37gamebox-9aa2b6[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

37gamebox-9aa2b6.exe
Size

4.0MB
MD5

00bdaffa33650e03967f652710eb860e
SHA1

fa9524c23a859bd6484ab6fe4445f6dc325ac9e4
SHA256

f48dc0c50fa47cd634a306fae192872f3c8ed20c80bafbca13c2902718fc9b4b
SHA512

625a6210c7fd3faa273ff2875a7e7849be60b7959e4adf0e562586d7b180965e9d28950fb08d3a901d745135c80d9703859ce837fb7a76a001a44f0ad834c7b7
SSDEEP

98304:yaqYR2ATy9Bj5qQ3oRNNj7zzrqw/jHzEY08+mik5C8QdGW:fRNIo5jbVHzEt8+mrMT

Score

3^/10

Malware Config

Signatures

Unsigned PE 20 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/BgWorker.dll
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/SkinBtn.dll
unpack001/$PLUGINSDIR/SkinProgress.dll
unpack001/$PLUGINSDIR/StdUtils.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/WndProc.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack002/$PLUGINSDIR/BgWorker.dll
unpack002/$PLUGINSDIR/FindProcDLL.dll
unpack002/$PLUGINSDIR/KillProcDLL.dll
unpack002/$PLUGINSDIR/SkinBtn.dll
unpack002/$PLUGINSDIR/SkinProgress.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/WndProc.dll
unpack002/$PLUGINSDIR/inetc.dll
unpack002/$PLUGINSDIR/nsDialogs.dll

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

Files

37gamebox-9aa2b6.exe
.exe windows:4 windows x86 arch:x86

ea4e67a31ace1a72683a99b80cf37830

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:b3:4b:34:a0:da:76:f3:e4:51:d9:e4:7a:15:db:ec
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/05/2023, 00:00

Not After

18/06/2025, 23:59

Subject

CN=上海硬通网络科技有限公司,O=上海硬通网络科技有限公司,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:ee:1f:b8:ae:82:99:24:c3:84:a2:74:d7:ac:0f:29:5a:8e:d1:92
Signer

Actual PE Digest

ca:ee:1f:b8:ae:82:99:24:c3:84:a2:74:d7:ac:0f:29:5a:8e:d1:92

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA

shell32

SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA

ole32

IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
GetSysColor
SetCursor
GetWindowLongA
SetClassLongA
SetWindowPos
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
GetTempFileNameA
RemoveDirectoryA
WriteFile
CreateDirectoryA
GetLastError
CreateProcessA
GlobalLock
GlobalUnlock
CreateThread
lstrcpynA
SetErrorMode
GetDiskFreeSpaceA
lstrlenA
GetCommandLineA
GetVersion
GetWindowsDirectoryA
SetEnvironmentVariableA
GetTempPathA
CopyFileA
GetCurrentProcess
ExitProcess
GetModuleFileNameA
GetFileSize
ReadFile
GetTickCount
Sleep
CreateFileA
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 104KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 293KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/BgWorker.dll
.dll windows:4 windows x86 arch:x86

db2755f409b81c4dbfc04f648cfb80b9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GetModuleHandleA
CloseHandle
SetThreadPriority
CreateThread

user32

IsWindowUnicode
PostMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects

Exports

Exports

CallAndWait

Sections

.text
Size: 1024B - Virtual size: 987B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 66B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/FindProcDLL.dll
.dll windows:6 windows x86 arch:x86

06dcb04c70882d779cebdc81fba96fc4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\37work\pc_code\tools\网络安装\FindProcDLL\Release\FindProcDLL.pdb

Imports

kernel32

VerSetConditionMask
CloseHandle
TerminateProcess
OpenProcess
GlobalFree
lstrcpyA
VerifyVersionInfoW
CreateToolhelp32Snapshot
Process32First
Process32Next
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW

user32

wsprintfA

vcruntime140

memset
__std_type_info_destroy_list
_except_handler4_common

api-ms-win-crt-string-l1-1-0

strlen
_strupr
strcmp
toupper

api-ms-win-crt-runtime-l1-1-0

terminate
_crt_atexit
_cexit
_crt_at_quick_exit
_initterm_e
_initterm
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment

api-ms-win-crt-convert-l1-1-0

_itoa

Exports

Exports

FindProc
KillProc

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:6 windows x86 arch:x86

6aa9a41e5d5d6fbd428a6608ec549db2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\whhit\Downloads\KillProcDLL-bin\Release\KillProcDLL.pdb

Imports

kernel32

CloseHandle
TerminateProcess
OpenProcess
GetVersionExA
FreeLibrary
GetProcAddress
GlobalFree
lstrcpyA
LoadLibraryA
CreateToolhelp32Snapshot
Process32First
Process32Next
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetCurrentThread
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetProcessHeap
GetStdHandle
GetFileType
SetConsoleCtrlHandler
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringA
OutputDebugStringW
WaitForSingleObjectEx
CreateThread
WriteConsoleW
EncodePointer
DecodePointer
CreateFileW
RaiseException

Exports

Exports

KillProc

Sections

.text
Size: 234KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 356B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/License.rtf
.rtf
$PLUGINSDIR/SkinBtn.dll
.dll windows:4 windows x86 arch:x86

baf2d405231cd43dae48df474a521d01

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GlobalAlloc
lstrcpynA
GetModuleHandleA
GlobalFree

user32

InvalidateRect
GetParent
SetWindowLongA
CallWindowProcA
GetPropA
SendMessageA
DrawTextA
DrawStateA
LoadImageA
RemovePropA
GetWindowLongA
SetPropA

gdi32

GetObjectA
CreateCompatibleDC
DeleteObject
SelectObject
DeleteDC
SetBkMode

msimg32

TransparentBlt

comctl32

_TrackMouseEvent

Exports

Exports

Init
Set
onClick

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 947B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SkinProgress.dll
.dll windows:4 windows x86 arch:x86

df38729be926f91d3390389029adf53b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GlobalAlloc
GlobalFree
GetModuleHandleA

user32

GetWindowRect
BeginPaint
GetWindowDC
CallWindowProcA
ReleaseDC
EndPaint
GetWindowLongA
GetPropA
SetPropA
SetWindowLongA
RemovePropA
LoadImageA
SendMessageA

gdi32

DeleteDC
BitBlt
CreateCompatibleBitmap
StretchBlt
SelectObject
CreateCompatibleDC
GetObjectA
DeleteObject

Exports

Exports

Set

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 797B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/StdUtils.dll
.dll windows:5 windows x86 arch:x86

ecbe1fbe5190eab5d326930114ad14a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

??3@YAXPAX@Z
isspace
_msize
setlocale
iscntrl
sscanf
_beginthreadex
time
srand
rand
clock
_getpid
_splitpath
strncpy
strchr
isgraph
__getmainargs
_strnicmp
_stricmp
calloc
free
_wcsicmp
_snprintf
swscanf
abort
??2@YAPAXI@Z
memset
memcpy

shlwapi

ord176

crypt32

CryptProtectData
CryptUnprotectData

kernel32

GlobalFree
MultiByteToWideChar
WideCharToMultiByte
InterlockedExchange
HeapValidate
InterlockedDecrement
InterlockedIncrement
GetSystemTime
OutputDebugStringA
DeleteCriticalSection
InitializeCriticalSection
SystemTimeToFileTime
TerminateThread
WaitForSingleObject
LocalFree
GetFullPathNameA
GetVersion
GetCommandLineA
GetVersionExA
LoadLibraryW
FreeLibrary
CloseHandle
lstrcpynA
GlobalAlloc
GetExitCodeProcess
LeaveCriticalSection
EnterCriticalSection
GetTickCount
Sleep
VerSetConditionMask
GetCurrentProcess
GetModuleHandleW
GetVersionExW
TerminateProcess
RaiseException
VerifyVersionInfoW
GetLastError
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
FatalAppExitA
CreateFileA
SetFilePointerEx
WriteFile
ReadFile
GetFileSizeEx
GetFileAttributesA

user32

MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
wsprintfA
DestroyWindow
SetTimer
KillTimer
LoadStringW
MessageBoxA
GetWindowThreadProcessId
AllowSetForegroundWindow
UnregisterClassA
CreateWindowExA
RegisterClassA

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

shell32

ShellExecuteExA
SHFileOperationA
ShellExecuteA

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

Exports

Exports

AppendToFile
ExecShellAsUser
ExecShellWaitEx
FormatStr
FormatStr2
FormatStr3
GetAllParameters
GetDays
GetDirectoryPart
GetDrivePart
GetExtensionPart
GetFileNamePart
GetHours
GetLibVersion
GetMinutes
GetOsEdition
GetOsReleaseId
GetOsReleaseName
GetParameter
GetParentPath
GetRealOsBuildNo
GetRealOsName
GetRealOsVersion
HashFile
HashText
InvokeShellVerb
NormalizePath
ParameterCnt
ParameterStr
ProtectStr
Rand
RandBytes
RandList
RandMax
RandMinMax
RevStr
SHFileCopy
SHFileMove
ScanStr
ScanStr2
ScanStr3
SetVerboseMode
SplitPath
StrFromUtf8
StrToUtf8
TestParameter
Time
TimerCreate
TimerDestroy
TrimStr
TrimStrLeft
TrimStrRight
UnprotectStr
ValidDomainName
ValidFileName
ValidPathSpec
VerifyRealOsBuildNo
VerifyRealOsVersion
WaitForProcEx

