6c13929b73cb1665d13c5a9f778bee2a_JaffaCakes118

resource
unpack001/Сʿ4ң/R-Readme.exe
unpack001/Сʿ4ң/uninst.exe
unpack002/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/InstallOptions.dll
unpack003/$PLUGINSDIR/System.dll
unpack001/Сʿ4ң/Сʿ4ң.exe

resource	yara_rule
static1/unpack001/Сʿ4ң/uninst.exe	nsis_installer_1
static1/unpack001/Сʿ4ң/uninst.exe	nsis_installer_2
static1/unpack001/Сʿ4ң/xttSetup2.1.exe	nsis_installer_1
static1/unpack001/Сʿ4ң/xttSetup2.1.exe	nsis_installer_2

.zip

Сʿ4ң/R-Readme.exe

.exe windows:4 windows x86 arch:x86

23dab55e2a25210a84f0bbc9deb32bff

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

htonl

gethostbyname

htons

WSACleanup

WSAStartup

ioctlsocket

setsockopt

ole32

CoInitialize

CoUninitialize

CoCreateInstance

CoFreeUnusedLibraries

CoTaskMemAlloc

CoTaskMemFree

oleaut32

SysFreeString

kernel32

MultiByteToWideChar

lstrlenA

WideCharToMultiByte

GlobalLock

GlobalUnlock

SetFilePointer

ExitProcess

GetModuleHandleA

GetCommandLineA

GetProcessTimes

SetEndOfFile

CopyFileA

CreateEventA

CreateThread

ExitThread

InterlockedDecrement

ResetEvent

WaitForMultipleObjects

GetCurrentThreadId

FreeLibrary

GetThreadPriority

GetCurrentThread

Sleep

GetModuleFileNameA

WaitForSingleObject

GetTickCount

CreateFileMappingA

MapViewOfFile

UnmapViewOfFile

ReleaseMutex

CreateMutexA

SetErrorMode

LoadLibraryA

GetProcAddress

FindClose

FindNextFileA

FindFirstFileA

GetFileSize

WriteFile

ReadFile

CreateFileA

CreateDirectoryA

RemoveDirectoryA

MoveFileA

DeleteFileA

GetFileAttributesA

SystemTimeToFileTime

GetSystemTime

GetTimeZoneInformation

GetUserDefaultLangID

GetLastError

GetVersionExA

GetStartupInfoA

CreateProcessA

CloseHandle

QueryPerformanceCounter

QueryPerformanceFrequency

IsDBCSLeadByte

GetACP

GetCPInfo

GlobalFree

GlobalAlloc

DeleteCriticalSection

InitializeCriticalSection

EnterCriticalSection

LeaveCriticalSection

InterlockedIncrement

GetCurrentProcess

SetThreadPriority

SetEvent

user32

DestroyWindow

SetClipboardData

EmptyClipboard

SetWindowPos

GetWindowRect

GetWindow

UnregisterClassA

DispatchMessageA

TranslateMessage

TranslateAcceleratorA

GetMessageA

LoadAcceleratorsA

RegisterClassA

LoadIconA

UpdateWindow

ShowWindow

PostQuitMessage

DialogBoxParamA

EndDialog

MoveWindow

GetDesktopWindow

SetDlgItemTextA

EnableWindow

GetDlgItemTextA

GetWindowTextLengthA

GetDlgItem

SetMenu

PostThreadMessageA

GetQueueStatus

PeekMessageA

MsgWaitForMultipleObjects

RegisterWindowMessageA

IsClipboardFormatAvailable

GetClipboardData

CloseClipboard

GetWindowLongA

DefWindowProcA

IsWindow

CreateWindowExA

OpenClipboard

GetMenu

BeginPaint

EndPaint

LoadCursorA

SetCursor

KillTimer

SetTimer

PostMessageA

FillRect

GetSubMenu

ReleaseCapture

GetCapture

LoadMenuA

GetMenuItemID

DeleteMenu

ClientToScreen

TrackPopupMenu

SetCapture

GetCursorPos

ScreenToClient

GetClientRect

LoadStringA

MessageBoxA

EnableMenuItem

CheckMenuItem

InvalidateRect

SetWindowLongA

WaitForInputIdle

MapVirtualKeyA

GetKeyState

GetSystemMetrics

DdeInitializeA

DdeCreateStringHandleA

DdeConnect

DdeClientTransaction

DdeDisconnect

DdeFreeStringHandle

DdeUninitialize

GetDC

ReleaseDC

GetDoubleClickTime

SetFocus

DestroyMenu

WindowFromPoint

GetFocus

gdi32

StartDocA

GetClipBox

CreateSolidBrush

BeginPath

FillPath

ExtCreatePen

StrokePath

EndPath

PolyBezierTo

SelectClipPath

RestoreDC

SaveDC

EndPage

StartPage

GdiFlush

DeleteObject

SelectObject

StretchDIBits

SetDIBitsToDevice

CreateCompatibleBitmap

GetObjectA

DeleteDC

CreateDIBSection

GetDeviceCaps

CreateCompatibleDC

BitBlt

RealizePalette

SelectPalette

MoveToEx

LineTo

EnumFontFamiliesA

SetBkMode

LPtoDP

SetTextAlign

IntersectClipRect

SelectClipRgn

ExtTextOutA

ExtTextOutW

SetTextColor

GetTextMetricsA

CreateFontIndirectA

CreatePen

GetClipRgn

CreateRectRgn

GetTextAlign

GetBkMode

GetTextColor

DPtoLP

GetTextExtentPoint32A

GetTextExtentPoint32W

GetCurrentObject

SetBkColor

GetBkColor

CreatePalette

SetPolyFillMode

EndDoc

GetSystemPaletteEntries

comdlg32

GetOpenFileNameA

GetSaveFileNameA

PrintDlgA

advapi32

RegCloseKey

RegQueryValueExA

RegOpenKeyExA

RegSetValueA

RegCreateKeyA

RegSetValueExA

shell32

DragQueryFileA

DragAcceptFiles

winmm

timeGetDevCaps

waveInGetDevCapsA

waveInReset

waveInUnprepareHeader

waveInClose

waveInOpen

waveInPrepareHeader

waveInStop

waveInAddBuffer

waveInStart

waveInGetNumDevs

timeBeginPeriod

waveOutGetNumDevs

waveOutReset

waveOutUnprepareHeader

waveOutPrepareHeader

waveOutWrite

timeSetEvent

timeGetTime

timeEndPeriod

waveOutOpen

waveOutGetDevCapsA

timeKillEvent

waveOutClose

Sections

.text
Size: 604KB - Virtual size: 603KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 831KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.CRT
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

