General

Malware Config

Signatures

Files

• x360ce.rar

  .rar
• x360ce.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2

  Certificate

  Issuer

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  29-10-2015 11:30

  Not After

  09-06-2027 11:30

  Subject

  CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0f:ab:69:f7:8d:83:87:f0:bd:5d:eb:98:4d:f4:a3:30

  Certificate

  Issuer

  CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  25-10-2016 13:57

  Not After

  25-10-2019 13:57

  Subject

  CN=Evaldas Jocys,OU=Evaldas Jocys,O=Evaldas Jocys,C=GB,1.2.840.113549.1.9.1=#0c116576616c646173406a6f6379732e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  ea:96:34:89:e9:fc:dd:13:d4:9a:77:00:bd:3e:43:f1:5b:5d:c0:ec

  Signer

  Actual PE Digest

  ea:96:34:89:e9:fc:dd:13:d4:9a:77:00:bd:3e:43:f1:5b:5d:c0:ec

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 2.9MB - Virtual size: 2.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 146KB - Virtual size: 145KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• x360ce.ini
• x360ce_x64.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2

  Certificate

  Issuer

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  29-10-2015 11:30

  Not After

  09-06-2027 11:30

  Subject

  CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0f:ab:69:f7:8d:83:87:f0:bd:5d:eb:98:4d:f4:a3:30

  Certificate

  Issuer

  CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  25-10-2016 13:57

  Not After

  25-10-2019 13:57

  Subject

  CN=Evaldas Jocys,OU=Evaldas Jocys,O=Evaldas Jocys,C=GB,1.2.840.113549.1.9.1=#0c116576616c646173406a6f6379732e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  43:be:3c:7c:a5:ee:6d:b7:90:76:5d:f4:88:3d:14:d7:97:bf:dc:a1

  Signer

  Actual PE Digest

  43:be:3c:7c:a5:ee:6d:b7:90:76:5d:f4:88:3d:14:d7:97:bf:dc:a1

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 2.9MB - Virtual size: 2.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 146KB - Virtual size: 145KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• xinput1_1.dll

  .dll windows:6 windows x64 arch:x64

  2f76e34e70806a7b79f14bc694472f2d

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  fa:33:b7:9d:d4:96:cf:d1:0c:84:65:39:a4:9d:63:b5

  Certificate

  Issuer

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  20-09-2011 11:04

  Not After

  20-09-2026 23:59

  Subject

  CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  1f:91:1f:d0:fd:9b:c3:d7:53:d2:4e:3e:de:42:d0:d9

  Certificate

  Issuer

  CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  05-12-2013 05:40

  Not After

  05-12-2015 05:40

  Subject

  CN=Jocys.com,OU=Jocys.com,O=Jocys.com,C=GB,1.2.840.113549.1.9.1=#0c116576616c646173406a6f6379732e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageKeyEncipherment

  9c:a6:b1:0f:e6:a6:9b:13:87:13:39:7f:87:b0:40:b9:b7:61:d0:61

  Signer

  Actual PE Digest

  9c:a6:b1:0f:e6:a6:9b:13:87:13:39:7f:87:b0:40:b9:b7:61:d0:61

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  Imports

  dinput8

  DirectInput8Create

  kernel32

  CloseHandle

  WriteFile

  OutputDebugStringA

  GetCurrentThreadId

  GetLocalTime

  GetModuleHandleExA

  GetLastError

  FreeLibrary

  GetProcAddress

  GetTickCount

  SetThreadExecutionState

  CreateFileA

  DisableThreadLibraryCalls

  MulDiv

  HeapReAlloc

  SetThreadContext

  HeapAlloc

  GetCurrentProcess

  HeapFree

  Thread32First

  HeapDestroy

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  QueryPerformanceCounter

  IsProcessorFeaturePresent

  IsDebuggerPresent

  DecodePointer

  EncodePointer

  SetLastError

  GetModuleHandleExW

  GetModuleHandleW

  LoadLibraryExW

  LoadLibraryExA

  Sleep

  GetPrivateProfileSectionA

  GetNativeSystemInfo

  GetModuleHandleA

  VerifyVersionInfoA

  VerSetConditionMask

  GetModuleFileNameW

  GetModuleFileNameA

  LoadLibraryW

  LoadLibraryA

  GetSystemDirectoryA

  HeapCreate

  Thread32Next

  FlushInstructionCache

  OpenThread

  VirtualProtect

  CreateToolhelp32Snapshot

  SuspendThread

  ResumeThread

  VirtualQuery

  VirtualFree

  VirtualAlloc

  GetSystemInfo

  GetThreadContext

  user32

  MessageBoxA

  GetSystemMetrics

  DestroyWindow

  MessageBeep

  CreateWindowExA

  msvcp120

  ?_Xlength_error@std@@YAXPEBD@Z

  ?_Xout_of_range@std@@YAXPEBD@Z

  ?_Winerror_map@std@@YAPEBDH@Z

  ?_Syserror_map@std@@YAPEBDH@Z

  ?_Xbad_alloc@std@@YAXXZ

  msvcr120

  _onexit

  __crt_debugger_hook

  __crtUnhandledException

  __crtTerminateProcess

  __crtCaptureCurrentContext

  __crtCapturePreviousContext

  __CppXcptFilter

  _amsg_exit

  free

  _malloc_crt

  _initterm

  _initterm_e

  ?_type_info_dtor_internal_method@type_info@@QEAAXXZ

  __clean_type_info_names_internal

  _CxxThrowException

  __C_specific_handler

  _calloc_crt

  _unlock

  _lock

  wcscpy_s

  strcpy_s

  wcsstr

  wcsrchr

  towlower

  tolower

  _endthreadex

  _beginthreadex

  ?terminate@@YAXXZ

  memchr

  swprintf_s

  swscanf_s

  sscanf_s

  strchr

  _stricmp

  strtoul

  strtol

  _errno

  _vscwprintf

  _vsnprintf_s_l

  _create_locale

  _purecall

  sprintf_s

  exit

  _vscprintf

  ??_V@YAXPEAX@Z

  ??2@YAPEAX_K@Z

  ??3@YAXPEAX@Z

  memmove

  __dllonexit

  __CxxFrameHandler3

  __RTDynamicCast

  memcmp

  memcpy

  memset

  _vsnwprintf_s

  sqrtf

  setupapi

  SetupDiGetDeviceInstanceIdW

  wintrust

  WinVerifyTrust

  shlwapi

  PathAppendA

  PathRemoveFileSpecA

  PathIsRelativeA

  PathFindFileNameA

  PathCombineA

  shell32

  SHGetFolderPathA

  ole32

  CoCreateInstance

  CoCreateInstanceEx

  CoGetClassObject

  CoUninitialize

  oleaut32

  SysReAllocString

  Exports

  Exports

  DllMain

  Reset

  XInputEnable

  XInputGetAudioDeviceIds

  XInputGetBatteryInformation

  XInputGetCapabilities

  XInputGetDSoundAudioDeviceGuids

  XInputGetKeystroke

  XInputGetState

  XInputSetState

  Sections

  .text

  Size: 87KB - Virtual size: 87KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 35KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 524B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• xinput1_2.dll

  .dll windows:6 windows x64 arch:x64

  2f76e34e70806a7b79f14bc694472f2d

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  fa:33:b7:9d:d4:96:cf:d1:0c:84:65:39:a4:9d:63:b5

  Certificate

  Issuer

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  20-09-2011 11:04

  Not After

  20-09-2026 23:59

  Subject

  CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  1f:91:1f:d0:fd:9b:c3:d7:53:d2:4e:3e:de:42:d0:d9

  Certificate

  Issuer

  CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  05-12-2013 05:40

  Not After

  05-12-2015 05:40

  Subject

  CN=Jocys.com,OU=Jocys.com,O=Jocys.com,C=GB,1.2.840.113549.1.9.1=#0c116576616c646173406a6f6379732e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageKeyEncipherment

  9c:a6:b1:0f:e6:a6:9b:13:87:13:39:7f:87:b0:40:b9:b7:61:d0:61

  Signer

  Actual PE Digest

  9c:a6:b1:0f:e6:a6:9b:13:87:13:39:7f:87:b0:40:b9:b7:61:d0:61

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  Imports

  dinput8

  DirectInput8Create

  kernel32

  CloseHandle

  WriteFile

  OutputDebugStringA

  GetCurrentThreadId

  GetLocalTime

  GetModuleHandleExA

  GetLastError

  FreeLibrary

  GetProcAddress

  GetTickCount

  SetThreadExecutionState

  CreateFileA

  DisableThreadLibraryCalls

  MulDiv

  HeapReAlloc

  SetThreadContext

  HeapAlloc

  GetCurrentProcess

  HeapFree

  Thread32First

  HeapDestroy

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  QueryPerformanceCounter

  IsProcessorFeaturePresent

  IsDebuggerPresent

  DecodePointer

  EncodePointer

  SetLastError

  GetModuleHandleExW

  GetModuleHandleW

  LoadLibraryExW

  LoadLibraryExA

  Sleep

  GetPrivateProfileSectionA

  GetNativeSystemInfo

  GetModuleHandleA

  VerifyVersionInfoA

  VerSetConditionMask

  GetModuleFileNameW

  GetModuleFileNameA

  LoadLibraryW

  LoadLibraryA

  GetSystemDirectoryA

  HeapCreate

  Thread32Next

  FlushInstructionCache

  OpenThread

  VirtualProtect

  CreateToolhelp32Snapshot

  SuspendThread

  ResumeThread

  VirtualQuery

  VirtualFree

  VirtualAlloc

  GetSystemInfo

  GetThreadContext

  user32

  MessageBoxA

  GetSystemMetrics

  DestroyWindow

  MessageBeep

  CreateWindowExA

  msvcp120

  ?_Xlength_error@std@@YAXPEBD@Z

  ?_Xout_of_range@std@@YAXPEBD@Z

  ?_Winerror_map@std@@YAPEBDH@Z

  ?_Syserror_map@std@@YAPEBDH@Z

  ?_Xbad_alloc@std@@YAXXZ

  msvcr120

  _onexit

  __crt_debugger_hook

  __crtUnhandledException

  __crtTerminateProcess

  __crtCaptureCurrentContext

  __crtCapturePreviousContext

  __CppXcptFilter

  _amsg_exit

  free

  _malloc_crt

  _initterm

  _initterm_e

  ?_type_info_dtor_internal_method@type_info@@QEAAXXZ

  __clean_type_info_names_internal

  _CxxThrowException

  __C_specific_handler

  _calloc_crt

  _unlock

  _lock

  wcscpy_s

  strcpy_s

  wcsstr

  wcsrchr

  towlower

  tolower

  _endthreadex

  _beginthreadex

  ?terminate@@YAXXZ

  memchr

  swprintf_s

  swscanf_s

  sscanf_s

  strchr

  _stricmp

  strtoul

  strtol

  _errno

  _vscwprintf

  _vsnprintf_s_l

  _create_locale

  _purecall

  sprintf_s

  exit

  _vscprintf

  ??_V@YAXPEAX@Z

  ??2@YAPEAX_K@Z

  ??3@YAXPEAX@Z

  memmove

  __dllonexit

  __CxxFrameHandler3

  __RTDynamicCast

  memcmp

  memcpy

  memset

  _vsnwprintf_s

  sqrtf

  setupapi

  SetupDiGetDeviceInstanceIdW

  wintrust

  WinVerifyTrust

  shlwapi

  PathAppendA

  PathRemoveFileSpecA

  PathIsRelativeA

  PathFindFileNameA

  PathCombineA

  shell32

  SHGetFolderPathA

  ole32

  CoCreateInstance

  CoCreateInstanceEx

  CoGetClassObject

  CoUninitialize

  oleaut32

  SysReAllocString

  Exports

  Exports

  DllMain

  Reset

  XInputEnable

  XInputGetAudioDeviceIds

  XInputGetBatteryInformation

  XInputGetCapabilities

  XInputGetDSoundAudioDeviceGuids

  XInputGetKeystroke

  XInputGetState

  XInputSetState

  Sections

  .text

  Size: 87KB - Virtual size: 87KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 35KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 524B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• xinput1_3.dll

