Overview
overview
7Static
static
3dac7b7c360...18.exe
windows7-x64
7dac7b7c360...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3aofpr.chm
windows7-x64
1aofpr.chm
windows10-2004-x64
1aofpr.exe
windows7-x64
6aofpr.exe
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
dac7b7c3609599ce443bff04bac785c1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dac7b7c3609599ce443bff04bac785c1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
aofpr.chm
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
aofpr.chm
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
aofpr.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
aofpr.exe
Resource
win10v2004-20240802-en
General
-
Target
dac7b7c3609599ce443bff04bac785c1_JaffaCakes118
-
Size
848KB
-
MD5
dac7b7c3609599ce443bff04bac785c1
-
SHA1
afc036c6adef4ec7c64f01e73e2bcbb9a49c0356
-
SHA256
4245018e08c7f11976185b609600b11bd088bcbd02d3982a0cedbc6a4160f032
-
SHA512
e445a8cbdeb3b120865fd4e24b56ccee755dbd61151e212693277d90cb043d3c72e8001e5d4b1299241ea37a41126de24c0fc17bcb289fbe8aa224bdeb87ca82
-
SSDEEP
24576:pWIiyDii1U93GrOzATOKcevWMD28tiOjWqb+I:5tDy3Gr6ATOKHvTJCBI
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/$PLUGINSDIR/InstallOptions.dll unpack001/$PLUGINSDIR/StartMenu.dll unpack001/aofpr.exe -
NSIS installer 2 IoCs
resource yara_rule sample nsis_installer_1 sample nsis_installer_2
Files
-
dac7b7c3609599ce443bff04bac785c1_JaffaCakes118.exe windows:4 windows x86 arch:x86
7fa974366048f9c551ef45714595665e
Code Sign
70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before29/01/1996, 00:00Not After01/08/2028, 23:59SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
37:df:e5:cf:99:c2:5d:29:d2:e3:ca:01:e1:87:b2:a2Certificate
IssuerCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USNot Before15/12/2009, 00:00Not After15/12/2010, 23:59SubjectCN=Passcovery Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Passcovery Ltd.,L=St.Petersburg,ST=Russia,C=RUExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before21/05/2009, 00:00Not After20/05/2019, 23:59SubjectCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
2b:f2:a7:ca:55:49:51:e6:79:bc:44:8d:96:98:d4:cf:79:40:9e:38Signer
Actual PE Digest2b:f2:a7:ca:55:49:51:e6:79:bc:44:8d:96:98:d4:cf:79:40:9e:38Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/InstallOptions.dll.dll windows:4 windows x86 arch:x86
b1cd0d78f652ce5fc63f0879371af012
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc
user32
MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect
gdi32
SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject
shell32
SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA
comdlg32
GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Exports
Exports
dialog
initDialog
show
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/StartMenu.dll.dll windows:4 windows x86 arch:x86