Сʿ4ң/bg/sys/ct/Thumbs.db

Сʿ4ң/bg/sys/ct/bg.dat

Сʿ4ң/bg/sys/ct/pic1.bmp

Сʿ4ң/bg/sys/ct/pic2.bmp

Сʿ4ң/bg/sys/ct/pic3.bmp

Сʿ4ң/bg/sys/ct/pic4.bmp

Сʿ4ң/bg/sys/ct/pic5.bmp

Сʿ4ң/bg/sys/ct/pic6.bmp

Сʿ4ң/bg/sys/ct/pic7.bmp

Сʿ4ң/bg/sys/ct/pic8.bmp

Сʿ4ң/bg/sys/ct/shadow.bmp

Сʿ4ң/bg/sys/cuhk/Thumbs.db

Сʿ4ң/bg/sys/cuhk/a1.bmp

Сʿ4ң/bg/sys/cuhk/a2.bmp

Сʿ4ң/bg/sys/cuhk/bg.dat

Сʿ4ң/bg/sys/cuhk/bu1.bmp

Сʿ4ң/bg/sys/cuhk/floor1.bmp

Сʿ4ң/bg/sys/cuhk/floor2.bmp

Сʿ4ң/bg/sys/cuhk/floor3.bmp

Сʿ4ң/bg/sys/cuhk/grass.bmp

Сʿ4ң/bg/sys/cuhk/grass2.bmp

Сʿ4ң/bg/sys/cuhk/hill.bmp

Сʿ4ң/bg/sys/cuhk/hill2.bmp

Сʿ4ң/bg/sys/cuhk/lamp1.bmp

Сʿ4ң/bg/sys/cuhk/lamp2.bmp

Сʿ4ң/bg/sys/cuhk/lib.bmp

Сʿ4ң/bg/sys/cuhk/right.bmp

Сʿ4ң/bg/sys/cuhk/s.bmp

Сʿ4ң/bg/sys/cuhk/sky1.bmp

Сʿ4ң/bg/sys/cuhk/sky2.bmp

Сʿ4ң/bg/sys/cuhk/statue.bmp

Сʿ4ң/bg/sys/ff/Thumbs.db

Сʿ4ң/bg/sys/ff/bg.dat

Сʿ4ң/bg/sys/ff/pic1.bmp

Сʿ4ң/bg/sys/ff/pic2.bmp

Сʿ4ң/bg/sys/ff/pic3.bmp

Сʿ4ң/bg/sys/ff/pic4.bmp

Сʿ4ң/bg/sys/ff/pic5.bmp

Сʿ4ң/bg/sys/ff/pic6.bmp

Сʿ4ң/bg/sys/ff/pic7.bmp

Сʿ4ң/bg/sys/ff/pic8.bmp

Сʿ4ң/bg/sys/ff/shadow.bmp

Сʿ4ң/bg/sys/ft/Thumbs.db

Сʿ4ң/bg/sys/ft/bg.dat

Сʿ4ң/bg/sys/ft/c1.bmp

Сʿ4ң/bg/sys/ft/c2.bmp

Сʿ4ң/bg/sys/ft/f1.bmp

Сʿ4ң/bg/sys/ft/f2.bmp

Сʿ4ң/bg/sys/ft/f3.bmp

Сʿ4ң/bg/sys/ft/f4.bmp

Сʿ4ң/bg/sys/ft/f5.bmp

Сʿ4ң/bg/sys/ft/f6.bmp

Сʿ4ң/bg/sys/ft/f7.bmp

Сʿ4ң/bg/sys/ft/f8.bmp

Сʿ4ң/bg/sys/ft/f9.bmp

Сʿ4ң/bg/sys/ft/fa.bmp

Сʿ4ң/bg/sys/ft/fb.bmp

Сʿ4ң/bg/sys/ft/fc.bmp

Сʿ4ң/bg/sys/ft/fd.bmp

Сʿ4ң/bg/sys/ft/g1.bmp

Сʿ4ң/bg/sys/ft/g2.bmp

Сʿ4ң/bg/sys/ft/g3.bmp

Сʿ4ң/bg/sys/ft/g4.bmp

Сʿ4ң/bg/sys/ft/s.bmp

Сʿ4ң/bg/sys/ft/sky.bmp

Сʿ4ң/bg/sys/ft/w1.bmp

Сʿ4ң/bg/sys/ft/w2.bmp

Сʿ4ң/bg/sys/ft/w3.bmp

Сʿ4ң/bg/sys/gw/Thumbs.db

Сʿ4ң/bg/sys/gw/bg.dat

Сʿ4ң/bg/sys/gw/hill1.bmp

Сʿ4ң/bg/sys/gw/hill2.bmp

Сʿ4ң/bg/sys/gw/road1.bmp

Сʿ4ң/bg/sys/gw/road2.bmp

Сʿ4ң/bg/sys/gw/road3.bmp

Сʿ4ң/bg/sys/gw/s.bmp

Сʿ4ң/bg/sys/gw/sky.bmp

Сʿ4ң/bg/sys/hkc/Thumbs.db

Сʿ4ң/bg/sys/hkc/back1.bmp

Сʿ4ң/bg/sys/hkc/back2.bmp

Сʿ4ң/bg/sys/hkc/back22.bmp

Сʿ4ң/bg/sys/hkc/bg.dat

Сʿ4ң/bg/sys/hkc/s.bmp

Сʿ4ң/bg/sys/im/Thumbs.db

Сʿ4ң/bg/sys/im/bg.dat

Сʿ4ң/bg/sys/im/pic1.bmp

Сʿ4ң/bg/sys/im/pic2.bmp

Сʿ4ң/bg/sys/im/pic3.bmp

Сʿ4ң/bg/sys/im/pic4.bmp

Сʿ4ң/bg/sys/im/pic5.bmp

Сʿ4ң/bg/sys/im/pic6.bmp

Сʿ4ң/bg/sys/im/pic7.bmp

Сʿ4ң/bg/sys/im/pic8.bmp

Сʿ4ң/bg/sys/im/shadow.bmp

Сʿ4ң/bg/sys/im2/Thumbs.db

Сʿ4ң/bg/sys/im2/bg.dat

Сʿ4ң/bg/sys/im2/pic1.bmp

Сʿ4ң/bg/sys/im2/pic2.bmp

Сʿ4ң/bg/sys/im2/pic3.bmp

Сʿ4ң/bg/sys/im2/pic4.bmp

Сʿ4ң/bg/sys/im2/pic5.bmp

Сʿ4ң/bg/sys/im2/pic6.bmp

Сʿ4ң/bg/sys/im2/pic7.bmp

Сʿ4ң/bg/sys/im2/pic8.bmp

Сʿ4ң/bg/sys/im2/shadow.bmp

Сʿ4ң/bg/sys/lf/Thumbs.db

Сʿ4ң/bg/sys/lf/bg.dat

Сʿ4ң/bg/sys/lf/forestm1.bmp

Сʿ4ң/bg/sys/lf/forestm2.bmp

Сʿ4ң/bg/sys/lf/forestm3.bmp

Сʿ4ң/bg/sys/lf/forestm4.bmp

Сʿ4ң/bg/sys/lf/forests.bmp

Сʿ4ң/bg/sys/lf/forestt.bmp

Сʿ4ң/bg/sys/lf/land1.bmp

Сʿ4ң/bg/sys/lf/land2.bmp

Сʿ4ң/bg/sys/lf/land3.bmp

Сʿ4ң/bg/sys/lf/land4.bmp

Сʿ4ң/bg/sys/lf/s.bmp

Сʿ4ң/bg/sys/ns/Thumbs.db

Сʿ4ң/bg/sys/ns/bg.dat

Сʿ4ң/bg/sys/ns/pic1.bmp

Сʿ4ң/bg/sys/ns/pic2.bmp

Сʿ4ң/bg/sys/ns/pic3.bmp

Сʿ4ң/bg/sys/ns/pic4.bmp

Сʿ4ң/bg/sys/ns/pic5.bmp

Сʿ4ң/bg/sys/ns/pic6.bmp

Сʿ4ң/bg/sys/ns/pic7.bmp

Сʿ4ң/bg/sys/ns/pic8.bmp

Сʿ4ң/bg/sys/ns/shadow.bmp

Сʿ4ң/bg/sys/qi/Thumbs.db

Сʿ4ң/bg/sys/qi/bg.dat

Сʿ4ң/bg/sys/qi/qi1.bmp

Сʿ4ң/bg/sys/qi/qi2.bmp

Сʿ4ң/bg/sys/qi/qi3.bmp

Сʿ4ң/bg/sys/qi/qi4.bmp

Сʿ4ң/bg/sys/qi/qi5.bmp

Сʿ4ң/bg/sys/qi/qi6.bmp

Сʿ4ң/bg/sys/qi/qi6b.bmp

Сʿ4ң/bg/sys/qi/qi7.bmp

Сʿ4ң/bg/sys/qi/qi8.bmp

Сʿ4ң/bg/sys/qi/qi9.bmp

Сʿ4ң/bg/sys/qi/qia.bmp

Сʿ4ң/bg/sys/qi/qib.bmp

Сʿ4ң/bg/sys/qi/qic.bmp

Сʿ4ң/bg/sys/qi/qid.bmp

Сʿ4ң/bg/sys/qi/qie.bmp

Сʿ4ң/bg/sys/qi/s.bmp

Сʿ4ң/bg/sys/sp/Thumbs.db

Сʿ4ң/bg/sys/sp/bg.dat

Сʿ4ң/bg/sys/sp/fire1.bmp

Сʿ4ң/bg/sys/sp/fire2.bmp

Сʿ4ң/bg/sys/sp/fire3.bmp

Сʿ4ң/bg/sys/sp/fire4.bmp

Сʿ4ң/bg/sys/sp/fire5.bmp

Сʿ4ң/bg/sys/sp/fire6.bmp

Сʿ4ң/bg/sys/sp/fire7.bmp

Сʿ4ң/bg/sys/sp/s.bmp

Сʿ4ң/bg/sys/sp/wall.bmp

Сʿ4ң/bg/sys/sp/wall2.bmp

Сʿ4ң/bg/sys/sp/wall3.bmp

Сʿ4ң/bg/sys/sp/wall4.bmp

Сʿ4ң/bg/sys/thv/1al.bmp

Сʿ4ң/bg/sys/thv/1ar.bmp

Сʿ4ң/bg/sys/thv/1bl.bmp

Сʿ4ң/bg/sys/thv/1br.bmp

Сʿ4ң/bg/sys/thv/1cl.bmp

Сʿ4ң/bg/sys/thv/1cr.bmp

Сʿ4ң/bg/sys/thv/1dl.bmp

Сʿ4ң/bg/sys/thv/1dr.bmp

Сʿ4ң/bg/sys/thv/1el.bmp

Сʿ4ң/bg/sys/thv/1er.bmp

Сʿ4ң/bg/sys/thv/2a.bmp

Сʿ4ң/bg/sys/thv/2al.bmp

Сʿ4ң/bg/sys/thv/2ar.bmp

Сʿ4ң/bg/sys/thv/2b.bmp

Сʿ4ң/bg/sys/thv/2bl.bmp

Сʿ4ң/bg/sys/thv/2br.bmp

Сʿ4ң/bg/sys/thv/3.bmp

Сʿ4ң/bg/sys/thv/4.bmp

Сʿ4ң/bg/sys/thv/5.bmp

Сʿ4ң/bg/sys/thv/Thumbs.db

Сʿ4ң/bg/sys/thv/bg.dat

Сʿ4ң/bg/sys/thv/s.bmp

Сʿ4ң/bg/template/1/bg.dat

Сʿ4ң/bg/template/1/pic1.bmp

Сʿ4ң/bg/template/1/pic2.bmp

Сʿ4ң/bg/template/1/pic3.bmp

Сʿ4ң/bg/template/1/pic4.bmp

Сʿ4ң/bg/template/1/pic5.bmp

Сʿ4ң/bg/template/1/pic6.bmp

Сʿ4ң/bg/template/1/pic7.bmp

Сʿ4ң/bg/template/1/pic8.bmp

Сʿ4ң/bg/template/1/shadow.bmp

Сʿ4ң/bg/template/2/bg.dat

Сʿ4ң/bg/template/2/pic1.bmp

Сʿ4ң/bg/template/2/pic2.bmp

Сʿ4ң/bg/template/2/pic3.bmp

Сʿ4ң/bg/template/2/pic4.bmp

Сʿ4ң/bg/template/2/pic5.bmp

Сʿ4ң/bg/template/2/pic6.bmp

Сʿ4ң/bg/template/2/pic7.bmp

Сʿ4ң/bg/template/2/pic8.bmp

Сʿ4ң/bg/template/2/shadow.bmp

Сʿ4ң/bg/template/3/bg.dat

Сʿ4ң/bg/template/3/pic1.bmp

Сʿ4ң/bg/template/3/pic2.bmp

Сʿ4ң/bg/template/3/pic3.bmp

Сʿ4ң/bg/template/3/pic4.bmp

Сʿ4ң/bg/template/3/pic5.bmp

Сʿ4ң/bg/template/3/pic6.bmp

Сʿ4ң/bg/template/3/pic7.bmp

Сʿ4ң/bg/template/3/pic8.bmp

Сʿ4ң/bg/template/3/shadow.bmp

Сʿ4ң/data/001.wav

Сʿ4ң/data/002.wav

Сʿ4ң/data/003.wav

Сʿ4ң/data/004.wav

Сʿ4ң/data/005.wav

Сʿ4ң/data/006.wav

Сʿ4ң/data/007.wav

Сʿ4ң/data/008.wav

Сʿ4ң/data/009.wav

Сʿ4ң/data/010.wav

Сʿ4ң/data/011.wav

Сʿ4ң/data/012.wav

Сʿ4ң/data/013.wav

Сʿ4ң/data/014.wav

Сʿ4ң/data/015.wav

Сʿ4ң/data/016.wav

Сʿ4ң/data/017.wav

Сʿ4ң/data/018.wav

Сʿ4ң/data/019.wav

Сʿ4ң/data/020.wav

Сʿ4ң/data/021.wav

Сʿ4ң/data/022.wav

Сʿ4ң/data/023.wav

Сʿ4ң/data/024.wav

Сʿ4ң/data/025.wav

Сʿ4ң/data/026.wav

Сʿ4ң/data/027.wav

Сʿ4ң/data/028.wav

Сʿ4ң/data/029.wav

Сʿ4ң/data/030.wav

Сʿ4ң/data/031.wav

Сʿ4ң/data/032.wav

Сʿ4ң/data/033.wav

Сʿ4ң/data/034.wav

Сʿ4ң/data/035.wav

Сʿ4ң/data/036.wav

Сʿ4ң/data/037.wav

Сʿ4ң/data/038.wav

Сʿ4ң/data/039.wav

Сʿ4ң/data/040.wav

Сʿ4ң/data/041.wav

Сʿ4ң/data/042.wav

Сʿ4ң/data/043.wav

Сʿ4ң/data/044.wav

Сʿ4ң/data/045.wav

Сʿ4ң/data/046.wav

Сʿ4ң/data/047.wav

Сʿ4ң/data/048.wav

Сʿ4ң/data/049.wav

Сʿ4ң/data/050.wav

Сʿ4ң/data/051.wav

Сʿ4ң/data/052.wav

Сʿ4ң/data/053.wav

Сʿ4ң/data/054.wav

Сʿ4ң/data/055.wav

Сʿ4ң/data/056.wav

Сʿ4ң/data/057.wav

Сʿ4ң/data/058.wav

Сʿ4ң/data/059.wav

Сʿ4ң/data/060.wav

Сʿ4ң/data/061.wav

Сʿ4ң/data/062.wav

Сʿ4ң/data/063.wav

Сʿ4ң/data/064.wav

Сʿ4ң/data/065.wav

Сʿ4ң/data/066.wav

Сʿ4ң/data/067.wav

Сʿ4ң/data/068.wav

Сʿ4ң/data/069.wav

Сʿ4ң/data/070.wav

Сʿ4ң/data/071.wav

Сʿ4ң/data/072.wav

Сʿ4ң/data/073.wav

Сʿ4ң/data/074.wav

Сʿ4ң/data/075.wav

Сʿ4ң/data/076.wav

Сʿ4ң/data/077.wav

Сʿ4ң/data/078.wav

Сʿ4ң/data/079.wav

Сʿ4ң/data/080.wav

Сʿ4ң/data/081.wav

Сʿ4ң/data/082.wav

Сʿ4ң/data/083.wav

Сʿ4ң/data/084.wav

Сʿ4ң/data/085.wav

Сʿ4ң/data/086.wav

Сʿ4ң/data/087.wav

Сʿ4ң/data/088.wav

Сʿ4ң/data/089.wav

Сʿ4ң/data/090.wav

Сʿ4ң/data/091.wav

Сʿ4ң/data/092.wav

Сʿ4ң/data/093.wav

Сʿ4ң/data/094.wav

Сʿ4ң/data/095.wav

Сʿ4ң/data/096.wav

Сʿ4ң/data/097.wav

Сʿ4ң/data/098.wav

Сʿ4ң/data/099.wav

Сʿ4ң/data/100.wav

Сʿ4ң/data/101.wav

Сʿ4ң/data/102.wav

Сʿ4ң/data/103.wav

Сʿ4ң/data/104.wav

Сʿ4ң/data/105.wav

Сʿ4ң/data/106.wav

Сʿ4ң/data/107.wav

Сʿ4ң/data/108.wav

Сʿ4ң/data/109.wav

Сʿ4ң/data/110.wav

Сʿ4ң/data/111.wav

Сʿ4ң/data/112.wav

Сʿ4ң/data/113.wav

Сʿ4ң/data/114.wav

Сʿ4ң/data/115.wav

Сʿ4ң/data/116.wav

Сʿ4ң/data/bandit.dat

Сʿ4ң/data/bandit2.dat

Сʿ4ң/data/bandit_flame.dat

Сʿ4ң/data/bat.dat

Сʿ4ң/data/bat2.dat

Сʿ4ң/data/bat_ball.dat

Сʿ4ң/data/bat_ball2.dat

Сʿ4ң/data/bat_chase.dat

Сʿ4ң/data/bat_chase2.dat

Сʿ4ң/data/bat_chase3.dat

Сʿ4ң/data/bat_chase4.dat

Сʿ4ң/data/bat_chase5.dat

Сʿ4ң/data/bat_flame.dat

Сʿ4ң/data/broken_weapon.dat

Сʿ4ң/data/cl.dat

Сʿ4ң/data/cl_ball.dat

Сʿ4ң/data/cl_ball2.dat

Сʿ4ң/data/cl_ball3.dat

Сʿ4ң/data/cl_chase.dat

Сʿ4ң/data/cl_chase2.dat

Сʿ4ң/data/cl_col.dat

Сʿ4ң/data/cl_col2.dat

Сʿ4ң/data/cl_col3.dat

Сʿ4ң/data/cl_flame.dat

Сʿ4ң/data/control.txt

Сʿ4ң/data/criminal.dat

Сʿ4ң/data/data.dat

Сʿ4ң/data/data.txt

Сʿ4ң/data/davis.dat

Сʿ4ң/data/davis_ball.dat

Сʿ4ң/data/davis_ball2.dat

Сʿ4ң/data/deep.dat

Сʿ4ң/data/deep_ball.dat

Сʿ4ң/data/deep_chop.dat

Сʿ4ң/data/dennis.dat

Сʿ4ң/data/dennis_ball.dat

Сʿ4ң/data/dennis_chase.dat

Сʿ4ң/data/dragon.dat

Сʿ4ң/data/etc.dat

Сʿ4ң/data/firen.dat

Сʿ4ң/data/firen_ball.dat

Сʿ4ң/data/firen_ball2.dat

Сʿ4ң/data/firen_ball3.dat

Сʿ4ң/data/firen_flame.dat

Сʿ4ң/data/firzen.dat

Сʿ4ң/data/firzen_ball.dat

Сʿ4ң/data/firzen_chasef.dat

Сʿ4ң/data/firzen_chasei.dat

Сʿ4ң/data/freeze.dat

Сʿ4ң/data/freeze_ball.dat

Сʿ4ң/data/freeze_ball2.dat

Сʿ4ң/data/freeze_column.dat

Сʿ4ң/data/guardian.dat

Сʿ4ң/data/henry.dat

Сʿ4ң/data/henry_arrow1.dat

Сʿ4ң/data/henry_arrow2.dat

Сʿ4ң/data/henry_wind.dat

Сʿ4ң/data/horizontal_ww.dat

Сʿ4ң/data/hunter.dat

Сʿ4ң/data/jack.dat

Сʿ4ң/data/jack_ball.dat

Сʿ4ң/data/jan.dat

Сʿ4ң/data/jan_chase.dat

Сʿ4ң/data/jan_chaseh.dat

Сʿ4ң/data/john.dat

Сʿ4ң/data/john_ball.dat

Сʿ4ң/data/john_ball2.dat

Сʿ4ң/data/john_biscuit.dat

Сʿ4ң/data/julian.dat

Сʿ4ң/data/julian_ball.dat

Сʿ4ң/data/julian_ball2.dat

Сʿ4ң/data/justin.dat

Сʿ4ң/data/justin_ball.dat

Сʿ4ң/data/justin_ball2.dat

Сʿ4ң/data/knight.dat

Сʿ4ң/data/knight_ball.dat

Сʿ4ң/data/knight_thunder.dat

Сʿ4ң/data/louis.dat

Сʿ4ң/data/louisEX.dat

Сʿ4ң/data/louis_ball.dat

Сʿ4ң/data/louisex_ball.dat

Сʿ4ң/data/m_cancel.wav

Сʿ4ң/data/m_end.wav

Сʿ4ң/data/m_join.wav

Сʿ4ң/data/m_ok.wav

Сʿ4ң/data/m_pass.wav

Сʿ4ң/data/mark.dat

Сʿ4ң/data/monk.dat

Сʿ4ң/data/richter.dat

Сʿ4ң/data/rudolf.dat

Сʿ4ң/data/rudolf_weapon.dat

Сʿ4ң/data/sorcerer.dat

Сʿ4ң/data/stage.dat

Сʿ4ң/data/template.dat

Сʿ4ң/data/temporary.txt

Сʿ4ң/data/weapon0.dat

Сʿ4ң/data/weapon1.dat

Сʿ4ң/data/weapon10.dat

Сʿ4ң/data/weapon11.dat

Сʿ4ң/data/weapon12.dat

Сʿ4ң/data/weapon13.dat

Сʿ4ң/data/weapon14.dat