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

8c8a576201f68de1a3f26fc723b9f30f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/WndProc.dll
.dll windows:4 windows x86 arch:x86

b3f659d7637a91b4fec12ff9b930080d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpyA
GlobalAlloc

user32

CallWindowProcA
SetWindowLongA
GetPropA
SetPropA
wsprintfA

Exports

Exports

onCallback

Sections

.text
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 377B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/bg.bmp
$PLUGINSDIR/bgAgreement.bmp
$PLUGINSDIR/btn_agreement.bmp
$PLUGINSDIR/btn_close.bmp
$PLUGINSDIR/btn_custom.bmp
$PLUGINSDIR/btn_install.bmp
$PLUGINSDIR/btn_install1.bmp
$PLUGINSDIR/btn_next.bmp
$PLUGINSDIR/btn_ok1.bmp
$PLUGINSDIR/btn_path.bmp
$PLUGINSDIR/btn_return.bmp
$PLUGINSDIR/btn_run.bmp
$PLUGINSDIR/finish.bmp
$PLUGINSDIR/inetc.dll
.dll windows:6 windows x86 arch:x86

1bd45504e2ab3f32113ddb1874924eef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\soft\nsis\Inetc\Plugins\inetc.pdb

Imports

wininet

InternetErrorDlg
HttpQueryInfoA
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetOptionA
InternetQueryOptionA
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetCrackUrlA

comctl32

ord17

kernel32

GlobalFree
GlobalAlloc
WideCharToMultiByte
DeleteFileA
CreateFileA
GetModuleHandleA
LoadLibraryA
lstrlenA
MultiByteToWideChar
lstrcpyA
lstrcpynA
lstrcmpiA
lstrcmpA
GetTickCount
MulDiv
CloseHandle
SetFilePointer
ReadFile
lstrcatA
SleepEx
GetProcAddress
LocalAlloc
LocalFree
CreateThread
TerminateThread
GetLastError
WaitForSingleObject
GetFileSize
WriteFile

user32

SendDlgItemMessageA
SetTimer
KillTimer
EnableWindow
UpdateWindow
RedrawWindow
SetWindowTextA
GetWindowTextA
GetClientRect
GetWindowRect
MessageBoxA
GetWindowLongA
SetWindowLongA
GetParent
FindWindowExA
LoadIconA
IsDialogMessageA
SystemParametersInfoA
SetDlgItemTextA
wsprintfA
GetMessageA
TranslateMessage
DispatchMessageA
SendMessageA
PostMessageA
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
IsWindowVisible
CreateDialogParamA
GetDlgItem

Exports

Exports

get
head
post
put

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/kv1.bmp
$PLUGINSDIR/loading1.bmp
$PLUGINSDIR/loading2.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

ebc2d915841be8afc8fa1ee9f6850960

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc

user32

DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
GetPropA
CharPrevA
DrawFocusRect
GetWindowLongA
DrawTextA
GetClientRect
SetWindowLongA
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
MapWindowPoints
RemovePropA
GetWindowTextA

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsis7z.dll
.dll windows:6 windows x86 arch:x86

79e802507623a06d443318041e7ac7a7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LocalFree
FormatMessageA
FormatMessageW
GetFileInformationByHandle
SetLastError
DeviceIoControl
GetModuleHandleA
GetProcAddress
HeapAlloc
HeapFree
GetProcessHeap
GetModuleHandleW
GetSystemTimeAsFileTime
GetStdHandle
WaitForMultipleObjects
GetTickCount
GetConsoleMode
SetConsoleMode
AreFileApisANSI
SetFileApisToOEM
SetFileApisToANSI
GlobalAlloc
GlobalFree
lstrcpynA
lstrcpyA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetCurrentDirectoryA
GetCurrentDirectoryW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
RemoveDirectoryA
RemoveDirectoryW
SetFileAttributesA
CreateSemaphoreA
SetFileTime
GetTempPathW
GetTempPathA
GetCurrentProcessId
GetCurrentThreadId
MoveFileA
MoveFileW
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileW
GetFileAttributesA
GetFileAttributesW
SetEndOfFile
GetCurrentProcess
GetSystemInfo
GlobalMemoryStatus
GetProcessAffinityMask
IsProcessorFeaturePresent
DecodePointer
WriteConsoleW
HeapSize
GetStringTypeW
ReadConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
GetFileSizeEx
GetConsoleCP
FlushFileBuffers
GetFileType
CreateEventA
ReleaseSemaphore
WaitForSingleObject
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetVersionExA
VirtualFree
VirtualAlloc
GetLastError
CloseHandle
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileW
SetFileAttributesW
CreateFileA
HeapReAlloc
LCMapStringW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue

user32

CharUpperW
SendMessageA
FindWindowExA
GetDlgItem
wsprintfA
CharUpperA
SetWindowTextA

advapi32

LookupPrivilegeValueA
SetFileSecurityW
AdjustTokenPrivileges
OpenProcessToken

oleaut32

VariantClear
SysAllocStringLen
SysStringLen
SysAllocString
SysFreeString
VariantCopy

