GetParent
RegisterWindowMessageW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetCursor
UpdateWindow
KillTimer
SetTimer
RedrawWindow
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
GetMenu
GetKeyState
GetDesktopWindow
SetForegroundWindow
EnableWindow
GetCursorPos
ScreenToClient
DrawEdge
CopyRect
InflateRect
FrameRect
FillRect
GetSysColor
OffsetRect
GetWindowLongW
GetWindowRect
InvalidateRect
SendMessageW
UnregisterClassW
LoadIconW
LoadCursorW
DefWindowProcW
FindWindowW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
DestroyWindow
CreateWindowExW
MessageBoxW
PostMessageW

gdi32

PatBlt
CreateFontW
CreateCompatibleDC
BitBlt
SelectObject
GetTextExtentPoint32W
GetTextMetricsW
GetTextAlign
GetCurrentObject
CreateDCW
GetDeviceCaps
CreateEnhMetaFileW
CloseEnhMetaFile
DeleteEnhMetaFile
DeleteDC
PlayMetaFileRecord
EnumMetaFile
CloseMetaFile
CreateMetaFileW
SetMetaFileBitsEx
CopyMetaFileW
DeleteMetaFile
DeleteObject
GetStockObject
GetObjectW
Rectangle
CreateFontIndirectW
Polygon
CreateSolidBrush
TextOutW
GetMetaFileBitsEx

comdlg32

GetSaveFileNameW
CommDlgExtendedError

advapi32

RegCloseKey
RegCreateKeyW
RegOpenKeyExA
RegQueryValueExA
RegSetValueExW
RegOpenKeyW
RegQueryValueExW

shell32

ShellExecuteW

comctl32

ord17

Exports

Exports

acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 326KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BetterWMF 6.00/Bwmf2010x64.arx
.dll windows:5 windows x64 arch:x64

