download (2).zip
- SHA256 a1082d01ede1f5fa700be2420ec96047a699d0579c15ddb2f54233a24ac3a7e9
Overview
overview
10Static
static
1007ba533a69...53.exe
windows7-x64
107ba533a69...53.exe
windows10-2004-x64
10e971ff0e7...8d.exe
windows7-x64
80e971ff0e7...8d.exe
windows10-2004-x64
8111fb06de8...8b.exe
windows7-x64
9111fb06de8...8b.exe
windows10-2004-x64
92de3cea3eb...a8.exe
windows7-x64
12de3cea3eb...a8.exe
windows10-2004-x64
1327a2a4916...ca.exe
windows7-x64
8327a2a4916...ca.exe
windows10-2004-x64
836c10a3e1f...d9.exe
windows7-x64
136c10a3e1f...d9.exe
windows10-2004-x64
167bf260c3e...10.exe
windows7-x64
867bf260c3e...10.exe
windows10-2004-x64
870ec1874cf...ac.exe
windows7-x64
170ec1874cf...ac.exe
windows10-2004-x64
1817f5b0fcc...99.exe
windows7-x64
7817f5b0fcc...99.exe
windows10-2004-x64
7875a6185aa...f0.exe
windows7-x64
1875a6185aa...f0.exe
windows10-2004-x64
1887d386d2e...c6.exe
windows7-x64
1887d386d2e...c6.exe
windows10-2004-x64
1902afe35c6...16.exe
windows7-x64
10902afe35c6...16.exe
windows10-2004-x64
1097b6e51df2...0a.exe
windows7-x64
797b6e51df2...0a.exe
windows10-2004-x64
7a4704be3a7...72.exe
windows7-x64
1a4704be3a7...72.exe
windows10-2004-x64
1b21f34ecfa...73.exe
windows7-x64
9b21f34ecfa...73.exe
windows10-2004-x64
9b75b3ff656...52.exe
windows7-x64
8b75b3ff656...52.exe
windows10-2004-x64
8Behavioral task
behavioral1
Sample
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral7
Sample
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral19
Sample
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe
Resource
win7-20231215-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral24
Sample
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral25
Sample
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral30
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral31
Sample
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target download (2).zip
- Size 3.8MB
- Sample240101-r7thvscfhp
- SHA256 a1082d01ede1f5fa700be2420ec96047a699d0579c15ddb2f54233a24ac3a7e9
- MD5 b635fff428bf641682282d89ec8623eb
- SHA1 5ab66f5b164d52a342c04a1cbf680d5b7a7aaeb7
- SHA512 b760da467194b3148a8918460e843991cf275f5c7de5c4829241123f74a1a0a7dee70947ae91325ab2ce2968305ed31156c078cc85206f5270fa6a26a84123e0
- SSDEEP 49152:E6Q/1OLt3OK9t1kHJMkhBaSHvgsurtH+2OdrFHPxMlsl6zudI1Ju4OhKhe50zlrp:E0hV6MEBaSHMtH+2OvIsAudOJgKM5S
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- MedusaLocker payload 1 IoCs
resource yara_rule static1/unpack001/902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016 family_medusalocker - Medusalocker family
- Unsigned PE 24 IoCs
Checks for missing Authenticode signature.