Exports

Exports

Extract
ExtractWithCallback
ExtractWithDetails

Sections

.text
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/welcome.bmp
$_47_/Head/1.png
.png
$_47_/Head/10.png
.png
$_47_/Head/10_login.png
.png
$_47_/Head/10_over.png
.png
$_47_/Head/11.png
.png
$_47_/Head/11_login.png
.png
$_47_/Head/11_over.png
.png
$_47_/Head/12.png
.png
$_47_/Head/12_login.png
.png
$_47_/Head/12_over.png
.png
$_47_/Head/13.png
.png
$_47_/Head/13_login.png
.png
$_47_/Head/13_over.png
.png
$_47_/Head/14.png
.png
$_47_/Head/14_login.png
.png
$_47_/Head/14_over.png
.png
$_47_/Head/15.png
.png
$_47_/Head/15_login.png
.png
$_47_/Head/15_over.png
.png
$_47_/Head/16.png
.png
$_47_/Head/16_login.png
.png
$_47_/Head/16_over.png
.png
$_47_/Head/17.png
.png
$_47_/Head/17_login.png
.png
$_47_/Head/17_over.png
.png
$_47_/Head/18.png
.png
$_47_/Head/18_login.png
.png
$_47_/Head/18_over.png
.png
$_47_/Head/1_login.png
.png
$_47_/Head/1_over.png
.png
$_47_/Head/2.png
.png
$_47_/Head/2_login.png
.png
$_47_/Head/2_over.png
.png
$_47_/Head/3.png
.png
$_47_/Head/3_login.png
.png
$_47_/Head/3_over.png
.png
$_47_/Head/4.png
.png
$_47_/Head/4_login.png
.png
$_47_/Head/4_over.png
.png
$_47_/Head/5.png
.png
$_47_/Head/5_login.png
.png
$_47_/Head/5_over.png
.png
$_47_/Head/6.png
.png
$_47_/Head/6_login.png
.png
$_47_/Head/6_over.png
.png
$_47_/Head/7.png
.png
$_47_/Head/7_login.png
.png
$_47_/Head/7_over.png
.png
$_47_/Head/8.png
.png
$_47_/Head/8_login.png
.png
$_47_/Head/8_over.png
.png
$_47_/Head/9.png
.png
$_47_/Head/9_login.png
.png
$_47_/Head/9_over.png
.png
$_47_/Skin/37Ϸ.jpg
.jpg
$_47_/Skin/37Ϸ/form_standalone_border.png
.png
$_47_/Skin/37Ϸ/game_bottom.png
.png
$_47_/Skin/37Ϸ/game_top.png
.png
$_47_/Skin/37Ϸ/home_down.png
.png
$_47_/Skin/37Ϸ/home_normal.png
.png
$_47_/Skin/37Ϸ/home_over.png
.png
$_47_/Skin/37Ϸ/search_down.png
.png
$_47_/Skin/37Ϸ/search_normal.png
.png
$_47_/Skin/37Ϸ/search_over.png
.png
$_47_/Skin/37Ϸ/shop_down.png
.png
$_47_/Skin/37Ϸ/shop_normal.png
.png
$_47_/Skin/37Ϸ/shop_over.png
.png
$_47_/Skin/37Ϸ/tab_head_sel_normal.png
.png
$_47_/Skin/37Ϸ/tingtingtop_down.png
.png
$_47_/Skin/37Ϸ/tingtingtop_normal.png
.png
$_47_/Skin/37Ϸ/tingtingtop_over.png
.png
$_47_/Skin/37Ϸ/web_button_down.png
.png
$_47_/Skin/37Ϸ/web_button_normal.png
.png
$_47_/Skin/37Ϸ/web_button_over.png
.png
$_47_/Skin/Default.jpg
.jpg
$_47_/Skin/Default/BottomBackground.bmp
$_47_/Skin/Default/Clear_Background.png
.png
$_47_/Skin/Default/Clear_down.png
.png
$_47_/Skin/Default/DownLoadForm_BK.bmp
$_47_/Skin/Default/DownLoadForm_Progress1.bmp
$_47_/Skin/Default/DownLoadForm_Progress2.bmp
$_47_/Skin/Default/Entergame_Down.png
.png
$_47_/Skin/Default/Entergame_Normal.png
.png
$_47_/Skin/Default/Entergame_Over.png
.png
$_47_/Skin/Default/FloatForm_Body.png
.png
$_47_/Skin/Default/FloatForm_Left.png
.png
$_47_/Skin/Default/FormExitMenu_Exit.png
.png
$_47_/Skin/Default/FormExitMenu_ExitOver.png
.png
$_47_/Skin/Default/FormExitMenu_Open.png
.png
$_47_/Skin/Default/FormExitMenu_OpenOver.png
.png
$_47_/Skin/Default/FormExitMenu_Set.png
.png
$_47_/Skin/Default/FormExitMenu_SetOver.png
.png
$_47_/Skin/Default/FormMain_Background.png
.png
$_47_/Skin/Default/FormMain_Close_Down.png
.png
$_47_/Skin/Default/FormMain_Close_Normal.png
.png
$_47_/Skin/Default/FormMain_Close_Over.png
.png
$_47_/Skin/Default/FormMain_Min_Down.png
.png
$_47_/Skin/Default/FormMain_Min_Normal.png
.png
$_47_/Skin/Default/FormMain_Min_Over.png
.png
$_47_/Skin/Default/FormMulAccount_Add_Normal.png
.png
$_47_/Skin/Default/FormMulAccount_Add_Over.png
.png
$_47_/Skin/Default/FormMulAccount_Delete.png
.png
$_47_/Skin/Default/FormMulAccount_Delete_Normal.png
.png
$_47_/Skin/Default/FormMulAccount_Delete_Over.png
.png
$_47_/Skin/Default/FormMulAccount_Edit.png
.png
$_47_/Skin/Default/FormMulAccount_Edit_Normal.png
.png
$_47_/Skin/Default/FormMulAccount_Edit_Over.png
.png
$_47_/Skin/Default/FormMulAccount_EnterGame_Normal.png
.png
$_47_/Skin/Default/FormMulAccount_EnterGame_Over.png
.png
$_47_/Skin/Default/FormMulAccount_Icon.png
.png
$_47_/Skin/Default/FormMulAccount_Line.jpg
.jpg
$_47_/Skin/Default/FormMulAccount_Line.png
.png
$_47_/Skin/Default/FormSetMenu_About.png
.png
$_47_/Skin/Default/FormSetMenu_AboutOver.png
.png
$_47_/Skin/Default/FormSetMenu_Commonproblem.png
.png
$_47_/Skin/Default/FormSetMenu_CommonproblemOver.png
.png
$_47_/Skin/Default/FormSetMenu_FeedBack.png
.png
$_47_/Skin/Default/FormSetMenu_FeedBackOver.png
.png
$_47_/Skin/Default/FormSetMenu_Officical.png
.png
$_47_/Skin/Default/FormSetMenu_OfficicalOver.png
.png
$_47_/Skin/Default/FormSetMenu_Set.png
.png
$_47_/Skin/Default/FormSetMenu_SetOver.png
.png
$_47_/Skin/Default/FormSetMenu_Version.png
.png
$_47_/Skin/Default/FormSetMenu_VersionOver.png
.png
$_47_/Skin/Default/FormUserMenu_Change.png
.png
$_47_/Skin/Default/FormUserMenu_Change_Over.png
.png
$_47_/Skin/Default/FormUserMenu_Safe.png
.png
$_47_/Skin/Default/FormUserMenu_Safe_Over.png
.png
$_47_/Skin/Default/Form_About_Logo.png
.png
$_47_/Skin/Default/Form_AddClock_Down.png
.png
$_47_/Skin/Default/Form_AddClock_Normal.png
.png
$_47_/Skin/Default/Form_AddClock_Over.png
.png
$_47_/Skin/Default/Form_Background.png
.png
$_47_/Skin/Default/Form_Boder.png
.png
$_47_/Skin/Default/Form_Bottom_Round.png
.png
$_47_/Skin/Default/Form_Checked.png
.png
$_47_/Skin/Default/Form_Chrome_ProBack.png
.png
$_47_/Skin/Default/Form_Chrome_ProPercent.png
.png
$_47_/Skin/Default/Form_Close_Down.png
.png
$_47_/Skin/Default/Form_Close_Normal.png
.png
$_47_/Skin/Default/Form_Close_Over.png
.png
$_47_/Skin/Default/Form_Cutline.png
.png
$_47_/Skin/Default/Form_Delete.png
.png
$_47_/Skin/Default/Form_Delete_Squarely.png
.png
$_47_/Skin/Default/Form_Doctor_Down.png
.png
$_47_/Skin/Default/Form_Doctor_Normal.png
.png
$_47_/Skin/Default/Form_Doctor_Over.png
.png
$_47_/Skin/Default/Form_Download_Progress.png
.png
$_47_/Skin/Default/Form_Download_Progress_Bg.png
.png
$_47_/Skin/Default/Form_DropDown_Normal.png
.png
$_47_/Skin/Default/Form_DropDown_Over.png
.png
$_47_/Skin/Default/Form_EditBg.png
.png
$_47_/Skin/Default/Form_Edit_Round.png
.png
$_47_/Skin/Default/Form_Edit_Squarely.png
.png
$_47_/Skin/Default/Form_Forbit_Icon.png
.png
$_47_/Skin/Default/Form_FullScreen_Exit.png
.png
$_47_/Skin/Default/Form_FullScreen_Exit_Over.png
.png
$_47_/Skin/Default/Form_FullScreen_Exit_down.png
.png
$_47_/Skin/Default/Form_FullScreen_Lock.png
.png
$_47_/Skin/Default/Form_FullScreen_Lock_Over.png
.png
$_47_/Skin/Default/Form_FullScreen_Lock_down.png
.png
$_47_/Skin/Default/Form_FullScreen_UnLock.png
.png
$_47_/Skin/Default/Form_FullScreen_UnLock_Over.png
.png
$_47_/Skin/Default/Form_FullScreen_UnLock_down.png
.png
$_47_/Skin/Default/Form_FullScreen_bg.png
.png
$_47_/Skin/Default/Form_Guide1.jpg
.jpg
$_47_/Skin/Default/Form_Help_Down.png
.png
$_47_/Skin/Default/Form_Help_Normal.png
.png
$_47_/Skin/Default/Form_Help_Over.png
.png
$_47_/Skin/Default/Form_Img_First.png
.png
$_47_/Skin/Default/Form_Img_Second.png
.png
$_47_/Skin/Default/Form_KMHook_Frame.png
.png
$_47_/Skin/Default/Form_Large_Clock.png
.png
$_47_/Skin/Default/Form_Left.png
.png
$_47_/Skin/Default/Form_Min1_Down.png
.png
$_47_/Skin/Default/Form_Min1_Normal.png
.png
$_47_/Skin/Default/Form_Min1_Over.png
.png
$_47_/Skin/Default/Form_Min_Down.png
.png
$_47_/Skin/Default/Form_Min_Normal.png
.png
$_47_/Skin/Default/Form_Min_Over.png
.png
$_47_/Skin/Default/Form_MulAccount_bg.png
.png
$_47_/Skin/Default/Form_OK_Down.png
.png
$_47_/Skin/Default/Form_OK_Down_Chrome.png
.png
