3dfbf6e56bf9d528b0cecdb4d007c405_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3dfbf6e56bf9d528b0cecdb4d007c405_JaffaCakes118
Size

3.4MB
MD5

3dfbf6e56bf9d528b0cecdb4d007c405
SHA1

11ec183306bf80911f38dfe1161f25a0f4cb3cc9
SHA256

b9438a335710a420f37704909045f8d9b34d3e9a80462723147dbc796c4cff9d
SHA512

8216a66727aa94284f33fceadf1d7da138399a8ef70ab3d0e7a8dcef22bd0de4b7bed55ec42eeb1eaf7bc18a155aeca746e3e226ab021e6c2c4462588ba7264b
SSDEEP

98304:+8pXJuswMXXEtfKFvS9Y2oDznc2CGj1kdK:+qKAXEtipS9Y1f0GZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
3dfbf6e56bf9d528b0cecdb4d007c405_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/LhNsis.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/ebanner.dll
unpack001/$PLUGINSDIR/messagebox.dll
unpack001/msvcr71.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

3dfbf6e56bf9d528b0cecdb4d007c405_JaffaCakes118
.exe windows:4 windows x86 arch:x86

237a51742fed62d237b6f1b75452402f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
SetFileTime
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
MulDiv
FindNextFileA
FindFirstFileA
DeleteFileA
CopyFileA

user32

ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
SystemParametersInfoA
RegisterClassA
EndDialog
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
CreateDialogParamA
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
LoadImageA
GetDC
EnableWindow
InvalidateRect
CreateWindowExA
GetWindowLongA
DrawFocusRect
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
TrackPopupMenu
wsprintfA
SendMessageA
CallWindowProcA
MapWindowPoints
GetWindowRect
ScreenToClient
PtInRect
LoadCursorA
SetCursor
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SetWindowLongA

gdi32

SetBkColor
GetDeviceCaps
GetCurrentObject
GetObjectA
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegEnumKeyA
RegEnumValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegQueryValueExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 368KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

57354bdeea3dfae6e948101add87501a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
GetPrivateProfileIntA
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
MultiByteToWideChar
GlobalAlloc

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
MapWindowPoints
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadIconA

gdi32

SetTextColor
GetObjectA
SelectObject
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
CreateCompatibleDC

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 954B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
RtlUnwind
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP

Exports

Exports

KillProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LhNsis.dll
.dll windows:4 windows x86 arch:x86

ac1e176598330255d8580fd7511f747e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\GameBox_Src_Cli\trunk\Project1\LhNsis\KuWoNsis\Release\LhNsis.pdb

Imports

kernel32

ExitProcess
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
GetCommandLineA
HeapSize
HeapReAlloc
TerminateProcess
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapDestroy
HeapCreate
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GetCurrentProcess
FlushFileBuffers
SetFilePointer
WriteFile
GetOEMCP
GetCPInfo
GlobalFlags
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
LoadLibraryA
FreeLibrary
lstrcmpW
InterlockedIncrement
RaiseException
SetErrorMode
GetModuleHandleA
GetProcAddress
GetModuleFileNameA
lstrcatA
GetCurrentThreadId
CloseHandle
InterlockedDecrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
SetLastError
FindResourceA
LoadResource
LockResource
SizeofResource
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
lstrlenA
lstrcmpiA
GetVersion
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
GlobalAlloc
lstrcpynA
lstrcpyA
VirtualFree
GlobalFree

user32

PostQuitMessage
DestroyMenu
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ClientToScreen
SetWindowTextA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetWindowTextA
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
LoadIconA
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
PostMessageA
AdjustWindowRectEx
GetClassInfoA
RegisterClassA
GetDlgCtrlID
DefWindowProcA
GetSubMenu
GetMenuItemCount
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetWindow
SetMenuItemBitmaps
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
GetMessagePos
GetMenuItemID
GetMenuState
UnhookWindowsHookEx
ValidateRect
PeekMessageA
GetKeyState
SendMessageA
DispatchMessageA
CallNextHookEx
SetWindowsHookExA
MessageBoxA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassA

gdi32

TextOutA
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
GetDeviceCaps
RectVisible
PtVisible
SetMapMode
RestoreDC
SaveDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
ExtTextOutA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

SetNamedSecurityInfoA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA

comctl32

ord17

shlwapi

PathFindFileNameA
PathFindExtensionA

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

AddAccessRights

Sections

.text
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ebanner.dll
.dll windows:5 windows x86 arch:x86

7fea26f6494f3be39d6fb127ff948275

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvfw32

MCIWndCreateA

kernel32

IsDebuggerPresent
TerminateProcess
lstrcatA
lstrcmpiA
Sleep
MultiByteToWideChar
GlobalFree
lstrcpyA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
RtlUnwind

user32

SetWindowLongA
IsWindow
SendMessageA
ShowWindow
CallWindowProcA
GetClientRect
IsWindowVisible
FindWindowExA
ValidateRect
ReleaseDC
RedrawWindow
UpdateWindow
GetDC
GetWindowLongA

ole32

CoCreateInstance

Exports

Exports

play
show
stop

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/messagebox.dll
.dll windows:4 windows x86 arch:x86

c3f3267799760b39c4e2763e70fc3909

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
lstrlenA
GetCurrentThreadId
lstrcpyA
GlobalAlloc
LoadLibraryA
FreeLibrary
lstrcpynA
lstrcmpA
GlobalFree

user32

FindWindowA
SetWindowPos
ReleaseDC
MapWindowPoints
GetWindowRect
GetDlgItem
ScreenToClient
SystemParametersInfoA
UnhookWindowsHookEx
GetDC
CallNextHookEx
wsprintfA
MessageBoxIndirectA
SetWindowsHookExA
GetWindowTextA
SendMessageA
CallWindowProcA
SetWindowLongA
SetWindowTextA

gdi32

GetTextExtentPointA
GetTextMetricsA
SelectObject

Exports

Exports

show

Sections

.rdata
Size: 1024B - Virtual size: 998B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$SMSTARTUP/7k7kϷ.exe
.exe windows:4 windows x86 arch:x86

