ff7f512f13493f048d02c56543f5c5d9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ff7f512f13493f048d02c56543f5c5d9_JaffaCakes118
Size

3.4MB
MD5

ff7f512f13493f048d02c56543f5c5d9
SHA1

4973d7183def03f1c2c21b6ffe75aef0fa69446f
SHA256

d29f045a264d08181b2f31f1d428fe19e3b0383e0462a7f309b94d39840bb8a5
SHA512

3cf5667609231f3b26c3b44b93321aafbed98131652acdce3d768a7829d38ae82828da8b7cbfa0168c6af4654b977a0da2f76c6cfdabbc5085623881e8fec4d9
SSDEEP

98304:Y//17upfqlEUfruwkrUxCJPXviSdeJ+tp:q/pisEUTmUx+68

Score

3^/10

pdf link

Malware Config

Signatures

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
ff7f512f13493f048d02c56543f5c5d9_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/cpudesc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Blue Cat Stereo Chorus RTAS data/uninst.exe
unpack001/Blue Cat Stereo Chorus RTAS.dpm

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Blue Cat Stereo Chorus RTAS data/uninst.exe	nsis_installer_1
static1/unpack001/Blue Cat Stereo Chorus RTAS data/uninst.exe	nsis_installer_2

Files

ff7f512f13493f048d02c56543f5c5d9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/cpudesc.dll
.dll windows:4 windows x86 arch:x86

c6a59b1080c20e84c1c392f75b2d75f4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalMemoryStatus
SetThreadPriority
SetPriorityClass
GetThreadPriority
lstrcpynA
GlobalAlloc
IsProcessorFeaturePresent
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemInfo
GetCurrentThread
GetPriorityClass
GetCurrentProcess

user32

wsprintfA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Exports

Exports

tell

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 118B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Blue Cat Stereo Chorus RTAS data/Skins/bg.bmp
Blue Cat Stereo Chorus RTAS data/Skins/bg2.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box.inc
Blue Cat Stereo Chorus RTAS data/Skins/box_bottom.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_bottom_left.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_bottom_left_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_bottom_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_bottom_right.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_bottom_right_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_left.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_left_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_right.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_right_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_top.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_top_left.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_top_left_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_top_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_top_right.bmp
Blue Cat Stereo Chorus RTAS data/Skins/box_top_right_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/default.xml
.xml
Blue Cat Stereo Chorus RTAS data/Skins/fader.inc
Blue Cat Stereo Chorus RTAS data/Skins/fader_thumb.bmp
Blue Cat Stereo Chorus RTAS data/Skins/fader_thumb_hi.bmp
Blue Cat Stereo Chorus RTAS data/Skins/fader_thumb_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/knob_black.bmp
Blue Cat Stereo Chorus RTAS data/Skins/knob_black.inc
Blue Cat Stereo Chorus RTAS data/Skins/knob_black_hi.bmp
Blue Cat Stereo Chorus RTAS data/Skins/knob_black_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/knobs.xml
.xml
Blue Cat Stereo Chorus RTAS data/Skins/on_off_button.bmp
Blue Cat Stereo Chorus RTAS data/Skins/on_off_button.inc
Blue Cat Stereo Chorus RTAS data/Skins/on_off_button_focus.bmp
Blue Cat Stereo Chorus RTAS data/Skins/on_off_button_hover.bmp
Blue Cat Stereo Chorus RTAS data/Skins/on_off_button_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/on_off_button_pushed.bmp
Blue Cat Stereo Chorus RTAS data/Skins/on_off_button_pushed_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/slider.inc
Blue Cat Stereo Chorus RTAS data/Skins/slider_h_wav.bmp
Blue Cat Stereo Chorus RTAS data/Skins/slider_h_wav_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/slider_small.bmp
Blue Cat Stereo Chorus RTAS data/Skins/slider_small_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/slider_small_selected.bmp
Blue Cat Stereo Chorus RTAS data/Skins/slider_thumb.bmp
Blue Cat Stereo Chorus RTAS data/Skins/slider_thumb_h.bmp
Blue Cat Stereo Chorus RTAS data/Skins/slider_thumb_h_hi.bmp
Blue Cat Stereo Chorus RTAS data/Skins/slider_thumb_h_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/slider_thumb_hi.bmp
Blue Cat Stereo Chorus RTAS data/Skins/slider_thumb_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/16x16_mouse_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/about.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/about_hover.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/about_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/about_pushed.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/about_pushed_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/at.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/at_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/at_pushed.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/at_pushed_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/help.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/help_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/help_pushed.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/help_pushed_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/load.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/load_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/load_pushed.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/load_pushed_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/menu.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/menu_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/menu_pushed.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/menu_pushed_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/redo.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/redo_disabled.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/redo_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/redo_mouse_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/redo_pushed.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/redo_pushed_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/save.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/save_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/save_pushed.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/save_pushed_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/square.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/square_mouse_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/toolbar.inc
.xml
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/toolbar_bg.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/undo.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/undo_disabled.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/undo_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/undo_pushed.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/undo_pushed_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/toolbar/undo_pushed_mouse_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/tooltip.inc
Blue Cat Stereo Chorus RTAS data/Skins/triangle_thumb.bmp
Blue Cat Stereo Chorus RTAS data/Skins/triangle_thumb_hi.bmp
Blue Cat Stereo Chorus RTAS data/Skins/triangle_thumb_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/wav_switch.bmp
Blue Cat Stereo Chorus RTAS data/Skins/wav_switch_hi.bmp
Blue Cat Stereo Chorus RTAS data/Skins/wav_switch_mask.bmp
Blue Cat Stereo Chorus RTAS data/Skins/wood.xml
.xml
Blue Cat Stereo Chorus RTAS data/logo.ico
Blue Cat Stereo Chorus RTAS data/manual.pdf
.pdf
- http://www.bluecataudio.com/?plugindoc
- http://www.bluecataudio.com/Products/Product_DXiManager/?plugindoc
- http://www.bluecataudio.com/Skins/?plugindoc
Blue Cat Stereo Chorus RTAS data/uninst.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
Blue Cat Stereo Chorus RTAS.dpm
.dll regsvr32 windows:5 windows x86 arch:x86