$_47_/Skin/Default/Form_OK_Normal.png
.png
$_47_/Skin/Default/Form_OK_Normal_Chrome.png
.png
$_47_/Skin/Default/Form_OK_Over.png
.png
$_47_/Skin/Default/Form_OK_Over_Chrome.png
.png
$_47_/Skin/Default/Form_RemindBg.png
.png
$_47_/Skin/Default/Form_Restore_Hint.png
.png
$_47_/Skin/Default/Form_Right.png
.png
$_47_/Skin/Default/Form_ScanCode.png
.png
$_47_/Skin/Default/Form_Set_Background_Grey.png
.png
$_47_/Skin/Default/Form_Set_Background_White.png
.png
$_47_/Skin/Default/Form_Set_Bg_Down.png
.png
$_47_/Skin/Default/Form_Set_Bg_Normal.png
.png
$_47_/Skin/Default/Form_Set_Bg_Over.png
.png
$_47_/Skin/Default/Form_SideScanCode.png
.png
$_47_/Skin/Default/Form_Small_Clock.png
.png
$_47_/Skin/Default/Form_Stock_code.png
.png
$_47_/Skin/Default/Form_Tips_Icon.png
.png
$_47_/Skin/Default/Form_Title.png
.png
$_47_/Skin/Default/Form_Title1.png
.png
$_47_/Skin/Default/Form_Unchecked.png
.png
$_47_/Skin/Default/Form_Upgrade_Down.png
.png
$_47_/Skin/Default/Form_Upgrade_New.png
.png
$_47_/Skin/Default/Form_Upgrade_ProBack.png
.png
$_47_/Skin/Default/Form_Upgrade_ProPercent.png
.png
$_47_/Skin/Default/Form_Upgrade_Tips.png
.png
$_47_/Skin/Default/Frame_Boder.png
.png
$_47_/Skin/Default/Frame_Titlebg.png
.png
$_47_/Skin/Default/Frame_Titlebg1.png
.png
$_47_/Skin/Default/GameNews_Btn_Normal.png
.png
$_47_/Skin/Default/GameNews_Btn_Over.png
.png
$_47_/Skin/Default/Img_DownIcon.png
.png
$_47_/Skin/Default/KMHelp.jpg
.jpg
$_47_/Skin/Default/NetDisconTip.png
.png
$_47_/Skin/Default/NetProxyTip.png
.png
$_47_/Skin/Default/Progress_Back.png
.png
$_47_/Skin/Default/Progress_Point.png
.png
$_47_/Skin/Default/Progress_Roll.png
.png
$_47_/Skin/Default/Proxy_GameBlack.png
.png
$_47_/Skin/Default/Radio_Checked.png
.png
$_47_/Skin/Default/Radio_Unchecked.png
.png
$_47_/Skin/Default/Radiobtn_Checked.png
.png
$_47_/Skin/Default/Radiobtn_Unchecked.png
.png
$_47_/Skin/Default/Recharge_down.png
.png
$_47_/Skin/Default/Refresh_down.png
.png
$_47_/Skin/Default/ScrollBackground.png
.png
$_47_/Skin/Default/ScrollDown_Normal.png
.png
$_47_/Skin/Default/ScrollDown_Over.png
.png
$_47_/Skin/Default/ScrollDropdown_Normal.png
.png
$_47_/Skin/Default/ScrollDropdown_Over.png
.png
$_47_/Skin/Default/ScrollPercent_Normal.png
.png
$_47_/Skin/Default/ScrollPercent_Over.png
.png
$_47_/Skin/Default/ScrollUp_Normal.png
.png
$_47_/Skin/Default/ScrollUp_Over.png
.png
$_47_/Skin/Default/Signals0.png
.png
$_47_/Skin/Default/Signals1.png
.png
$_47_/Skin/Default/Signals2.png
.png
$_47_/Skin/Default/Signals3.png
.png
$_47_/Skin/Default/Signals4.png
.png
$_47_/Skin/Default/SkinDefine.xml
$_47_/Skin/Default/StandAlone_floating_background.png
.png
$_47_/Skin/Default/StandAlone_floating_button_close.png
.png
$_47_/Skin/Default/ThirdLogin11.png
.png
$_47_/Skin/Default/ThirdLogin12.png
.png
$_47_/Skin/Default/ThirdLogin13.png
.png
$_47_/Skin/Default/Tick_Off.png
.png
$_47_/Skin/Default/Tick_On.png
.png
$_47_/Skin/Default/UserMenu_Binding.png
.png
$_47_/Skin/Default/UserMenu_Binding_Over.png
.png
$_47_/Skin/Default/VIP0.png
.png
$_47_/Skin/Default/VIP1.png
.png
$_47_/Skin/Default/VIP2.png
.png
$_47_/Skin/Default/VIP3.png
.png
$_47_/Skin/Default/VIP4.png
.png
$_47_/Skin/Default/VIP5.png
.png
$_47_/Skin/Default/VIP6.png
.png
$_47_/Skin/Default/VIP7.png
.png
$_47_/Skin/Default/VIP8.png
.png
$_47_/Skin/Default/accelerate_b_down.png
.png
$_47_/Skin/Default/accelerate_b_normal.png
.png
$_47_/Skin/Default/accelerate_b_over.png
.png
$_47_/Skin/Default/accelerate_down.png
.png
$_47_/Skin/Default/accelerate_normal.png
.png
$_47_/Skin/Default/accelerate_over.png
.png
$_47_/Skin/Default/autoclear_normal.png
.png
$_47_/Skin/Default/autoclear_over.png
.png
$_47_/Skin/Default/autoclear_sel_normal.png
.png
$_47_/Skin/Default/autoclear_sel_over.png
.png
$_47_/Skin/Default/binding_floating_background.png
.png
$_47_/Skin/Default/btn_Clear_Down.png
.png
$_47_/Skin/Default/btn_Clear_Normal.png
.png
$_47_/Skin/Default/btn_Clear_Over.png
.png
$_47_/Skin/Default/btn_off.png
.png
$_47_/Skin/Default/btn_on.png
.png
$_47_/Skin/Default/bulletin_down.png
.png
$_47_/Skin/Default/bulletin_normal.png
.png
$_47_/Skin/Default/bulletin_over.png
.png
$_47_/Skin/Default/catechisml_down.png
.png
$_47_/Skin/Default/catechisml_normal.png
.png
$_47_/Skin/Default/catechisml_over.png
.png
$_47_/Skin/Default/chun_down.png
.png
$_47_/Skin/Default/chun_normal.png
.png
$_47_/Skin/Default/chun_over.png
.png
$_47_/Skin/Default/clear_icon.png
.png
$_47_/Skin/Default/clear_normal.png
.png
$_47_/Skin/Default/clear_over.png
.png
$_47_/Skin/Default/clock_down.png
.png
$_47_/Skin/Default/clock_icon.png
.png
$_47_/Skin/Default/clock_normal.png
.png
$_47_/Skin/Default/clock_over.png
.png
$_47_/Skin/Default/dns_icon.png
.png
$_47_/Skin/Default/dropdown_down.png
.png
$_47_/Skin/Default/dropdown_normal.png
.png
$_47_/Skin/Default/dropdown_over.png
.png
$_47_/Skin/Default/form_bottom.png
.png
$_47_/Skin/Default/form_remind_active.png
.png
$_47_/Skin/Default/form_remind_background.png
.png
$_47_/Skin/Default/form_remind_clock.png
.png
$_47_/Skin/Default/form_remind_close_down.png
.png
$_47_/Skin/Default/form_remind_close_normal.png
.png
$_47_/Skin/Default/form_remind_close_over.png
.png
$_47_/Skin/Default/form_remind_gift.png
.png
$_47_/Skin/Default/form_standalone_border.png
.png
$_47_/Skin/Default/form_standalone_boss.png
.png
$_47_/Skin/Default/form_standalone_button_down.png
.png
$_47_/Skin/Default/form_standalone_button_normal.png
.png
$_47_/Skin/Default/form_standalone_button_over.png
.png
$_47_/Skin/Default/form_standalone_mute.png
.png
$_47_/Skin/Default/form_standalone_recharge.png
.png
$_47_/Skin/Default/form_standalone_refresh.png
.png
$_47_/Skin/Default/form_standalone_standalone.png
.png
$_47_/Skin/Default/form_standalone_topmost.png
.png
$_47_/Skin/Default/form_standalone_topmost_sel.png
.png
$_47_/Skin/Default/form_standalone_voice.png
.png
$_47_/Skin/Default/formtt_Title.png
.png
$_47_/Skin/Default/formtt_boder.png
.png
$_47_/Skin/Default/formtt_close_down.png
.png
$_47_/Skin/Default/formtt_close_normal.png
.png
$_47_/Skin/Default/formtt_close_over.png
.png
$_47_/Skin/Default/formtt_min_down.png
.png
$_47_/Skin/Default/formtt_min_normal.png
.png
$_47_/Skin/Default/formtt_min_over.png
.png
$_47_/Skin/Default/formtt_top_down.png
.png
$_47_/Skin/Default/formtt_top_normal.png
.png
$_47_/Skin/Default/formtt_top_over.png
.png
$_47_/Skin/Default/formtt_under_down.png
.png
$_47_/Skin/Default/formtt_under_normal.png
.png
$_47_/Skin/Default/formtt_under_over.png
.png
$_47_/Skin/Default/fullscreen_down.png
.png
$_47_/Skin/Default/fullscreen_normal.png
.png
$_47_/Skin/Default/fullscreen_over.png
.png
$_47_/Skin/Default/fullscreen_sel_down.png
.png
$_47_/Skin/Default/fullscreen_sel_normal.png
.png
$_47_/Skin/Default/fullscreen_sel_over.png
.png
$_47_/Skin/Default/game_bbs_normal.png
.png
$_47_/Skin/Default/game_bbs_over.png
.png
$_47_/Skin/Default/game_boder.png
.png
$_47_/Skin/Default/game_boss_normal.png
.png
$_47_/Skin/Default/game_boss_over.png
.png
$_47_/Skin/Default/game_bottom.png
.png
$_47_/Skin/Default/game_close_down.bmp
$_47_/Skin/Default/game_close_down.png
.png
$_47_/Skin/Default/game_close_normal.png
.png
$_47_/Skin/Default/game_close_over.png
.png
$_47_/Skin/Default/game_doctor_down.png
.png
$_47_/Skin/Default/game_doctor_normal.png
.png
$_47_/Skin/Default/game_doctor_over.png
.png
$_47_/Skin/Default/game_left.bmp
$_47_/Skin/Default/game_max_down.png
.png
$_47_/Skin/Default/game_max_normal.png
.png
$_47_/Skin/Default/game_max_over.png
.png
$_47_/Skin/Default/game_message_down.png