resource unpack001/07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53 unpack001/0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d unpack001/111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b unpack001/2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8 unpack001/327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca unpack001/36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9 unpack001/67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10 unpack001/70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac unpack001/817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999 unpack001/875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0 unpack001/887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6 unpack001/902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016 unpack001/97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a unpack001/a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572 unpack001/b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273 unpack001/b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552 unpack001/c697e2d009219bf9ef4a300f0d66273f3d1a3a92e66ed3c0b0fec50305e8e366 unpack001/cd7542f2d7f2285ab524a57bc04ae1ad9306a15b9efbf56ea7b002d99d4b974f unpack001/d6dcee050e7c2accacbfd4de5bbcd2423c970a1437fc6360084c1b3e492315fe unpack001/ded5fa93032fa254d49532adab59a7695b352e9a31cafdbc72bde05f5d338b32 unpack001/e49e4b815789001951a3798b46898751023974347d8a468a39b2ccbff70282dd unpack001/f70521a197291008e7a691566c9d20c6883f1b2199cd4b6be1fbbe61ccda4dc3 unpack001/fce17dd710a05778968a73283e95bb1eb7749c7c5e701c63882082942409522c unpack001/ffc5e46200f16549f17d2d6e4d6e5e61239b711cd07fbf7932c31e2ea18a7865
File Explorer
-
download (2).zip.zip 3.8MB
-
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53.exe 586KB
-
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe 179KB
-
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe 662KB
-
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8.exe 464KB
-
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca.exe 531KB
-
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9.exe 179KB
-
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe 276KB
-
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac.exe 188KB
-
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999.exe 339KB
-
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0.exe 197KB
-
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6.exe 519KB
-
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe 334KB
-
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe 207KB
-
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe 565KB
-
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe 352KB
-
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552.exe 414KB
-
c697e2d009219bf9ef4a300f0d66273f3d1a3a92e66ed3c0b0fec50305e8e366.exe 299KB
-
cd7542f2d7f2285ab524a57bc04ae1ad9306a15b9efbf56ea7b002d99d4b974f.exe 215KB
-
d6dcee050e7c2accacbfd4de5bbcd2423c970a1437fc6360084c1b3e492315fe.exe 605KB
-
ded5fa93032fa254d49532adab59a7695b352e9a31cafdbc72bde05f5d338b32.exe 213KB
-
e49e4b815789001951a3798b46898751023974347d8a468a39b2ccbff70282dd.exe 183KB
-
f70521a197291008e7a691566c9d20c6883f1b2199cd4b6be1fbbe61ccda4dc3.exe 201KB
-
fce17dd710a05778968a73283e95bb1eb7749c7c5e701c63882082942409522c.exe 666KB
-
ffc5e46200f16549f17d2d6e4d6e5e61239b711cd07fbf7932c31e2ea18a7865.exe 414KB
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53
- MD5 03b47131c6a809c9222de2f97e03b49e
- SHA1 7831520ec9797f8d776a191b2ac30bea4b9c28c0
- SHA512 54cc49085e2e9cadeebe4462e6906782fae221325baf2039886fe562bb2c485382453f85e1617577fd0117ab08ff718a23913db0bccdfdcfdbce854cd9a52176
- SSDEEP 6144:gMO1jIO0u8krJilHXIdAXEZvGLw+nmYciNXyEuxIKvqoPFZLRbUqF5jQaBlQAhb/:ROhIOR/0lHXQAlL7aIKTvl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
232494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
219KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
366KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d
