51eb5d1c5063d18f87674e137e9c0c04d59e67a7627f63928e9176b44049395c_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

51eb5d1c5063d18f87674e137e9c0c04d59e67a7627f63928e9176b44049395c_NeikiAnalytics.exe
Size

501KB
MD5

42b75554414ae98a2f22acf9411914d0
SHA1

8c8a8a2bfef31879392a68865896de11a091f9aa
SHA256

51eb5d1c5063d18f87674e137e9c0c04d59e67a7627f63928e9176b44049395c
SHA512

2504dae7a4223e1a720a4eb117961f680c950d05ef47f1a70885b29075069b1caed1aed3b2ede8fbb0f7f2204d43aae25eda3475df27e10f9d3606daf4d53158
SSDEEP

12288:NfbbgPK5ku2hYxBfh0EsUDwbJGTZbIemufLiI3cdRw5B0Q9I6S4yR/b7G:NbAKVhfcI5B0EmNR/2

Score

1^/10

Malware Config

Signatures

Files

51eb5d1c5063d18f87674e137e9c0c04d59e67a7627f63928e9176b44049395c_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

16c4fd92b1dfd549ce318d6d02300a1e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6f:dd:a6:09:f2:17:5f:71:5f:1c:3c:cc:dd:d3:0c:a3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

02-06-2008 00:00

Not After

05-07-2011 23:59

Subject

CN=Nuance Communications\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Nuance Communications\, Inc.,ST=Massachusetts,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2c:cb:3b:b5:2b:1c:ee:df:42:96:d4:7a:c1:7b:aa:ce:dd:a9:28:13
Signer

Actual PE Digest

2c:cb:3b:b5:2b:1c:ee:df:42:96:d4:7a:c1:7b:aa:ce:dd:a9:28:13

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\dailybuild\CSDKWin16\Release\bin.rel\PDFCnv.pdb

Imports

defaults

?GetDefaultValue@@YA_NPBD0_NPAX@Z
?SetDefaultValue@@YA_NPBD0_NPAX@Z
?GetDefaultValue@@YAHPBD0HPAX@Z
?SetDefaultValue@@YA_NPBD0HPAX@Z
?SetDefaultLocation@@YA_NPBDW4ELocation@@PAX_N@Z
?GetDefaultValue@@YAPBDPBD00PAX@Z
?FreeDefaultLocationId@@YAXPAX@Z
?CreateDefaultLocationId@@YAPAXXZ
?DeleteDefaultKey@@YA_NPBD0PAX@Z