.png
$_47_/Skin/Default/game_message_normal.png
.png
$_47_/Skin/Default/game_message_over.png
.png
$_47_/Skin/Default/game_min_down.png
.png
$_47_/Skin/Default/game_min_normal.png
.png
$_47_/Skin/Default/game_min_over.png
.png
$_47_/Skin/Default/game_nor_down.png
.png
$_47_/Skin/Default/game_nor_normal.png
.png
$_47_/Skin/Default/game_nor_over.png
.png
$_47_/Skin/Default/game_official_normal.png
.png
$_47_/Skin/Default/game_official_over.png
.png
$_47_/Skin/Default/game_right.bmp
$_47_/Skin/Default/game_right.png
.png
$_47_/Skin/Default/game_set_down.png
.png
$_47_/Skin/Default/game_set_normal.png
.png
$_47_/Skin/Default/game_set_over.png
.png
$_47_/Skin/Default/game_skin_down.png
.png
$_47_/Skin/Default/game_skin_normal.png
.png
$_47_/Skin/Default/game_skin_over.png
.png
$_47_/Skin/Default/game_top.png
.png
$_47_/Skin/Default/gift_down.png
.png
$_47_/Skin/Default/gift_normal.jpg
.jpg
$_47_/Skin/Default/gift_normal.png
.png
$_47_/Skin/Default/gift_over.jpg
.jpg
$_47_/Skin/Default/gift_over.png
.png
$_47_/Skin/Default/gm_down.png
.png
$_47_/Skin/Default/gm_floating_background.png
.png
$_47_/Skin/Default/gm_normal.png
.png
$_47_/Skin/Default/gm_over.png
.png
$_47_/Skin/Default/guide_close_normal.jpg
.jpg
$_47_/Skin/Default/guide_close_normal.png
.png
$_47_/Skin/Default/guide_close_over.jpg
.jpg
$_47_/Skin/Default/guide_close_over.png
.png
$_47_/Skin/Default/guide_next1_normal.jpg
.jpg
$_47_/Skin/Default/guide_next1_normal.png
.png
$_47_/Skin/Default/guide_next1_over.jpg
.jpg
$_47_/Skin/Default/guide_next1_over.png
.png
$_47_/Skin/Default/guide_next2 _over.png
.png
$_47_/Skin/Default/guide_next3_normal.jpg
.jpg
$_47_/Skin/Default/guide_next3_normal.png
.png
$_47_/Skin/Default/guide_next3_over.jpg
.jpg
$_47_/Skin/Default/guide_next3_over.png
.png
$_47_/Skin/Default/hidden_down.png
.png
$_47_/Skin/Default/hidden_normal.png
.png
$_47_/Skin/Default/hidden_over.png
.png
$_47_/Skin/Default/home_down.png
.png
$_47_/Skin/Default/home_normal.png
.png
$_47_/Skin/Default/home_over.png
.png
$_47_/Skin/Default/icon.png
.png
$_47_/Skin/Default/ie_icon.png
.png
$_47_/Skin/Default/img_kernel_tips1.png
.png
$_47_/Skin/Default/img_kernel_tips2.png
.png
$_47_/Skin/Default/kernel_icon_normal.png
.png
$_47_/Skin/Default/kernel_icon_over.png
.png
$_47_/Skin/Default/keyelves_down.png
.png
$_47_/Skin/Default/keyelves_normal.png
.png
$_47_/Skin/Default/keyelves_over.png
.png
$_47_/Skin/Default/keyelves_stop_down.png
.png
$_47_/Skin/Default/keyelves_stop_normal.png
.png
$_47_/Skin/Default/keyelves_stop_over.png
.png
$_47_/Skin/Default/menu_button_normal.png
.png
$_47_/Skin/Default/menu_button_over.png
.png
$_47_/Skin/Default/more_down.png
.png
$_47_/Skin/Default/more_normal.png
.png
$_47_/Skin/Default/more_over.png
.png
$_47_/Skin/Default/more_sel_down.png
.png
$_47_/Skin/Default/more_sel_normal.png
.png
$_47_/Skin/Default/more_sel_over.png
.png
$_47_/Skin/Default/multaccount_down.png
.png
$_47_/Skin/Default/multaccount_normal.png
.png
$_47_/Skin/Default/multaccount_over.png
.png
$_47_/Skin/Default/official_down.png
.png
$_47_/Skin/Default/official_normal.png
.png
$_47_/Skin/Default/official_over.png
.png
$_47_/Skin/Default/opensocks_down.png
.png
$_47_/Skin/Default/opensocks_normal.png
.png
$_47_/Skin/Default/opensocks_over.png
.png
$_47_/Skin/Default/progressbar.png
.png
$_47_/Skin/Default/progressbar_bg.png
.png
$_47_/Skin/Default/recharge_normal.png
.png
$_47_/Skin/Default/recharge_over.png
.png
$_47_/Skin/Default/record_down.png
.png
$_47_/Skin/Default/record_normal.png
.png
$_47_/Skin/Default/record_over.png
.png
$_47_/Skin/Default/record_unable.png
.png
$_47_/Skin/Default/refresh_normal.png
.png
$_47_/Skin/Default/refresh_over.png
.png
$_47_/Skin/Default/remind_down.png
.png
$_47_/Skin/Default/remind_normal.png
.png
$_47_/Skin/Default/remind_over.png
.png
$_47_/Skin/Default/replay_down.png
.png
$_47_/Skin/Default/replay_normal.png
.png
$_47_/Skin/Default/replay_over.png
.png
$_47_/Skin/Default/replay_unable.png
.png
$_47_/Skin/Default/right.bmp
$_47_/Skin/Default/search_down.png
.png
$_47_/Skin/Default/search_normal.png
.png
$_47_/Skin/Default/search_over.png
.png
$_47_/Skin/Default/service_down.png
.png
$_47_/Skin/Default/service_normal.png
.png
$_47_/Skin/Default/service_over.png
.png
$_47_/Skin/Default/shadow_frame.png
.png
$_47_/Skin/Default/shop_down.png
.png
$_47_/Skin/Default/shop_normal.png
.png
$_47_/Skin/Default/shop_over.png
.png
$_47_/Skin/Default/shortcut_down.png
.png
$_47_/Skin/Default/shortcut_normal.png
.png
$_47_/Skin/Default/shortcut_over.png
.png
$_47_/Skin/Default/shutdown_down.png
.png
$_47_/Skin/Default/shutdown_down_b.png
.png
$_47_/Skin/Default/shutdown_normal.png
.png
$_47_/Skin/Default/shutdown_normal_b.png
.png
$_47_/Skin/Default/shutdown_over.png
.png
$_47_/Skin/Default/shutdown_over_b.png
.png
$_47_/Skin/Default/sign_floating_background.png
.png
$_47_/Skin/Default/sign_floating_button_close.png
.png
$_47_/Skin/Default/signin_down.png
.png
$_47_/Skin/Default/signin_normal.png
.png
$_47_/Skin/Default/signin_over.png
.png
$_47_/Skin/Default/skin_over_frame.png
.png
$_47_/Skin/Default/skin_selected.png
.png
$_47_/Skin/Default/standalone_down.png
.png
$_47_/Skin/Default/standalone_normal.png
.png
$_47_/Skin/Default/standalone_over.png
.png
$_47_/Skin/Default/stop_down.png
.png
$_47_/Skin/Default/stop_normal.png
.png
$_47_/Skin/Default/stop_over.png
.png
$_47_/Skin/Default/stop_record_down.png
.png
$_47_/Skin/Default/stop_record_normal.png
.png
$_47_/Skin/Default/stop_record_over.png
.png
$_47_/Skin/Default/stop_replay_down.png
.png
$_47_/Skin/Default/stop_replay_normal.png
.png
$_47_/Skin/Default/stop_replay_over.png
.png
$_47_/Skin/Default/stop_unable.png
.png
$_47_/Skin/Default/switchkernel_b_normal.png
.png
$_47_/Skin/Default/switchkernel_b_over.png
.png
$_47_/Skin/Default/switchkernel_normal.png
.png
$_47_/Skin/Default/switchkernel_over.png
.png
$_47_/Skin/Default/tab_head_close_normal.png
.png
$_47_/Skin/Default/tab_head_close_over.png
.png
$_47_/Skin/Default/tab_head_normal.png
.png
$_47_/Skin/Default/tab_head_over.png
.png
$_47_/Skin/Default/tab_head_sel_normal.png
.png
$_47_/Skin/Default/taccelerate_down.png
.png
$_47_/Skin/Default/taccelerate_normal.png
.png
$_47_/Skin/Default/taccelerate_over.png
.png
$_47_/Skin/Default/tcatechisml_down.png
.png
$_47_/Skin/Default/tcatechisml_normal.png
.png
$_47_/Skin/Default/tcatechisml_over.png
.png
$_47_/Skin/Default/tclock_down.png
.png
$_47_/Skin/Default/tclock_normal.png
.png
$_47_/Skin/Default/tclock_over.png
.png
$_47_/Skin/Default/tick.png
.png
$_47_/Skin/Default/tingting_down.png
.png
$_47_/Skin/Default/tingting_floating_background.png
.png
$_47_/Skin/Default/tingting_floating_button_close.png
.png
$_47_/Skin/Default/tingting_normal.png
.png
$_47_/Skin/Default/tingting_over.png
.png
$_47_/Skin/Default/tingtingtop_down.png
.png
$_47_/Skin/Default/tingtingtop_normal.png
.png
$_47_/Skin/Default/tingtingtop_over.png
.png
$_47_/Skin/Default/tips_reddot.png
.png
$_47_/Skin/Default/tips_reddot2.png
.png
$_47_/Skin/Default/tkeyelves_down.png
.png
$_47_/Skin/Default/tkeyelves_normal.png
.png
$_47_/Skin/Default/tkeyelves_over.png
.png
$_47_/Skin/Default/tmultaccount_down.png
.png
$_47_/Skin/Default/tmultaccount_normal.png
.png
$_47_/Skin/Default/tmultaccount_over.png
.png
$_47_/Skin/Default/tool_button_down.png
.png
$_47_/Skin/Default/tool_button_normal.png
.png
$_47_/Skin/Default/tool_button_over.png
.png
$_47_/Skin/Default/tool_menu_normal.png
.png
$_47_/Skin/Default/tool_menu_over.png
