aa26ec34162e38147b948b39b362d476_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
aa26ec34162e38147b948b39b362d476_JaffaCakes118
Size 4.6MB
Sample240614-rpcgmathka
SHA256 df77dd69b8085bcd0bac0a6493b405b2cb4faab5a8394e9c25dcb594c8735c54
MD5 aa26ec34162e38147b948b39b362d476
SHA1 da5b96356ad4abf51660d031981c0cb22dc60b45
SHA512 2120f027fd065c8d4b83416246899332b5ac6f14f9ba20ea1efa817e732e5420b78a0573fff61b195369ba33046b8d59de872eeed9bfbf231ab912254b37ff6d
SSDEEP 98304:2kXLdgsaDD0rQ9LeAu1m1UWYJiNj32bttv/ah6eygQgFQt81ngkn:nLdgsaDIk9/1UJiIBtv/neyPkn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Windows优化卫士 6.0/YiXinSafe/SkinH_EL.dll	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Windows优化卫士 6.0/YiXinSafe/SkinH_EL.dll
unpack001/Windows优化卫士 6.0/YiXinSafe/YiXinPCTray.exe
unpack001/Windows优化卫士 6.0/YiXinSafe/mb.dll
unpack001/Windows优化卫士 6.0/nsUninstall.exe

File Explorer

aa26ec34162e38147b948b39b362d476_JaffaCakes118

.rar 4.6MB
Windows优化卫士 6.0/YiXinSafe/SkinH_EL.dll

.dll 143KB
Windows优化卫士 6.0/YiXinSafe/YXabc.ini

30B
Windows优化卫士 6.0/YiXinSafe/YiXinPCTray.exe

.exe 1.3MB
Windows优化卫士 6.0/YiXinSafe/data/admin.edb

1KB
Windows优化卫士 6.0/YiXinSafe/mb.dll

.dll 8.2MB
Windows优化卫士 6.0/nsUninstall.dat

764B
Windows优化卫士 6.0/nsUninstall.exe

.exe 381KB
Windows优化卫士 6.0/下载说明.txt

810B
Windows优化卫士 6.0/华彩联盟论坛.url

.url 195B
Windows优化卫士 6.0/华彩软件站-使用必读.url

.url 195B

aa26ec34162e38147b948b39b362d476_JaffaCakes118

SHA256 df77dd69b8085bcd0bac0a6493b405b2cb4faab5a8394e9c25dcb594c8735c54
MD5 aa26ec34162e38147b948b39b362d476
SHA1 da5b96356ad4abf51660d031981c0cb22dc60b45
SHA512 2120f027fd065c8d4b83416246899332b5ac6f14f9ba20ea1efa817e732e5420b78a0573fff61b195369ba33046b8d59de872eeed9bfbf231ab912254b37ff6d
SSDEEP 98304:2kXLdgsaDD0rQ9LeAu1m1UWYJiNj32bttv/ah6eygQgFQt81ngkn:nLdgsaDIk9/1UJiIBtv/neyPkn
MD5 SHA1 SHA512 SSDEEP

Windows优化卫士 6.0/YiXinSafe/SkinH_EL.dll

SHA256 931eb554bad234bbd3b427237ece1ab509a9b6da5fb1bcd8d668f08d52201771
MD5 772b247e8c57ffd1751cd569e2c0377a
SHA1 ebcbef1bd170138ab4855ee1ce3e7421555e3691
SHA512 9c4b9c134308e289130829901e1fd0d8bb470dcadef7b9cd09ce8afe7431bc0973ebc76232ab5a7965ac4fde4dcc8d7819dea0099947361f24fed494f7d4bee6
SSDEEP 3072:x5Np2dlUX0+Cx17F8QRJZKmOK3outKqnhCO6an//8vt8VXuX208n:PFwT7SMJMzUoShhKa//82G2l
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

249856

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Windows优化卫士 6.0/YiXinSafe/YiXinPCTray.exe

IMPHASH 749aa822d0ce4e160a189879ee9bfe9f
SHA256 3ba42211ae2fdf56182fef332f11c9d1b9ed5ed5fd57838b604418aa8cfc322e
MD5 58853c966aa4475abcb37f8a89bfad63
SHA1 09dc7d7c796414b754a5fa9687005a6a1f8856bc
SHA512 6f3ac48dc9eb6dbb190c3fe676ec6e8a0ec88d9e8846d8bff8cebe9e47785d514445c07316f0f09f9aefd849ab7c309b8659017d65868d0c3f29f2d1cf4039a4
SSDEEP 12288:48eTUxcn2d9sxrIJpUcGP76kXTbgHKHhea0lfshdcC:48OUxn7sdIJCc27r/lHhn0dwf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1544192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause waveOutReset waveOutClose waveOutGetNumDevs midiStreamStop midiOutReset midiStreamClose midiStreamRestart

ws2_32

WSAAsyncSelect closesocket send WSACleanup recvfrom ioctlsocket recv getpeername accept WSAStartup inet_ntoa select

rasapi32

RasGetConnectStatusA RasHangUpA

kernel32

GetSystemDirectoryA MultiByteToWideChar SetLastError GetTimeZoneInformation GetVersion WideCharToMultiByte FileTimeToSystemTime GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers DuplicateHandle lstrcpynA FileTimeToLocalFileTime LocalFree InterlockedDecrement InterlockedIncrement TerminateProcess GetCurrentProcess GetFileSize SetFilePointer Beep GetWindowsDirectoryA LoadLibraryExA CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource lstrlenW GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose GetFileAttributesA MoveFileA DeleteFileA CopyFileA SetCurrentDirectoryA InterlockedExchange GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount WaitForSingleObject CloseHandle GetStartupInfoA RtlUnwind RaiseException GetSystemTime GetLocalTime HeapSize GetACP SetStdHandle GetFileType UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr

user32

SetWindowRgn DestroyAcceleratorTable GetWindow GetActiveWindow SetFocus IsIconic PeekMessageA SetMenu GetMenu DeleteMenu GetSystemMenu DefWindowProcA GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer GetClassInfoA IsZoomed PostQuitMessage CopyAcceleratorTableA GetKeyState TranslateAcceleratorA IsWindowEnabled ShowWindow SystemParametersInfoA LoadImageA EnumDisplaySettingsA ClientToScreen EnableMenuItem GetSubMenu GetDlgCtrlID CreateAcceleratorTableA CreateMenu ModifyMenuA AppendMenuA CreatePopupMenu DrawIconEx CreateIconFromResource ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible CreateIconFromResourceEx RedrawWindow GetWindowLongA SetWindowLongA GetSysColor GetSysColorBrush GetMenuCheckMarkDimensions SetMenuItemBitmaps CheckMenuItem MoveWindow IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos RegisterClassA CreateWindowExA GetClassLongA SetPropA GetPropA CallWindowProcA SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA RegisterClipboardFormatA SetRectEmpty DispatchMessageA GetMessageA WindowFromPoint DrawFocusRect DrawEdge DrawFrameControl TranslateMessage LoadIconA GetClassNameA GetWindowTextA GetMenuState GetMenuItemID UnregisterClassA GetMenuItemCount CallNextHookEx SetWindowsHookExA UnhookWindowsHookEx SetWindowTextA LoadStringA CopyIcon GetIconInfo CreateIconIndirect GetDesktopWindow GetDlgItem GetForegroundWindow EnableWindow GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA

gdi32

TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps GetViewportOrgEx GetWindowExtEx GetDIBits RealizePalette SelectPalette StretchBlt CreatePalette GetSystemPaletteEntries CreateDIBitmap DeleteObject ExtTextOutA CreatePolygonRgn GetClipRgn SetStretchBltMode CreateDIBSection CreateRectRgnIndirect SetBkColor FrameRgn OffsetRgn GetTextMetricsA SetTextColor LineTo ExcludeClipRect GetClipBox ScaleWindowExtEx SetWindowExtEx SetWindowOrgEx Escape DPtoLP LPtoDP Rectangle Ellipse CreateCompatibleDC BitBlt StartPage StartDocA DeleteDC EndDoc EndPage GetObjectA GetStockObject CreateFontIndirectA CreateSolidBrush FillRgn CreateRectRgn CombineRgn PatBlt CreatePen SelectObject CreateBitmap ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetROP2 SetPolyFillMode SetBkMode CreateDCA CreateCompatibleBitmap GetPolyFillMode GetStretchBltMode GetROP2 GetBkColor GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn PathToRegion EndPath BeginPath SelectClipRgn MoveToEx RestoreDC SaveDC GetWindowOrgEx

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegQueryValueExA RegOpenKeyExA RegSetValueExA RegCreateKeyA RegQueryValueA RegCreateKeyExA RegCloseKey

shell32

ShellExecuteA SHGetSpecialFolderPathA Shell_NotifyIconA

ole32

CLSIDFromProgID OleRun CoCreateInstance CLSIDFromString OleUninitialize OleInitialize

oleaut32

VariantChangeType VariantClear VariantCopyInd VariantInit SysAllocString RegisterTypeLi UnRegisterTypeLi LoadTypeLi LHashValOfNameSys

comctl32

ImageList_GetIcon ImageList_GetImageInfo ImageList_GetImageCount ord17 ImageList_Destroy ImageList_Read ImageList_Duplicate

wininet

InternetGetConnectedState InternetOpenA InternetOpenUrlA InternetCloseHandle

comdlg32

ChooseColorA GetOpenFileNameA GetFileTitleA GetSaveFileNameA

Windows优化卫士 6.0/YiXinSafe/mb.dll

IMPHASH 103f81674ba4c2c57ba4243663c92101
SHA256 1f48007c2b9c6fe919579c3375d2505727f5fcf1b5059cb769cb81bfc9be4ce4
MD5 3ca3a8b5f33d1a0495a299a09b9b990f
SHA1 c6245ad97407dadcc8a32d01c562d952d6477c49
SHA512 632c7af384b77e1c913997849e4b8ab757b4f6a07c5fe2836e89a44d7d2a80e8657a44529753a2a2bcf3c35fe16d2100ce94c3770a5c6d32040c9da9b405acc8
SSDEEP 98304:Btw4MNqQmNmjdZg+BS2zDwo17vh4gUNaAlbQBma/GYeYVQPfZyyEVlJFUq/EUiDy:AqKdZjZHwo17iNVQ/+RfsywGm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8945664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

winmm

midiStreamProperty PlaySoundA midiStreamRestart midiStreamClose midiOutReset midiStreamStop midiStreamOut waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause midiOutPrepareHeader midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset

ws2_32

inet_ntoa WSAStartup WSACleanup select send closesocket inet_addr htons bind socket recvfrom WSAAsyncSelect ioctlsocket connect recv listen getpeername accept __WSAFDIsSet ntohs getsockname gethostname WSAGetLastError gethostbyname

