General

Malware Config

Signatures

Files

• FrostyModManager.zip

  .zip
• FrostyControls.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 91KB - Virtual size: 91KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 936B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• FrostyCore.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 5.9MB - Virtual size: 5.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 912B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• FrostyHash.dll

  .dll windows x64

  e0024bab776a080fbe2677e3e4194691

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  DisableThreadLibraryCalls

  InitializeSListHead

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  GetModuleHandleW

  Sleep

  vcruntime140

  __current_exception

  __current_exception_context

  memset

  __FrameUnwindFilter

  __std_type_info_destroy_list

  __C_specific_handler

  memcpy

  api-ms-win-crt-runtime-l1-1-0

  _configure_narrow_argv

  _initialize_narrow_environment

  _initialize_onexit_table

  _register_onexit_function

  _execute_onexit_table

  _seh_filter_dll

  _crt_at_quick_exit

  _cexit

  terminate

  abort

  _initterm

  _crt_atexit

  _initterm_e

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 17KB - Virtual size: 16KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .nep

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 48KB - Virtual size: 47KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 1024B - Virtual size: 708B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 44B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• FrostyModManager.exe

  .exe windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 361KB - Virtual size: 360KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 144KB - Virtual size: 144KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• FrostyModSupport.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 104KB - Virtual size: 103KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 952B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• FrostySdk.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 2.6MB - Virtual size: 2.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 888B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Plugins/FsLocalizationPlugin.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 33KB - Virtual size: 33KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 948B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Plugins/LaunchPlatformPlugin.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 908B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Plugins/MeshSetPlugin.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 244KB - Virtual size: 243KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 868B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Plugins/Swbf2MergerPlugin.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 81KB - Virtual size: 80KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 884B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Prereqs/NET Framework 4.7.2.exe

  .exe windows x86

  9b2f6a441f9ff8df98ae6e9e6b5d4271

  
  

  Code Sign

  33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

  Certificate

  Issuer

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  07-09-2016 17:58

  Not After

  07-09-2018 17:58

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  11-08-2017 20:11

  Not After

  11-08-2018 20:11

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31-08-2010 22:19

  Not After

  31-08-2020 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:16:68:34:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  03-04-2007 12:53

  Not After

  03-04-2021 13:03

  Subject

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  11-08-2017 20:20

  Not After

  11-08-2018 20:20

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  b1:09:a9:d4:3c:aa:d0:ba:64:d3:e8:f3:19:68:6a:f2:f3:f3:04:e3:05:dc:22:54:b7:17:99:2f:ae:ed:e0:ba

  Signer

  Actual PE Digest

  b1:09:a9:d4:3c:aa:d0:ba:64:d3:e8:f3:19:68:6a:f2:f3:f3:04:e3:05:dc:22:54:b7:17:99:2f:ae:ed:e0:ba

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  20-01-2023 15:57

  Valid: false

  af:8b:14:7a:71:2b:42:a9:89:27:bf:94:37:d3:f1:79:9b:8f:22:46

  Signer

  Actual PE Digest

  af:8b:14:7a:71:2b:42:a9:89:27:bf:94:37:d3:f1:79:9b:8f:22:46

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  07-06-2018 22:05

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  CreateWellKnownSid

  InitializeSecurityDescriptor

  SetEntriesInAclW

  SetSecurityDescriptorDacl

  SetSecurityDescriptorOwner

  CryptAcquireContextW

  CryptGenRandom

  CryptReleaseContext

  DecryptFileW

  kernel32

  GetTickCount

  SetEnvironmentVariableW

  GetLastError

  ExpandEnvironmentStringsW

  CreateProcessW

  Sleep

  WaitForSingleObject

  GetExitCodeProcess

  CloseHandle

  SetFileAttributesW

  InitializeCriticalSection

  CreateEventW

  GetEnvironmentVariableW

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  SetEvent

  GetCommandLineW

  lstrlenW

  CompareStringW

  LocalFree

  CreateDirectoryW

  QueryDosDeviceW

  GetLogicalDriveStringsW

  GetDiskFreeSpaceExW

  GetDriveTypeW

  CreateFileW

  DeviceIoControl

  SetErrorMode

  RemoveDirectoryW

  MoveFileExW

  GetProcAddress

  GetSystemDirectoryW

  LoadLibraryW

  GetModuleHandleW

  CreateThread

  LocalAlloc

  RaiseException

  ExitThread

  WaitForMultipleObjects

  ResetEvent

  CreateEventA

  GetSystemInfo

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  FileTimeToDosDateTime

  GetModuleHandleA

  GetVersionExA

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  SetEndOfFile

  DuplicateHandle

  ReadFile

  SetFilePointerEx

  GlobalFree

  GetCommandLineA

  HeapSetInformation

  GetStartupInfoW

  SetUnhandledExceptionFilter

  ExitProcess

  WriteFile

  GetStdHandle

  GetModuleFileNameW

  GetModuleFileNameA

  FreeEnvironmentStringsW

  WideCharToMultiByte

  GetEnvironmentStringsW

  SetHandleCount

  InitializeCriticalSectionAndSpinCount

  GetFileType

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  InterlockedIncrement

  SetLastError

  GetCurrentThreadId

  InterlockedDecrement

  HeapCreate

  QueryPerformanceCounter

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  IsDebuggerPresent

  HeapFree

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  HeapAlloc

  LCMapStringW

  FreeLibrary

  InterlockedExchange

  RtlUnwind

  SetFilePointer

  GetConsoleCP

  GetConsoleMode

  MultiByteToWideChar

  GetStringTypeW

  HeapSize

  HeapReAlloc

  IsProcessorFeaturePresent

  SetStdHandle

  WriteConsoleW

  FlushFileBuffers

  CreateFileA

  GetLocalTime

  GetComputerNameW

  lstrlenA

  FormatMessageW

  GetSystemTime

  GetTimeZoneInformation

  SystemTimeToTzSpecificLocalTime

  DeleteFileW

  GetFileAttributesW

  FindFirstFileW

  FindNextFileW

  FindClose

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  GetProcessHeap

  GlobalAlloc

  LoadLibraryA

  comctl32

  ord17

  rpcrt4

  UuidToStringW

  UuidCreate

  RpcStringFreeW

  shell32

  CommandLineToArgvW

  SHBrowseForFolderW

  SHGetPathFromIDListW

  shlwapi

  PathRemoveExtensionW

  user32

  MessageBoxW

  GetTopWindow

  GetWindowThreadProcessId

  GetWindow

  SendMessageW

  PostMessageW

  DialogBoxParamW

  GetDlgItem

  SetWindowTextW

  EndDialog

  PostQuitMessage

  LoadStringW

  SetWindowLongW

  GetWindowLongW

  CharUpperW

  oleaut32

  SysAllocString

  VariantClear

  Exports

  Exports

  ?dwPlaceholder@@3PAEA

  _DecodePointerInternal@4

  _EncodePointerInternal@4

  Sections

  .text

  Size: 156KB - Virtual size: 156KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .boxld01

  Size: 512B - Virtual size: 182B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Prereqs/Visual C++ Redistributable for Visual Studio 2015.exe

  .exe windows x86

  8e2588a9cf43886de3449dfff03137b6

  
  

  Code Sign

  33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f

  Certificate

  Issuer

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  20-03-2015 17:32

  Not After

  20-06-2016 17:32

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  04-06-2015 17:42

  Not After

  04-09-2016 17:42

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31-08-2010 22:19

  Not After

  31-08-2020 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:16:68:34:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  03-04-2007 12:53

  Not After

  03-04-2021 13:03

  Subject

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  01-10-2014 18:11

  Not After

  01-01-2016 18:11

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  6b:c4:15:a1:23:fa:49:fb:dc:05:86:1f:21:48:b0:49:3b:d5:1d:dc:c6:72:35:17:aa:75:ea:bc:63:fa:76:f8

  Signer

  Actual PE Digest

  6b:c4:15:a1:23:fa:49:fb:dc:05:86:1f:21:48:b0:49:3b:d5:1d:dc:c6:72:35:17:aa:75:ea:bc:63:fa:76:f8