237a51742fed62d237b6f1b75452402f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:f7:f7:18:8b:d2:0c:4a:59:53:c2:f3:e0:b6:ac:6b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

29/09/2010, 00:00

Not After

28/09/2012, 23:59

Subject

CN=Beijing Qike Information Technology co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=GameBox support,O=Beijing Qike Information Technology co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cf:54:84:1e:d4:cb:dc:34:08:d3:39:f4:2f:70:62:1d:eb:f7:69:a9
Signer

Actual PE Digest

cf:54:84:1e:d4:cb:dc:34:08:d3:39:f4:2f:70:62:1d:eb:f7:69:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
SetFileTime
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
MulDiv
FindNextFileA
FindFirstFileA
DeleteFileA
CopyFileA

user32

ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
SystemParametersInfoA
RegisterClassA
EndDialog
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
CreateDialogParamA
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
LoadImageA
GetDC
EnableWindow
InvalidateRect
CreateWindowExA
GetWindowLongA
DrawFocusRect
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
TrackPopupMenu
wsprintfA
SendMessageA
CallWindowProcA
MapWindowPoints
GetWindowRect
ScreenToClient
PtInRect
LoadCursorA
SetCursor
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SetWindowLongA

gdi32

SetBkColor
GetDeviceCaps
GetCurrentObject
GetObjectA
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegEnumKeyA
RegEnumValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegQueryValueExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 264KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/config.ini
$TEMP/hengban1.bmp
$TEMP/hengban2.bmp
LangHua.exe
.exe windows:4 windows x86 arch:x86

ecba8974ea081dac1be8c14f3b2003e1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:f7:f7:18:8b:d2:0c:4a:59:53:c2:f3:e0:b6:ac:6b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

29/09/2010, 00:00

Not After

28/09/2012, 23:59

Subject

CN=Beijing Qike Information Technology co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=GameBox support,O=Beijing Qike Information Technology co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

44:30:32:a7:84:15:90:f8:6d:ac:12:c1:8c:0b:42:96:e5:ff:35:75
Signer

Actual PE Digest

44:30:32:a7:84:15:90:f8:6d:ac:12:c1:8c:0b:42:96:e5:ff:35:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\GameBox_Src_Cli\trunk\GameBox\dev\prj\GameBox\Release\GameBox.pdb

Imports

http

?Disconnect@YL_CHTTPDownFile@@QAE_NXZ
?IsDownloadFailed@YL_CHTTPDownFile@@QAE_NXZ
?GetFailedReason@YL_CHTTPDownFile@@QAE?AW4HTTP_DOWN_FAILED_REASON@@XZ
?GetCurrentDownloadStatus@YL_CHTTPDownFile@@QAENXZ
?GetSpeed@YL_CHTTPDownFile@@QAEIXZ
?GetParamLocalFile@YL_CHTTPDownFile@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?AsyncDownloadFile@YL_CHTTPDownFile@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAI@Z
?GetFileSize@YL_CHTTPDownFile@@QAE_KXZ
?GetReturnCode@YL_CHTTPRequest@@QAE_NAAJ@Z
?GetHeader@YL_CHTTPRequest@@QAEPAEAAJ@Z
?Disconnect@YL_CHTTPRequest@@QAE_NXZ
??0YL_CHTTPRequest@@QAE@XZ
?Request@YL_CHTTPRequest@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4REQUEST_TYPE@1@JPAEI@Z
??1YL_CHTTPRequest@@QAE@XZ
?GetContent@YL_CHTTPRequest@@QAEPAEAAJ@Z
??0YL_CHTTPDownFile@@QAE@XZ
??1YL_CHTTPDownFile@@QAE@XZ
?DownloadFile@YL_CHTTPDownFile@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAI@Z

fzip

?UnCompress@YL_CFileZip@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@_N@Z
?UnCompress@YL_CFileZip@@SA_NPAXIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@_N@Z

lhlogsvr

?LogInit@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?LogRealMsg@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_NPAPAEPAI@Z
?LogUserActMsg@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?YL_Log@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H0PBDZZ

wininet

InternetGetCookieA
InternetGetConnectedState

winmm

mixerClose
mixerSetControlDetails
mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen
PlaySoundA
mixerGetControlDetailsA