version

VerLanguageNameA

msvfw32

DrawDibDraw

avifil32

AVIStreamInfoA AVIStreamGetFrame

rasapi32

RasHangUpA RasGetConnectStatusA

kernel32

GetSystemDefaultLangID GetLocaleInfoA GetVersion InterlockedDecrement GetTimeZoneInformation WideCharToMultiByte TerminateThread Beep lstrcmpiA MapViewOfFile CreateFileMappingA LocalFree UnmapViewOfFile FormatMessageA FileTimeToSystemTime FileTimeToLocalFileTime lstrcpynA DuplicateHandle FlushFileBuffers LockFile UnlockFile SetEndOfFile GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA lstrcmpA LocalAlloc TlsAlloc GlobalHandle TlsFree TlsSetValue LocalReAlloc TlsGetValue GetFileTime GetCurrentThread GlobalFlags SetErrorMode GetProcessVersion GetCPInfo GetOEMCP RtlUnwind GetSystemTime GetLocalTime RaiseException ExitThread HeapSize GetACP SetStdHandle GetFileType SetHandleCount GetStdHandle GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW UnhandledExceptionFilter CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr IsValidLocale IsValidCodePage EnumSystemLocalesA GetLocaleInfoW SetLastError MultiByteToWideChar GetSystemDirectoryA LoadLibraryExA GetWindowsDirectoryA GlobalMemoryStatus TerminateProcess GetCurrentProcess GetFileSize SetFilePointer CreateToolhelp32Snapshot Process32First Process32Next CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetUserDefaultLCID GetProfileStringA WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource RemoveDirectoryA GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GetDriveTypeA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA MoveFileA DeleteFileA CreateDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle InterlockedExchange InterlockedIncrement

user32

GetMenuCheckMarkDimensions UnregisterClassA SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos RegisterClassA CreateWindowExA GetClassLongA RemovePropA GetMessageTime GetLastActivePopup RegisterWindowMessageA GetWindowPlacement EndDialog CreateDialogIndirectParamA DestroyWindow EndPaint BeginPaint CharUpperA GetNextDlgTabItem GetMenuStringA GetTabbedTextExtentA DrawStateA GrayStringA TabbedTextOutA WindowFromDC GetPropA MoveWindow SetPropA GetCursor FrameRect GetSysColorBrush GetWindowDC CallWindowProcA EnumChildWindows GetWindowTextLengthA EnumThreadWindows DrawTextA CreateIconIndirect GetIconInfo CopyIcon LoadStringA SetWindowTextA UnhookWindowsHookEx SetWindowsHookExA CallNextHookEx GetMenuItemCount GetMenuItemID GetMenuState GetForegroundWindow GetWindowTextA FindWindowExA GetDlgItem GetClassNameA GetDesktopWindow GetKeyboardLayout LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA SetMenuItemBitmaps SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect InvertRect IsRectEmpty ScrollDC ReleaseDC IsChild TrackPopupMenu DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle CheckMenuItem IsDialogMessageA ScrollWindowEx DispatchMessageA GetScrollRange

gdi32

CreateDCA CreateCompatibleBitmap GetPolyFillMode GetStretchBltMode GetROP2 GetBkColor GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn CreateBrushIndirect CreateHatchBrush PathToRegion CreateBitmap CreatePatternBrush SelectObject GetObjectA CreatePen PatBlt EndPath CombineRgn CreateRectRgn FillRgn BeginPath CreateSolidBrush GetWindowOrgEx GetViewportOrgEx GetWindowExtEx GetDIBits RealizePalette SelectPalette StretchBlt TextOutA ExtTextOutA Escape SetDIBitsToDevice GetStockObject SetPolyFillMode SetROP2 CreateFontIndirectA SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect ExtSelectClipRgn GetViewportExtEx MoveToEx LineTo SetTextColor GetTextMetricsA OffsetRgn FrameRgn SetBkColor CreateRectRgnIndirect CreateDIBSection SetPixel ExtCreateRegion SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette EndPage EndDoc DeleteDC StartDocA StartPage BitBlt GetPixel CreateCompatibleDC SetPixelV Ellipse Rectangle SetMapMode RectVisible PtVisible CreatePenIndirect RestoreDC SaveDC SetWindowOrgEx CreateEllipticRgnIndirect LPtoDP DPtoLP GetCurrentObject RoundRect Pie Chord Arc Polygon GetTextExtentPoint32A GetDeviceCaps SetBkMode

msimg32

GradientFill

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

comdlg32

GetFileTitleA GetSaveFileNameA GetOpenFileNameA ChooseFontA ChooseColorA

advapi32

RegCreateKeyExA GetUserNameA RegQueryValueA RegDeleteKeyA RegDeleteValueA RegCreateKeyA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

SHGetSpecialFolderPathA SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA DragQueryFileA ShellExecuteA Shell_NotifyIconA

ole32

ReleaseStgMedium RevokeDragDrop OleInitialize CoCreateInstance OleRun OleUninitialize CLSIDFromString

oleaut32

VariantCopy GetErrorInfo VariantClear VariantChangeType SafeArrayCreate VariantInit SysAllocString SafeArrayDestroy SafeArrayPutElement UnRegisterTypeLi RegisterTypeLi LoadTypeLi SysFreeString SysStringLen SysAllocStringByteLen SafeArrayCreateVector

comctl32

ImageList_Create ImageList_Destroy ord17 ImageList_Draw ImageList_Read ImageList_DrawIndirect ImageList_Duplicate ImageList_GetIcon ImageList_GetImageInfo ImageList_GetImageCount ImageList_SetBkColor ImageList_AddMasked _TrackMouseEvent

wldap32

ord29

wininet

InternetCloseHandle

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

152KB

Virtual Size

552KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

388KB

Virtual Size

386KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

184KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rmnet

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Windows优化卫士 6.0/nsUninstall.exe

IMPHASH dd61790fdd696dadcbe24997627880fb
SHA256 c67bf1732374270d710c73b7e613832d67b2d933839a9d7eb4bf2de88b0919ab
MD5 750d535256dd25072e27cea0d2c26782
SHA1 783405ae08f93f371d416a7ae7c42936e79bf54c
SHA512 3ebe23dd306f92890968d51fff2148e045e16ec63ca152fa3cfe71f62c239d7a0e9fc5c4c6bb1cb6c4e3d29a3b49ae3e2e31ae23b663c38a4033f9f5426c0325
SSDEEP 6144:b/1K2c1DQ6uWDavc2/vuZaJevK+H781hFn7vW/h9Sp1Xt1:pJIDQ6u9vc2/mZK+HOCud
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

81323

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\nstools\nsSetup\HofoInstallers-2.0\Release\nsUninstall.pdb

kernel32

HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleW ExitProcess IsProcessorFeaturePresent RtlUnwind MultiByteToWideChar ReadFile CloseHandle WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement HeapDestroy GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FreeLibrary LoadLibraryW CreateFileW SetFilePointer SetStdHandle WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers GetCPInfo GetACP GetOEMCP IsValidCodePage SetEndOfFile WriteConsoleW LCMapStringW GetStringTypeW lstrcmpW lstrcatW FreeResource GlobalLock GlobalUnlock GetFileSize FindFirstFileW FindNextFileW GlobalFree WaitForSingleObject TerminateThread FindClose DeleteFileW RemoveDirectoryW lstrlenW CreateThread OpenProcess lstrlenA GetVersionExW CreateDirectoryW GetDiskFreeSpaceExW GetFileTime FileTimeToLocalFileTime FileTimeToSystemTime CreateMutexW CreateFileMappingW OpenFileMappingW MapViewOfFile lstrcpynW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW UnmapViewOfFile LCMapStringA GetSystemPowerStatus lstrcmpiW GetTempPathW GetLocalTime CreateEventW ResetEvent InitializeCriticalSection LocalFree SetEnvironmentVariableA ExitThread GetDriveTypeW FindFirstFileExW GetFullPathNameW GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW CreateFileA GetTimeZoneInformation CompareStringW GetTickCount lstrcpyW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GlobalAlloc SetLastError Sleep

user32

GetWindowRect GetDC TranslateMessage ReleaseDC SetCursor CreateWindowExW DispatchMessageW LoadIconW FindWindowW SetWindowRgn OffsetRect FillRect TrackMouseEvent SendMessageW ReleaseCapture GetCursorPos SetCapture PostQuitMessage UpdateLayeredWindow wsprintfW EnableWindow SetForegroundWindow RegisterClassExW DrawIconEx LoadCursorW PostMessageW GetWindowLongW DefWindowProcW IsIconic OpenClipboard EmptyClipboard SetClipboardData CloseClipboard GetClipboardData LoadImageW GetSystemMetrics PrivateExtractIconsW SetWindowLongW DestroyWindow UnregisterClassW MoveWindow SetWindowPos BeginPaint EndPaint ShowWindow GetClientRect ClientToScreen SetLayeredWindowAttributes GetMessageW

gdi32

GetTextExtentPoint32W CreateDIBSection CreateDCW DeleteDC CreateCompatibleBitmap CreateCompatibleDC GetObjectA CreateFontIndirectW BitBlt CreateSolidBrush DeleteObject CreateRectRgn CombineRgn OffsetRgn SetRectRgn GetStockObject CreatePen SelectObject SetROP2 MoveToEx GetObjectW LineTo

ole32

CoCreateInstance CoUninitialize CoInitialize CreateStreamOnHGlobal OleRun

shlwapi

PathFileExistsW

dbghelp

MiniDumpWriteDump

comdlg32

GetSaveFileNameW ChooseColorW GetOpenFileNameW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegEnumKeyExW OpenSCManagerW CreateServiceW OpenServiceW CloseServiceHandle StartServiceW ControlService DeleteService RegOpenKeyW RegSetValueW RegNotifyChangeKeyValue RegDeleteValueW RegCreateKeyW RegCloseKey RegDeleteKeyW OpenProcessToken LookupPrivilegeValueW

shell32

SHBrowseForFolderW ShellExecuteExW Shell_NotifyIconW ShellExecuteW SHGetSpecialFolderPathW SHGetPathFromIDListW

oleaut32

SysAllocString VariantChangeType VariantInit VariantClear SysFreeString

wininet

HttpAddRequestHeadersW HttpQueryInfoW GetUrlCacheEntryInfoW InternetGetConnectedState InternetOpenW InternetConnectW InternetCloseHandle InternetSetOptionW HttpOpenRequestW HttpSendRequestW InternetReadFile

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

PlaySoundW mciSendStringW

gdiplus

GdipCreateFromHDC GdipGetImageGraphicsContext GdipDeleteGraphics GdipSetTextRenderingHint GdipSetInterpolationMode GdipSetSmoothingMode GdipResetWorldTransform GdipTranslateWorldTransform GdipRotateWorldTransform GdipDrawString GdipDrawImageRectI GdipDrawImagePointsI GdipDrawImageRectRectI GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipLoadImageFromFileICM GdipDeleteStringFormat GdipLoadImageFromStreamICM GdipSetStringFormatTrimming GdipCloneImage GdipSaveImageToFile GdipSaveImageToStream GdipGetImageWidth GdipGetImageHeight GdipImageRotateFlip GdipCreateBitmapFromScan0 GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdiplusShutdown GdipCreateStringFormat GdipDisposeImage GdipCreateSolidFill GdipCloneBrush GdipDeleteBrush GdipSetImageAttributesColorKeys GdipSetImageAttributesColorMatrix GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipLoadImageFromStream GdipSetStringFormatFlags GdipDisposeImageAttributes GdipCreateImageAttributes GdipAlloc GdipFree GdipLoadImageFromFile

crypt32

CertFreeCertificateContext CertAddCertificateContextToStore CertCloseStore CertCreateCertificateContext CertOpenStore CertFindCertificateInStore