.png
$_47_/Skin/Default/toolmanage_down.png
.png
$_47_/Skin/Default/toolmanage_normal.png
.png
$_47_/Skin/Default/toolmanage_over.png
.png
$_47_/Skin/Default/tshutdown_down.png
.png
$_47_/Skin/Default/tshutdown_normal.png
.png
$_47_/Skin/Default/tshutdown_over.png
.png
$_47_/Skin/Default/tvoice_down.png
.png
$_47_/Skin/Default/tvoice_normal.png
.png
$_47_/Skin/Default/tvoice_over.png
.png
$_47_/Skin/Default/voice_down.png
.png
$_47_/Skin/Default/voice_mute_down.png
.png
$_47_/Skin/Default/voice_mute_normal.png
.png
$_47_/Skin/Default/voice_mute_over.png
.png
$_47_/Skin/Default/voice_normal.png
.png
$_47_/Skin/Default/voice_over.png
.png
$_47_/Skin/Default/web_button_down.png
.png
$_47_/Skin/Default/web_button_normal.png
.png
$_47_/Skin/Default/web_button_over.png
.png
$_47_/Skin/Default/yx_down.png
.png
$_47_/Skin/Default/yx_normal.png
.png
$_47_/Skin/Default/yx_over.png
.png
$_47_/Skin/Waiting.jpg
.jpg
$_47_/Skin/ʹ֮ר.jpg
.jpg
$_47_/Skin/ʹ֮ר/form_standalone_border.png
.png
$_47_/Skin/ʹ֮ר/game_boder.png
.png
$_47_/Skin/ʹ֮ר/game_bottom.png
.png
$_47_/Skin/ʹ֮ר/game_top.png
.png
$_47_/Skin/ʹ֮ר/home_down.png
.png
$_47_/Skin/ʹ֮ר/home_normal.png
.png
$_47_/Skin/ʹ֮ר/home_over.png
.png
$_47_/Skin/ʹ֮ר/search_down.png
.png
$_47_/Skin/ʹ֮ר/search_normal.png
.png
$_47_/Skin/ʹ֮ר/search_over.png
.png
$_47_/Skin/ʹ֮ר/shop_down.png
.png
$_47_/Skin/ʹ֮ר/shop_normal.png
.png
$_47_/Skin/ʹ֮ר/shop_over.png
.png
$_47_/Skin/ʹ֮ר/tab_head_close_normal.png
.png
$_47_/Skin/ʹ֮ר/tab_head_normal.png
.png
$_47_/Skin/ʹ֮ר/tab_head_over.png
.png
$_47_/Skin/ʹ֮ר/tab_head_sel_normal.png
.png
$_47_/Skin/ʹ֮ר/tingtingtop_down.png
.png
$_47_/Skin/ʹ֮ר/tingtingtop_normal.png
.png
$_47_/Skin/ʹ֮ר/tingtingtop_over.png
.png
$_47_/Skin/ʹ֮ר/web_button_down.png
.png
$_47_/Skin/ʹ֮ר/web_button_normal.png
.png
$_47_/Skin/ʹ֮ר/web_button_over.png
.png
$_47_/Skin/.jpg
.jpg
$_47_/Skin//form_standalone_border.png
.png
$_47_/Skin//game_bottom.png
.png
$_47_/Skin//game_top.png
.png
$_47_/Skin//home_down.png
.png
$_47_/Skin//home_normal.png
.png
$_47_/Skin//home_over.png
.png
$_47_/Skin//search_down.png
.png
$_47_/Skin//search_normal.png
.png
$_47_/Skin//search_over.png
.png
$_47_/Skin//shop_down.png
.png
$_47_/Skin//shop_normal.png
.png
$_47_/Skin//shop_over.png
.png
$_47_/Skin//tab_head_close_normal.png
.png
$_47_/Skin//tab_head_sel_normal.png
.png
$_47_/Skin//tingtingtop_down.png
.png
$_47_/Skin//tingtingtop_normal.png
.png
$_47_/Skin//tingtingtop_over.png
.png
$_47_/Skin//web_button_down.png
.png
$_47_/Skin//web_button_normal.png
.png
$_47_/Skin//web_button_over.png
.png
$_47_/Skin/Լר.jpg
.jpg
$_47_/Skin/Լר/form_standalone_border.png
.png
$_47_/Skin/Լר/game_boder.png
.png
$_47_/Skin/Լר/game_bottom.png
.png
$_47_/Skin/Լר/game_top.png
.png
$_47_/Skin/Լר/home_down.png
.png
$_47_/Skin/Լר/home_normal.png
.png
$_47_/Skin/Լר/home_over.png
.png
$_47_/Skin/Լר/search_down.png
.png
$_47_/Skin/Լר/search_normal.png
.png
$_47_/Skin/Լר/search_over.png
.png
$_47_/Skin/Լר/shop_down.png
.png
$_47_/Skin/Լר/shop_normal.png
.png
$_47_/Skin/Լר/shop_over.png
.png
$_47_/Skin/Լר/tab_head_close_normal.png
.png
$_47_/Skin/Լר/tab_head_normal.png
.png
$_47_/Skin/Լר/tab_head_over.png
.png
$_47_/Skin/Լר/tab_head_sel_normal.png
.png
$_47_/Skin/Լר/tingtingtop_down.png
.png
$_47_/Skin/Լר/tingtingtop_normal.png
.png
$_47_/Skin/Լר/tingtingtop_over.png
.png
$_47_/Skin/Լר/tool_button_down.png
.png
$_47_/Skin/Լר/tool_button_normal.png
.png
$_47_/Skin/Լר/tool_button_over.png
.png
$_47_/Skin/Լר/web_button_down.png
.png
$_47_/Skin/Լר/web_button_normal.png
.png
$_47_/Skin/Լר/web_button_over.png
.png
$_47_/Skin/Ҷ.jpg
.jpg
$_47_/Skin/Ҷ/form_standalone_border.png
.png
$_47_/Skin/Ҷ/game_bottom.png
.png
$_47_/Skin/Ҷ/game_top.png
.png
$_47_/Skin/Ҷ/home_down.png
.png
$_47_/Skin/Ҷ/home_normal.png
.png
$_47_/Skin/Ҷ/home_over.png
.png
$_47_/Skin/Ҷ/search_down.png
.png
$_47_/Skin/Ҷ/search_normal.png
.png
$_47_/Skin/Ҷ/search_over.png
.png
$_47_/Skin/Ҷ/shop_down.png
.png
$_47_/Skin/Ҷ/shop_normal.png
.png
$_47_/Skin/Ҷ/shop_over.png
.png
$_47_/Skin/Ҷ/tab_head_close_normal.png
.png
$_47_/Skin/Ҷ/tab_head_sel_normal.png
.png
$_47_/Skin/Ҷ/tingtingtop_down.png
.png
$_47_/Skin/Ҷ/tingtingtop_normal.png
.png
$_47_/Skin/Ҷ/tingtingtop_over.png
.png
$_47_/Skin/Ҷ/web_button_down.png
.png
$_47_/Skin/Ҷ/web_button_normal.png
.png
$_47_/Skin/Ҷ/web_button_over.png
.png
$_47_/Skin/.jpg
.jpg
$_47_/Skin//form_standalone_border.png
.png
$_47_/Skin//game_bottom.png
.png
$_47_/Skin//game_top.png
.png
$_47_/Skin//home_down.png
.png
$_47_/Skin//home_normal.png
.png
$_47_/Skin//home_over.png
.png
$_47_/Skin//search_down.png
.png
$_47_/Skin//search_normal.png
.png
$_47_/Skin//search_over.png
.png
$_47_/Skin//shop_down.png
.png
$_47_/Skin//shop_normal.png
.png
$_47_/Skin//shop_over.png
.png
$_47_/Skin//tab_head_close_normal.png
.png
$_47_/Skin//tab_head_sel_normal.png
.png
$_47_/Skin//tingtingtop_down.png
.png
$_47_/Skin//tingtingtop_normal.png
.png
$_47_/Skin//tingtingtop_over.png
.png
$_47_/Skin//web_button_down.png
.png
$_47_/Skin//web_button_normal.png
.png
$_47_/Skin//web_button_over.png
.png
$_47_/Skin/ִ.jpg
.jpg
$_47_/Skin/ִ/form_standalone_border.png
.png
$_47_/Skin/ִ/game_bottom.png
.png
$_47_/Skin/ִ/game_top.png
.png
$_47_/Skin/ִ/home_down.png
.png
$_47_/Skin/ִ/home_normal.png
.png
$_47_/Skin/ִ/home_over.png
.png
$_47_/Skin/ִ/search_down.png
.png
$_47_/Skin/ִ/search_normal.png
.png
$_47_/Skin/ִ/search_over.png
.png
$_47_/Skin/ִ/shop_down.png
.png
$_47_/Skin/ִ/shop_normal.png
.png
$_47_/Skin/ִ/shop_over.png
.png
$_47_/Skin/ִ/tab_head_close_normal.png
.png
$_47_/Skin/ִ/tab_head_sel_normal.png
.png
$_47_/Skin/ִ/tingtingtop_down.png
.png
$_47_/Skin/ִ/tingtingtop_normal.png
.png
$_47_/Skin/ִ/tingtingtop_over.png
.png
$_47_/Skin/ִ/web_button_down.png
.png
$_47_/Skin/ִ/web_button_normal.png
.png
$_47_/Skin/ִ/web_button_over.png
.png
$_47_/Skin/´.jpg
.jpg
$_47_/Skin/´/form_standalone_border.png
.png
$_47_/Skin/´/game_bottom.png
.png
$_47_/Skin/´/game_top.png
.png
$_47_/Skin/´/home_down.png
.png
$_47_/Skin/´/home_normal.png
.png
$_47_/Skin/´/home_over.png
.png
$_47_/Skin/´/search_down.png
.png
$_47_/Skin/´/search_normal.png
.png
$_47_/Skin/´/search_over.png
.png
$_47_/Skin/´/shop_down.png
.png
$_47_/Skin/´/shop_normal.png
.png
$_47_/Skin/´/shop_over.png
.png
$_47_/Skin/´/tab_head_close_normal.png
.png
$_47_/Skin/´/tab_head_sel_normal.png
.png
$_47_/Skin/´/tingtingtop_down.png
.png
$_47_/Skin/´/tingtingtop_normal.png
.png
$_47_/Skin/´/tingtingtop_over.png
.png
$_47_/Skin/´/web_button_down.png
.png
$_47_/Skin/´/web_button_normal.png
.png
$_47_/Skin/´/web_button_over.png
.png
$_47_/Skin/ǿ.jpg
.jpg
$_47_/Skin/ǿ/form_standalone_border.png
.png
$_47_/Skin/ǿ/game_bottom.png
.png
$_47_/Skin/ǿ/game_top.png
.png
$_47_/Skin/ǿ/home_down.png
.png
$_47_/Skin/ǿ/home_normal.png
.png
$_47_/Skin/ǿ/home_over.png
.png
$_47_/Skin/ǿ/search_down.png
.png
$_47_/Skin/ǿ/search_normal.png
.png
$_47_/Skin/ǿ/search_over.png
.png
$_47_/Skin/ǿ/shop_down.png
.png
$_47_/Skin/ǿ/shop_normal.png
.png
$_47_/Skin/ǿ/shop_over.png
.png
$_47_/Skin/ǿ/tab_head_sel_normal.png
.png
$_47_/Skin/ǿ/tingtingtop_down.png
.png
$_47_/Skin/ǿ/tingtingtop_normal.png
.png
$_47_/Skin/ǿ/tingtingtop_over.png
.png
$_47_/Skin/ǿ/web_button_down.png
.png
$_47_/Skin/ǿ/web_button_normal.png
.png
$_47_/Skin/ǿ/web_button_over.png
.png
$_47_/Web/error.html
.html .js polyglot
$_47_/Web/img1.png
.png
$_47_/Web/img2.png
.png
$_47_/config.ini
$_47_/option.ini
$_47_/plugin.txt
Service.ico
gamebox.exe
.exe windows:5 windows x86 arch:x86