- MD5 8e0e472d93c3ebeb725099bc1bbe0a9a
- SHA1 7229e11205e794c75a65587bcef040ed345b3322
- SHA512 74a63a29a6ea5cfd2f7983b9828dd7a78b3d16072f5e044e795404eb67a2178ac091e15c9a29bafa7b9e7426c6aa709697cb9705ff25f7e40c9597ad1758eda3
- SSDEEP 3072:2Rb6HWdU1NByFMuIBRC0eXLfQzueFsB0yxfWolUJFMXNsz5SkE+pbt8ICjGs:IbeBRmXLP0yJAJFMXNXyC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
189118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
177KB
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b
- MD5 b6c70f89f19670923f3f490ed5331395
- SHA1 24c9df54d779be27508203666dc48a3fdabb0b87
- SHA512 8a49a73c4086be3ae657452816070d7bf79dc653a9a7c783262348788ee80584c4456e3056f1427f4f1b8433de54437b996bfbede100430b2f7168c130511b0b
- SSDEEP 12288:IG86nitqrIT6Eqk56i258EJsUQUUJ9LBHd2Uo:57itqr3e6d18J9LBHd2n
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
679670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
656KB
Virtual Size
655KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8
- MD5 79db8a12fc1a24a70c37c4cad0c29c6b
- SHA1 ec6e79d2494862dd6cecbbd817926e282a6e2f4e
- SHA512 cbaf76ba0f245a103d3cfbd3cf3c78e353bee26931afdbde40c27355379ea9590e16aa430d9af82700fa8773cd4bb342cdfa73add60eab8ea549be7010d6f57f
- SSDEEP 3072:KovCvStG1V1wisbM/OmsolxIrRuw+mqv9j1MWLQL:KqgRwLg/ODAx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
380366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
363KB
Virtual Size
363KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca
- MD5 afce432f39419ac75edf95ca955d5937
- SHA1 948b431bdd23bd5e65f0978e56ef09061943fb07
- SHA512 9dc222c083a17ead29648fdf47102c4cfb296305790453adb5acaa13519e91651b07ce74a95336ba422fecbe64f9ee3606fb8a7afc33306f0e001da936ec8fee
- SSDEEP 1536:ymb6YYUjUDYEmb6YYUjUDY1q2JKeDDLXf9Xt1be41hmb6YYUjUDYjij:9+yID4+yIDkxJHDDLXVXt1beEA+yIDd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
377070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
360KB
Virtual Size
360KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
185B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
169KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9
- MD5 b0ca603398de86e031a781c9d7606ec5
- SHA1 6be006b5098f6286032ab54bf5b2549fcb859060
- SHA512 629b6c8a5bb204fdef6d14b77105cef59af3c481364577f68b240b15c18141f7d8cf239f8dd8b26a4c01b861aeca1d3a44c26c41e671581a1592012bcca33853
- SSDEEP 1536:6BBzTaVpK3p2oEvvHVUFWHy4h0ZX9efw1+b91RM:6BQVpKvEvPVU5ukX9l1+BzM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
87614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10
- MD5 80d0e4499a2ce6ac1d3bd1d43300c506
- SHA1 a1ca861aacf0ef8369d7d5a169134c29f895e5ef
- SHA512 e67bab4f57deb5f3cb6a227298a19c9f6d96ef0e6825be0ef9f1f3537ca7cc32e9ba4482a5f6e2240b0d6a15ee39061671d6d4928afcfb7feab09009d5e44d30
- SSDEEP 3072:L6ZBn8Tiju3y8TBz5c3Px/rbtYkHOG0rpPVuwq7fxZ1v:gaijqNcpqful
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
276878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
262KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac
- MD5 c924d51f5943766d54ca1c2fe0dfd3c0
- SHA1 4221c92cc0a689f47065dc28795969219727b82e
- SHA512 1f2bb905ee4792553cd1a6d65eb22f48a157947ac9dd62d10fdc5e15f358f825d081a2f9153eae8afe576f94c4969f1e63bce2edf74a6f9cdd703e0d30ad4bc8
- SSDEEP 3072:F7tWE2AM+gTuJEJjy1GS52CFgPhIikuJEfUsIVp/is4cWs:htc+jJOjEGkf4fJ/d
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
173482
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
161KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999
- IMPHASH 027ea80e8125c6dda271246922d4c3b0
- SHA256 817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999
- MD5 f549cea3f3f2d8304b56997d241690dd
- SHA1 b063ea7f64513aa2ddb3b7a7ac51f9d7cba7cf18
- SHA512 3beeb0c83a0acfc41f1fb6273a04145783cd69ca126d924638ec2282ff162a39cf7b65b1107311f8be3d94003897e70ed78ecf2be07cda6d63b24ca8f6e512fd
- SSDEEP 6144:fc0h522p3l04ZMSmIp3Uy28uhyqe/I3ahlvFJxKvN0Ic22Zh1F:nhxp3lZnT9bDuaI3ahlvFJxK1nMh1F
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
117429
