Executables Whats App[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Executables Whats App.zip
Size

29.6MB
MD5

80fe0d0a1ffb228aa1e1fbe1bfd81ec6
SHA1

7490525323911226f5e8b40161b620bf429af938
SHA256

2575d5db7bfb17921eda865c49303830f63517ef576645b53adf6470448765a1
SHA512

a512ecedba3941cee7ee297fdf5435e60a2bab3679e81d1b36de072dd96bfb23c4291e42c991e1b77be8e436bc2dc9ac39c4b181eb476554942b2ba50a3969e4
SSDEEP

786432:UPGhztEIbfISiFuRm9Md+w2QTtdQ8l2AGZ7xy3qVJJz:UsztTfXiFX7xQTtd9sxyaVnz

Score

1^/10

Malware Config

Signatures

Files

Executables Whats App.zip
.zip
Microsoft.Graphics.Canvas.dll
.dll windows x64

87bedf23efcd97400e685e25562ab8d4

Code Sign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:b0:f9:bb:07:67:fb:52:4f:ec:b0:ee:97:c9:e7:a1:0b:99:4d:9e:00:1f:47:69:de:ab:7b:6f:e4:93:7d:93
Signer

Actual PE Digest

71:b0:f9:bb:07:67:fb:52:4f:ec:b0:ee:97:c9:e7:a1:0b:99:4d:9e:00:1f:47:69:de:ab:7b:6f:e4:93:7d:93

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/04/2023, 18:14
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d2d1

ord13
ord1
ord5

d3d11

CreateDirect3D11DeviceFromDXGIDevice
CreateDirect3D11SurfaceFromDXGISurface
D3D11CreateDevice

dwrite

DWriteCreateFactory

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
RoFailFastWithErrorContext
SetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW
RoOriginateError

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsGetStringLen
WindowsCreateString
WindowsCompareStringOrdinal
WindowsDeleteStringBuffer
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsDuplicateString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

api-ms-win-core-synch-l1-1-0

SetEvent
CreateEventExW
WaitForSingleObjectEx
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockShared

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
GetHGlobalFromStream
CoCreateInstanceFromApp
CoTaskMemFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize
GlobalLock
GlobalUnlock

api-ms-win-core-handle-l1-1-0

CloseHandle

msvcp140_app

_Mtx_unlock
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Cnd_unregister_at_thread_exit
_Thrd_hardware_concurrency
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Cnd_init_in_situ
_Cnd_wait
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
_Cnd_register_at_thread_exit
_Cnd_broadcast
_Cnd_destroy_in_situ

vcruntime140_1_app

__CxxFrameHandler4

vcruntime140_app

_purecall
memset
__std_exception_destroy
__std_exception_copy
__std_terminate
__C_specific_handler
__CxxFrameHandler3
__current_exception
memmove
memcpy
strstr
__std_type_info_destroy_list
__current_exception_context
_CxxThrowException

api-ms-win-crt-math-l1-1-0

_fdsign
_fdclass
sqrtf
ceilf
fmodf
floorf
sinf
cosf
roundf

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_cexit
_invalid_parameter_noinfo_noreturn
terminate
_invalid_parameter_noinfo
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_errno

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Exports

Exports

CreateDirect3D11DeviceFromDXGIDevice
CreateDirect3D11SurfaceFromDXGISurface
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 378KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Microsoft.UI.Xaml.Core.Direct.dll
.dll windows x64

fb00da51a87bcd86f9b3d4670ee5ec01

Code Sign

33:00:00:01:1a:2f:2e:15:ee:b6:85:47:95:00:00:00:00:01:1a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/10/2018, 21:07

Not After

10/01/2020, 21:07

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3E7A-E359-A25D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9b:03:89:4a:04:63:04:1a:5d:14:46:06:b2:bf:b2:fc:2c:a4:94:ed
Signer

Actual PE Digest

9b:03:89:4a:04:63:04:1a:5d:14:46:06:b2:bf:b2:fc:2c:a4:94:ed

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

15/03/2019, 17:29
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

vccorlib140_app

?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
??BType@Platform@@SA?AVTypeName@Interop@Xaml@UI@Windows@@PE$AAV01@@Z
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
??0InvalidArgumentException@Platform@@QE$AAA@XZ
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
??0ChangedStateException@Platform@@QE$AAA@XZ
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
??0OutOfBoundsException@Platform@@QE$AAA@XZ
??0FailureException@Platform@@QE$AAA@XZ
??0OutOfMemoryException@Platform@@QE$AAA@XZ
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
??0NotImplementedException@Platform@@QE$AAA@XZ
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?__abi_translateCurrentException@@YAJ_N@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
??0Object@Platform@@QE$AAA@XZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z

msvcp140_app

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_app

_CxxThrowException
__std_exception_destroy
__std_exception_copy
__C_specific_handler
memset
__std_terminate
__CxxFrameHandler3
__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_cexit
_initterm
_initterm_e
_seh_filter_dll