pd

CloseKWMV
StartKWMV
GetResInfo
StartDown
StopDown

mfc71

ord5355
ord3987
ord1912
ord2081
ord2077
ord2039
ord1352
ord4986
ord1347
ord5913
ord5145
ord6269
ord5202
ord5161
ord1962
ord3183
ord606
ord357
ord3944
ord1343
ord4339
ord3740
ord4444
ord4443
ord4790
ord4204
ord4781
ord4388
ord4980
ord4171
ord4178
ord4587
ord4776
ord4386
ord4401
ord4399
ord4381
ord4384
ord4379
ord4863
ord4860
ord3974
ord5914
ord5151
ord5204
ord3344
ord1360
ord5174
ord1556
ord4273
ord393
ord732
ord5988
ord6091
ord5071
ord5072
ord5070
ord4797
ord4617
ord4844
ord4190
ord4213
ord4736
ord5211
ord4720
ord718
ord519
ord516
ord518
ord4867
ord1327
ord2036
ord1582
ord5212
ord4280
ord1521
ord4272
ord721
ord524
ord526
ord2428
ord4583
ord3070
ord2368
ord3255
ord1185
ord5331
ord6297
ord3302
ord5320
ord6286
ord2419
ord2420
ord2421
ord2418
ord2417
ord4067
ord2264
ord259
ord1580
ord870
ord2527
ord5611
ord6060
ord5608
ord6054
ord4161
ord6057
ord5888
ord6037
ord5727
ord5642
ord5647
ord5523
ord5588
ord5414
ord5401
ord5921
ord5719
ord3180
ord602
ord347
ord1279
ord5637
ord262
ord2346
ord3684
ord3576
ord5214
ord741
ord326
ord2991
ord572
ord662
ord425
ord629
ord1439
ord5089
ord384
ord868
ord4065
ord5529
ord6179
ord2469
ord1308
ord2176
ord5526
ord911
ord1916
ord2451
ord2903
ord5323
ord5493
ord1929
ord2263
ord4001
ord4123
ord5641
ord2707
ord3243
ord380
ord3287
ord3204
ord1646
ord1588
ord3312
ord736
ord1091
ord3596
ord760
ord1161
ord3997
ord6138
ord3648
ord3466
ord2246
ord1913
ord2615
ord5009
ord5012
ord4309
ord4135
ord2939
ord4904
ord943
ord5356
ord2992
ord2425
ord2424
ord4019
ord1557
ord3945
ord5148
ord5205
ord2173
ord1306
ord4277
ord4265
ord635
ord395
ord5165
ord4118
ord4299
ord4250
ord2019
ord333
ord3349
ord3348
ord3423
ord1545
ord4232
ord753
ord587
ord563
ord6168
ord651
ord1930
ord1564
ord416
ord6255
ord1009
ord2086
ord3164
ord5731
ord2164
ord3989
ord5055
ord5622
ord5985
ord4927
ord4342
ord4104
ord2719
ord907
ord4450
ord3650
ord3477
ord4132
ord2008
ord1302
ord4131
ord4961
ord4507
ord4946
ord4649
ord4964
ord5053
ord3033
ord4710
ord4796
ord4963
ord4377
ord4376
ord4287
ord4794
ord4948
ord4200
ord4516
ord4971
ord4480
ord4529
ord4970
ord4846
ord4501
ord4368
ord4439
ord5049
ord4559
ord4920
ord4519
ord4914
ord4389
ord1619
ord5206
ord5166
ord1562
ord2717
ord648
ord410
ord4298
ord4129
ord4928
ord4364
ord496
ord3514
ord5341
ord432
ord5403
ord1917
ord6017
ord2306
ord3331
ord1031
ord5563
ord1395
ord3454
ord1554
ord620
ord6035
ord3195
ord4761
ord4888
ord1614
ord2131
ord3605
ord1230
ord3908
ord4394
ord1654
ord1598
ord2083
ord2870
ord2884
ord2876
ord2878
ord3991
ord3799
ord4385
ord4400
ord5531
ord2853
ord2942
ord3169
ord468
ord694
ord2814
ord2787
ord3473
ord2090
ord1637
ord1558
ord4236
ord642
ord6120
ord3214
ord3651
ord1641
ord1571
ord4238
ord3230
ord658
ord1728
ord3875
ord2873
ord2794
ord3402
ord2882
ord5871
ord2092
ord2958
ord5866
ord3680
ord3587
ord754
ord4350
ord2987
ord3328
ord313
ord1198
ord589
ord330
ord3337
ord502
ord3397
ord1192
ord1160
ord2654
ord3879
ord5976
ord1968
ord1966
ord3339
ord2234
ord1071
ord3503
ord3295
ord3929
ord722
ord1955
ord5444
ord2271
ord2075
ord6062
ord300
ord751
ord2477
ord1470
ord2869
ord1595
ord562
ord2938
ord908
ord5710
ord298
ord6005
ord1118
ord5714
ord1253
ord3863
ord4100
ord2094
ord3244
ord1283
ord4041
ord2233
ord6144
ord1092
ord3233
ord423
ord660
ord5466
ord4063
ord866
ord3428
ord590
ord1117
ord331
ord3696
ord4320
ord2370
ord356
ord1793
ord1788
ord1883
ord1873
ord305
ord6288
ord785
ord6281
ord591
ord1931
ord1483
ord4098
ord2089
ord1547
ord4234
ord3171
ord655
ord5661
ord996
ord5107
ord2804
ord421
ord1151
ord630
ord383
ord3088
ord2021
ord385
ord5625
ord1443
ord2308
ord5284
ord5287
ord2159
ord5111
ord5868
ord3620
ord2250
ord314
ord2253
ord2252
ord4520
ord765
ord2566
ord763
ord3919
ord1629
ord1628
ord6103
ord5141
ord5160
ord1609
ord4457
ord5315
ord1320
ord1312
ord2146
ord5832
ord5831
ord2163
ord3988
ord6089
ord6064
ord4124
ord5802
ord2653
ord3759
ord6066
ord4117
ord4114
ord2718
ord3399
ord5571
ord5944
ord3114
ord3906
ord5947
ord3909
ord2058

msvcr71

_strnicmp
_strupr
_itoa
_stricmp
_setmbcp
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
_acmdln
_amsg_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
__security_error_handler
isspace
isalnum
fputc
?what@exception@@UBEPBDXZ
localtime
printf
_splitpath
isalpha
cos
isdigit
setlocale
atol
mbstowcs
_mbccpy
_mbsnbcmp
_mbsncmp
strchr
fflush
_mbclen
_mktime64
wcscmp
wcslen
_beginthreadex
memcmp
_mbsstr
fgets
toupper
isxdigit
tolower
_mbsicmp
strtol
_mbsrev
strtod
strtoul
_mbsnbcpy
_strdup
fprintf
strrchr
strncpy
_stat64
vsprintf
_vscprintf
_mbsrchr
_mbschr
ftell
wcschr
srand
rand
fseek
fread
fwrite
??0exception@@QAE@ABQBD@Z
rename
fopen
fclose
_localtime64
_time64
labs
atof
abs
_mbscmp
sscanf
atoi
memmove
strcpy
exit
_beginthread
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
__getmainargs
_initterm
__setusermatherr
??0exception@@QAE@ABV0@@Z
__RTDynamicCast
strncmp
_CxxThrowException
memcpy
strtok
strcmp
_atoi64
strcat
strlen
_snprintf
time
_purecall
free
malloc
__p___argc
strstr
memset
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__CxxFrameHandler
_resetstkoflw
_except_handler3
wcscpy
sprintf
_controlfp