6df8c72dbed548fd239c6ffa3e75c31f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcp90

?uncaught_exception@std@@YA_NXZ

msvcr90

isprint
isdigit
localeconv
abs
div
_wcslwr
_wcsnicmp
_wcsicmp
_wcsupr
exit
memcmp
_errno
strlen
strcpy
strcat
_strdup
_access
__libm_sse2_pow
_CIcosh
__libm_sse2_log
_CIsinh
_CItanh
__libm_sse2_atan
__libm_sse2_cos
__libm_sse2_sin
__libm_sse2_asin
__libm_sse2_atan2
__libm_sse2_log10
__libm_sse2_acos
??_V@YAXPAX@Z
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
sprintf
ceil
__clean_type_info_names_internal
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
islower
ispunct
_splitpath
cos
sin
exp
atol
fabs
_itoa
__RTDynamicCast
_snprintf
sqrt
asin
_controlfp
strncat
pow
log
floor
strtod
vsprintf
strstr
strtol
tolower
strncpy
toupper
strcspn
memmove
strncmp
isspace
strchr
isalnum
isalpha
fputc
_vsnprintf_s
fputs
atoi
fopen
fread
fprintf
ftell
fseek
fclose
fwrite
free
printf
strtoul
calloc
clock
rand
srand
__CxxFrameHandler3
malloc
_CxxThrowException
memcpy
strncpy_s
??0exception@std@@QAE@XZ
memset
realloc
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
_fpclass
_copysign
_isnan
_ecvt_s
_fcvt_s
vsprintf_s
__iob_func
fflush
setvbuf
fgetpos
_fseeki64
fsetpos
ungetc
getc
putc
_CIpow
memchr
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
_get_osfhandle
__pioinfo

opengl32

glClearDepth
glDepthFunc
glClear
glClearColor
glGetDoublev
glEnd
glBegin
glShadeModel
glPopMatrix
glGetFloatv
glPushMatrix
glMultMatrixf
glRotatef
glBlendFunc
glScalef
glVertex3f
glMatrixMode
glViewport
glTranslatef
glEnable
glColor3f
glHint
glLoadIdentity
wglCreateContext
glGetString
wglMakeCurrent
wglGetProcAddress
wglDeleteContext
glColor4f
glPolygonMode
glGetIntegerv