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSectionEx
DeleteCriticalSection

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsDeleteString
WindowsDuplicateString
WindowsCreateStringReference

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoTaskMemAlloc

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableCS
InitializeConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 706KB - Virtual size: 706KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Microsoft.Web.WebView2.Core.dll
.dll windows x64

9efaa48ba751dac8128119b624a8771d

Code Sign

33:00:00:02:54:ca:2b:f3:cb:9d:da:a6:75:00:00:00:00:02:54
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:33

Not After

01/09/2022, 18:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:5a:8f:d8:ed:c2:95:8c:78:a5:fe:c1:8e:cb:24:5b:77:63:c9:7e:c9:74:8f:05:cf:98:54:cb:ad:19:c2:5c
Signer

Actual PE Digest

68:5a:8f:d8:ed:c2:95:8c:78:a5:fe:c1:8e:cb:24:5b:77:63:c9:7e:c9:74:8f:05:cf:98:54:cb:ad:19:c2:5c

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/04/2023, 18:14
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

OutputDebugStringW
GetCurrentThreadId
FormatMessageW
IsDebuggerPresent
SetLastError
GetLastError
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
DecodePointer
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitOnceExecuteOnce
EncodePointer
ReleaseSRWLockShared
AcquireSRWLockShared
GetFileAttributesW
GetModuleFileNameW
OutputDebugStringA
LoadLibraryExW
LoadLibraryW
FreeLibrary
GetEnvironmentVariableW
InterlockedPushEntrySList
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
TerminateProcess
InterlockedFlushSList
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RaiseException
RtlPcToFileHeader
TlsAlloc
TlsGetValue
TlsSetValue
WideCharToMultiByte
MultiByteToWideChar
TlsFree

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoCreateFreeThreadedMarshaler

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull

api-ms-win-shcore-stream-winrt-l1-1-0

CreateRandomAccessStreamOverStream
CreateStreamOverRandomAccessStream

oleaut32

SetErrorInfo
GetErrorInfo
SysFreeString
SysAllocString
VariantClear
VariantInit
SysStringLen

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_initterm_e
terminate
_invalid_parameter_noinfo
_errno
_invalid_parameter_noinfo_noreturn
_initterm
abort
_cexit
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit

api-ms-win-crt-string-l1-1-0

_wcsicmp
iswspace
wcsncmp
wcslen
strcpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s
__stdio_common_vswprintf

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-heap-l1-1-0

_callnewh
free
calloc
malloc

api-ms-win-crt-math-l1-1-0

floor

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 398KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WebView2Loader.dll
.dll windows x64

dc9fbafd0b96c0a640df70f088bfd2b0

Code Sign

33:00:00:02:54:ca:2b:f3:cb:9d:da:a6:75:00:00:00:00:02:54
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:33

Not After

01/09/2022, 18:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e4:6f:61:66:a9:cb:47:19:a0:09:44:06:06:92:82:a8:43:82:db:4b:93:c9:59:da:ff:07:50:b4:79:96:48:8e
Signer

Actual PE Digest

e4:6f:61:66:a9:cb:47:19:a0:09:44:06:06:92:82:a8:43:82:db:4b:93:c9:59:da:ff:07:50:b4:79:96:48:8e

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/04/2023, 18:14
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
CreateEventW
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile

Exports

Exports

CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 92B

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 512B - Virtual size: 68B

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WhatsApp.dll
.dll windows x64