e65ff539eb0fa0174e2965746299ad68

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

acdb18

?desc@AcDbViewport@@SAPEAVAcRxClass@@XZ
?getSymbolTable@AcDbDatabase@@QEAA?AW4ErrorStatus@Acad@@AEAPEAVAcDbBlockTable@@W4OpenMode@AcDb@@@Z
?getAt@AcDbBlockTable@@QEBA?AW4ErrorStatus@Acad@@PEB_WAEAPEAVAcDbBlockTableRecord@@W4OpenMode@AcDb@@_N@Z
?newIterator@AcDbBlockTableRecord@@QEBA?AW4ErrorStatus@Acad@@AEAPEAVAcDbBlockTableRecordIterator@@_N1@Z
?step@AcDbBlockTableRecordIterator@@QEAAX_N0@Z
?done@AcDbBlockTableRecordIterator@@QEBA_NXZ
?getEntity@AcDbBlockTableRecordIterator@@QEBA?AW4ErrorStatus@Acad@@AEAPEAVAcDbEntity@@W4OpenMode@AcDb@@_N@Z
?height@AcDbViewport@@QEBANXZ
?number@AcDbViewport@@QEBAFXZ
?width@AcDbViewport@@QEBANXZ
?centerPoint@AcDbViewport@@QEBA?AVAcGePoint3d@@XZ
?desc@AcRxDynamicLinker@@SAPEAVAcRxClass@@XZ
?acrxUnlockApplication@@YA_NPEAX@Z
?preXrefLockFile@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@VAcDbObjectId@@@Z
?xrefSubCommandAborted@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@W4AcXrefSubCommand@@AEBV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@PEBQEB_W3@Z
?xrefSubCommandStart@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@W4AcXrefSubCommand@@AEBV?$AcArray@VAcDbObjectId@@V?$AcArrayMemCopyReallocator@VAcDbObjectId@@@@@@PEBQEB_W3AEA_N@Z
?endRestore@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?abortRestore@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?beginRestore@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@PEB_W0@Z
?comandeered@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@VAcDbObjectId@@0@Z
?redirected@AcRxEventReactor@@UEAAXVAcDbObjectId@@0@Z
?endAttach@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?abortAttach@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?otherAttach@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@0@Z
?beginAttach@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@PEB_W0@Z
?partialOpenNotice@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?endDeepClone@AcRxEventReactor@@UEAAXAEAVAcDbIdMapping@@@Z
?abortDeepClone@AcRxEventReactor@@UEAAXAEAVAcDbIdMapping@@@Z
?beginDeepCloneXlation@AcRxEventReactor@@UEAAXAEAVAcDbIdMapping@@PEAW4ErrorStatus@Acad@@@Z
?beginDeepClone@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@AEAVAcDbIdMapping@@@Z
?beginWblockObjects@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@AEAVAcDbIdMapping@@@Z
?endWblock@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?abortWblock@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?otherWblock@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@AEAVAcDbIdMapping@@0@Z
?beginWblock@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@0AEAPEBVAcGePoint3d@@@Z
?beginWblock@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@0VAcDbObjectId@@@Z
?beginWblock@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@0@Z
?wblockNotice@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?endInsert@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?abortInsert@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?otherInsert@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@AEAVAcDbIdMapping@@0@Z
?beginInsert@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@PEB_W0@Z
?beginInsert@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@AEBVAcGeMatrix3d@@0@Z
?dxfOutComplete@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?abortDxfOut@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?beginDxfOut@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?dxfInComplete@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?abortDxfIn@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?beginDxfIn@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?abortSave@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?saveComplete@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@PEB_W@Z
?beginSave@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@PEB_W@Z
?databaseToBeDestroyed@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?databaseConstructed@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?initialDwgFileOpenComplete@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@@Z
?dwgFileOpened@AcRxEventReactor@@UEAAXPEAVAcDbDatabase@@PEA_W@Z
?comparedTo@AcRxObject@@UEBA?AW4Ordering@AcRx@@PEBV1@@Z
?isEqualTo@AcRxObject@@UEBAHPEBV1@@Z
?copyFrom@AcRxObject@@UEAA?AW4ErrorStatus@Acad@@PEBV1@@Z
?clone@AcRxObject@@UEBAPEAV1@XZ
?isA@AcRxEventReactor@@UEBAPEAVAcRxClass@@XZ
acutPrintf
??0AcRxObject@@IEAA@XZ
acrxSysRegistry
?acdbHostApplicationServices@@YAPEAVAcDbHostApplicationServices@@XZ
?tilemode@AcDbDatabase@@QEBA_NXZ
?close@AcDbObject@@QEAA?AW4ErrorStatus@Acad@@XZ

acad.exe

acedRetNil
acedGetVar
?acedGetRGB@@YAKH@Z
acedRetT
acedGetArgs
acedRetReal
acedRetInt
acedCommand
acedSSLength
acedSSFree
acedSSGet
acedGetString
acedGetKword
acedInitGet
adsw_acadMainWnd
ads_queueexpr
acedRegFunc
acedDefun
acedSetVar
acedSSSetFirst
acedUsrBrk
?acedCoordFromPixelToWorld@@YAXAEBVCPoint@@QEAN@Z
?acedGetAcadDwgView@@YAPEAVCView@@XZ
?acDocManagerPtr@@YAPEAVAcApDocManager@@XZ
acedRetStr