cae098253209b15a9fdaebc08dcf5935

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:b3:4b:34:a0:da:76:f3:e4:51:d9:e4:7a:15:db:ec
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/05/2023, 00:00

Not After

18/06/2025, 23:59

Subject

CN=上海硬通网络科技有限公司,O=上海硬通网络科技有限公司,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9b:8d:78:50:7f:73:f6:f5:12:db:1b:80:6d:bc:54:7b:4c:d9:39:e3
Signer

Actual PE Digest

9b:8d:78:50:7f:73:f6:f5:12:db:1b:80:6d:bc:54:7b:4c:d9:39:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\37work\pc_code\gamebox\gamebox_v7000\04code\bin\Release\gamebox.pdb

Imports

libcef

cef_register_widevine_cdm
cef_api_hash
cef_string_map_alloc
cef_string_map_free
cef_command_line_create
cef_command_line_get_global
cef_dictionary_value_create
cef_image_create
cef_list_value_create
cef_request_context_get_global_context
cef_request_context_create_context
cef_create_context_shared
cef_string_multimap_alloc
cef_string_multimap_free
cef_request_create
cef_post_data_create
cef_post_data_element_create
cef_cookie_manager_get_global_manager
cef_server_create
cef_stream_reader_create_for_data
cef_stream_reader_create_for_handler
cef_menu_model_create
cef_menu_button_create
cef_panel_create
cef_browser_view_create
cef_window_create_top_level
cef_textfield_create
cef_label_button_create
cef_process_message_create
cef_v8value_create_undefined
cef_v8value_create_null
cef_v8value_create_bool
cef_v8value_create_int
cef_v8value_create_uint
cef_v8value_create_double
cef_v8value_create_date
cef_v8value_create_string
cef_v8value_create_object
cef_v8value_create_array
cef_v8value_create_array_buffer
cef_v8value_create_function
cef_v8context_get_current_context
cef_string_list_size
cef_string_list_value
cef_string_list_append
cef_string_map_size
cef_string_map_key
cef_string_map_value
cef_string_map_append
cef_string_multimap_size
cef_string_multimap_key
cef_string_multimap_value
cef_string_multimap_append
cef_string_list_clear
cef_parse_url
cef_load_crlsets_file
cef_set_crash_key_value
cef_crash_reporting_enabled
cef_enable_highdpi_support
cef_quit_message_loop
cef_do_message_loop_work
cef_shutdown
cef_initialize
cef_execute_process
cef_string_utf16_to_utf8
cef_string_utf8_to_utf16
cef_string_utf8_clear
cef_string_utf16_set
cef_string_utf16_cmp
cef_time_to_timet
cef_get_min_log_level
cef_get_current_platform_thread_id
cef_string_ascii_to_utf16
cef_string_utf16_to_lower
cef_time_now
cef_time_delta
cef_register_extension
cef_post_task
cef_currently_on
cef_browser_host_create_browser
cef_string_list_free
cef_string_list_alloc
cef_value_create
cef_string_userfree_utf16_free
cef_log
cef_visit_web_plugin_info
cef_end_tracing
cef_begin_tracing
cef_get_path
cef_write_json
cef_parse_jsonand_return_error
cef_parse_json
cef_uriencode
cef_base64encode
cef_get_mime_type
cef_run_message_loop
cef_string_utf16_clear

comctl32

_TrackMouseEvent

shlwapi

StrCmpW
StrToIntW
PathFileExistsW
StrCpyW

ws2_32

closesocket
select
listen
getsockname
send
recvfrom
recv
connect
bind
sendto
ioctlsocket
setsockopt
WSAGetLastError
WSACleanup
WSAStartup
inet_ntoa
gethostbyname
shutdown
__WSAFDIsSet
inet_addr
htons
getsockopt
socket
accept

shell32

SHGetFolderPathW
Shell_NotifyIconW
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
SHFileOperationW

ole32

CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
OleUninitialize
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
CoInitialize
CoTaskMemRealloc
CoCreateGuid
CoInitializeEx

oleaut32

SysFreeString
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnaccessData
VariantInit
VariantClear
VariantChangeType
SysStringLen
SysAllocString
SafeArrayPutElement
LoadRegTypeLi
LoadTypeLi
DispCallFunc
OleCreateFontIndirect
SysAllocStringLen
VariantTimeToSystemTime
SystemTimeToVariantTime
VarUI4FromStr
SafeArrayCreate

advapi32

RegCreateKeyExW
RegOpenKeyExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
IsTextUnicode
RegEnumKeyExW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyW

user32

RemovePropW
GetSubMenu
BeginDeferWindowPos
CopyRect
IsWindowEnabled
SetPropW
LoadIconW
EndDeferWindowPos
RemoveMenu
SetTimer
GetMessageW
LoadAcceleratorsW
DispatchMessageW
IsDialogMessageW
TranslateAcceleratorW
TranslateMessage
PostQuitMessage
RegisterWindowMessageW
MessageBoxW
GetAncestor
SetParent
EnumDisplaySettingsW
GetForegroundWindow
UnionRect
GetAsyncKeyState
GetSystemMetrics
GetCursorPos
ReleaseDC
GetDC
EnableWindow
SetWindowRgn
UpdateLayeredWindow
EndPaint
BeginPaint
SetForegroundWindow
IsIconic
SystemParametersInfoW
IsWindowVisible
GetFocus
PostMessageW
SetFocus
ClientToScreen
UpdateWindow
FillRect
SetWindowTextW
ShowWindow
SetWindowPos
GetWindowTextW
DestroyWindow
IsWindow
InflateRect
DrawTextW
LoadImageW
CallWindowProcW
GetWindowLongW
OffsetRect
GetClientRect
RedrawWindow
SetCursor
PtInRect
CreateWindowExW
DestroyAcceleratorTable
GetDesktopWindow
InvalidateRect
InvalidateRgn
MoveWindow
CreateAcceleratorTableW
CharNextW
GetSysColor
GetClassNameW
GetDlgItem
GetWindow
GetWindowTextLengthW
SetLayeredWindowAttributes
SetRect
LoadMenuW
DestroyMenu
TrackPopupMenu
RegisterHotKey
UnregisterHotKey
GetWindowPlacement
SetWindowPlacement
PeekMessageW
ExitWindowsEx
EnumChildWindows
GetPropW
GetMenu
AdjustWindowRectEx
DeferWindowPos
LoadCursorW
GetClassInfoExW
RegisterClassExW
KillTimer
LoadStringW
GetKeyState
GetWindowRect
SetCapture
ReleaseCapture
IsChild
DefWindowProcW
GetParent
ScreenToClient
SendMessageW
SetWindowLongW
UnregisterClassW

gdi32

GetStockObject
GetPixel
GetDeviceCaps
SetRectRgn
CreateRectRgn
PtInRegion
CombineRgn
ExtTextOutW
SetBkColor
CreateRoundRectRgn
CreateCompatibleBitmap
CreateSolidBrush
CreateFontW
RestoreDC
SetTextColor
SetBkMode
SaveDC
GetObjectW
SetDIBColorTable
SelectObject
GetDIBColorTable
DeleteObject
CreateDIBSection
BitBlt
CreateCompatibleDC
DeleteDC
StretchBlt

kernel32

TlsAlloc
WaitForSingleObjectEx
DuplicateHandle
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
GetCPInfo
CompareStringW
SetFilePointerEx
ReadConsoleW
TlsGetValue
GetCurrentDirectoryW
SetStdHandle
MoveFileExW
FlushFileBuffers
GetFileAttributesExW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
LCMapStringW
GetLocaleInfoW
UnhandledExceptionFilter
ResetEvent
TlsSetValue
TlsFree
TryEnterCriticalSection
GetCurrentThread
GetThreadTimes
LocalFree
LocalAlloc
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetTempPathW
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
ReleaseMutex
CreateMutexW
LoadLibraryExW
lstrcmpiW
SetUnhandledExceptionFilter
WriteProcessMemory
CreateDirectoryW
GetStartupInfoW
MoveFileW
CreateThread
GlobalFree
WinExec
GlobalAddAtomW
TerminateProcess
CopyFileW
GetLocalTime
lstrcmpW
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
IsBadWritePtr
SetProcessWorkingSetSize
OpenProcess
GetSystemTimeAsFileTime
GetFileAttributesW
FindClose
SleepEx
OutputDebugStringW
WaitForMultipleObjectsEx
InitializeCriticalSectionAndSpinCount
GetModuleHandleExW
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
DecodePointer
lstrcpyA
GetModuleFileNameW
FindFirstFileW
GlobalMemoryStatusEx
GetSystemInfo
DeviceIoControl
SetPriorityClass
SetProcessAffinityMask
GetProcessAffinityMask
GetCurrentProcess
GetCommandLineW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetVersionExW
MultiByteToWideChar
GetThreadPriority
ResumeThread
SetThreadPriority
TerminateThread
DeleteFileW
WaitForSingleObject
WriteFile
SetEvent
CreateEventW
InitializeCriticalSection
FreeLibrary
LoadLibraryW
Sleep
GetTickCount
SetLastError
RaiseException
GetCurrentThreadId
InitializeCriticalSectionEx
DeleteCriticalSection
GetLastError
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetModuleHandleA
VirtualProtect
ReleaseSemaphore
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitProcess
VirtualQuery
ExitThread
GetDriveTypeW
GetFullPathNameW
GetFullPathNameA
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
GetStdHandle
GetACP
GetConsoleCP
GetConsoleMode
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
CreateProcessW
EnumSystemLocalesW
lstrlenW
FindNextFileW
CreateFileW
ReadFile
CloseHandle
WideCharToMultiByte
SizeofResource
LockResource
LoadResource

msimg32

AlphaBlend
TransparentBlt

winmm

waveOutOpen
waveOutClose
waveOutGetVolume
PlaySoundW
waveOutSetVolume

gdiplus

GdipDisposeImage
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipAlloc
GdipGetImagePalette
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdipGetImagePaletteSize
GdiplusShutdown
GdipFree

iphlpapi

GetAdaptersInfo
GetNetworkParams

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetSetCookieExW
FindFirstUrlCacheEntryW
InternetQueryDataAvailable
InternetCloseHandle
InternetReadFile
InternetGetCookieExW
HttpSendRequestW
DeleteUrlCacheEntryW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetCrackUrlW
InternetGetConnectedState
FindCloseUrlCache
FindNextUrlCacheEntryW
HttpQueryInfoW

easyhook32

_LhUninstallHook@4
_LhUninstallAllHooks@0
_LhSetExclusiveACL@12
_LhInstallHook@16
_LhWaitForPendingRemovals@0

dbghelp

MiniDumpWriteDump

sensapi

IsNetworkAlive

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 588KB - Virtual size: 588KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 300KB - Virtual size: 300KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lander.ico
uninst.exe
.exe windows:4 windows x86 arch:x86

ced282d9b261d1462772017fe2f6972b

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:b3:4b:34:a0:da:76:f3:e4:51:d9:e4:7a:15:db:ec
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/05/2023, 00:00