70fde2571f42649acce4480c8fb3b062

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mrt100_app

RhpNewFast
RhpAssignRefEDX
RhpCheckCctor2
RhpNewArray
RhpInitialInterfaceDispatch
RhTypeCast_IsInstanceOfClass
RhTypeCast_CheckUnbox
RhTypeCast_CheckArrayStore
RhpCheckedAssignRefEDX
RhpThrowEx
RhpResolveInterfaceMethod
RhpNewFinalizable
RhpCopyMultibyteWithWriteBarrier
RhpRethrow
RhTypeCast_CheckCastClass
RhpReversePInvoke
RhpReversePInvokeReturn
RhpPInvokeExceptionGuard
RhpSuppressGcStress
RhpRegisterModule
RhpUnsuppressGcStress
RhTypeCast_IsInstanceOf
RhTypeCast_CheckCast
RhpCheckedXchg
RhTypeCast_CheckCastArray
RhMemberwiseClone
RhpArrayCopy
RhpCheckedLockCmpXchg
RhpCopyMultibyte
RhHandleSet
RhAllocLocal
RhpCopyAnyWithWriteBarrier
RhSuppressFinalize
RhTypeCast_IsInstanceOfArray
RhTypeCast_IsInstanceOfInterface
RhpArrayClear
RhTypeCast_CheckCastInterface
RhUnboxAny
RhBoxAny
RhTypeCast_CheckVectorElemAddr
RhpInitMultibyte
RhArrayStoreCheckAny
RhHandleGetDependent
RhpHandleAllocDependent
RhpGetThread
RhpTrapThreads
RhpWaitForSuspend
RhpWaitForGC
RhGetProcessCpuCount
RhTypeCast_AreTypesEquivalent
__chkstk
RhpHandleAlloc
RhNewString
memmove
RhTypeCast_AreTypesAssignable
RhUnbox
RhBox
RhNewObject
RhSpinWait
RhCompatibleReentrantWaitAny
RhHandleFree
RhCreateThunksHeap
RhSetThunkData
RhGetJmpStubCodeTarget
RhGetLoadedOSModules
RhSetErrorInfoBuffer
RhGetExceptionsForCurrentThread
RhAllocateThunk
RhNewArray
RhTryGetThunkData
RhFreeThunk
RhYield
RhGetGeneration
RhFindBlob
RhGetModuleFromEEType
RhConvertPublicKeyToPublicKeyToken
RhGetDispatchMapForType
RhCreateGenericInstanceDescForType2
RhGetGCDescSize
RhGetOSModuleFromEEType
RhResolveDispatch
RhRegisterGcCallout
RhpETWShouldWalkCom
RhpETWLogLiveCom
RhIsPromoted
RhHandleSetDependentSecondary
RhGetGcCollectionCount
RhGetCurrentObjSize
RhGetGCNow
RhGetLastGCStartTime
RhGetLastGCDuration
RhCollect
RhFindMethodStartAddress
RhGetOSModuleFromPointer
RhGetModuleFileName
RhGetCurrentThreadStackBounds
RhReRegisterForFinalize
_ecvt_s
pow
fmod
RhGetCurrentThreadStackTrace
memset
RhBulkMoveWithWriteBarrier
RhGetCodeTarget
RhGetThreadLocalStorageForDynamicType
RhGetTargetOfUnboxingAndInstantiatingStub
RhResolveDispatchOnType
RhGetUniversalTransitionThunk
RhInitializeConservativeReportingRegion
RhDisableConservativeReportingRegion
RhCallDescrWorker
RhRegisterRefCountedHandleCallback
RhGetGcTotalMemory
sin
cos
atan2
RhpDblRemRev
RhpGetModuleSection
RhpRegisterFrozenSegment
RhpCreateTypeManager
RhpRegisterOsModule
log10
RhWaitForFullGCComplete
RhpFltRemRev
RhWaitForPendingFinalizers
RhGetRuntimeHelperForType
RhNewInterfaceDispatchCell
log
modf
RhGetThunkSize
RhGetThreadStaticFieldAddress
RhpEtwExceptionThrown
tan
RhpLoopHijack

whatsapp

CreateCommandLine

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError

kernel32

CloseHandle
GetFileInformationByHandleEx
CompareStringOrdinal
CompareStringEx
FormatMessageW
SetEvent
CreateEventExW
WaitForMultipleObjectsEx
GetThreadPriority
GetCurrentProcess
GetCurrentThread
DuplicateHandle
LCMapStringEx
GetLocaleInfoEx
ResolveLocaleName
LCIDToLocaleName
GetCalendarInfoEx
EnumCalendarInfoExEx
EnumTimeFormatsEx
Sleep
FindStringOrdinal
FindNLSStringEx
ResetEvent
SetThreadPriority
DeleteFileW
SetThreadErrorMode
FindFirstFileExW
GetFileAttributesExW
GetLongPathNameW
GetFullPathNameW
SetFilePointerEx
GetFileType
CreateFile2
CreateDirectoryW
MultiByteToWideChar
MoveFileExW
WaitForSingleObject
ResumeThread
CreateThread
QueryPerformanceCounter
WriteFile
CancelIoEx
SetEndOfFile
ReadFile
GlobalMemoryStatusEx
GetCurrentProcessId
QueryPerformanceFrequency
GetVersionExW
GetCPInfo
WideCharToMultiByte
LocalFree
LocalAlloc
GetTempPathW
GetSystemInfo
SetFileCompletionNotificationModes
SetFileAttributesW
CopyFileExW
EnumSystemLocalesEx
DeleteVolumeMountPointW
RemoveDirectoryW
FindNextFileW
FindClose
FlushFileBuffers
LocaleNameToLCID

