75651ad750e5f73028d1fe4437de62b5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

75651ad750e5f73028d1fe4437de62b5_JaffaCakes118
Size

3.4MB
MD5

75651ad750e5f73028d1fe4437de62b5
SHA1

208f9e8178c545d4934df733eb09ac911e961dab
SHA256

47acf84c3fa3441cfd5a5e3ebebe2056faae9be64fc2960e7d7dd026fc89fe19
SHA512

1891e12ba396e29a040f10be2f9a60ac27d5e1ed357730cb8d3ff719726d9e6fc2655dffa3a42359fd4403d3cc2facc60ec1d14dc164266ee6aad4d38e69f718
SSDEEP

98304:9zmJeM0jAOPLcqthaJrP0zHsKyvWunKO42U1tH21:gJCMOHhOccWuKvJ1FE

Score

7^/10

themida

Malware Config

Signatures

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/Qy_book/NovelSearch/bin/OriSoft.dll	themida
static1/unpack002/WanerSoft.dll	themida

Unsigned PE 18 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Qy_book/NovelSearch/Config/UrlRewriter.dll
unpack001/Qy_book/NovelSearch/bin/Ajax.dll
unpack001/Qy_book/NovelSearch/bin/AspNetPager.dll
unpack001/Qy_book/NovelSearch/bin/FreeTextBox.dll
unpack001/Qy_book/NovelSearch/bin/MySql.Data.dll
unpack001/Qy_book/NovelSearch/bin/OriSoft.BLL.dll
unpack001/Qy_book/NovelSearch/bin/OriSoft.Code.dll
unpack001/Qy_book/NovelSearch/bin/OriSoft.DAL.dll
unpack001/Qy_book/NovelSearch/bin/OriSoft.DBUtility.dll
unpack001/Qy_book/NovelSearch/bin/OriSoft.Model.dll
unpack001/Qy_book/NovelSearch/bin/OriSoft.Web.dll
unpack001/Qy_book/NovelSearch/bin/OriSoft.dll
unpack001/Qy_book/NovelSearch/bin/Socut.Data.dll
unpack002/IrisSkin2.dll
unpack002/WanerSoft.dll
unpack002/WizardBase.dll
unpack002/WsSearch.exe
unpack002/WsSearch.vshost.exe