glu32

gluUnProject
gluProject
gluPerspective

msimg32

AlphaBlend

kernel32

GetCurrentDirectoryW
GetCurrentDirectoryA
GetStdHandle
DuplicateHandle
CreateFileW
IsValidCodePage
IsDBCSLeadByteEx
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateFileA
SetFilePointer
GetSystemInfo
WriteFile
ReadFile
GetFileSize
GetFileInformationByHandle
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
Sleep
InterlockedExchange
GetFullPathNameA
ResetEvent
CreateEventA
SetEvent
CreateThread
CloseHandle
GetCurrentThreadId
OpenThread
TerminateThread
WaitForSingleObject
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleFileNameA
VirtualQuery
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
GetProcessHeap
HeapFree
HeapAlloc
DeleteFileA
GetTempPathA
GetTempFileNameA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LoadLibraryA
GlobalDeleteAtom
GetVersion
OutputDebugStringA
GetModuleHandleA
GetProcAddress
SetLastError
GetLastError
GetModuleFileNameW
GetFileAttributesW
LoadLibraryW
GetModuleHandleW
GetFullPathNameW
FreeLibrary
InterlockedExchangeAdd
LockResource
LoadResource
SizeofResource
FindResourceA
LoadLibraryExA
InterlockedCompareExchange

user32

TrackPopupMenu
GetWindow
IsWindowVisible
GetSystemMetrics
GetActiveWindow
GetWindowLongA
IntersectRect
GetParent
GetWindowRect
ScreenToClient
ClientToScreen
SetMenuItemInfoA
DestroyMenu
RemoveMenu
GetMenuItemCount
GetMenuItemInfoA
InsertMenuItemA
CreateMenu
CallWindowProcA
EnableWindow
GetSysColorBrush
DefWindowProcA
TranslateAcceleratorA
CreateWindowExA
TranslateMessage
WaitMessage
GetMenuInfo
IsWindowEnabled
GetFocus
PeekMessageA
UnregisterHotKey
SetWindowLongA
SetParent
KillTimer
SetTimer
IsWindow
MoveWindow
LoadCursorFromFileA
LoadCursorA
LoadImageA
AdjustWindowRectEx
GetCursor
ShowWindow
SetLayeredWindowAttributes
GetCursorPos
SetWindowPos
GetSysColor
MessageBoxA
GetMenu
SendMessageA
GetClientRect
SetCursor
DestroyWindow
UpdateWindow
InvalidateRect
TrackMouseEvent
ReleaseCapture
PostMessageA
GetDC
BeginPaint
CreatePopupMenu
SetMenuInfo
GetKeyState
DispatchMessageA
SetCapture
GetUpdateRgn
EndPaint
RegisterClassA
UnregisterClassA
SetWindowTextA
SetPropA
GetWindowTextA
GetCapture
GetWindowTextLengthA
RemovePropA
GetPropA
SetScrollInfo
ScrollWindow
GetScrollInfo
WindowFromDC
ReleaseDC
DrawTextA
FillRect
SetFocus

gdi32

RestoreDC
DeleteObject
ExtSelectClipRgn
CreateRectRgn
CombineRgn
GetRegionData
GetClipRgn
AddFontResourceExA
RemoveFontResourceExA
CreateSolidBrush
GetStockObject
SetBkColor
SetTextColor
GetPixel
SetPixel
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
GetObjectA
GetRgnBox
GetCurrentObject
CreateFontIndirectA
CreateDIBSection
DeleteDC
BitBlt
TextOutA
GetTextColor
OffsetViewportOrgEx
IntersectClipRect
GetClipBox
SetStretchBltMode
SaveDC
CreateBrushIndirect
SelectClipRgn
SetBkMode
StretchBlt
GetBkMode
GetTextExtentPoint32A
GetViewportOrgEx
SwapBuffers
SetPixelFormat
ChoosePixelFormat
Polyline
Rectangle
CreatePenIndirect
LineTo
MoveToEx
OffsetRgn