a648aeaa164b592c1e8892a10400b5ae
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
lstrcatA
FindClose
FindNextFileA
MulDiv
GlobalFree
lstrcpynA
GlobalAlloc
lstrcmpiA
FindFirstFileA
lstrcpyA
user32
TranslateMessage
GetMessageA
IsDialogMessageA
PostMessageA
DispatchMessageA
GetWindowLongA
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
IsDlgButtonChecked
GetWindowTextA
DestroyWindow
GetDlgItem
CreateDialogParamA
SetWindowLongA
wsprintfA
CallWindowProcA
gdi32
GetTextMetricsA
SelectObject
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ole32
CoTaskMemFree
Exports
Exports
Init
Select
Show
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 518B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/ioSpecial.ini
-
$PLUGINSDIR/modern-wizard.bmp
-
aofpr.chm.chm
-
aofpr.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
@$xp$10TCCalendar
@$xp$10TPieEditor
@$xp$11TCColorGrid
@$xp$11TNumberEdit
@$xp$13TPasswordMask
@$xp$15TAngleEditorDlg
@$xp$15TAnglesProperty
@$xp$16Cspin@TCSpinEdit
@$xp$16Cspin@TCSpinEdit
@$xp$16Cspin@TCSpinEdit
@$xp$16Cspin@TCSpinEdit
@$xp$16Cspin@TCSpinEdit
@$xp$16Cspin@TCSpinEdit
@$xp$16Cspin@TCSpinEdit
@$xp$16Richview@TCPInfo
@$xp$16Rvstyle@TRVStyle
@$xp$17Rvstyle@TFontInfo
@$xp$17TPerformanceGraph
@$xp$18Cspin@TCSpinButton
@$xp$18Cspin@TCSpinButton
@$xp$18Cspin@TCSpinButton
@$xp$18Cspin@TCSpinButton
@$xp$18Cspin@TCSpinButton
@$xp$18Cspin@TCSpinButton
@$xp$18Cspin@TCSpinButton
@$xp$18Richview@TJumpInfo
@$xp$18Richview@TLineInfo
@$xp$18Richview@TRichView
@$xp$18Rvstyle@TFontInfos
@$xp$19Richview@TJumpEvent
@$xp$20Controls@TAnchorKind
@$xp$20Controls@TAnchorKind
@$xp$20Controls@TAnchorKind
@$xp$20Controls@TAnchorKind
@$xp$20Controls@TAnchorKind
@$xp$20Controls@TAnchorKind
@$xp$20Controls@TAnchorKind
@$xp$20Controls@TAnchorKind
@$xp$20Controls@TAnchorKind
@$xp$20Controls@TAnchorKind
@$xp$20Controls@TAnchorKind
@$xp$20Controls@TAnchorKind
@$xp$20Controls@TAnchorKind
@$xp$20Richview@TRVInteger2
@$xp$20Rvscroll@TRVScroller
@$xp$22Outline@TOutlineOption
@$xp$22Richview@TDrawLineInfo
@$xp$22Richview@TRVSaveFormat
@$xp$22Richview@TRVSaveOption
@$xp$23Cspin@TTimerSpeedButton
@$xp$23Richview@TRVSaveOptions
@$xp$25Richview@TBackgroundStyle
@$xp$25Richview@TRVDblClickEvent
@$xp$25Richview@TRVDisplayOption
@$xp$25Richview@TScreenAndDevice
@$xp$26Richview@TRVDisplayOptions
@$xp$26Richview@TRVMouseMoveEvent
@$xp$26Richview@TRVURLNeededEvent
@$xp$27Cdiroutl@TCDirectoryOutline
@$xp$27Richview@TRVRightClickEvent
@$xp$36Richview@TRVSaveComponentToFileEvent
@$xp$4TPie
@$xp$7TAngles
@$xp$7TCGauge
@$xp$9TTrayIcon
@@Basesocketprocessclass@Finalize
@@Basesocketprocessclass@Initialize
@@Basesocketprocessthread@Finalize
@@Basesocketprocessthread@Initialize
@@Ccalendr@Finalize
@@Ccalendr@Initialize
@@Cdiroutl@Finalize
@@Cdiroutl@Initialize