Files

75651ad750e5f73028d1fe4437de62b5_JaffaCakes118
.rar
Qy_book/NovelSearch/About/SiteMap.xml
.xml
Qy_book/NovelSearch/Admin/Book/Book.aspx
Qy_book/NovelSearch/Admin/Book/BookChapter.aspx
Qy_book/NovelSearch/Admin/Book/BookChapterList.aspx
Qy_book/NovelSearch/Admin/Book/BookComment.aspx
Qy_book/NovelSearch/Admin/Book/BookDelete.aspx
Qy_book/NovelSearch/Admin/Book/BookList.aspx
Qy_book/NovelSearch/Admin/Book/BookReComm.aspx
.asp
Qy_book/NovelSearch/Admin/Book/BookSearch.aspx
Qy_book/NovelSearch/Admin/Common/Frame.aspx
Qy_book/NovelSearch/Admin/Css.css
Qy_book/NovelSearch/Admin/Css/Css.css
Qy_book/NovelSearch/Admin/DataBase/Advanced.aspx
Qy_book/NovelSearch/Admin/DataBase/Maintenance.aspx
Qy_book/NovelSearch/Admin/HelperScripts/ftb.colorpicker.aspx
.asp .js polyglot
Qy_book/NovelSearch/Admin/HelperScripts/ftb.imagegallery.aspx
.asp .js polyglot
Qy_book/NovelSearch/Admin/HelperScripts/ftb.inserttable.aspx
.asp .js polyglot
Qy_book/NovelSearch/Admin/Images/List/0.gif
.gif
Qy_book/NovelSearch/Admin/Images/List/1.gif
.gif
Qy_book/NovelSearch/Admin/Images/List/F0.gif
.gif
Qy_book/NovelSearch/Admin/Images/List/F1.gif
.gif
Qy_book/NovelSearch/Admin/Images/List/folderclose.gif
.gif
Qy_book/NovelSearch/Admin/Images/List/folderopen.gif
.gif
Qy_book/NovelSearch/Admin/Images/List/info.gif
.gif
Qy_book/NovelSearch/Admin/Images/List/lastnode.gif
.gif
Qy_book/NovelSearch/Admin/Images/List/menuclose.gif
.gif
Qy_book/NovelSearch/Admin/Images/List/menuopen.gif
.gif
Qy_book/NovelSearch/Admin/Images/List/node.gif
.gif
Qy_book/NovelSearch/Admin/Images/Login.jpg
.jpg
Qy_book/NovelSearch/Admin/Images/Login3.jpg
.jpg
Qy_book/NovelSearch/Admin/Images/Meg/0.gif
.gif
Qy_book/NovelSearch/Admin/Images/Meg/1.gif
.gif
Qy_book/NovelSearch/Admin/Images/Meg/2.gif
.gif
Qy_book/NovelSearch/Admin/Images/Meg/3.gif
.gif
Qy_book/NovelSearch/Admin/Images/Meg/4.gif
.gif
Qy_book/NovelSearch/Admin/Images/Meg/_vti_cnf/0.gif
Qy_book/NovelSearch/Admin/Images/Meg/_vti_cnf/1.gif
Qy_book/NovelSearch/Admin/Images/Meg/_vti_cnf/2.gif
Qy_book/NovelSearch/Admin/Images/Meg/_vti_cnf/3.gif
Qy_book/NovelSearch/Admin/Images/Meg/_vti_cnf/4.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/Collect.gif
.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/Copy.gif
.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/Img.gif
.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/Paste.gif
.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/TypeSet.gif
.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/UploadImg.gif
.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/Url.gif
.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/_vti_cnf/Collect.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/_vti_cnf/Copy.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/_vti_cnf/Img.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/_vti_cnf/Paste.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/_vti_cnf/TypeSet.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/_vti_cnf/UploadImg.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/_vti_cnf/Url.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/_vti_cnf/flash.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/_vti_cnf/toolbar.bg.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/_vti_cnf/toolbar.separator.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/_vti_cnf/toolbar.start.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/flash.gif
.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/toolbar.bg.gif
.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/toolbar.separator.gif
.gif
Qy_book/NovelSearch/Admin/Images/RichTextBox/toolbar.start.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/HideTree.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/L_2.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/L_22.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/Menu_Close.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/Menu_Open.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/N_N.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/N_Y_C.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/N_Y_O.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/S_plus.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/S_unplus.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/ShowTree.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/Y_N.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/Y_Y_C.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/Y_Y_O.gif
.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/HideTree.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/L_2.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/L_22.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/Menu_Close.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/Menu_Open.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/N_N.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/N_Y_C.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/N_Y_O.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/S_plus.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/S_unplus.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/ShowTree.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/Y_N.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/Y_Y_C.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/Y_Y_O.gif
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/left1.jpg
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/left12.jpg
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/left2-2.jpg
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/left2.jpg
Qy_book/NovelSearch/Admin/Images/Tree/_vti_cnf/left32.jpg
Qy_book/NovelSearch/Admin/Images/Tree/left1.jpg
.jpg
Qy_book/NovelSearch/Admin/Images/Tree/left12.jpg
.jpg
Qy_book/NovelSearch/Admin/Images/Tree/left2-2.jpg
.jpg
Qy_book/NovelSearch/Admin/Images/Tree/left2.jpg
.jpg
Qy_book/NovelSearch/Admin/Images/Tree/left32.jpg
.jpg
Qy_book/NovelSearch/Admin/Images/ftb/folder.big.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/folder.small.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/folder.up.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/bold.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/bullets.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/center.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/copy.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/createlink.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/cut.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/deletetablecolumn.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/deletetablerow.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/fontbackcolorpicker.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/fontforecolorpicker.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/indent.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/insertdate.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/insertimage.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/insertimagefromgallery.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/insertrule.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/inserttable.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/inserttablecolumn.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/inserttablerow.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/inserttime.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/italic.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/justifycenter.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/justifyfull.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/justifyleft.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/justifyright.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/link.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/mode.design.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/mode.html.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/numberedlist.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/numbers.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/outdent.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/paste.