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetLastError
SetLastError
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
GetTickCount
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointerEx
DecodePointer
Name
.text
Size
184KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=139, id=243, version=40116,
count=24, id=242, version=40116,
count=22, id=259, version=23907,
count=19, id=260, version=23907,
count=45, id=261, version=23907,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=248, id=1, productName=Unmarked objects,
count=48, id=261, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=256, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0
- MD5 05c95cefcc2292424ffc1aff84215a4e
- SHA1 83eeb67e6deaa063979aa5bbde7e9d9eeabab577
- SHA512 7ae78baba3315c11e738a236f5542f0aff5a0c2232ef8e2b5d0f90582771c91ebebbb6c047c611890ae9185115e73ae476fb8403d4147924937a666075e65889
- SSDEEP 6144:8fkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk4:8fkkkkkkkkkkkkkkkkkkkkkkkkkkkkkL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
118142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
107KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6
- MD5 51ff96a2fe3ecc27f2bae4a243aca5d4
- SHA1 eb8a0c988de8e2ba14f9a970651424ea64b17ba0
- SHA512 eda5c45118bea07a697b68c3ee190e84b7b35afa65711b6fae3ac7d42acafeaa2aa8f2e4a0056887c5b1c8af6b41bd5ddb9779f11f1b66993025a4a49a293102
- SSDEEP 3072:aePKBpKkHYVqc4yByz3bnkzuZilMpX6Ldj1XaUrAp/GFIPFhmJnVifQRipMLh427:zKBpKAY+8nGSjemJnVZ4AT9Wy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
533926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
513KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016
- IMPHASH d2075085e01f67e8fee40d30b544c390
- SHA256 902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016
- MD5 4d8bdcee20a3de89ba08bd09cd4ea642
- SHA1 cc4ddf3a821eb13db3d45ed7e4b0b2ed35c2a22e
- SHA512 024944b3910f72e80d1436627812fefb7bd4b4f3e9d541a747d549743a8edc5f279a0abf45fab6b3fc5ce47eea00b22958efa04513095c86c42efe24c450f28d
- SSDEEP 6144:bkv89W2QcboLPlZvqEKvSlvgXCBVnTDg3GV06rPnek63AW1g3yEXq:bk09XelZvqEKv8gXCBlPHeByyEXq
- MD5 SHA1 SHA512 SSDEEP
-
MedusaLocker payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
131096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
crypt32
CryptStringToBinaryW
CryptBinaryToStringW
shlwapi
StrStrIW
PathFindExtensionW
PathIsUNCW
rstrtmgr
RmGetList
RmStartSession
RmRegisterResources
RmEndSession
RmShutdown
mpr
WNetGetConnectionW
WNetAddConnection2W
kernel32
GetLogicalDrives
FindFirstVolumeW
SetVolumeMountPointW
FindVolumeClose
GetVolumePathNamesForVolumeNameW
DeleteVolumeMountPointW
FindNextVolumeW
GetDriveTypeW
ReadFile
CloseThreadpool
CreateThreadpool
FindFirstFileExW
FindNextFileW
WriteFile
FindClose
CreateFileW
SetThreadpoolThreadMinimum
SetFileAttributesW
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
SetThreadpoolThreadMaximum
CreateThreadpoolCleanupGroup
SubmitThreadpoolWork
GetConsoleWindow
lstrcmpiW
SetConsoleTitleW
MoveFileW
GetWindowsDirectoryW
SizeofResource
GetCurrentProcess
AssignProcessToJobObject
InitializeProcThreadAttributeList
CreatePipe
PeekNamedPipe
WaitForSingleObject
OpenProcess
MultiByteToWideChar
UpdateProcThreadAttribute
LockResource
LoadResource
FindResourceW
CreateProcessW
GetModuleHandleW
WideCharToMultiByte
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
SetFilePointerEx
GetFileSizeEx
GetFileAttributesExW
GetExitCodeProcess
CloseHandle
GetLastError
CreateJobObjectW
SetInformationJobObject
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
DecodePointer
QueryDosDeviceW
CreateThreadpoolWork
LocalFree
FormatMessageA
GetLocaleInfoEx
RaiseException
WaitForSingleObjectEx
Sleep
GetCurrentThreadId
GetExitCodeThread
GetNativeSystemInfo
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CloseThreadpoolWork
GetModuleHandleExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetProcAddress
InitializeConditionVariable
WakeConditionVariable
QueryPerformanceCounter
QueryPerformanceFrequency