Сʿ4ң/data/weapon2.dat

Сʿ4ң/data/weapon3.dat

Сʿ4ң/data/weapon4.dat

Сʿ4ң/data/weapon5.dat

Сʿ4ң/data/weapon6.dat

Сʿ4ң/data/weapon7.dat

Сʿ4ң/data/weapon8.dat

Сʿ4ң/data/weapon9.dat

Сʿ4ң/data/weapon99.dat

Сʿ4ң/data/woody.dat

Сʿ4ң/data/woody_ball.dat

Сʿ4ң/install1.ico

Сʿ4ң/install1.reg

Сʿ4ң/sprite/sys/Thumbs.db

Сʿ4ң/sprite/sys/bandit_0.bmp

Сʿ4ң/sprite/sys/bandit_0b.bmp

Сʿ4ң/sprite/sys/bandit_1.bmp

Сʿ4ң/sprite/sys/bandit_1b.bmp

Сʿ4ң/sprite/sys/bandit_col.bmp

Сʿ4ң/sprite/sys/bandit_col2.bmp

Сʿ4ң/sprite/sys/bandit_f.bmp

Сʿ4ң/sprite/sys/bandit_fb.bmp

Сʿ4ң/sprite/sys/bandit_flame.bmp

Сʿ4ң/sprite/sys/bandit_s.bmp

Сʿ4ң/sprite/sys/bandit_sb.bmp

Сʿ4ң/sprite/sys/bandit_shadow.bmp

Сʿ4ң/sprite/sys/bat2_0.bmp

Сʿ4ң/sprite/sys/bat2_1.bmp

Сʿ4ң/sprite/sys/bat2_2.bmp

Сʿ4ң/sprite/sys/bat2_f.bmp

Сʿ4ң/sprite/sys/bat2_s.bmp

Сʿ4ң/sprite/sys/bat_0.bmp

Сʿ4ң/sprite/sys/bat_1.bmp

Сʿ4ң/sprite/sys/bat_2.bmp

Сʿ4ң/sprite/sys/bat_ball.bmp

Сʿ4ң/sprite/sys/bat_ball2.bmp

Сʿ4ң/sprite/sys/bat_chase.bmp

Сʿ4ң/sprite/sys/bat_chase2.bmp

Сʿ4ң/sprite/sys/bat_chase3.bmp

Сʿ4ң/sprite/sys/bat_chase4.bmp

Сʿ4ң/sprite/sys/bat_f.bmp

Сʿ4ң/sprite/sys/bat_s.bmp

Сʿ4ң/sprite/sys/broken.bmp

Сʿ4ң/sprite/sys/broken2.bmp

Сʿ4ң/sprite/sys/cl_0.bmp

Сʿ4ң/sprite/sys/cl_1.bmp

Сʿ4ң/sprite/sys/cl_2.bmp

Сʿ4ң/sprite/sys/cl_3.bmp

Сʿ4ң/sprite/sys/cl_ball.bmp

Сʿ4ң/sprite/sys/cl_ball2.bmp

Сʿ4ң/sprite/sys/cl_chase.bmp

Сʿ4ң/sprite/sys/cl_col.bmp

Сʿ4ң/sprite/sys/cl_col2.bmp

Сʿ4ң/sprite/sys/cl_col3.bmp

Сʿ4ң/sprite/sys/cl_col4.bmp

Сʿ4ң/sprite/sys/cl_col5 ``.bmp

Сʿ4ң/sprite/sys/cl_col5.bmp

Сʿ4ң/sprite/sys/cl_f.bmp

Сʿ4ң/sprite/sys/cl_flame.bmp

Сʿ4ң/sprite/sys/cl_s.bmp

Сʿ4ң/sprite/sys/cl_star.bmp

Сʿ4ң/sprite/sys/cl_star2.bmp

Сʿ4ң/sprite/sys/criminal.bmp

Сʿ4ң/sprite/sys/davis_0.bmp

Сʿ4ң/sprite/sys/davis_1.bmp

Сʿ4ң/sprite/sys/davis_2.bmp

Сʿ4ң/sprite/sys/davis_ball.bmp

Сʿ4ң/sprite/sys/davis_ball2.bmp

Сʿ4ң/sprite/sys/davis_col.bmp

Сʿ4ң/sprite/sys/davis_f.bmp

Сʿ4ң/sprite/sys/davis_s.bmp

Сʿ4ң/sprite/sys/deep_0.bmp

Сʿ4ң/sprite/sys/deep_1.bmp

Сʿ4ң/sprite/sys/deep_2.bmp

Сʿ4ң/sprite/sys/deep_3.bmp

Сʿ4ң/sprite/sys/deep_4.bmp

Сʿ4ң/sprite/sys/deep_ball.bmp

Сʿ4ң/sprite/sys/deep_ball2.bmp

Сʿ4ң/sprite/sys/deep_ball3.bmp

Сʿ4ң/sprite/sys/deep_ball4.bmp

Сʿ4ң/sprite/sys/deep_ball5.bmp

Сʿ4ң/sprite/sys/deep_ball6.bmp

Сʿ4ң/sprite/sys/deep_ball7.bmp

Сʿ4ң/sprite/sys/deep_f.bmp

Сʿ4ң/sprite/sys/deep_s.bmp

Сʿ4ң/sprite/sys/dennis_0.bmp

Сʿ4ң/sprite/sys/dennis_1.bmp

Сʿ4ң/sprite/sys/dennis_2.bmp

Сʿ4ң/sprite/sys/dennis_3.bmp

Сʿ4ң/sprite/sys/dennis_ball.bmp

Сʿ4ң/sprite/sys/dennis_ball2.bmp

Сʿ4ң/sprite/sys/dennis_ball3.bmp

Сʿ4ң/sprite/sys/dennis_chase.bmp

Сʿ4ң/sprite/sys/dennis_f.bmp

Сʿ4ң/sprite/sys/dennis_s.bmp

Сʿ4ң/sprite/sys/etc.bmp

Сʿ4ң/sprite/sys/firen_0.bmp

Сʿ4ң/sprite/sys/firen_1.bmp

Сʿ4ң/sprite/sys/firen_2.bmp

Сʿ4ң/sprite/sys/firen_ball.bmp

Сʿ4ң/sprite/sys/firen_ball2.bmp

Сʿ4ң/sprite/sys/firen_ball3.bmp

Сʿ4ң/sprite/sys/firen_chase.bmp

Сʿ4ң/sprite/sys/firen_col.bmp

Сʿ4ң/sprite/sys/firen_col2.bmp

Сʿ4ң/sprite/sys/firen_exp.bmp

Сʿ4ң/sprite/sys/firen_f.bmp

Сʿ4ң/sprite/sys/firen_flame.bmp

Сʿ4ң/sprite/sys/firen_grd.bmp

Сʿ4ң/sprite/sys/firen_s.bmp

Сʿ4ң/sprite/sys/firzen_0.bmp

Сʿ4ң/sprite/sys/firzen_1.bmp

Сʿ4ң/sprite/sys/firzen_2.bmp

Сʿ4ң/sprite/sys/firzen_ball.bmp

Сʿ4ң/sprite/sys/firzen_chasef.bmp

Сʿ4ң/sprite/sys/firzen_chasei.bmp

Сʿ4ң/sprite/sys/firzen_f.bmp

Сʿ4ң/sprite/sys/firzen_s.bmp

Сʿ4ң/sprite/sys/firzen_up.bmp

Сʿ4ң/sprite/sys/firzen_up2.bmp

Сʿ4ң/sprite/sys/firzen_up3.bmp

Сʿ4ң/sprite/sys/freeze_0.bmp

Сʿ4ң/sprite/sys/freeze_1.bmp

Сʿ4ң/sprite/sys/freeze_2.bmp

Сʿ4ң/sprite/sys/freeze_ball.bmp

Сʿ4ң/sprite/sys/freeze_ball2.bmp

Сʿ4ң/sprite/sys/freeze_chase.bmp

Сʿ4ң/sprite/sys/freeze_col.bmp

Сʿ4ң/sprite/sys/freeze_col2.bmp

Сʿ4ң/sprite/sys/freeze_f.bmp

Сʿ4ң/sprite/sys/freeze_s.bmp

Сʿ4ң/sprite/sys/freeze_ww.bmp

Сʿ4ң/sprite/sys/guardian_0.bmp

Сʿ4ң/sprite/sys/guardian_1.bmp

Сʿ4ң/sprite/sys/guardian_2.bmp

Сʿ4ң/sprite/sys/guardian_ball.bmp

Сʿ4ң/sprite/sys/guardian_f.bmp

Сʿ4ң/sprite/sys/guardian_s.bmp

Сʿ4ң/sprite/sys/henry_0.bmp

Сʿ4ң/sprite/sys/henry_1.bmp

Сʿ4ң/sprite/sys/henry_2.bmp

Сʿ4ң/sprite/sys/henry_arrow1.bmp

Сʿ4ң/sprite/sys/henry_arrow2.bmp

Сʿ4ң/sprite/sys/henry_arrow3.bmp

Сʿ4ң/sprite/sys/henry_arrow4.bmp

Сʿ4ң/sprite/sys/henry_arrow6.bmp

Сʿ4ң/sprite/sys/henry_f.bmp

Сʿ4ң/sprite/sys/henry_s.bmp

Сʿ4ң/sprite/sys/henry_td.bmp

Сʿ4ң/sprite/sys/henry_wind.bmp

Сʿ4ң/sprite/sys/hunter_0.bmp

Сʿ4ң/sprite/sys/hunter_0b.bmp

Сʿ4ң/sprite/sys/hunter_1.bmp

Сʿ4ң/sprite/sys/hunter_1b.bmp

Сʿ4ң/sprite/sys/hunter_arrow1.bmp

Сʿ4ң/sprite/sys/hunter_arrow2.bmp

Сʿ4ң/sprite/sys/hunter_arrow3.bmp

Сʿ4ң/sprite/sys/hunter_col.bmp

Сʿ4ң/sprite/sys/hunter_exp.bmp

Сʿ4ң/sprite/sys/hunter_f.bmp

Сʿ4ң/sprite/sys/hunter_s.bmp

Сʿ4ң/sprite/sys/jack_0.bmp

Сʿ4ң/sprite/sys/jack_0b.bmp

Сʿ4ң/sprite/sys/jack_1.bmp

Сʿ4ң/sprite/sys/jack_1b.bmp

Сʿ4ң/sprite/sys/jack_b.bmp

Сʿ4ң/sprite/sys/jack_b2.bmp

Сʿ4ң/sprite/sys/jack_col.bmp

Сʿ4ң/sprite/sys/jack_col2.bmp

Сʿ4ң/sprite/sys/jack_f.bmp

Сʿ4ң/sprite/sys/jack_s.bmp

Сʿ4ң/sprite/sys/jan_0.bmp

Сʿ4ң/sprite/sys/jan_1.bmp

Сʿ4ң/sprite/sys/jan_2.bmp

Сʿ4ң/sprite/sys/jan_3.bmp

Сʿ4ң/sprite/sys/jan_ball.bmp

Сʿ4ң/sprite/sys/jan_ball2.bmp

Сʿ4ң/sprite/sys/jan_ball3.bmp

Сʿ4ң/sprite/sys/jan_chase.bmp

Сʿ4ң/sprite/sys/jan_chaseb.bmp

Сʿ4ң/sprite/sys/jan_chaseh.bmp

Сʿ4ң/sprite/sys/jan_f.bmp

Сʿ4ң/sprite/sys/jan_s.bmp

Сʿ4ң/sprite/sys/john_0.bmp

Сʿ4ң/sprite/sys/john_1.bmp

Сʿ4ң/sprite/sys/john_2.bmp

Сʿ4ң/sprite/sys/john_3.bmp

Сʿ4ң/sprite/sys/john_ball.bmp

Сʿ4ң/sprite/sys/john_ball2.bmp

Сʿ4ң/sprite/sys/john_biscuit.bmp

Сʿ4ң/sprite/sys/john_col.bmp

Сʿ4ң/sprite/sys/john_col2.bmp

Сʿ4ң/sprite/sys/john_col3.bmp

Сʿ4ң/sprite/sys/john_f.bmp

Сʿ4ң/sprite/sys/john_s.bmp

Сʿ4ң/sprite/sys/julian_0.bmp

Сʿ4ң/sprite/sys/julian_1.bmp

Сʿ4ң/sprite/sys/julian_2.bmp

Сʿ4ң/sprite/sys/julian_ball.bmp

Сʿ4ң/sprite/sys/julian_ball2.bmp

Сʿ4ң/sprite/sys/julian_col.bmp

Сʿ4ң/sprite/sys/julian_col2.bmp

Сʿ4ң/sprite/sys/julian_exp.bmp

Сʿ4ң/sprite/sys/julian_f.bmp

Сʿ4ң/sprite/sys/julian_s.bmp

Сʿ4ң/sprite/sys/justin_0.bmp

Сʿ4ң/sprite/sys/justin_0b.bmp

Сʿ4ң/sprite/sys/justin_1.bmp

Сʿ4ң/sprite/sys/justin_1b.bmp

Сʿ4ң/sprite/sys/justin_ball.bmp

Сʿ4ң/sprite/sys/justin_col.bmp

Сʿ4ң/sprite/sys/justin_col2.bmp

Сʿ4ң/sprite/sys/justin_f.bmp

Сʿ4ң/sprite/sys/justin_s.bmp

Сʿ4ң/sprite/sys/knight_0.bmp

Сʿ4ң/sprite/sys/knight_0b.bmp

Сʿ4ң/sprite/sys/knight_1.bmp

Сʿ4ң/sprite/sys/knight_1b.bmp

Сʿ4ң/sprite/sys/knight_2.bmp

Сʿ4ң/sprite/sys/knight_2b.bmp

Сʿ4ң/sprite/sys/knight_ball.bmp

Сʿ4ң/sprite/sys/knight_col.bmp

Сʿ4ң/sprite/sys/knight_f.bmp

Сʿ4ң/sprite/sys/knight_s.bmp

Сʿ4ң/sprite/sys/louisEX_0.bmp

Сʿ4ң/sprite/sys/louisEX_1.bmp

Сʿ4ң/sprite/sys/louisEX_2.bmp

Сʿ4ң/sprite/sys/louisEX_3.bmp

Сʿ4ң/sprite/sys/louisEX_4.bmp

Сʿ4ң/sprite/sys/louisEX_ball.bmp

Сʿ4ң/sprite/sys/louisEX_f.bmp

Сʿ4ң/sprite/sys/louisEX_s.bmp

Сʿ4ң/sprite/sys/louisEX_ww.bmp

Сʿ4ң/sprite/sys/louis_0.bmp

Сʿ4ң/sprite/sys/louis_1.bmp

Сʿ4ң/sprite/sys/louis_2.bmp

Сʿ4ң/sprite/sys/louis_3.bmp

Сʿ4ң/sprite/sys/louis_ball.bmp

Сʿ4ң/sprite/sys/louis_f.bmp

Сʿ4ң/sprite/sys/louis_s.bmp

Сʿ4ң/sprite/sys/mark_0.bmp

Сʿ4ң/sprite/sys/mark_0b.bmp

Сʿ4ң/sprite/sys/mark_1.bmp

Сʿ4ң/sprite/sys/mark_1b.bmp

Сʿ4ң/sprite/sys/mark_f.bmp

Сʿ4ң/sprite/sys/mark_s.bmp

Сʿ4ң/sprite/sys/monk_0.bmp

Сʿ4ң/sprite/sys/monk_0b.bmp

Сʿ4ң/sprite/sys/monk_1.bmp

Сʿ4ң/sprite/sys/monk_1b.bmp

Сʿ4ң/sprite/sys/monk_ball.bmp

Сʿ4ң/sprite/sys/monk_col.bmp

Сʿ4ң/sprite/sys/monk_col2.bmp

Сʿ4ң/sprite/sys/monk_f.bmp

Сʿ4ң/sprite/sys/monk_golden.bmp

Сʿ4ң/sprite/sys/monk_s.bmp

Сʿ4ң/sprite/sys/richter_0.bmp

Сʿ4ң/sprite/sys/richter_1.bmp

Сʿ4ң/sprite/sys/richter_2.bmp

Сʿ4ң/sprite/sys/richter_3.bmp

Сʿ4ң/sprite/sys/richter_ball.bmp

Сʿ4ң/sprite/sys/richter_ball2.bmp

Сʿ4ң/sprite/sys/richter_f.bmp

Сʿ4ң/sprite/sys/richter_s.bmp

Сʿ4ң/sprite/sys/rudolf_0.bmp

Сʿ4ң/sprite/sys/rudolf_1.bmp

Сʿ4ң/sprite/sys/rudolf_2.bmp

Сʿ4ң/sprite/sys/rudolf_3.bmp

Сʿ4ң/sprite/sys/rudolf_f.bmp

Сʿ4ң/sprite/sys/rudolf_flash.bmp

Сʿ4ң/sprite/sys/rudolf_flash2.bmp

Сʿ4ң/sprite/sys/rudolf_s.bmp

Сʿ4ң/sprite/sys/rudolf_smoke.bmp

Сʿ4ң/sprite/sys/rudolf_weapon.bmp

Сʿ4ң/sprite/sys/sflash.bmp

Сʿ4ң/sprite/sys/sorcerer_0.bmp

Сʿ4ң/sprite/sys/sorcerer_0b.bmp

Сʿ4ң/sprite/sys/sorcerer_1.bmp

Сʿ4ң/sprite/sys/sorcerer_1b.bmp

Сʿ4ң/sprite/sys/sorcerer_ball.bmp

Сʿ4ң/sprite/sys/sorcerer_ball2.bmp

Сʿ4ң/sprite/sys/sorcerer_f.bmp

Сʿ4ң/sprite/sys/sorcerer_s.bmp

Сʿ4ң/sprite/sys/sorcerer_w.bmp

Сʿ4ң/sprite/sys/spark.bmp

Сʿ4ң/sprite/sys/weapon0.bmp

Сʿ4ң/sprite/sys/weapon1.bmp

Сʿ4ң/sprite/sys/weapon10.bmp

Сʿ4ң/sprite/sys/weapon11.bmp

Сʿ4ң/sprite/sys/weapon12.bmp

Сʿ4ң/sprite/sys/weapon13.bmp

Сʿ4ң/sprite/sys/weapon2.bmp

Сʿ4ң/sprite/sys/weapon3.bmp

Сʿ4ң/sprite/sys/weapon4.bmp

Сʿ4ң/sprite/sys/weapon5.bmp

Сʿ4ң/sprite/sys/weapon6.bmp

Сʿ4ң/sprite/sys/weapon7.bmp

Сʿ4ң/sprite/sys/weapon8.bmp

Сʿ4ң/sprite/sys/weapon9.bmp

Сʿ4ң/sprite/sys/woody_0.bmp

Сʿ4ң/sprite/sys/woody_1.bmp

Сʿ4ң/sprite/sys/woody_2.bmp

Сʿ4ң/sprite/sys/woody_3.bmp

Сʿ4ң/sprite/sys/woody_ball.bmp

Сʿ4ң/sprite/sys/woody_f.bmp

Сʿ4ң/sprite/sys/woody_s.bmp

Сʿ4ң/sprite/sys/xly.bmp

Сʿ4ң/sprite/template1/0.bmp

Сʿ4ң/sprite/template1/1.bmp

Сʿ4ң/sprite/template1/face.bmp

Сʿ4ң/sprite/template1/s.bmp

Сʿ4ң/uninst.exe

.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime

SearchPathA

GetShortPathNameA

GetFullPathNameA

MoveFileA

SetCurrentDirectoryA

GetFileAttributesA

GetLastError

CreateDirectoryA

SetFileAttributesA

Sleep

GetTickCount

GetFileSize

GetModuleFileNameA

GetCurrentProcess

CopyFileA

ExitProcess

GetWindowsDirectoryA

SetFileTime

GetCommandLineA

SetErrorMode

LoadLibraryA

lstrcpynA

GetDiskFreeSpaceA

GlobalUnlock

GlobalLock

CreateThread

CreateProcessA

RemoveDirectoryA

CreateFileA

GetTempFileNameA

lstrlenA

lstrcatA

GetSystemDirectoryA

GetVersion

CloseHandle

lstrcmpiA

lstrcmpA

ExpandEnvironmentStringsA

GlobalFree

GlobalAlloc

WaitForSingleObject

GetExitCodeProcess

GetModuleHandleA

LoadLibraryExA

GetProcAddress