advapi32

RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA

shell32

ShellExecuteA
SHCreateDirectoryExA
SHGetFolderPathA

digiext

ord7214
ord7009
ord7008
ord7011
ord7022
ord518
ord520
ord755
ord802
ord756
ord542
ord6733
ord1047
ord7058
ord375
ord380
ord523
ord489
ord630
ord628
ord693
ord688
ord868
ord456
ord6725
ord7213
ord6740
ord6716
ord302
ord2230
ord7130
ord6842
ord321
ord430
ord519
ord732
ord224
ord454
ord244
ord6713
ord497
ord309
ord6722
ord865
ord265
ord1150
ord7018
ord7034
ord7047
ord1053
ord459
ord361
ord404
ord7
ord7002
ord386
ord754
ord516
ord465
ord582
ord983
ord982
ord985
ord621
ord586
ord389
ord6500
ord7046
ord624
ord699
ord821
ord626
ord7186
ord250
ord961
ord238
ord229
ord242
ord288
ord235
ord455
ord316
ord289
ord5002
ord5001
ord6057
ord383
ord267
ord955
ord649
ord387
ord248
ord7211
ord259
ord717
ord634
ord433
ord645
ord860
ord653
ord290
ord7051
ord458
ord721
ord6728
ord1120
ord6724
ord314
ord643
ord751
ord512
ord252
ord514
ord509
ord750
ord899
ord748
ord897
ord746
ord513
ord707
ord6719
ord7084
ord6562
ord7187
ord6563
ord7083
ord305
ord239
ord1244
ord431
ord6526
ord1160
ord6708
ord247
ord7188
ord521
ord7185
ord301
ord6703
ord434
ord215
ord6712
ord6240
ord6236
ord6239
ord6235
ord532
ord6234
ord663
ord7189
ord260
ord501
ord7010
ord719
ord1058

dae

_FicSDSDoneWithToken@4
_FicSDSGetTokenAndTaskVal@16
_FicSDSReserveName@12
_FicSDSGetNameId@12
_FicSDSFreeName@8
_FicSDSSetListenerManufacturer@8
_FicSDSSetListenerProtocol@8
_FicSDSSetListenerTask@8
_FicSDSSetListenerTaskVal@8
_FicSDSSetListenerLatestFlag@8
_FicSDSSetListenerCriticalFlag@8
_FicSDSSetListenerGoal@8
_FicSDSSetListenerSubType@8
_FicSDSSetListenerType@8
_FicGestalt@8
_FicFindStandardType@8
_FicNewObject@8
_FicDeactivateListener@8
_FicReactivateListener@8
_FicDeactivateTalker@8
_FicReactivateTalker@8
_FicCreatePlugInSpec@16
_FicPrepareForConnectionsStatus@4
_FicPrepareForConnections@8
_FicSDSDispatchToken@4
_FicUnRegisterDirectMIDIClient@4
_FicRegisterDirectMIDIClient@16
_FicPersonalityDoIdle@0
_FicDelete@4
_FicNewServer@0
_FicIsAlive@0
_FicSDSSetListenerName@12

dsi

_SSetControlLatch@8
_SStartShell@4
_SPauseShell@4
_SResumeShell@4
_SSetInputDelay@8
_SGetDSPCodeInfo@12
_DsiPrintf@4
_GetDSPList@4
_InitSADriver@0
_GetCardList@4
_GetClientList@4
_DsiSendMsg@4
_SGetControlLatch@8
_SSetLeftRightBit@8
_SExecute@8
_SChangePBits@16
_SChangeYBits@16
_SChangeXBits@16
_SGetPWord@12
_SGetYWord@12
_SGetXWord@12
_ResetDSP@4
_GetShellList@4
_DsiLoadShell@12
_SInitShell@4
_SSetOutputDelay@8
_SUpdateDSPPeripheral@4