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/print.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/redo.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/removeformat.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/save.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/separator.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/spellcheck.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/strikethrough.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/subscript.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/superscript.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/table.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/toolbar.end.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/toolbar.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/toolbar.start.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/underline.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/undo.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/unlink.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/wordclean.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2000/wordcount.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/bold.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/bullets.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/copy.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/createlink.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/cut.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/delete.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/deletetablecolumn.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/deletetablerow.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/fontbackcolorpicker.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/fontforecolorpicker.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/indent.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/insertdate.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/insertimage.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/insertimagefromgallery.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/insertrule.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/inserttable.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/inserttablecolumn.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/inserttablerow.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/inserttime.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/italic.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/justifycenter.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/justifyfull.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/justifyleft.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/justifyright.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/mode.design.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/mode.html.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/numberedlist.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/outdent.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/paste.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/print.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/redo.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/removeformat.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/save.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/separator.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/spellcheck.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/strikethrough.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/subscript.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/superscript.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/toolbar.background.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/toolbar.end.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/toolbar.start.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/toolbarbutton.down.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/toolbarbutton.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/underline.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/undo.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/unlink.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/wordclean.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/office2003/wordcount.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/bgcolor.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/bold.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/bold.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/borders.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/bullets.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/bullets.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/changecase.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/changecase.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/copy.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/copy.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/createlink.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/createlink.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/cut.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/cut.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/delete.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/delete.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/deletetablecolumn.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/deletetablecolumn.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/deletetablerow.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/deletetablerow.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/details.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/find.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/find.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/fontbackcolorpicker.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/fontbackcolorpicker.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/fontforecolorpicker.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/fontforecolorpicker.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/help.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/help.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/indent.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/indent.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/insertdate.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/insertdate.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/insertemail.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/insertemail.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/insertimage.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/insertimage.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/insertimagefromgallery.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/insertimagefromgallery.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/insertrule.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/insertrule.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/inserttable.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/inserttable.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/inserttablecolumn.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/inserttablecolumn.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/inserttablerow.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/inserttablerow.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/inserttime.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/inserttime.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/italic.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/italic.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/justifycenter.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/justifycenter.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/justifyfull.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/justifyfull.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/justifyleft.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/justifyleft.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/justifyright.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/justifyright.