@@Cgauges@Finalize
@@Cgauges@Initialize
@@Cgrid@Finalize
@@Cgrid@Initialize
@@Cspin@Finalize
@@Cspin@Initialize
@@Filesavehelper@Finalize
@@Filesavehelper@Initialize
@@Fmmain@Finalize
@@Fmmain@Initialize
@@Fmprefap@Finalize
@@Fmprefap@Initialize
@@Fmpreftask@Finalize
@@Fmpreftask@Initialize
@@Fmreg@Finalize
@@Fmreg@Initialize
@@Fmtaskclientpref@Finalize
@@Fmtaskclientpref@Initialize
@@Fmtryother@Finalize
@@Fmtryother@Initialize
@@Fmwaitform@Finalize
@@Fmwaitform@Initialize
@@Formdebug@Finalize
@@Formdebug@Initialize
@@Frmwizard2@Finalize
@@Frmwizard2@Initialize
@@Generatepasswordclassbase@Finalize
@@Generatepasswordclassbase@Initialize
@@Generatepasswordclassbrute@Finalize
@@Generatepasswordclassbrute@Initialize
@@Generatepasswordclassbrutemasked@Finalize
@@Generatepasswordclassbrutemasked@Initialize
@@Generatepasswordclassdictionary@Finalize
@@Generatepasswordclassdictionary@Initialize
@@Passwordchecker@Finalize
@@Passwordchecker@Initialize
@@Passwordmask@Finalize
@@Passwordmask@Initialize
@@Perfgrap@Finalize
@@Perfgrap@Initialize
@@Piereg@Finalize
@@Piereg@Initialize
@@Searchpasswordthread@Finalize
@@Searchpasswordthread@Initialize
@@Settings@Finalize
@@Settings@Initialize
@@Taskbase@Finalize
@@Taskbase@Initialize
@@Taskbrute@Finalize
@@Taskbrute@Initialize
@@Taskbrutemasked@Finalize
@@Taskbrutemasked@Initialize
@@Taskdictionary@Finalize
@@Taskdictionary@Initialize
@@Taskinfo@Finalize
@@Taskinfo@Initialize
@@Taskprocessor@Finalize
@@Taskprocessor@Initialize
@@Taskprocessoreventhandlerbase@Finalize
@@Taskprocessoreventhandlerbase@Initialize
@@Taskprocessoreventhandlerofficepassword@Finalize
@@Taskprocessoreventhandlerofficepassword@Initialize
@@Tnumberedit@Finalize
@@Tnumberedit@Initialize
@@Trayicon@Finalize
@@Trayicon@Initialize
@@Trequest@Finalize
@@Trequest@Initialize
@@Tsocketclientqueue@Finalize
@@Tsocketclientqueue@Initialize
@@Tsocketserverqueue@Finalize
@@Tsocketserverqueue@Initialize
@@Unotinterface@Finalize
@@Unotinterface@Initialize
@@Ustructs@Finalize
@@Ustructs@Initialize
@@Uuisupportclasses@Finalize
@@Uuisupportclasses@Initialize
@@Uworkingthread@Finalize
@@Uworkingthread@Initialize
@@Visualtaskbase@Finalize
@@Visualtaskbase@Initialize
@@Visualtaskclient@Finalize
@@Visualtaskclient@Initialize
@@Visualtaskserver@Finalize
@@Visualtaskserver@Initialize
@Ccalendr@Register$qqrv
@Cdiroutl@Register$qqrv
@Cdiroutl@TCDirectoryOutline@
@Cdiroutl@TCDirectoryOutline@$bctr$qqrp18Classes@TComponent
@Cdiroutl@TCDirectoryOutline@APointer
@Cdiroutl@TCDirectoryOutline@AssignCaseProc$qqrv
@Cdiroutl@TCDirectoryOutline@BuildOneLevel$qqrl
@Cdiroutl@TCDirectoryOutline@BuildSubTree$qqrl
@Cdiroutl@TCDirectoryOutline@BuildTree$qqrv
@Cdiroutl@TCDirectoryOutline@Change$qqrv
@Cdiroutl@TCDirectoryOutline@Click$qqrv
@Cdiroutl@TCDirectoryOutline@CreateWnd$qqrv