FreeLibrary

MultiByteToWideChar

WritePrivateProfileStringA

GetPrivateProfileStringA

WriteFile

ReadFile

MulDiv

SetFilePointer

FindClose

FindNextFileA

FindFirstFileA

DeleteFileA

GetTempPathA

user32

EndDialog

ScreenToClient

GetWindowRect

EnableMenuItem

GetSystemMenu

SetClassLongA

IsWindowEnabled

SetWindowPos

GetSysColor

GetWindowLongA

SetCursor

LoadCursorA

CheckDlgButton

GetMessagePos

LoadBitmapA

CallWindowProcA

IsWindowVisible

CloseClipboard

SetClipboardData

EmptyClipboard

RegisterClassA

TrackPopupMenu

AppendMenuA

CreatePopupMenu

GetSystemMetrics

SetDlgItemTextA

GetDlgItemTextA

MessageBoxIndirectA

CharPrevA

DispatchMessageA

PeekMessageA

DestroyWindow

CreateDialogParamA

SetTimer

SetWindowTextA

PostQuitMessage

SetForegroundWindow

wsprintfA

SendMessageTimeoutA

FindWindowExA

SystemParametersInfoA

CreateWindowExA

GetClassInfoA

DialogBoxParamA

CharNextA

OpenClipboard

ExitWindowsEx

IsWindow

GetDlgItem

SetWindowLongA

LoadImageA

GetDC

EnableWindow

InvalidateRect

SendMessageA

DefWindowProcA

BeginPaint

GetClientRect

FillRect

DrawTextA

EndPaint

ShowWindow

gdi32

SetBkColor

GetDeviceCaps

DeleteObject

CreateBrushIndirect

CreateFontIndirectA

SetBkMode

SetTextColor

SelectObject

shell32

SHGetPathFromIDListA

SHBrowseForFolderA

SHGetFileInfoA

ShellExecuteA

SHFileOperationA

SHGetSpecialFolderLocation

advapi32

RegQueryValueExA

RegSetValueExA

RegEnumKeyA

RegEnumValueA

RegOpenKeyExA

RegDeleteKeyA

RegDeleteValueA

RegCloseKey

RegCreateKeyExA

comctl32

ImageList_AddMasked

ImageList_Destroy

ord17

ImageList_Create

ole32

CoTaskMemFree

OleInitialize

OleUninitialize

CoCreateInstance

version

GetFileVersionInfoSizeA

GetFileVersionInfoA

VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc

GlobalFree

GlobalSize

GetLastError

lstrcpyA

lstrcpynA

FreeLibrary

lstrcatA

GetProcAddress

LoadLibraryA

GetModuleHandleA

MultiByteToWideChar

lstrlenA

WideCharToMultiByte

VirtualAlloc

VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2

CLSIDFromString

Exports

Alloc

Call

Copy

Free

Get

Int64Op

Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/modern-header.bmp

Сʿ4ң/xttSetup2.1.exe

.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

KeyUsageCertSign

KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

01/07/2010, 00:00

Not After

30/06/2013, 23:59

Subject

CN=Hubei Dudu Network Technology co.\,ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Hubei Dudu Network Technology co.\,ltd.,L=wuhanshi,ST=hubeisheng,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime

SearchPathA

GetShortPathNameA

GetFullPathNameA

MoveFileA

SetCurrentDirectoryA

GetFileAttributesA

GetLastError

CreateDirectoryA

SetFileAttributesA

Sleep

GetTickCount

GetFileSize

GetModuleFileNameA

GetCurrentProcess

CopyFileA

ExitProcess

GetWindowsDirectoryA

SetFileTime

GetCommandLineA

SetErrorMode

LoadLibraryA

lstrcpynA

GetDiskFreeSpaceA

GlobalUnlock

GlobalLock

CreateThread

CreateProcessA

RemoveDirectoryA

CreateFileA

GetTempFileNameA

lstrlenA

lstrcatA

GetSystemDirectoryA

GetVersion

CloseHandle

lstrcmpiA

lstrcmpA

ExpandEnvironmentStringsA

GlobalFree

GlobalAlloc

WaitForSingleObject

GetExitCodeProcess

GetModuleHandleA

LoadLibraryExA

GetProcAddress

FreeLibrary

MultiByteToWideChar

WritePrivateProfileStringA

GetPrivateProfileStringA

WriteFile

ReadFile

MulDiv

SetFilePointer

FindClose

FindNextFileA

FindFirstFileA

DeleteFileA

GetTempPathA

user32

EndDialog

ScreenToClient

GetWindowRect

EnableMenuItem

GetSystemMenu

SetClassLongA

IsWindowEnabled

SetWindowPos

GetSysColor

GetWindowLongA

SetCursor

LoadCursorA

CheckDlgButton

GetMessagePos

LoadBitmapA

CallWindowProcA

IsWindowVisible

CloseClipboard

SetClipboardData

EmptyClipboard

RegisterClassA

TrackPopupMenu

AppendMenuA

CreatePopupMenu

GetSystemMetrics

SetDlgItemTextA

GetDlgItemTextA

MessageBoxIndirectA

CharPrevA

DispatchMessageA

PeekMessageA

DestroyWindow

CreateDialogParamA

SetTimer

SetWindowTextA

PostQuitMessage

SetForegroundWindow

wsprintfA

SendMessageTimeoutA

FindWindowExA

SystemParametersInfoA

CreateWindowExA

GetClassInfoA

DialogBoxParamA

CharNextA

OpenClipboard

ExitWindowsEx

IsWindow

GetDlgItem

SetWindowLongA

LoadImageA

GetDC

EnableWindow

InvalidateRect

SendMessageA

DefWindowProcA

BeginPaint

GetClientRect

FillRect

DrawTextA

EndPaint

ShowWindow

gdi32

SetBkColor

GetDeviceCaps

DeleteObject

CreateBrushIndirect

CreateFontIndirectA

SetBkMode

SetTextColor

SelectObject

shell32

SHGetPathFromIDListA

SHBrowseForFolderA

SHGetFileInfoA

ShellExecuteA

SHFileOperationA

SHGetSpecialFolderLocation

advapi32

RegQueryValueExA

RegSetValueExA

RegEnumKeyA

RegEnumValueA

RegOpenKeyExA

RegDeleteKeyA

RegDeleteValueA

RegCloseKey

RegCreateKeyExA

comctl32

ImageList_AddMasked

ImageList_Destroy

ord17

ImageList_Create

ole32

CoTaskMemFree

OleInitialize

OleUninitialize

CoCreateInstance

version

GetFileVersionInfoSizeA

GetFileVersionInfoA

VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

$APPDATA/XiTaotao/FavIcon/Default.ico

$APPDATA/XiTaotao/FavIcon/china.alibaba.com.ico

$APPDATA/XiTaotao/FavIcon/cn.msn.com.ico

$APPDATA/XiTaotao/FavIcon/cn.yahoo.com.ico

$APPDATA/XiTaotao/FavIcon/home.dangdang.com.ico

$APPDATA/XiTaotao/FavIcon/reg.renren.com.ico

$APPDATA/XiTaotao/FavIcon/search8.taobao.com.ico

$APPDATA/XiTaotao/FavIcon/wwv.renren.com.ico

$APPDATA/XiTaotao/FavIcon/www.163.com.ico

$APPDATA/XiTaotao/FavIcon/www.39.net.ico

$APPDATA/XiTaotao/FavIcon/www.51.com.ico

$APPDATA/XiTaotao/FavIcon/www.7345.com.ico

$APPDATA/XiTaotao/FavIcon/www.8412.com.ico

$APPDATA/XiTaotao/FavIcon/www.baidu.com.ico

$APPDATA/XiTaotao/FavIcon/www.caiwang.com.ico

$APPDATA/XiTaotao/FavIcon/www.cctv.com.ico

$APPDATA/XiTaotao/FavIcon/www.chinamobile.com.ico

$APPDATA/XiTaotao/FavIcon/www.cmbchina.com.ico

$APPDATA/XiTaotao/FavIcon/www.eachnet.com.ico

$APPDATA/XiTaotao/FavIcon/www.ganji.com.ico

$APPDATA/XiTaotao/FavIcon/www.google.cn.ico

$APPDATA/XiTaotao/FavIcon/www.hao123.com.ico

$APPDATA/XiTaotao/FavIcon/www.hc360.com.ico

$APPDATA/XiTaotao/FavIcon/www.ifeng.com.ico

$APPDATA/XiTaotao/FavIcon/www.pconline.com.cn.ico

$APPDATA/XiTaotao/FavIcon/www.qq.com.ico

$APPDATA/XiTaotao/FavIcon/www.sina.com.cn.ico

$APPDATA/XiTaotao/FavIcon/www.sohu.com.ico

$APPDATA/XiTaotao/FavIcon/www.soufun.com.ico

$APPDATA/XiTaotao/FavIcon/www.taobao.com.ico

$APPDATA/XiTaotao/FavIcon/www.wamei.com.ico

$APPDATA/XiTaotao/FavIcon/www.xinhuanet.com.ico

$APPDATA/XiTaotao/FavIcon/www.youku.com.ico

$APPDATA/XiTaotao/FavIcon/www.zaobao.com.ico

$APPDATA/XiTaotao/FavIcon/www.zhcw.com.ico

$APPDATA/XiTaotao/Mousestate/Cursor.cur

$APPDATA/XiTaotao/Mousestate/NextTab_tip.cur

$APPDATA/XiTaotao/Mousestate/PageDown_tip.cur

$APPDATA/XiTaotao/Mousestate/PageUp_tip.cur

$APPDATA/XiTaotao/Mousestate/PreTab_tip.cur

$APPDATA/XiTaotao/Mousestate/backward_tip.cur

$APPDATA/XiTaotao/Mousestate/close.cur

$APPDATA/XiTaotao/Mousestate/closeAll_tip.cur

$APPDATA/XiTaotao/Mousestate/close_tip.cur

$APPDATA/XiTaotao/Mousestate/forward_tip.cur

$APPDATA/XiTaotao/Mousestate/refresh_tip.cur

$APPDATA/XiTaotao/Page/addse.js

.js

$APPDATA/XiTaotao/Page/configue.js

.js

$APPDATA/XiTaotao/Page/ext-all.js

.js

$APPDATA/XiTaotao/Page/ext-base.js

.js

$APPDATA/XiTaotao/Page/ext-lang-zh_CN.js

.js

$APPDATA/XiTaotao/Page/images/1.ico

$APPDATA/XiTaotao/Page/images/2.ico

$APPDATA/XiTaotao/Page/images/3.ico

$APPDATA/XiTaotao/Page/images/CancelNavigate.JPG

.jpg

$APPDATA/XiTaotao/Page/images/arrow.gif

.gif

$APPDATA/XiTaotao/Page/images/baidu.gif

.gif

$APPDATA/XiTaotao/Page/images/blank_buttonbg.jpg

.jpg

$APPDATA/XiTaotao/Page/images/body_bg.jpg

.jpg

$APPDATA/XiTaotao/Page/images/box/corners-blue.gif

.gif

$APPDATA/XiTaotao/Page/images/box/corners.gif

.gif

$APPDATA/XiTaotao/Page/images/box/l-blue.gif

.gif

$APPDATA/XiTaotao/Page/images/box/l.gif

.gif

$APPDATA/XiTaotao/Page/images/box/r-blue.gif

.gif

$APPDATA/XiTaotao/Page/images/box/r.gif

.gif

$APPDATA/XiTaotao/Page/images/box/tb-blue.gif

.gif

$APPDATA/XiTaotao/Page/images/box/tb.gif

.gif

$APPDATA/XiTaotao/Page/images/box_bottom.jpg

.jpg

$APPDATA/XiTaotao/Page/images/box_top.jpg

.jpg

$APPDATA/XiTaotao/Page/images/button.jpg

.jpg

$APPDATA/XiTaotao/Page/images/button/arrow.gif

.gif

$APPDATA/XiTaotao/Page/images/button/btn.gif

.gif

$APPDATA/XiTaotao/Page/images/button/group-cs.gif

.gif

$APPDATA/XiTaotao/Page/images/button/group-lr.gif

.gif

$APPDATA/XiTaotao/Page/images/button/group-tb.gif

.gif

$APPDATA/XiTaotao/Page/images/button/s-arrow-b-noline.gif

.gif

$APPDATA/XiTaotao/Page/images/button/s-arrow-b.gif

.gif

$APPDATA/XiTaotao/Page/images/button/s-arrow-bo.gif

.gif

$APPDATA/XiTaotao/Page/images/button/s-arrow-noline.gif

.gif

$APPDATA/XiTaotao/Page/images/button/s-arrow-o.gif

.gif

$APPDATA/XiTaotao/Page/images/button/s-arrow.gif

.gif

$APPDATA/XiTaotao/Page/images/button01.jpg

.jpg

$APPDATA/XiTaotao/Page/images/button01_2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/button02.jpg

.jpg

$APPDATA/XiTaotao/Page/images/button02_2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/button_bg1.gif

.gif

$APPDATA/XiTaotao/Page/images/button_bg1.jpg

.jpg

$APPDATA/XiTaotao/Page/images/button_bg2.gif

.gif

$APPDATA/XiTaotao/Page/images/button_bg2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/button_bg3.jpg

.jpg

$APPDATA/XiTaotao/Page/images/button_bg4.jpg

.jpg

$APPDATA/XiTaotao/Page/images/chaosu_logo.jpg

.jpg

$APPDATA/XiTaotao/Page/images/chaosulogo.jpg

.jpg

$APPDATA/XiTaotao/Page/images/china.alibaba.com.ico

$APPDATA/XiTaotao/Page/images/close_bg1.jpg

.jpg

$APPDATA/XiTaotao/Page/images/close_bg2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/cn.bing.com.ico

$APPDATA/XiTaotao/Page/images/color.jpg

.jpg

$APPDATA/XiTaotao/Page/images/color_1.gif

.gif

$APPDATA/XiTaotao/Page/images/color_1.jpg

.jpg

$APPDATA/XiTaotao/Page/images/color_2.gif

.gif

$APPDATA/XiTaotao/Page/images/color_2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/color_3.gif