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/mode.design.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/mode.html.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/numberedlist.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/numberedlist.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/outdent.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/outdent.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/paste.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/paste.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/print.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/print.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/redo.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/redo.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/removeformat.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/removeformat.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/save.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/save.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/separator.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/spellcheck.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/spellcheck.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/strikethrough.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/strikethrough.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/subscript.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/subscript.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/superscript.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/superscript.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/toggleborders.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/toggledetails.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/toggledetails.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/toolbar.end.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/toolbar.start.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/underline.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/underline.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/undo.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/undo.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/unlink.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/unlink.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/verse.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/verse.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/wordclean.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/wordclean.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/wordcount.gif
.gif
Qy_book/NovelSearch/Admin/Images/ftb/officeXP/wordcount.over.gif
.gif
Qy_book/NovelSearch/Admin/Images/logo.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/0.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/1.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/10.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/11.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/12.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/13.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/14.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/15.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/16.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/17.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/2.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/3.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/4.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/5.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/6.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/7.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/8.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/9.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/User.gif
.gif
Qy_book/NovelSearch/Admin/Images/menu/_notes/User.gif.mno
Qy_book/NovelSearch/Admin/Images/menu/_notes/_vti_cnf/User.gif.mno
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/0.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/1.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/10.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/11.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/12.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/13.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/14.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/15.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/16.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/17.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/2.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/3.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/4.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/5.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/6.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/7.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/8.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/9.gif
Qy_book/NovelSearch/Admin/Images/menu/_vti_cnf/User.gif
Qy_book/NovelSearch/Admin/Images/zoomin.gif
.gif
Qy_book/NovelSearch/Admin/Images/zoomout.gif
.gif
Qy_book/NovelSearch/Admin/Index_Left.aspx
.js
Qy_book/NovelSearch/Admin/Index_LeftLoad.aspx
.js
Qy_book/NovelSearch/Admin/Index_Main.aspx
Qy_book/NovelSearch/Admin/Index_Top.aspx
Qy_book/NovelSearch/Admin/Login.aspx
.js
Qy_book/NovelSearch/Admin/LoginErr.aspx
Qy_book/NovelSearch/Admin/Logout.aspx
Qy_book/NovelSearch/Admin/News/List.aspx
Qy_book/NovelSearch/Admin/News/News.aspx
Qy_book/NovelSearch/Admin/Other/Announce.aspx
Qy_book/NovelSearch/Admin/Other/Application.aspx
Qy_book/NovelSearch/Admin/Other/FriendList.aspx
Qy_book/NovelSearch/Admin/Rule/Setup.aspx
Qy_book/NovelSearch/Admin/RunErr.aspx
Qy_book/NovelSearch/Admin/System/LoginLog.aspx
Qy_book/NovelSearch/Admin/System/Run.aspx
Qy_book/NovelSearch/Admin/System/Setup.aspx
Qy_book/NovelSearch/Admin/System/Url.aspx
Qy_book/NovelSearch/Admin/System/User.aspx
Qy_book/NovelSearch/Admin/UpLoad/UpLoad.aspx
Qy_book/NovelSearch/Admin/User/ListAdmin.aspx
Qy_book/NovelSearch/Admin/User/ListAll.aspx
Qy_book/NovelSearch/Admin/User/PassUser.aspx
Qy_book/NovelSearch/Admin/User/User.aspx
Qy_book/NovelSearch/Admin/User/UserAdmin.aspx
Qy_book/NovelSearch/Admin/ValidatorCode.aspx
Qy_book/NovelSearch/Admin/index.aspx
.asp
Qy_book/NovelSearch/Admin/js/Content.js
.js
Qy_book/NovelSearch/Admin/js/List.js
.js
Qy_book/NovelSearch/Admin/js/Public.js
.js
Qy_book/NovelSearch/Admin/js/Tree.js
Qy_book/NovelSearch/Admin/js/keyword.js
.js
Qy_book/NovelSearch/Book/BookChapter.aspx
.js
Qy_book/NovelSearch/Book/BookDir.aspx
Qy_book/NovelSearch/Book/BookForum.aspx
Qy_book/NovelSearch/Book/BookHeader.aspx
Qy_book/NovelSearch/Book/BookInfo.aspx
Qy_book/NovelSearch/Book/BookRead.aspx
Qy_book/NovelSearch/Book/BookReadUrl.aspx
.asp
Qy_book/NovelSearch/Book/BookTop.aspx
Qy_book/NovelSearch/Book/BookTran.aspx
Qy_book/NovelSearch/Book/BookWeekTop.aspx
Qy_book/NovelSearch/Book/CommendSave.aspx
Qy_book/NovelSearch/Book/Comment.aspx
Qy_book/NovelSearch/Book/Contorl/Announce.ascx
Qy_book/NovelSearch/Book/Contorl/BookForumSend.ascx
.js
Qy_book/NovelSearch/Book/Contorl/BookMark.ascx
Qy_book/NovelSearch/Book/Contorl/Comment.ascx
Qy_book/NovelSearch/Book/Contorl/CommentSend.ascx
.js
Qy_book/NovelSearch/Book/Contorl/ThreadDetailSend.ascx
.js
Qy_book/NovelSearch/Book/Contorl/ThreadDetailment.ascx
Qy_book/NovelSearch/Book/Contorl/TopHit.ascx
Qy_book/NovelSearch/Book/Contorl/TopHitIndex.ascx
Qy_book/NovelSearch/Book/Contorl/TopUpdate.ascx
Qy_book/NovelSearch/Book/Rss.aspx
Qy_book/NovelSearch/Book/Search.aspx
Qy_book/NovelSearch/Book/ThreadDetail.aspx
.js
Qy_book/NovelSearch/Book/Update.aspx
Qy_book/NovelSearch/Common/BookLogin.ascx
Qy_book/NovelSearch/Common/BookMenu.ascx
.js
Qy_book/NovelSearch/Common/Footer.ascx
Qy_book/NovelSearch/Common/FriendText.ascx
Qy_book/NovelSearch/Common/Header.ascx
Qy_book/NovelSearch/Common/Menu.ascx
.js
Qy_book/NovelSearch/Common/MenuLogin.ascx
Qy_book/NovelSearch/Config/Forum.Config
.xml
Qy_book/NovelSearch/Config/ForumLoad.Config
Qy_book/NovelSearch/Config/Setup.Config
.xml
Qy_book/NovelSearch/Config/UrlRewriter.dll
.dll windows:4 windows x86 arch:x86