@Cdiroutl@TCDirectoryOutline@CurDir$qv
@Cdiroutl@TCDirectoryOutline@DriveToInt$qqrc
@Cdiroutl@TCDirectoryOutline@Expand$qqri
@Cdiroutl@TCDirectoryOutline@ForceCase$qqrrx17System@AnsiString
@Cdiroutl@TCDirectoryOutline@GetChildNamed$qqrrx17System@AnsiStringl
@Cdiroutl@TCDirectoryOutline@InvalidIndex
@Cdiroutl@TCDirectoryOutline@Loaded$qqrv
@Cdiroutl@TCDirectoryOutline@RootIndex
@Cdiroutl@TCDirectoryOutline@SetDirectory$qqr17System@AnsiString
@Cdiroutl@TCDirectoryOutline@SetDrive$qqrc
@Cdiroutl@TCDirectoryOutline@SetTextCase$qqr18Cdiroutl@TTextCase
@Cdiroutl@TCDirectoryOutline@WalkTree$qqrrx17System@AnsiString
@Cgauges@Register$qqrv
@Cgrid@Register$qqrv
@Cspin@Register$qqrv
@Cspin@TCSpinButton@
@Cspin@TCSpinButton@
@Cspin@TCSpinButton@
@Cspin@TCSpinButton@
@Cspin@TCSpinButton@
@Cspin@TCSpinButton@
@Cspin@TCSpinButton@
@Cspin@TCSpinButton@$bctr$qqrp18Classes@TComponent
@Cspin@TCSpinButton@$bdtr$qqrv
@Cspin@TCSpinButton@$bdtr$qqrv
@Cspin@TCSpinButton@$bdtr$qqrv
@Cspin@TCSpinButton@$bdtr$qqrv
@Cspin@TCSpinButton@$bdtr$qqrv
@Cspin@TCSpinButton@$bdtr$qqrv
@Cspin@TCSpinButton@$bdtr$qqrv
@Cspin@TCSpinButton@AdjustSize$qqrrit1
@Cspin@TCSpinButton@BtnClick$qqrp14System@TObject
@Cspin@TCSpinButton@BtnMouseDown$qqrp14System@TObject21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Cspin@TCSpinButton@CreateButton$qqrv
@Cspin@TCSpinButton@Dispatch$qqrpv
@Cspin@TCSpinButton@Dispatch$qqrpv
@Cspin@TCSpinButton@Dispatch$qqrpv
@Cspin@TCSpinButton@Dispatch$qqrpv
@Cspin@TCSpinButton@Dispatch$qqrpv
@Cspin@TCSpinButton@Dispatch$qqrpv
@Cspin@TCSpinButton@Dispatch$qqrpv
@Cspin@TCSpinButton@GetDownGlyph$qqrv
@Cspin@TCSpinButton@GetUpGlyph$qqrv
@Cspin@TCSpinButton@KeyDown$qqrrus46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%
@Cspin@TCSpinButton@Loaded$qqrv
@Cspin@TCSpinButton@SetBounds$qqriiii
@Cspin@TCSpinButton@SetDownGlyph$qqrp16Graphics@TBitmap
@Cspin@TCSpinButton@SetFocusBtn$qqrp23Cspin@TTimerSpeedButton
@Cspin@TCSpinButton@SetUpGlyph$qqrp16Graphics@TBitmap
@Cspin@TCSpinButton@WMGetDlgCode$qqrr20Messages@TWMNoParams
@Cspin@TCSpinButton@WMKillFocus$qqrr21Messages@TWMKillFocus
@Cspin@TCSpinButton@WMSetFocus$qqrr20Messages@TWMSetFocus
@Cspin@TCSpinButton@WMSize$qqrr16Messages@TWMSize
@Cspin@TCSpinEdit@
@Cspin@TCSpinEdit@
@Cspin@TCSpinEdit@
@Cspin@TCSpinEdit@
@Cspin@TCSpinEdit@
@Cspin@TCSpinEdit@
@Cspin@TCSpinEdit@
@Cspin@TCSpinEdit@$bctr$qqrp18Classes@TComponent
@Cspin@TCSpinEdit@$bdtr$qqrv
@Cspin@TCSpinEdit@CMEnter$qqrr20Messages@TWMNoParams
@Cspin@TCSpinEdit@CMExit$qqrr20Messages@TWMNoParams
@Cspin@TCSpinEdit@CheckValue$qqrl
@Cspin@TCSpinEdit@CreateParams$qqrr22Controls@TCreateParams
@Cspin@TCSpinEdit@CreateWnd$qqrv
@Cspin@TCSpinEdit@Dispatch$qqrpv
@Cspin@TCSpinEdit@Dispatch$qqrpv
@Cspin@TCSpinEdit@Dispatch$qqrpv
@Cspin@TCSpinEdit@Dispatch$qqrpv
@Cspin@TCSpinEdit@Dispatch$qqrpv
@Cspin@TCSpinEdit@Dispatch$qqrpv