.gif

$APPDATA/XiTaotao/Page/images/color_3.jpg

.jpg

$APPDATA/XiTaotao/Page/images/color_4.jpg

.jpg

$APPDATA/XiTaotao/Page/images/color_5.jpg

.jpg

$APPDATA/XiTaotao/Page/images/color_6.jpg

.jpg

$APPDATA/XiTaotao/Page/images/color_7.jpg

.jpg

$APPDATA/XiTaotao/Page/images/color_8.jpg

.jpg

$APPDATA/XiTaotao/Page/images/color_9.jpg

.jpg

$APPDATA/XiTaotao/Page/images/colorscroll.png

.png

$APPDATA/XiTaotao/Page/images/dd/drop-add.gif

.gif

$APPDATA/XiTaotao/Page/images/dd/drop-no.gif

.gif

$APPDATA/XiTaotao/Page/images/dd/drop-yes.gif

.gif

$APPDATA/XiTaotao/Page/images/ddd_03.jpg

.jpg

$APPDATA/XiTaotao/Page/images/default.ico

$APPDATA/XiTaotao/Page/images/defcon_high.png

.png

$APPDATA/XiTaotao/Page/images/defcon_low.png

.png

$APPDATA/XiTaotao/Page/images/defcon_med.png

.png

$APPDATA/XiTaotao/Page/images/del.jpg

.jpg

$APPDATA/XiTaotao/Page/images/demo_1.jpg

.jpg

$APPDATA/XiTaotao/Page/images/demo_10.jpg

.jpg

$APPDATA/XiTaotao/Page/images/demo_2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/demo_3.jpg

.jpg

$APPDATA/XiTaotao/Page/images/demo_4.jpg

.jpg

$APPDATA/XiTaotao/Page/images/demo_5.jpg

.jpg

$APPDATA/XiTaotao/Page/images/demo_6.jpg

.jpg

$APPDATA/XiTaotao/Page/images/demo_7.jpg

.jpg

$APPDATA/XiTaotao/Page/images/demo_8.jpg

.jpg

$APPDATA/XiTaotao/Page/images/demo_9.jpg

.jpg

$APPDATA/XiTaotao/Page/images/edit_bg.jpg

.jpg

$APPDATA/XiTaotao/Page/images/editor/tb-sprite.gif

.gif

$APPDATA/XiTaotao/Page/images/ext-all.css

$APPDATA/XiTaotao/Page/images/form/checkbox.gif

.gif

$APPDATA/XiTaotao/Page/images/form/clear-trigger.gif

.gif

$APPDATA/XiTaotao/Page/images/form/clear-trigger.psd

$APPDATA/XiTaotao/Page/images/form/date-trigger.gif

.gif

$APPDATA/XiTaotao/Page/images/form/date-trigger.psd

$APPDATA/XiTaotao/Page/images/form/error-tip-corners.gif

.gif

$APPDATA/XiTaotao/Page/images/form/exclamation.gif

.gif

$APPDATA/XiTaotao/Page/images/form/radio.gif

.gif

$APPDATA/XiTaotao/Page/images/form/search-trigger.gif

.gif

$APPDATA/XiTaotao/Page/images/form/search-trigger.psd

$APPDATA/XiTaotao/Page/images/form/text-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/form/trigger-tpl.gif

.gif

$APPDATA/XiTaotao/Page/images/form/trigger.gif

.gif

$APPDATA/XiTaotao/Page/images/form/trigger.psd

$APPDATA/XiTaotao/Page/images/gesture_1.jpg

.jpg

$APPDATA/XiTaotao/Page/images/gesture_2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/gesture_3.jpg

.jpg

$APPDATA/XiTaotao/Page/images/gesture_4.jpg

.jpg

$APPDATA/XiTaotao/Page/images/gesture_5.jpg

.jpg

$APPDATA/XiTaotao/Page/images/gesture_6.jpg

.jpg

$APPDATA/XiTaotao/Page/images/gesture_7.jpg

.jpg

$APPDATA/XiTaotao/Page/images/gesture_8.jpg

.jpg

$APPDATA/XiTaotao/Page/images/gesture_9.jpg

.jpg

$APPDATA/XiTaotao/Page/images/gradient-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/arrow-left-white.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/arrow-right-white.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/col-move-bottom.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/col-move-top.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/columns.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/dirty.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/done.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/drop-no.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/drop-yes.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/footer-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/grid-blue-hd.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/grid-blue-split.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/grid-hrow.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/grid-loading.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/grid-split.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/grid-vista-hd.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/grid3-hd-btn.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/grid3-hrow-over.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/grid3-hrow.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/grid3-special-col-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/grid3-special-col-sel-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/group-by.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/group-collapse.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/group-expand-sprite.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/group-expand.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/hd-pop.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/hmenu-asc.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/hmenu-desc.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/hmenu-lock.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/hmenu-lock.png

.png

$APPDATA/XiTaotao/Page/images/grid/hmenu-unlock.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/hmenu-unlock.png

.png

$APPDATA/XiTaotao/Page/images/grid/invalid_line.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/loading.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/mso-hd.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/nowait.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/page-first-disabled.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/page-first.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/page-last-disabled.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/page-last.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/page-next-disabled.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/page-next.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/page-prev-disabled.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/page-prev.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/pick-button.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/refresh.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/row-check-sprite.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/row-expand-sprite.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/row-over.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/row-sel.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/sort-hd.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/sort_asc.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/sort_desc.gif

.gif

$APPDATA/XiTaotao/Page/images/grid/wait.gif

.gif

$APPDATA/XiTaotao/Page/images/helpico.jpg

.jpg

$APPDATA/XiTaotao/Page/images/home.dangdang.com.ico

$APPDATA/XiTaotao/Page/images/ico_1616.jpg

.jpg

$APPDATA/XiTaotao/Page/images/ico_default.jpg

.jpg

$APPDATA/XiTaotao/Page/images/ico_renren.jpg

.jpg

$APPDATA/XiTaotao/Page/images/ico_sina.jpg

.jpg

$APPDATA/XiTaotao/Page/images/ico_taobao.jpg

.jpg

$APPDATA/XiTaotao/Page/images/inputbg.jpg

.jpg

$APPDATA/XiTaotao/Page/images/itemico.jpg

.jpg

$APPDATA/XiTaotao/Page/images/layout/collapse.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/expand.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/gradient-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/mini-bottom.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/mini-left.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/mini-right.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/mini-top.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/ns-collapse.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/ns-expand.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/panel-close.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/panel-title-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/panel-title-light-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/stick.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/stuck.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/tab-close-on.gif

.gif

$APPDATA/XiTaotao/Page/images/layout/tab-close.gif

.gif

$APPDATA/XiTaotao/Page/images/left_repeat.jpg

.jpg

$APPDATA/XiTaotao/Page/images/leftrepeat-28.jpg

.jpg

$APPDATA/XiTaotao/Page/images/leftrepeat.jpg

.jpg

$APPDATA/XiTaotao/Page/images/li_bg.jpg

.jpg

$APPDATA/XiTaotao/Page/images/li_bg2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/libg.jpg

.jpg

$APPDATA/XiTaotao/Page/images/loading.gif

.gif

$APPDATA/XiTaotao/Page/images/m1.png

.png

$APPDATA/XiTaotao/Page/images/m10.png

.png

$APPDATA/XiTaotao/Page/images/m11.png

.png

$APPDATA/XiTaotao/Page/images/m1l.png

.png

$APPDATA/XiTaotao/Page/images/m2.png

.png

$APPDATA/XiTaotao/Page/images/m3.png

.png

$APPDATA/XiTaotao/Page/images/m4.png

.png

$APPDATA/XiTaotao/Page/images/m5.png

.png

$APPDATA/XiTaotao/Page/images/m6.png

.png

$APPDATA/XiTaotao/Page/images/m7.png

.png

$APPDATA/XiTaotao/Page/images/m8.png

.png

$APPDATA/XiTaotao/Page/images/m9.png

.png

$APPDATA/XiTaotao/Page/images/main_bg.jpg

.jpg

$APPDATA/XiTaotao/Page/images/menu/checked.gif

.gif

$APPDATA/XiTaotao/Page/images/menu/group-checked.gif

.gif

$APPDATA/XiTaotao/Page/images/menu/item-over.gif

.gif

$APPDATA/XiTaotao/Page/images/menu/menu-parent.gif

.gif

$APPDATA/XiTaotao/Page/images/menu/menu.gif

.gif

$APPDATA/XiTaotao/Page/images/menu/unchecked.gif

.gif

$APPDATA/XiTaotao/Page/images/news.sina.com.cn.ico

$APPDATA/XiTaotao/Page/images/next.jpg

.jpg

$APPDATA/XiTaotao/Page/images/panel/corners-sprite.gif

.gif

$APPDATA/XiTaotao/Page/images/panel/left-right.gif

.gif

$APPDATA/XiTaotao/Page/images/panel/light-hd.gif

.gif

$APPDATA/XiTaotao/Page/images/panel/tool-sprite-tpl.gif

.gif

$APPDATA/XiTaotao/Page/images/panel/tool-sprites.gif

.gif

$APPDATA/XiTaotao/Page/images/panel/tools-sprites-trans.gif

.gif

$APPDATA/XiTaotao/Page/images/panel/top-bottom.gif

.gif

$APPDATA/XiTaotao/Page/images/panel/top-bottom.png

.png

$APPDATA/XiTaotao/Page/images/panel/white-corners-sprite.gif

.gif

$APPDATA/XiTaotao/Page/images/panel/white-left-right.gif

.gif

$APPDATA/XiTaotao/Page/images/panel/white-top-bottom.gif

.gif

$APPDATA/XiTaotao/Page/images/pre.jpg

.jpg

$APPDATA/XiTaotao/Page/images/progress/progress-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/qh_bg1.jpg

.jpg

$APPDATA/XiTaotao/Page/images/qh_bg2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/qh_bg3.jpg

.jpg

$APPDATA/XiTaotao/Page/images/qtip/bg.gif

.gif

$APPDATA/XiTaotao/Page/images/qtip/close.gif

.gif

$APPDATA/XiTaotao/Page/images/qtip/tip-anchor-sprite.gif

.gif

$APPDATA/XiTaotao/Page/images/qtip/tip-sprite.1.gif

.gif

$APPDATA/XiTaotao/Page/images/restore.png

.png

$APPDATA/XiTaotao/Page/images/restoreall.png

.png

$APPDATA/XiTaotao/Page/images/rightmenu_bg.jpg

.jpg

$APPDATA/XiTaotao/Page/images/rightmenu_bg2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/rightmenu_bg3.jpg

.jpg

$APPDATA/XiTaotao/Page/images/s.gif

.gif

$APPDATA/XiTaotao/Page/images/search_bg1.gif

.gif

$APPDATA/XiTaotao/Page/images/search_bg1.jpg

.jpg

$APPDATA/XiTaotao/Page/images/search_bg2.gif

.gif

$APPDATA/XiTaotao/Page/images/search_bg2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/search_bg3.jpg

.jpg

$APPDATA/XiTaotao/Page/images/search_bg4.jpg

.jpg

$APPDATA/XiTaotao/Page/images/shadow-c.png

.png

$APPDATA/XiTaotao/Page/images/shadow-lr.png

.png

$APPDATA/XiTaotao/Page/images/shadow.png

.png

$APPDATA/XiTaotao/Page/images/shared/blue-loading.gif

.gif

$APPDATA/XiTaotao/Page/images/shared/calendar.gif

.gif

$APPDATA/XiTaotao/Page/images/shared/glass-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/shared/hd-sprite.gif

.gif

$APPDATA/XiTaotao/Page/images/shared/large-loading.gif

.gif

$APPDATA/XiTaotao/Page/images/shared/left-btn.gif

.gif

$APPDATA/XiTaotao/Page/images/shared/loading-balls.gif

.gif

$APPDATA/XiTaotao/Page/images/shared/right-btn.gif

.gif

$APPDATA/XiTaotao/Page/images/shared/warning.gif

.gif

$APPDATA/XiTaotao/Page/images/sizer/e-handle-dark.gif

.gif

$APPDATA/XiTaotao/Page/images/sizer/e-handle.gif

.gif

$APPDATA/XiTaotao/Page/images/sizer/ne-handle-dark.gif

.gif

$APPDATA/XiTaotao/Page/images/sizer/ne-handle.gif

.gif

$APPDATA/XiTaotao/Page/images/sizer/nw-handle-dark.gif

.gif

$APPDATA/XiTaotao/Page/images/sizer/nw-handle.gif

.gif

$APPDATA/XiTaotao/Page/images/sizer/s-handle-dark.gif

.gif

$APPDATA/XiTaotao/Page/images/sizer/s-handle.gif

.gif

$APPDATA/XiTaotao/Page/images/sizer/se-handle-dark.gif

.gif

$APPDATA/XiTaotao/Page/images/sizer/se-handle.gif

.gif

$APPDATA/XiTaotao/Page/images/sizer/square.gif

.gif

$APPDATA/XiTaotao/Page/images/sizer/sw-handle-dark.gif

.gif

$APPDATA/XiTaotao/Page/images/sizer/sw-handle.gif

.gif

$APPDATA/XiTaotao/Page/images/slider-bg.png

.png

$APPDATA/XiTaotao/Page/images/slider-thumb.png

.png

$APPDATA/XiTaotao/Page/images/slider/slider-bg.png

.png

$APPDATA/XiTaotao/Page/images/slider/slider-thumb.png

.png

$APPDATA/XiTaotao/Page/images/slider/slider-v-bg.png

.png

$APPDATA/XiTaotao/Page/images/slider/slider-v-thumb.png

.png

$APPDATA/XiTaotao/Page/images/sports.sina.com.cn.ico

$APPDATA/XiTaotao/Page/images/style.css

$APPDATA/XiTaotao/Page/images/style1.css

$APPDATA/XiTaotao/Page/images/style1.jpg

.jpg

$APPDATA/XiTaotao/Page/images/style2.css

$APPDATA/XiTaotao/Page/images/style2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/tabs/scroll-left.gif

.gif

$APPDATA/XiTaotao/Page/images/tabs/scroll-right.gif

.gif

$APPDATA/XiTaotao/Page/images/tabs/scroller-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/tabs/tab-btm-inactive-left-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/tabs/tab-btm-inactive-right-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/tabs/tab-btm-left-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/tabs/tab-btm-right-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/tabs/tab-close.gif

.gif

$APPDATA/XiTaotao/Page/images/tabs/tab-strip-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/tabs/tab-strip-bg.png

.png

$APPDATA/XiTaotao/Page/images/tabs/tab-strip-btm-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/tabs/tabs-sprite.gif

.gif

$APPDATA/XiTaotao/Page/images/temp_1.jpg

.jpg

$APPDATA/XiTaotao/Page/images/temp_2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/temp_3.jpg

.jpg

$APPDATA/XiTaotao/Page/images/temp_4.jpg

.jpg

$APPDATA/XiTaotao/Page/images/text_bg.jpg

.jpg

$APPDATA/XiTaotao/Page/images/ticks.gif

.gif

$APPDATA/XiTaotao/Page/images/toolbar/bg.gif

.gif

$APPDATA/XiTaotao/Page/images/toolbar/btn-arrow-light.gif

.gif

$APPDATA/XiTaotao/Page/images/toolbar/btn-arrow.gif

.gif

$APPDATA/XiTaotao/Page/images/toolbar/btn-over-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/toolbar/gray-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/toolbar/more.gif

.gif

$APPDATA/XiTaotao/Page/images/toolbar/tb-bg.gif

.gif

$APPDATA/XiTaotao/Page/images/toolbar/tb-btn-sprite.gif

.gif

$APPDATA/XiTaotao/Page/images/toolbar/tb-xl-btn-sprite.gif

.gif

$APPDATA/XiTaotao/Page/images/toolbar/tb-xl-sep.gif

.gif

$APPDATA/XiTaotao/Page/images/top_repeat.jpg

.jpg

$APPDATA/XiTaotao/Page/images/toprepeat.jpg

.jpg

$APPDATA/XiTaotao/Page/images/tree/arrows.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/drop-add.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/drop-between.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/drop-no.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/drop-over.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/drop-under.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/drop-yes.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/elbow-end-minus-nl.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/elbow-end-minus.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/elbow-end-plus-nl.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/elbow-end-plus.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/elbow-end.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/elbow-line.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/elbow-minus-nl.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/elbow-minus.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/elbow-plus-nl.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/elbow-plus.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/elbow.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/folder-open.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/folder.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/leaf.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/loading.gif

