0b60cb733412ed7a81fb809a964e82ad_JaffaCakes118
- SHA256 c74643d935408a6a5c351b9c0b82aaea27ee2f3b7070d9ae33c8cedba2360901
Overview
overview
7Static
static
3PlayMule_B...30.exe
windows7-x64
3PlayMule_B...30.exe
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3IE2EM.dll
windows7-x64
6IE2EM.dll
windows10-2004-x64
6Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7config/antiLeech.dll
windows7-x64
1config/antiLeech.dll
windows10-2004-x64
1config/antiLeech.dll
windows7-x64
1config/antiLeech.dll
windows10-2004-x64
1config/cou...ag.dll
windows7-x64
1config/cou...ag.dll
windows10-2004-x64
1emule.exe
windows7-x64
6emule.exe
windows10-2004-x64
6lang/zh_CN.dll
windows7-x64
1lang/zh_CN.dll
windows10-2004-x64
1player.exe
windows7-x64
1player.exe
windows10-2004-x64
1新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PlayMule_Build_080630.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
PlayMule_Build_080630.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
IE2EM.dll
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
IE2EM.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
Uninstall.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
Uninstall.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
config/antiLeech.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
config/antiLeech.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
config/antiLeech.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
config/antiLeech.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
config/countryflag.dll
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
config/countryflag.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
emule.exe
Resource
win7-20240611-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral16
Sample
emule.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
lang/zh_CN.dll
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
lang/zh_CN.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
player.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
player.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
新云软件.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
新云软件.url
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 0b60cb733412ed7a81fb809a964e82ad_JaffaCakes118
- Size 5.4MB
- Sample240621-pgewnsyhnc
- SHA256 c74643d935408a6a5c351b9c0b82aaea27ee2f3b7070d9ae33c8cedba2360901
- MD5 0b60cb733412ed7a81fb809a964e82ad
- SHA1 0f0a6d664a0d28333e26e15be3d39e0b8846c6c1
- SHA512 d48b77ff643061cafef4dd2f911177b7192181f7e12bdb577647ae632447b9eaa4f33ea95a8733702ae6e340f94d385a0dd02d6a0e9421ac46a2cb62205eb3b2
- SSDEEP 98304:GzGUkLOrZLStQtwQEbKbaxFJaxLmlDJ3u2ZweB8cEbKPjWijnNkcneuCRkNFpZVz:Gz3kLOFutQaQFbaxD0Lm1vqe045euCSR
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/PlayMule_Build_080630.exe unpack002/$PLUGINSDIR/StartMenu.dll unpack002/IE2EM.dll unpack002/Uninstall.exe unpack002/config/countryflag.dll unpack002/emule.exe unpack002/lang/zh_CN.dll unpack002/player.exe - NSIS installer 4 IoCs
resource yara_rule static1/unpack001/PlayMule_Build_080630.exe nsis_installer_1 static1/unpack001/PlayMule_Build_080630.exe nsis_installer_2 static1/unpack002/Uninstall.exe nsis_installer_1 static1/unpack002/Uninstall.exe nsis_installer_2
File Explorer
-
0b60cb733412ed7a81fb809a964e82ad_JaffaCakes118.rar 5.4MB
-
PlayMule_Build_080630.exe.exe 5.5MB
-
$PLUGINSDIR/StartMenu.dll.dll 7KB
-
$PLUGINSDIR/modern-header.bmp25KB
-
IE2EM.dll.dll 140KB
-
Uninstall.exe.exe 196KB
-
$PLUGINSDIR/modern-header.bmp25KB
-
config/CatInit.ini1KB
-
config/addresses.dat34B
-
config/antiLeech.dll.dll 99KB
-
config/antiLeech.dll.new.dll 99KB
-
config/clients.met962KB
-
config/countryflag.dll.dll 268KB
-
config/ip-to-country.csv2.2MB
-
config/ipfilter.dat426B
-
config/nodes.dat4KB
-
config/preferences.ini9KB
-
config/server.met15KB
-
config/staticservers.dat227B
-
config/webservices.dat67B
-
emule.exe.exe 5.0MB
-
lang/zh_CN.dll.dll 52KB
-
player.exe.exe 4.1MB
-
新云软件.url.url 133B
PlayMule_Build_080630.exe
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 7156995bb7e4204f67e551718d81a685ad6a3e83a4b1e6155311be5f6daa7ee3
- MD5 30364db4b502cecbfdb75b66e40504d3
- SHA1 438416ec67e42c9b3fb8370f570f32eadc8459e3
- SHA512 2aeaa105a0e580831b318150a0cf2349bf270b4ec9f6da471051cc15360a9148ded1da3dc305b974adb727f712f52ae996d70c554ae185ff5af62ae046b51ab5
- SSDEEP 98304:zidAqoEeQbPmFqPdiV5LiJoYsQluTXSMT//LxDOkNJEf5ahf2DT58EGFpURcfG9Q:edABuPVcV5DLSwnLA3aAH5PGFKRoGu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12515
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
163KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/StartMenu.dll
- IMPHASH 7868cd55f358bfb360f9eb8ce1512ca0
- SHA256 e66dd544c167c9ebb3d8ed18622276c350e5c97c076c7c81b514bab6446a3ca5
- MD5 80a55b35582678d845ccca04f52cada3
- SHA1 82d1236218c95a34425b8831ef1627c0c5919dfa
- SHA512 c683793d4f264a76ffa5aab33be2a1aca154757f09a984e22b4281af19e9deaac5297a80ee9c92b8195e15db5b8b33f7d110707c05bf9c928c6e5561da559a62