mfc90u

ord3291
ord4225
ord4222
ord5861
ord3862
ord293
ord290
ord4191
ord277
ord281
ord3343
ord1963
ord1468
ord641
ord5452
ord391
ord3480
ord5755
ord5264
ord6204
ord1306
ord442
ord777
ord2012
ord1335
ord614
ord681
ord5850
ord1975
ord355
ord2433
ord913
ord6434
ord5217
ord392
ord2230
ord1516
ord3173
ord642
ord2068
ord393
ord3257
ord4345
ord1578
ord2136
ord4205
ord1514
ord1977
ord602
ord1919
ord1837
ord1820
ord1938
ord2973
ord5966
ord775
ord3428
ord3247
ord1188
ord5767
ord722
ord512
ord600
ord5532
ord2531
ord5772
ord336
ord6177
ord6179
ord5857
ord2311
ord1836
ord2102
ord2436
ord1111
ord338
ord916
ord1201
ord379
ord1118
ord2142
ord1626
ord4351
ord3408
ord756
ord4035
ord2325
ord5839
ord1211
ord1215
ord5285
ord911
ord1287
ord2222
ord2437
ord1422
ord6429
ord6207
ord791
ord4432
ord3784
ord286
ord4465
ord6234
ord1949
ord1080
ord5938
ord877
ord4213
ord1980
ord1149
ord3297
ord3008
ord285
ord6259
ord1519
ord280
ord4856
ord4211
ord4321
ord4855
ord3024
ord3259
ord339
ord2066
ord3249
ord3376
ord2432
ord332
ord5770
ord513
ord5771
ord6079
ord1307
ord5692
ord1512
ord2975
ord4103
ord789
ord4699
ord5743
ord6381
ord2378
ord887
ord2722
ord6209
ord2218
ord3740
ord1840
ord1931
ord1824
ord1839
ord670
ord1424
ord6412
ord1979
ord1515
ord4206
ord2138
ord1602
ord4348
ord3316
ord2133
ord1576
ord3137
ord6056
ord1430
ord4343
ord5346
ord3073
ord4372
ord3250
ord5314
ord4322
ord5013
ord2067
ord1714
ord1713
ord1582
ord3135
ord6053
ord1661
ord1658
ord4048
ord1429
ord4355
ord5284
ord1954
ord5201
ord6421
ord4294
ord5335
ord3494
ord4843
ord4393
ord1635
ord6101
ord5367
ord5365
ord938
ord943
ord947
ord945
ord949
ord2455
ord2475
ord2459
ord2465
ord2463
ord2461
ord2478
ord2473
ord2457
ord2480
ord2468
ord2450
ord2452
ord2470
ord2233
ord2226
ord1553
ord6423
ord3902
ord6425
ord3436
ord5093
ord6027
ord3014
ord1389
ord5307
ord2010
ord1699
ord1698
ord1634
ord5332
ord2602
ord2797
ord2904
ord4419
ord2780
ord2932
ord2605
ord2711
ord2598
ord3818
ord3819
ord3809
ord2709
ord4051
ord4601
ord4373
ord3269
ord362
ord583
ord617
ord598
ord588
ord296
ord1103
ord1186
ord779
ord1110

msvcr90

_amsg_exit
_encoded_null
_initterm_e
_initterm
_malloc_crt
?terminate@@YAXXZ
__CppXcptFilter
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__C_specific_handler
_wunlink
wcscmp
_wsplitpath
_wmakepath
_wfopen
fclose
_waccess
wcstok
_wcsnicmp
floor
_swprintf
sin
cos
malloc
free
isalnum
wcscpy
_vswprintf
swscanf
_time64
_localtime64_s
wcsftime
memset
wcslen
memcpy
__CxxFrameHandler3
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
__clean_type_info_names_internal
_decode_pointer

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
ExpandEnvironmentStringsA
LoadLibraryA
GetProcAddress
CreateMutexW
GetCurrentThreadId
GetModuleFileNameW
lstrlenW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
OutputDebugStringW
GetLastError
FormatMessageW
RtlVirtualUnwind
LocalFree
GetSystemTimeAsFileTime
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter

user32

GetMenuItemCount
GetSubMenu
GetMenuItemID
RemoveMenu
GetClientRect
GetSystemMetrics
LoadBitmapW
MessageBeep
IsClipboardFormatAvailable
EnumClipboardFormats
GetClipboardFormatNameW
GetClipboardData
GetParent
RegisterWindowMessageW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetCursor
UpdateWindow
KillTimer
SetTimer
RedrawWindow
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
GetMenu
GetKeyState
GetDesktopWindow
SetForegroundWindow
EnableWindow
GetCursorPos
ScreenToClient
DrawEdge
CopyRect
InflateRect
FrameRect
FillRect
GetSysColor
OffsetRect
GetWindowLongW
GetWindowRect
InvalidateRect
SendMessageW
UnregisterClassW
LoadIconW
LoadCursorW
DefWindowProcW
FindWindowW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
DestroyWindow
CreateWindowExW
MessageBoxW
PostMessageW

