ActiveMARKReadInstaller
Overview
overview
7Static
static
33cc9ddc779...18.exe
windows7-x64
73cc9ddc779...18.exe
windows10-2004-x64
7"aminstall.dll
windows7-x64
1"aminstall.dll
windows10-2004-x64
3"ice_breaker.exe
windows7-x64
3"ice_breaker.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3image_tool.dll
windows7-x64
1image_tool.dll
windows10-2004-x64
1prog.dll
windows7-x64
1prog.dll
windows10-2004-x64
1readme.html
windows7-x64
1readme.html
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
3cc9ddc779bbcf43db528e862af1c25d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3cc9ddc779bbcf43db528e862af1c25d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
"aminstall.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
"aminstall.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
"ice_breaker.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
"ice_breaker.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Uninstall.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Uninstall.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
image_tool.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
image_tool.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
prog.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
prog.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
readme.html
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
readme.html
Resource
win10v2004-20240709-en
General
-
Target
3cc9ddc779bbcf43db528e862af1c25d_JaffaCakes118
-
Size
3.5MB
-
MD5
3cc9ddc779bbcf43db528e862af1c25d
-
SHA1
b122493cf1a95f9f1187f8b7bc4fb17c31813aa1
-
SHA256
a3e51f3f31af3d422450240974800b2701f54befdc20ecbd172de9b98cb75992
-
SHA512
05606a76f425d746c78f70ca653c8841447a38f233b4b5f3cb2953af828d798751c2bee696c45e74c4daa2ce77d3cf27fd34e0a26b481cbafcfefe41f9415fb1
-
SSDEEP
49152:vwLXnWH74sp7F+a2gra0WNVj9SC+adju20P3Q1D47ISEzT7p6TncYHCu1zZITJtf:lX2gruj9SC+68QCIJTNecYFUtas
Malware Config
Signatures
-
Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource 3cc9ddc779bbcf43db528e862af1c25d_JaffaCakes118 unpack001/"aminstall.dll" unpack001/"ice_breaker.exe" unpack001/$PLUGINSDIR/InstallOptions.dll unpack001/$PLUGINSDIR/StartMenu.dll unpack001/$PLUGINSDIR/System.dll unpack001/Uninstall.exe unpack002/$PLUGINSDIR/InstallOptions.dll unpack001/image_tool.dll unpack001/prog.dll -
NSIS installer 2 IoCs
resource yara_rule sample nsis_installer_1 static1/unpack001/Uninstall.exe nsis_installer_1
Files
-
3cc9ddc779bbcf43db528e862af1c25d_JaffaCakes118.exe windows:4 windows x86 arch:x86
dae718ca7c0da2949ad685c2d593ec7a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create
kernel32
FindNextFileA
DeleteFileA
FindFirstFileA
CloseHandle
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
CopyFileA
ExitProcess
lstrcpynA
GetCommandLineA
lstrcmpiA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GetVersion
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
MulDiv
FindClose
SetFilePointer
ReadFile
WriteFile
GetPrivateProfileStringA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
WritePrivateProfileStringA
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
GetWindowsDirectoryA
user32
CharNextA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
PostQuitMessage
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ExitWindowsEx
gdi32
GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateBrushIndirect
CreateFontA
SetBkMode
SetTextColor
SetBkColor
SelectObject
advapi32
RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyA
RegCloseKey
shell32
ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA
ole32
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
"aminstall.dll".dll windows:4 windows x86 arch:x86
39bf2f9400b25dffe6038f4810921a11
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
RegSetValueExA
RegCreateKeyExA
RegCloseKey
kernel32
GetModuleHandleA
GetSystemTime
SetFilePointer
FreeEnvironmentStringsW
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
RtlUnwind
GetCommandLineA
GetVersion
HeapFree
RaiseException
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
CloseHandle
GetModuleFileNameA
FreeEnvironmentStringsA
IsBadReadPtr
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
FlushFileBuffers
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
GetCPInfo
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
CreateFileA
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
LCMapStringW
SetEndOfFile
LCMapStringA
user32
MessageBoxA
Exports
Exports
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
"ice_breaker.exe".exe windows:4 windows x86 arch:x86
51c4e98e76bd946f81a1a9c26b55ce8b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ord1
Sections
.bss Size: - Virtual size: 126KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 9.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: - Virtual size: 21KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: - Virtual size: 25KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 928KB - Virtual size: 928KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 93KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 39KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 69B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
$PLUGINSDIR/InstallOptions.dll.dll windows:4 windows x86 arch:x86
3764e6c387ce3c76b39936a24d523dce
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetPrivateProfileIntA
MultiByteToWideChar
GetPrivateProfileStringA
MulDiv
lstrcmpiA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GetModuleHandleA
GlobalAlloc
user32
PtInRect
MapWindowPoints
GetDlgCtrlID
LoadIconA
LoadImageA
LoadCursorA
CreateWindowExA
GetDC
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
EnableWindow
SendMessageA
SetWindowTextA
GetWindowTextA
wsprintfA
CharNextA
SetWindowLongA
gdi32
SetTextColor
CreateCompatibleDC
SelectObject
GetTextMetricsA
GetTextExtentPoint32A
DeleteDC
DeleteObject
comdlg32
GetOpenFileNameA
CommDlgExtendedError
GetSaveFileNameA
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA
Exports
Exports
dialog
initDialog
show
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/StartMenu.dll.dll windows:4 windows x86 arch:x86
aebc3107701149edfc563b8db7a789fd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpynA
GlobalAlloc
MulDiv
GetModuleHandleA
GlobalFree
FindClose
FindNextFileA
FindFirstFileA
lstrcmpiA
lstrcatA
lstrcpyA
user32
GetDlgItem
PostMessageA
CallWindowProcA
CreateDialogParamA
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
GetWindowTextA
IsDlgButtonChecked
SetWindowLongA
IsDialogMessageA
GetMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
GetWindowLongA
gdi32
GetTextMetricsA
SelectObject
shell32
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA
Exports
Exports
Select
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 444B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/System.dll.dll windows:4 windows x86 arch:x86
445ca064c668ebcb89957d525a8bef23
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
f:\Cpp\!nsis!\System\Release\System.pdb
Imports
kernel32
GlobalAlloc
GlobalSize
GlobalFree
lstrcpyA
lstrcpynA
FreeLibrary
GetModuleHandleA
LoadLibraryA
GetProcAddress
lstrcatA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Exports
Exports
Alloc
Call
Copy
Free
Get
Int64Op
Store
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 478B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/ioSpecial.ini
-
$PLUGINSDIR/modern-header.bmp
-
$PLUGINSDIR/modern-wizard.bmp
-
Uninstall.exe.exe windows:4 windows x86 arch:x86
dae718ca7c0da2949ad685c2d593ec7a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create
kernel32
FindNextFileA
DeleteFileA
FindFirstFileA
CloseHandle
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
CopyFileA
ExitProcess
lstrcpynA
GetCommandLineA
lstrcmpiA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GetVersion
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
MulDiv
FindClose
SetFilePointer
ReadFile
WriteFile
GetPrivateProfileStringA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
WritePrivateProfileStringA
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
GetWindowsDirectoryA
user32
CharNextA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
PostQuitMessage
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ExitWindowsEx
gdi32
GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateBrushIndirect
CreateFontA
SetBkMode
SetTextColor
SetBkColor
SelectObject
advapi32
RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyA
RegCloseKey
shell32
ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA
ole32
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/InstallOptions.dll.dll windows:4 windows x86 arch:x86
3764e6c387ce3c76b39936a24d523dce
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetPrivateProfileIntA
MultiByteToWideChar
GetPrivateProfileStringA
MulDiv
lstrcmpiA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GetModuleHandleA
GlobalAlloc
user32
PtInRect
MapWindowPoints
GetDlgCtrlID
LoadIconA
LoadImageA
LoadCursorA
CreateWindowExA
GetDC
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
EnableWindow
SendMessageA
SetWindowTextA
GetWindowTextA
wsprintfA
CharNextA
SetWindowLongA
gdi32
SetTextColor
CreateCompatibleDC
SelectObject
GetTextMetricsA
GetTextExtentPoint32A
DeleteDC
DeleteObject
comdlg32
GetOpenFileNameA
CommDlgExtendedError
GetSaveFileNameA
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA
Exports
Exports
dialog
initDialog
show
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/ioSpecial.ini
-
$PLUGINSDIR/modern-header.bmp
-
$PLUGINSDIR/modern-wizard.bmp
-
ib/arial.mft
-
ib/arial_12.mft
-
ib/arrow_down_off.tga
-
ib/arrow_down_on.tga
-
ib/arrow_up_off.tga
-
ib/arrow_up_on.tga
-
ib/autumn_digits.mft
-
ib/bear.tga
-
ib/bear_s.tga
-
ib/block_break_mask.tga
-
ib/bon_bomb.tga
-
ib/bon_c4.tga
-
ib/bon_clightning.tga
-
ib/bon_freemove.tga
-
ib/bon_hordest.tga
-
ib/bon_icepick.tga
-
ib/bon_lightning.tga
-
ib/bon_sun.tga
-
ib/bon_timeslow.tga
-
ib/bon_twister.tga
-
ib/bon_verdest.tga
-
ib/btn_already_paid.jap
-
ib/btn_already_paid_hilight.jap