.gif

$APPDATA/XiTaotao/Page/images/tree/s.gif

.gif

$APPDATA/XiTaotao/Page/images/url_bg1.jpg

.jpg

$APPDATA/XiTaotao/Page/images/url_bg2.jpg

.jpg

$APPDATA/XiTaotao/Page/images/url_bg3.jpg

.jpg

$APPDATA/XiTaotao/Page/images/url_bg4.jpg

.jpg

$APPDATA/XiTaotao/Page/images/window/icon-error.gif

.gif

$APPDATA/XiTaotao/Page/images/window/icon-info.gif

.gif

$APPDATA/XiTaotao/Page/images/window/icon-question.gif

.gif

$APPDATA/XiTaotao/Page/images/window/icon-warning.gif

.gif

$APPDATA/XiTaotao/Page/images/window/left-corners.png

.png

$APPDATA/XiTaotao/Page/images/window/left-corners.psd

$APPDATA/XiTaotao/Page/images/window/left-right.png

.png

$APPDATA/XiTaotao/Page/images/window/left-right.psd

$APPDATA/XiTaotao/Page/images/window/right-corners.png

.png

$APPDATA/XiTaotao/Page/images/window/right-corners.psd

$APPDATA/XiTaotao/Page/images/window/top-bottom.png

.png

$APPDATA/XiTaotao/Page/images/window/top-bottom.psd

$APPDATA/XiTaotao/Page/images/www.163.com.ico

$APPDATA/XiTaotao/Page/images/www.39.net.ico

$APPDATA/XiTaotao/Page/images/www.51.com.ico

$APPDATA/XiTaotao/Page/images/www.7y7.com.ico

$APPDATA/XiTaotao/Page/images/www.7y7.com.jpg

.jpg

$APPDATA/XiTaotao/Page/images/www.amazon.cn.ico

$APPDATA/XiTaotao/Page/images/www.baidu.com.ico

$APPDATA/XiTaotao/Page/images/www.baidu.com.jpg

.jpg

$APPDATA/XiTaotao/Page/images/www.caiwang.com.ico

$APPDATA/XiTaotao/Page/images/www.caiwang.com.jpg

.jpg

$APPDATA/XiTaotao/Page/images/www.cctv.com.ico

$APPDATA/XiTaotao/Page/images/www.cctv.com.jpg

.jpg

$APPDATA/XiTaotao/Page/images/www.chinamobile.com.ico

$APPDATA/XiTaotao/Page/images/www.google.cn.ico

$APPDATA/XiTaotao/Page/images/www.google.cn.jpg

.jpg

$APPDATA/XiTaotao/Page/images/www.icbc.com.cn.ico

$APPDATA/XiTaotao/Page/images/www.icbc.com.cn.jpg

.jpg

$APPDATA/XiTaotao/Page/images/www.ifeng.com.ico

$APPDATA/XiTaotao/Page/images/www.kaixin001.com.ico

$APPDATA/XiTaotao/Page/images/www.pconline.com.cn.ico

$APPDATA/XiTaotao/Page/images/www.sina.com.cn.ico

$APPDATA/XiTaotao/Page/images/www.sogou.com.ico

$APPDATA/XiTaotao/Page/images/www.taobao.com.ico

$APPDATA/XiTaotao/Page/images/www.taobao.com.jpg

.jpg

$APPDATA/XiTaotao/Page/images/www.tianya.cn.ico

$APPDATA/XiTaotao/Page/images/www.tianya.cn.jpg

.jpg

$APPDATA/XiTaotao/Page/images/www.tudou.com.ico

$APPDATA/XiTaotao/Page/images/www.youku.com.ico

$APPDATA/XiTaotao/Page/images/xqh_bg4.jpg

.jpg

$APPDATA/XiTaotao/Skin/Default/ChaoSuSetting.png

.png

$APPDATA/XiTaotao/Skin/Default/Exit.png

.png

$APPDATA/XiTaotao/Skin/Default/FavoriteAdd.png

.png

$APPDATA/XiTaotao/Skin/Default/Find.png

.png

$APPDATA/XiTaotao/Skin/Default/MainMenuBar.png

.png

$APPDATA/XiTaotao/Skin/Default/NewTab.png

.png

$APPDATA/XiTaotao/Skin/Default/Print.png

.png

$APPDATA/XiTaotao/Skin/Default/Save.png

.png

$APPDATA/XiTaotao/Skin/Default/ZoomArrow.png

.png

$APPDATA/XiTaotao/Skin/Default/address.png

.png

$APPDATA/XiTaotao/Skin/Default/addurl.png

.png

$APPDATA/XiTaotao/Skin/Default/allsearch.png

.png

$APPDATA/XiTaotao/Skin/Default/app.ico

$APPDATA/XiTaotao/Skin/Default/backward.png

.png

$APPDATA/XiTaotao/Skin/Default/bottombar.png

.png

$APPDATA/XiTaotao/Skin/Default/chevron.png

.png

$APPDATA/XiTaotao/Skin/Default/cuxiaobutton.png

.png

$APPDATA/XiTaotao/Skin/Default/dropdown.png

.png

$APPDATA/XiTaotao/Skin/Default/edit.png

.png

$APPDATA/XiTaotao/Skin/Default/enter.png

.png

$APPDATA/XiTaotao/Skin/Default/fav_add.ico

$APPDATA/XiTaotao/Skin/Default/fav_directory3.ico

$APPDATA/XiTaotao/Skin/Default/fav_directory4.ico

$APPDATA/XiTaotao/Skin/Default/fav_net_login.ico

$APPDATA/XiTaotao/Skin/Default/fav_net_nologin.ico

$APPDATA/XiTaotao/Skin/Default/fav_sidebar.ico

$APPDATA/XiTaotao/Skin/Default/fav_url.ico

$APPDATA/XiTaotao/Skin/Default/favbar.png

.png

$APPDATA/XiTaotao/Skin/Default/favmore.png

.png

$APPDATA/XiTaotao/Skin/Default/favorites.png

.png

$APPDATA/XiTaotao/Skin/Default/findbarClose.png

.png

$APPDATA/XiTaotao/Skin/Default/findbarHighLight.png

.png

$APPDATA/XiTaotao/Skin/Default/findbarNext.png

.png

$APPDATA/XiTaotao/Skin/Default/findbarPrevious.png

.png

$APPDATA/XiTaotao/Skin/Default/findbaritem.png

.png

$APPDATA/XiTaotao/Skin/Default/forward.png

.png

$APPDATA/XiTaotao/Skin/Default/home.png

.png

$APPDATA/XiTaotao/Skin/Default/img_lock.png

.png

$APPDATA/XiTaotao/Skin/Default/img_progress.png

.png

$APPDATA/XiTaotao/Skin/Default/img_refresh.png

.png

$APPDATA/XiTaotao/Skin/Default/keywordarrow.png

.png

$APPDATA/XiTaotao/Skin/Default/keywordbar.png

.png

$APPDATA/XiTaotao/Skin/Default/liquidate.png

.png

$APPDATA/XiTaotao/Skin/Default/mask.png

.png

$APPDATA/XiTaotao/Skin/Default/menuhilight.png

.png

$APPDATA/XiTaotao/Skin/Default/menuicon.png

.png

$APPDATA/XiTaotao/Skin/Default/menumask.png

.png

$APPDATA/XiTaotao/Skin/Default/miaoshabutton.png

.png

$APPDATA/XiTaotao/Skin/Default/navigatebutton.png

.png

$APPDATA/XiTaotao/Skin/Default/navihistory.png

.png

$APPDATA/XiTaotao/Skin/Default/new.png

.png

$APPDATA/XiTaotao/Skin/Default/next.png

.png

$APPDATA/XiTaotao/Skin/Default/openclosesidebar.png

.png

$APPDATA/XiTaotao/Skin/Default/openfavorite.png

.png

$APPDATA/XiTaotao/Skin/Default/previous.png

.png

$APPDATA/XiTaotao/Skin/Default/private.png

.png

$APPDATA/XiTaotao/Skin/Default/refresh.png

.png

$APPDATA/XiTaotao/Skin/Default/refresh_combine.png

.png

$APPDATA/XiTaotao/Skin/Default/restore.png

.png

$APPDATA/XiTaotao/Skin/Default/scrollbg.png

.png

$APPDATA/XiTaotao/Skin/Default/scrollgauge.png

.png

$APPDATA/XiTaotao/Skin/Default/search.ico

$APPDATA/XiTaotao/Skin/Default/search.png

.png

$APPDATA/XiTaotao/Skin/Default/searcharrow.png

.png

$APPDATA/XiTaotao/Skin/Default/searchbox.png

.png

$APPDATA/XiTaotao/Skin/Default/searchenter.png

.png

$APPDATA/XiTaotao/Skin/Default/select.png

.png

$APPDATA/XiTaotao/Skin/Default/sep.png

.png

$APPDATA/XiTaotao/Skin/Default/separatorbutton.png

.png

$APPDATA/XiTaotao/Skin/Default/shequbutton.png

.png

$APPDATA/XiTaotao/Skin/Default/sidebaradd.png

.png

$APPDATA/XiTaotao/Skin/Default/sidebarclose.png

.png

$APPDATA/XiTaotao/Skin/Default/sidebarfavorite.png

.png

$APPDATA/XiTaotao/Skin/Default/sidebarfloat.png

.png

$APPDATA/XiTaotao/Skin/Default/sidebarlock.png

.png

$APPDATA/XiTaotao/Skin/Default/sidebarorganize.png

.png

$APPDATA/XiTaotao/Skin/Default/sizestatus.png

.png

$APPDATA/XiTaotao/Skin/Default/skinpreview.PNG

.png

$APPDATA/XiTaotao/Skin/Default/statusitem.png

.png

$APPDATA/XiTaotao/Skin/Default/stop.png

.png

$APPDATA/XiTaotao/Skin/Default/stop_combine.png

.png

$APPDATA/XiTaotao/Skin/Default/tab_close.png

.png

$APPDATA/XiTaotao/Skin/Default/tab_dragmark.png

.png

$APPDATA/XiTaotao/Skin/Default/tab_new.png

.png

$APPDATA/XiTaotao/Skin/Default/tab_progress.png

.png

$APPDATA/XiTaotao/Skin/Default/tabbar.png

.png

$APPDATA/XiTaotao/Skin/Default/tabbutton.png

.png

$APPDATA/XiTaotao/Skin/Default/tabbutton2.png

.png

$APPDATA/XiTaotao/Skin/Default/tabitem.png

.png

$APPDATA/XiTaotao/Skin/Default/taohebutton.png

.png

$APPDATA/XiTaotao/Skin/Default/thumb.png

.png

$APPDATA/XiTaotao/Skin/Default/title_close.png

.png

$APPDATA/XiTaotao/Skin/Default/title_cus.png

.png

$APPDATA/XiTaotao/Skin/Default/title_max.png

.png

$APPDATA/XiTaotao/Skin/Default/title_max2.png

.png

$APPDATA/XiTaotao/Skin/Default/title_min.png

.png

$APPDATA/XiTaotao/Skin/Default/titlebar.png

.png

$APPDATA/XiTaotao/Skin/Default/titlelink.png

.png

$APPDATA/XiTaotao/Skin/Default/titlemore.png

.png

$APPDATA/XiTaotao/Skin/Default/tixingbutton.png

.png

$APPDATA/XiTaotao/Skin/Default/tool.png

.png

$APPDATA/XiTaotao/Skin/Default/topbar.png

.png

$APPDATA/XiTaotao/Skin/Default/translate.png

.png

$APPDATA/XiTaotao/Skin/Default/tuangou.png

.png

$APPDATA/XiTaotao/Skin/Default/tuangoubutton.png

.png

$APPDATA/XiTaotao/Skin/Default/xttskin.config

.xml

$APPDATA/XiTaotao/config/xttBrowser-bak.config

.xml

$APPDATA/XiTaotao/config/xttBrowser.config

.xml

$APPDATA/XiTaotao/config/xttCustomButton.config

.xml

$APPDATA/XiTaotao/config/xtturldatabase.config

$PLUGINSDIR/InstallOptions.dll

.dll windows:4 windows x86 arch:x86

295fc8c35dee88b924b0f6bafc807c6c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA

GetCurrentDirectoryA

GetTickCount

MultiByteToWideChar

GetPrivateProfileIntA

GlobalLock

GetModuleHandleA

lstrcmpiA

GetPrivateProfileStringA

lstrcatA

lstrcpynA

WritePrivateProfileStringA

lstrlenA

lstrcpyA

GlobalFree

GlobalUnlock

GlobalAlloc

user32

LoadCursorA

PtInRect

MapWindowPoints

GetDlgCtrlID

CloseClipboard

SetCursor

OpenClipboard

GetClientRect

SetWindowRgn

LoadIconA

LoadImageA

SetWindowLongA

CreateWindowExA

MapDialogRect

SetWindowPos

GetWindowRect

CreateDialogParamA

ShowWindow

EnableMenuItem

GetSystemMenu

EnableWindow

GetDlgItem

DestroyIcon

DestroyWindow

DispatchMessageA

TranslateMessage

GetMessageA

IsDialogMessageA

DrawTextA

GetWindowLongA

DrawFocusRect

MessageBoxA

CallWindowProcA

PostMessageA

SetTimer

KillTimer

CharNextA

wsprintfA

GetWindowTextA

SetWindowTextA

SendMessageA

GetClipboardData

gdi32

SetTextColor

CreateCompatibleDC

GetObjectA

GetDIBits

CreateRectRgn

CombineRgn

DeleteObject

SelectObject

shell32

SHBrowseForFolderA

SHGetDesktopFolder

SHGetPathFromIDListA

ShellExecuteA

comdlg32

GetOpenFileNameA

GetSaveFileNameA

CommDlgExtendedError

ole32

CoTaskMemFree

Exports

dialog

initDialog

show

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc

GlobalFree

GlobalSize

GetLastError

lstrcpyA

lstrcpynA

FreeLibrary

lstrcatA

GetProcAddress

LoadLibraryA

GetModuleHandleA

MultiByteToWideChar

lstrlenA

WideCharToMultiByte

VirtualAlloc

VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2

CLSIDFromString

Exports

Alloc

Call

Copy

Free

Get

Int64Op

Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 470B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

TaobaoAPI.dll

.dll windows:5 windows x86 arch:x86

c97cfe45ad7a9f2656e59b3417cf60bb

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

KeyUsageCertSign

KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

01/07/2010, 00:00

Not After

30/06/2013, 23:59

Subject

CN=Hubei Dudu Network Technology co.\,ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Hubei Dudu Network Technology co.\,ltd.,L=wuhanshi,ST=hubeisheng,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\XiTaoTao\TaobaoAPI\Release\TaobaoAPI.pdb