dspmanager

GetDSPManager

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Exports

Exports

?registered@?$TStaticFactory@V?$TBinaryFunction@$1?And@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?And@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Average@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Average@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Difference@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Difference@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Distance@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Distance@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Division@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Division@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Equality@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Equality@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?GreaterThan@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?GreaterThan@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?GreaterThanEqual@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?GreaterThanEqual@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?LowerThan@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?LowerThan@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?LowerThanEqual@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?LowerThanEqual@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Max@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Max@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Min@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Min@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Module@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Module@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?NotEqual@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?NotEqual@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Or@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Or@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Power@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Power@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Product@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Product@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Sum@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Sum@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?X@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?X@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Y@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TBinaryFunction@$1?Y@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TCircularLUTFunction@V?$TLookupTable@MV?$TConstrainedSplineInterpolator@MM@Core@Kitty@@@Core@Kitty@@@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TCircularLUTFunction@V?$TLookupTable@MV?$TConstrainedSplineInterpolator@MM@Core@Kitty@@@Core@Kitty@@@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TDeprecatedCircularLUTFunction@V?$TLookupTable@MV?$TConstrainedSplineInterpolator@MM@Core@Kitty@@@Core@Kitty@@@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TDeprecatedCircularLUTFunction@V?$TLookupTable@MV?$TConstrainedSplineInterpolator@MM@Core@Kitty@@@Core@Kitty@@@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Abs@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Abs@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Ceil@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Ceil@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Cos@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Cos@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Cosh@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Cosh@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Exp@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Exp@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Floor@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Floor@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?FromdB@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?FromdB@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Identity@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Identity@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Log@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Log@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Negate@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Negate@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormExp1@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormExp1@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormExp2@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormExp2@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormExp3@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormExp3@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormExp@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormExp@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormLog1@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormLog1@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormLog2@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormLog2@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormLog3@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormLog3@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormLog@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?NormLog@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Not@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Not@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Round@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Round@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Sin@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Sin@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Sinh@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Sinh@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Square@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Square@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?SquareRoot@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?SquareRoot@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Tan@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Tan@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Tanh@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?Tanh@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?TodB@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunction@$1?TodB@FunctionsLibrary@Math@Kitty@@YAMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunctionsOperation@$1?Difference@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunctionsOperation@$1?Difference@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunctionsOperation@$1?Division@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunctionsOperation@$1?Division@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunctionsOperation@$1?Product@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunctionsOperation@$1?Product@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunctionsOperation@$1?Sum@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TFunctionsOperation@$1?Sum@FunctionsLibrary@Math@Kitty@@YAMMM@Z@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TLUTFunction@V?$TLookupTable@MV?$TConstrainedSplineInterpolator@MM@Core@Kitty@@@Core@Kitty@@@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TLUTFunction@V?$TLookupTable@MV?$TConstrainedSplineInterpolator@MM@Core@Kitty@@@Core@Kitty@@@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TLUTFunction@V?$TLookupTable@MV?$TLinearInterpolator@MM@Core@Kitty@@@Core@Kitty@@@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TLUTFunction@V?$TLookupTable@MV?$TLinearInterpolator@MM@Core@Kitty@@@Core@Kitty@@@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TLUTFunction@V?$TLookupTable@MV?$TNearestInterpolator@MM@Core@Kitty@@@Core@Kitty@@@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@V?$TLUTFunction@V?$TLookupTable@MV?$TNearestInterpolator@MM@Core@Kitty@@@Core@Kitty@@@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCBinaryFunctionComposition@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCBinaryFunctionComposition@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCBinaryFunctionProxy@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCBinaryFunctionProxy@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCBinaryFunctionsCombination@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCBinaryFunctionsCombination@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCBiquadGain@Algorithm@DSP@Audio@Kitty@@V12345@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCBiquadGain@Algorithm@DSP@Audio@Kitty@@VIFunction@Math@5@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCBiquadPhaseShift@Algorithm@DSP@Audio@Kitty@@V12345@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCBiquadPhaseShift@Algorithm@DSP@Audio@Kitty@@VIFunction@Math@5@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCConstant@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCConstant@Math@Kitty@@VIConstant@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCConstantBinaryFunction@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCConstantBinaryFunction@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCConstantComposition@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCConstantComposition@Math@Kitty@@VIConstant@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCConstantFunction@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCConstantFunction@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCConstantsCombination@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCConstantsCombination@Math@Kitty@@VIConstant@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCDataBuffer@Serialization@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCFilterCascadeGainResponse@Algorithm@DSP@Audio@Kitty@@V12345@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCFilterCascadeGainResponse@Algorithm@DSP@Audio@Kitty@@VIFunction@Math@5@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCFunctionProxy@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCFunctionProxy@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCFunctionsCombination@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCFunctionsCombination@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCFunctionsComposition@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCFunctionsComposition@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCMIDICCSetting@Plugin@Audio@Kitty@@V1234@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCMonoQuadGain@Algorithm@DSP@Audio@Kitty@@V12345@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCMonoQuadGain@Algorithm@DSP@Audio@Kitty@@VIFunction@Math@5@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCMonoQuadPhaseShift@Algorithm@DSP@Audio@Kitty@@V12345@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCMonoQuadPhaseShift@Algorithm@DSP@Audio@Kitty@@VIFunction@Math@5@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCSweptCurvesFunction@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCSweptCurvesFunction@Math@Kitty@@VIBinaryFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCSweptValues@Math@Kitty@@V123@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCSweptValues@Math@Kitty@@VIFunction@23@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCTodBFunction@Algorithm@DSP@Audio@Kitty@@V12345@@Runtime@Kitty@@2_NB
?registered@?$TStaticFactory@VCTodBFunction@Algorithm@DSP@Audio@Kitty@@VIFunction@Math@5@@Runtime@Kitty@@2_NB
DllRegisterServer
DllUnregisterServer
NewPlugIn
_PI_GetRoutineDescriptor