3f660cc84b8c808ecc7dd3c09ff66d06

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\dinoch\dev\ISAPI\IIRF\IsapiRewrite4.pdb

Imports

kernel32

SetLastError
GetLastError
DeleteCriticalSection
GetCurrentThreadId
GetModuleFileNameA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
WideCharToMultiByte
ReadDirectoryChangesW
CreateFileA
CloseHandle
CreateThread
GetCurrentProcessId
FindClose
FindFirstFileA
HeapValidate
IsBadReadPtr
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetModuleHandleA
ExitProcess
GetSystemTimeAsFileTime
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
FatalAppExitA
HeapReAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
WriteFile
GetStdHandle
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
LoadLibraryW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
SetFilePointer
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
GetTimeZoneInformation
ReadFile
RaiseException
lstrlenA
SetEndOfFile
VirtualQuery
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

ApplyRules
GetFilterVersion
HttpFilterProc
IsapiFilterTestSetup
TerminateFilter

Sections

.text
Size: 476KB - Virtual size: 473KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Qy_book/NovelSearch/Config/UrlRewriter.ini
Qy_book/NovelSearch/Config/User.Config
.xml
Qy_book/NovelSearch/Css/BookChapter.css
Qy_book/NovelSearch/Css/BookInfo.Css
Qy_book/NovelSearch/Css/Common.css
Qy_book/NovelSearch/Css/Default.Css
Qy_book/NovelSearch/Css/Header.css
Qy_book/NovelSearch/Css/Login.css
Qy_book/NovelSearch/Css/Update.Css
Qy_book/NovelSearch/Css/Xml.css
Qy_book/NovelSearch/Css/master.css
Qy_book/NovelSearch/Css/oricode.css
Qy_book/NovelSearch/Css/popup.css
Qy_book/NovelSearch/Default.aspx
Qy_book/NovelSearch/Images/Logo.gif
.gif
Qy_book/NovelSearch/Images/MegIcon/0.gif
.gif
Qy_book/NovelSearch/Images/MegIcon/1.gif
.gif
Qy_book/NovelSearch/Images/MegIcon/2.gif
.gif
Qy_book/NovelSearch/Images/MegIcon/3.gif
.gif
Qy_book/NovelSearch/Images/MegIcon/4.gif
.gif
Qy_book/NovelSearch/Images/MegIcon/5.gif
.gif
Qy_book/NovelSearch/Images/MegIcon/6.gif
.gif
Qy_book/NovelSearch/Images/MegIcon/7.gif
.gif
Qy_book/NovelSearch/Images/MegIcon/8.gif
.gif
Qy_book/NovelSearch/Images/MegIcon/9.gif
.gif
Qy_book/NovelSearch/Images/MegIcon/Close.gif
.gif
Qy_book/NovelSearch/Images/MegIcon/bg.gif
.gif
Qy_book/NovelSearch/Images/No.png
.png
Qy_book/NovelSearch/Images/Regno.png
.png
Qy_book/NovelSearch/Images/Regyes.png
.png
Qy_book/NovelSearch/Images/Rss.gif
.gif
Qy_book/NovelSearch/Images/UserIcon/System/notset.gif
.gif
Qy_book/NovelSearch/Images/What.png
.png
Qy_book/NovelSearch/Images/Yes.png
.png
Qy_book/NovelSearch/Images/bbsmax_icons.png
.png
Qy_book/NovelSearch/Images/bg-h.gif
.gif
Qy_book/NovelSearch/Images/bg.gif
.gif
Qy_book/NovelSearch/Images/bg8.gif
.gif
Qy_book/NovelSearch/Images/bg_01.gif
.gif
Qy_book/NovelSearch/Images/bg_02.gif
.gif
Qy_book/NovelSearch/Images/bg_05.gif
.gif
Qy_book/NovelSearch/Images/bg_06.gif
.gif
Qy_book/NovelSearch/Images/bg_07.gif
.gif
Qy_book/NovelSearch/Images/bg_08.gif
.gif
Qy_book/NovelSearch/Images/bg_09.gif
.gif
Qy_book/NovelSearch/Images/bg_10.gif
.gif
Qy_book/NovelSearch/Images/bg_11.gif
.gif
Qy_book/NovelSearch/Images/bg_13.gif
.gif
Qy_book/NovelSearch/Images/bg_18.gif
.gif
Qy_book/NovelSearch/Images/blog.gif
.gif
Qy_book/NovelSearch/Images/blueBg.jpg
.jpg
Qy_book/NovelSearch/Images/bullet_arrow2.gif
.gif
Qy_book/NovelSearch/Images/bullet_arrow4.gif
.gif
Qy_book/NovelSearch/Images/bullet_user.gif
.gif
Qy_book/NovelSearch/Images/buttonbg.gif
.gif
Qy_book/NovelSearch/Images/bx01.gif
.gif
Qy_book/NovelSearch/Images/check_error.gif
.gif
Qy_book/NovelSearch/Images/check_right.gif
.gif
Qy_book/NovelSearch/Images/close.gif
.gif
Qy_book/NovelSearch/Images/dotLine-h.gif
.gif
Qy_book/NovelSearch/Images/dotLine.gif
.gif
Qy_book/NovelSearch/Images/dotLine2.gif
.gif
Qy_book/NovelSearch/Images/error.gif
.gif
Qy_book/NovelSearch/Images/error_mail.gif
.gif
Qy_book/NovelSearch/Images/ftb/folder.big.gif
.gif
Qy_book/NovelSearch/Images/ftb/folder.small.gif
.gif
Qy_book/NovelSearch/Images/ftb/folder.up.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/bold.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/bullets.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/center.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/copy.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/createlink.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/cut.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/deletetablecolumn.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/deletetablerow.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/fontbackcolorpicker.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/fontforecolorpicker.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/indent.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/insertdate.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/insertimage.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/insertimagefromgallery.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/insertrule.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/inserttable.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/inserttablecolumn.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/inserttablerow.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/inserttime.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/italic.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/justifycenter.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/justifyfull.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/justifyleft.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/justifyright.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/link.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/mode.design.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/mode.html.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/numberedlist.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/numbers.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/outdent.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/paste.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/print.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/redo.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/removeformat.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/save.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/separator.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/spellcheck.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/strikethrough.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/subscript.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/superscript.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/table.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/toolbar.end.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/toolbar.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/toolbar.start.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/underline.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/undo.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/unlink.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/wordclean.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2000/wordcount.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/bold.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/bullets.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/copy.