gdi32

PatBlt
CreateFontW
CreateCompatibleDC
BitBlt
SelectObject
GetTextExtentPoint32W
GetTextMetricsW
GetTextAlign
GetCurrentObject
CreateDCW
GetDeviceCaps
CreateEnhMetaFileW
CloseEnhMetaFile
DeleteEnhMetaFile
DeleteDC
PlayMetaFileRecord
EnumMetaFile
CloseMetaFile
CreateMetaFileW
SetMetaFileBitsEx
CopyMetaFileW
DeleteMetaFile
DeleteObject
GetStockObject
GetObjectW
Rectangle
CreateFontIndirectW
Polygon
CreateSolidBrush
TextOutW
GetMetaFileBitsEx

comdlg32

GetSaveFileNameW
CommDlgExtendedError

advapi32

RegCloseKey
RegCreateKeyW
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
RegOpenKeyW
RegQueryValueExW

shell32

ShellExecuteW

comctl32

ord17

Exports

Exports

acrxEntryPoint
acrxGetApiVersion

Sections

.text
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 326KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BetterWMF 6.00/GRAY1.BW3.bak
BetterWMF 6.00/GRAY2.BW.bak3
BetterWMF 6.00/Gray1.bw3
BetterWMF 6.00/Gray2.bw3
BetterWMF 6.00/Readme.txt
BetterWMF 6.00/Register.txt
BetterWMF 6.00/不要读我.txt

Sharing

General

Malware Config

Signatures

Files

025cdffcb3a4f736b0124c8a783ae7ce

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oleaut32

Sections

.text Size: 256KB - Virtual size: 255KB

.rdata Size: 100KB - Virtual size: 99KB

.data Size: 12KB - Virtual size: 32KB

.rsrc Size: 324KB - Virtual size: 322KB

e3d6d8a4af49d499fda4b903f4740dd4

Headers

File Characteristics

Imports

acdb17

acad.exe

acge17

mfc80u

msvcr80

kernel32

user32

gdi32

advapi32

shell32

comctl32

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 77KB

.rdata Size: 40KB - Virtual size: 37KB

.data Size: 4KB - Virtual size: 21KB

.rsrc Size: 328KB - Virtual size: 326KB

.reloc Size: 16KB - Virtual size: 14KB

87bbfe6a97e16715f8b7543ab7fb0af3

Headers

File Characteristics

Imports

acdb17

acad.exe

mfc80u

msvcr80

kernel32

user32

gdi32

advapi32

shell32

comctl32

Exports

Exports

Sections

.text Size: 90KB - Virtual size: 90KB

.rdata Size: 64KB - Virtual size: 64KB

.data Size: 3KB - Virtual size: 23KB

.pdata Size: 7KB - Virtual size: 7KB

.rsrc Size: 326KB - Virtual size: 326KB

.reloc Size: 5KB - Virtual size: 4KB

c162b3d96af00db64bc1ab766e6e00b0

Headers

File Characteristics

Imports

acdb18

acad.exe

mfc90u

msvcr90

kernel32

user32

.text
Size: 256KB - Virtual size: 255KB

.rdata
Size: 100KB - Virtual size: 99KB

.data
Size: 12KB - Virtual size: 32KB

.rsrc
Size: 324KB - Virtual size: 322KB

.text
Size: 80KB - Virtual size: 77KB

.rdata
Size: 40KB - Virtual size: 37KB

.data
Size: 4KB - Virtual size: 21KB

.rsrc
Size: 328KB - Virtual size: 326KB

.reloc
Size: 16KB - Virtual size: 14KB

.text
Size: 90KB - Virtual size: 90KB

.rdata
Size: 64KB - Virtual size: 64KB

.data
Size: 3KB - Virtual size: 23KB

.pdata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 326KB - Virtual size: 326KB

.reloc
Size: 5KB - Virtual size: 4KB

.text
Size: 110KB - Virtual size: 110KB

.rdata
Size: 61KB - Virtual size: 60KB

.data
Size: 3KB - Virtual size: 22KB

.rsrc
Size: 326KB - Virtual size: 326KB

.reloc
Size: 16KB - Virtual size: 15KB

.text
Size: 133KB - Virtual size: 133KB

.rdata
Size: 88KB - Virtual size: 87KB

.data
Size: 4KB - Virtual size: 24KB

.pdata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 326KB - Virtual size: 326KB

.reloc
Size: 6KB - Virtual size: 5KB