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc

ole32

CoTaskMemFree
CoTaskMemAlloc
CoGetApartmentType
CoCreateGuid

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoGetActivationFactory
RoUninitialize

api-ms-win-core-kernel32-legacy-l1-1-0

RaiseFailFastException

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateString
WindowsCreateStringReference

advapi32

EventActivityIdControl
CryptAcquireContextW
EventSetInformation
EnumerateTraceGuidsEx
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken
OpenThreadToken
GetTokenInformation
LsaOpenPolicy
CryptGenKey
CryptReleaseContext
LsaLookupNames2
LsaClose
LsaLookupSids
CryptSetProvParam
CryptImportKey
CryptDestroyKey
CryptGetProvParam
CryptGetUserKey
CryptGetDefaultProviderW
CryptGetKeyParam
EventRegister
EventWriteTransfer
LsaNtStatusToWinError
LsaFreeMemory
EventUnregister

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformationForYear
GetDynamicTimeZoneInformationEffectiveYears
EnumDynamicTimeZoneInformation
GetDynamicTimeZoneInformation

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetLocaleInfoEx
IsValidLocaleName
ResolveLocaleName

api-ms-win-core-com-l1-1-0

CoGetObjectContext
CoGetContextToken
CoReleaseMarshalData
CoUnmarshalInterface
CoGetMarshalSizeMax
CoMarshalInterface
CoCreateFreeThreadedMarshaler
CoCreateInstanceFromApp

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent

bcrypt

BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptDestroyHash
BCryptHashData
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptGenRandom
BCryptExportKey
BCryptDestroyKey
BCryptDecrypt
BCryptEncrypt
BCryptImportKey

oleaut32

SysFreeString
SysStringLen
VariantClear
SysAllocStringLen

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
RoOriginateError
SetRestrictedErrorInfo

normaliz

IdnToUnicode
IdnToAscii
NormalizeString

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolIo
CreateThreadpoolTimer
SetThreadpoolTimer
CancelThreadpoolIo
CloseThreadpoolIo
StartThreadpoolIo

clrcompression

CompressionNative_DeflateInit2_
CompressionNative_Inflate
CompressionNative_InflateEnd
CompressionNative_InflateInit2_
CompressionNative_DeflateEnd
CompressionNative_Deflate

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

crypt32

CertGetCertificateChain
CertCloseStore
CertDuplicateCertificateContext
CertAddCertificateLinkToStore
CertOpenStore
CertFindCertificateInStore
CryptMsgGetParam
CryptMsgClose
CertEnumCertificatesInStore
CertGetCertificateContextProperty
PFXImportCertStore
CryptQueryObject
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetIntendedKeyUsage
CertFindExtension
CryptDecodeObject
CertGetValidUsages
CryptFindOIDInfo
CertVerifyTimeValidity
CertGetNameStringW
CertControlStore
CryptImportPublicKeyInfoEx2
CryptFormatObject
CertNameToStrW
CertFreeCertificateContext

ncrypt

NCryptDeleteKey
NCryptOpenKey
NCryptOpenStorageProvider
NCryptSetProperty
NCryptFinalizeKey
NCryptCreatePersistedKey
NCryptGetProperty
NCryptImportKey
NCryptFreeObject

ws2_32

WSAGetOverlappedResult
getpeername
select
getsockname
setsockopt
ioctlsocket
WSAIoctl
closesocket
recv
shutdown
WSAConnect
getsockopt
WSASocketW
gethostname
WSAStartup
GetAddrInfoW
FreeAddrInfoExW
WSASendTo
WSARecvFrom
WSASend
WSARecv
accept
GetNameInfoW
GetAddrInfoExW
bind
listen
send
freeaddrinfo

iphlpapi

GetNetworkParams
GetPerAdapterInfo
GetAdaptersAddresses

e_sqlite3

sqlite3_libversion_number
sqlite3_user_data
sqlite3_aggregate_context
sqlite3_column_bytes
sqlite3_column_text
sqlite3_column_int64
sqlite3_column_type
sqlite3_bind_text
sqlite3_bind_int64
sqlite3_bind_int
sqlite3_column_count
sqlite3_prepare_v2
sqlite3_step
sqlite3_errmsg
sqlite3_exec
sqlite3_finalize
sqlite3_free
sqlite3_close_v2
sqlite3_open

api-ms-win-ro-typeresolution-l1-1-0

RoParseTypeName

user32

GetActiveWindow
WindowFromPoint
GetAncestor
GetWindow
GetWindowTextW
GetWindowRect
FindWindowExA