Imports

kernel32

WaitForSingleObject

SetEvent

InitializeCriticalSection

WideCharToMultiByte

LeaveCriticalSection

MultiByteToWideChar

EnterCriticalSection

CreateEventW

CreateThread

FlushFileBuffers

CloseHandle

CreateFileA

GetLocaleInfoA

GetStringTypeW

GetStringTypeA

LCMapStringW

LCMapStringA

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetStdHandle

InitializeCriticalSectionAndSpinCount

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

GetCurrentThreadId

GetCommandLineA

RaiseException

RtlUnwind

GetLastError

HeapFree

HeapAlloc

GetModuleHandleW

GetProcAddress

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

InterlockedIncrement

SetLastError

InterlockedDecrement

Sleep

HeapSize

ExitProcess

SetHandleCount

GetStdHandle

GetFileType

GetStartupInfoA

DeleteCriticalSection

GetModuleFileNameA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

HeapCreate

HeapDestroy

VirtualFree

QueryPerformanceCounter

GetTickCount

GetCurrentProcessId

GetSystemTimeAsFileTime

VirtualAlloc

HeapReAlloc

SetFilePointer

WriteFile

GetConsoleCP

GetConsoleMode

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

LoadLibraryA

user32

IsWindow

SendMessageW

ws2_32

WSAEnumNetworkEvents

htons

WSAEventSelect

recv

WSAGetLastError

WSACreateEvent

closesocket

gethostbyname

send

WSAWaitForMultipleEvents

WSAStartup

connect

ioctlsocket

WSACloseEvent

socket

Exports

_TaobaoSearch@8

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

detoured.dll

.dll windows:5 windows x86 arch:x86

6c8408bb5d7d5a5b75b9314f94e68763

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

KeyUsageCertSign

KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

01/07/2010, 00:00

Not After

30/06/2013, 23:59

Subject

CN=Hubei Dudu Network Technology co.\,ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Hubei Dudu Network Technology co.\,ltd.,L=wuhanshi,ST=hubeisheng,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\Program Files\Microsoft Research\Detours Express 2.1\bin\detoured.pdb

Imports

kernel32

DisableThreadLibraryCalls

Exports

Detoured

Sections

.text
Size: 512B - Virtual size: 42B

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 313B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

setup.ico

uninst.exe.nsis

xtt.ico

xttProxy.dll

.dll regsvr32 windows:5 windows x86 arch:x86

eda5abdb9cbd837dfbd09fd54e34f220

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

KeyUsageCertSign

KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

01/07/2010, 00:00

Not After

30/06/2013, 23:59

Subject

CN=Hubei Dudu Network Technology co.\,ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Hubei Dudu Network Technology co.\,ltd.,L=wuhanshi,ST=hubeisheng,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

d:\XiTaoTao\XiTaoTaoProxy\Release\xttProxy.pdb

Imports

kernel32

InterlockedIncrement

InterlockedDecrement

lstrlenW

GetModuleHandleA

GetLastError

IsDBCSLeadByte

lstrcmpiA

RaiseException

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

SetThreadLocale

GetThreadLocale

WideCharToMultiByte

LoadLibraryExA

GetProcAddress

GetModuleHandleW

HeapDestroy

HeapAlloc

HeapFree

HeapReAlloc

HeapSize

GetProcessHeap

FindResourceExA

LoadResource

LockResource

SizeofResource

FindResourceA

GetModuleFileNameA

lstrlenA

MultiByteToWideChar

InitializeCriticalSection

FreeLibrary

lstrcpyA

InitializeCriticalSectionAndSpinCount

GetStringTypeW

GetStringTypeA

LCMapStringW

LCMapStringA

GetLocaleInfoA

LoadLibraryA

GetSystemTimeAsFileTime

GetCurrentProcessId

GetTickCount

QueryPerformanceCounter

GetEnvironmentStringsW

FreeEnvironmentStringsW

GetEnvironmentStrings

FreeEnvironmentStringsA

RtlUnwind

VirtualProtect

VirtualAlloc

GetSystemInfo

VirtualQuery

GetCurrentThreadId

GetCommandLineA

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

SetLastError

TerminateProcess

GetCurrentProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

WriteFile

GetStdHandle

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

HeapCreate

VirtualFree

Sleep

ExitProcess

SetHandleCount

GetFileType

GetStartupInfoA

user32

CharNextW

CharNextA

advapi32

RegDeleteValueA

RegCreateKeyExA

RegDeleteKeyA

RegEnumKeyExA

RegSetValueExA

RegOpenKeyExA

RegOpenKeyA

RegQueryValueExA

RegCloseKey

RegQueryInfoKeyA

ole32

StringFromCLSID

CoTaskMemFree

CoTaskMemRealloc

StringFromGUID2

CoCreateInstance

CoTaskMemAlloc

shell32

SHGetFileInfoA

oleaut32

UnRegisterTypeLi

SysAllocString

RegisterTypeLi

SysStringLen

LoadRegTypeLi

VarUI4FromStr

GetErrorInfo

VariantChangeType

VariantCopy

VariantClear

LoadTypeLi

VariantInit

SysAllocStringLen

SysFreeString

Exports

DllCanUnloadNow

DllGetClassObject

DllMain

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

xttbrowser.bak

.exe windows:5 windows x86 arch:x86

974a1c7a7ce391a3be3d6868b1da51e2

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

KeyUsageCertSign

KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

01/07/2010, 00:00

Not After

30/06/2013, 23:59

Subject

CN=Hubei Dudu Network Technology co.\,ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Hubei Dudu Network Technology co.\,ltd.,L=wuhanshi,ST=hubeisheng,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\XiTaoTao\XiTaoTao\Release\xttbrowser.pdb

Imports

gdiplus

GdiplusShutdown

GdipLoadImageFromFile

GdipSaveImageToFile

GdiplusStartup

GdipBitmapSetPixel

GdipCreateBitmapFromHBITMAP

GdipGetImageEncoders

GdipGetImageEncodersSize

GdipBitmapGetPixel

GdipDrawImageRectI

GdipSetImageAttributesWrapMode

GdipDisposeImageAttributes

GdipCreateImageAttributes

GdipDisposeImage

GdipCloneImage

GdipAlloc

GdipGetImageHeight

GdipFree

GdipCreateBitmapFromResource

GdipGetImageWidth

GdipDrawImageRectRectI

GdipDeleteGraphics

GdipCreateFromHDC

GdipCreateBitmapFromFileICM

wininet

FindCloseUrlCache

InternetSetOptionW

InternetOpenW

InternetOpenUrlW

InternetCloseHandle

FindNextUrlCacheEntryW

DeleteUrlCacheEntryW

FindFirstUrlCacheEntryW

shell32

DragAcceptFiles

SHGetSpecialFolderPathW

ShellExecuteW

Shell_NotifyIconW

CommandLineToArgvW

ShellExecuteExW

DragQueryFileW

SHGetFolderPathW

SHGetDesktopFolder

psapi

EnumProcessModules

GetModuleBaseNameW

EnumProcesses

iphlpapi

GetAdaptersInfo

taobaoapi

_TaobaoSearch@8

wintrust

WinVerifyTrust

CryptCATAdminReleaseCatalogContext

CryptCATAdminCalcHashFromFileHandle

CryptCATAdminAcquireContext

CryptCATAdminEnumCatalogFromHash

CryptCATCatalogInfoFromContext

CryptCATAdminReleaseContext

detoured

Detoured

kernel32

FindResourceExW

FileTimeToLocalFileTime

FileTimeToSystemTime

HeapAlloc

GetProcessHeap

HeapFree

SetUnhandledExceptionFilter

GlobalFindAtomW

GlobalAddAtomW

LoadLibraryW

GetCommandLineW

GetCurrentThread

RaiseException

GlobalDeleteAtom

CreateMutexW

FreeLibrary

GetProcAddress

GetModuleHandleW

lstrcmpiW

LoadLibraryExW

GetModuleFileNameW

DeleteCriticalSection

InitializeCriticalSection

GetPrivateProfileIntW

SetLastError

GlobalFree

lstrlenA

DebugBreak

OutputDebugStringW

WideCharToMultiByte

lstrcpyW

GetPrivateProfileStringW

FindFirstFileW

FindNextFileW

FindClose

GetFileAttributesW

GetVersionExW

GlobalLock

GlobalUnlock

LockResource

OpenProcess

TerminateProcess

lstrcpynW

CreateProcessW

OpenFileMappingW

MapViewOfFile

UnmapViewOfFile

ReleaseMutex

CreateFileMappingW

lstrcmpiA

RemoveDirectoryW

SetFileAttributesW

CopyFileW

FileTimeToDosDateTime

GetSystemTime

GetLocalTime

lstrcmpW

CompareStringW

GlobalAlloc

MulDiv

CreateFileW

FindResourceW

GetFileSize

SystemTimeToFileTime

VirtualAllocEx

ReadProcessMemory

VirtualFreeEx

ExpandEnvironmentStringsW

GetTempPathW

Sleep

LocalFree

LoadLibraryA

CompareFileTime

lstrcatW

VirtualQuery

VirtualProtect

VirtualAlloc

InterlockedCompareExchange

ResumeThread

GetThreadContext

SetThreadContext

SuspendThread

SizeofResource

GetLastError

CreateDirectoryW

DeleteFileW

LeaveCriticalSection

EnterCriticalSection

GetCurrentThreadId

FlushInstructionCache

GetCurrentProcess

MultiByteToWideChar

SetEvent

SetThreadPriority

CreateEventW

CloseHandle

GetTickCount

WaitForSingleObject

CreateThread

InterlockedIncrement

lstrlenW

InterlockedDecrement

LCMapStringW

GetCPInfo

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

ExitProcess

IsProcessorFeaturePresent

VirtualFree

HeapDestroy

HeapReAlloc

HeapSize

UnhandledExceptionFilter

IsDebuggerPresent

MoveFileW

GetStartupInfoW

RtlUnwind

LCMapStringA

HeapCreate

WriteFile

ReadFile

LoadResource

GetStdHandle

GetModuleFileNameA

GetACP

GetOEMCP

IsValidCodePage

GetConsoleCP

GetConsoleMode

GetTimeZoneInformation

FreeEnvironmentStringsW

GetEnvironmentStringsW

SetHandleCount

GetFileType

GetStartupInfoA

QueryPerformanceCounter

GetSystemTimeAsFileTime

GetLocaleInfoA

GetStringTypeA

GetStringTypeW

InitializeCriticalSectionAndSpinCount

SetFilePointer

WriteConsoleA

GetConsoleOutputCP

WriteConsoleW

SetStdHandle

FlushFileBuffers

CreateFileA

CompareStringA

SetEnvironmentVariableA

GetCurrentProcessId

user32

SetMenuDefaultItem

CallNextHookEx

TranslateAcceleratorW

SetWindowRgn

CreateAcceleratorTableW

SetRectEmpty

IsMenu

GetMenuInfo

SetMenuInfo

IsWindowEnabled

FillRect

GetDlgCtrlID

GetCapture

DrawFocusRect

GetDesktopWindow

InvalidateRgn

RegisterWindowMessageW

FindWindowExW

wsprintfW

InsertMenuW

DeleteMenu

EnableWindow

AttachThreadInput

IntersectRect

IsRectEmpty

CharUpperW

EnableMenuItem

GetCursor

DestroyCursor

EmptyClipboard

SetClipboardData

GetDoubleClickTime

GetClassNameW

GetFocus

ReleaseCapture

SetCapture

ShowCursor

SetCursor

GetMenuItemInfoW

CheckMenuItem

LoadMenuW

GetSubMenu

GetMenuStringW

GetMenuState

CreatePopupMenu

MonitorFromPoint

TrackPopupMenu

SetActiveWindow

DestroyAcceleratorTable

InflateRect

SetMenu

GetSystemMenu

RedrawWindow

GetAsyncKeyState

WindowFromPoint

GetSystemMetrics

GetWindowDC

OffsetRect

GetForegroundWindow

GetKeyState

UnregisterClassA

AppendMenuW

GetMenuItemID

GetMenuItemCount

DestroyMenu

IsZoomed

ScreenToClient

GetMessagePos

PostThreadMessageW

EndDialog

DialogBoxParamW

SetMenuItemInfoW

IsIconic

CloseClipboard

GetClipboardData

OpenClipboard

GetWindowTextLengthW

IsClipboardFormatAvailable

GetSysColor

GetActiveWindow

GetDlgItem

MonitorFromWindow

GetMonitorInfoW

MapWindowPoints

IsWindowVisible

SetWindowTextW

wvsprintfW

GetWindowRect

GetParent

GetWindow

DrawIconEx

LoadImageW

DestroyIcon

PtInRect

SetWindowPos

ReleaseDC

GetDC

ClientToScreen

DrawTextW

KillTimer

SetTimer

SetFocus

IsWindow

InvalidateRect

EndPaint

BeginPaint

MoveWindow

GetClientRect

GetClassInfoExW

RegisterClassExW

CreateWindowExW

MsgWaitForMultipleObjects

SendMessageTimeoutW

AllowSetForegroundWindow

FindWindowW

PostQuitMessage

UnhookWindowsHookEx

UnregisterHotKey

PeekMessageW

GetMessageW

TranslateMessage

DispatchMessageW

SetWindowsHookExW

RegisterHotKey

SetForegroundWindow

UpdateWindow

SetWindowPlacement

GetWindowPlacement

GetWindowThreadProcessId

IsChild

LoadCursorW

MessageBoxW

CharNextW

DestroyWindow

CallWindowProcW

DefWindowProcW

SetWindowLongW

GetWindowLongW

CopyRect

SystemParametersInfoW

PostMessageW

ShowWindow

LoadStringW

CharLowerW

SendMessageW

ShowWindowAsync

EqualRect

GetWindowTextW

GetCursorPos

gdi32

CreateCompatibleBitmap

CreatePen

ExtTextOutW

DPtoLP

BitBlt

SetBkColor

LPtoDP

Rectangle

SetTextColor

CreateSolidBrush

SetBkMode

SelectObject

DeleteObject

CreateBitmapIndirect

CreateCompatibleDC

GetTextExtentPoint32W

GetStockObject

DeleteDC

StretchBlt

GetCurrentObject

GetDeviceCaps

GetObjectW

SetViewportOrgEx

GetClipBox

RestoreDC

SaveDC

SetWindowOrgEx

CombineRgn

CreateRectRgn

LineTo

MoveToEx

CreateFontIndirectW

CreateDCW

comdlg32

GetOpenFileNameW

GetSaveFileNameW

advapi32

RegCreateKeyW

GetNamedSecurityInfoW

SetNamedSecurityInfoW

SetEntriesInAclW

LookupPrivilegeValueW

RegCloseKey

RegCreateKeyExW

RegSetValueExW

OpenProcessToken

GetTokenInformation

GetLengthSid

CopySid

GetSidIdentifierAuthority

GetSidSubAuthorityCount

GetSidSubAuthority

RegOpenKeyExW

RegGetKeySecurity

AllocateAndInitializeSid

InitializeAcl

AddAce

InitializeSecurityDescriptor

SetSecurityDescriptorDacl

FreeSid

RegSetKeySecurity

RegQueryInfoKeyW

RegEnumKeyW

GetUserNameW

RegDeleteKeyW

RegEnumKeyExW

RegDeleteValueW

RegOpenKeyW

RegQueryValueExW

AdjustTokenPrivileges

ole32

CoInitialize

CoUninitialize

CoTaskMemFree

CoCreateInstance

CoTaskMemRealloc

CoTaskMemAlloc

CoRegisterClassObject

CoRevokeClassObject

OleUninitialize

StringFromGUID2

OleLockRunning

CreateStreamOnHGlobal

CoGetClassObject

CLSIDFromProgID

CLSIDFromString

OleInitialize

ReleaseStgMedium

CoMarshalInterThreadInterfaceInStream

CoGetMalloc

CreateBindCtx

CoGetMarshalSizeMax

CoMarshalInterface

CoGetInterfaceAndReleaseStream

CoUnmarshalInterface

CoInitializeEx

oleaut32

SysStringByteLen

SysAllocStringByteLen

VarUI4FromStr

SysFreeString

SysAllocString

OleCreateFontIndirect

SysStringLen

LoadRegTypeLi

LoadTypeLi

VariantClear

VariantInit

SysAllocStringLen

DispCallFunc

VarBstrCmp

shlwapi

StrCmpLogicalW

SHGetValueW

SHDeleteKeyW

SHSetValueW

urlmon

URLDownloadToFileW

UrlMkGetSessionOption

UrlMkSetSessionOption

comctl32

ImageList_Create

ImageList_DragMove

ImageList_DragLeave

ImageList_EndDrag

_TrackMouseEvent

InitCommonControlsEx

ImageList_DragEnter

ImageList_BeginDrag

ImageList_Destroy

ImageList_ReplaceIcon

ImageList_DragShowNolock

Sections

.text
Size: 823KB - Virtual size: 822KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 291KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 913KB - Virtual size: 912KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

xttbrowser.exe

.exe windows:5 windows x86 arch:x86

974a1c7a7ce391a3be3d6868b1da51e2

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

KeyUsageCertSign

KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

01/07/2010, 00:00

Not After

30/06/2013, 23:59

Subject

CN=Hubei Dudu Network Technology co.\,ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Hubei Dudu Network Technology co.\,ltd.,L=wuhanshi,ST=hubeisheng,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\XiTaoTao\XiTaoTao\Release\xttbrowser.pdb