@Cspin@TCSpinEdit@Dispatch$qqrpv
@Cspin@TCSpinEdit@DownClick$qqrp14System@TObject
@Cspin@TCSpinEdit@GetChildren$qqrynpqqrp18Classes@TComponent$vp18Classes@TComponent
@Cspin@TCSpinEdit@GetMinHeight$qqrv
@Cspin@TCSpinEdit@GetValue$qqrv
@Cspin@TCSpinEdit@IsValidChar$qqrc
@Cspin@TCSpinEdit@KeyDown$qqrrus46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%
@Cspin@TCSpinEdit@KeyPress$qqrrc
@Cspin@TCSpinEdit@SetEditRect$qqrv
@Cspin@TCSpinEdit@SetValue$qqrl
@Cspin@TCSpinEdit@UpClick$qqrp14System@TObject
@Cspin@TCSpinEdit@WMCut$qqrr20Messages@TWMNoParams
@Cspin@TCSpinEdit@WMPaste$qqrr20Messages@TWMNoParams
@Cspin@TCSpinEdit@WMSize$qqrr16Messages@TWMSize
@Cspin@TTimerSpeedButton@
@Cspin@TTimerSpeedButton@$bctr$qqrp18Classes@TComponent
@Cspin@TTimerSpeedButton@$bdtr$qqrv
@Cspin@TTimerSpeedButton@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Cspin@TTimerSpeedButton@MouseUp$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Cspin@TTimerSpeedButton@Paint$qqrv
@Cspin@TTimerSpeedButton@TimerExpired$qqrp14System@TObject
@Passwordmask@Register$qqrv
@Perfgrap@Register$qqrv
@Piereg@Register$qqrv
@Richview@Finalization$qqrv
@Richview@InfoAboutSaD$qqrr25Richview@TScreenAndDevicep16Graphics@TCanvas
@Richview@TCPInfo@
@Richview@TDrawLineInfo@
@Richview@TJumpInfo@
@Richview@TLineInfo@
@Richview@TRVInteger2@
@Richview@TRichView@
@Richview@TRichView@$bctr$qqrp18Classes@TComponent
@Richview@TRichView@$bdtr$qqrv
@Richview@TRichView@Add$qqr17System@AnsiStringi
@Richview@TRichView@AddBreak$qqrv
@Richview@TRichView@AddBullet$qqrip19Controls@TImageListo
@Richview@TRichView@AddCenterLine$qqr17System@AnsiStringi
@Richview@TRichView@AddCheckPoint$qqrv
@Richview@TRichView@AddControl$qqrp17Controls@TControlo
@Richview@TRichView@AddFromNewLine$qqr17System@AnsiStringi
@Richview@TRichView@AddHotSpot$qqrip19Controls@TImageListo
@Richview@TRichView@AddNamedCheckPoint$qqr17System@AnsiString
@Richview@TRichView@AddPicture$qqrp17Graphics@TGraphic
@Richview@TRichView@AddText$qqr17System@AnsiStringi
@Richview@TRichView@AddTextFromNewLine$qqr17System@AnsiStringi
@Richview@TRichView@AdjustChildrenCoords$qqrv
@Richview@TRichView@AdjustJumpsCoords$qqrv
@Richview@TRichView@AppendFrom$qqrp18Richview@TRichView
@Richview@TRichView@CMMouseLeave$qqrr17Messages@TMessage
@Richview@TRichView@Clear$qqrv
@Richview@TRichView@ClearTemporal$qqrv
@Richview@TRichView@Click$qqrv
@Richview@TRichView@CopyText$qqrv
@Richview@TRichView@DblClick$qqrv
@Richview@TRichView@DeleteLines$qqrii
@Richview@TRichView@DeleteSection$qqr17System@AnsiString
@Richview@TRichView@Deselect$qqrv
@Richview@TRichView@DrawBack$qqruirx13Windows@TRectii
@Richview@TRichView@FindClickedWord$qqrr17System@AnsiStringri
@Richview@TRichView@FindItemAtPos$qqrii
@Richview@TRichView@FindItemForSel$qqriirit3
@Richview@TRichView@Format$qqrv