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  20-01-2023 15:57

  Valid: false

  57:19:7f:e6:ec:8b:ea:59:58:33:9f:f6:88:06:04:41:78:e0:04:94

  Signer

  Actual PE Digest

  57:19:7f:e6:ec:8b:ea:59:58:33:9f:f6:88:06:04:41:78:e0:04:94

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  26-06-2015 07:02

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  Imports

  gdiplus

  GdiplusShutdown

  GdiplusStartup

  GdipDeleteGraphics

  GdipFree

  GdipCloneImage

  GdipDisposeImage

  GdipGetImageWidth

  GdipGetImageHeight

  GdipCreateBitmapFromResource

  GdipCreateFromHDC

  GdipSetInterpolationMode

  GdipDrawImageRectI

  GdipAlloc

  advapi32

  QueryServiceConfigW

  CryptAcquireContextW

  CryptCreateHash

  CryptHashData

  CryptGetHashParam

  CryptDestroyHash

  CryptReleaseContext

  RegDeleteKeyW

  RegCreateKeyExW

  RegEnumKeyExW

  RegEnumValueW

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  OpenProcessToken

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegCloseKey

  RegDeleteValueW

  RegQueryValueExW

  GetUserNameW

  InitiateSystemShutdownExW

  CreateWellKnownSid

  InitializeAcl

  SetEntriesInAclW

  DecryptFileW

  ChangeServiceConfigW

  ControlService

  CloseServiceHandle

  QueryServiceStatus

  OpenServiceW

  OpenSCManagerW

  RegQueryInfoKeyW

  RegSetValueExW

  SetEntriesInAclA

  SetSecurityDescriptorGroup

  RegOpenKeyExW

  GetTokenInformation

  CheckTokenMembership

  AllocateAndInitializeSid

  FreeSid

  LookupAccountNameW

  SetNamedSecurityInfoW

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  SetSecurityDescriptorOwner

  user32

  GetMessageW

  PeekMessageW

  PostMessageW

  IsWindow

  PostQuitMessage

  GetWindowLongW

  SetWindowLongW

  DefWindowProcW

  UnregisterClassW

  DispatchMessageW

  TranslateMessage

  IsDialogMessageW

  MsgWaitForMultipleObjects

  WaitForInputIdle

  LoadCursorW

  BeginPaint

  EndPaint

  GetCursorPos

  MonitorFromPoint

  GetMonitorInfoW

  ReleaseDC

  MessageBoxW

  PostThreadMessageW

  RegisterClassW

  CreateWindowExW

  oleaut32

  VariantClear

  VariantInit

  SysAllocString

  SysFreeString

  gdi32

  GetDeviceCaps

  CreateDCW

  shell32

  ShellExecuteExW

  SHGetFolderPathW

  CommandLineToArgvW

  ole32

  CoTaskMemFree

  CoCreateInstance

  CoInitialize

  CoUninitialize

  CoInitializeEx

  StringFromGUID2

  CoInitializeSecurity

  CLSIDFromProgID

  kernel32

  GetCurrentProcess

  InitializeCriticalSection

  TlsFree

  DeleteCriticalSection

  CloseHandle

  TlsGetValue

  Sleep

  GetLastError

  ReleaseMutex

  TlsSetValue

  TlsAlloc

  GetCurrentThreadId

  GetVersionExW

  GetModuleHandleW

  ReadFile

  SetFilePointerEx

  CreateFileW

  GetCurrentProcessId

  GetProcessId

  WriteFile

  ConnectNamedPipe

  SetNamedPipeHandleState

  lstrlenW

  CompareStringW

  LocalFree

  CreateNamedPipeW

  WaitForSingleObject

  OpenProcess

  lstrlenA

  RemoveDirectoryW

  GetFileAttributesW

  ExpandEnvironmentStringsW

  LeaveCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetProcAddress

  VerifyVersionInfoW

  VerSetConditionMask

  GetComputerNameW

  GetTempPathW

  GetSystemDirectoryW

  GetSystemWow64DirectoryW

  GetVolumePathNameW

  HeapAlloc

  GetSystemDefaultLangID

  GetUserDefaultLangID

  GetDateFormatW

  GetSystemTime

  InterlockedExchange

  LoadLibraryW

  InterlockedCompareExchange

  GetExitCodeThread

  CreateThread

  SetEvent

  WaitForMultipleObjects

  CreateEventW

  ProcessIdToSessionId

  InterlockedIncrement

  InterlockedDecrement

  GetStringTypeW

  SetFileAttributesW

  FindClose

  FindNextFileW

  FindFirstFileW

  CreateProcessW

  SetCurrentDirectoryW

  GetCurrentDirectoryW

  GetExitCodeProcess

  SetThreadExecutionState

  CopyFileExW

  HeapSetInformation

  MapViewOfFile

  CreateFileMappingW

  CreateMutexW

  SetEndOfFile

  ResetEvent

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  CreateFileA

  GetSystemTimeAsFileTime

  VirtualFree

  VirtualAlloc

  DeleteFileW

  GetThreadLocale

  GetTimeZoneInformation

  TerminateProcess

  UnhandledExceptionFilter

  SystemTimeToTzSpecificLocalTime

  SystemTimeToFileTime

  GlobalAlloc

  IsProcessorFeaturePresent

  GetTickCount

  QueryPerformanceCounter

  HeapCreate

  SetLastError

  EncodePointer

  GetFileType

  InitializeCriticalSectionAndSpinCount

  SetHandleCount

  GetEnvironmentStringsW

  GlobalFree

  MoveFileExW

  CopyFileW

  GetFileSizeEx

  GetModuleHandleA

  RaiseException

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  RtlUnwind

  SetFilePointer

  WideCharToMultiByte

  GetConsoleCP

  GetConsoleMode

  HeapSize

  HeapReAlloc

  LCMapStringW

  MultiByteToWideChar

  SetStdHandle

  WriteConsoleW

  FlushFileBuffers

  GetLocalTime

  UnmapViewOfFile

  IsDebuggerPresent

  DuplicateHandle

  HeapFree

  FormatMessageW

  GetTempFileNameW

  GetWindowsDirectoryW

  CompareStringA

  FreeEnvironmentStringsW

  GetModuleFileNameW

  GetStdHandle

  DecodePointer

  ExitProcess

  SetUnhandledExceptionFilter

  GetStartupInfoW

  GetCommandLineW

  GetFullPathNameW

  CreateDirectoryW

  GetProcessHeap

  cabinet

  ord22

  ord20

  ord23

  crypt32

  CertGetCertificateContextProperty

  CryptHashPublicKeyInfo

  msi

  ord88

  ord17

  ord125

  ord116

  ord115

  ord118

  ord8

  ord171

  ord205

  ord45

  ord137

  ord141

  ord238

  ord190

  ord169

  ord90

  ord173

  ord111

  ord70

  rpcrt4

  UuidCreate

  wininet

  InternetCloseHandle

  HttpAddRequestHeadersW

  HttpOpenRequestW

  InternetErrorDlg

  InternetReadFile

  HttpSendRequestW

  InternetSetOptionW

  InternetOpenW

  HttpQueryInfoW

  InternetCrackUrlW

  InternetConnectW

  wintrust

  WinVerifyTrust

  WTHelperGetProvSignerFromChain

  WTHelperProvDataFromStateData

  CryptCATAdminCalcHashFromFileHandle

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  Sections

  .text

  Size: 229KB - Virtual size: 228KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 104KB - Virtual size: 104KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .wixburn

  Size: 512B - Virtual size: 56B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 14KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Prereqs/Visual C++ Redistributable for Visual Studio 2017.exe

  .exe windows x86

  58e63938ccf607896b1a0dac4dd9b11d

  
  

  Code Sign

  33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12-07-2018 20:11

  Not After

  26-07-2019 20:11

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  33:00:00:00:fc:a0:e2:4f:d0:dc:19:5a:3a:00:00:00:00:00:fc

  Certificate

  Issuer

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  23-08-2018 20:20

  Not After

  23-11-2019 20:20

  Subject

  CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31-08-2010 22:19

  Not After

  31-08-2020 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:16:68:34:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  03-04-2007 12:53

  Not After

  03-04-2021 13:03

  Subject

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:da:a6:63:82:46:0e:dc:d1:da:7a:7a:ef:17:25:8d:73:da:33:3f