Imports

gdiplus

GdiplusShutdown

GdipLoadImageFromFile

GdipSaveImageToFile

GdiplusStartup

GdipBitmapSetPixel

GdipCreateBitmapFromHBITMAP

GdipGetImageEncoders

GdipGetImageEncodersSize

GdipBitmapGetPixel

GdipDrawImageRectI

GdipSetImageAttributesWrapMode

GdipDisposeImageAttributes

GdipCreateImageAttributes

GdipDisposeImage

GdipCloneImage

GdipAlloc

GdipGetImageHeight

GdipFree

GdipCreateBitmapFromResource

GdipGetImageWidth

GdipDrawImageRectRectI

GdipDeleteGraphics

GdipCreateFromHDC

GdipCreateBitmapFromFileICM

wininet

FindCloseUrlCache

InternetSetOptionW

InternetOpenW

InternetOpenUrlW

InternetCloseHandle

FindNextUrlCacheEntryW

DeleteUrlCacheEntryW

FindFirstUrlCacheEntryW

shell32

DragAcceptFiles

SHGetSpecialFolderPathW

ShellExecuteW

Shell_NotifyIconW

CommandLineToArgvW

ShellExecuteExW

DragQueryFileW

SHGetFolderPathW

SHGetDesktopFolder

psapi

EnumProcessModules

GetModuleBaseNameW

EnumProcesses

iphlpapi

GetAdaptersInfo

taobaoapi

_TaobaoSearch@8

wintrust

WinVerifyTrust

CryptCATAdminReleaseCatalogContext

CryptCATAdminCalcHashFromFileHandle

CryptCATAdminAcquireContext

CryptCATAdminEnumCatalogFromHash

CryptCATCatalogInfoFromContext

CryptCATAdminReleaseContext

detoured

Detoured

kernel32

FindResourceExW

FileTimeToLocalFileTime

FileTimeToSystemTime

HeapAlloc

GetProcessHeap

HeapFree

SetUnhandledExceptionFilter

GlobalFindAtomW

GlobalAddAtomW

LoadLibraryW

GetCommandLineW

GetCurrentThread

RaiseException

GlobalDeleteAtom

CreateMutexW

FreeLibrary

GetProcAddress

GetModuleHandleW

lstrcmpiW

LoadLibraryExW

GetModuleFileNameW

DeleteCriticalSection

InitializeCriticalSection

GetPrivateProfileIntW

SetLastError

GlobalFree

lstrlenA

DebugBreak

OutputDebugStringW

WideCharToMultiByte

lstrcpyW

GetPrivateProfileStringW

FindFirstFileW

FindNextFileW

FindClose

GetFileAttributesW

GetVersionExW

GlobalLock

GlobalUnlock

LockResource

OpenProcess

TerminateProcess

lstrcpynW

CreateProcessW

OpenFileMappingW

MapViewOfFile

UnmapViewOfFile

ReleaseMutex

CreateFileMappingW

lstrcmpiA

RemoveDirectoryW

SetFileAttributesW

CopyFileW

FileTimeToDosDateTime

GetSystemTime

GetLocalTime

lstrcmpW

CompareStringW

GlobalAlloc

MulDiv

CreateFileW

FindResourceW

GetFileSize

SystemTimeToFileTime

VirtualAllocEx

ReadProcessMemory

VirtualFreeEx

ExpandEnvironmentStringsW

GetTempPathW

Sleep

LocalFree

LoadLibraryA

CompareFileTime

lstrcatW

VirtualQuery

VirtualProtect

VirtualAlloc

InterlockedCompareExchange

ResumeThread

GetThreadContext

SetThreadContext

SuspendThread

SizeofResource

GetLastError

CreateDirectoryW

DeleteFileW

LeaveCriticalSection

EnterCriticalSection

GetCurrentThreadId

FlushInstructionCache

GetCurrentProcess

MultiByteToWideChar

SetEvent

SetThreadPriority

CreateEventW

CloseHandle

GetTickCount

WaitForSingleObject

CreateThread

InterlockedIncrement

lstrlenW

InterlockedDecrement

LCMapStringW

GetCPInfo

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

ExitProcess

IsProcessorFeaturePresent

VirtualFree

HeapDestroy

HeapReAlloc

HeapSize

UnhandledExceptionFilter

IsDebuggerPresent

MoveFileW

GetStartupInfoW

RtlUnwind

LCMapStringA

HeapCreate

WriteFile

ReadFile

LoadResource

GetStdHandle

GetModuleFileNameA

GetACP

GetOEMCP

IsValidCodePage

GetConsoleCP

GetConsoleMode

GetTimeZoneInformation

FreeEnvironmentStringsW

GetEnvironmentStringsW

SetHandleCount

GetFileType

GetStartupInfoA

QueryPerformanceCounter

GetSystemTimeAsFileTime

GetLocaleInfoA

GetStringTypeA

GetStringTypeW

InitializeCriticalSectionAndSpinCount

SetFilePointer

WriteConsoleA

GetConsoleOutputCP

WriteConsoleW

SetStdHandle

FlushFileBuffers

CreateFileA

CompareStringA

SetEnvironmentVariableA

GetCurrentProcessId

user32

SetMenuDefaultItem

CallNextHookEx

TranslateAcceleratorW

SetWindowRgn

CreateAcceleratorTableW

SetRectEmpty

IsMenu

GetMenuInfo

SetMenuInfo

IsWindowEnabled

FillRect

GetDlgCtrlID

GetCapture

DrawFocusRect

GetDesktopWindow

InvalidateRgn

RegisterWindowMessageW

FindWindowExW

wsprintfW

InsertMenuW

DeleteMenu

EnableWindow

AttachThreadInput

IntersectRect

IsRectEmpty

CharUpperW

EnableMenuItem

GetCursor

DestroyCursor

EmptyClipboard

SetClipboardData

GetDoubleClickTime

GetClassNameW

GetFocus

ReleaseCapture

SetCapture

ShowCursor

SetCursor

GetMenuItemInfoW

CheckMenuItem

LoadMenuW

GetSubMenu

GetMenuStringW

GetMenuState

CreatePopupMenu

MonitorFromPoint

TrackPopupMenu

SetActiveWindow

DestroyAcceleratorTable

InflateRect

SetMenu

GetSystemMenu

RedrawWindow

GetAsyncKeyState

WindowFromPoint

GetSystemMetrics

GetWindowDC

OffsetRect

GetForegroundWindow

GetKeyState

UnregisterClassA

AppendMenuW

GetMenuItemID

GetMenuItemCount

DestroyMenu

IsZoomed

ScreenToClient

GetMessagePos

PostThreadMessageW

EndDialog

DialogBoxParamW

SetMenuItemInfoW

IsIconic

CloseClipboard

GetClipboardData

OpenClipboard

GetWindowTextLengthW

IsClipboardFormatAvailable

GetSysColor

GetActiveWindow

GetDlgItem

MonitorFromWindow

GetMonitorInfoW

MapWindowPoints

IsWindowVisible

SetWindowTextW

wvsprintfW

GetWindowRect

GetParent

GetWindow

DrawIconEx

LoadImageW

DestroyIcon

PtInRect

SetWindowPos

ReleaseDC

GetDC

ClientToScreen

DrawTextW

KillTimer

SetTimer

SetFocus

IsWindow

InvalidateRect

EndPaint

BeginPaint

MoveWindow

GetClientRect

GetClassInfoExW

RegisterClassExW

CreateWindowExW

MsgWaitForMultipleObjects

SendMessageTimeoutW

AllowSetForegroundWindow

FindWindowW

PostQuitMessage

UnhookWindowsHookEx

UnregisterHotKey

PeekMessageW

GetMessageW

TranslateMessage

DispatchMessageW

SetWindowsHookExW

RegisterHotKey

SetForegroundWindow

UpdateWindow

SetWindowPlacement

GetWindowPlacement

GetWindowThreadProcessId

IsChild

LoadCursorW

MessageBoxW

CharNextW

DestroyWindow

CallWindowProcW

DefWindowProcW

SetWindowLongW

GetWindowLongW

CopyRect

SystemParametersInfoW

PostMessageW

ShowWindow

LoadStringW

CharLowerW

SendMessageW

ShowWindowAsync

EqualRect

GetWindowTextW

GetCursorPos

gdi32

CreateCompatibleBitmap

CreatePen

ExtTextOutW

DPtoLP

BitBlt

SetBkColor

LPtoDP

Rectangle

SetTextColor

CreateSolidBrush

SetBkMode

SelectObject

DeleteObject

CreateBitmapIndirect

CreateCompatibleDC

GetTextExtentPoint32W

GetStockObject

DeleteDC

StretchBlt

GetCurrentObject

GetDeviceCaps

GetObjectW

SetViewportOrgEx

GetClipBox

RestoreDC

SaveDC

SetWindowOrgEx

CombineRgn

CreateRectRgn

LineTo

MoveToEx

CreateFontIndirectW

CreateDCW

comdlg32

GetOpenFileNameW

GetSaveFileNameW

advapi32

RegCreateKeyW

GetNamedSecurityInfoW

SetNamedSecurityInfoW

SetEntriesInAclW

LookupPrivilegeValueW

RegCloseKey

RegCreateKeyExW

RegSetValueExW

OpenProcessToken

GetTokenInformation

GetLengthSid

CopySid

GetSidIdentifierAuthority

GetSidSubAuthorityCount

GetSidSubAuthority

RegOpenKeyExW

RegGetKeySecurity

AllocateAndInitializeSid

InitializeAcl

AddAce

InitializeSecurityDescriptor

SetSecurityDescriptorDacl

FreeSid

RegSetKeySecurity

RegQueryInfoKeyW

RegEnumKeyW

GetUserNameW

RegDeleteKeyW

RegEnumKeyExW

RegDeleteValueW

RegOpenKeyW

RegQueryValueExW

AdjustTokenPrivileges

ole32

CoInitialize

CoUninitialize

CoTaskMemFree

CoCreateInstance

CoTaskMemRealloc

CoTaskMemAlloc

CoRegisterClassObject

CoRevokeClassObject

OleUninitialize

StringFromGUID2

OleLockRunning

CreateStreamOnHGlobal

CoGetClassObject

CLSIDFromProgID

CLSIDFromString

OleInitialize

ReleaseStgMedium

CoMarshalInterThreadInterfaceInStream

CoGetMalloc

CreateBindCtx

CoGetMarshalSizeMax

CoMarshalInterface

CoGetInterfaceAndReleaseStream

CoUnmarshalInterface

CoInitializeEx

oleaut32

SysStringByteLen

SysAllocStringByteLen

VarUI4FromStr

SysFreeString

SysAllocString

OleCreateFontIndirect

SysStringLen

LoadRegTypeLi

LoadTypeLi

VariantClear

VariantInit

SysAllocStringLen

DispCallFunc

VarBstrCmp

shlwapi

StrCmpLogicalW

SHGetValueW

SHDeleteKeyW

SHSetValueW

urlmon

URLDownloadToFileW

UrlMkGetSessionOption

UrlMkSetSessionOption

comctl32

ImageList_Create

ImageList_DragMove

ImageList_DragLeave

ImageList_EndDrag

_TrackMouseEvent

InitCommonControlsEx

ImageList_DragEnter

ImageList_BeginDrag

ImageList_Destroy

ImageList_ReplaceIcon

ImageList_DragShowNolock

Sections

.text
Size: 823KB - Virtual size: 822KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 291KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 913KB - Virtual size: 912KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

xttbrowser.exe.manifest

.xml

Сʿ4ң/yymain.ini

Сʿ4ң/ĬϿ.txt

Сʿ4ң/Сʿ4ң.exe

.exe windows:4 windows x86 arch:x86

586a893b65efe2a7742d5eef0032533d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep

OutputDebugStringA

MultiByteToWideChar

VirtualAlloc

FlushFileBuffers

HeapCreate

HeapDestroy

VirtualFree

GetLastError

GetProcAddress

CloseHandle

GetVersion

GetCommandLineA

ExitProcess

HeapFree

RtlUnwind

GetStartupInfoA

HeapReAlloc

IsBadWritePtr

HeapAlloc

GetCurrentProcess

UnhandledExceptionFilter

TerminateProcess

FreeEnvironmentStringsA

FreeEnvironmentStringsW

SetEndOfFile

GetModuleHandleA

lstrlenA

GetStringTypeW

GetStringTypeA

LoadLibraryA

GetOEMCP

GetACP

GetCPInfo

IsBadCodePtr

IsBadReadPtr

SetUnhandledExceptionFilter

CreateFileA

WriteFile

GetModuleFileNameA

GetFileType

LCMapStringW

ReadFile

SetStdHandle

SetFilePointer

WideCharToMultiByte

GetStdHandle

SetHandleCount

GetEnvironmentStringsW

GetEnvironmentStrings

LCMapStringA

user32

ShowWindow

LoadImageA

SetRect

MessageBoxA

DestroyWindow

RegisterClassA

UpdateWindow

CreateWindowExA

GetSystemMetrics

LoadCursorA

LoadIconA

GetKeyState

PostMessageA

TranslateMessage

PeekMessageA

GetMessageA

GetClientRect

DispatchMessageA

InvalidateRect

DefWindowProcA

ClientToScreen

SetCursor

PostQuitMessage

gdi32

TextOutA

SetTextColor

SetBkColor

DeleteObject

StretchBlt

GetObjectA

SelectObject

CreateCompatibleDC

DeleteDC

ole32

CoInitialize

ddraw

DirectDrawCreate

winmm

mmioRead

mmioClose

mmioAscend

mmioOpenA

timeGetTime

mmioDescend

joySetCapture

joySetThreshold

joyGetDevCapsA

joyGetPosEx

joyGetNumDevs

dsound

ord1

wsock32

WSAStartup

closesocket

socket

WSAAsyncSelect

sendto

accept

WSACleanup

recv

gethostbyaddr

inet_ntoa

connect

bind

ioctlsocket

listen

gethostname

gethostbyname

send

inet_addr

htons

Sections

.text
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

Сʿ4ң/԰.txt

Сʿ4ң/԰.url

Сʿ4ң/ר.JPG

.jpg

Sharing

General

Malware Config

Signatures

Files

23dab55e2a25210a84f0bbc9deb32bff

Headers

File Characteristics

Imports

wsock32

ole32

oleaut32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

winmm

Sections

.text Size: 604KB - Virtual size: 603KB

.rdata Size: 44KB - Virtual size: 40KB

.data Size: 52KB - Virtual size: 831KB

.data1 Size: 4KB - Virtual size: 192B

.CRT Size: 4KB - Virtual size: 4B

.rsrc Size: 88KB - Virtual size: 85KB

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 151KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 4KB - Virtual size: 3KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

7fa974366048f9c551ef45714595665e

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

.text
Size: 604KB - Virtual size: 603KB

.rdata
Size: 44KB - Virtual size: 40KB

.data
Size: 52KB - Virtual size: 831KB

.data1
Size: 4KB - Virtual size: 192B

.CRT
Size: 4KB - Virtual size: 4B

.rsrc
Size: 88KB - Virtual size: 85KB

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 151KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 16KB - Virtual size: 16KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 512B - Virtual size: 470B

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

35:fa:61:68:75:d3:cf:e7:68:22:45:77:61:dc:66:a1
Certificate

.text
Size: 52KB - Virtual size: 52KB