@Richview@TRichView@FormatLine$qqririt2t2t2p16Graphics@TCanvasr25Richview@TScreenAndDevice
@Richview@TRichView@FormatTail$qqrv
@Richview@TRichView@Format_$qqroip16Graphics@TCanvaso
@Richview@TRichView@GetCheckPointY$qqri
@Richview@TRichView@GetDrawLineNo$qqrii
@Richview@TRichView@GetFirstLineVisible$qqrv
@Richview@TRichView@GetFirstVisible$qqri
@Richview@TRichView@GetJumpPointY$qqri
@Richview@TRichView@GetLastCP$qqrv
@Richview@TRichView@GetLastLineVisible$qqrv
@Richview@TRichView@GetLineCount$qqrv
@Richview@TRichView@GetMaxPictureWidth$qqrv
@Richview@TRichView@GetNextFileName$qqr17System@AnsiString
@Richview@TRichView@GetSelBounds$qqrrit1t1t1
@Richview@TRichView@GetSelText$qqrv
@Richview@TRichView@InvalidateJumpRect$qqri
@Richview@TRichView@KeyDown$qqrrus46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%
@Richview@TRichView@Loaded$qqrv
@Richview@TRichView@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Richview@TRichView@MouseMove$qqr46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Richview@TRichView@MouseUp$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@Richview@TRichView@Notification$qqrp18Classes@TComponent18Classes@TOperation
@Richview@TRichView@OnScrollTimer$qqrp14System@TObject
@Richview@TRichView@Paint$qqrv
@Richview@TRichView@RestoreSelBounds$qqriiii
@Richview@TRichView@SaveHTML$qqr17System@AnsiStringt1t150System@%Set$t22Richview@TRVSaveOption$iuc$0$iuc$0%
@Richview@TRichView@SavePicture$qqr22Richview@TRVSaveFormat17System@AnsiStringp17Graphics@TGraphic
@Richview@TRichView@SaveText$qqr17System@AnsiStringi
@Richview@TRichView@SelectAll$qqrv
@Richview@TRichView@SelectionExists$qqrv
@Richview@TRichView@SetBackBitmap$qqrp16Graphics@TBitmap
@Richview@TRichView@SetBackgroundStyle$qqr25Richview@TBackgroundStyle
@Richview@TRichView@SetVSmallStep$qqri
@Richview@TRichView@ShareLinesFrom$qqrp18Richview@TRichView
@Richview@TRichView@StoreSelBounds$qqrrit1t1t1
@Richview@TRichView@WMEraseBkgnd$qqrr22Messages@TWMEraseBkgnd
@Richview@TRichView@WMSize$qqrr16Messages@TWMSize
@Richview@initialization$qqrv
@Rvscroll@Finalization$qqrv
@Rvscroll@TRVScroller@
@Rvscroll@TRVScroller@$bctr$qqrp18Classes@TComponent
@Rvscroll@TRVScroller@CreateParams$qqrr22Controls@TCreateParams
@Rvscroll@TRVScroller@CreateWnd$qqrv
@Rvscroll@TRVScroller@GetVScrollMax$qqrv
@Rvscroll@TRVScroller@GetVScrollPos$qqrv
@Rvscroll@TRVScroller@Paint$qqrv
@Rvscroll@TRVScroller@ScrollChildren$qqrii
@Rvscroll@TRVScroller@ScrollTo$qqri
@Rvscroll@TRVScroller@SetHPos$qqri
@Rvscroll@TRVScroller@SetVPos$qqri
@Rvscroll@TRVScroller@SetVScrollPos$qqri
@Rvscroll@TRVScroller@SetVScrollVisible$qqro
@Rvscroll@TRVScroller@UpdateChildren$qqrv
@Rvscroll@TRVScroller@UpdateScrollBars$qqrii
@Rvscroll@TRVScroller@WMGetDlgCode$qqrr20Messages@TWMNoParams
@Rvscroll@TRVScroller@WMHScroll$qqrr18Messages@TWMScroll