-
ib/btn_buy_now.jap
-
ib/btn_buy_now_hilight.jap
-
ib/btn_delete.jap
-
ib/btn_delete_hilight.jap
-
ib/btn_down.jap
-
ib/btn_down_hilight.jap
-
ib/btn_end_game.jap
-
ib/btn_go.jap
-
ib/btn_go_hilight.jap
-
ib/btn_help.jap
-
ib/btn_hiscores.jap
-
ib/btn_left.jap
-
ib/btn_left_hilight.jap
-
ib/btn_menu.jap
-
ib/btn_menu_hilight.jap
-
ib/btn_no.jap
-
ib/btn_no_hilight.jap
-
ib/btn_ok.jap
-
ib/btn_ok_hilight.jap
-
ib/btn_options.jap
-
ib/btn_other_games.jap
-
ib/btn_other_games_hilight.jap
-
ib/btn_pause.jap
-
ib/btn_play.jap
-
ib/btn_quit.jap
-
ib/btn_replay.jap
-
ib/btn_replay_hilight.jap
-
ib/btn_rewards.jap
-
ib/btn_rewards_hilight.jap
-
ib/btn_rewards_small.jap
-
ib/btn_right.jap
-
ib/btn_right_hilight.jap
-
ib/btn_select.jap
-
ib/btn_select_hilight.jap
-
ib/btn_sound.jap
-
ib/btn_story.jap
-
ib/btn_story_hilight.jap
-
ib/btn_story_small.jap
-
ib/btn_switch.jap
-
ib/btn_yes.jap
-
ib/btn_yes_hilight.jap
-
ib/button_click.ogg
-
ib/click_the_block.jap
-
ib/click_the_map2.jap
-
ib/combo4x.ogg
-
ib/combo5x.ogg
-
ib/combo6x.ogg
-
ib/combo7x.ogg
-
ib/combo8x.ogg
-
ib/config.ini
-
ib/congrats.ogg
-
ib/devlogo.tga
-
ib/drag.ogg
-
ib/eagle.tga
-
ib/eagle_s.tga
-
ib/eskimo.tga
-
ib/eskimo_s.tga
-
ib/explosion.ogg
-
ib/fishie.tga
-
ib/fishie_s.tga
-
ib/flake82_0000.tga
-
ib/flake82_0001.tga
-
ib/flake82_0002.tga
-
ib/flake82_0003.tga
-
ib/flake82_0004.tga
-
ib/flake82_0005.tga
-
ib/flake82_0006.tga
-
ib/flake82_0007.tga
-
ib/flake82_0008.tga
-
ib/freemove.ogg
-
ib/hor_lightning.jap
-
ib/horizontal_fire.jap
-
ib/husky.tga
-
ib/husky_s.tga
-
ib/hylki.tga
-
ib/hylki2.tga
-
ib/hylki2_s.tga
-
ib/hylki_s.tga
-
ib/i_glow.jap
-
ib/ice_blue.mft
-
ib/ice_crack.ogg
-
ib/ice_crack_01.ogg
-
ib/ice_crack_02.ogg
-
ib/ice_crack_03.ogg
-
ib/ice_crack_04.ogg
-
ib/ice_crack_05.ogg
-
ib/icecream.tga
-
ib/icecream_s.tga
-
ib/icepick.ogg
-
ib/igloo.tga
-
ib/igloo_s.tga
-
ib/illegal_select.ogg
-
ib/img_backdrop.jpg.jpg
-
ib/img_board.jap
-
ib/img_bombtime.tga
-
ib/img_combo_4x.jap
-
ib/img_combo_5x.jap
-
ib/img_combo_6x.jap
-
ib/img_combo_7x.jap
-
ib/img_combo_8xplus.jap
-
ib/img_congrats.jap
-
ib/img_drop_01.jap
-
ib/img_drop_02.jap
-
ib/img_eskimo.jap
-
ib/img_failure.jap
-
ib/img_help.jap
-
ib/img_hiscores.jap
-
ib/img_hruler.jap
-
ib/img_hruler2.jap
-
ib/img_icy_hruler_down.jap
-
ib/img_icy_hruler_up.jap
-
ib/img_icy_vruler.jap
-
ib/img_level.jap
-
ib/img_lightning.jap
-
ib/img_map.jap
-
ib/img_map_overlay.jap
-
ib/img_map_path.jap
-
ib/img_no_possible_moves.jap
-
ib/img_options.jap
-
ib/img_panel_time.jap
-
ib/img_pathmark.tga
-
ib/img_pathmark_hilight.tga
-
ib/img_prepare_for.jap
-
ib/img_rec_levelscore.jap
-
ib/img_rec_leveltime.jap
-
ib/img_rec_top10.jap
-
ib/img_reward_meter.jap
-
ib/img_rewardhunt.tga
-
ib/img_score.jap
-
ib/img_score_panel.jap
-
ib/img_selector.jap
-
ib/img_sign_level.jap
-
ib/img_sign_score.jap
-
ib/img_sign_time.jap
-
ib/img_small_meter.jap
-
ib/img_small_meter_ind.jap
-
ib/img_speech_medium.jap
-
ib/img_speech_small.jap
-
ib/img_success.jap
-
ib/img_sun_glow.jap
-
ib/img_time.jap
-
ib/img_tooth_ind.jap
-
ib/img_vermeterback.jap
-
ib/img_vermeterback.tga
-
ib/img_welcome.jap
-
ib/impact.ttf.mft
-
ib/impact_black.mft
-
ib/ind_highscore.jap
-
ib/interlude1.ogg
-
ib/interlude2-loppu.ogg
-
ib/interlude2.ogg
-
ib/kayak.tga
-
ib/kayak_s.tga
-
ib/kimalle1_pien.tga
-