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException
RoReportUnhandledError

sspicli

FreeCredentialsHandle
AcquireCredentialsHandleW
InitializeSecurityContextW
DeleteSecurityContext
AcceptSecurityContext
QueryContextAttributesW
EnumerateSecurityPackagesW
DecryptMessage
EncryptMessage
LsaGetLogonSessionData
FreeContextBuffer
ApplyControlToken
LsaFreeReturnBuffer

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcessorNumber

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

Exports

Exports

$thread_static_index
ActivatorCreateInstanceAny
AppendExceptionStackFrame
CheckStaticClassConstruction
CreateCommandLine
Dbl2IntOvf
Dbl2LngOvf
Dbl2UIntOvf
Dbl2ULngOvf
DebugFuncEvalAbortHelper
DebugFuncEvalHelper
DllGetActivationFactory
DllGetClassObject
FailFast
Flt2IntOvf
Flt2LngOvf
GenericLookup
GenericLookupAndAllocArray
GenericLookupAndAllocObject
GenericLookupAndCallCtor
GenericLookupAndCast
GenericLookupAndCheckArrayElemType
GetRuntimeException
GetSystemArrayEEType
GetThreadStaticsForDynamicType
InitializeFinalizerThread
InitializeModules
InvokeExeMain
OnFirstChanceException
RHBinder__ShimExeMain
UpdateMethodFloatingDictionary
UpdateTypeFloatingDictionary

Sections

.rdata
Size: 35.2MB - Virtual size: 35.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 26.0MB - Virtual size: 26.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WhatsApp.exe
.exe windows x64

f12299573f995fc0c70b04fabebb3e6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

whatsapp

RHBinder__ShimExeMain

Sections

.rdata
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
WhatsAppNative.dll
.dll windows x64

b104984acd6d37343735bbff18708af3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcrypt

BCryptDestroyHash
BCryptEncrypt
BCryptHashData
BCryptGenRandom
BCryptDecrypt
BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptCreateHash
BCryptSetProperty
BCryptFinishHash
BCryptOpenAlgorithmProvider

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSectionEx
ResetEvent
SetEvent
CreateEventW
EnterCriticalSection
WaitForSingleObject
ReleaseSemaphore
InitializeCriticalSection
LeaveCriticalSection

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
GetLastError

api-ms-win-core-file-l1-1-0

SetEndOfFile
WriteFile
SetFilePointerEx
GetFileAttributesW
FindNextFileW
ReadFile
CreateDirectoryW
FileTimeToLocalFileTime
RemoveDirectoryW
FindClose
DeleteFileW
GetFileSizeEx
FlushFileBuffers
FindFirstFileW
LocalFileTimeToFileTime
GetTempFileNameW

api-ms-win-core-com-l1-1-0

CoCreateInstanceFromApp
CoTaskMemFree
PropVariantClear
CoGetContextToken

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
CreateThread
GetCurrentThreadId
GetExitCodeThread

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTime
GetTickCount
GetLocalTime

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

mfplat

MFCreateSample
MFShutdown
MFStartup
MFTEnumEx
MFCreateMediaBufferWrapper
MFCreateMediaType
MFCreateAttributes
MFCreateMFByteStreamOnStreamEx
MFCreateWaveFormatExFromMFMediaType

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsConcatString
WindowsGetStringLen
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsCreateString
WindowsDeleteString
WindowsCompareStringOrdinal

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoInitialize
RoUninitialize
RoGetActivationFactory

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

api-ms-win-core-namedpipe-l1-1-0

CreatePipe

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile

api-ms-win-core-memory-l1-1-1

CreateFileMappingFromApp
MapViewOfFileFromApp

mfreadwrite

MFCreateSourceReaderFromByteStream
MFCreateSinkWriterFromURL

ws2_32

htonl
getsockopt
inet_ntoa
inet_addr
accept
bind
ntohl
ntohs
recvfrom
setsockopt
ioctlsocket
freeaddrinfo
htons
recv
sendto
gethostname
getsockname
WSAGetLastError
WSAAddressToStringW
WSAIoctl
connect
WSASocketW
socket
send
inet_pton
WSAEventSelect
WSAStartup
WSACleanup
getaddrinfo
shutdown
closesocket
__WSAFDIsSet
select