  Signer

  Actual PE Digest

  07:da:a6:63:82:46:0e:dc:d1:da:7a:7a:ef:17:25:8d:73:da:33:3f

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  31-01-2019 19:25

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  Imports

  advapi32

  OpenProcessToken

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  InitiateSystemShutdownExW

  GetUserNameW

  RegCloseKey

  RegQueryValueExW

  RegDeleteValueW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  DecryptFileW

  CreateWellKnownSid

  InitializeAcl

  SetEntriesInAclW

  ChangeServiceConfigW

  CloseServiceHandle

  ControlService

  OpenSCManagerW

  OpenServiceW

  QueryServiceStatus

  QueryServiceConfigW

  SetNamedSecurityInfoW

  CheckTokenMembership

  AllocateAndInitializeSid

  SetEntriesInAclA

  SetSecurityDescriptorGroup

  SetSecurityDescriptorOwner

  SetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  RegSetValueExW

  RegQueryInfoKeyW

  RegEnumValueW

  RegEnumKeyExW

  RegDeleteKeyW

  RegCreateKeyExW

  GetTokenInformation

  CryptDestroyHash

  CryptHashData

  CryptCreateHash

  CryptGetHashParam

  CryptReleaseContext

  CryptAcquireContextW

  RegOpenKeyExW

  SystemFunction036

  user32

  WaitForInputIdle

  PostQuitMessage

  TranslateMessage

  DispatchMessageW

  DefWindowProcW

  RegisterClassW

  CreateWindowExW

  MessageBoxW

  GetCursorPos

  GetWindowLongW

  IsWindow

  LoadBitmapW

  LoadCursorW

  IsDialogMessageW

  MonitorFromPoint

  PostThreadMessageW

  MsgWaitForMultipleObjects

  PeekMessageW

  SetWindowLongW

  GetMessageW

  UnregisterClassW

  GetMonitorInfoW

  PostMessageW

  oleaut32

  SysAllocString

  SysFreeString

  VariantClear

  VariantInit

  gdi32

  StretchBlt

  SelectObject

  DeleteObject

  DeleteDC

  CreateCompatibleDC

  GetObjectW

  shell32

  CommandLineToArgvW

  ShellExecuteExW

  SHGetFolderPathW

  ole32

  CoInitializeEx

  CoUninitialize

  CoInitializeSecurity

  CLSIDFromProgID

  CoInitialize

  StringFromGUID2

  CoTaskMemFree

  CoCreateInstance

  kernel32

  FreeLibrary

  GetProcAddress

  EnterCriticalSection

  LeaveCriticalSection

  GetSystemTime

  GetNativeSystemInfo

  lstrlenW

  GetModuleHandleExW

  GetSystemDirectoryW

  GetTempPathW

  GetWindowsDirectoryW

  GetSystemWow64DirectoryW

  GetComputerNameW

  VerifyVersionInfoW

  GetVolumePathNameW

  CompareStringW

  GetDateFormatW

  GetSystemDefaultLangID

  GetUserDefaultLangID

  GetStringTypeW

  ExpandEnvironmentStringsW

  GetFileAttributesW

  ReadFile

  SetFilePointerEx

  CreateFileW

  CreateProcessW

  DuplicateHandle

  InterlockedExchange

  InterlockedCompareExchange

  LoadLibraryW

  lstrlenA

  CreateEventW

  GetCurrentProcessId

  ProcessIdToSessionId

  LocalFree

  OpenProcess

  GetProcessId

  WaitForSingleObject

  WriteFile

  ConnectNamedPipe

  SetNamedPipeHandleState

  CreateNamedPipeW

  CreateThread

  GetExitCodeThread

  FindClose

  SetFileAttributesW

  FindFirstFileW

  FindNextFileW

  SetEvent

  WaitForMultipleObjects

  InterlockedIncrement

  InterlockedDecrement

  ResetEvent

  SetEndOfFile

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  CreateFileA

  CompareStringA

  SetCurrentDirectoryW

  GetCurrentDirectoryW

  GetExitCodeProcess

  SetThreadExecutionState

  CopyFileExW

  MapViewOfFile

  UnmapViewOfFile

  CreateMutexW

  CreateFileMappingW

  GetThreadLocale

  VerSetConditionMask

  GetVersionExW

  GetModuleHandleW

  TlsFree

  TlsSetValue

  TlsGetValue

  SystemTimeToTzSpecificLocalTime

  VirtualFree

  VirtualAlloc

  RemoveDirectoryW

  MoveFileExW

  GetFullPathNameW

  CreateDirectoryW

  CopyFileW

  DeleteFileW

  GetFileSizeEx

  GetTempFileNameW

  FormatMessageW

  TlsAlloc

  CloseHandle

  GetLocalTime

  SetFilePointer

  Sleep

  ReleaseMutex

  DeleteCriticalSection

  InitializeCriticalSection

  GetLastError

  GetCurrentThreadId

  GetCurrentProcess

  WriteConsoleW

  DecodePointer

  FlushFileBuffers

  GetConsoleMode

  GetConsoleCP

  HeapReAlloc

  HeapSize

  GetProcessHeap

  SetStdHandle

  LCMapStringW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GlobalFree

  GetCommandLineW

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  IsValidCodePage

  FindFirstFileExW

  GetFileType

  HeapAlloc

  HeapSetInformation

  GetTimeZoneInformation

  SystemTimeToFileTime

  GlobalAlloc

  GetModuleHandleA

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  TerminateProcess

  GetModuleFileNameW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  LoadLibraryExW

  RtlUnwind

  SetLastError

  GetStdHandle

  MultiByteToWideChar

  WideCharToMultiByte

  ExitProcess

  GetACP

  HeapFree

  cabinet

  ord20

  ord22

  ord23

  crypt32

  CertGetCertificateContextProperty

  CryptHashPublicKeyInfo

  msi

  ord141

  ord137

  ord169

  ord70

  ord88

  ord190

  ord238

  ord173

  ord45

  ord205

  ord90

  ord171

  ord118

  ord115

  ord125

  ord17

  ord111

  ord116

  ord8

  rpcrt4

  UuidCreate

  wininet

  InternetOpenW

  InternetCloseHandle

  InternetConnectW

  InternetReadFile

  InternetErrorDlg

  InternetSetOptionW

  HttpOpenRequestW

  HttpAddRequestHeadersW

  HttpSendRequestW

  HttpQueryInfoW

  InternetCrackUrlW

  wintrust

  CryptCATAdminCalcHashFromFileHandle

  WTHelperProvDataFromStateData

  WTHelperGetProvSignerFromChain

  WinVerifyTrust

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  shlwapi

  PathCanonicalizeW

  Sections

  .text

  Size: 291KB - Virtual size: 290KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 121KB - Virtual size: 121KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .wixburn

  Size: 512B - Virtual size: 56B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Profiles/AnthemSDK.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 11.6MB - Virtual size: 11.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Profiles/BF1SDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 5.0MB - Virtual size: 5.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 684B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Profiles/BF4SDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 3.4MB - Virtual size: 3.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Profiles/BFHSDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 3.5MB - Virtual size: 3.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 684B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Profiles/BFVSDK.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 8.8MB - Virtual size: 8.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Profiles/DragonAgeSDK.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 4.2MB - Virtual size: 4.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 684B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Profiles/FIFA19SDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 5.6MB - Virtual size: 5.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Profiles/FIFA20SDK.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 8.9MB - Virtual size: 8.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Profiles/Fifa17SDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 3.7MB - Virtual size: 3.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Profiles/Fifa18SDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 5.1MB - Virtual size: 5.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Profiles/MADDEN19SDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 5.3MB - Virtual size: 5.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Profiles/MADDEN20SDK.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 7.7MB - Virtual size: 7.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Profiles/MassEffectSDK.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 6.8MB - Virtual size: 6.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Profiles/MirrorsEdgeSDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 3.3MB - Virtual size: 3.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Profiles/NFS14SDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 2.9MB - Virtual size: 2.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Profiles/NFS16SDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 3.7MB - Virtual size: 3.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Profiles/NFS17SDK.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 6.4MB - Virtual size: 6.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Profiles/NFSEDGESDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 3.8MB - Virtual size: 3.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 684B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Profiles/NFSHEATSDK.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 7.8MB - Virtual size: 7.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Profiles/PVZ1SDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 3.5MB - Virtual size: 3.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Profiles/PVZ2SDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 3.8MB - Virtual size: 3.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Profiles/PVZ3SDK.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 11.5MB - Virtual size: 11.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Profiles/StarWarsIISDK.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 9.0MB - Virtual size: 9.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Profiles/StarWarsSDK.dll