ib/kimalle2_pien.tga
-
ib/kimalle3_pien.tga
-
ib/kimalle4_pien.tga
-
ib/kimalle5_pien.tga
-
ib/kimalle6_pien.tga
-
ib/layers.def
-
ib/lemming.tga
-
ib/lemming_s.tga
-
ib/level_hiscore.ogg
-
ib/levels.def
-
ib/logo_loading.tga
-
ib/lose.ogg
-
ib/lumipallo.tga
-
ib/map_back.tga
-
ib/map_path.tga
-
ib/meter_time.jap
-
ib/naali.tga
-
ib/naali_s.tga
-
ib/nopea1.ogg
-
ib/nopea2.ogg
-
ib/part_1_40x40.tga
-
ib/part_small_flake.jap
-
ib/part_snowflake.tga
-
ib/pause_menut.ogg
-
ib/pingu.tga
-
ib/pingu_s.tga
-
ib/plu0000.jap
-
ib/plu0002.jap
-
ib/plu0004.jap
-
ib/plu0006.jap
-
ib/plu0008.jap
-
ib/plu0010.jap
-
ib/plu0012.jap
-
ib/plu0014.jap
-
ib/plu0016.jap
-
ib/plu0018.jap
-
ib/plu0020.jap
-
ib/point_lightning.jap
-
ib/qigirn.tga
-
ib/qigirn_s.tga
-
ib/rauhallinen1.ogg
-
ib/rauhallinen2-b.ogg
-
ib/rauhallinen2.ogg
-
ib/rauhallinen3.ogg
-
ib/record_level_time.ogg
-
ib/rew_ancestor.jap
-
ib/rew_black_polar_bear.jap
-
ib/rew_eagle_pendant.jap
-
ib/rew_eagles_soul.jap
-
ib/rew_killerwhale.jap
-
ib/rew_moon_pendant.jap
-
ib/rew_shamans_mask.jap
-
ib/rew_warrior.jap
-
ib/rewards.def
-
ib/scoreboard_frame.jap
-
ib/select.ogg
-
ib/settings.def
-
ib/shamaani.tga
-
ib/shamaani_s.tga
-
ib/shard_01_01.tga
-
ib/shard_01_02.tga
-
ib/shard_01_03.tga
-
ib/shard_01_04.tga
-
ib/shard_02_01.tga
-
ib/shard_02_02.tga
-
ib/shock.ogg
-
ib/shockwave.ogg
-
ib/smoke.tga
-
ib/steel.tga
-
ib/sun.ogg
-
ib/tickticktick.ogg
-
ib/timeslow.ogg
-
ib/top10.ogg
-
ib/twister.ogg
-
ib/ui_checkbox.jap
-
ib/ui_checkbox_on.jap
-
ib/ui_editbox.jap
-
ib/ui_listbox.jap
-
ib/ui_master_volume_slider.jap
-
ib/ui_music_volume_slider.jap
-
ib/ui_panel_login.jap
-
ib/ui_popup_huuto_box.tga
-
ib/ui_popup_question_box.jap
-
ib/ui_slider_pointer.jap
-
ib/ver_lightning.jap
-
ib/vertical_fire.jap
-
ib/vorbis.txt
-
ib/water_01.ogg
-
ib/water_02.ogg
-
ib/whale.tga
-
ib/whale_s.tga
-
ib/win.ogg
-
image_tool.dll.dll windows:4 windows x86 arch:x86
143fa350048f33ac1e551edd702280a7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
printf
??2@YAPAXI@Z
??3@YAXPAX@Z
_setjmp3
longjmp
fread
fclose
ftell
fseek
fopen
_ftol
putc
fwrite
fputc
sprintf
sscanf
getenv
free
_initterm
malloc
_adjust_fdiv
user32
GetActiveWindow
MessageBoxA
Exports
Exports
U_GetInterface
Sections
.text Size: 56KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1010B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
manual/b1.jpg.jpg
-
manual/b10.jpg.jpg
-
manual/b11.jpg.jpg
-
manual/b2.jpg.jpg
-
manual/b3.jpg.jpg
-
manual/b4.jpg.jpg
-
manual/b5.jpg.jpg
-
manual/b6.jpg.jpg
-
manual/b7.jpg.jpg
-
manual/b8.jpg.jpg
-
manual/b9.jpg.jpg
-
manual/s0.jpg.jpg
-
manual/s1.jpg.jpg
-
manual/title.jpg.jpg
-
megan.ini
-
prog.dll.dll windows:4 windows x86 arch:x86
8f750a5a5e815d7f9a97fa7c21a8ec25
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
user32
LoadCursorA
SetCursor
MessageBoxA
msvcrt
_adjust_fdiv
malloc
_initterm
fclose
??3@YAXPAX@Z
ungetc
fgetc
??2@YAPAXI@Z
ftell
fseek
fopen
__CxxFrameHandler
_CxxThrowException
sscanf
strchr
strstr
sprintf
rand
_ftol
atof
atoi
printf
toupper
qsort
fread
fwrite
_CIpow
srand
time
_beginthread
fprintf
fscanf
??1type_info@@UAE@XZ
__dllonexit
_onexit
free
Exports
Exports
MP_GetInterface
Sections
.text Size: 88KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 579KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
readme.html.html
-
vorbis.txt