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 349KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

STLPORT_
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Blue Cat Stereo Chorus RTAS.dpm.rsr
BlueCatStereoChorus_vc9redist.exe
.exe windows:5 windows x86 arch:x86

092eb6daba2f17cbda102fd1a32acd00

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:14:2c:a7:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/06/2007, 23:54

Not After

13/06/2012, 00:04

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3e:b8:2d:0b:41:de:b8:14:82:b2:6d:80:ac:85:6a:a4:1c:9b:ef:50
Signer

Actual PE Digest

3e:b8:2d:0b:41:de:b8:14:82:b2:6d:80:ac:85:6a:a4:1c:9b:ef:50

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
SetEvent
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
GetVersionExA
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
CreateFileA
FindNextFileA
FindFirstFileA
CopyFileA
SetFileAttributesA
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceA
QueryDosDeviceA
GetCurrentDirectoryA
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetExitCodeProcess
CreateProcessA
ExpandEnvironmentStringsA
GetFileSize
CreateThread
CreateEventA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
CloseHandle
DeviceIoControl
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
SetErrorMode
GetTickCount
CreateDirectoryA
GetLastError
RemoveDirectoryA
MoveFileExA
SetFilePointer
FindClose
ReadFile

msvcrt

strchr
_strnicmp
_stricmp
strrchr
_strlwr
strncpy
strstr
_snprintf
sprintf

advapi32

AllocateAndInitializeSid
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
OpenProcessToken

user32

ShowWindow
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
LoadStringA
EndDialog
SetParent
MessageBoxA

ntdll

NtShutdownSystem
NtAdjustPrivilegesToken
NtClose
NtOpenProcessToken

comctl32

ord17

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 84KB

.rsrc Size: 43KB - Virtual size: 42KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

c6a59b1080c20e84c1c392f75b2d75f4

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 192B

.reloc Size: 512B - Virtual size: 118B

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 572B

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 84KB

.rsrc
Size: 43KB - Virtual size: 42KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 192B

.reloc
Size: 512B - Virtual size: 118B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 572B

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 84KB

.rsrc
Size: 43KB - Virtual size: 42KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 349KB - Virtual size: 365KB

STLPORT_
Size: 512B - Virtual size: 32B

.rsrc
Size: 1024B - Virtual size: 964B

.reloc
Size: 316KB - Virtual size: 316KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:0f:78:4d:00:00:00:00:00:03
Certificate

61:14:2c:a7:00:00:00:00:00:06
Certificate

61:14:2c:a7:00:00:00:00:00:06
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

3e:b8:2d:0b:41:de:b8:14:82:b2:6d:80:ac:85:6a:a4:1c:9b:ef:50
Signer

.text
Size: 30KB - Virtual size: 30KB