  .dll windows:6 windows x64 arch:x64

  2f76e34e70806a7b79f14bc694472f2d

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  fa:33:b7:9d:d4:96:cf:d1:0c:84:65:39:a4:9d:63:b5

  Certificate

  Issuer

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  20-09-2011 11:04

  Not After

  20-09-2026 23:59

  Subject

  CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  1f:91:1f:d0:fd:9b:c3:d7:53:d2:4e:3e:de:42:d0:d9

  Certificate

  Issuer

  CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  05-12-2013 05:40

  Not After

  05-12-2015 05:40

  Subject

  CN=Jocys.com,OU=Jocys.com,O=Jocys.com,C=GB,1.2.840.113549.1.9.1=#0c116576616c646173406a6f6379732e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageKeyEncipherment

  9c:a6:b1:0f:e6:a6:9b:13:87:13:39:7f:87:b0:40:b9:b7:61:d0:61

  Signer

  Actual PE Digest

  9c:a6:b1:0f:e6:a6:9b:13:87:13:39:7f:87:b0:40:b9:b7:61:d0:61

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  Imports

  dinput8

  DirectInput8Create

  kernel32

  CloseHandle

  WriteFile

  OutputDebugStringA

  GetCurrentThreadId

  GetLocalTime

  GetModuleHandleExA

  GetLastError

  FreeLibrary

  GetProcAddress

  GetTickCount

  SetThreadExecutionState

  CreateFileA

  DisableThreadLibraryCalls

  MulDiv

  HeapReAlloc

  SetThreadContext

  HeapAlloc

  GetCurrentProcess

  HeapFree

  Thread32First

  HeapDestroy

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  QueryPerformanceCounter

  IsProcessorFeaturePresent

  IsDebuggerPresent

  DecodePointer

  EncodePointer

  SetLastError

  GetModuleHandleExW

  GetModuleHandleW

  LoadLibraryExW

  LoadLibraryExA

  Sleep

  GetPrivateProfileSectionA

  GetNativeSystemInfo

  GetModuleHandleA

  VerifyVersionInfoA

  VerSetConditionMask

  GetModuleFileNameW

  GetModuleFileNameA

  LoadLibraryW

  LoadLibraryA

  GetSystemDirectoryA

  HeapCreate

  Thread32Next

  FlushInstructionCache

  OpenThread

  VirtualProtect

  CreateToolhelp32Snapshot

  SuspendThread

  ResumeThread

  VirtualQuery

  VirtualFree

  VirtualAlloc

  GetSystemInfo

  GetThreadContext

  user32

  MessageBoxA

  GetSystemMetrics

  DestroyWindow

  MessageBeep

  CreateWindowExA

  msvcp120

  ?_Xlength_error@std@@YAXPEBD@Z

  ?_Xout_of_range@std@@YAXPEBD@Z

  ?_Winerror_map@std@@YAPEBDH@Z

  ?_Syserror_map@std@@YAPEBDH@Z

  ?_Xbad_alloc@std@@YAXXZ

  msvcr120

  _onexit