api-ms-win-core-io-l1-1-0

GetOverlappedResult

vccorlib140_app

?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
??0ChangedStateException@Platform@@QE$AAA@XZ
??0OutOfBoundsException@Platform@@QE$AAA@XZ
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
??0FailureException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0Delegate@Platform@@QE$AAA@XZ
??0FailureException@Platform@@QE$AAA@XZ
??0Exception@Platform@@QE$AAA@H@Z
??0NotImplementedException@Platform@@QE$AAA@PE$AAVString@1@@Z
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
??0OutOfMemoryException@Platform@@QE$AAA@XZ
??0InvalidArgumentException@Platform@@QE$AAA@XZ
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
?ResolveWeakReference@Details@Platform@@YAPE$AAVObject@2@AEBU_GUID@@PEAPEAU__abi_IUnknown@@@Z
?GetWeakReference@Details@Platform@@YAPEAU__abi_IUnknown@@QE$ADVObject@2@@Z
??0Exception@Platform@@QE$AAA@HPE$AAVString@1@@Z
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
??0NotImplementedException@Platform@@QE$AAA@XZ
??0Object@Platform@@QE$AAA@XZ
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
??0OutOfMemoryException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0InvalidArgumentException@Platform@@QE$AAA@PE$AAVString@1@@Z
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_translateCurrentException@@YAJ_N@Z
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
??0NullReferenceException@Platform@@QE$AAA@XZ
?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z

msvcp140_app

?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
_Mtx_trylock
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ
?GetNextAsyncId@platform@details@Concurrency@@YAIXZ
_Thrd_join
_Thrd_id
_Cnd_signal
_Xtime_get_ticks
_Thrd_detach
_Query_perf_counter
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
_Query_perf_frequency
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
_Cnd_destroy_in_situ
_Cnd_broadcast
_Cnd_wait
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Cnd_init_in_situ
?__ExceptionPtrCreate@@YAXPEAX@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Random_device@std@@YAIXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Throw_Cpp_error@std@@YAXH@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ

kernel32

GetFileSize
GetCurrentThread
CreateSemaphoreA
GetSystemInfo
GetSystemTimePreciseAsFileTime
GetStdHandle
InitializeSListHead
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceBeginInitialize
InitOnceComplete
ReleaseSRWLockShared
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetUnhandledExceptionFilter
VirtualQueryEx
OutputDebugStringA
GetProcAddress
LoadLibraryW
CreateFileW
GetProcessId
RtlCaptureContext
GetSystemTimeAsFileTime
LockFileEx
HeapAlloc
GetNativeSystemInfo
HeapReAlloc
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
HeapSize
UnlockFileEx
CreateEventA
GetFileInformationByHandleEx
DebugBreak
FormatMessageA
CreateEventExW
GetTimeZoneInformation
WaitForSingleObjectEx
QueryPerformanceFrequency
QueryPerformanceCounter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetThreadPriority
TryEnterCriticalSection
SetFilePointer

ole32

CoCreateFreeThreadedMarshaler
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc

concrt140_app

?_Internal_pop_if_present@_Concurrent_queue_base_v4@details@Concurrency@@IEAA_NPEAX@Z
??0scoped_lock@critical_section@Concurrency@@QEAA@AEAV12@@Z
??1critical_section@Concurrency@@QEAA@XZ
??0critical_section@Concurrency@@QEAA@XZ
??0_Concurrent_queue_base_v4@details@Concurrency@@IEAA@_K@Z
??1_Concurrent_queue_base_v4@details@Concurrency@@MEAA@XZ
?_Internal_push@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXPEBX@Z
??1scoped_lock@critical_section@Concurrency@@QEAA@XZ
?_Internal_empty@_Concurrent_queue_base_v4@details@Concurrency@@IEBA_NXZ
?_Internal_finish_clear@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXXZ
?_Internal_throw_exception@_Concurrent_queue_base_v4@details@Concurrency@@IEBAXXZ

vcruntime140_1_app

__CxxFrameHandler4

vcruntime140_app

__C_specific_handler
__current_exception_context
__current_exception
_set_purecall_handler
_CxxThrowException
longjmp
strchr
memcmp
__std_type_info_destroy_list
memset
memcpy
memmove
strrchr
_purecall
wcsrchr
wcschr
__std_exception_copy
__std_exception_destroy
__std_terminate
memchr
__intrinsic_setjmp

api-ms-win-crt-heap-l1-1-0

_msize
realloc
free
malloc
_callnewh
calloc

api-ms-win-crt-stdio-l1-1-0

_wfopen
fwrite
fgetc
__stdio_common_vsscanf
_close
_write
fgetpos
_lseeki64
_open
fclose
ferror
fseek
feof
setvbuf
fgets
__stdio_common_vsnwprintf_s
fflush
__stdio_common_vswprintf_s
ungetc
fsetpos
fread
_fseeki64
_get_stream_buffer_pointers
__stdio_common_vsnprintf_s
__stdio_common_vswprintf
fputs
putc
fputc
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
terminate
_beginthreadex
abort
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_set_invalid_parameter_handler
_invalid_parameter_noinfo_noreturn
exit
_errno
strerror
_invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