kernel32

MultiByteToWideChar
GetVersion
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
FileTimeToSystemTime
GetFileTime
FormatMessageA
WaitForMultipleObjects
GetExitCodeProcess
LocalFree
OutputDebugStringA
Thread32Next
SuspendThread
OpenThread
Thread32First
GetLongPathNameA
ExitProcess
GetStartupInfoA
QueryPerformanceCounter
GetSystemTimeAsFileTime
lstrlenW
WideCharToMultiByte
lstrcmpiA
lstrlenA
WaitForSingleObject
GetLastError
ReleaseMutex
FreeLibrary
LoadLibraryA
GetCommandLineA
CreateMutexA
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
DuplicateHandle
GetCurrentProcess
CreateProcessA
GetCurrentProcessId
GetCommandLineW
InitializeCriticalSection
GetTickCount
LeaveCriticalSection
EnterCriticalSection
SetFileAttributesA
GetDiskFreeSpaceExA
SetEvent
SetProcessWorkingSetSize
CreateThread
CreateEventA
lstrcpynA
DeleteCriticalSection
RaiseException
TerminateThread
GetExitCodeThread
Sleep
GetModuleFileNameA
GetProcAddress
InterlockedIncrement
InterlockedDecrement
CopyFileA
CreateDirectoryA
CreateFileA
GetModuleHandleA
WritePrivateProfileStringA
GetPrivateProfileStringA
DeleteFileA
MulDiv
ResetEvent
GetCurrentThreadId
MoveFileExA
FindClose
FindFirstFileA
GetTempPathA
DeviceIoControl
GetDriveTypeA
GetLogicalDrives
GlobalFree
GlobalAlloc
FindResourceA
SizeofResource
LockResource
LoadResource
FindResourceExA
RemoveDirectoryA
FindNextFileA
GetFileAttributesA
GetLogicalDriveStringsA
GetSystemDirectoryA
GlobalUnlock
GlobalLock
MapViewOfFile
CreateFileMappingA
GetWindowsDirectoryA
lstrcpyA
WinExec
lstrcatA
ResumeThread
FreeResource
HeapAlloc
GetProcessHeap
HeapFree
GlobalReAlloc
GetCurrentDirectoryA
HeapDestroy
HeapReAlloc
HeapSize
SetLastError
VirtualProtect
FlushInstructionCache
GetCPInfo
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
OpenProcess

user32

DispatchMessageA
TranslateMessage
GetMessageA
RegisterClassA
GetClassInfoA
SetForegroundWindow
PostMessageA
IsWindowVisible
PostThreadMessageA
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
wsprintfW
GetKeyState
SetActiveWindow
wsprintfA
GetWindowTextA
DestroyWindow
IsDlgButtonChecked
CheckDlgButton
ExitWindowsEx
MessageBoxA
UnregisterHotKey
RegisterHotKey
GetAsyncKeyState
EnumChildWindows
RegisterWindowMessageA
GetDoubleClickTime
CheckMenuItem
AdjustWindowRectEx
GetDlgCtrlID
RemoveMenu
ModifyMenuA
InsertMenuA
GetSubMenu
GetMenuState
GetMenuItemID
GetMenuItemCount
AppendMenuA
DeleteMenu
CreatePopupMenu
CreateMenu
GetMenuItemInfoA
SetRectEmpty
RegisterClassExA
DestroyIcon
DrawIconEx
GetIconInfo
IntersectRect
GetWindowPlacement
IsRectEmpty
WindowFromDC
MapWindowPoints
DrawFrameControl
RemovePropA
SetPropA
CreateWindowExA
GetPropA
SetScrollRange
SetScrollPos
SetScrollInfo
GetScrollRange
GetScrollPos
GetScrollInfo
EnableScrollBar
DrawTextW
DrawEdge
GetNextDlgGroupItem
DrawFocusRect
ShowScrollBar
GetUpdateRect
CopyIcon
GetMessagePos
MessageBeep
GetFocus
CopyImage
FindWindowA
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
BringWindowToTop
GetCursorInfo
ScreenToClient
BeginPaint
EndPaint
SetLayeredWindowAttributes
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
UpdateWindow
LoadImageA
WindowFromPoint
GetWindowDC
FrameRect
DefWindowProcA
CallWindowProcA
FillRect
PeekMessageA
SetParent
SetWindowLongA
IsIconic
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
CopyRect
GetWindow
InflateRect
OffsetRect
EqualRect
SetRect
GetWindowLongA
GetDlgItem
ShowWindow
GetClassNameA
GetClassLongA
GetSysColorBrush
SetWindowPos
PtInRect
LoadIconA
EnableWindow
GetParent
SetCapture
GetCapture
KillTimer
RedrawWindow
ReleaseDC
GetDC
ClientToScreen
GetClientRect
GetSystemMenu
EnableMenuItem
DrawIcon
SystemParametersInfoA
MoveWindow
LoadBitmapA
IsMenu
GetCursorPos
SetWindowRgn
GetWindowRect
LoadCursorA
SetCursor
GetDesktopWindow
InvalidateRect
ReleaseCapture
SendMessageA
SetTimer
GetSystemMetrics
IsWindow
SendMessageTimeoutA
GetSysColor

gdi32

Escape
OffsetRgn
RectInRegion
ExtTextOutA
DeleteObject
BitBlt
TextOutA
RectVisible
PtVisible
CreateCompatibleDC
CreateCompatibleBitmap
FillRgn
CombineRgn
SetRectRgn
CreatePolygonRgn
CreateRectRgnIndirect
CreateRectRgn
DeleteDC
GetCurrentObject
GetTextMetricsA
CreateFontW
Rectangle
Ellipse
GetBkMode
CreateHatchBrush
GetTextExtentPoint32W
FrameRgn
EqualRgn
GetClipBox
GetDCOrgEx
SetWindowOrgEx
PlayEnhMetaFile
IntersectClipRect
CreatePatternBrush
SetBrushOrgEx
CreateBitmap
UnrealizeObject
GetTextExtentPointW
SelectClipRgn
SaveDC
StretchBlt
SetStretchBltMode
RestoreDC
GetTextExtentPoint32A
SetTextColor
SetBkColor
GetTextExtentPointA
CreateICA
ExtCreateRegion
GetDIBits
CreateDIBitmap
CreateHalftonePalette
CreatePalette
StretchDIBits
SelectPalette
RealizePalette
GetStockObject
SetBitmapDimensionEx
CreateFontA
GetBitmapDimensionEx
GetTextAlign
SetPixel
GetBkColor
GetPixel
Polygon
GetTextColor
CreateFontIndirectA
CreatePen
SetBkMode
GetDeviceCaps
CreateSolidBrush
SelectObject
GetObjectA
CreateDIBSection
PatBlt