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/createlink.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/cut.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/delete.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/deletetablecolumn.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/deletetablerow.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/fontbackcolorpicker.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/fontforecolorpicker.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/indent.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/insertdate.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/insertimage.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/insertimagefromgallery.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/insertrule.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/inserttable.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/inserttablecolumn.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/inserttablerow.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/inserttime.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/italic.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/justifycenter.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/justifyfull.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/justifyleft.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/justifyright.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/mode.design.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/mode.html.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/numberedlist.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/outdent.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/paste.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/print.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/redo.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/removeformat.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/save.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/separator.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/spellcheck.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/strikethrough.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/subscript.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/superscript.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/toolbar.background.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/toolbar.end.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/toolbar.start.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/toolbarbutton.down.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/toolbarbutton.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/underline.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/undo.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/unlink.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/wordclean.gif
.gif
Qy_book/NovelSearch/Images/ftb/office2003/wordcount.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/bgcolor.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/bold.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/bold.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/borders.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/bullets.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/bullets.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/changecase.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/changecase.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/copy.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/copy.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/createlink.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/createlink.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/cut.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/cut.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/delete.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/delete.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/deletetablecolumn.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/deletetablecolumn.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/deletetablerow.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/deletetablerow.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/details.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/find.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/find.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/fontbackcolorpicker.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/fontbackcolorpicker.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/fontforecolorpicker.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/fontforecolorpicker.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/help.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/help.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/indent.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/indent.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/insertdate.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/insertdate.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/insertemail.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/insertemail.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/insertimage.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/insertimage.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/insertimagefromgallery.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/insertimagefromgallery.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/insertrule.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/insertrule.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/inserttable.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/inserttable.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/inserttablecolumn.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/inserttablecolumn.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/inserttablerow.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/inserttablerow.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/inserttime.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/inserttime.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/italic.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/italic.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/justifycenter.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/justifycenter.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/justifyfull.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/justifyfull.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/justifyleft.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/justifyleft.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/justifyright.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/justifyright.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/mode.design.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/mode.html.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/numberedlist.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/numberedlist.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/outdent.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/outdent.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/paste.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/paste.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/print.