  __crt_debugger_hook

  __crtUnhandledException

  __crtTerminateProcess

  __crtCaptureCurrentContext

  __crtCapturePreviousContext

  __CppXcptFilter

  _amsg_exit

  free

  _malloc_crt

  _initterm

  _initterm_e

  ?_type_info_dtor_internal_method@type_info@@QEAAXXZ

  __clean_type_info_names_internal

  _CxxThrowException

  __C_specific_handler

  _calloc_crt

  _unlock

  _lock

  wcscpy_s

  strcpy_s

  wcsstr

  wcsrchr

  towlower

  tolower

  _endthreadex

  _beginthreadex

  ?terminate@@YAXXZ

  memchr

  swprintf_s

  swscanf_s

  sscanf_s

  strchr

  _stricmp

  strtoul

  strtol

  _errno

  _vscwprintf

  _vsnprintf_s_l

  _create_locale

  _purecall

  sprintf_s

  exit

  _vscprintf

  ??_V@YAXPEAX@Z

  ??2@YAPEAX_K@Z

  ??3@YAXPEAX@Z

  memmove

  __dllonexit

  __CxxFrameHandler3

  __RTDynamicCast

  memcmp

  memcpy

  memset

  _vsnwprintf_s

  sqrtf

  setupapi

  SetupDiGetDeviceInstanceIdW

  wintrust

  WinVerifyTrust

  shlwapi

  PathAppendA

  PathRemoveFileSpecA

  PathIsRelativeA

  PathFindFileNameA

  PathCombineA

  shell32

  SHGetFolderPathA

  ole32

  CoCreateInstance

  CoCreateInstanceEx

  CoGetClassObject

  CoUninitialize

  oleaut32

  SysReAllocString

  Exports

  Exports

  DllMain

  Reset

  XInputEnable

  XInputGetAudioDeviceIds

  XInputGetBatteryInformation

  XInputGetCapabilities

  XInputGetDSoundAudioDeviceGuids

  XInputGetKeystroke

  XInputGetState

  XInputSetState

  Sections

  .text

  Size: 87KB - Virtual size: 87KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 35KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 524B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• xinput1_4.dll

  .dll windows:6 windows x64 arch:x64

  2f76e34e70806a7b79f14bc694472f2d

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  fa:33:b7:9d:d4:96:cf:d1:0c:84:65:39:a4:9d:63:b5

  Certificate

  Issuer

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  20-09-2011 11:04

  Not After

  20-09-2026 23:59

  Subject

  CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  1f:91:1f:d0:fd:9b:c3:d7:53:d2:4e:3e:de:42:d0:d9

  Certificate

  Issuer

  CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  05-12-2013 05:40

  Not After

  05-12-2015 05:40

  Subject

  CN=Jocys.com,OU=Jocys.com,O=Jocys.com,C=GB,1.2.840.113549.1.9.1=#0c116576616c646173406a6f6379732e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageKeyEncipherment

  9c:a6:b1:0f:e6:a6:9b:13:87:13:39:7f:87:b0:40:b9:b7:61:d0:61

  Signer

  Actual PE Digest

  9c:a6:b1:0f:e6:a6:9b:13:87:13:39:7f:87:b0:40:b9:b7:61:d0:61

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  Imports

  dinput8

  DirectInput8Create

  kernel32

  CloseHandle

  WriteFile

  OutputDebugStringA

  GetCurrentThreadId

  GetLocalTime

  GetModuleHandleExA

  GetLastError

  FreeLibrary

  GetProcAddress

  GetTickCount

  SetThreadExecutionState

  CreateFileA

  DisableThreadLibraryCalls

  MulDiv

  HeapReAlloc

  SetThreadContext

  HeapAlloc

  GetCurrentProcess

  HeapFree

  Thread32First

  HeapDestroy

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  QueryPerformanceCounter

  IsProcessorFeaturePresent

  IsDebuggerPresent

  DecodePointer

  EncodePointer

  SetLastError

  GetModuleHandleExW

  GetModuleHandleW

  LoadLibraryExW

  LoadLibraryExA

  Sleep

  GetPrivateProfileSectionA

  GetNativeSystemInfo

  GetModuleHandleA

  VerifyVersionInfoA

  VerSetConditionMask

  GetModuleFileNameW

  GetModuleFileNameA

  LoadLibraryW

  LoadLibraryA

  GetSystemDirectoryA

  HeapCreate

  Thread32Next

  FlushInstructionCache

  OpenThread

  VirtualProtect

  CreateToolhelp32Snapshot

  SuspendThread

  ResumeThread

  VirtualQuery

  VirtualFree

  VirtualAlloc

  GetSystemInfo

  GetThreadContext

  user32

  MessageBoxA

  GetSystemMetrics

  DestroyWindow

  MessageBeep

  CreateWindowExA

  msvcp120

  ?_Xlength_error@std@@YAXPEBD@Z

  ?_Xout_of_range@std@@YAXPEBD@Z

  ?_Winerror_map@std@@YAPEBDH@Z

  ?_Syserror_map@std@@YAPEBDH@Z

  ?_Xbad_alloc@std@@YAXXZ

  msvcr120

  _onexit

  __crt_debugger_hook

  __crtUnhandledException

  __crtTerminateProcess

  __crtCaptureCurrentContext

  __crtCapturePreviousContext

  __CppXcptFilter

  _amsg_exit

  free

  _malloc_crt

  _initterm

  _initterm_e

  ?_type_info_dtor_internal_method@type_info@@QEAAXXZ

  __clean_type_info_names_internal

  _CxxThrowException

  __C_specific_handler

  _calloc_crt

  _unlock

  _lock

  wcscpy_s

  strcpy_s

  wcsstr

  wcsrchr

  towlower

  tolower

  _endthreadex

  _beginthreadex

  ?terminate@@YAXXZ

  memchr

  swprintf_s

  swscanf_s

  sscanf_s

  strchr

  _stricmp

  strtoul

  strtol

  _errno

  _vscwprintf

  _vsnprintf_s_l

  _create_locale

  _purecall

  sprintf_s

  exit

  _vscprintf

  ??_V@YAXPEAX@Z

  ??2@YAPEAX_K@Z

  ??3@YAXPEAX@Z

  memmove

  __dllonexit

  __CxxFrameHandler3

  __RTDynamicCast

  memcmp

  memcpy

  memset

  _vsnwprintf_s

  sqrtf

  setupapi

  SetupDiGetDeviceInstanceIdW

  wintrust

  WinVerifyTrust

  shlwapi

  PathAppendA

  PathRemoveFileSpecA

  PathIsRelativeA

  PathFindFileNameA

  PathCombineA

  shell32

  SHGetFolderPathA

  ole32

  CoCreateInstance

  CoCreateInstanceEx

  CoGetClassObject

  CoUninitialize

  oleaut32

  SysReAllocString

  Exports

  Exports

  DllMain

  Reset

  XInputEnable

  XInputGetAudioDeviceIds

  XInputGetBatteryInformation

  XInputGetCapabilities

  XInputGetDSoundAudioDeviceGuids

  XInputGetKeystroke

  XInputGetState

  XInputSetState

  Sections

  .text

  Size: 87KB - Virtual size: 87KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 35KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 524B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• xinput9_1_0.dll

  .dll windows:6 windows x64 arch:x64

  2f76e34e70806a7b79f14bc694472f2d

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  fa:33:b7:9d:d4:96:cf:d1:0c:84:65:39:a4:9d:63:b5

  Certificate

  Issuer

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  20-09-2011 11:04

  Not After

  20-09-2026 23:59

  Subject

  CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  1f:91:1f:d0:fd:9b:c3:d7:53:d2:4e:3e:de:42:d0:d9

  Certificate

  Issuer

  CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  05-12-2013 05:40

  Not After

  05-12-2015 05:40

  Subject

  CN=Jocys.com,OU=Jocys.com,O=Jocys.com,C=GB,1.2.840.113549.1.9.1=#0c116576616c646173406a6f6379732e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageKeyEncipherment

  9c:a6:b1:0f:e6:a6:9b:13:87:13:39:7f:87:b0:40:b9:b7:61:d0:61

  Signer

  Actual PE Digest

  9c:a6:b1:0f:e6:a6:9b:13:87:13:39:7f:87:b0:40:b9:b7:61:d0:61

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  Imports

  dinput8

  DirectInput8Create

  kernel32

  CloseHandle

  WriteFile

  OutputDebugStringA

  GetCurrentThreadId

  GetLocalTime

  GetModuleHandleExA

  GetLastError

  FreeLibrary

  GetProcAddress

  GetTickCount

  SetThreadExecutionState

  CreateFileA

  DisableThreadLibraryCalls

  MulDiv

  HeapReAlloc

  SetThreadContext

  HeapAlloc

  GetCurrentProcess

  HeapFree

  Thread32First

  HeapDestroy

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  QueryPerformanceCounter

  IsProcessorFeaturePresent

  IsDebuggerPresent

  DecodePointer

  EncodePointer

  SetLastError

  GetModuleHandleExW

  GetModuleHandleW

  LoadLibraryExW

  LoadLibraryExA

  Sleep

  GetPrivateProfileSectionA

  GetNativeSystemInfo

  GetModuleHandleA

  VerifyVersionInfoA

  VerSetConditionMask

  GetModuleFileNameW

  GetModuleFileNameA

  LoadLibraryW

  LoadLibraryA

  GetSystemDirectoryA

  HeapCreate

  Thread32Next

  FlushInstructionCache

  OpenThread

  VirtualProtect

  CreateToolhelp32Snapshot

  SuspendThread

  ResumeThread

  VirtualQuery

  VirtualFree

  VirtualAlloc

  GetSystemInfo

  GetThreadContext

  user32

  MessageBoxA

  GetSystemMetrics

  DestroyWindow

  MessageBeep

  CreateWindowExA

  msvcp120

  ?_Xlength_error@std@@YAXPEBD@Z

  ?_Xout_of_range@std@@YAXPEBD@Z

  ?_Winerror_map@std@@YAPEBDH@Z

  ?_Syserror_map@std@@YAPEBDH@Z

  ?_Xbad_alloc@std@@YAXXZ

  msvcr120

  _onexit

  __crt_debugger_hook

  __crtUnhandledException

  __crtTerminateProcess

  __crtCaptureCurrentContext

  __crtCapturePreviousContext

  __CppXcptFilter

  _amsg_exit

  free

  _malloc_crt

  _initterm

  _initterm_e

  ?_type_info_dtor_internal_method@type_info@@QEAAXXZ

  __clean_type_info_names_internal

  _CxxThrowException

  __C_specific_handler

  _calloc_crt

  _unlock

  _lock

  wcscpy_s

  strcpy_s

  wcsstr

  wcsrchr

  towlower

  tolower

  _endthreadex

  _beginthreadex

  ?terminate@@YAXXZ

  memchr

  swprintf_s

  swscanf_s

  sscanf_s

  strchr

  _stricmp

  strtoul

  strtol

  _errno

  _vscwprintf

  _vsnprintf_s_l

  _create_locale

  _purecall

  sprintf_s

  exit

  _vscprintf

  ??_V@YAXPEAX@Z

  ??2@YAPEAX_K@Z

  ??3@YAXPEAX@Z

  memmove

  __dllonexit

  __CxxFrameHandler3

  __RTDynamicCast

  memcmp

  memcpy

  memset

  _vsnwprintf_s

  sqrtf

  setupapi

  SetupDiGetDeviceInstanceIdW

  wintrust

  WinVerifyTrust

  shlwapi

  PathAppendA

  PathRemoveFileSpecA

  PathIsRelativeA

  PathFindFileNameA

  PathCombineA

  shell32

  SHGetFolderPathA

  ole32

  CoCreateInstance

  CoCreateInstanceEx

  CoGetClassObject

  CoUninitialize

  oleaut32

  SysReAllocString

  Exports

  Exports

  DllMain

  Reset

  XInputEnable

  XInputGetAudioDeviceIds

  XInputGetBatteryInformation

  XInputGetCapabilities

  XInputGetDSoundAudioDeviceGuids

  XInputGetKeystroke

  XInputGetState

  XInputSetState

  Sections

  .text

  Size: 87KB - Virtual size: 87KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 35KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 524B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