InitOnceComplete
InitOnceBeginInitialize
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockExclusive
InitializeSRWLock
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
TerminateProcess
RtlUnwind
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetFileType
CompareStringW
LCMapStringW
WriteConsoleW
user32
GetAsyncKeyState
RegisterWindowMessageW
IsWindowVisible
GetShellWindow
ShowWindow
GetWindowThreadProcessId
advapi32
CryptGenRandom
RegSetValueExW
OpenProcessToken
GetTokenInformation
CryptDestroyKey
CryptGetKeyParam
CryptAcquireContextW
CryptEncrypt
RegGetValueW
CryptExportKey
CryptImportKey
CryptGenKey
CryptReleaseContext
RegCloseKey
RegCreateKeyExW
shell32
SHEmptyRecycleBinW
Name
.text
Size
244KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=163, id=261, version=30795,
count=20, id=260, version=30795,
count=18, id=260, version=32420,
count=65, id=261, version=32420,
count=26, id=259, version=32420,
count=17, id=257, version=30795,
count=217, id=1, productName=Unmarked objects,
count=8, id=265, version=32532,
count=1, id=255, version=32532,
count=1, id=151,
count=1, id=258, version=32532,
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a
- IMPHASH eee47adb0ca923b6306684afa84004c3
- SHA256 97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a
- MD5 729871063d04ce837b6b65a57f4a2153
- SHA1 25f77150f1d34d19afcb8e7b543d52630dee2862
- SHA512 dc1869dd47e2d1cd55a71aa589f691066b2638954c3de34a86b14dac6f66e9c004dec02355dd060b3f4eae631166e9e93c2fd786a354168a10776b3508eab575
- SSDEEP 3072:7ZyQGq+qT2atob56RHAKsSCLLBvAd2xLD0oVuAAg0FujoHtUjVVFOq0rO:7vRLDWkRHAKsSiPAOotUbF8O
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
18842
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ReadFile
FindFirstFileA
WriteFile
FindNextFileA
FindClose
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EncodePointer
DecodePointer
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
GetLastError
FreeLibrary
LoadLibraryExW
RaiseException
RtlUnwind
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetACP
HeapAlloc
HeapReAlloc
HeapFree
DeleteFileW
GetFileType
GetConsoleCP
GetConsoleMode
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
FlushFileBuffers
SetFilePointerEx
CreateFileW
WriteConsoleW
HeapSize
SetEndOfFile
Name
.text
Size
132KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
1024B
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=157, id=243, version=40116,
count=29, id=242, version=40116,
count=22, id=259, version=24123,
count=57, id=261, version=24123,
count=34, id=260, version=24123,
count=3, id=203, version=65501,
count=99, id=1, productName=Unmarked objects,
count=2, id=265, version=24213,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3 build 24213, version=24213,
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572
- MD5 587163ebb29d37762be9b65b4553733a
- SHA1 1688aadda5db2d63fdd296edd65a8063db1a3eec
- SHA512 3222f727beb7e8b5d512355863bd0d280b7a6303a1a770345e9d48b48b4c8d37f10a78085ad1d82db265c3a97c2651856366975403aa8656c0127961208b589b
- SSDEEP 6144:vQfvuXwa/F2wHHG/BY1oDShdi6QgEOr26QD3T:OmX37H7hA6P26Mj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
571518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
550KB
Virtual Size
550KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273
- IMPHASH 297afa6dad8483724e2a0a247c5ec927
- SHA256 b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273
- MD5 4f88b5e510ecbd0adefdfc87c552289c
- SHA1 047ec67b8e3c001086284d7176b2d239db565fb5
- SHA512 75b86d6de4bec5285559f7e9a0dbf46df48dbdf78386023e5f8668a7814bc1db5322d8bf9d306cfd65175112b94366641d671175d59d3edacc3d2b2ba802f348
- SSDEEP 6144:X9PrHO8306KFnBCzDIZXY3HJmui45mkA2/1:drHBpgkDuoEuXbJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70577
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetConsoleOutputCP
WriteConsoleA
HeapSize
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
InitializeCriticalSection
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetHandleCount
GetModuleFileNameA
GetProcAddress
WriteFile
ExitProcess
HeapReAlloc
VirtualAlloc
DeleteCriticalSection
VirtualFree
WriteConsoleW
HeapDestroy
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
LocalFileTimeToFileTime
lstrcpyA
OpenFileMappingA
GetVersion
CloseHandle
OutputDebugStringA
CreateMutexA
lstrcatW
GetModuleHandleA
lstrcmpiA
GetLastError
lstrlenW
MultiByteToWideChar
GetTimeZoneInformation
TerminateProcess
SetTimeZoneInformation
CreateEventA
Sleep
LoadLibraryW
WideCharToMultiByte
OpenProcess
SetFileTime
GetProcessHeap
WaitForSingleObject
GetCurrentProcess
TlsGetValue
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
RtlUnwind
RaiseException
GetStartupInfoA
GetVersionExA
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
CreateDirectoryA
UnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetSystemInfo
GetNumberFormatW
GetFileType
HeapCreate
LoadLibraryA
SystemTimeToFileTime
HeapAlloc
FreeLibrary
MapViewOfFile
lstrlenA
GetStdHandle
CreateFileA
user32
OemKeyScan
GetDlgCtrlID
GetWindow
SetDlgItemTextW
LoadImageA
GetSystemMetrics
MessageBoxW
DispatchMessageA
RegisterRawInputDevices
IsWindow
AppendMenuA
SendMessageA
LoadCursorA
BeginPaint
wsprintfW
GetScrollRange
CreateMenu
WindowFromPoint
DlgDirSelectExA
GetSysColorBrush
LoadStringW
DlgDirListA
TranslateMessage
GetCursorPos
GetSysColor
GetDesktopWindow
DefWindowProcA
EndDialog
CreateWindowExA
GetClipboardData
GetWindowLongA
CharLowerA
LoadIconA
TrackPopupMenuEx
DefMDIChildProcA
EndPaint
GetMessageA
EnumDisplayMonitors
InsertMenuItemA
RegisterClassExA
FillRect
LoadStringA
GetFocus
LoadBitmapA
GetParent
LoadMenuA
SetCursorPos
gdi32
SetBkColor
CreateSolidBrush
GetObjectA
SetTextJustification
GetTextExtentPoint32A
SetWindowExtEx
SetTextColor
CreateDIBSection
TextOutA
GetRegionData
DeleteObject
SelectObject
advapi32
CryptAcquireContextW
CryptSetProvParam
CryptGetKeyParam
CryptGetUserKey
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
shell32
SHBrowseForFolderA
SHGetFolderPathW
SHGetFileInfoA
SHGetFileInfoW
ole32
CoUninitialize
BindMoniker
CoRegisterClassObject
CoInitializeEx
StgOpenStorage
CoCreateGuid
PropVariantClear
StringFromGUID2
CLSIDFromString
CreateFileMoniker
oleaut32
UnRegisterTypeLi
netapi32
NetShareGetInfo
psapi
GetModuleFileNameExA
avicap32
capGetDriverDescriptionA
winscard
SCardGetProviderIdW
SCardConnectA
SCardListCardsW
winmm
mmioAscend
waveInOpen
waveInPrepareHeader
waveInReset
crypt32
CertCreateCertificateContext
CertOpenStore
shlwapi
SHStrDupW
StrCmpNIA
StrCSpnA
ChrCmpIA
StrChrA
StrToIntExA
StrCmpIW
StrTrimA
comctl32
ImageList_Create
rpcrt4
RpcEpResolveBinding
gdiplus
GdipCloneImage
GdipLoadImageFromFile
GdipAlloc
GdipDisposeImage
GdipCreateBitmapFromFile
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSaveImageToFile
GdipFree
GdipCreateBitmapFromFileICM
GdipDeleteGraphics
imm32
ImmGetOpenStatus
ImmSetOpenStatus
ImmGetContext
ImmReleaseContext
winhttp
WinHttpOpen
WinHttpConnect
urlmon
CoInternetParseUrl
Name
.text
Size
144KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
152KB
Virtual Size
151KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=126, version=50327,
count=45, id=125, productName=VS2005 build 50727, version=50727,
count=136, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=53, id=110, productName=VS2005 build 50727, version=50727,
count=39, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=247, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552
- SHA256 b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552
- MD5 c2ed5b0eea4e4bf833e1a5549bde2024
- SHA1 5b24af2e9802b503c7f41c17b561b0b6b38914d7
- SHA512 0519a11af45ef901e0624e5b3f3ccdf5d3c8af7ca636304d8a1e8be6af607bf3df839b95381460342ca9fa25e8ac8c511be468b22c62e23c31322ad778bbf769
- SSDEEP 6144:5ji4E09S/t71Pnk0vlg6D59mkwxpCkiesHjAqk55e5BT:Ji4E09qLnrbt9mCeujAJ55e5BT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
314508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
303KB
Virtual Size
303KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