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/print.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/redo.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/redo.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/removeformat.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/removeformat.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/save.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/save.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/separator.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/spellcheck.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/spellcheck.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/strikethrough.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/strikethrough.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/subscript.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/subscript.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/superscript.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/superscript.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/toggleborders.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/toggledetails.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/toggledetails.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/toolbar.end.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/toolbar.start.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/underline.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/underline.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/undo.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/undo.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/unlink.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/unlink.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/verse.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/verse.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/wordclean.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/wordclean.over.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/wordcount.gif
.gif
Qy_book/NovelSearch/Images/ftb/officeXP/wordcount.over.gif
.gif
Qy_book/NovelSearch/Images/gg_on.gif
.gif
Qy_book/NovelSearch/Images/helper_arrow.gif
.gif
Qy_book/NovelSearch/Images/hover01.gif
.gif
Qy_book/NovelSearch/Images/htopbg.jpg
.jpg
Qy_book/NovelSearch/Images/icn_fun.gif
.gif
Qy_book/NovelSearch/Images/ico.gif
.gif
Qy_book/NovelSearch/Images/icon1.gif
.gif
Qy_book/NovelSearch/Images/icon2.gif
.gif
Qy_book/NovelSearch/Images/icon3.gif
.gif
Qy_book/NovelSearch/Images/icon4.gif
.gif
Qy_book/NovelSearch/Images/icon5.gif
.gif
Qy_book/NovelSearch/Images/icon_loading.gif
.gif
Qy_book/NovelSearch/Images/icon_mail.gif
.gif
Qy_book/NovelSearch/Images/idmax_bg1.gif
.gif
Qy_book/NovelSearch/Images/idmax_bg2.gif
.gif
Qy_book/NovelSearch/Images/idmax_bg3.gif
.gif
Qy_book/NovelSearch/Images/idmax_bg4.gif
.gif
Qy_book/NovelSearch/Images/idmax_user.png
.png
Qy_book/NovelSearch/Images/imgMain-1.jpg
.jpg
Qy_book/NovelSearch/Images/imgMain-2.gif
.gif
Qy_book/NovelSearch/Images/info_bgall.png
.png
Qy_book/NovelSearch/Images/info_btn.gif
.gif
Qy_book/NovelSearch/Images/info_icons.png
.png
Qy_book/NovelSearch/Images/linePage.gif
.gif
Qy_book/NovelSearch/Images/load.png
.png
Qy_book/NovelSearch/Images/loading.gif
.gif
Qy_book/NovelSearch/Images/loading_16x16.gif
.gif
Qy_book/NovelSearch/Images/login_ico.gif
.gif
Qy_book/NovelSearch/Images/loginbg.jpg
.jpg
Qy_book/NovelSearch/Images/m01.gif
.gif
Qy_book/NovelSearch/Images/m010.gif
.gif
Qy_book/NovelSearch/Images/m02.gif
.gif
Qy_book/NovelSearch/Images/m03.gif
.gif
Qy_book/NovelSearch/Images/m04.gif
.gif
Qy_book/NovelSearch/Images/m05.gif
.gif
Qy_book/NovelSearch/Images/m06.gif
.gif
Qy_book/NovelSearch/Images/m07.gif
.gif
Qy_book/NovelSearch/Images/m08.gif
.gif
Qy_book/NovelSearch/Images/m09.gif
.gif
Qy_book/NovelSearch/Images/mail.gif
.gif
Qy_book/NovelSearch/Images/mainBg.gif
.gif
Qy_book/NovelSearch/Images/mainBgBottom.gif
.gif
Qy_book/NovelSearch/Images/mbox-jt.gif
.gif
Qy_book/NovelSearch/Images/mm_on.gif
.gif
Qy_book/NovelSearch/Images/navBgArrowHover.jpg
.jpg
Qy_book/NovelSearch/Images/nav_bg.gif
.gif
Qy_book/NovelSearch/Images/new_an1.gif
.gif
Qy_book/NovelSearch/Images/new_an2.gif
.gif
Qy_book/NovelSearch/Images/new_an3.gif
.gif
Qy_book/NovelSearch/Images/new_an5.gif
.gif
Qy_book/NovelSearch/Images/noimg.gif
.gif
Qy_book/NovelSearch/Images/otherTopBg.gif
.gif
Qy_book/NovelSearch/Images/popup_close.gif
.gif
Qy_book/NovelSearch/Images/popup_dialog_1.png
.png
Qy_book/NovelSearch/Images/popup_dialog_2.png
.png
Qy_book/NovelSearch/Images/popwin_bg1.png
.png
Qy_book/NovelSearch/Images/reader.gif
.gif
Qy_book/NovelSearch/Images/reader_icon.gif
.gif
Qy_book/NovelSearch/Images/shadow.jpg
.jpg
Qy_book/NovelSearch/Images/tagBg_2.gif
.gif
Qy_book/NovelSearch/Images/textlogo.gif
.gif
Qy_book/NovelSearch/Images/titleBg.jpg
.jpg
Qy_book/NovelSearch/Images/tjy.gif
.gif
Qy_book/NovelSearch/Images/urs_btnbg.gif
.gif
Qy_book/NovelSearch/Images/v.gif
.gif
Qy_book/NovelSearch/Images/xbutton.gif
.gif
Qy_book/NovelSearch/Info/Error.aspx
Qy_book/NovelSearch/Installer/EULA.html
Qy_book/NovelSearch/Installer/EULA.txt
Qy_book/NovelSearch/Installer/Index.htm
.html
Qy_book/NovelSearch/Installer/Setup.aspx
.asp
Qy_book/NovelSearch/Installer/SqlScript/Imports.sql
Qy_book/NovelSearch/Installer/SqlScript/Procedures.sql
Qy_book/NovelSearch/Installer/SqlScript/Table.sql
Qy_book/NovelSearch/Installer/SqlScript/View.sql
Qy_book/NovelSearch/Installer/images/blcorner.gif
.gif
Qy_book/NovelSearch/Installer/images/brCorner.gif
.gif
Qy_book/NovelSearch/Installer/images/headerbg.gif
.gif
Qy_book/NovelSearch/Installer/images/printerIcon.gif
.gif
Qy_book/NovelSearch/Js/Ajax.js
.js
Qy_book/NovelSearch/Js/Check.js
.js
Qy_book/NovelSearch/Js/DateTime.js
.js
Qy_book/NovelSearch/Js/Form.js
.js
Qy_book/NovelSearch/Js/Hint.js
.js
Qy_book/NovelSearch/Js/boxover.js
.js
Qy_book/NovelSearch/Js/common.js
.js
Qy_book/NovelSearch/Js/commonpass.js
Qy_book/NovelSearch/Js/ntes.js
.js
Qy_book/NovelSearch/Js/photo_pro.js
Qy_book/NovelSearch/Js/prototype.js
.js
Qy_book/NovelSearch/Js/public.js
.js
Qy_book/NovelSearch/Js/tip.lib.js.fast.aspx
.js
Qy_book/NovelSearch/News/Contorl/TopNews.ascx
Qy_book/NovelSearch/News/Contorl/TopNewsText.ascx
Qy_book/NovelSearch/News/NewsList.aspx
Qy_book/NovelSearch/News/NewsText.aspx
Qy_book/NovelSearch/PrecompiledApp.config
Qy_book/NovelSearch/User/BookList.aspx
Qy_book/NovelSearch/User/BookMarkAjax.aspx
Qy_book/NovelSearch/User/BookMarkCookies.aspx
Qy_book/NovelSearch/User/ChangPass.aspx
.js
Qy_book/NovelSearch/User/Collect.aspx
Qy_book/NovelSearch/User/CollectDel.aspx
Qy_book/NovelSearch/User/DisposeEvent.aspx
Qy_book/NovelSearch/User/Edit.aspx
.js
Qy_book/NovelSearch/User/ForgetPass.aspx
.js
Qy_book/NovelSearch/User/Index.aspx
.js
Qy_book/NovelSearch/User/Login.aspx
Qy_book/NovelSearch/User/LoginAjax.aspx
Qy_book/NovelSearch/User/LoginCheck.aspx
.js
Qy_book/NovelSearch/User/Logout.aspx
Qy_book/NovelSearch/User/Recommend.aspx
Qy_book/NovelSearch/User/Reg.aspx
Qy_book/NovelSearch/User/RegtersSave.aspx
.js
Qy_book/NovelSearch/User/Transfer.aspx
Qy_book/NovelSearch/User/UserAjax.aspx
Qy_book/NovelSearch/User/ValidatorCode.aspx
Qy_book/NovelSearch/Web.Config.Bak
Qy_book/NovelSearch/Xml/Announce.xml
.xml
Qy_book/NovelSearch/Xml/FriendLink/NoImg.xml
Qy_book/NovelSearch/a.txt
Qy_book/NovelSearch/bin/Ajax.dll
.dll .js windows:4 windows x86 arch:x86 polyglot