@Rvscroll@TRVScroller@WMKeyDown$qqrr15Messages@TWMKey
@Rvscroll@TRVScroller@WMVScroll$qqrr18Messages@TWMScroll
@Rvscroll@Tag2Y$qqrp17Controls@TControl
@Rvscroll@initialization$qqrv
@Rvstyle@Finalization$qqrv
@Rvstyle@TFontInfo@
@Rvstyle@TFontInfo@$bctr$qqrp19Classes@TCollection
@Rvstyle@TFontInfo@Assign$qqrp19Classes@TPersistent
@Rvstyle@TFontInfos@
@Rvstyle@TFontInfos@$bctr$qqrv
@Rvstyle@TFontInfos@Add$qqrv
@Rvstyle@TFontInfos@AddFont$qqr17System@AnsiStringi15Graphics@TColor47System@%Set$t19Graphics@TFontStyle$iuc$0$iuc$3%
@Rvstyle@TFontInfos@AddFontEx$qqr17System@AnsiStringi15Graphics@TColor47System@%Set$t19Graphics@TFontStyle$iuc$0$iuc$3%uc
@Rvstyle@TFontInfos@Delete$qqri
@Rvstyle@TFontInfos@GetItem$qqri
@Rvstyle@TFontInfos@SetItem$qqrip17Rvstyle@TFontInfo
@Rvstyle@TRVStyle@
@Rvstyle@TRVStyle@$bctr$qqrp18Classes@TComponent
@Rvstyle@TRVStyle@$bdtr$qqrv
@Rvstyle@TRVStyle@AddTextStyle$qqrv
@Rvstyle@TRVStyle@DeleteTextStyle$qqri
@Rvstyle@TRVStyle@GetTextStyle$qqri
@Rvstyle@TRVStyle@LoadINI$qqr17System@AnsiStringt1
@Rvstyle@TRVStyle@SaveINI$qqr17System@AnsiStringt1
@Rvstyle@TRVStyle@SetTextStyles$qqrp18Rvstyle@TFontInfos
@Rvstyle@initialization$qqrv
@TAngleEditorDlg@
@TAngleEditorDlg@$bctr$qqrp18Classes@TComponent
@TAngleEditorDlg@$bctr$qqrp18Classes@TComponenti
@TAngleEditorDlg@$bctr$qqrpv
@TAngleEditorDlg@$bdtr$qqrv
@TAngleEditorDlg@CancelClick$qqrp14System@TObject
@TAngleEditorDlg@ETrackBarChange$qqrp14System@TObject
@TAngleEditorDlg@STrackBarChange$qqrp14System@TObject
@TAngleEditorDlg@SetAngles$qqrp7TAngles
@TAngleEditorDlg@SetEndAngle$qqri
@TAngleEditorDlg@SetStartAngle$qqri
@TAngles@
@TAngles@$bctr$qqrv
@TAngles@$bdtr$qqrv
@TAngles@Assign$qqrp19Classes@TPersistent
@TAngles@Changed$qqrv
@TAngles@SetEnd$qqri
@TAngles@SetStart$qqri
@TAnglesProperty@
@TAnglesProperty@$bctr$qqrx50System@%DelphiInterface$t22Dsgnintf@IFormDesigner%i
@TAnglesProperty@$bdtr$qqrv
@TAnglesProperty@Edit$qqrv
@TAnglesProperty@GetAttributes$qqrv
@TCCalendar@
@TCCalendar@$bctr$qqrp18Classes@TComponent
@TCCalendar@Change$qqrv
@TCCalendar@ChangeMonth$qqri
@TCCalendar@Click$qqrv
@TCCalendar@DaysPerMonth$qqrii
@TCCalendar@DaysThisMonth$qqrv
@TCCalendar@Dispatch$qqrpv
@TCCalendar@DrawCell$qqriirx13Windows@TRect42System@%Set$t14Grids@Grids__3$iuc$0$iuc$2%
@TCCalendar@GetCellText$qqrii
@TCCalendar@GetDateElement$qqri
@TCCalendar@IsLeapYear$qqri
@TCCalendar@NextMonth$qqrv
@TCCalendar@NextYear$qqrv
@TCCalendar@PrevMonth$qqrv
@TCCalendar@PrevYear$qqrv
@TCCalendar@SeTCCalendarDate$qqr16System@TDateTime
@TCCalendar@SelectCell$qqrii
@TCCalendar@SetDateElement$qqrii
@TCCalendar@SetStartOfWeek$qqrs
@TCCalendar@SetUseCurrentDate$qqro
@TCCalendar@StoreCalendarDate$qqrv
@TCCalendar@UpdateCalendar$qqrv
@TCCalendar@WMSize$qqrr16Messages@TWMSize
@TCColorGrid@
@TCColorGrid@$bctr$qqrp18Classes@TComponent