- SSDEEP 96:Z+LBC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5t/GhEl5VN:Z+lepxPE1r8/FtmCDt+g5v
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpynA
GlobalAlloc
MulDiv
GetModuleHandleA
GlobalFree
FindClose
FindNextFileA
FindFirstFileA
lstrcmpiA
lstrcatA
lstrcpyA
user32
TranslateMessage
GetMessageA
IsDialogMessageA
PostMessageA
DispatchMessageA
GetWindowLongA
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
IsDlgButtonChecked
GetWindowTextA
DestroyWindow
GetDlgItem
CreateDialogParamA
SetWindowLongA
wsprintfA
CallWindowProcA
gdi32
GetTextMetricsA
SelectObject
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ole32
CoTaskMemFree
Init
Select
Show
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=1, productName=Unmarked objects,
count=11, id=93, version=2179,
count=1, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-header.bmp
- SHA256 35de7194e19b52c3c6ca018e99b8e160f192554cc7ce68257d871b24101aa0e9
- MD5 57af65a1d241bfd8e38606a5a2dc241b
- SHA1 7d5a0206d2242147713cbc9ef9ac7967a9d48ae0
- SHA512 08bed55a427e69ed01e50707f0c218ada6441760d69eebb603bf38718d0304f83b30c449c44439b1034b230f76544cd01b754eeaf28f2b128930a642c9e74f8d
- SSDEEP 48:AFLroYtDD3GsVh0A8yWgZC5Gy3dIW+5lQgHzFJ+Sti2iRuAuGaNbOf:AWYtHGW6Zy/GGy33+PRHj+V2ErKO
- MD5 SHA1 SHA512 SSDEEP
IE2EM.dll
- IMPHASH 7ddfd351fee5996572a10759fa2e8f38
- SHA256 060fca871cfa8cc882cea983e1e44a3a0f6c71daa453d92823c31bb86af471f4
- MD5 9085e79a986c376d9197052ebffd1de8
- SHA1 d9649126fc3fb8268dee6cb063736b8ad04a135a
- SHA512 a5eeaf0a2a4b5bf519b105bda4896f1742e90090027d2a0044159a607f6b77ca0094e84392a973809e17a8382ab9cd2451dcacea52a85e79d91131aea9c4379d
- SSDEEP 3072:I3kt8JnSjr1kC9yT3SQ2hCDs49Y6IAlGEn3rqM93:ftv23SpuiJ2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38721
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
f:\code\easyMule-1.0.0-Source\Ie2em\Release\IE2EM.pdb
kernel32
GetLastError
lstrcmpiW
lstrcpynW
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
DeleteCriticalSection
GetModuleHandleW
GetModuleFileNameW
lstrcatW
WideCharToMultiByte
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
LocalFree
CloseHandle
InitializeCriticalSection
RaiseException
lstrcpyW
lstrlenW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
LoadLibraryExW
InterlockedExchange
FlushFileBuffers
SetStdHandle
SetFilePointer
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetVersionExA
HeapAlloc
HeapFree
ExitProcess
RtlUnwind
HeapReAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetModuleFileNameA
SetUnhandledExceptionFilter
VirtualQuery
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
VirtualProtect
GetSystemInfo
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
HeapSize
user32
CharNextW
MessageBoxW
GetKeyState
advapi32
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
ole32
CoGetMalloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
oleaut32
SysFreeString
SysAllocString
LoadRegTypeLi
VariantClear
VarBstrCat
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
VarUI4FromStr
VarBstrCmp
shlwapi
PathFileExistsW
PathFindExtensionW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=25, version=9210,
count=3, id=95, version=2179,
count=2, id=93, version=2067,
count=11, id=93, version=2179,
count=144, id=1, productName=Unmarked objects,
count=28, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=124, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Uninstall.exe
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 02104c3821325a7dd2a2bb0c955c40b626d24f26491b5912548f2f5c766069ad
- MD5 39803a2f8b2ff4d51d034b4a6d51de04
- SHA1 dba60fc5bb101204f5b2b7cc4ecff4e797d0baf0
- SHA512 f31664dd441f0e71baa4f297a05393b81e2b036cd0442a4243028f554b2d8cd7c1027c61ebf5b23f76488250f4221e70e29134c46fde131d814ec3637402016b
- SSDEEP 3072:pYU94fDhmJBieh5QgYVLKA6RFWT/H3YLG:pcChhLULD6DCb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12515
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
163KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/modern-header.bmp
- SHA256 35de7194e19b52c3c6ca018e99b8e160f192554cc7ce68257d871b24101aa0e9
- MD5 57af65a1d241bfd8e38606a5a2dc241b
- SHA1 7d5a0206d2242147713cbc9ef9ac7967a9d48ae0
- SHA512 08bed55a427e69ed01e50707f0c218ada6441760d69eebb603bf38718d0304f83b30c449c44439b1034b230f76544cd01b754eeaf28f2b128930a642c9e74f8d
- SSDEEP 48:AFLroYtDD3GsVh0A8yWgZC5Gy3dIW+5lQgHzFJ+Sti2iRuAuGaNbOf:AWYtHGW6Zy/GGy33+PRHj+V2ErKO
- MD5 SHA1 SHA512 SSDEEP
config/CatInit.ini
- SHA256 d70be5a86b69f7ea2ff35f442a9a649025be892db51847a166227b0cefaf3a3f
- MD5 b1a654396205a30627bce328b344b8dd
- SHA1 967c12b82e678ded7b0a72e4c421b0c64536a5a5
- SHA512 9d550d4be77e05fc5d1dd595815242f0d6afbd5f0004e9657941bb61abed2ad9d66a234f3069f6b29ae0e256c1f757574a800a7c83877dc2934fdc1e6434ae9f
- MD5 SHA1 SHA512
config/addresses.dat
- SHA256 bd73f82094cfd3002ebe20cf22ce6574ffd0f6e476eaea8b4b92e3072ad50f3f
- MD5 1ce3d25a0158c3dfc878008d5410d113
- SHA1 7591c12485923931e922ddd22d0f95da17a18590
- SHA512 af79bee6cc0e9f5f9495317d7c0e90981b4b111e905a160935cd5d67f8187ab72963e335faeef6a808c43289a1b54138c370bf7a741cf1634032d2c858236458
- MD5 SHA1 SHA512
config/antiLeech.dll
- IMPHASH beeca3d79cc23a8b14fe0d512f5cadc3
- SHA256 416db1f259303d864940819744b589152be292caa480a31914341436bc5dc9df
- MD5 4e6356018e86041a7bef0fa31e24455e
- SHA1 89b5c8086849da5a9100389c5f609b399f2c24db
- SHA512 3de7cef8009bdf79e551836a2ab4a319b70e44b86b3fb5543de5a0985f03b5dbdc1dd09faa9db4e864207b9652870d9b6c2ab8ed203e6bf79ad617f4825fae4b
- SSDEEP 1536:FmplIYwch+0OfdldWRUvLt6dxybqqR1V82c5MWGdP0d:FmtkfN5V/8f5MWGF0d
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
29:ca:79:b0:22:cd:70:23:30:02:1d:78:18:12:b4:38:ef:f9:75:08
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Shanghai Source Networking Technology Co.\, Ltd,OU=WoSign Class 3 Code Signing,O=Shanghai Source Networking Technology Co.\, Ltd,L=Shanghai,ST=Shanghai,C=CN
Chains
Jun 18, 2024
Subject
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Serial Number
42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning, ExtKeyUsageClientAuth
Timespan
Apr 25, 2007 - Jul 9, 2019
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Jul 9, 1999 - Jul 9, 2019
Subject
CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US
Serial Number
43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 30, 2007 - Apr 29, 2012
Subject
CN=Shanghai Source Networking Technology Co.\, Ltd,OU=WoSign Class 3 Code Signing,O=Shanghai Source Networking Technology Co.\, Ltd,L=Shanghai,ST=Shanghai,C=CN
Serial Number
7e:83:32:3f:99:07:57:f7:e2:d4:38:3f:33:6a:15:5a
Issuer
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
Sep 11, 2007 - Sep 10, 2008
Minor OS version
0
Major OS version
5
Entry point
26164
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\Projects\DLP\v31_2\Release\antiLeech.pdb
kernel32
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
HeapAlloc
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
FindResourceExW
LoadResource
LockResource
SizeofResource
EnterCriticalSection
FindResourceW
FlushFileBuffers
CloseHandle
CreateFileA
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetLastError
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
user32
MessageBoxW
advapi32
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextW
shlwapi
StrCmpIW
StrStrIW
StrStrW
DLPCheckHelloTag
DLPCheckInfoTag
DLPCheckMessageSpam
DLPCheckModstring
DLPCheckModstring_Hard
DLPCheckModstring_Soft
DLPCheckNameAndHash
DLPCheckNameAndHashAndMod
DLPCheckUserhash
DLPCheckUsername
DLPCheckUsername_Hard
DLPCheckUsername_Soft
GetDLPVersion
TestFunc
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=103, id=131, productName=VS2008 build 21022, version=21022,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=101, id=1, productName=Unmarked objects,
count=47, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
config/antiLeech.dll.new
- IMPHASH beeca3d79cc23a8b14fe0d512f5cadc3
- SHA256 416db1f259303d864940819744b589152be292caa480a31914341436bc5dc9df
- MD5 4e6356018e86041a7bef0fa31e24455e
- SHA1 89b5c8086849da5a9100389c5f609b399f2c24db
- SHA512 3de7cef8009bdf79e551836a2ab4a319b70e44b86b3fb5543de5a0985f03b5dbdc1dd09faa9db4e864207b9652870d9b6c2ab8ed203e6bf79ad617f4825fae4b
- SSDEEP 1536:FmplIYwch+0OfdldWRUvLt6dxybqqR1V82c5MWGdP0d:FmtkfN5V/8f5MWGF0d
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
29:ca:79:b0:22:cd:70:23:30:02:1d:78:18:12:b4:38:ef:f9:75:08
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Shanghai Source Networking Technology Co.\, Ltd,OU=WoSign Class 3 Code Signing,O=Shanghai Source Networking Technology Co.\, Ltd,L=Shanghai,ST=Shanghai,C=CN
Chains
Jun 18, 2024
Subject
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Serial Number
42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning, ExtKeyUsageClientAuth
Timespan
Apr 25, 2007 - Jul 9, 2019
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Jul 9, 1999 - Jul 9, 2019
Subject
CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US
Serial Number
43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 30, 2007 - Apr 29, 2012
Subject
CN=Shanghai Source Networking Technology Co.\, Ltd,OU=WoSign Class 3 Code Signing,O=Shanghai Source Networking Technology Co.\, Ltd,L=Shanghai,ST=Shanghai,C=CN
Serial Number
7e:83:32:3f:99:07:57:f7:e2:d4:38:3f:33:6a:15:5a
Issuer
CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
Sep 11, 2007 - Sep 10, 2008
Minor OS version
0
Major OS version
5
Entry point
26164
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\Projects\DLP\v31_2\Release\antiLeech.pdb
kernel32
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
HeapAlloc
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
FindResourceExW
LoadResource
LockResource
SizeofResource
EnterCriticalSection
FindResourceW
FlushFileBuffers
CloseHandle
CreateFileA
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetLastError
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
user32
MessageBoxW
advapi32
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextW
shlwapi
StrCmpIW
StrStrIW
StrStrW
DLPCheckHelloTag
DLPCheckInfoTag
DLPCheckMessageSpam
DLPCheckModstring
DLPCheckModstring_Hard
DLPCheckModstring_Soft
DLPCheckNameAndHash
DLPCheckNameAndHashAndMod
DLPCheckUserhash
DLPCheckUsername
DLPCheckUsername_Hard
DLPCheckUsername_Soft
GetDLPVersion
TestFunc
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=103, id=131, productName=VS2008 build 21022, version=21022,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=101, id=1, productName=Unmarked objects,
count=47, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
config/clients.met
- SHA256 7271f95d2f3c61b849cbbc498a5a9c8496826459bb9bbcd51533f6d802324803
- MD5 7dd114a0721c4265152666f2b6a810cb
- SHA1 cd5ed3f4591dc9dfee369817784bb5e9f6521903
- SHA512 1c280d327ebaa4f74d8bdbf2af4949f7cf3ff322c226d5f532c1aa01a61d34ec2dc3812af5ed29bead5851e12cd15dbafccb7638638f833ef5bd72fa83639e0f
- SSDEEP 12288:fPM9WGueIArD9EmxPq3hVrtKhuN82HISkxvqjOoVG5ncHBk1x9JuI2r:f0oGu4DOmxirtK682HI/SjachIyI2r
- MD5 SHA1 SHA512 SSDEEP
config/countryflag.dll
- SHA256 e8197c566c9af80474a497524ffc59b2204df97ed9b2393013f1a389cddeae41
- MD5 68ba4702303deb81ef19c4eb3a561649
- SHA1 fd29b08fcec9f07bdccdcb5cb60267f968e58bba
- SHA512 ee1bbaba6ad3b5f581e1c1496a8719960139f56776ef45f1c52e20ecbc250a24ca5f410725adf995df29ca6d3e5ba90aab475b016a06119cd01f558103f3d875
- SSDEEP 1536:qsuBpesYI/3emDBq0G0GPZr5vUTnuEYyfIDQDFLAJnVauwBglVn:qb/lN/uS+Bt+U8I+FENgBylV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\eMule_VC\src\flag\Dynamic\flag.pdb
Name
.rdata
Size
4KB
Virtual Size
90B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
256KB
Virtual Size
253KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
config/ip-to-country.csv
- SHA256 9d15ce21e0d67303043969c2d88d7e07182406ae2367886abb627b3a36366fd1
- MD5 ca6ed52d5111273ad7d3ed0c79bf6a6f
- SHA1 bb0f034fb0708a62aa1f9cfe50c356695d89f3d0
- SHA512 1373289298029a727c7406aec64267da57d019e9b5fa715a9afc170e6367ba08ca9d8be1a478d5ae8bab5b1655276349592d8a6c40090546d67af4d3304c0941
- SSDEEP 3072:SuxebeN1bcuDAFLdZmGjDXig8eDUUKBzrVhS0XMkUyjUFvgWk3/SvdsJjdRGGSY3:PxebeN1MSglKhrp/r1aZI7LctDq4nWWq
- MD5 SHA1 SHA512 SSDEEP
config/ipfilter.dat
- SHA256 e56b9cae107781430ec5b35fad1fe26c012ea5952458fc13f1304b35d28f0831
- MD5 a814b6220b8896604a77e09569038340
- SHA1 821c91172b5d6fe1d61426ed7b1f951ab161afb1
- SHA512 e6a7f1a0a86e592986781875f4cf0b78261aca5832439146b7d4c51806b18085b04750e24706487a3c59edfa47b7b0e10767f41d609bc3df8090c3e3383f81a0
- MD5 SHA1 SHA512
config/nodes.dat
- SHA256 99287787c7dd38e43556eecc8ef076ef5ac0a75b2efe114c6d0ab6bfef64e78f
- MD5 6d6b994646740a5f635efdf00abd9070
- SHA1 013b1a5c3fb89a6e4b5a0f3338ab019273c857d1
- SHA512 e1380d2ed7e8eddfb4d3260364aaf7fc3aca99dcab3d87c982cf557d4dc951a0cb90734b59076a2f4f429966e2287fd4c8faf51adaa1201e20f617882c105dfd
- SSDEEP 96:WKSSmJNGqWcmT+PiISljCrPbr+evmVGYfp/+osqF4WU/LA2dzLhPe1mNUQreEZoS:BSfJFWcKsxXbEGYfpLFHUzddXhPelQrF
- MD5 SHA1 SHA512 SSDEEP
config/preferences.ini
- SHA256 dfa33f1610aa60803a041e19e94efccd747d620c6407100c8cfbd494d59d9d00
- MD5 1bf6a614f758e809cc6765f9c1dddaa6
- SHA1 a5780b43acd2db2217a8a7eca34aca119d6b6d23
- SHA512 e840f2c9f97700f0f2bf6c10a93a146f5b2f0006915a1f9d6647212b6a638f1a5f4262c944a03ae2ab1bd715b9cd23f85f64119ecc72dbc735e223134d39940b
- SSDEEP 192:BA/kWTn5ZOU+TfJPLfKtNueU8gTwTzTzThTXLtNe846xpkVVFn:BAxZOTTFfiufiLtI8DpkrFn
- MD5 SHA1 SHA512 SSDEEP
config/server.met
- SHA256 408442490a53df4311fb0fced9a7cb5484796d70a66064f95d1d27888e1f913f
- MD5 a22a1135a91721b825b3d3b643872a4a
- SHA1 c9b37148228bdfcc1fd0133d80c18e7df0561425
- SHA512 b3a2e51fa7e5191bf2fab855c2d6cc73708c50106bc28ed8bb2b33c3536ad67927991f28e23b0277a509792870cada509b1eeccf8e5f4393d4bc58a0acfd0db2
- SSDEEP 384:HFTD9kRI62sdJo5upmfx29GycVR4jTXn+2ItyHExM6:Hl6dJ+xa14tT
- MD5 SHA1 SHA512 SSDEEP
config/staticservers.dat
- SHA256 a68b54f2fcfb4bee56a38dbbabcdbe490986f54fac53ecf4769e27503d3b5660
- MD5 0ca3ea6c23203989f6742da7fd70df3e
- SHA1 38b971430bd1052b8349cbd2bf06a3642bc67b92
- SHA512 a8efe0eb4e9fbb4cd428ce027e2812faa4bb8c8fee68e7c2338f46b5bfdd23b072f915734c0ad2561cd07585f08f91bd4fa184ebe22641ed3fef580f8b05c6b7
- MD5 SHA1 SHA512
config/webservices.dat
- SHA256 4682c234644fa784df62ce7bfe7804d89a7ced4c6fd45e75bc6debd038d8da4f
- MD5 91171c63ef26dbf32a03c36325f22884
- SHA1 9e0bae993281f4fce5216901c1ec0404af639757
- SHA512 8676ff4ee839b47e847e5ba2d30204a8ae0a9b9266b32f32be29bd94ba791d188828765678ce1e3d9ae86da6cef78ee47b7d54768265f0e91abda1cdce48f376
- MD5 SHA1 SHA512
emule.exe
- IMPHASH c71ca5755c080863efbedc8e970ccbe1
- SHA256 93c129bf571e03c152322c3d0f8bc218eab0ce8fef54fdc5bbd6bac31a455ab2
- MD5 4a4a19ba54361e620d25a2556af4bc0a
- SHA1 356a54e66f3dc909fcab577599258a50a1b9bd93
- SHA512 656f698e8008bf590d6da0b58cf8618c314d1aaa7fe36420dd2e5c574e8c8b096472b5f68e71fa0f780f3d7fc9a8e9471273d8232db83f8030096bf842549197
- SSDEEP 49152:YWX6S1zJFPujY24lbXNOgCqy3DY1mhHv0WCK1S+8X4e7NzyuRTEiXD1c3dWWWWWt:rz+ClbXN92N49oi+V6z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2640769
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\code\eMule-VeryCD-src\src\release\emule.pdb
kernel32
CreateFileA
SizeofResource
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleHandleA
CompareStringA
SetEnvironmentVariableA
GetDriveTypeA
IsBadCodePtr
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetOEMCP
LCMapStringA
VirtualFree
HeapCreate
HeapDestroy
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
HeapSize
SetStdHandle
CreateThread
ExitThread
RtlUnwind
VirtualQuery
GetSystemInfo
GetVersionExA
SuspendThread
GetModuleFileNameA
GetCurrentDirectoryA
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetCurrentProcessId
ExitProcess
SetUnhandledExceptionFilter
GetCurrentThread
TryEnterCriticalSection
MulDiv
InterlockedDecrement
InterlockedIncrement
SetThreadPriority
FreeResource
WriteFile
WaitForMultipleObjects
ResetEvent
IsBadReadPtr
GetExitCodeProcess
QueryPerformanceFrequency
QueryPerformanceCounter
IsBadWritePtr
OpenThread
GetVersion
HeapFree
GetProcessHeap
HeapAlloc
Beep
DeviceIoControl
TerminateThread
SetLastError
GetTimeZoneInformation
FindClose
LocalFree
GetCurrentProcess
lstrlenA
SetEvent
WritePrivateProfileStringA
GetPrivateProfileStringA
GetSystemDefaultLCID
VirtualAlloc
GetDateFormatA
GetTimeFormatA
PeekNamedPipe
GetFileInformationByHandle
GetFileType
TerminateProcess
HeapReAlloc
GlobalFlags
SetThreadLocale
ResumeThread
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SetConsoleCtrlHandler
LoadLibraryA
RaiseException
UnmapViewOfFile
MapViewOfFile
ReadFile
SetFilePointer
GetFileSize
FreeLibrary
GetTickCount
GetCurrentThreadId
GetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
WaitForSingleObject
Sleep
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
LoadResource
LockResource
GlobalSize
SetErrorMode
VirtualProtect
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
lstrcmpiA
ConvertDefaultLocale
EnumResourceLanguagesW
GlobalDeleteAtom
GetFileTime
FileTimeToLocalFileTime
ReleaseMutex
DuplicateHandle
UnlockFile
LockFile
FlushFileBuffers
lstrcmpA
LocalAlloc
SetEndOfFile
advapi32
CryptAcquireContextA
CryptGenRandom
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptReleaseContext
user32
FillRect
GetDlgItem
SetForegroundWindow
GetDesktopWindow
GetSysColor
CopyRect
IsRectEmpty
OffsetRect
GetCursorPos
DestroyWindow
GetParent
PtInRect
IsWindowVisible
MapWindowPoints
InvalidateRect
UpdateWindow
FrameRect
DestroyCursor
DestroyMenu
GetNextDlgTabItem
SetCursor
WindowFromPoint
GetActiveWindow
GetSubMenu
InflateRect
DrawFocusRect
GetIconInfo
CreateIconIndirect
SetParent
SetFocus
RedrawWindow
SetWindowPos
GetClassNameA
ScreenToClient
DrawFrameControl
MessageBoxA
SetCapture
GetCapture
GetMessagePos
SetRect
ReleaseCapture
GetWindow
GetFocus
LockWindowUpdate
GetDCEx
GetNextDlgGroupItem
DeleteMenu
UnpackDDElParam
ReuseDDElParam
SetMenu
InvalidateRgn
ShowOwnedPopups
EndDialog
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
EndPaint
BeginPaint
IsWindowEnabled
MoveWindow
IsDlgButtonChecked
ClientToScreen
ReleaseDC
GetDC
ExitWindowsEx
SetTimer
KillTimer
UnhookWindowsHookEx
CallNextHookEx
AdjustWindowRectEx
GetClientRect
IsWindow
GetWindowRect
DestroyIcon
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EnumWindows
GetAsyncKeyState
GetSystemMetrics
SetDlgItemInt
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SendDlgItemMessageA
GetForegroundWindow
GetLastActivePopup
GetTopWindow
CreatePopupMenu
DrawEdge
IntersectRect
IsChild
ChildWindowFromPointEx
SubtractRect
ShowWindow
SetWindowRgn
TranslateMessage
ShowCursor
SetMenuDefaultItem
SetRectEmpty
SetWindowTextA
SetDlgItemTextA
GetWindowTextA
ScrollDC
CheckMenuRadioItem
DrawIconEx
CopyIcon
ShowScrollBar
GetCaretPos
EnableMenuItem
CheckMenuItem
EqualRect
GetMessageTime
SetActiveWindow
RemoveMenu
GetMenuItemCount
CreateMenu
MessageBeep
BringWindowToTop
FlashWindow
DrawIcon
IsIconic
GetSystemMenu
GetDoubleClickTime
GetSysColorBrush
GetKeyState
GetWindowDC
GetWindowRgn
GetScrollInfo
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetMenu
IsMenu
IsZoomed
GetMenuItemID
GetMenuState
ValidateRect
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetWindowPlacement
SystemParametersInfoA
GetDlgCtrlID
SetWindowPlacement
SetScrollInfo
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
TrackPopupMenu
ScrollWindow
gdi32
CreateRectRgn
PtVisible
GetWindowOrgEx
GetBkColor
GetViewportExtEx
GetWindowExtEx
GetMapMode
SetBitmapBits
GetBitmapBits
SetDIBColorTable
CreateDIBSection
GdiFlush
CreateRectRgnIndirect
CreatePen
RealizePalette
Rectangle
CreatePalette
CreateSolidBrush
Polygon
SetPixel
GetPixel
CreateCompatibleBitmap
DeleteDC
SetTextColor
BitBlt
SetBkColor
SelectObject
CreateCompatibleDC
DeleteObject
DPtoLP
GetDeviceCaps
CreateBrushIndirect
CreateBitmap
GetStockObject
RectVisible
Escape
CombineRgn
SetBkMode
GetBitmapDimensionEx
GetDIBits
SetBitmapDimensionEx
SetBoundsRect
SetPixelV
SetTextAlign
GetViewportOrgEx
SetDIBitsToDevice
SetStretchBltMode
GetTextColor
GetRgnBox
Ellipse
LPtoDP
CreateEllipticRgn
SelectPalette
CreatePatternBrush
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectClipRgn
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
SetMapMode
SetROP2
SetPolyFillMode
RestoreDC
SaveDC
PatBlt
CreatePolygonRgn
FillRgn
OffsetRgn
SetRectRgn
GetClipBox
ExtSelectClipRgn
CreateDIBitmap
shell32
SHGetMalloc
DragFinish
SHAppBarMessage
winmm
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeGetTime
comctl32
ImageList_Remove
ImageList_GetImageCount
ImageList_EndDrag
ImageList_DragLeave
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragEnter
ImageList_BeginDrag
ImageList_SetOverlayImage
DestroyPropertySheetPage
ImageList_Destroy
ImageList_AddMasked
ImageList_GetIconSize
ImageList_GetIcon
ImageList_Draw
ImageList_GetImageInfo
_TrackMouseEvent
ord17
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Create
ImageList_LoadImageW
PropertySheetW
ImageList_DrawIndirect
CreatePropertySheetPageW
shlwapi
PathFileExistsW
PathMatchSpecW
PathRenameExtensionW
PathIsRelativeW
PathRemoveFileSpecW
PathFindExtensionW
PathRemoveExtensionW
PathFindFileNameW
PathRemoveBackslashW
PathCanonicalizeW
PathStripToRootW
PathAddBackslashW
PathStripPathW
PathCombineW
PathGetArgsW
PathIsUNCW
StrStrIA
UrlUnescapeW
StrStrIW
ole32
CreateStreamOnHGlobal
CoTaskMemAlloc
StgOpenStorage
CoTaskMemFree
CoUninitialize
CoCreateInstance
CoInitializeSecurity
ReleaseStgMedium
OleDuplicateData
StringFromCLSID
OleUninitialize
CoFreeUnusedLibraries
CLSIDFromProgID
CLSIDFromString
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleGetClipboard
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoRegisterClassObject
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoInitialize
OleInitialize
oleaut32
OleCreateFontIndirect
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
VariantTimeToSystemTime
LoadRegTypeLi
DispCallFunc
VariantCopy
VariantChangeType
SysStringByteLen
SystemTimeToVariantTime
SysFreeString
VariantInit
VariantClear
VarBstrCmp
SysAllocStringLen
SysAllocString
SysStringLen
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
OleLoadPicture
urlmon
IsValidURL
FindMimeFromData
CoInternetGetSession
wsock32
WSAStartup
select
wininet
HttpQueryInfoW
InternetConnectW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
InternetErrorDlg
InternetCanonicalizeUrlW
InternetQueryOptionW
InternetQueryDataAvailable
InternetCrackUrlW
InternetReadFile
InternetOpenW
InternetOpenUrlW
InternetCloseHandle
InternetWriteFile
InternetSetFilePointer
InternetGetLastResponseInfoW
InternetSetStatusCallbackW
iphlpapi
GetAdaptersInfo
winspool.drv
ClosePrinter
Name
.text
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
660KB
Virtual Size
659KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
56KB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=245, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=286, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=6, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=27, id=93, version=2179,
count=690, id=1, productName=Unmarked objects,
count=195, id=105, version=2067,
count=204, id=95, version=2179,
count=54, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=278, id=100, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
lang/zh_CN.dll
- SHA256 32fd3d15f2b03766e3cf4250c0a499ca7dff44f39f3fb97a6be214f0df92af25
- MD5 43840e67d198bcada200a86f98e64bed
- SHA1 2171814293a8fa57862efabb23058a52d22451bb
- SHA512 49b596f6ed439650bd74582942847a435155b29853249a3797327a3faa2c5beafea4f00b778c7ec6d44171d91b0155bd346eb35dadea2c8a4fb44ba61c51caf3
- SSDEEP 384:6daRyofb5ae7pBHATgOUW6HD2WRrZMC31KT63MzUoM6UYv4af0iEv0AZnwjDI4/n:6dBmTBJO6iorZr4ucM6rv3EaaBw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
44KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
player.exe
- IMPHASH fcbe4719987f525c36ae6e757811ac2b
- SHA256 07f1f565183dc40b69830c9e06067b8c69b07e536b96feb1314ace71edd8eb59
- MD5 807302ead843d0f184cdfc0f3f323ad3
- SHA1 0ffc5f207eb20c29fad4b102a962f741b49c6140
- SHA512 3415a689a5e0b345034f13d4fc468c9b992f203e9f0fec15203b4bd0564d3ec55f816497f92cd6066cb3babed06ecf0d213f96ee2e76beb1bdd45755efee0a6a
- SSDEEP 98304:pkuSKZ37rfhkHgzoYiakezUG9MF+zYFVvvvvvv05cs+lzamVqIARzAXos3wcYM1W:SEmakk9s+QO5cs+lzamVqIARzAXos3wt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2352330
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\code\release_v1_0_10_0\src\apps\mplayerc\Release Unicode\mplayerc.pdb
dsound
ord1
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
ddraw
DirectDrawCreateEx
setupapi
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiSetDeviceRegistryPropertyA
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsW
SetupDiGetDeviceRegistryPropertyA
SetupDiSetDeviceRegistryPropertyW
kernel32
UnlockFile
SetEndOfFile
GlobalGetAtomNameW
CompareStringA
EnumResourceLanguagesW
ConvertDefaultLocale
GetFileAttributesW
GetFileTime
FindResourceExW
GlobalFlags
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
RtlUnwind
HeapReAlloc
GetSystemTimeAsFileTime
ExitThread
ExitProcess
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetStdHandle
GetFileType
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
GetCommandLineA
GetCommandLineW
SetHandleCount
GetStartupInfoA
LockFile
HeapCreate
GetCPInfo
GetOEMCP
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
GetStringTypeA
GetStringTypeW
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
SizeofResource
LockResource
LoadResource
FindResourceW
GetPrivateProfileSectionW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
lstrlenW
GetUserDefaultLCID
WideCharToMultiByte
LoadLibraryW
GetModuleHandleW
GetProcAddress
SetLastError
GetLastError
LocalFree
FormatMessageW
SetEvent
MulDiv
CloseHandle
TerminateThread
WaitForMultipleObjects
InterlockedIncrement
ReleaseSemaphore
InterlockedDecrement
ResetEvent
WaitForSingleObject
CreateThread
CreateSemaphoreW
FlushFileBuffers
lstrcmpiW
GetStringTypeExW
LocalAlloc
GetProfileIntW
GetThreadLocale
SuspendThread
ResumeThread
lstrcmpA
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
GetVersionExA
GlobalSize
GlobalFree
FreeResource
DebugBreak
GetTempFileNameW
GetTempPathW
IsDBCSLeadByteEx
RaiseException
GetVolumeInformationW
GetCurrentThread
GetThreadPriority
SetThreadPriority
VirtualAlloc
VirtualFree
GetSystemInfo
lstrcmpW
GetModuleFileNameA
GetSystemDirectoryA
CreateMutexA
ReleaseMutex
GetModuleHandleA
VirtualQuery
LoadLibraryA
FlushInstructionCache
GetTempPathA
GetTempFileNameA
DeleteFileA
CreatePipe
DuplicateHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateProcessW
WriteFile
TerminateProcess
GetWindowsDirectoryW
CreateNamedPipeW
ConnectNamedPipe
CopyFileW
GetACP
GetDateFormatW
GetTimeFormatW
GlobalAlloc
DeleteFileW
GetFileAttributesExW
CreateDirectoryW
GetVersionExW
GetFullPathNameW
QueryPerformanceFrequency
lstrlenA
QueryPerformanceCounter
ReadProcessMemory
WriteProcessMemory
DeviceIoControl
CreateFileA
IsDebuggerPresent
CreateMutexW
FindNextFileW
GetCurrentDirectoryW
GlobalLock
GlobalUnlock
GetDriveTypeW
GetCurrentThreadId
SetPriorityClass
OpenProcess
FindClose
GetDiskFreeSpaceExW
GetLocaleInfoW
GetLocaleInfoA
FindFirstFileW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetSystemPowerState
GetCurrentProcess
lstrcpynW
MultiByteToWideChar
GetTickCount
Sleep
GetVersion
VirtualProtect
GetModuleFileNameW
GetUserDefaultLangID
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileW
GetFileSize
SetFilePointer
ReadFile
GetCurrentProcessId
FreeLibrary
CreateEventW
HeapDestroy
user32
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
CheckMenuItem
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
SetWindowsHookExW
CallNextHookEx
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetLastActivePopup
GetTopWindow
TrackPopupMenu
GetScrollPos
GetClassInfoExW
GetClassInfoW
RegisterClassW
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
UnhookWindowsHookEx
GetMenuState
GetMenuStringW
GetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetIconInfo
wsprintfW
GetDCEx
SetWindowRgn
AdjustWindowRectEx
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetClassNameW
GetClassLongW
GetScrollInfo
GetWindowRgn
DrawTextExW
InvertRect
CharLowerBuffW
IntersectRect
GetQueueStatus
MsgWaitForMultipleObjects
PeekMessageW
wsprintfA
GetMessageW
CopyIcon
CreateWindowExW
GetMessageTime
DestroyIcon
GetCapture
EqualRect
EmptyClipboard
SetClipboardData
DrawFocusRect
ReleaseCapture
OpenClipboard
SetCapture
SetActiveWindow
ClientToScreen
GetDlgCtrlID
TranslateMessage
CheckDlgButton
SetWindowLongW
GetDlgItemTextW
CallWindowProcW
DefWindowProcW
IsIconic
ShowWindow
CreateAcceleratorTableW
MessageBoxW
DestroyAcceleratorTable
ChangeDisplaySettingsW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
ChangeDisplaySettingsExA
UpdateWindow
GetWindowModuleFileNameW
GetWindowThreadProcessId
EnumDisplayMonitors
SystemParametersInfoW
FindWindowExW
UnregisterClassA
SetWindowContextHelpId
ShowOwnedPopups
SetParent
GetSystemMenu
WaitMessage
GetMonitorInfoW
DestroyMenu
IsMenu
GetKeyState
GetWindowLongW
GetMenuItemRect
PostQuitMessage
FindWindowW
GetMenuBarInfo
GetSystemMetrics
GetCursorPos
ExitWindowsEx
RegisterClipboardFormatW
PostThreadMessageW
GetForegroundWindow
SetForegroundWindow
WindowFromPoint
IsChild
GetDesktopWindow
KillTimer
ReleaseDC
GetDC
SetMenu
GetMenu
LoadMenuW
RemoveMenu
InsertMenuW
GetSubMenu
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
EnableMenuItem
DeleteMenu
PtInRect
RegisterWindowMessageW
RedrawWindow
GetFocus
FillRect
FrameRect
GetSysColorBrush
GetAsyncKeyState
IsClipboardFormatAvailable
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
BringWindowToTop
TranslateAcceleratorW
CharUpperW
EndPaint
CharNextW
CheckRadioButton
IsDlgButtonChecked
IsDialogMessageW
SetWindowTextW
MoveWindow
TabbedTextOutW
DrawTextW
GrayStringW
GetWindowDC
BeginPaint
GetNextDlgGroupItem
LockWindowUpdate
InvalidateRgn
CopyAcceleratorTableW
UnregisterClassW
DispatchMessageW
MapDialogRect
ValidateRect
CloseClipboard
EnableWindow
SendMessageW
GetWindow
GetClientRect
MapWindowPoints
IsWindowVisible
LoadCursorW
IsWindow
PostMessageW
InflateRect
OffsetRect
GetWindowRect
InvalidateRect
GetParent
SetCursor
GetSysColor
LoadImageW
IsRectEmpty
SetRect
UnionRect
GetDlgItem
LoadBitmapW
CreatePopupMenu
AppendMenuW
ScreenToClient
SetTimer
LoadIconW
GetMessagePos
MessageBeep
CopyRect
MonitorFromWindow
SetRectEmpty
ModifyMenuW
gdi32
SetViewportOrgEx
SelectClipRgn
LineTo
MoveToEx
GdiFlush
SetRectRgn
OffsetRgn
FillRgn
CreatePolygonRgn
GetPixel
PatBlt
CopyMetaFileW
GetClipBox
ExtTextOutW
GetMapMode
CreatePatternBrush
DPtoLP
SaveDC
RestoreDC
SetStretchBltMode
ExcludeClipRect
OffsetViewportOrgEx
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
Escape
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetBkColor
GetCharWidthW
StretchDIBits
EnumFontFamiliesExW
GetRgnBox
GetKerningPairsW
CloseFigure
EndPath
GetPath
AbortPath
BeginPath
AddFontResourceW
SetBkMode
SetMapMode
GetTextMetricsW
TranslateCharsetInfo
Rectangle
CreateSolidBrush
CreateFontW
EqualRgn
CombineRgn
CreateFontIndirectW
GetTextColor
GetStockObject
ExtSelectClipRgn
SetPixel
CreateRectRgnIndirect
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
CreatePen
CreateBitmap
GetTextExtentPoint32W
GetCurrentObject
SetBkColor
SetTextColor
TextOutW
CreateRectRgn
GetRegionData
CreateDIBSection
DeleteObject
GetObjectW
StretchBlt
SetDIBColorTable
SelectObject
DeleteDC
IntersectClipRect
CreateCompatibleDC
comdlg32
GetFileTitleW
winspool.drv
ClosePrinter
OpenPrinterW
DocumentPropertiesW
advapi32
RegEnumValueW
RegEnumKeyW
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegFlushKey
RegCreateKeyA
RegCreateKeyW
RegCreateKeyExA
OpenServiceW
RegCreateKeyExW
RegDeleteKeyA
RegDeleteKeyW
ControlService
DeleteService
OpenSCManagerW
CreateServiceW
CloseServiceHandle
StartServiceW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSetValueExW
RegSetValueExA
RegSetValueW
RegSetValueA
RegQueryValueExA
RegQueryValueW
RegQueryValueA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyW
RegOpenKeyA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueW
RegDeleteValueA
RegCloseKey
shell32
DragFinish
SHGetPathFromIDListW
Shell_NotifyIconW
DragQueryFileW
ShellExecuteW
DragAcceptFiles
ExtractIconExW
SHBrowseForFolderW
shlwapi
PathIsUNCW
UrlUnescapeW
PathRemoveFileSpecA
PathAddBackslashA
PathStripToRootW
PathCanonicalizeW
PathRelativePathToW
PathIsDirectoryW
PathAppendW
PathCompactPathW
PathRemoveFileSpecW
PathMakePrettyW
PathCombineW
PathAddExtensionW
PathAddBackslashW
PathFileExistsW
PathStripPathW
PathRenameExtensionW
PathRemoveExtensionW
PathFindExtensionW
PathFindFileNameW
oledlg
OleUIBusyW
ole32
StgCreateDocfileOnILockBytes
CoTaskMemFree
CoCreateInstance
CLSIDFromString
MkParseDisplayName
CreateBindCtx
CreateItemMoniker
GetRunningObjectTable
CoInitialize
CoUninitialize
OleSaveToStream
CoTaskMemAlloc
OleLoadFromStream
OleInitialize
OleUninitialize
StringFromGUID2
CoFreeUnusedLibraries
CoFreeLibrary
StringFromCLSID
CoLoadLibrary
StgOpenStorageOnILockBytes
ReleaseStgMedium
OleDuplicateData
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleGetClipboard
CLSIDFromProgID
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CreateILockBytesOnHGlobal
CoGetClassObject
oleaut32
VariantInit
VariantClear
VariantChangeType
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
SysStringLen
SysAllocStringByteLen
SysStringByteLen
OleCreatePropertyFrame
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocStringLen
VarBstrCmp
OleCreateFontIndirect
VariantCopy
SafeArrayDestroy
SysFreeString
ws2_32
closesocket
recvfrom
setsockopt
bind
socket
inet_addr
listen
htonl
WSAStartup
recv
WSAGetLastError
WSAAsyncSelect
sendto
connect
WSASetLastError
getpeername
getsockname
select
accept
gethostbyname
inet_ntoa
ntohs
WSACleanup
send
htons
winmm
waveOutGetVolume
waveOutSetVolume
mixerSetControlDetails
timeGetDevCaps
timeSetEvent
timeEndPeriod
timeKillEvent
timeBeginPeriod
wininet
InternetOpenUrlW
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
InternetQueryDataAvailable
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
Name
.text
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_TEXT64
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
860KB
Virtual Size
856KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
216KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
472KB
Virtual Size
468KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=126, version=50327,
count=11, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=2, productName=Unmarked objects (old),
count=66, id=125, productName=VS2005 build 50727, version=50727,
count=39, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=8, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=29, version=9254,
count=828, id=1, productName=Unmarked objects,
count=310, id=109, productName=VS2005 build 50727, version=50727,
count=498, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
新云软件.url
- SHA256 df65af1fc1e09f6effbde7e0ef1cb64d6caeef1f62b0e6467821efa032533678
- MD5 4f0017b3b346bd0626f0c3b915e6e734
- SHA1 823bf3ff9e16cd636c9dc0dc690d6a586fcbfe92
- SHA512 0f5eb5024cf6a0323f7998d419995a707c48de917a5899a185369e6acfeb17c09ffa03f7d110adc87b8de20b7d4bf30d50c72479bfb18614d2e21cbe169dc5a6
- MD5 SHA1 SHA512