msimg32

AlphaBlend
TransparentBlt

advapi32

RegEnumKeyA
InitializeSecurityDescriptor
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteValueA
RegEnumKeyExA
RegDeleteKeyA
RegQueryValueA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumValueA
RegOpenKeyA
SetSecurityDescriptorDacl

shell32

SHGetPathFromIDListA
Shell_NotifyIconA
DragQueryFileA
SHGetFolderPathA
ShellExecuteA
SHGetMalloc
SHBrowseForFolderA
SHGetSpecialFolderPathA
ShellExecuteExA
SHGetFileInfoA
SHGetSpecialFolderLocation

comctl32

ImageList_ReplaceIcon
ImageList_GetImageCount
ImageList_Remove
InitCommonControlsEx
ImageList_Draw
ImageList_AddMasked
_TrackMouseEvent
ord17
ImageList_GetIconSize
ImageList_Add
ImageList_GetIcon
ImageList_SetBkColor
ImageList_GetImageInfo
ImageList_EndDrag
ImageList_DragLeave

shlwapi

StrToIntA
PathFileExistsA
ColorHLSToRGB
ColorRGBToHLS
StrStrIA
PathRemoveFileSpecA
PathFindExtensionW
PathFindExtensionA
PathRemoveExtensionA
PathFindFileNameA

ole32

CoCreateInstance
CreateStreamOnHGlobal
CoInitialize

oleaut32

VariantClear
OleLoadPicture
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
SysAllocStringLen
VariantInit
SysAllocStringByteLen
SysStringByteLen
VariantCopy
OleCreatePictureIndirect
SysFreeString

msvcp71

??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?setf@ios_base@std@@QAEHHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?is_open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
?exceptions@ios_base@std@@QAEXH@Z
?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@II@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??0?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Bios_base@std@@QBEPAXXZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AViterator@12@XZ
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AViterator@12@V312@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@Viterator@12@0PB_W@Z
??_D?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?to_int_type@?$char_traits@_W@std@@SAGAB_W@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?max_size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?eof@?$char_traits@_W@std@@SAGXZ
?eq_int_type@?$char_traits@_W@std@@SA_NABG0@Z
?to_char_type@?$char_traits@_W@std@@SA_WABG@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?flags@ios_base@std@@QBEHXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?to_int_type@?$char_traits@D@std@@SAHABD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0_Lockit@std@@QAE@H@Z
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@@Z
?_Incref@facet@locale@std@@QAEXXZ
?_Register@facet@locale@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1locale@std@@QAE@XZ
?width@ios_base@std@@QBEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?eof@?$char_traits@D@std@@SAHXZ
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?to_char_type@?$char_traits@D@std@@SADABH@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?width@ios_base@std@@QAEHH@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

gdiplus

GdipCloneImage
GdipReleaseDC
GdipDrawImageRectRectI
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenColor
GdipGetPenColor
GdipGetPenFillType
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawArc
GdipFillRectangle
GdipDrawString
GdipDisposeImage
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipCreateBitmapFromGraphics
GdipCreateFromHWND
GdipCreateFromHWNDICM
GdipDrawImageRectI
GdipSetInterpolationMode
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreatePath
GdipDeletePath
GdipClonePath
GdipAddPathLineI
GdipAddPathArcI
GdipDrawPath
GdipCreateFromHDC
GdipAlloc
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRect
GdipFillPolygon
GdipDrawImageRectRect
GdipSetSmoothingMode
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushFromRect
GdiplusStartup
GdiplusShutdown
GdipDrawLineI

sensapi

IsNetworkAlive

ws2_32

htons
gethostbyname
closesocket
connect
send
recv
socket

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 364KB - Virtual size: 362KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SHARED
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Skin/CommonSkin/Login/CoverFrame.png
.png
Skin/CommonSkin/Login/LoginBK.bmp
Skin/CommonSkin/Login/LoginBtnCloseDown.bmp
Skin/CommonSkin/Login/LoginBtnCloseNormal.bmp
Skin/CommonSkin/Login/LoginBtnCloseOver.bmp
Skin/CommonSkin/Login/LoginEditBorderGlow.bmp
Skin/CommonSkin/Login/LoginEditBorderGlow2.bmp
Skin/CommonSkin/Login/LoginEditBorderNormal.bmp
Skin/CommonSkin/Login/LoginEditBorderNormal2.bmp
Skin/CommonSkin/Login/LoginEditRegBorderNorma.bmp
Skin/CommonSkin/Login/LoginEditRegBorderNorma2l.bmp
Skin/CommonSkin/Login/LoginPass.bmp
Skin/CommonSkin/Login/LoginRegisterPic.bmp
Skin/CommonSkin/Login/MessageTip.bmp
Skin/CommonSkin/Login/NoTipNoCheckCheckDown.bmp
Skin/CommonSkin/Login/NoTipNoCheckCheckNormal.bmp
Skin/CommonSkin/Login/TrayMessagePort.bmp
Skin/CommonSkin/Login/UserRegisterBK.bmp
Skin/CommonSkin/Login/_2LoginBtnAutologin.bmp
Skin/CommonSkin/Login/_2LoginBtnRemPassword.bmp
Skin/CommonSkin/Login/_2LoginRegister.bmp
Skin/CommonSkin/Login/_2LoginRegisterLogin.bmp
Skin/CommonSkin/Login/_3LoginBtnLogin.bmp
Skin/CommonSkin/Login/trayMessageBottom.bmp
Skin/CommonSkin/Login/trayMessageHead.bmp
Skin/CommonSkin/Login/trayMessageMiddle.bmp
Skin/default/AddGameTriangleDown.bmp
Skin/default/AddGameTriangleHover.bmp
Skin/default/AddGameTriangleNormal.bmp
Skin/default/AutoAddDown.bmp
Skin/default/AutoAddHover.bmp
Skin/default/AutoAddNormal.bmp
Skin/default/BottomAdPanelBK.bmp
Skin/default/BottomPanelBKLeft.bmp
Skin/default/BottomPanelBKMid.bmp
Skin/default/BottomPanelBKRight.bmp
Skin/default/BottomUpLine.bmp
Skin/default/CancelAddDown.bmp
Skin/default/CancelAddHover.bmp
Skin/default/CancelAddNormal.bmp
Skin/default/ChangeSkinBK.bmp
Skin/default/CollapseDown.bmp
Skin/default/CollapseNormal.bmp
Skin/default/CollapseOver.bmp
Skin/default/CutDown.bmp
Skin/default/CutNormal.bmp
Skin/default/CutOver.bmp
Skin/default/DlgHotKeyBK.bmp
Skin/default/DownMgrDelHover.bmp
Skin/default/DownMgrDelNormal.bmp
Skin/default/DownMgrPauseHover.bmp
Skin/default/DownMgrPauseNormal.bmp
Skin/default/DownMgrProgressBar.bmp
Skin/default/DownMgrProgressShell.bmp
Skin/default/DownMgrStartHover.bmp
Skin/default/DownMgrStartNormal.bmp
Skin/default/DownMgrStatusDowning.bmp
Skin/default/DownMgrStatusError.bmp
Skin/default/DownMgrStatusPause.bmp
Skin/default/DownMgrStatusWait.bmp
Skin/default/DownPathSelBk.bmp
Skin/default/DownPathSelBrowseHover.bmp
Skin/default/DownPathSelBrowseNormal.bmp
Skin/default/DownPathSelCancelHover.bmp
Skin/default/DownPathSelCancelNormal.bmp
Skin/default/DownPathSelOkHover.bmp
Skin/default/DownPathSelOkNormal.bmp
Skin/default/DownPathSel_PopUpDialog.bmp
Skin/default/DownPathSel_UnPopUpDialog.bmp
Skin/default/DownProgressBarEmptyMiddle.bmp
Skin/default/DownProgressBarEmptyRight.bmp
Skin/default/DownProgressBarFullMiddle.bmp
Skin/default/DownProgressBarFullRight.bmp
Skin/default/DownProgressBarLeft.bmp
Skin/default/DownProgressLogo.bmp
Skin/default/DownTipsBack.bmp
Skin/default/DownTipsPcGame.bmp
Skin/default/DownTipsSwfGame.bmp
Skin/default/DownloadInfoProgressBar.bmp
Skin/default/DownloadInfoProgressShell.bmp
Skin/default/DownloadingTitle.bmp
Skin/default/ExitFullDown.bmp
Skin/default/ExitFullNormal.bmp
Skin/default/ExitFullOver.bmp
Skin/default/ExpandDown.bmp
Skin/default/ExpandNormal.bmp
Skin/default/ExpandOver.bmp
Skin/default/FrameBottomLeft.bmp
Skin/default/FrameBottomLeftMask.bmp
Skin/default/FrameBottomMid.bmp
Skin/default/FrameBottomRight.bmp
Skin/default/FrameBottomRightMask.bmp
Skin/default/FrameLeftBottom.bmp
Skin/default/FrameLeftMid.bmp
Skin/default/FrameLeftTop.bmp
Skin/default/FrameRightBottom.bmp
Skin/default/FrameRightMid.bmp
Skin/default/FrameRightTop.bmp
Skin/default/FrameTopLeft.bmp
Skin/default/FrameTopLeftMask.bmp
Skin/default/FrameTopMid.bmp
Skin/default/FrameTopRight.bmp
Skin/default/FrameTopRightMask.bmp
Skin/default/GameInfoCloseNormal.bmp
Skin/default/GameInfoCloseOver.bmp
Skin/default/GameInfoOpenNormal.bmp
Skin/default/GameInfoOpenOver.bmp
Skin/default/GameRePlayDown.bmp
Skin/default/GameRePlayNormal.bmp
Skin/default/GameRePlayOver.bmp
Skin/default/HotKeyDelayHover.bmp
Skin/default/HotKeyDelayNormal.bmp
Skin/default/HotKeyResetHover.bmp
Skin/default/HotKeyResetNormal.bmp
Skin/default/IconTreeNodeCategory.bmp
Skin/default/ListBkTop.bmp
Skin/default/ListHeaderBk.bmp
Skin/default/ListHeaderMidLine.bmp
Skin/default/ListHeaderSortAsc.bmp
Skin/default/ListHeaderSortDesc.bmp
Skin/default/ListHoverBK.bmp
Skin/default/ManualAddDown.bmp
Skin/default/ManualAddHover.bmp
Skin/default/ManualAddNormal.bmp
Skin/default/MuteDown.bmp
Skin/default/MuteNormal.bmp
Skin/default/MuteOver.bmp
Skin/default/PNG/SkinFrame.png
.png
Skin/default/PNG/TopPanelBtnBugReport.png
.png
Skin/default/PNG/TopPanelBtnClose.png
.png
Skin/default/PNG/TopPanelBtnMax.png
.png
Skin/default/PNG/TopPanelBtnMin.png
.png
Skin/default/PNG/TopPanelBtnRestore.png
.png
Skin/default/PNG/TopPanelBtnSetting.png
.png
Skin/default/PNG/TopPanelBtnSkin.png
.png
Skin/default/PNG/TopPanelLog.png
.png
Skin/default/PNG/right.png
.png
Skin/default/PNG/yes.png
.png
Skin/default/PauseDown.bmp
Skin/default/PauseNormal.bmp
Skin/default/PauseOver.bmp
Skin/default/PlayedGameSortTitleBar.bmp
Skin/default/QQPaneIcoSeriesGame.bmp
Skin/default/QQPaneIconDown.bmp
Skin/default/QQPaneIconExeGame.bmp
Skin/default/QQPaneIconHasTreeRight.bmp
Skin/default/QQPaneIconMyGame.bmp
Skin/default/QQPaneIconRight.bmp
Skin/default/QQPaneIconSwfGame.bmp
Skin/default/QQPaneIconWebGame.bmp
Skin/default/QQPaneLeft.bmp
Skin/default/QQPaneLeftDown.bmp
Skin/default/QQPaneLeftNormal.bmp
Skin/default/QQPaneLeftOver.bmp
Skin/default/QQPaneMiddleDown.bmp
Skin/default/QQPaneMiddleNormal.bmp
Skin/default/QQPaneMiddleOver.bmp
Skin/default/QQPaneRight.bmp
Skin/default/QQPaneRightDown.bmp
Skin/default/QQPaneRightNormal.bmp