_strdup
strncpy_s
strncmp
wcslen
_stricmp
isalpha
wcsnlen
strncpy
wcscpy_s
strcmp
strcspn
strnlen
wcsncmp
_strnicmp
isdigit
isspace

api-ms-win-crt-utility-l1-1-0

bsearch
qsort
rand
srand

api-ms-win-crt-filesystem-l1-1-0

_mkdir
_wremove
_stat64i32
_unlock_file
_lock_file

api-ms-win-crt-convert-l1-1-0

atof
strtoul
atoi
strtoull
strtoll
strtol
strtod

api-ms-win-crt-math-l1-1-0

lround
sin
log2
copysignf
floorf
roundf
asinf
ceil
round
fmaxf
sqrtf
sinf
powf
log10f
cosf
acosf
ceilf
atanf
fmod
lrint
logf
lrintf
floor
sqrt
log
log10
cos
exp
pow
tanhf
expf

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64

d3d11

CreateDirect3D11DeviceFromDXGIDevice
D3D11CreateDevice

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

d2d1

ord1

dxgi

CreateDXGIFactory2

mmdevapi

ord17

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory

Sections

.text
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 231KB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 290KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.WAobs
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
clrcompression.dll
.dll windows x64

5a51928c11ae88f8c7e463bab1d9868a

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:32

Not After

01/09/2022, 18:32

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:79:ab:e7:62:35:29:78:1f:3a:d1:d9:e6:83:d6:35:1a:91:78:d5:a1:36:80:8e:66:2f:d3:e6:51:b0:31:a3
Signer

Actual PE Digest

3b:79:ab:e7:62:35:29:78:1f:3a:d1:d9:e6:83:d6:35:1a:91:78:d5:a1:36:80:8e:66:2f:d3:e6:51:b0:31:a3

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/04/2023, 18:14
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCurrentThreadId
GetTickCount64
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
QueryPerformanceCounter

ole32

CoTaskMemFree
CoTaskMemAlloc

Exports

Exports

CompressionNative_Crc32
CompressionNative_Deflate
CompressionNative_DeflateEnd
CompressionNative_DeflateInit2_
CompressionNative_Inflate
CompressionNative_InflateEnd
CompressionNative_InflateInit2_

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
e_sqlite3.dll
.dll windows x64

8b84aaa621f208bc42700ee4acf265cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-file-l1-1-0

ReadFile
WriteFile
GetFileAttributesExW
UnlockFileEx
SetEndOfFile
DeleteFileW
LockFileEx
SetFilePointerEx
FlushFileBuffers

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemTime
GetTickCount64

api-ms-win-core-memory-l1-1-1

MapViewOfFileFromApp
CreateFileMappingFromApp

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
FreeLibrary
GetProcAddress

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
HeapSize

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
CreateEventExW

api-ms-win-core-memory-l1-1-0

FlushViewOfFile
UnmapViewOfFile

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

GetLastError

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-libraryloader-l2-1-0

LoadPackagedLibrary

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

vcruntime140_app

memmove
__std_type_info_destroy_list
memcpy
memset
__C_specific_handler
memcmp
strrchr

api-ms-win-crt-heap-l1-1-0

free
malloc
_msize
realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcspn
strcmp
strncmp

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

log

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_seh_filter_dll
_execute_onexit_table
_cexit
_initterm_e
_initterm
_initialize_onexit_table