Not After

18/06/2025, 23:59

Subject

CN=上海硬通网络科技有限公司,O=上海硬通网络科技有限公司,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:d9:86:38:60:48:ff:25:90:5a:35:c4:a1:1a:9b:21:fd:33:4a:f0
Signer

Actual PE Digest

71:d9:86:38:60:48:ff:25:90:5a:35:c4:a1:1a:9b:21:fd:33:4a:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA

shell32

SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA

ole32

IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
GetSysColor
SetCursor
GetWindowLongA
SetClassLongA
SetWindowPos
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
ReadFile
GetTempFileNameA
WriteFile
RemoveDirectoryA
CreateProcessA
CreateFileA
GetLastError
CreateThread
CreateDirectoryA
GlobalUnlock
GetDiskFreeSpaceA
GlobalLock
SetErrorMode
GetVersion
lstrcpynA
GetCommandLineA
GetTempPathA
lstrlenA
SetEnvironmentVariableA
ExitProcess
GetWindowsDirectoryA
GetCurrentProcess
GetModuleFileNameA
CopyFileA
GetTickCount
Sleep
GetFileSize
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 104KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 293KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/BgWorker.dll
.dll windows:4 windows x86 arch:x86

db2755f409b81c4dbfc04f648cfb80b9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GetModuleHandleA
CloseHandle
SetThreadPriority
CreateThread

user32

IsWindowUnicode
PostMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects

Exports

Exports

CallAndWait

Sections

.text
Size: 1024B - Virtual size: 987B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 66B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/FindProcDLL.dll
.dll windows:6 windows x86 arch:x86

06dcb04c70882d779cebdc81fba96fc4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\37work\pc_code\tools\网络安装\FindProcDLL\Release\FindProcDLL.pdb

Imports

kernel32

VerSetConditionMask
CloseHandle
TerminateProcess
OpenProcess
GlobalFree
lstrcpyA
VerifyVersionInfoW
CreateToolhelp32Snapshot
Process32First
Process32Next
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW

user32

wsprintfA

vcruntime140

memset
__std_type_info_destroy_list
_except_handler4_common

api-ms-win-crt-string-l1-1-0

strlen
_strupr
strcmp
toupper

api-ms-win-crt-runtime-l1-1-0

terminate
_crt_atexit
_cexit
_crt_at_quick_exit
_initterm_e
_initterm
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment

api-ms-win-crt-convert-l1-1-0

_itoa

Exports

Exports

FindProc
KillProc

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:6 windows x86 arch:x86

6aa9a41e5d5d6fbd428a6608ec549db2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\whhit\Downloads\KillProcDLL-bin\Release\KillProcDLL.pdb

Imports

kernel32

CloseHandle
TerminateProcess
OpenProcess
GetVersionExA
FreeLibrary
GetProcAddress
GlobalFree
lstrcpyA
LoadLibraryA
CreateToolhelp32Snapshot
Process32First
Process32Next
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetCurrentThread
GetACP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetProcessHeap
GetStdHandle
GetFileType
SetConsoleCtrlHandler
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringA
OutputDebugStringW
WaitForSingleObjectEx
CreateThread
WriteConsoleW
EncodePointer
DecodePointer
CreateFileW
RaiseException

Exports

Exports

KillProc

Sections

.text
Size: 234KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 356B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SkinBtn.dll
.dll windows:4 windows x86 arch:x86

baf2d405231cd43dae48df474a521d01

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GlobalAlloc
lstrcpynA
GetModuleHandleA
GlobalFree

user32

InvalidateRect
GetParent
SetWindowLongA
CallWindowProcA
GetPropA
SendMessageA
DrawTextA
DrawStateA
LoadImageA
RemovePropA
GetWindowLongA
SetPropA

gdi32

GetObjectA
CreateCompatibleDC
DeleteObject
SelectObject
DeleteDC
SetBkMode

msimg32

TransparentBlt

comctl32

_TrackMouseEvent

Exports

Exports

Init
Set
onClick

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 947B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SkinProgress.dll
.dll windows:4 windows x86 arch:x86

df38729be926f91d3390389029adf53b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GlobalAlloc
GlobalFree
GetModuleHandleA

user32

GetWindowRect
BeginPaint
GetWindowDC
CallWindowProcA
ReleaseDC
EndPaint
GetWindowLongA
GetPropA
SetPropA
SetWindowLongA
RemovePropA
LoadImageA
SendMessageA

gdi32

DeleteDC
BitBlt
CreateCompatibleBitmap
StretchBlt
SelectObject
CreateCompatibleDC
GetObjectA
DeleteObject

Exports

Exports

Set

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 797B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

8c8a576201f68de1a3f26fc723b9f30f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/WndProc.dll
.dll windows:4 windows x86 arch:x86

b3f659d7637a91b4fec12ff9b930080d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpyA
GlobalAlloc

user32

CallWindowProcA
SetWindowLongA
GetPropA
SetPropA
wsprintfA

Exports

Exports

onCallback

Sections

.text
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 377B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/btn_cancel.bmp
$PLUGINSDIR/btn_close.bmp
$PLUGINSDIR/btn_keepon.bmp
$PLUGINSDIR/btn_ok.bmp
$PLUGINSDIR/inetc.dll
.dll windows:6 windows x86 arch:x86

1bd45504e2ab3f32113ddb1874924eef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\soft\nsis\Inetc\Plugins\inetc.pdb

Imports

wininet

InternetErrorDlg
HttpQueryInfoA
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetOptionA
InternetQueryOptionA
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetCrackUrlA

comctl32

ord17

kernel32

GlobalFree
GlobalAlloc
WideCharToMultiByte
DeleteFileA
CreateFileA
GetModuleHandleA
LoadLibraryA
lstrlenA
MultiByteToWideChar
lstrcpyA
lstrcpynA
lstrcmpiA
lstrcmpA
GetTickCount
MulDiv
CloseHandle
SetFilePointer
ReadFile
lstrcatA
SleepEx
GetProcAddress
LocalAlloc
LocalFree
CreateThread
TerminateThread
GetLastError
WaitForSingleObject
GetFileSize
WriteFile

user32

SendDlgItemMessageA
SetTimer
KillTimer
EnableWindow
UpdateWindow
RedrawWindow
SetWindowTextA
GetWindowTextA
GetClientRect
GetWindowRect
MessageBoxA
GetWindowLongA
SetWindowLongA
GetParent
FindWindowExA
LoadIconA
IsDialogMessageA
SystemParametersInfoA
SetDlgItemTextA
wsprintfA
GetMessageA
TranslateMessage
DispatchMessageA
SendMessageA
PostMessageA
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
IsWindowVisible
CreateDialogParamA
GetDlgItem

Exports

Exports

get
head
post
put

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/loading1.bmp
$PLUGINSDIR/loading2.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

ebc2d915841be8afc8fa1ee9f6850960

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc

user32

DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
GetPropA
CharPrevA
DrawFocusRect
GetWindowLongA
DrawTextA
GetClientRect
SetWindowLongA
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
MapWindowPoints
RemovePropA
GetWindowTextA

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/unbg.bmp
$PLUGINSDIR/uninstall1.bmp
$PLUGINSDIR/uninstall2.bmp

Sharing

General

Malware Config

Signatures

Files

ea4e67a31ace1a72683a99b80cf37830

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

0f:b3:4b:34:a0:da:76:f3:e4:51:d9:e4:7a:15:db:ecCertificate

Extended Key Usages

Key Usages

ca:ee:1f:b8:ae:82:99:24:c3:84:a2:74:d7:ac:0f:29:5a:8e:d1:92Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 106KB

.ndata Size: - Virtual size: 104KB

.rsrc Size: 293KB - Virtual size: 293KB

db2755f409b81c4dbfc04f648cfb80b9

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 987B

.reloc Size: 512B - Virtual size: 66B

06dcb04c70882d779cebdc81fba96fc4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 928B

.gfids Size: 512B - Virtual size: 28B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 564B

6aa9a41e5d5d6fbd428a6608ec549db2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0f:b3:4b:34:a0:da:76:f3:e4:51:d9:e4:7a:15:db:ec
Certificate

ca:ee:1f:b8:ae:82:99:24:c3:84:a2:74:d7:ac:0f:29:5a:8e:d1:92
Signer

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 106KB

.ndata
Size: - Virtual size: 104KB

.rsrc
Size: 293KB - Virtual size: 293KB

.text
Size: 1024B - Virtual size: 987B

.reloc
Size: 512B - Virtual size: 66B

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 928B

.gfids
Size: 512B - Virtual size: 28B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 564B

.text
Size: 234KB - Virtual size: 233KB

.rdata
Size: 33KB - Virtual size: 33KB

.data
Size: 2KB - Virtual size: 6KB

.gfids
Size: 512B - Virtual size: 356B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 8KB - Virtual size: 8KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 947B

.data
Size: - Virtual size: 24B

.reloc
Size: 512B - Virtual size: 284B

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 797B

.data
Size: - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 254B

.text
Size: 72KB - Virtual size: 72KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB