66999aca2b46caacf08683516cf94eb9_JaffaCakes118

resource
unpack001/零时空/agents.dll
unpack001/零时空/audio.dll
unpack001/零时空/cl32.dll
unpack001/零时空/core.dll
unpack001/零时空/drvmgrcore.dll
unpack001/零时空/drvmgrui.dll
unpack001/零时空/fileclient.dll
unpack001/零时空/fltk.dll
unpack001/零时空/hotfixcore.dll
unpack001/零时空/hotfixui.dll
unpack001/零时空/librmdts.dll
unpack001/零时空/msvcm90.dll
unpack001/零时空/netmgrcore.dll
unpack001/零时空/netmgrui.dll
unpack001/零时空/ntio518vista.sys
unpack001/零时空/ntio518xp.sys
unpack001/零时空/pgdisk.dll
unpack001/零时空/pgemail.dll
unpack001/零时空/pghfutil.dll
unpack001/零时空/pghook.dll
unpack001/零时空/prvgud.dll
unpack001/零时空/rmdthooks.dll
unpack001/零时空/terms.dll
unpack001/零时空/termsess.exe
unpack001/零时空/termshell.exe
unpack001/零时空/tools/vim.exe
unpack001/零时空/winoptcore.dll
unpack001/零时空/winoptui.dll

.rar

零时空/Microsoft.VC90.ATL.manifest

.xml

零时空/Microsoft.VC90.CRT.manifest

.xml

零时空/agents.dll

.dll windows:5 windows x86 arch:x86

78fc8ed38931dc7ec0710d62938dc6d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\qhelp.v3.0\bin\Release\agents.pdb

Imports

ws2_32

send

iphlpapi

GetExtendedTcpTable

GetExtendedUdpTable

version

GetFileVersionInfoSizeA

GetFileVersionInfoA

VerQueryValueA

kernel32

HeapAlloc

HeapFree

GetModuleHandleW

GetProcessHeap

InitializeCriticalSection

OpenProcess

LeaveCriticalSection

GetProcAddress

EnterCriticalSection

Sleep

MultiByteToWideChar

InterlockedDecrement

GetLastError

FindClose

FindNextFileA

GetFileAttributesExA

CloseHandle

InterlockedExchange

CreateDirectoryA

GetLogicalDriveStringsA

GetLongPathNameA

RemoveDirectoryA

CopyFileA

GetTempFileNameA

GetDiskFreeSpaceA

GetModuleHandleA

GetTempPathA

DeleteFileA

GetSystemTimeAsFileTime

GetCurrentProcessId

WideCharToMultiByte

GetCurrentProcess

lstrlenA

UnhandledExceptionFilter

TerminateProcess

CreateToolhelp32Snapshot

GetDriveTypeA

Module32FirstW

InterlockedCompareExchange

FindFirstFileA

GetFileAttributesA

GetCurrentThreadId

GetTickCount

QueryPerformanceCounter

IsDebuggerPresent

SetUnhandledExceptionFilter

advapi32

RegDeleteValueW

RegQueryValueExW

GetTokenInformation

RegCloseKey

AdjustTokenPrivileges

RegEnumKeyA

RegOpenKeyExA

LookupPrivilegeValueW

RegQueryValueExA

OpenProcessToken

RegOpenKeyExW

shell32

SHGetFolderPathA

ole32

CoInitializeEx

CoInitialize

CoCreateInstance

CoSetProxyBlanket

CoUninitialize

oleaut32

SafeArrayGetUBound

SafeArrayUnaccessData

SafeArrayAccessData

VariantTimeToSystemTime

SafeArrayGetLBound

SysFreeString

VariantInit

VariantClear

SysAllocString

msvcr90

_wfsopen

setvbuf

_fileno

fwrite

fseek

wcscpy

_unlock

__dllonexit

_encode_pointer

_lock

_onexit

_decode_pointer

_malloc_crt

_encoded_null

_initterm

_initterm_e

_amsg_exit

_adjust_fdiv

__CppXcptFilter

_crt_debugger_hook

_except_handler4_common

?terminate@@YAXXZ

?_type_info_dtor_internal_method@type_info@@QAEXXZ

__clean_type_info_names_internal

_fstat64i32

feof

fclose

fread

memset

fopen

strchr

strcmp

_CxxThrowException

rename

memmove_s

memcpy

strlen

_purecall

printf

wcsstr

atoi

_atoi64

mbstowcs

_wcsicmp

getenv

_access

malloc

free

??2@YAPAXI@Z

_wtol

_wtoi64

??_V@YAXPAX@Z

_invalid_parameter_noinfo

??_U@YAPAXI@Z

??0exception@std@@QAE@ABV01@@Z

??0exception@std@@QAE@ABQBD@Z

??0exception@std@@QAE@XZ

??1exception@std@@UAE@XZ

?what@exception@std@@UBEPBDXZ

sprintf

??3@YAXPAX@Z

_itoa

_strnicmp

__CxxFrameHandler3

_errno

msvcp90

??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z

?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z

?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@D@Z

?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ

?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ

??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z

?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z

?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@II@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z

??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z

??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z

??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z

??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z

??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z

??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z

??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z

?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z

?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z

?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z

?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z

?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z

?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB

??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z

??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z

?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ

?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z

??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

shlwapi

StrFormatByteSizeW

SHDeleteKeyA

Exports

LibProcessData

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

零时空/atl90.dll

.dll windows:5 windows x86 arch:x86

17ed9dd04d0bbfc19b81bf75e8ebe774

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

Not Before

22-08-2007 22:31

Not After

25-08-2012 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-10-2008 21:24

Not After

22-01-2010 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-09-2006 01:55

Not After

16-09-2011 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

03:0e:59:c3:98:19:85:40:ba:61:d7:1f:7b:9f:b9:ad:41:15:cf:6c
Signer

Actual PE Digest

03:0e:59:c3:98:19:85:40:ba:61:d7:1f:7b:9f:b9:ad:41:15:cf:6c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

atl90.i386.pdb

Imports

kernel32

lstrlenW

RaiseException

EnterCriticalSection

LeaveCriticalSection

InitializeCriticalSection

DeleteCriticalSection

GetLastError

DisableThreadLibraryCalls

InterlockedIncrement

InterlockedDecrement

GetProcAddress

GetModuleHandleW

lstrcmpiW

FreeLibrary

MultiByteToWideChar

SizeofResource

LoadResource

FindResourceW

LoadLibraryExW

CloseHandle

ReadFile

GetFileSize

CreateFileW

GetModuleFileNameW

WideCharToMultiByte

WaitForSingleObject

GlobalAlloc

FindResourceA

MulDiv

GetCurrentThreadId

FlushInstructionCache

GetCurrentProcess

lstrcmpW

GlobalUnlock

GlobalLock

SetLastError

GlobalFree

GlobalHandle

LockResource

LocalAlloc

InterlockedExchange

LoadLibraryA

HeapFree

HeapAlloc

GetCommandLineA

HeapCreate

HeapDestroy

VirtualFree

VirtualAlloc

HeapReAlloc

TerminateProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlUnwind

WriteFile

GetStdHandle

GetModuleFileNameA

TlsGetValue

TlsAlloc

TlsSetValue

TlsFree

Sleep

ExitProcess

HeapSize

SetHandleCount

GetFileType

GetStartupInfoA

FreeEnvironmentStringsA

GetEnvironmentStrings

FreeEnvironmentStringsW

GetEnvironmentStringsW

QueryPerformanceCounter

GetTickCount

GetCurrentProcessId

GetSystemTimeAsFileTime

InitializeCriticalSectionAndSpinCount

GetCPInfo

GetACP

GetOEMCP

IsValidCodePage

GetLocaleInfoA

SetFilePointer

GetConsoleCP

GetConsoleMode

GetStringTypeA

GetStringTypeW

LCMapStringA

LCMapStringW

SetStdHandle

WriteConsoleA

GetConsoleOutputCP

WriteConsoleW

CreateFileA

FlushFileBuffers

InterlockedCompareExchange

GetProcessHeap

IsProcessorFeaturePresent

lstrcmpA

GetModuleHandleA

Exports

AtlAdvise

AtlAxAttachControl

AtlAxCreateControl

AtlAxCreateControlEx

AtlAxCreateControlLic

AtlAxCreateControlLicEx

AtlAxCreateDialogA

AtlAxCreateDialogW

AtlAxDialogBoxA

AtlAxDialogBoxW

AtlAxGetControl

AtlAxGetHost

AtlAxWinInit

AtlCallTermFunc

AtlComModuleGetClassObject

AtlComModuleRegisterClassObjects

AtlComModuleRevokeClassObjects

AtlComModuleUnregisterServer

AtlComPtrAssign

AtlComQIPtrAssign

AtlCreateRegistrar

AtlCreateTargetDC

AtlDevModeW2A

AtlFreeMarshalStream

AtlGetObjectSourceInterface

AtlGetPerUserRegistration

AtlGetVersion

AtlHiMetricToPixel

AtlIPersistPropertyBag_Load

AtlIPersistPropertyBag_Save

AtlIPersistStreamInit_Load

AtlIPersistStreamInit_Save

AtlInternalQueryInterface

AtlLoadTypeLib

AtlMarshalPtrInProc

AtlModuleAddTermFunc

AtlPixelToHiMetric

AtlRegisterClassCategoriesHelper

AtlSetErrorInfo

AtlSetPerUserRegistration

AtlUnadvise

AtlUnmarshalPtr

AtlUpdateRegistryFromResourceD

AtlWaitWithMessageLoop

AtlWinModuleAddCreateWndData

AtlWinModuleExtractCreateWndData

AtlWinModuleInit

AtlWinModuleRegisterClassExA

AtlWinModuleRegisterClassExW

AtlWinModuleRegisterWndClassInfoA

AtlWinModuleRegisterWndClassInfoW

AtlWinModuleTerm

Sections

.text
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

零时空/audio.dll

.dll windows:5 windows x86 arch:x86

c9151180fd86d8c990e9e78bba319af9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

D:\qhelp.v3.0\bin\Release\audio.pdb

Imports

ws2_32

recv

WSAGetLastError

send

kernel32

InterlockedExchange

GetSystemTimeAsFileTime

GetCurrentProcessId

GetTickCount

CloseHandle

GetLastError

CreateMutexW

CreateSemaphoreA

InitializeCriticalSection

DeleteCriticalSection

Sleep

LeaveCriticalSection

EnterCriticalSection

CreateThread

OutputDebugStringA

WaitForSingleObject

SetThreadPriority

TlsSetValue

GetCurrentThreadId

DuplicateHandle

GetCurrentThread

GetCurrentProcess

TlsAlloc

GlobalAlloc

GlobalFree

QueryPerformanceFrequency

QueryPerformanceCounter

LocalFree

FormatMessageA

CreateEventA

ResetEvent

GetEnvironmentVariableA

GetVersionExA

WaitForMultipleObjects

SetEvent

TerminateProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

InterlockedCompareExchange

msvcr90

strcpy

_purecall

malloc

free

strncpy

memmove

floor

pow

_snprintf

memmove_s

_vsnprintf

_ftol

_CIacos

_stricmp

_CIpow

fflush

??0exception@std@@QAE@XZ

__iob_func

atoi

_unlock

__dllonexit

_encode_pointer

_lock

_onexit

_decode_pointer

_malloc_crt

_encoded_null

_initterm

_initterm_e

_amsg_exit

_adjust_fdiv

__CppXcptFilter

_crt_debugger_hook

?terminate@@YAXXZ

?_type_info_dtor_internal_method@type_info@@QAEXXZ

_except_handler4_common

__clean_type_info_names_internal

??1exception@std@@UAE@XZ

?what@exception@std@@UBEPBDXZ

??0exception@std@@QAE@ABQBD@Z

??0exception@std@@QAE@ABV01@@Z

_CxxThrowException

??2@YAPAXI@Z

??3@YAXPAX@Z

vfprintf