  .dll windows x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 3.8MB - Virtual size: 3.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 688B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• ThirdParty/CryptBase.dll

  .dll windows x64

  b402a08aa547a6b2bcf6d8761a84da62

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  user32

  MessageBoxA

  kernel32

  InitializeCriticalSectionAndSpinCount

  WriteConsoleW

  ExpandEnvironmentStringsA

  GetLastError

  VirtualProtect

  FreeLibrary

  GetProcAddress

  LoadLibraryA

  FormatMessageA

  HeapCreate

  HeapFree

  GetCurrentProcess

  Thread32Next

  Thread32First

  GetCurrentThreadId

  SuspendThread

  ResumeThread

  CreateToolhelp32Snapshot

  Sleep

  HeapReAlloc

  CloseHandle

  HeapAlloc

  HeapDestroy

  GetThreadContext

  GetCurrentProcessId

  GetModuleHandleW

  FlushInstructionCache

  SetThreadContext

  OpenThread

  VirtualFree

  VirtualAlloc

  GetSystemInfo

  VirtualQuery

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  TerminateProcess

  RtlUnwindEx

  InterlockedFlushSList

  RtlPcToFileHeader

  RaiseException

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  CreateFileW

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  LoadLibraryExW

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameA

  MultiByteToWideChar

  WideCharToMultiByte

  LCMapStringW

  FindClose

  FindFirstFileExA

  FindNextFileA

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetProcessHeap

  GetStdHandle

  GetFileType

  GetStringTypeW

  HeapSize

  SetStdHandle

  WriteFile

  FlushFileBuffers

  GetConsoleCP

  GetConsoleMode

  SetFilePointerEx

  Exports

  Exports

  SystemFunction001

  SystemFunction002

  SystemFunction003

  SystemFunction004

  SystemFunction005

  SystemFunction028

  SystemFunction029

  SystemFunction034

  SystemFunction036

  SystemFunction040

  SystemFunction041

  Sections

  .text

  Size: 46KB - Virtual size: 46KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 36KB - Virtual size: 36KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 648B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ThirdParty/LZMA.dll

  .dll windows x64

  acd67703cae3fc8ba3be16ae38a61dc2

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  VirtualAlloc

  VirtualFree

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  CloseHandle

  GetLastError

  InitializeCriticalSection

  SetEvent

  ResetEvent

  ReleaseSemaphore

  WaitForSingleObject

  CreateEventA

  CreateSemaphoreA

  WriteConsoleW

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  RtlUnwindEx

  InterlockedPushEntrySList

  InterlockedFlushSList

  SetLastError

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  EncodePointer

  RaiseException

  RtlPcToFileHeader

  CreateThread

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetModuleHandleExW

  ExitProcess

  GetModuleFileNameA

  GetModuleFileNameW

  MultiByteToWideChar

  WideCharToMultiByte

  HeapFree

  HeapAlloc

  GetCurrentThread

  GetDateFormatW

  GetTimeFormatW

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  FindClose

  FindFirstFileExA

  FindFirstFileExW

  FindNextFileA

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetEnvironmentVariableW

  GetProcessHeap

  GetStdHandle

  GetFileType

  SetConsoleCtrlHandler

  GetStringTypeW

  HeapSize

  HeapReAlloc

  SetStdHandle

  WriteFile

  FlushFileBuffers

  GetConsoleCP

  GetConsoleMode

  SetFilePointerEx

  OutputDebugStringA

  OutputDebugStringW

  WaitForSingleObjectEx

  CreateFileW

  Exports

  Exports

  Lzma2Uncompress

  LzmaUncompress

  Sections

  .text

  Size: 347KB - Virtual size: 346KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 69KB - Virtual size: 68KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ThirdParty/Newtonsoft.Json.dll

  .dll windows x86

  dae02f32a21e03ce65412f6e56942daa

  
  

  Code Sign

  02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

  Certificate

  Issuer

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  10-11-2006 00:00

  Not After

  10-11-2031 00:00

  Subject

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23

  Certificate

  Issuer

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  27-04-2018 12:41

  Not After

  27-04-2028 12:41

  Subject

  CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e

  Certificate

  Issuer

  CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

  Not Before

  25-10-2018 00:00

  Not After

  29-10-2021 12:00

  Subject

  SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-10-2019 00:00

  Not After

  17-10-2030 00:00

  Subject

  CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81

  Signer

  Actual PE Digest

  8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

  09-11-2019 00:56

  Valid: true

  Chain 1

  SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

  CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorDllMain

  Sections

  .text

  Size: 673KB - Virtual size: 673KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ThirdParty/UnRAR.dll

  .dll windows x64

  21cc0575dccc73f63dbb5896b6b52a1b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  CreateFileW

  DeleteFileW

  CreateHardLinkW

  GetShortPathNameW

  GetLongPathNameW

  MoveFileW

  WriteFile

  ReadFile

  FlushFileBuffers

  SetEndOfFile

  SetFilePointer

  SetFileAttributesW

  GetFileAttributesW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetVersionExW

  GetCurrentDirectoryW

  GetFullPathNameW

  FoldStringW

  FreeLibrary

  GetProcAddress

  GetCurrentProcessId

  SetThreadPriority

  SetThreadExecutionState

  LoadLibraryW

  GetSystemDirectoryW

  RemoveDirectoryW

  GetProcessAffinityMask

  CreateThread

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  SetEvent

  ResetEvent

  ReleaseSemaphore

  WaitForSingleObject

  CreateEventW

  CreateSemaphoreW

  GetSystemTime

  SystemTimeToTzSpecificLocalTime

  TzSpecificLocalTimeToSystemTime

  SystemTimeToFileTime

  FileTimeToLocalFileTime

  LocalFileTimeToFileTime

  FileTimeToSystemTime

  GetCPInfo

  IsDBCSLeadByte

  MultiByteToWideChar

  WideCharToMultiByte

  CompareStringW

  WriteConsoleW

  SetFilePointerEx

  HeapSize

  GetConsoleCP

  GetProcessHeap

  FreeEnvironmentStringsW

  CreateDirectoryW

  CloseHandle

  SetFileTime

  DeviceIoControl

  GetCurrentProcess

  Sleep

  SetLastError

  GetLastError

  AreFileApisANSI

  GetConsoleMode

  GetStdHandle

  GetFileType

  GetEnvironmentStringsW

  GetCommandLineW

  GetCommandLineA

  GetOEMCP

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  WaitForSingleObjectEx

  GetModuleHandleW

  IsDebuggerPresent

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlPcToFileHeader

  EncodePointer

  RaiseException

  RtlUnwindEx

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  LoadLibraryExW

  InterlockedFlushSList

  QueryPerformanceFrequency

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameA

  HeapFree

  HeapAlloc

  HeapReAlloc

  GetACP

  GetStringTypeW

  LCMapStringW

  SetStdHandle

  FindFirstFileExA

  FindNextFileA

  IsValidCodePage

  user32

  CharUpperW

  CharToOemBuffW

  CharToOemA

  OemToCharBuffA

  OemToCharA

  CharLowerW

  advapi32

  FreeSid

  AllocateAndInitializeSid

  LookupPrivilegeValueW

  SetFileSecurityW

  AdjustTokenPrivileges

  OpenProcessToken

  CheckTokenMembership

  Exports

  Exports

  RARCloseArchive

  RARGetDllVersion

  RAROpenArchive

  RAROpenArchiveEx

  RARProcessFile

  RARReadHeader

  RARReadHeaderEx

  RARSetCallback

  RARSetChangeVolProc

  RARSetPassword

  RARSetProcessDataProc

  Sections

  .text

  Size: 216KB - Virtual size: 216KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 62KB - Virtual size: 61KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gfids

  Size: 512B - Virtual size: 204B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ThirdParty/fifaconfig.exe

  .exe windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ThirdParty/liblz4.so.1.8.0.dll

  .dll windows x64

  50cdd5477420455c168372227cba52d9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetLastError

  GetModuleHandleA

  GetProcAddress

  GetSystemTimeAsFileTime

  GetTickCount

  InitializeCriticalSection

  LeaveCriticalSection

  QueryPerformanceCounter

  RtlAddFunctionTable

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  SetUnhandledExceptionFilter

  Sleep

  TerminateProcess

  TlsGetValue

  UnhandledExceptionFilter

  VirtualProtect

  VirtualQuery

  msvcrt

  __dllonexit

  __iob_func

  _amsg_exit

  _initterm

  _lock

  _onexit

  _unlock

  abort

  calloc

  free

  fwrite

  malloc

  memcpy

  memmove

  memset

  signal

  strlen

  strncmp

  vfprintf

  Exports

  Exports

  LZ4F_compressBegin

  LZ4F_compressBound

  LZ4F_compressEnd

  LZ4F_compressFrame

  LZ4F_compressFrameBound

  LZ4F_compressUpdate

  LZ4F_compressionLevel_max

  LZ4F_createCompressionContext

  LZ4F_createDecompressionContext

  LZ4F_decompress

  LZ4F_flush

  LZ4F_freeCompressionContext

  LZ4F_freeDecompressionContext

  LZ4F_getErrorName

  LZ4F_getFrameInfo

  LZ4F_getVersion

  LZ4F_isError

  LZ4F_resetDecompressionContext

  LZ4_compress

  LZ4_compressBound

  LZ4_compressHC

  LZ4_compressHC2

  LZ4_compressHC2_continue

  LZ4_compressHC2_limitedOutput

  LZ4_compressHC2_limitedOutput_continue

  LZ4_compressHC2_limitedOutput_withStateHC

  LZ4_compressHC2_withStateHC

  LZ4_compressHC_continue

  LZ4_compressHC_limitedOutput

  LZ4_compressHC_limitedOutput_continue

  LZ4_compressHC_limitedOutput_withStateHC

  LZ4_compressHC_withStateHC

  LZ4_compress_HC

  LZ4_compress_HC_continue

  LZ4_compress_HC_extStateHC

  LZ4_compress_continue

  LZ4_compress_default

  LZ4_compress_destSize

  LZ4_compress_fast

  LZ4_compress_fast_continue

  LZ4_compress_fast_extState

  LZ4_compress_limitedOutput

  LZ4_compress_limitedOutput_continue

  LZ4_compress_limitedOutput_withState

  LZ4_compress_withState

  LZ4_create

  LZ4_createHC

  LZ4_createStream

  LZ4_createStreamDecode

  LZ4_createStreamHC

  LZ4_decompress_fast

  LZ4_decompress_fast_continue

  LZ4_decompress_fast_usingDict

  LZ4_decompress_fast_withPrefix64k

  LZ4_decompress_safe

  LZ4_decompress_safe_continue

  LZ4_decompress_safe_partial

  LZ4_decompress_safe_usingDict

  LZ4_decompress_safe_withPrefix64k

  LZ4_freeHC

  LZ4_freeStream

  LZ4_freeStreamDecode

  LZ4_freeStreamHC

  LZ4_loadDict

  LZ4_loadDictHC

  LZ4_resetStream

  LZ4_resetStreamHC

  LZ4_resetStreamState

  LZ4_resetStreamStateHC

  LZ4_saveDict

  LZ4_saveDictHC

  LZ4_setStreamDecode

  LZ4_sizeofState

  LZ4_sizeofStateHC

  LZ4_sizeofStreamState

  LZ4_sizeofStreamStateHC

  LZ4_slideInputBuffer

  LZ4_slideInputBufferHC

  LZ4_uncompress

  LZ4_uncompress_unknownOutputSize

  LZ4_versionNumber

  LZ4_versionString

  Sections

  .text

  Size: 113KB - Virtual size: 112KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 88B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 88B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 104B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 148B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /4

  Size: 1024B - Virtual size: 752B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /19

  Size: 243KB - Virtual size: 243KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /31

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /45

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /57

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /70

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /81

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /92

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ThirdParty/libzstd.0.0.6.dll

  .dll windows x64

  093d494eed4e2ae5b6d621211d3c6501

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  vcruntime140

  memset

  memcpy

  __std_type_info_destroy_list

  __C_specific_handler

  memmove

  api-ms-win-crt-heap-l1-1-0

  malloc

  calloc

  free

  api-ms-win-crt-runtime-l1-1-0

  _crt_atexit

  _execute_onexit_table

  _register_onexit_function

  _initialize_onexit_table

  _configure_narrow_argv

  _seh_filter_dll

  _initterm_e

  _initterm

  _cexit

  _initialize_narrow_environment

  kernel32

  GetCurrentThreadId

  RtlCaptureContext

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  InitializeSListHead

  DisableThreadLibraryCalls

  GetSystemTimeAsFileTime

  RtlLookupFunctionEntry

  GetCurrentProcessId

  QueryPerformanceCounter

  IsProcessorFeaturePresent

  TerminateProcess

  GetCurrentProcess

  Exports

  Exports

  ZBUFF_compressContinue

  ZBUFF_compressEnd

  ZBUFF_compressFlush

  ZBUFF_compressInit

  ZBUFF_compressInitDictionary

  ZBUFF_compressInit_advanced

  ZBUFF_createCCtx

  ZBUFF_createDCtx

  ZBUFF_decompressContinue

  ZBUFF_decompressInit

  ZBUFF_decompressInitDictionary

  ZBUFF_freeCCtx

  ZBUFF_freeDCtx

  ZBUFF_getErrorName

  ZBUFF_isError

  ZBUFF_recommendedCInSize

  ZBUFF_recommendedCOutSize

  ZBUFF_recommendedDInSize

  ZBUFF_recommendedDOutSize

  ZSTD_adjustCParams

  ZSTD_checkCParams

  ZSTD_compress

  ZSTD_compressBegin

  ZSTD_compressBegin_advanced

  ZSTD_compressBegin_usingDict

  ZSTD_compressBound

  ZSTD_compressCCtx

  ZSTD_compressContinue

  ZSTD_compressEnd

  ZSTD_compress_advanced

  ZSTD_compress_usingDict

  ZSTD_compress_usingPreparedCCtx

  ZSTD_copyCCtx

  ZSTD_copyDCtx

  ZSTD_createCCtx

  ZSTD_createDCtx

  ZSTD_decompress

  ZSTD_decompressBegin

  ZSTD_decompressBegin_usingDict

  ZSTD_decompressContinue

  ZSTD_decompressDCtx

  ZSTD_decompress_usingDict

  ZSTD_decompress_usingPreparedDCtx

  ZSTD_freeCCtx

  ZSTD_freeDCtx

  ZSTD_getErrorName

  ZSTD_getFrameParams

  ZSTD_isError

  ZSTD_maxCLevel

  ZSTD_nextSrcSizeToDecompress

  ZSTD_versionNumber

  Sections

  .text

  Size: 95KB - Virtual size: 95KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 15KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gfids

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 68B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ThirdParty/libzstd.1.1.5.dll