Skin/default/QQPaneRightOver.bmp
Skin/default/SbujectSkin/1/TopPanelBKLeft.bmp
Skin/default/SbujectSkin/1/TopPanelBKMid.bmp
Skin/default/SbujectSkin/1/TopPanelBKRight.bmp
Skin/default/SbujectSkin/1/conf.ini
Skin/default/SbujectSkin/1/small.jpg
.jpg
Skin/default/SbujectSkin/Angry Birds HD/TopPanelBKLeft.bmp
Skin/default/SbujectSkin/Angry Birds HD/TopPanelBKMid.bmp
Skin/default/SbujectSkin/Angry Birds HD/TopPanelBKRight.bmp
Skin/default/SbujectSkin/Angry Birds HD/conf.ini
Skin/default/SbujectSkin/Angry Birds HD/small.bmp
Skin/default/SbujectSkin/Angry Birds HD/topleft.png
.png
Skin/default/SbujectSkin/Angry Birds HD/topright.png
.png
Skin/default/SbujectSkin/Merry Christmas/TopPanelBKLeft.bmp
Skin/default/SbujectSkin/Merry Christmas/TopPanelBKMid.bmp
Skin/default/SbujectSkin/Merry Christmas/TopPanelBKRight.bmp
Skin/default/SbujectSkin/Merry Christmas/conf.ini
Skin/default/SbujectSkin/Merry Christmas/small.bmp
Skin/default/SbujectSkin/Merry Christmas/topleft.png
.png
Skin/default/SbujectSkin/Merry Christmas/topright.png
.png
Skin/default/SbujectSkin/Ұ˼/TopPanelBKLeft.bmp
Skin/default/SbujectSkin/Ұ˼/TopPanelBKMid.bmp
Skin/default/SbujectSkin/Ұ˼/TopPanelBKRight.bmp
Skin/default/SbujectSkin/Ұ˼/conf.ini
Skin/default/SbujectSkin/Ұ˼/small.bmp
Skin/default/SbujectSkin/Ұ˼/topleft.png
.png
Skin/default/SbujectSkin/Ұ˼/topright.png
.png
Skin/default/SbujectSkin//TopPanelBKLeft.bmp
Skin/default/SbujectSkin//TopPanelBKMid.bmp
Skin/default/SbujectSkin//TopPanelBKRight.bmp
Skin/default/SbujectSkin//conf.ini
Skin/default/SbujectSkin//small.bmp
Skin/default/SbujectSkin//topleft.png
.png
Skin/default/SbujectSkin//TopPanelBKLeft.bmp
Skin/default/SbujectSkin//TopPanelBKMid.bmp
Skin/default/SbujectSkin//TopPanelBKRight.bmp
Skin/default/SbujectSkin//conf.ini
Skin/default/SbujectSkin//small.BMP
Skin/default/SbujectSkin//topleft.png
.png
Skin/default/SbujectSkin//topright.png
.png
Skin/default/SbujectSkin/ʬ/TopPanelBKLeft.bmp
Skin/default/SbujectSkin/ʬ/TopPanelBKMid.bmp
Skin/default/SbujectSkin/ʬ/TopPanelBKRight.bmp
Skin/default/SbujectSkin/ʬ/conf.ini
Skin/default/SbujectSkin/ʬ/small.bmp
Skin/default/SbujectSkin/ʬ/topleft.png
.png
Skin/default/SbujectSkin/ʬ/topright.png
.png
Skin/default/SbujectSkin//TopPanelBKLeft.bmp
Skin/default/SbujectSkin//TopPanelBKMid.bmp
Skin/default/SbujectSkin//TopPanelBKRight.bmp
Skin/default/SbujectSkin//conf.ini
Skin/default/SbujectSkin//small.bmp
Skin/default/SbujectSkin//topleft .png
.png
Skin/default/SbujectSkin//topright.png
.png
Skin/default/SbujectSkin//topright2.png
.png
Skin/default/ScrollHorz.bmp
Skin/default/ScrollVert.bmp
Skin/default/SearchBtnDown.bmp
Skin/default/SearchBtnNormal.bmp
Skin/default/SearchBtnOver.bmp
Skin/default/SearchEditBorder.bmp
Skin/default/SearchEditBorderIn.bmp
Skin/default/SearchEditBorderOut.bmp
Skin/default/SearchPanelBtnSearchHistoryDown.bmp
Skin/default/SearchPanelBtnSearchHistoryDown2.bmp
Skin/default/SearchPanelBtnSearchHistoryNormal.bmp
Skin/default/SearchPanelBtnSearchHistoryOver.bmp
Skin/default/SortByTimeDown.bmp
Skin/default/SortByTimeHover.bmp
Skin/default/SortByTimeNormal.bmp
Skin/default/SortByTimesDown.bmp
Skin/default/SortByTimesHover.bmp
Skin/default/SortByTimesNormal.bmp
Skin/default/SortByTypeDown.bmp
Skin/default/SortByTypeHover.bmp
Skin/default/SortByTypeNormal.bmp
Skin/default/SpliterBarDown.bmp
Skin/default/SpliterBarDownOver.bmp
Skin/default/SpliterBarLeft.bmp
Skin/default/SpliterBarLeftOver.bmp
Skin/default/SpliterBarRight.bmp
Skin/default/SpliterBarRightOver.bmp
Skin/default/SpliterBarUp.bmp
Skin/default/SpliterBarUpOver.bmp
Skin/default/SpliterHorzBK.bmp
Skin/default/SpliterOuterVertBK.bmp
Skin/default/SpliterOuterVertOpenBK.bmp
Skin/default/SpliterSlimHorz.bmp
Skin/default/SpliterSlimVert.bmp
Skin/default/SpliterVertBK.bmp
Skin/default/StartDown.bmp
Skin/default/StartNormal.bmp
Skin/default/StartOver.bmp
Skin/default/TabBarBottomLine.bmp
Skin/default/TabBarCloseNormal.bmp
Skin/default/TabBarCloseOver.bmp
Skin/default/TabBarRectLeftDown.bmp
Skin/default/TabBarRectLeftNormal.bmp
Skin/default/TabBarRectLeftOver.bmp
Skin/default/TabBarRectMiddleDown.bmp
Skin/default/TabBarRectMiddleNormal.bmp
Skin/default/TabBarRectMiddleOver.bmp
Skin/default/TabBarRectRightDown.bmp
Skin/default/TabBarRectRightNormal.bmp
Skin/default/TabBarRectRightOver.bmp
Skin/default/ToFullDown.bmp
Skin/default/ToFullNormal.bmp
Skin/default/ToFullOver.bmp
Skin/default/TopPanelBKLeft.bmp
Skin/default/TopPanelBKMid.bmp
Skin/default/TopPanelBKRight.bmp
Skin/default/UnMuteDown.bmp
Skin/default/UnMuteNormal.bmp
Skin/default/UnMuteOver.bmp
Skin/default/UserFeedBackBack.bmp
Skin/default/UserFeedBackDown.bmp
Skin/default/UserFeedBackNormal.bmp
Skin/default/UserFeedBackOver.bmp
Skin/default/UserInfoPanelMail.bmp
Skin/default/UserInfoPanelRemind.bmp
Skin/default/UserInfoPanelSpace.bmp
Skin/default/_2ChangeSkinBtnMoreColor.bmp
Skin/default/_3ChangeSkinBtnClose.bmp
Skin/default/_3ChangeSkinBtnSub.bmp
Skin/default/_3CommonBtn.bmp
Skin/default/config.xml
.xml
Skin/default/config.xml.org
.xml
Skin/default/config.xml.temp
.xml
Skin/default/defaultPicGame.jpg
.jpg
Skin/default/minorexitback1.bmp
Skin/default/minorexitback2.bmp
Skin/default/minorexitboxchk.bmp
Skin/default/minorexitboxunchk.bmp
Skin/default/minorexitcancel.bmp
Skin/default/minorexitcancelDown.bmp
Skin/default/minorexitok.bmp
Skin/default/minorexitokDown.bmp
Skin/default/minorexitradchk.bmp
Skin/default/minorexitradunchk.bmp
Skin/default/onlinegametag.gif
.gif
Skin/default/trayMessageHead.bmp
config.ini
favicon.ico
msvcr71.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 228KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
readme.txt
res/DataEntry.xml
.xml
res/GameVersion.xml
.xml
res/default.jpg
.jpg
res/default_swf.JPG
.jpg
res/history/his.dat
res/html/404_narrow.gif
.gif
res/html/404_wide.jpg
.jpg
res/html/SwfGamePlaying.htm
.html .js polyglot
res/html/netload.swf
res/html/no.swf
res/html/weberror.htm
.html .js polyglot
res/pic/lhc.img
res/pic/lhpcmd.img
res/pic/lhplog.img
res/pic/svr.img
run.exe
.exe windows:4 windows x86 arch:x86