wintrust

WinVerifyTrust

urlmon

URLDownloadToFileW

??0CLock@@QAE@XZ ??0CNsApp@@QAE@XZ ??0CNsDC@@QAE@PAUHDC__@@AAUtagRECT@@_N2PAUHWND__@@@Z ??0CNsDC@@QAE@XZ ??0CNsFont@@QAE@ABV0@@Z ??0CNsFont@@QAE@XZ ??0CNsImage@@QAE@ABV0@@Z ??0CNsImage@@QAE@XZ ??0CNsLog@@QAE@ABV0@@Z ??0CNsLog@@QAE@XZ ??0CNsNet@@QAE@XZ ??0CNsReg@@QAE@XZ ??0CNsSkin@@QAE@ABV0@@Z ??0CNsSkin@@QAE@XZ ??0CNsThread@@QAE@ABV0@@Z ??0CNsThread@@QAE@XZ ??0CNsUninstaller@@QAE@ABV0@@Z ??0CNsUninstaller@@QAE@XZ ??0CNsXml@@QAE@ABV0@@Z ??0CNsXml@@QAE@XZ ??0CNsZlib@@QAE@XZ ??0CnsDump@@QAE@ABV0@@Z ??0CnsDump@@QAE@XZ ??1CLock@@QAE@XZ ??1CNsApp@@QAE@XZ ??1CNsDC@@QAE@XZ ??1CNsFont@@QAE@XZ ??1CNsImage@@QAE@XZ ??1CNsLog@@QAE@XZ ??1CNsNet@@QAE@XZ ??1CNsReg@@QAE@XZ ??1CNsSkin@@QAE@XZ ??1CNsThread@@QAE@XZ ??1CNsUninstaller@@QAE@XZ ??1CNsXml@@QAE@XZ ??1CNsZlib@@QAE@XZ ??1CnsDump@@QAE@XZ ??4CLock@@QAEAAV0@ABV0@@Z ??4CNsApp@@QAEAAV0@ABV0@@Z ??4CNsDC@@QAEAAV0@ABV0@@Z ??4CNsFont@@QAEAAV0@ABV0@@Z ??4CNsImage@@QAEAAV0@ABV0@@Z ??4CNsLog@@QAEAAV0@ABV0@@Z ??4CNsNet@@QAEAAV0@ABV0@@Z ??4CNsReg@@QAEAAV0@ABV0@@Z ??4CNsSkin@@QAEAAV0@ABV0@@Z ??4CNsThread@@QAEAAV0@ABV0@@Z ??4CNsUninstaller@@QAEAAV0@ABV0@@Z ??4CNsXml@@QAEAAV0@ABV0@@Z ??4CNsZlib@@QAEAAV0@ABV0@@Z ??4CnsDump@@QAEAAV0@ABV0@@Z ??_B?1??Instance@CNsLog@@SAAAV1@XZ@51 ??_B?1??Instance@CNsNet@@SAAAV1@XZ@51 ??_B?1??Instance@CNsReg@@SAAAV1@XZ@51 ??_B?1??Instance@CNsXml@@SAAAV1@XZ@51 ??_B?1??Instance@CNsZlib@@SAAAV1@XZ@51 ?AddMovie@CNsImage@@QAE_NPAUHWND__@@HPB_WHHHHHHHHPAUHDC__@@@Z ?AddMovie@CNsImage@@QAE_NPAUHWND__@@PB_WHHHHHHHHPAUHDC__@@@Z ?AddTimer@CNsThread@@AAEPAUtagNsTimer@@AAU2@@Z ?BmToStream@CNsImage@@QAE_NPAUHBITMAP__@@PAUIStream@@PB_W@Z ?CertExists@@YAHPB_W@Z ?CheckFont@CNsFont@@QAEHPB_W@Z ?CheckImage@CNsImage@@QAE_NPB_W@Z ?CheckInstalled@@YAHPB_W@Z ?CheckOneInstance@@YAHPB_W0@Z ?ClearReg@CNsUninstaller@@QAEHPB_W@Z ?CompVersion@@YAHPB_W0@Z ?CountFiles@CNsUninstaller@@AAEHPB_W@Z ?CreateCompatibleBitmapEx@CNsDC@@QAEPAUHBITMAP__@@UtagRECT@@@Z ?CreateDirTree@@YAHPB_W@Z ?CreateFolder@@YAHPB_W@Z ?CreateMemDC@CNsDC@@QAEXPAUHDC__@@AAUtagRECT@@_N2PAUHWND__@@@Z ?CreateNewFont@CNsFont@@AAEPAUHFONT__@@AAUtagFontInfo@@@Z ?CreateShareMem@@YAPAXPB_WK@Z ?CreateShortcut@@YAHPB_W000G0H@Z ?CreateUID@@YAXPA_WH@Z ?CreateUrlShortcut@@YAHPB_W0@Z ?DecodeFile@CNsZlib@@QAEJPB_W0K@Z ?DecodeGZipBuffer@CNsZlib@@QAEJPAEJPAPAEPAJ@Z ?DelDir@CNsUninstaller@@AAE_NPB_W@Z ?DelShortcut@CNsUninstaller@@QAEXXZ ?DelTray@@YAHPAUHWND__@@@Z ?DeleteSelf@CNsUninstaller@@QAEXXZ ?DesGo@@YAXQBDPADHH@Z ?DisableFsRedirection@@YAXPAPAX@Z ?DoReport@@YAXPB_W00@Z ?DoRun@@YAHPB_W0HH@Z ?Draw@CNsDC@@QAEXXZ ?DrawCaret@CNsApp@@QAEXPAUHWND__@@@Z ?DrawImg@CNsImage@@QAE_NPAUHDC__@@HPB_WHHHHPAUtagRECT@@@Z ?DrawImg@CNsImage@@QAE_NPAUHDC__@@PAUIStream@@HHHHPAUtagRECT@@@Z ?DrawImg@CNsImage@@QAE_NPAUHDC__@@PAVImage@Gdiplus@@HHHHPAUtagRECT@@PAVImageAttributes@4@@Z ?DrawImg@CNsImage@@QAE_NPAUHDC__@@PB_WHHHHPAUtagRECT@@@Z ?DrawImgEx@CNsImage@@QAE_NPAUHDC__@@HPB_WMMMMHHHH@Z ?DrawImgEx@CNsImage@@QAE_NPAUHDC__@@PAUIStream@@MMMMHHHH@Z ?DrawImgEx@CNsImage@@QAE_NPAUHDC__@@PB_WMMMMHHHH@Z ?DrawRotate3D@CNsImage@@QAEXPAUHDC__@@HPB_WHHHHHH@Z ?DrawRotate3D@CNsImage@@QAEXPAUHDC__@@PAUIStream@@HHHHHH@Z ?DrawRotate@CNsImage@@QAE_NPAUHDC__@@HPB_WHHHHH@Z ?DrawRotate@CNsImage@@QAE_NPAUHDC__@@PAUIStream@@HHHHH@Z ?DrawRotate@CNsImage@@QAE_NPAUHDC__@@PB_WHHHHH@Z ?DrawRotateFlip@CNsImage@@QAE_NPAUHDC__@@HPB_WHHHHW4RotateFlipType@Gdiplus@@M@Z ?DrawRotateFlip@CNsImage@@QAE_NPAUHDC__@@PAUIStream@@HHHHW4RotateFlipType@Gdiplus@@M@Z ?DrawRotateFlip@CNsImage@@QAE_NPAUHDC__@@PB_WHHHHW4RotateFlipType@Gdiplus@@M@Z ?DrawSplitH@CNsImage@@AAE_NPAUHDC__@@PAVImage@Gdiplus@@HHHHPAUtagRECT@@H@Z ?DrawSplitV@CNsImage@@AAE_NPAUHDC__@@PAVImage@Gdiplus@@HHHHPAUtagRECT@@HH@Z ?DrawStretchImg@CNsImage@@QAE_NPAUHDC__@@HPB_WHHHHHHHH@Z ?DrawStretchImg@CNsImage@@QAE_NPAUHDC__@@PAUIStream@@HHHHHHHH@Z ?DrawStretchImg@CNsImage@@QAE_NPAUHDC__@@PAVImage@Gdiplus@@HHHHHHHH@Z ?DrawStretchImg@CNsImage@@QAE_NPAUHDC__@@PB_WHHHHHHHH@Z ?DrawString@CNsImage@@QAEXPAUHDC__@@PAUHFONT__@@PB_WHHHHKH_N3H@Z ?DrawTranImg@CNsImage@@QAE_NPAUHDC__@@HPB_WKKHHHH@Z ?DrawTranImg@CNsImage@@QAE_NPAUHDC__@@PAUIStream@@KKHHHH@Z ?DrawTranImg@CNsImage@@QAE_NPAUHDC__@@PB_WKKHHHH@Z ?EasyEncode@@YAXPADH@Z ?EncodeFile@CNsZlib@@QAEJPB_W0H@Z ?ExceptionFilter@CnsDump@@CGJPAU_EXCEPTION_POINTERS@@@Z ?ExitApp@CNsApp@@QAEXXZ ?ExitThread@CNsThread@@QAEXPAXH@Z ?ExtractPath@@YAXPA_W@Z ?FileSize@@YA_JPB_W@Z ?FileTime@@YAHPB_WPAU_SYSTEMTIME@@11@Z ?FindRes@CNsSkin@@AAE_NPB_WPAUIStream@@@Z ?ForceLog@CNsLog@@QAEX_N@Z ?FreeSkin@CNsSkin@@QAEXXZ ?GbToTraditional@@YAXPADH@Z ?GetCPUID@@YAXPAD@Z ?GetClipboard@@YAHPA_WH@Z ?GetColorDlg@@YAKPAUHWND__@@K@Z ?GetCurPath@@YAXPA_W@Z ?GetCurPathEx@@YAXPB_WPA_W@Z ?GetDefaultSize@CNsFont@@QAEHXZ ?GetDesktopPath@@YAHPA_W@Z ?GetEncoderClsid@CNsImage@@QAEHPB_WPAU_GUID@@@Z ?GetFileIcon@@YAPAUHICON__@@PB_WHH@Z ?GetFileVer@@YAHPB_WPA_W@Z ?GetFont@CNsFont@@AAEPAUHFONT__@@AAUtagFontInfo@@@Z ?GetFont@CNsFont@@QAEPAUHFONT__@@HPB_WHHH@Z ?GetImgSize@CNsImage@@QAE_NHAAH0@Z ?GetImgSize@CNsImage@@QAE_NPB_WAAH1@Z ?GetInfoLen@CNsNet@@QAEHXZ ?GetLogFileName@CNsLog@@AAEXAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?GetMovieIndex@CNsImage@@QAEHH@Z ?GetNodeAttr@CNsXml@@QAEHPB_W0PA_W@Z ?GetOsName@@YAHPA_W@Z ?GetPathUseSpace@@YA_KPB_W@Z ?GetProgramFilePath@@YAHPA_W@Z ?GetProgramsPath@@YAHPA_W@Z ?GetQuickLaunchPath@@YAHPA_WH@Z ?GetRegInfo@@YAHPAUHKEY__@@PA_W1H1@Z ?GetRegInfo@CNsReg@@QAEHPAUHKEY__@@PA_W1H1@Z ?GetRes@CNsSkin@@QAE_NPB_WPAUIStream@@@Z ?GetResType@CNsSkin@@QAEHXZ ?GetShortcutIcon@@YAHPB_WPA_WPAH@Z ?GetShortcutUrl@@YAHPB_WPA_W@Z ?GetSoftVer@@YAHPB_WPA_W@Z ?GetStartMenuPath@@YAHPA_W@Z ?GetThemesPath@CNsSkin@@QAEXPA_W@Z ?GetUrlCacheIcon@@YAPAUHICON__@@PB_WH@Z ?GetUrlCacheIconPath@@YAHPB_WPA_W@Z ?GetUrlInfo@@YAHPB_WPADH@Z ?GetUrlInfo@CNsNet@@QAEHPB_WPADH@Z ?GetUrlShortcutIcon@@YAHPB_WPA_WH@Z ?GetXmlNode@CNsXml@@QAEHPA_WAAH@Z ?GetXmlNodeCount@@YAHPB_W@Z ?GetXmlNodeCount@CNsXml@@QAEHPB_W@Z ?GetXmlNodeValue2@@YAHPB_WPA_WH@Z ?GetXmlNodeValue3@@YAHPB_WPA_WPAH@Z ?GetXmlNodeValue@@YAHPB_WPA_W@Z ?GetXmlNodeValue@CNsXml@@QAEHPB_WPA_W@Z ?GetXmlNodeValue@CNsXml@@QAEHPB_WPA_WH@Z ?GetXmlNodeValue@CNsXml@@QAEHPB_WPA_WPAH@Z ?ImportCACert@@YAHPAXH@Z ?ImportCertFile@@YAHPB_W@Z ?InitZlib@CNsZlib@@QAEJPB_W@Z ?Install@CnsDump@@QAEXPB_W0@Z ?InstallDump@@YAXPB_W0@Z ?Instance@CNsLog@@SAAAV1@XZ ?Instance@CNsNet@@SAAAV1@XZ ?Instance@CNsReg@@SAAAV1@XZ ?Instance@CNsXml@@SAAAV1@XZ ?Instance@CNsZlib@@SAAAV1@XZ ?IntToStrSize@@YAX_JPA_W@Z ?IsLockRead@CLock@@QAE_NXZ ?IsLockWrite@CLock@@QAE_NXZ ?KillTimer@CNsThread@@QAEXH@Z ?LnkToRealPath@@YAJPB_WPA_W@Z ?LoadDrv@@YAHPB_W0@Z ?LoadPngFromRes@CNsImage@@AAEPAVImage@Gdiplus@@HPB_W@Z ?LoadProxyConfig@CNsNet@@QAEXXZ ?LoadSkin@CNsSkin@@QAE_NPB_W@Z ?Lock@CLock@@QAEXXZ ?LockRead@CLock@@QAEXXZ ?MD5Go@@YAHPAD0@Z ?MakeSkin@CNsSkin@@QAE_NPB_W0@Z ?MonitorReg@CNsReg@@QAEHPAUHKEY__@@PA_WHP6GXPAX@Z2@Z ?MonitorThread@CNsReg@@SGKPAX@Z ?MovieThread@CNsImage@@CGIPAX@Z ?MsgLoop@CNsApp@@QAEHXZ ?NsEncode@@YAXQBDPADHH@Z ?NsEncodeFile@@YAHPB_W0@Z ?NsGetStrWidth@@YAHPB_WPAUHWND__@@PAUHFONT__@@@Z ?NsReadFile@@YAHPB_WPAXAAK@Z ?NsResGetBuff@@YAHHPB_WPAX@Z ?NsResGetStream@@YAPAUIStream@@HPB_W@Z ?NsResSave@@YAHHPB_W0@Z ?NsResSize@@YAHHPB_W@Z ?NsResUpdate2@@YAHPB_WH0PAXH@Z ?NsResUpdate@@YAHPB_WH00@Z ?NsWriteFile@@YAHPB_WPAXK@Z ?OpenUrl@@YAXPB_WH@Z ?Parse@@YAHPB_W@Z ?Parse@CNsXml@@QAEHPB_W@Z ?PauseMP3@@YAXPB_W@Z ?PlayMP3@@YAXPB_WH@Z ?PlayWav@@YAHPB_WH@Z ?Post@CNsNet@@QAEHPB_WPAXHPADH@Z ?ReadShareMem2@@YAHPB_WPAXHH@Z ?ReadShareMem@@YAHPB_WPA_W@Z ?RefreshIconCache@@YAXXZ ?RegFileRelation@@YAXPB_W0000@Z ?RegProtocol@@YAXPB_W0@Z ?ReplaceExeIco@@YAHPB_W0H@Z ?ResumeMP3@@YAXPB_W@Z ?RevertFsRedirection@@YAXPAPAX@Z ?SavePic@CNsImage@@QAE_NPAUHDC__@@UtagRECT@@PB_W2@Z ?SavePic@CNsImage@@QAE_NPAUHWND__@@PB_W1@Z ?SavePic@CNsImage@@QAE_NPB_W00@Z ?SaveScreen@CNsImage@@QAE_NPB_W0@Z ?SetAppName@CNsApp@@QAEXPB_W@Z ?SetAutoRun@@YAHPB_WH0@Z ?SetAutoRun@CNsReg@@QAEHPB_WH0@Z ?SetClipboard@@YAHPB_W@Z ?SetDefaultFont@CNsFont@@QAEXHPB_WH@Z ?SetIcon@@YAHPAUHWND__@@PAUHICON__@@@Z ?SetInst@CNsImage@@QAEXPAUHINSTANCE__@@@Z ?SetMemName@CNsLog@@QAEXPB_WH@Z ?SetPrivilege@@YAHPB_WH@Z ?SetRegInfo@@YAHPAUHKEY__@@PA_W1HPB_W@Z ?SetRegInfo@CNsReg@@QAEHPAUHKEY__@@PA_W1HPB_W@Z ?SetResType@CNsSkin@@QAEXH@Z ?SetShortcutIcon@@YAHPB_W0@Z ?SetSkinName@CNsSkin@@QAEXPB_W@Z ?SetThemesName@CNsSkin@@QAEXPB_W@Z ?SetTip@@YAHPAUHWND__@@PB_W@Z ?ShowBalloon@@YAHPAUHWND__@@PB_W1H@Z ?ShowOpenFileDlg@@YAHPA_WHPAUHWND__@@PB_W2H@Z ?ShowSaveFileDlg@@YAHPA_WPAUHWND__@@PB_W2@Z ?ShowSelDir@@YAHPA_WPAUHWND__@@@Z ?ShowTray@@YAHPAUHWND__@@PAUHICON__@@PB_WI@Z ?StartMonitor@@YAXPAUHKEY__@@PB_WHP6GXPAX@Z2@Z ?StartMonitor@CNsReg@@QAEXPAUHKEY__@@PB_WHP6GXPAX@Z2@Z ?StartMovie@CNsImage@@QAEXH@Z ?StartThread@CNsThread@@QAEPAXP6GIPAX@Z0H@Z ?StartTimer@CNsThread@@QAEXHP6GXPAX@ZH0@Z ?StartUninstall@CNsUninstaller@@QAEXPAUHWND__@@H@Z ?Stop@CNsNet@@QAEXXZ ?Stop@CNsThread@@QAEXXZ ?StopMP3@@YAXPB_W@Z ?StopMonitor@@YAXXZ ?StopMonitor@CNsReg@@QAEXXZ ?StopMovie@CNsImage@@QAEXH@Z ?StrToIntSize@@YA_JPB_W@Z ?TimerThread@CNsThread@@CGIPAX@Z ?ToAsc@@YAXPADH@Z ?ToHex@@YAXPADH@Z ?URLEncode@@YAHPA_W@Z ?UnLoadDrv@@YAHPB_W@Z ?UninitZlib@CNsZlib@@QAEXXZ ?UninstallFunc@CNsUninstaller@@AAE_NXZ ?UninstallThread@CNsUninstaller@@CGIPAX@Z ?Unlock@CLock@@QAEXXZ ?UnlockRead@CLock@@QAEXXZ ?VerifySignature@@YAHPB_W@Z ?WriteLog2@CNsLog@@QAAXPB_WZZ ?WriteLog3@CNsLog@@QAAXPB_WZZ ?WriteLog@@YAXPB_W@Z ?WriteLog@CNsLog@@QAEXPB_W@Z ?WriteShareMem2@@YAHPB_WPAXHH@Z ?WriteShareMem@@YAHPB_W0H@Z ?WriteSkin@CNsSkin@@AAEXPAU_iobuf@@AAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?Zoom@CNsImage@@QAE_NPB_WMHH00@Z ?_ins@?1??Instance@CNsZlib@@SAAAV2@XZ@4V2@A ?_obj@?1??Instance@CNsLog@@SAAAV2@XZ@4V2@A ?_obj@?1??Instance@CNsNet@@SAAAV2@XZ@4V2@A ?_obj@?1??Instance@CNsReg@@SAAAV2@XZ@4V2@A ?_obj@?1??Instance@CNsXml@@SAAAV2@XZ@4V2@A ?gb2big@@YAXPADH@Z ?isConnected@@YAHPB_W@Z ?isConnected@CNsNet@@QAEHPB_W@Z ?isDigital@@YAHPBD@Z ?isDir@@YAHPB_W@Z ?isEnableUAC@@YAHXZ ?isEnglish@@YAHXZ ?isExistsMovie@CNsImage@@AAE_NH@Z ?isExistsShareMem@@YAHPB_W@Z ?isGzip@CNsNet@@QAEHPAX@Z ?isHZ@@YAHPBD@Z ?isLog@CNsLog@@AAE_NXZ ?isNotebook@@YAHXZ ?isSimplified@@YAHXZ ?isStop@CNsImage@@QAE_NH@Z ?isSupportYaHei@CNsFont@@QAEHXZ ?isTraditional@@YAHXZ ?isWin7@@YAHXZ ?isWin8@@YAHXZ ?isWow64@@YAHXZ

Sharing

General

Malware Config

Signatures

File Explorer

aa26ec34162e38147b948b39b362d476_JaffaCakes118

Windows优化卫士 6.0/YiXinSafe/SkinH_EL.dll

generic

Windows优化卫士 6.0/YiXinSafe/YXabc.ini

Windows优化卫士 6.0/YiXinSafe/YiXinPCTray.exe

winmm

ws2_32

rasapi32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wininet

comdlg32

generic

Windows优化卫士 6.0/YiXinSafe/data/admin.edb

Windows优化卫士 6.0/YiXinSafe/mb.dll

winmm

ws2_32

version

msvfw32

avifil32

rasapi32

kernel32

user32

gdi32

msimg32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

wldap32

wininet

generic

Windows优化卫士 6.0/nsUninstall.dat

Windows优化卫士 6.0/nsUninstall.exe

kernel32

user32

gdi32

ole32

shlwapi

dbghelp

comdlg32

advapi32

shell32

oleaut32

wininet

version

winmm

gdiplus

crypt32

wintrust

urlmon

generic

Windows优化卫士 6.0/下载说明.txt

Windows优化卫士 6.0/华彩联盟论坛.url

Windows优化卫士 6.0/华彩软件站-使用必读.url