  .dll windows x64

  2ead89be6f22c37cc711c6945b6b3f93

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  RtlUnwindEx

  InterlockedFlushSList

  GetLastError

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  QueryPerformanceFrequency

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameA

  MultiByteToWideChar

  WideCharToMultiByte

  HeapFree

  HeapAlloc

  LCMapStringW

  GetStdHandle

  GetFileType

  FlushFileBuffers

  WriteFile

  GetConsoleCP

  GetConsoleMode

  GetACP

  FindClose

  FindFirstFileExA

  FindNextFileA

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetProcessHeap

  GetStringTypeW

  SetStdHandle

  SetFilePointerEx

  WriteConsoleW

  HeapSize

  HeapReAlloc

  CloseHandle

  CreateFileW

  RaiseException

  Exports

  Exports

  COVER_optimizeTrainFromBuffer

  COVER_trainFromBuffer

  ZBUFF_compressContinue

  ZBUFF_compressEnd

  ZBUFF_compressFlush

  ZBUFF_compressInit

  ZBUFF_compressInitDictionary

  ZBUFF_compressInit_advanced

  ZBUFF_createCCtx

  ZBUFF_createCCtx_advanced

  ZBUFF_createDCtx

  ZBUFF_createDCtx_advanced

  ZBUFF_decompressContinue

  ZBUFF_decompressInit

  ZBUFF_decompressInitDictionary

  ZBUFF_freeCCtx

  ZBUFF_freeDCtx

  ZBUFF_getErrorName

  ZBUFF_isError

  ZBUFF_recommendedCInSize

  ZBUFF_recommendedCOutSize

  ZBUFF_recommendedDInSize

  ZBUFF_recommendedDOutSize

  ZDICT_addEntropyTablesFromBuffer

  ZDICT_finalizeDictionary

  ZDICT_getDictID

  ZDICT_getErrorName

  ZDICT_isError

  ZDICT_trainFromBuffer

  ZDICT_trainFromBuffer_advanced

  ZSTDMT_compressCCtx

  ZSTDMT_compressStream

  ZSTDMT_createCCtx

  ZSTDMT_endStream

  ZSTDMT_flushStream

  ZSTDMT_freeCCtx

  ZSTDMT_initCStream

  ZSTDMT_initCStream_advanced

  ZSTDMT_resetCStream

  ZSTDMT_setMTCtxParameter

  ZSTD_CStreamInSize

  ZSTD_CStreamOutSize

  ZSTD_DStreamInSize

  ZSTD_DStreamOutSize

  ZSTD_adjustCParams

  ZSTD_checkCParams

  ZSTD_compress

  ZSTD_compressBegin

  ZSTD_compressBegin_advanced

  ZSTD_compressBegin_usingCDict

  ZSTD_compressBegin_usingDict

  ZSTD_compressBlock

  ZSTD_compressBound

  ZSTD_compressCCtx

  ZSTD_compressContinue

  ZSTD_compressEnd

  ZSTD_compressStream

  ZSTD_compress_advanced

  ZSTD_compress_usingCDict

  ZSTD_compress_usingDict

  ZSTD_copyCCtx

  ZSTD_copyDCtx

  ZSTD_createCCtx

  ZSTD_createCCtx_advanced

  ZSTD_createCDict

  ZSTD_createCDict_advanced

  ZSTD_createCDict_byReference

  ZSTD_createCStream

  ZSTD_createCStream_advanced

  ZSTD_createDCtx

  ZSTD_createDCtx_advanced

  ZSTD_createDDict

  ZSTD_createDDict_advanced

  ZSTD_createDDict_byReference

  ZSTD_createDStream

  ZSTD_createDStream_advanced

  ZSTD_decompress

  ZSTD_decompressBegin

  ZSTD_decompressBegin_usingDict

  ZSTD_decompressBlock

  ZSTD_decompressContinue

  ZSTD_decompressDCtx

  ZSTD_decompressStream

  ZSTD_decompress_usingDDict

  ZSTD_decompress_usingDict

  ZSTD_endStream

  ZSTD_estimateCCtxSize

  ZSTD_estimateDCtxSize

  ZSTD_findDecompressedSize

  ZSTD_findFrameCompressedSize

  ZSTD_flushStream

  ZSTD_freeCCtx

  ZSTD_freeCDict

  ZSTD_freeCStream

  ZSTD_freeDCtx

  ZSTD_freeDDict

  ZSTD_freeDStream

  ZSTD_getBlockSizeMax

  ZSTD_getCParams

  ZSTD_getDecompressedSize

  ZSTD_getDictID_fromDDict

  ZSTD_getDictID_fromDict

  ZSTD_getDictID_fromFrame

  ZSTD_getErrorCode

  ZSTD_getErrorName

  ZSTD_getErrorString

  ZSTD_getFrameContentSize

  ZSTD_getFrameParams

  ZSTD_getParams

  ZSTD_initCStream

  ZSTD_initCStream_advanced

  ZSTD_initCStream_srcSize

  ZSTD_initCStream_usingCDict

  ZSTD_initCStream_usingDict

  ZSTD_initDStream

  ZSTD_initDStream_usingDDict

  ZSTD_initDStream_usingDict

  ZSTD_insertBlock

  ZSTD_isError

  ZSTD_isFrame

  ZSTD_maxCLevel

  ZSTD_nextInputType

  ZSTD_nextSrcSizeToDecompress

  ZSTD_resetCStream

  ZSTD_resetDStream

  ZSTD_setCCtxParameter

  ZSTD_setDStreamParameter

  ZSTD_sizeof_CCtx

  ZSTD_sizeof_CDict

  ZSTD_sizeof_CStream

  ZSTD_sizeof_DCtx

  ZSTD_sizeof_DDict

  ZSTD_sizeof_DStream

  ZSTD_versionNumber

  Sections

  .text

  Size: 260KB - Virtual size: 260KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 69KB - Virtual size: 68KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gfids

  Size: 512B - Virtual size: 152B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ThirdParty/libzstd.1.2.0.dll

  .dll windows x64

  7f37a3de67eb5eac134c273eeaa98fb1

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetLastError

  GetModuleFileNameW

  GetModuleHandleA

  GetProcAddress

  GetSystemTimeAsFileTime

  GetTickCount

  InitializeCriticalSection

  LeaveCriticalSection

  QueryPerformanceCounter

  RtlAddFunctionTable

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  SetUnhandledExceptionFilter