@TCColorGrid@CMCtl3DChanged$qqrr17Messages@TMessage
@TCColorGrid@Change$qqrv
@TCColorGrid@CreateWnd$qqrv
@TCColorGrid@Dispatch$qqrpv
@TCColorGrid@DrawFgBg$qqrv
@TCColorGrid@DrawSquare$qqrio
@TCColorGrid@EnableBackground$qqro
@TCColorGrid@EnableForeground$qqro
@TCColorGrid@GetBackgroundColor$qqrv
@TCColorGrid@GetForegroundColor$qqrv
@TCColorGrid@KeyDown$qqrrus46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%
@TCColorGrid@MouseDown$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@TCColorGrid@MouseMove$qqr46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@TCColorGrid@MouseUp$qqr21Controls@TMouseButton46System@%Set$t18Classes@Classes__1$iuc$0$iuc$6%ii
@TCColorGrid@Paint$qqrv
@TCColorGrid@SetBackgroundIndex$qqri
@TCColorGrid@SetForegroundIndex$qqri
@TCColorGrid@SetGridOrdering$qqr13TGridOrdering
@TCColorGrid@SetSelection$qqri
@TCColorGrid@SquareFromPos$qqrii
@TCColorGrid@UpdateCellSizes$qqro
@TCColorGrid@WMGetDlgCode$qqrr20Messages@TWMNoParams
@TCColorGrid@WMKillFocus$qqrr21Messages@TWMKillFocus
@TCColorGrid@WMSetFocus$qqrr20Messages@TWMSetFocus
@TCColorGrid@WMSize$qqrr16Messages@TWMSize
@TCGauge@
@TCGauge@$bctr$qqrp18Classes@TComponent
@TCGauge@AddProgress$qqrl
@TCGauge@GetPercentDone$qqrv
@TCGauge@Paint$qqrv
@TCGauge@PaintAsBar$qqrp16Graphics@TBitmaprx13Windows@TRect
@TCGauge@PaintAsNeedle$qqrp16Graphics@TBitmaprx13Windows@TRect
@TCGauge@PaintAsNothing$qqrp16Graphics@TBitmaprx13Windows@TRect
@TCGauge@PaintAsPie$qqrp16Graphics@TBitmaprx13Windows@TRect
@TCGauge@PaintAsText$qqrp16Graphics@TBitmaprx13Windows@TRect
@TCGauge@PaintBackground$qqrp16Graphics@TBitmap
@TCGauge@SeTCGaugeKind$qqr11TCGaugeKind
@TCGauge@SetBackColor$qqr15Graphics@TColor
@TCGauge@SetBorderStyle$qqr22Forms@TFormBorderStyle
@TCGauge@SetForeColor$qqr15Graphics@TColor
@TCGauge@SetMaxValue$qqrl
@TCGauge@SetMinValue$qqrl
@TCGauge@SetProgress$qqrl
@TCGauge@SetShowText$qqro
@TNumberEdit@
@TNumberEdit@$bctr$qqrp18Classes@TComponent
@TNumberEdit@Change$qqrv
@TNumberEdit@SetAllowNull$qqro
@TNumberEdit@SetMaxValue$qqri
@TNumberEdit@SetMinValue$qqri
@TPasswordMask@
@TPasswordMask@$bctr$qqrp18Classes@TComponent
@TPasswordMask@$bdtr$qqrv
@TPasswordMask@CellClick$qqrii
@TPasswordMask@ComponentActivate$qqrr20Messages@TWMActivate
@TPasswordMask@ComponentDeactivate$qqrr20Messages@TWMActivate
@TPasswordMask@Dispatch$qqrpv
@TPasswordMask@DrawLeftArrow$qqrv
@TPasswordMask@DrawRightArrow$qqrv
@TPasswordMask@FontEvent$qqrp14System@TObject
@TPasswordMask@GetPasswordChar$qqri
@TPasswordMask@GetPasswordCharSet$qqrv
Sections
Size: 333KB - Virtual size: 892KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 125KB - Virtual size: 772KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 30KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 162KB - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
languages.dat
-
uninst.exe.nsis