spdflib

?AddText@CPDFGen@SPDFLIB@@QAEXPB_WHW4TPO_FormatType@2@@Z
?EndCurrentMC@CPDFGen@SPDFLIB@@QAEXXZ
??0CPDF_Rectangle@SPDFLIB@@QAE@NNNN@Z
??0CPDF_Position@SPDFLIB@@QAE@NN@Z
?AddLine@CPDFGen@SPDFLIB@@QAEXABVCPDF_Position@2@0UTPDF_LINEATTR@2@W4TPDFDrawmode@2@@Z
??1CPDF_Position@SPDFLIB@@UAE@XZ
??0TFontHandle@SPDFLIB@@QAE@ABV01@@Z
?GetFontPtr@CFontManager@SPDFLIB@@SAPAVCPDFFont@2@VTFontHandle@2@@Z
?GetPDFCode@CPDFFont@SPDFLIB@@QAE_NAB_WAA_W@Z
??4TFontHandle@SPDFLIB@@QAEAAV01@ABV01@@Z
??0CP_String@SPDFLIB@@QAE@PA_WHW4TPO_FormatType@1@W4TPO_StringType@1@@Z
?AddText@CPDFGen@SPDFLIB@@QAEXPB_WNABVCP_Name@2@ABVCPDF_Position@2@NNNIHW4TPO_FormatType@2@@Z
??0CPDF_Rectangle@SPDFLIB@@QAE@AAUTPDF_REALRECT@1@@Z
?AddMRCImages@SPDFLIB@@YA_NPBDQAXABVCPDF_Rectangle@1@PAVCPDFGen@1@QAUtagRECT@@@Z
?AddImage@CPDFGen@SPDFLIB@@QAE?AU_TObj_ID@2@AAVCP_Name@2@QAXABVCPDF_Rectangle@2@U32@W4TImageType@2@PBUTImageDestinationFormat@2@@Z
?AddImage@CPDFGen@SPDFLIB@@QAE?AU_TObj_ID@2@AAVCP_Name@2@UTPDF_IMAGE@2@ABVCPDF_Rectangle@2@U32@W4TImageType@2@PBUTImageDestinationFormat@2@@Z
?nullId@SPDFLIB@@3U_TObj_ID@1@B
?AddImageSource@CPDFGen@SPDFLIB@@QAE?AU_TObj_ID@2@AAVCP_Name@2@UTPDF_IMAGE@2@U32@W4TImageType@2@PBUTImageDestinationFormat@2@@Z
??0CPDF_Color@SPDFLIB@@QAE@I@Z
??RCPDF_Color@SPDFLIB@@QBEKXZ
??0CPDFGen_ContentStream@SPDFLIB@@QAE@AAVACompression@1@PAVCPDFGen@1@@Z
??4CPOperator@SPDFLIB@@UAEAAV01@ABV01@@Z
?CreateClone@CPOperator@SPDFLIB@@UBEPAV12@XZ
?Write@CPOperator@SPDFLIB@@UAEHAAVCWriteAbleStream@2@@Z
??0CPOperator@SPDFLIB@@QAE@XZ
?AddOperator@CPOperator@SPDFLIB@@QAAXPBDZZ
??1CPOperator@SPDFLIB@@UAE@XZ
??0CP_Name@SPDFLIB@@QAE@PBD@Z
?AddObject@CP_Array@SPDFLIB@@QAEXABVCP_Obj@2@@Z
??1CP_Array@SPDFLIB@@UAE@XZ
??1TFontHandle@SPDFLIB@@UAE@XZ
??0TFontHandle@SPDFLIB@@QAE@XZ
SetLogErrorFunction
??1CP_String@SPDFLIB@@UAE@XZ
??1CP_Name@SPDFLIB@@UAE@XZ
??0CP_Name@SPDFLIB@@QAE@XZ
??1CPDFGen_ContentStream@SPDFLIB@@UAE@XZ
??1CPCDS_Resource@SPDFLIB@@UAE@XZ
?eq@CP_Array@SPDFLIB@@UAE_NPBVCP_Obj@2@@Z
?CreateClone@CP_Array@SPDFLIB@@UBEPAVCP_Obj@2@XZ
?Write@CP_Array@SPDFLIB@@UAEHAAVCWriteAbleStream@2@@Z
SetLogLogFunction
InitLib
?TrYCoordPDFToTwips@SPDFLIB@@YANNN@Z
?TrXCoordPDFToTwips@SPDFLIB@@YANNN@Z
??ZCPDF_Position@SPDFLIB@@QAEAAV01@V01@@Z
??0CPDF_Position@SPDFLIB@@QAE@ABV01@@Z
?GetCurrentPageSize@CPDFGen@SPDFLIB@@QAE?AUTPDF_PAGESIZE@2@XZ
?ComputeFitAbleLength@SPDFLIB@@YAHPB_WHNNNNVTFontHandle@1@@Z
?SetTextRise@CPDFGen@SPDFLIB@@QAEXN@Z
?AddText@CPDFGen@SPDFLIB@@QAEXPB_WNABVCP_Name@2@NNIHW4TPO_FormatType@2@@Z
?AddDocumentMC@CPDFGen@SPDFLIB@@QAEXW4TPDF_LANGUAGE@2@@Z
?AddDivMC@CPDFGen@SPDFLIB@@QAEXVCPDF_Rectangle@2@NNNN@Z
?AddSectionMC@CPDFGen@SPDFLIB@@QAEXXZ
?AddTableMC@CPDFGen@SPDFLIB@@QAEXNNNNNN@Z
?AddTableRowMC@CPDFGen@SPDFLIB@@QAEXXZ
?AddTableCellMC@CPDFGen@SPDFLIB@@QAEXNNW4TPDF_ALIGNMENT@2@@Z
?AddPictureMC@CPDFGen@SPDFLIB@@QAEXVCPDF_Rectangle@2@NNNNW4TPDF_ALIGNMENT@2@@Z
??1CP_Number@SPDFLIB@@UAE@XZ
??0CP_Number@SPDFLIB@@QAE@N@Z
??1CP_Dictionary@SPDFLIB@@UAE@XZ
?AddPair@CP_Dictionary@SPDFLIB@@QAEXABVCP_Name@2@ABVCP_Obj@2@@Z
??0CP_Dictionary@SPDFLIB@@QAE@XZ
?Write@CP_Dictionary@SPDFLIB@@UAEHAAVCWriteAbleStream@2@@Z
?CreateClone@CP_Dictionary@SPDFLIB@@UBEPAVCP_Obj@2@XZ
?eq@CP_Dictionary@SPDFLIB@@UAE_NPBVCP_Obj@2@@Z
?AddURI@CPDFGen@SPDFLIB@@QAE?AU_TObj_ID@2@ABVCP_String@2@ABVCPDF_Rectangle@2@AAVCPCDS_Number3@2@_N@Z
?CP_Number0@SPDFLIB@@3VCP_Number@1@A
?IsOpened@CPDFGen@SPDFLIB@@QAE?AW4TPErrorID@2@XZ
??0CPDFGen@SPDFLIB@@QAE@PBDAAVAProperties@1@@Z
?EndPDFGen@CPDFGen@SPDFLIB@@QAEX_N@Z
??1CPDFGen@SPDFLIB@@UAE@XZ
?SetFont@CPDFGen@SPDFLIB@@QAEXABVCP_Name@2@N@Z
??0CPDF_Position@SPDFLIB@@QAE@ABUTPDF_POSITION@1@@Z
?AddClipRect@CPDFGen@SPDFLIB@@QAEXABVCPDF_Rectangle@2@@Z
?SaveState@CPDFGen@SPDFLIB@@QAEXXZ
?RestoreState@CPDFGen@SPDFLIB@@QAEXXZ
??8TFontHandle@SPDFLIB@@QBE_NABV01@@Z
??8SPDFLIB@@YA_NABUTPDF_CHARACTERFORMAT@0@0@Z
?AddOutline@CPDFGen@SPDFLIB@@QAE_NAAVCP_String@2@AAU_TObj_ID@2@VCPDF_Position@2@@Z
??1CPDS_StructElem@SPDFLIB@@UAE@XZ
?AddGroupingMC@CPDFGen@SPDFLIB@@QAEXABVCPDS_StructElem@2@@Z
?AddAttributes@CPDS_StructElem@SPDFLIB@@QAEXABVCPDS_Attribute@2@@Z
?AddSubtype@CPDS_StructElem@SPDFLIB@@QAEXABVCP_Name@2@@Z
??0CPDS_StructElem@SPDFLIB@@QAE@XZ
?GetCurrentPageNumber@CPDFGen@SPDFLIB@@QAEHXZ
?AddDrawingOperators@CPDFGen@SPDFLIB@@QAEXU_TObj_ID@2@ABVCP_Name@2@ABVCPDF_Rectangle@2@@Z
??_DCPDF_AdvancedGeneratorTools@SPDFLIB@@QAEXXZ
??1CPDF_GeneratorTools@SPDFLIB@@UAE@XZ
??1CPDF_AdvancedGeneratorTools@SPDFLIB@@UAE@XZ
?AddJump@CPDFGen@SPDFLIB@@QAEXABVCP_String@2@ABVCP_Number@2@ABVCPDF_Rectangle@2@AAVCPCDS_Number3@2@@Z
?NewPage@CPDFGen@SPDFLIB@@QAE?AU_TObj_ID@2@UTPDF_PAGESIZE@2@@Z
?NewPage@CPDF_GeneratorTools@SPDFLIB@@UAEXXZ
??0CPDF_AdvancedGeneratorTools@SPDFLIB@@QAE@AAVAProperties@1@@Z
??1CPDS_OBJR@SPDFLIB@@UAE@XZ
?AddKids@CPDS_StructElem@SPDFLIB@@QAEXABVCP_Array@2@@Z
?AddObject@CPDS_OBJR@SPDFLIB@@QAEXABVCP_Reference@2@@Z
??0CPDS_OBJR@SPDFLIB@@QAE@XZ
?AddLanguage@CPDS_StructElem@SPDFLIB@@QAEXABVCP_String@2@@Z
?ConvertMacLanguageIdToXMLName@SPDFLIB@@YAPBDW4TPDF_LANGUAGE@1@@Z
?ContinueNonGoupingElement@CPDFGen@SPDFLIB@@QAEHPAVCPDS_StructElem@2@PBD_N@Z
?SetContinueAbleNonGoupingElement@CPDFGen@SPDFLIB@@QAEHXZ
?GetUri@CLetter@SPDFLIB@@SA?AVCP_String@2@V?$_Iterator@$00@?$list@VCP_String@SPDFLIB@@V?$allocator@VCP_String@SPDFLIB@@@std@@@std@@@Z
??1CLetter@SPDFLIB@@UAE@XZ
?GetUriIndex@CLetter@SPDFLIB@@QBE?BV?$_Iterator@$00@?$list@VCP_String@SPDFLIB@@V?$allocator@VCP_String@SPDFLIB@@@std@@@std@@XZ
??0CLetter@SPDFLIB@@QAE@XZ
?IsPunct@CPDFFont@SPDFLIB@@QAE_N_W@Z
?SetCharFormat@CLetter@SPDFLIB@@QAEXABUTPDF_CHARACTERFORMAT@2@@Z
?SetUri@CLetter@SPDFLIB@@QAEXABVCP_String@2@@Z
??0CPDF_GeneratorTools@SPDFLIB@@QAE@XZ
?Init@CPDF_AdvancedGeneratorTools@SPDFLIB@@MAEXAAVAProperties@2@@Z
?FontChooser@CPDF_AdvancedGeneratorTools@SPDFLIB@@UAE?AVTFontHandle@2@ABVCFONTATTR@2@ABV?$CStore@_W@2@V32@_N@Z
?FontChooser@CPDF_AdvancedGeneratorTools@SPDFLIB@@UAE?AVTFontHandle@2@ABVCLetter@2@ABV?$CStore@_W@2@V32@_N@Z
?SetStrategy@CPDF_AdvancedGeneratorTools@SPDFLIB@@UAEXH@Z
?Init@CPDF_GeneratorTools@SPDFLIB@@UAEXXZ
?GetFontAttr@CPDF_GeneratorTools@SPDFLIB@@UAE?AVCFONTATTR@2@PBDH@Z
?FontChooser@CPDF_GeneratorTools@SPDFLIB@@UAE?AVTFontHandle@2@ABVCFONTATTR@2@ABV?$CStore@_W@2@V32@@Z
?FontChooser@CPDF_GeneratorTools@SPDFLIB@@UAE?AVTFontHandle@2@ABVCLetter@2@ABV?$CStore@_W@2@V32@@Z
?UseFont@CPDF_AdvancedGeneratorTools@SPDFLIB@@UAEPBVCP_Name@2@VTFontHandle@2@PAVCPDFGen@2@@Z
?PutTextTwips@CPDF_AdvancedGeneratorTools@SPDFLIB@@UAEXPBVCLetter@2@0PB_WHNNHHHHHVTFontHandle@2@PAVCPDFGen@2@W4TPDF_TEXTDIRECTION@2@HPAUTImageDestinationFormat@2@@Z
?GetFontAttr@CPDF_AdvancedGeneratorTools@SPDFLIB@@UAE?AVCFONTATTR@2@VTFontHandle@2@@Z
?NeedClone@CPDF_AdvancedGeneratorTools@SPDFLIB@@MAEXPAVCPDFFont@2@@Z
?GetFontObjId@CPDF_AdvancedGeneratorTools@SPDFLIB@@UAE?AU_TObj_ID@2@VTFontHandle@2@@Z
?EndFile@CPDF_AdvancedGeneratorTools@SPDFLIB@@UAE_NPAVCPDFGen@2@@Z
AddDefaultLanguageFonts
GetPDFLIB_SID
?GetRejectChar@SPDFLIB@@YAEXZ
?SetFont@CLetter@SPDFLIB@@QAEXABUTPDF_FONTATTR@2@@Z
?AddRotateBackCTM@SPDFLIB@@YA_NPAVCPDFGen@1@QAXUTPDF_IMAGE@1@@Z
?SetDecimalDigits@CP_Number@SPDFLIB@@SAXH@Z
?GetDecimalDigits@CP_Number@SPDFLIB@@SAHXZ
?GetCurrentCropBox@CPDFGen@SPDFLIB@@QAE?AUTPDF_REALRECT@2@XZ
?GetCurrentRotation@CPDFGen@SPDFLIB@@QAEHXZ
??0CTransformationMatrix@SPDFLIB@@QAE@XZ
?AddThumbnail@CPDFGen@SPDFLIB@@QAEXU_TObj_ID@2@@Z
?ClearPuffer@CLetter@SPDFLIB@@SAXXZ
?GetUnicodeCode@CPDFFont@SPDFLIB@@QAE_W_W@Z
?GetTextAttrs@SPDFLIB@@YAHPBVCLetter@1@0PB_WPANPAH3333PAW4TPDF_TEXTDIRECTION@1@_W@Z
?GetPdfFont@CLetter@SPDFLIB@@QBE?AVTFontHandle@2@XZ
?GetCharFormat@CLetter@SPDFLIB@@QBE?AUTPDF_CHARACTERFORMAT@2@XZ
?RepairLetterPositionsTwips@SPDFLIB@@YAXPAVCLetter@1@HHUtagRECT@@JUTPDF_LINESPACING@1@W4TPDF_ALIGNMENT@1@PAVCPDFGen@1@@Z
?GetCharFormatIndex@CLetter@SPDFLIB@@QBE?BV?$_Iterator@$00@?$list@UTPDF_CHARACTERFORMAT@SPDFLIB@@V?$allocator@UTPDF_CHARACTERFORMAT@SPDFLIB@@@std@@@std@@XZ
?CreateError@CPDFError@SPDFLIB@@SAXW4TPErrorID@2@PAD1H@Z
?AddNewContentStream@CPDFGen@SPDFLIB@@QAEX_N@Z
?SetCurrentPage@CPDFGen@SPDFLIB@@QAE?AU_TObj_ID@2@H@Z
?GetFontType@CPDFFont@SPDFLIB@@QAE?AW4TFontType@2@XZ
?SetPdfFont@CLetter@SPDFLIB@@QAEXVTFontHandle@2@@Z
??9TFontHandle@SPDFLIB@@QBE_NABV01@@Z
?HasUri@CLetter@SPDFLIB@@QBE_NXZ
?AddParaMC@CPDFGen@SPDFLIB@@QAEXNNNNW4TPDF_ALIGNMENT@2@W4TPDF_LANGUAGE@2@@Z
?AddRadioButtons@CPDFGen@SPDFLIB@@QAE?AU_TObj_ID@2@U32@AAVCP_String@2@ABVCP_Name@2@ABVCP_Array@2@_N@Z
??0CP_String@SPDFLIB@@QAE@PADHW4TPO_FormatType@1@@Z
?GetPdfStringLength@CP_String@SPDFLIB@@QBEIXZ
?GetPdfStringValue@CP_String@SPDFLIB@@QBEPB_WXZ
??1CP_Reference@SPDFLIB@@UAE@XZ
??0CP_Reference@SPDFLIB@@QAE@ABU_TObj_ID@1@@Z
?GetSize@CP_Array@SPDFLIB@@QAE?BIXZ
??0CP_String@SPDFLIB@@QAE@XZ
?AddTextField@CPDFGen@SPDFLIB@@QAE?AU_TObj_ID@2@AAVCP_String@2@ABVCPDF_Rectangle@2@PB_WIIABUTPDF_BORDER@2@HNUTPDF_LINEATTR@2@H_N_NPAUTPDF_FormFontInfo@2@@Z
??4CP_Name@SPDFLIB@@QAEAAV01@ABV01@@Z
?GetAnsiClone@CPDF_AdvancedGeneratorTools@SPDFLIB@@QAE?AVTFontHandle@2@V32@@Z
?AddEllipse@CPDFGen_ContentStream@SPDFLIB@@QAEXABVCPDF_Rectangle@2@UTPDF_LINEATTR@2@I@Z
?AddTextOp@CPDFGen_ContentStream@SPDFLIB@@QAEXABVCPOperator@2@_N@Z
?SetTextColor@CPDFGen_ContentStream@SPDFLIB@@QAEXABVCPDF_Color@2@@Z
?SetFont@CPDFGen_ContentStream@SPDFLIB@@QAEXABVCP_Name@2@N@Z
?AddFont@CPCDS_Resource@SPDFLIB@@QAEXABVCP_Name@2@ABVCP_Reference@2@@Z
?AddCheckBox@CPDFGen@SPDFLIB@@QAE?AU_TObj_ID@2@AAVCP_String@2@ABVCPDF_Rectangle@2@_NIIABUTPDF_BORDER@2@PBVTPDF_CheckBoxLayout@2@2U32@@Z
?AddBorder@CPDFGen_ContentStream@SPDFLIB@@QAEXABVCPDF_Rectangle@2@ABUTPDF_BORDER@2@@Z
?AddLine@CPDFGen_ContentStream@SPDFLIB@@QAEXABVCPDF_Position@2@0UTPDF_LINEATTR@2@W4TPDFDrawmode@2@@Z
??0CPDF_Position@SPDFLIB@@QAE@XZ
?AddProcSet@CPCDS_Resource@SPDFLIB@@QAEXABVCPCDS_ProcSet@2@@Z
??4CP_String@SPDFLIB@@QAEAAV01@ABV01@@Z
??8CPDF_Rectangle@SPDFLIB@@QAE_NV01@@Z
??0CP_Name@SPDFLIB@@QAE@ABV01@@Z
??0CPDF_Rectangle@SPDFLIB@@QAE@ABV01@@Z
?ComputePdfLength@SPDFLIB@@YANPB_WHNNNVTFontHandle@1@@Z
??0CPCDS_Resource@SPDFLIB@@QAE@XZ
??0CP_Array@SPDFLIB@@QAE@XZ
??0CPDF_Rectangle@SPDFLIB@@QAE@XZ
?TrYCoordTwipsToPDF@SPDFLIB@@YANNN@Z
?AddBox@CPDFGen@SPDFLIB@@QAEXABVCPDF_Rectangle@2@ABUTPDF_ROUNDCORNER@2@II@Z
?AddBorder@CPDFGen@SPDFLIB@@QAEXABVCPDF_Rectangle@2@ABUTPDF_BORDER@2@@Z
??1CPDF_Rectangle@SPDFLIB@@UAE@XZ
?TrXCoordTwipsToPDF@SPDFLIB@@YANNN@Z
??1CPDF_Color@SPDFLIB@@UAE@XZ

recdiag

?GetRelativePath@CFMUtil@@SA?AW4_FM_ERROR@@PB_W0PA_WH@Z
?u8@Utf8Str@@QAEPBDXZ
??0Utf8Str@@QAE@PB_W@Z
?strcpy_r@@YAHPADIPBD@Z
kRecRemoveW
kRecAccessU8
??1Utf8toUtf16@@QAE@XZ
?u16@Utf8toUtf16@@QAEPB_WXZ
?wcscat_r@@YAHPA_WIPB_W@Z
??0CSIDSwitch@@QAE@H@Z
??1CSIDSwitch@@QAE@XZ
??1Utf8Str@@QAE@XZ
D_RmAlloc
D_RmFree
?wcscpy_r@@YAHPA_WIPB_W@Z
??0Utf8toUtf16@@QAE@PBD@Z

rendering

?FindFeat@CConvExtProp@@QBEHI@Z
?Save@CConvExtText@@UBE_NPBDPAX@Z
?Load@CConvExtText@@UAEXPBDPAX@Z
??0CConvExtProp@@QAE@IPBD@Z
??1CConvExtProp@@UAE@XZ
?GetFeat@CConvExtProp@@QAEPAVCConvExtFeature@@H@Z
?AddFeatCopy@CConvExtProp@@IAEXPAVCConvExtFeature@@@Z

kernelapi

?ImgGetImg@@YG?AW4tagRECERR@@PAUtagRECPAGESTRUCT@@W4tagIMAGEINDEX@@PAPAVCImage@@@Z
?ImgAskRotation@@YG?AW4tagRECERR@@PAUtagRECPAGESTRUCT@@PAW4tagIMG_ROTATE@@@Z
?ImgAskSlope@@YG?AW4tagRECERR@@PAUtagRECPAGESTRUCT@@PAH@Z
_ChrUIsDigit@4
?GetImageIndex@CImage@@QBE?AW4tagIMAGEINDEX@@XZ
?ImgGetArea@@YG?AW4tagRECERR@@PAVCImage@@PBUtagRECT@@PBUtagSIZE@@PAUtagIMG_INFO@@PAPAE@Z
?IsPalette@CImage@@QBEHXZ
?GetPaletteAddress@CImage@@QBEQAEXZ
?ImgFreeArea@@YG?AW4tagRECERR@@PAE@Z
?GetImage@CPage@@QBEPAVCImage@@W4tagIMAGEINDEX@@@Z
?kRecGetConfiguration@@YGHXZ
_ChrUIsAlNum@4

lecsomgr

L_LGGetType
L_LGInitLGrouplikeIterator
L_LGNextLGrouplikeId
L_LGCloseLGroup
L_LPGetText
?L_Bullets2Letters@@YA?AW4tagRECERR@@PBU_LS_BULLETS@@PAPAU_LS_LETTER@@PAHQBH@Z
L_DDGetNumberOfPage
L_DDNextPage
L_DDInitPageIterator
L_DDCloseDLogicalDocument
L_DDOpenDLogicalDocument
L_LTLCloseLTextLine
L_LRLGetPosition
L_LRLGetLineAttr
L_LRLCloseLRuleLine
L_LRLOpenLRuleLine
L_LCRCloseLCrossRef
L_LCROpenLCrossRef
L_LCGetTextDirection
L_LCGetNumberOfLParalike
L_LCNextLParalikeId
L_LCInitLParalikeIterator
L_LCGetBackgroundColor
L_LCGetColRange
L_LCGetRowRange
L_LCCloseLCell
L_LCOpenLCell
L_LTGetSpaceAfter
L_LTGetSpaceBefore
L_LTGetLeftIndent
L_LTGetRightIndent
L_LTGetShape
L_LTNextLCell
L_LTInitLCellIterator
L_LTGetLCellInGrid
L_LTGetBorderStyle
L_LTGetCols
L_LTGetRows
L_LTCloseLTable
L_LTOpenLTable
L_LPIGetFillerColor
L_LPIGetSpaceAfter
L_LPIGetSpaceBefore
L_LPIGetLeftIndent
L_LPIGetRightIndent
L_LPIGetAlignment
L_LPIGetShape
L_LPICloseLPicture
L_LPIOpenLPicture
L_LPGetShape
L_LPGetDropCap
L_LPNextPWordInfoId
L_LPInitPWordInfoIterator
L_LPGetBullets
L_LPGetLineSpacing
L_LPGetSpaceAfter
L_LPGetSpaceBefore
L_LPGetFirstLineIndent
L_LPGetLeftIndent
L_LPGetRightIndent
L_LPGetAlignment
L_LPGetTabs
L_LPGetTextRunLanguage
L_LPGetTextRunDFontAttr
L_LAGetTextDirection
L_LAGetRoundCorner
L_LAGetBorder
L_LAGetFlags
L_LAGetBackgroundColor
L_LANextLParlikeId
L_LAInitLParlikeIterator
L_LACloseLArea
L_LAOpenLArea
L_LCOLNextLAreaId
L_LCOLInitLAreaIterator
L_LCOLCloseLColumn
L_LCOLOpenLColumn
L_LMCOLGetTextDirection
L_LMCOLNextLArealikeId
L_LMCOLInitLArealikeIterator
L_LMCOLCloseLMultiColumn
L_LMCOLOpenLMultiColumn
L_LFRGetTextDirection
L_LGOpenLGroup
L_LFRNextLArealikeId
L_LFRInitLArealikeIterator
L_LFRGetBackgroundColor
L_LFRGetBorder
L_LFRCloseLFramed
L_LFROpenLFramed
L_LPGNextExtraLFramedId
L_LPGInitExtraLFramedIterator
L_LPGCloseLLogicalPage
L_LPGOpenLLogicalPage
L_PPGGetMargin
L_PPGGetLetters
L_PPGCloseLPhysicalPage
L_PPGOpenLPhysicalPage
L_PGGetTextDirection
L_PGGetBackgroundColor
?L_Bullets2Str@@YA?AW4tagRECERR@@PBU_LS_BULLETS@@PAPB_WQBH@Z
L_DDGetLanguages
L_SGetOutputDocument
L_GetDefCharFormat
L_PIGetHImg
L_PIReleaseHImg
L_PPGInitPZoneIterator
L_PPGNextPZoneId
L_PZGetType
L_PZGetShape
L_PZGetLObjId
L_LAGetShape
L_LFRGetShape
L_OTGetSpaceAfter
L_OTGetSpaceBefore
L_OTGetRightIndent
L_OTGetAlignment
L_OTGetCell
L_OTGetBorderStyle
L_OTGetLeftIndent
L_OTGetCols
L_OTGetRows
L_OSGetBackgroundColor
L_OSGetOutputFileName
L_OSGetMargins
L_OSGetPageSize
L_OSGetFooter
L_OSGetHdr
L_OSGetFooterPosition
L_OSGetHdrPosition
L_OSGetStartProperty
L_OSGetNumberOfBoxRuleLine
L_OSGetNumberOfParPicTable
L_ORLGetLength
L_ORLGetPosition
L_ORLGetDirection
L_ORLGetLineAttr
L_OPIGetFillerColor
L_OPIGetSpaceAfter
L_OPIGetSpaceBefore
L_OPIGetLeftIndent
L_OPIGetRightIndent
L_OPIGetAlignment
L_OPIGetSize
L_OPIGetDpi
L_OPIGetImage
L_OPGetNumberOfRelative
L_OPGetDropCap
L_OPGetBullets
L_OPGetParFormat
L_OPGetTextRunLanguage
L_ODGetDefaultTab
L_ODGetNumberOfSection
L_OCGetAlignment
L_OCGetRightLeader
L_OCGetLeftLeader
L_OCGetVertAlignment
L_OCGetInnerMargins
L_OCGetBackgroundColor
L_OCGetColRange
L_OCGetRowRange
L_OBGetRoundCorner
L_OBGetSize
L_OBGetPosition
L_LCBGetBackgroundColor
L_OBGetBorder
L_OBGetInternalMargins
L_LFCGetType
L_LARTCloseLArticle
L_LARTNextLGrouplikeId
L_LARTInitLGrouplikeIterator
L_LARTOpenLArticle
L_LPGNextArticleId
L_LPGInitArticleIterator
L_PWIGetFlags
L_PGGetLanguages
L_PGSetPageState
L_PGGetPageState
L_LFRGetRoundCorner
L_OBGetBackgroundColor
?L_WriteStrLog@@YA?AW4tagRECERR@@PBD@Z
?L_EndLog@@YA?AW4tagRECERR@@XZ
?L_WriteIntLog@@YA?AW4tagRECERR@@H@Z
?L_NewLog@@YA?AW4tagRECERR@@PBD0HW4_LE_LOGINDENT@@@Z
L_SGetLogicalDocument
L_OBOpenBox
L_OBCloseBox
L_OBInitParPicTableIterator
L_OBNextParPicTableId
L_OCOpenCell
L_OCCloseCell
L_OCInitParPicIterator
L_OCNextParPicId
L_OHFOpenHdrFooter
L_OHFCloseHdrFooter
L_OHFInitParPicIterator
L_OHFNextParPicId
L_ODOpenOutputDoc
L_ODCloseOutputDoc
L_ODInitSectionIterator
L_ODNextSectionId
L_OPOpenPar
L_OPClosePar
L_OPInitRelativeIterator
L_OPNextRelativeId
L_OPIOpenPicture
L_OPIClosePicture
L_ORLOpenRuleLine
L_ORLCloseRuleLine
L_OSOpenSection
L_OSCloseSection
L_OSInitParPicTableIterator
L_OSNextParPicTableId
L_OTOpenTable
L_OTCloseTable
L_OTInitCellIterator
L_OTNextCell
L_OTInitRelativeIterator
L_OTNextRelativeId
L_OBGetWrapping
L_GetObjType
?L_NewError@@YA?AW4tagRECERR@@PBD0H0W41@U_LS_OBJID@@W4_LE_LOGINDENT@@@Z
L_GetErrorName
L_PGClosePage
L_LPGNextArealikeId
L_LPGInitArealikeIterator
L_PGGetLogicalPage
L_PGOpenPage
L_DFGetAttr
L_LFGetAttr
L_PIGetRectImgArea
L_PIFreeImgArea
L_LPIGetImgArea
L_LPIFreeImgArea
L_OPIGetImgArea
L_OPIFreeImgArea
L_LFGCloseLFormGroup
L_LPCloseLPara
L_LFGGetRange
L_LILGetRange
L_LCTGetRange
L_LCBGetRange
L_LTLGetRange
L_LTLGetBoundingRect
L_LTLGetRoundCorner
L_LTLGetPattern
L_LTLGetShadow
L_LTLGetBorder
L_LTLGetBackgroundColor
L_LFGNextTextElement
L_LFGInitTextElementIterator
L_LFGOpenLFormGroup
L_LPGetTextRegion
L_LPNextTextElement
L_LPInitTextElementIterator
L_LPOpenLPara
L_OPNextTextlikeId
L_OPInitTextlikeIterator
L_LPGetTextRunText
L_LPGetTextRunLFontId
L_LPGetTextRunFormat
L_LPGetTextRunMakeUpBits
L_OPGetTextRunText
L_OPGetTextRunFontId
L_OPGetTextRunFormat
L_OPGetTextRunMakeUpBits
L_LPNextTextRun
L_LPInitTextRunIterator
L_OPNextTextRun
L_OPInitTextRunIterator
L_LPIsFormInPara
L_LPSetEndOfTextRunBeforeMakeUp
L_LPSetEndOfTextRun
L_LPNextLFieldCode
L_LPInitLFieldCodeIterator
L_OPIsFormInPara
L_OPSetEndOfTextRunBeforeMakeUp
L_OPSetEndOfTextRun
L_OPNextFieldCode
L_OPInitFieldCodeIterator
L_LPNextLCrossRefId
L_LPInitLCrossRefIterator
L_OPNextCrossRefId
L_OPInitCrossRefIterator
L_LOGetParentId
L_LCTGetPrev
L_LCBGetPrev
L_LCTGetNext
L_LCBGetNext
L_LFGRGetBoundingRect
L_LFGRGetRoundCorner
L_LFGRGetPattern
L_LFGRGetShadow
L_LFGRGetBorder
L_LFGRGetBackgroundColor
L_LFGRGetFieldName
L_LILGetBoundingRect
L_LILGetRoundCorner
L_LILGetPattern
L_LILGetShadow
L_LILGetBorder
L_LILGetBackgroundColor
L_LILGetFieldName
L_LCTGetBoundingRect
L_LCTGetRoundCorner
L_LCTGetPattern
L_LCTGetShadow
L_LCTGetBorder
L_LCTGetBackgroundColor
L_LCTGetFieldName
L_LCBGetBoundingRect
L_LCBGetRoundCorner
L_LCBGetPattern
L_LCBGetShadow
L_LCBGetBorder
L_LCRGetURL
L_LCBGetFieldName
L_LFGGetNumberOfTextElement
L_LFGGetFormType
L_LFGGetFieldName
L_LFGGetBoundingRect
L_LFGGetRoundCorner
L_LFGGetPattern
L_LFGGetShadow
L_LFGGetBorder
L_LFGGetBackgroundColor
L_PGGetPhysicalPage
L_PPGGetPageSize
L_PPGInitPImageIterator
L_PPGNextPImageId
L_PPGGetNumberOfPImage
L_PIOpenImage
L_PICloseImage
L_PIGetImgInfo

kernel32

InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
UnhandledExceptionFilter
DisableThreadLibraryCalls
GetModuleFileNameW
LoadLibraryExA
FreeLibrary
GetProcAddress
WideCharToMultiByte
GetSystemTimeAsFileTime

user32

ReleaseDC
GetDC

gdi32

CreateFontA
SelectObject
GetTextExtentPoint32W
DeleteObject

msvcp80

??0?$allocator@_W@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEPADXZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?rbegin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?width@ios_base@std@@QAEHH@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?eq_int_type@?$char_traits@_W@std@@SA_NABG0@Z
?eof@?$char_traits@_W@std@@SAGXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBEHXZ
?length@?$char_traits@_W@std@@SAIPB_W@Z
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
??_D?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?close@?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V32@@Z
?rbegin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$allocator@_W@std@@QAE@ABV01@@Z
?construct@?$allocator@_W@std@@QAEXPA_WAB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ
?max_size@?$allocator@_W@std@@QBEIXZ
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_ofstream@_WU?$char_traits@_W@std@@@std@@QAE@PBDHH@Z

msvcr80

_purecall
__CxxFrameHandler3
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memset
strstr
_stricmp
_snprintf
??_V@YAXPAX@Z
wcsrchr
sprintf_s
fflush
fprintf
fclose
fopen_s
__iob_func
wcschr
wcsstr
swprintf_s
wcsspn
_CIsqrt
memmove_s
memcpy
ceil
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
_except_handler4_common

Exports

Exports

CloseConv
CreateConv
CreateConvExt
GetInterfaceVersion
InitConv
QueryConvs
QueryConvsExt
R2C_BuildProperties
R2C_CheckAfter
R2C_CheckBefore
R2C_WriteToFile
SetProgressCallBack
SetProperties
SetPropertiesExt
WriteToFile

Sections

.text
Size: 364KB - Virtual size: 362KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

16c4fd92b1dfd549ce318d6d02300a1e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

6f:dd:a6:09:f2:17:5f:71:5f:1c:3c:cc:dd:d3:0c:a3Certificate

Extended Key Usages

Key Usages

2c:cb:3b:b5:2b:1c:ee:df:42:96:d4:7a:c1:7b:aa:ce:dd:a9:28:13Signer

Headers

File Characteristics

PDB Paths

Imports

defaults

spdflib

recdiag

rendering

kernelapi

lecsomgr

kernel32

user32

gdi32

msvcp80

msvcr80

Exports

Exports

Sections

.text Size: 364KB - Virtual size: 362KB

.rdata Size: 88KB - Virtual size: 84KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 32KB - Virtual size: 29KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

6f:dd:a6:09:f2:17:5f:71:5f:1c:3c:cc:dd:d3:0c:a3
Certificate

2c:cb:3b:b5:2b:1c:ee:df:42:96:d4:7a:c1:7b:aa:ce:dd:a9:28:13
Signer

.text
Size: 364KB - Virtual size: 362KB

.rdata
Size: 88KB - Virtual size: 84KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 32KB - Virtual size: 29KB