  Sleep

  TerminateProcess

  TlsGetValue

  UnhandledExceptionFilter

  VirtualProtect

  VirtualQuery

  msvcrt

  __dllonexit

  __iob_func

  _amsg_exit

  _exit

  _initterm

  _lock

  _onexit

  _snwprintf

  _unlock

  abort

  calloc

  clock

  fflush

  fprintf

  fputc

  free

  fwprintf

  fwrite

  malloc

  memcmp

  memcpy

  memmove

  memset

  qsort

  raise

  signal

  strlen

  strncmp

  vfprintf

  wcscpy

  user32

  MessageBoxW

  Exports

  Exports

  COVER_optimizeTrainFromBuffer

  COVER_trainFromBuffer

  ZBUFF_compressContinue

  ZBUFF_compressEnd

  ZBUFF_compressFlush

  ZBUFF_compressInit

  ZBUFF_compressInitDictionary

  ZBUFF_compressInit_advanced

  ZBUFF_createCCtx

  ZBUFF_createCCtx_advanced

  ZBUFF_createDCtx

  ZBUFF_createDCtx_advanced

  ZBUFF_decompressContinue

  ZBUFF_decompressInit

  ZBUFF_decompressInitDictionary

  ZBUFF_freeCCtx

  ZBUFF_freeDCtx

  ZBUFF_getErrorName

  ZBUFF_isError

  ZBUFF_recommendedCInSize

  ZBUFF_recommendedCOutSize

  ZBUFF_recommendedDInSize

  ZBUFF_recommendedDOutSize

  ZDICT_addEntropyTablesFromBuffer

  ZDICT_finalizeDictionary

  ZDICT_getDictID

  ZDICT_getErrorName

  ZDICT_isError

  ZDICT_trainFromBuffer

  ZDICT_trainFromBuffer_advanced

  ZSTDMT_compressCCtx

  ZSTDMT_compressStream

  ZSTDMT_createCCtx

  ZSTDMT_endStream

  ZSTDMT_flushStream

  ZSTDMT_freeCCtx

  ZSTDMT_initCStream

  ZSTDMT_initCStream_advanced

  ZSTDMT_resetCStream

  ZSTDMT_setMTCtxParameter

  ZSTD_CStreamInSize

  ZSTD_CStreamOutSize

  ZSTD_DStreamInSize

  ZSTD_DStreamOutSize

  ZSTD_adjustCParams

  ZSTD_checkCParams

  ZSTD_compress

  ZSTD_compressBegin

  ZSTD_compressBegin_advanced

  ZSTD_compressBegin_usingCDict

  ZSTD_compressBegin_usingCDict_advanced

  ZSTD_compressBegin_usingDict

  ZSTD_compressBlock

  ZSTD_compressBound

  ZSTD_compressCCtx

  ZSTD_compressContinue

  ZSTD_compressEnd

  ZSTD_compressStream

  ZSTD_compress_advanced

  ZSTD_compress_usingCDict

  ZSTD_compress_usingCDict_advanced

  ZSTD_compress_usingDict

  ZSTD_copyCCtx

  ZSTD_copyDCtx

  ZSTD_createCCtx

  ZSTD_createCCtx_advanced

  ZSTD_createCDict

  ZSTD_createCDict_advanced

  ZSTD_createCDict_byReference

  ZSTD_createCStream

  ZSTD_createCStream_advanced

  ZSTD_createDCtx

  ZSTD_createDCtx_advanced

  ZSTD_createDDict

  ZSTD_createDDict_advanced

  ZSTD_createDDict_byReference

  ZSTD_createDStream

  ZSTD_createDStream_advanced

  ZSTD_decompress

  ZSTD_decompressBegin

  ZSTD_decompressBegin_usingDict

  ZSTD_decompressBlock

  ZSTD_decompressContinue

  ZSTD_decompressDCtx

  ZSTD_decompressStream

  ZSTD_decompress_usingDDict

  ZSTD_decompress_usingDict

  ZSTD_endStream

  ZSTD_estimateCCtxSize

  ZSTD_estimateDCtxSize

  ZSTD_findDecompressedSize

  ZSTD_findFrameCompressedSize

  ZSTD_flushStream

  ZSTD_freeCCtx

  ZSTD_freeCDict

  ZSTD_freeCStream

  ZSTD_freeDCtx

  ZSTD_freeDDict

  ZSTD_freeDStream

  ZSTD_getBlockSizeMax

  ZSTD_getCParams

  ZSTD_getDecompressedSize

  ZSTD_getDictID_fromDDict

  ZSTD_getDictID_fromDict

  ZSTD_getDictID_fromFrame

  ZSTD_getErrorCode

  ZSTD_getErrorName

  ZSTD_getErrorString

  ZSTD_getFrameContentSize

  ZSTD_getFrameParams

  ZSTD_getParams

  ZSTD_initCStream

  ZSTD_initCStream_advanced

  ZSTD_initCStream_srcSize

  ZSTD_initCStream_usingCDict

  ZSTD_initCStream_usingCDict_advanced

  ZSTD_initCStream_usingDict

  ZSTD_initDStream

  ZSTD_initDStream_usingDDict

  ZSTD_initDStream_usingDict

  ZSTD_insertBlock

  ZSTD_isError

  ZSTD_isFrame

  ZSTD_maxCLevel

  ZSTD_nextInputType

  ZSTD_nextSrcSizeToDecompress

  ZSTD_resetCStream

  ZSTD_resetDStream

  ZSTD_setCCtxParameter

  ZSTD_setDStreamParameter

  ZSTD_sizeof_CCtx

  ZSTD_sizeof_CDict

  ZSTD_sizeof_CStream

  ZSTD_sizeof_DCtx

  ZSTD_sizeof_DDict

  ZSTD_sizeof_DStream

  ZSTD_versionNumber

  Sections

  .text

  Size: 464KB - Virtual size: 464KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 104B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 20KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 88B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 104B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 196B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /4

  Size: 512B - Virtual size: 80B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /19

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /31

  Size: 512B - Virtual size: 303B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /45

  Size: 1024B - Virtual size: 546B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /57

  Size: 512B - Virtual size: 72B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ThirdParty/libzstd.1.3.4.dll

  .dll windows x64

  7f37a3de67eb5eac134c273eeaa98fb1

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetLastError

  GetModuleFileNameW

  GetModuleHandleA

  GetProcAddress

  GetSystemTimeAsFileTime

  GetTickCount

  InitializeCriticalSection

  LeaveCriticalSection

  QueryPerformanceCounter

  RtlAddFunctionTable

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  SetUnhandledExceptionFilter