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_autovacuum_pages
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_pointer
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_changes64
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_filename
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_create_window_function
sqlite3_data_count
sqlite3_data_directory
sqlite3_database_file_object
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_deserialize
sqlite3_drop_modules
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_error_offset
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_filename_database
sqlite3_filename_journal
sqlite3_filename_wal
sqlite3_finalize
sqlite3_free
sqlite3_free_filename
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_hard_heap_limit64
sqlite3_initialize
sqlite3_interrupt
sqlite3_key
sqlite3_key_v2
sqlite3_keyword_check
sqlite3_keyword_count
sqlite3_keyword_name
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare16_v3
sqlite3_prepare_v2
sqlite3_prepare_v3
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_rekey
sqlite3_rekey_v2
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_pointer
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_serialize
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_set_last_insert_rowid
sqlite3_shutdown
sqlite3_sleep
sqlite3_snapshot_cmp
sqlite3_snapshot_free
sqlite3_snapshot_get
sqlite3_snapshot_open
sqlite3_snapshot_recover
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_isexplain
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_str_append
sqlite3_str_appendall
sqlite3_str_appendchar
sqlite3_str_appendf
sqlite3_str_errcode
sqlite3_str_finish
sqlite3_str_length
sqlite3_str_new
sqlite3_str_reset
sqlite3_str_value
sqlite3_str_vappendf
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_total_changes64
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_txn_state
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_key
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_frombind
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_nochange
sqlite3_value_numeric_type
sqlite3_value_pointer
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_collation
sqlite3_vtab_config
sqlite3_vtab_distinct
sqlite3_vtab_in
sqlite3_vtab_in_first
sqlite3_vtab_in_next
sqlite3_vtab_nochange
sqlite3_vtab_on_conflict
sqlite3_vtab_rhs_value
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_set_directory
sqlite3_win32_set_directory16
sqlite3_win32_set_directory8
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87bedf23efcd97400e685e25562ab8d4

Code Sign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

71:b0:f9:bb:07:67:fb:52:4f:ec:b0:ee:97:c9:e7:a1:0b:99:4d:9e:00:1f:47:69:de:ab:7b:6f:e4:93:7d:93Signer

Signature Validations

Verification

13/04/2023, 18:14 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

d2d1

d3d11

dwrite

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-shcore-stream-winrt-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-handle-l1-1-0

msvcp140_app

vcruntime140_1_app

vcruntime140_app

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 378KB - Virtual size: 377KB

.data Size: 5KB - Virtual size: 9KB

.pdata Size: 69KB - Virtual size: 68KB

.didat Size: 512B - Virtual size: 32B

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 44KB - Virtual size: 43KB

fb00da51a87bcd86f9b3d4670ee5ec01

Code Sign

33:00:00:01:1a:2f:2e:15:ee:b6:85:47:95:00:00:00:00:01:1aCertificate

Extended Key Usages

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03Certificate

Extended Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

9b:03:89:4a:04:63:04:1a:5d:14:46:06:b2:bf:b2:fc:2c:a4:94:edSigner

Signature Validations

Verification

15/03/2019, 17:29 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

vccorlib140_app

msvcp140_app

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

71:b0:f9:bb:07:67:fb:52:4f:ec:b0:ee:97:c9:e7:a1:0b:99:4d:9e:00:1f:47:69:de:ab:7b:6f:e4:93:7d:93
Signer

13/04/2023, 18:14
Valid: false

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 378KB - Virtual size: 377KB

.data
Size: 5KB - Virtual size: 9KB

.pdata
Size: 69KB - Virtual size: 68KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 44KB - Virtual size: 43KB

33:00:00:01:1a:2f:2e:15:ee:b6:85:47:95:00:00:00:00:01:1a
Certificate

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

9b:03:89:4a:04:63:04:1a:5d:14:46:06:b2:bf:b2:fc:2c:a4:94:ed
Signer

15/03/2019, 17:29
Valid: false

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 706KB - Virtual size: 706KB

.data
Size: 28KB - Virtual size: 30KB

.pdata
Size: 158KB - Virtual size: 158KB

.reloc
Size: 5KB - Virtual size: 4KB

33:00:00:02:54:ca:2b:f3:cb:9d:da:a6:75:00:00:00:00:02:54
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

68:5a:8f:d8:ed:c2:95:8c:78:a5:fe:c1:8e:cb:24:5b:77:63:c9:7e:c9:74:8f:05:cf:98:54:cb:ad:19:c2:5c
Signer

13/04/2023, 18:14
Valid: false

.text
Size: 398KB - Virtual size: 397KB

.rdata
Size: 92KB - Virtual size: 91KB

.data
Size: 2KB - Virtual size: 5KB

.pdata
Size: 25KB - Virtual size: 25KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB

33:00:00:02:54:ca:2b:f3:cb:9d:da:a6:75:00:00:00:00:02:54
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

e4:6f:61:66:a9:cb:47:19:a0:09:44:06:06:92:82:a8:43:82:db:4b:93:c9:59:da:ff:07:50:b4:79:96:48:8e
Signer

13/04/2023, 18:14
Valid: false