237a51742fed62d237b6f1b75452402f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:f7:f7:18:8b:d2:0c:4a:59:53:c2:f3:e0:b6:ac:6b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

29/09/2010, 00:00

Not After

28/09/2012, 23:59

Subject

CN=Beijing Qike Information Technology co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=GameBox support,O=Beijing Qike Information Technology co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cf:54:84:1e:d4:cb:dc:34:08:d3:39:f4:2f:70:62:1d:eb:f7:69:a9
Signer

Actual PE Digest

cf:54:84:1e:d4:cb:dc:34:08:d3:39:f4:2f:70:62:1d:eb:f7:69:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
SetFileTime
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
MulDiv
FindNextFileA
FindFirstFileA
DeleteFileA
CopyFileA

user32

ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
SystemParametersInfoA
RegisterClassA
EndDialog
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
CreateDialogParamA
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
LoadImageA
GetDC
EnableWindow
InvalidateRect
CreateWindowExA
GetWindowLongA
DrawFocusRect
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
TrackPopupMenu
wsprintfA
SendMessageA
CallWindowProcA
MapWindowPoints
GetWindowRect
ScreenToClient
PtInRect
LoadCursorA
SetCursor
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SetWindowLongA

gdi32

SetBkColor
GetDeviceCaps
GetCurrentObject
GetObjectA
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegEnumKeyA
RegEnumValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegQueryValueExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 264KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

237a51742fed62d237b6f1b75452402f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 290KB

.ndata Size: - Virtual size: 368KB

.rsrc Size: 11KB - Virtual size: 12KB

57354bdeea3dfae6e948101add87501a

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 954B

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 2KB

ac1e176598330255d8580fd7511f747e

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

shlwapi

oleaut32

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 68KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 19KB

.rsrc Size: 16KB - Virtual size: 14KB

.reloc Size: 16KB - Virtual size: 14KB

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

Imports

kernel32

user32

ole32

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 290KB

.ndata
Size: - Virtual size: 368KB

.rsrc
Size: 11KB - Virtual size: 12KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 954B

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 72KB - Virtual size: 68KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 19KB

.rsrc
Size: 16KB - Virtual size: 14KB

.reloc
Size: 16KB - Virtual size: 14KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 494B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 900B

.CRT
Size: 512B - Virtual size: 4B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 1024B - Virtual size: 568B

.rdata
Size: 1024B - Virtual size: 998B

.data
Size: 3KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 444B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

79:f7:f7:18:8b:d2:0c:4a:59:53:c2:f3:e0:b6:ac:6b
Certificate

cf:54:84:1e:d4:cb:dc:34:08:d3:39:f4:2f:70:62:1d:eb:f7:69:a9
Signer

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 290KB

.ndata
Size: - Virtual size: 264KB

.rsrc
Size: 10KB - Virtual size: 12KB