  Sleep

  TerminateProcess

  TlsGetValue

  UnhandledExceptionFilter

  VirtualProtect

  VirtualQuery

  msvcrt

  __dllonexit

  __iob_func

  _amsg_exit

  _exit

  _initterm

  _lock

  _onexit

  _snwprintf

  _unlock

  abort

  calloc

  clock

  fflush

  fprintf

  fputc

  free

  fwprintf

  fwrite

  malloc

  memcmp

  memcpy

  memmove

  memset

  qsort

  raise

  signal

  strlen

  strncmp

  vfprintf

  wcscpy

  user32

  MessageBoxW

  Exports

  Exports

  ZBUFF_compressContinue

  ZBUFF_compressEnd

  ZBUFF_compressFlush

  ZBUFF_compressInit

  ZBUFF_compressInitDictionary

  ZBUFF_compressInit_advanced

  ZBUFF_createCCtx

  ZBUFF_createCCtx_advanced

  ZBUFF_createDCtx

  ZBUFF_createDCtx_advanced

  ZBUFF_decompressContinue

  ZBUFF_decompressInit

  ZBUFF_decompressInitDictionary

  ZBUFF_freeCCtx

  ZBUFF_freeDCtx

  ZBUFF_getErrorName

  ZBUFF_isError

  ZBUFF_recommendedCInSize

  ZBUFF_recommendedCOutSize

  ZBUFF_recommendedDInSize

  ZBUFF_recommendedDOutSize

  ZDICT_addEntropyTablesFromBuffer

  ZDICT_finalizeDictionary

  ZDICT_getDictID

  ZDICT_getErrorName

  ZDICT_isError

  ZDICT_optimizeTrainFromBuffer_cover

  ZDICT_trainFromBuffer

  ZDICT_trainFromBuffer_cover

  ZDICT_trainFromBuffer_legacy

  ZSTDMT_compressCCtx

  ZSTDMT_compressStream

  ZSTDMT_compressStream_generic

  ZSTDMT_compress_advanced

  ZSTDMT_createCCtx

  ZSTDMT_createCCtx_advanced

  ZSTDMT_endStream

  ZSTDMT_flushStream

  ZSTDMT_freeCCtx

  ZSTDMT_initCStream

  ZSTDMT_initCStream_advanced

  ZSTDMT_initCStream_usingCDict

  ZSTDMT_resetCStream

  ZSTDMT_setMTCtxParameter

  ZSTDMT_sizeof_CCtx

  ZSTD_CCtxParam_setParameter

  ZSTD_CCtxParams_init

  ZSTD_CCtxParams_init_advanced

  ZSTD_CCtxParams_reset

  ZSTD_CCtx_loadDictionary

  ZSTD_CCtx_loadDictionary_advanced

  ZSTD_CCtx_loadDictionary_byReference

  ZSTD_CCtx_refCDict

  ZSTD_CCtx_refPrefix

  ZSTD_CCtx_refPrefix_advanced

  ZSTD_CCtx_reset

  ZSTD_CCtx_setParameter

  ZSTD_CCtx_setParametersUsingCCtxParams

  ZSTD_CCtx_setPledgedSrcSize

  ZSTD_CStreamInSize

  ZSTD_CStreamOutSize

  ZSTD_DCtx_loadDictionary

  ZSTD_DCtx_loadDictionary_advanced

  ZSTD_DCtx_loadDictionary_byReference

  ZSTD_DCtx_refDDict

  ZSTD_DCtx_refPrefix

  ZSTD_DCtx_refPrefix_advanced

  ZSTD_DCtx_reset

  ZSTD_DCtx_setFormat

  ZSTD_DCtx_setMaxWindowSize

  ZSTD_DStreamInSize

  ZSTD_DStreamOutSize

  ZSTD_adjustCParams

  ZSTD_checkCParams

  ZSTD_compress

  ZSTD_compressBegin

  ZSTD_compressBegin_advanced

  ZSTD_compressBegin_usingCDict

  ZSTD_compressBegin_usingCDict_advanced

  ZSTD_compressBegin_usingDict

  ZSTD_compressBlock

  ZSTD_compressBound

  ZSTD_compressCCtx

  ZSTD_compressContinue

  ZSTD_compressEnd

  ZSTD_compressStream

  ZSTD_compress_advanced

  ZSTD_compress_generic

  ZSTD_compress_generic_simpleArgs

  ZSTD_compress_usingCDict

  ZSTD_compress_usingCDict_advanced

  ZSTD_compress_usingDict

  ZSTD_copyCCtx

  ZSTD_copyDCtx

  ZSTD_createCCtx

  ZSTD_createCCtxParams

  ZSTD_createCCtx_advanced

  ZSTD_createCDict

  ZSTD_createCDict_advanced

  ZSTD_createCDict_byReference

  ZSTD_createCStream

  ZSTD_createCStream_advanced

  ZSTD_createDCtx

  ZSTD_createDCtx_advanced

  ZSTD_createDDict

  ZSTD_createDDict_advanced

  ZSTD_createDDict_byReference

  ZSTD_createDStream

  ZSTD_createDStream_advanced

  ZSTD_decodingBufferSize_min

  ZSTD_decompress

  ZSTD_decompressBegin

  ZSTD_decompressBegin_usingDDict

  ZSTD_decompressBegin_usingDict

  ZSTD_decompressBlock

  ZSTD_decompressContinue

  ZSTD_decompressDCtx

  ZSTD_decompressStream

  ZSTD_decompress_generic

  ZSTD_decompress_generic_simpleArgs

  ZSTD_decompress_usingDDict

  ZSTD_decompress_usingDict

  ZSTD_endStream

  ZSTD_estimateCCtxSize

  ZSTD_estimateCCtxSize_usingCCtxParams

  ZSTD_estimateCCtxSize_usingCParams

  ZSTD_estimateCDictSize

  ZSTD_estimateCDictSize_advanced

  ZSTD_estimateCStreamSize

  ZSTD_estimateCStreamSize_usingCCtxParams

  ZSTD_estimateCStreamSize_usingCParams

  ZSTD_estimateDCtxSize

  ZSTD_estimateDDictSize

  ZSTD_estimateDStreamSize

  ZSTD_estimateDStreamSize_fromFrame

  ZSTD_findDecompressedSize

  ZSTD_findFrameCompressedSize

  ZSTD_flushStream

  ZSTD_frameHeaderSize

  ZSTD_freeCCtx

  ZSTD_freeCCtxParams

  ZSTD_freeCDict

  ZSTD_freeCStream

  ZSTD_freeDCtx

  ZSTD_freeDDict

  ZSTD_freeDStream

  ZSTD_getBlockSize

  ZSTD_getCParams

  ZSTD_getDecompressedSize

  ZSTD_getDictID_fromDDict

  ZSTD_getDictID_fromDict

  ZSTD_getDictID_fromFrame

  ZSTD_getErrorCode

  ZSTD_getErrorName

  ZSTD_getErrorString

  ZSTD_getFrameContentSize

  ZSTD_getFrameHeader

  ZSTD_getParams

  ZSTD_initCStream

  ZSTD_initCStream_advanced

  ZSTD_initCStream_srcSize

  ZSTD_initCStream_usingCDict

  ZSTD_initCStream_usingCDict_advanced

  ZSTD_initCStream_usingDict

  ZSTD_initDStream

  ZSTD_initDStream_usingDDict

  ZSTD_initDStream_usingDict

  ZSTD_initStaticCCtx

  ZSTD_initStaticCDict

  ZSTD_initStaticCStream

  ZSTD_initStaticDCtx

  ZSTD_initStaticDDict

  ZSTD_initStaticDStream

  ZSTD_insertBlock

  ZSTD_isError

  ZSTD_isFrame

  ZSTD_maxCLevel

  ZSTD_nextInputType

  ZSTD_nextSrcSizeToDecompress

  ZSTD_resetCStream

  ZSTD_resetDStream

  ZSTD_setDStreamParameter

  ZSTD_sizeof_CCtx

  ZSTD_sizeof_CDict

  ZSTD_sizeof_CStream

  ZSTD_sizeof_DCtx

  ZSTD_sizeof_DDict

  ZSTD_sizeof_DStream

  ZSTD_versionNumber

  ZSTD_versionString

  Sections

  .text

  Size: 705KB - Virtual size: 704KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 104B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 23KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 88B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 104B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 196B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /4

  Size: 512B - Virtual size: 80B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /19

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /31

  Size: 512B - Virtual size: 303B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /45

  Size: 1024B - Virtual size: 546B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /57

  Size: 512B - Virtual size: 72B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ThirdParty/zlibwapi.dll

  .dll windows x64

  a020653e2200de4edae4d0929ebfdefb

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  ReadFile

  WriteFile

  SetFilePointer

  CreateFileW

  GetLastError

  CreateFileA

  CloseHandle

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  DisableThreadLibraryCalls

  InitializeSListHead

  GetModuleHandleW

  IsProcessorFeaturePresent

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  QueryPerformanceCounter

  vcruntime140

  __std_type_info_destroy_list

  __C_specific_handler

  memchr

  memset

  memcpy

  api-ms-win-crt-stdio-l1-1-0

  fseek

  fread

  _wopen

  _open

  _ftelli64

  fopen

  ferror

  ftell

  _write

  fclose

  _fseeki64

  _close

  _read

  fwrite

  _lseeki64

  __stdio_common_vsprintf

  api-ms-win-crt-convert-l1-1-0

  wcstombs

  api-ms-win-crt-heap-l1-1-0

  malloc

  free

  api-ms-win-crt-runtime-l1-1-0

  _cexit

  strerror

  _initterm

  _initterm_e

  _seh_filter_dll

  _configure_narrow_argv

  _initialize_narrow_environment

  _initialize_onexit_table

  _register_onexit_function

  _execute_onexit_table

  _crt_atexit

  _crt_at_quick_exit

  _errno

  terminate

  api-ms-win-crt-utility-l1-1-0

  srand

  rand

  api-ms-win-crt-time-l1-1-0

  _time64

  Exports

  Exports

  adler32

  adler32_combine

  adler32_z

  compress

  compress2

  compressBound

  crc32

  crc32_combine

  crc32_z

  deflate

  deflateBound

  deflateCopy

  deflateEnd

  deflateGetDictionary

  deflateInit2_

  deflateInit_

  deflateParams

  deflatePending

  deflatePrime

  deflateReset

  deflateResetKeep

  deflateSetDictionary

  deflateSetHeader

  deflateTune

  fill_win32_filefunc

  fill_win32_filefunc64

  fill_win32_filefunc64A

  fill_win32_filefunc64W

  get_crc_table

  gzbuffer

  gzclearerr

  gzclose

  gzclose_r

  gzclose_w

  gzdirect

  gzdopen

  gzeof

  gzerror

  gzflush

  gzfread

  gzfwrite

  gzgetc

  gzgetc_

  gzgets

  gzoffset

  gzopen

  gzopen_w

  gzprintf

  gzputc

  gzputs

  gzread

  gzrewind

  gzseek

  gzsetparams

  gztell

  gzungetc

  gzvprintf

  gzwrite

  inflate

  inflateBack

  inflateBackEnd

  inflateBackInit_

  inflateCodesUsed

  inflateCopy

  inflateEnd

  inflateGetDictionary

  inflateGetHeader

  inflateInit2_

  inflateInit_

  inflateMark

  inflatePrime

  inflateReset

  inflateReset2

  inflateResetKeep

  inflateSetDictionary

  inflateSync

  inflateSyncPoint

  inflateUndermine

  inflateValidate

  uncompress

  uncompress2

  unzClose

  unzCloseCurrentFile

  unzGetCurrentFileInfo

  unzGetCurrentFileInfo64

  unzGetCurrentFileZStreamPos64

  unzGetFilePos

  unzGetFilePos64

  unzGetGlobalComment

  unzGetGlobalInfo

  unzGetGlobalInfo64

  unzGetLocalExtrafield

  unzGoToFilePos

  unzGoToFilePos64

  unzGoToFirstFile

  unzGoToNextFile

  unzLocateFile

  unzOpen

  unzOpen2

  unzOpen2_64

  unzOpen64

  unzOpenCurrentFile

  unzOpenCurrentFile2

  unzOpenCurrentFile3

  unzOpenCurrentFilePassword

  unzReadCurrentFile

  unzStringFileNameCompare

  unzeof

  unztell

  unztell64

  zError

  zipClose

  zipCloseFileInZip

  zipCloseFileInZipRaw

  zipCloseFileInZipRaw64

  zipOpen

  zipOpen2

  zipOpen2_64

  zipOpen64

  zipOpenNewFileInZip

  zipOpenNewFileInZip2

  zipOpenNewFileInZip2_64

  zipOpenNewFileInZip3

  zipOpenNewFileInZip3_64

  zipOpenNewFileInZip4_64

  zipOpenNewFileInZip64

  zipWriteInFileInZip

  zlibCompileFlags

  zlibVersion

  Sections

  .text

  Size: 72KB - Virtual size: 72KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 30KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 216B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gfids

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 920B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 96B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