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Qy_book/NovelSearch/bin/AspNetPager.dll
.dll .js windows:4 windows x86 arch:x86 polyglot

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Qy_book/NovelSearch/bin/FreeTextBox.dll
.dll .js windows:4 windows x86 arch:x86 polyglot

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\FTBv1-6-3-Source\obj\Debug\FreeTextBox.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 144KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Qy_book/NovelSearch/bin/MySql.Data.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Qy_book/NovelSearch/bin/OriSoft.BLL.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Qy_book/NovelSearch/bin/OriSoft.Code.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Qy_book/NovelSearch/bin/OriSoft.DAL.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Qy_book/NovelSearch/bin/OriSoft.DBUtility.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Qy_book/NovelSearch/bin/OriSoft.Model.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Qy_book/NovelSearch/bin/OriSoft.Web.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Qy_book/NovelSearch/bin/OriSoft.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

A6F86D2D67D9403eA725820C4EF210A2
A6F92A92B69B4082AB0F9C7A9C1FF10C
CheckRuntime
EC1DB9C1620C48588C4701045B242FA9
GetCpuID
GetDiskID
GetMacID
MainDLL

Sections

Size: 96KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 576KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Qy_book/NovelSearch/bin/Socut.Data.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.textxc
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Qy_book/NovelSearch/note.txt
Qy_book/NovelSearch/使用说明.url
.url
Qy_book/NovelSearch/起源网络小说搜索采集器.rar
.rar
Data/RunConfig.xml
.xml
Data/System.ini
IrisSkin2.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.textxc
Size: 528KB - Virtual size: 524KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.datax
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 86B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WanerSoft.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

A6F86D2D67D9403eA725820C4EF210A2
A6F92A92B69B4082AB0F9C7A9C1FF10C
CheckRuntime
EC1DB9C1620C48588C4701045B242FA9
GetCpuID
GetCpuIDW
GetDiskID
GetDiskIDW
GetMacID
GetMacIDW
MainDLL

Sections

Size: 96KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Themida
Size: 564KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
WizardBase.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\manish.ranjan\Documents\Visual Studio 2005\Projects\Presentation\WizardDemo\WizardBase\obj\Release\WizardBase.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 372KB - Virtual size: 368KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WsSearch.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 844KB - Virtual size: 844KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WsSearch.vshost.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\RTM\vsproject\vshost\vshostneutral\objr\i386\vshost.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
log/20080221.txt
log/20080222.txt
log/20080223.txt
log/20080224.txt
log/20080225.txt
log/20080226.txt
log/20080227.txt
log/20080817.txt
log/20081006.txt

Sharing

General

Malware Config

Signatures

Files

3f660cc84b8c808ecc7dd3c09ff66d06

Headers

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 476KB - Virtual size: 473KB

.rdata Size: 72KB - Virtual size: 69KB

.data Size: 20KB - Virtual size: 26KB

.idata Size: 4KB - Virtual size: 3KB

.reloc Size: 20KB - Virtual size: 19KB

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 56KB - Virtual size: 52KB

.rsrc Size: 4KB - Virtual size: 984B

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 96KB - Virtual size: 92KB

.rsrc Size: 4KB - Virtual size: 1000B

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 144KB - Virtual size: 142KB

.rsrc Size: 4KB - Virtual size: 952B

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 256KB - Virtual size: 255KB

.rsrc Size: 4KB - Virtual size: 896B

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 68KB - Virtual size: 68KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 44KB - Virtual size: 44KB

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 24KB - Virtual size: 24KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 476KB - Virtual size: 473KB

.rdata
Size: 72KB - Virtual size: 69KB

.data
Size: 20KB - Virtual size: 26KB

.idata
Size: 4KB - Virtual size: 3KB

.reloc
Size: 20KB - Virtual size: 19KB

.text
Size: 56KB - Virtual size: 52KB

.rsrc
Size: 4KB - Virtual size: 984B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 96KB - Virtual size: 92KB

.rsrc
Size: 4KB - Virtual size: 1000B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 144KB - Virtual size: 142KB

.rsrc
Size: 4KB - Virtual size: 952B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 256KB - Virtual size: 255KB

.rsrc
Size: 4KB - Virtual size: 896B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 68KB - Virtual size: 68KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 44KB - Virtual size: 44KB

.text
Size: 24KB - Virtual size: 24KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 16KB - Virtual size: 16KB

.text
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 4KB - Virtual size: 984B

.reloc
Size: 16KB - Virtual size: 12KB

.text
Size: 72KB - Virtual size: 72KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 72KB - Virtual size: 72KB

.text
Size: 52KB - Virtual size: 52KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 40KB - Virtual size: 40KB

.text
Size: 152KB - Virtual size: 152KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 100KB - Virtual size: 100KB

.rsrc
Size: 20KB - Virtual size: 17KB

.idata
Size: 4KB - Virtual size: 4KB

Themida
Size: 576KB - Virtual size: 1.3MB

.textxc
Size: 124KB - Virtual size: 121KB

.idata
Size: 4KB - Virtual size: 82B

.reloc
Size: 4KB - Virtual size: 12B

.rsrc
Size: 4KB - Virtual size: 1KB

.textxc
Size: 528KB - Virtual size: 524KB

.datax
Size: 4KB - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 86B

.reloc
Size: 4KB - Virtual size: 12B