c697e2d009219bf9ef4a300f0d66273f3d1a3a92e66ed3c0b0fec50305e8e366
- IMPHASH 2deacc19769aa91cf861c87c8a49d016
- SHA256 c697e2d009219bf9ef4a300f0d66273f3d1a3a92e66ed3c0b0fec50305e8e366
- MD5 3b33b83347a37fbc5b466f4e8f43032a
- SHA1 29fb6213a1ed88c906644bd9a8885dbd962a9156
- SHA512 87618b4680e4e5ad7dcb21cd4ef091896174cb9661b730433818fca31c60c25f46e15b116e0b9a3e41f651c6ef022cce0182a2491a16ae90562138e0a821a5e4
- SSDEEP 6144:8KX3e4TjTOhFJxIvl4HuABNRglGL51gHayx:8KXuNhFJxI94HuABPUGt1g66
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
168007
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathFindFileNameW
psapi
EnumProcesses
GetProcessImageFileNameW
kernel32
GetCurrentProcess
GlobalLock
GetModuleHandleW
OpenProcess
LoadLibraryW
CopyFileW
GetVersionExW
TerminateProcess
GetModuleFileNameW
lstrlenW
GlobalUnlock
SetLastError
GetProcAddress
LocalAlloc
GetSystemInfo
lstrcatW
GetShortPathNameW
GetCurrentProcessId
LocalFree
lstrcpyW
CreateThread
GetTickCount
GlobalMemoryStatus
FreeLibrary
QueryPerformanceCounter
GetProcessHeap
SetEndOfFile
CreateFileA
GetLocaleInfoA
CreateProcessW
GetStringTypeW
GetStringTypeA
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapSize
SetStdHandle
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
RaiseException
MultiByteToWideChar
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
TlsFree
TlsSetValue
AllocConsole
CreateMutexW
GetEnvironmentVariableW
GetFullPathNameW
GetVolumeInformationW
DeleteFileW
FindNextFileW
FindClose
GlobalFree
GetLastError
ExitThread
GetModuleHandleA
ReadFile
Sleep
GlobalAlloc
GetSystemTimeAsFileTime
GetLogicalDriveStringsW
MoveFileExW
GetDriveTypeW
SetFilePointer
FindFirstFileW
GetFileSize
CloseHandle
GetLocalTime
FlushFileBuffers
CreateFileW
WriteFile
TlsAlloc
TlsGetValue
RtlUnwind
GetModuleFileNameA
GetStdHandle
VirtualAlloc
DeleteCriticalSection
VirtualFree
HeapCreate
GetStartupInfoW
ExitProcess
LeaveCriticalSection
EnterCriticalSection
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapReAlloc
HeapAlloc
HeapFree
user32
GetSystemMetrics
UpdateWindow
DefWindowProcW
DispatchMessageW
PostMessageW
SetClipboardData
SendMessageW
EnableWindow
EndPaint
DestroyWindow
SetCursor
CloseClipboard
GetSystemMenu
SetTimer
GetWindowRect
GetMessageW
PostQuitMessage
FillRect
DrawTextW
DrawTextA
DialogBoxIndirectParamW
DrawIconEx
LoadCursorW
CreateIconFromResourceEx
GetClientRect
BeginPaint
PtInRect
GetDC
TranslateMessage
RegisterClassExW
GetWindowTextA
MessageBoxA
LookupIconIdFromDirectoryEx
SystemParametersInfoW
CreateWindowExA
ReleaseDC
EnableMenuItem
EmptyClipboard
EndDialog
SetWindowPos
ShowWindow
CreateWindowExW
OpenClipboard
gdi32
SetTextColor
DeleteDC
GetDIBits
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetStockObject
CreateSolidBrush
advapi32
AdjustTokenPrivileges
CheckTokenMembership
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueA
GetTokenInformation
GetSidSubAuthority
OpenProcessToken
RegSetValueExW
RegCloseKey
RegFlushKey
RegQueryValueExW
RegCreateKeyExW
shell32
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteExW
ShellExecuteA
ShellExecuteW
ole32
CoInitializeEx
CoCreateInstance
mpr
WNetEnumResourceW
WNetCloseEnum
WNetOpenEnumW
wininet
InternetOpenUrlW
InternetOpenA
InternetSetCookieW
InternetOpenW
InternetConnectA
InternetCloseHandle
InternetReadFile
HttpOpenRequestA
HttpSendRequestA
Name
.text
Size
229KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
27KB
Virtual Size
700KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=53, id=132, productName=VS2008 build 21022, version=21022,
count=25, id=149, productName=VS2008 build 21022, version=21022,
count=155, id=131, productName=VS2008 build 21022, version=21022,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=218, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=52, id=137, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
cd7542f2d7f2285ab524a57bc04ae1ad9306a15b9efbf56ea7b002d99d4b974f
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cd7542f2d7f2285ab524a57bc04ae1ad9306a15b9efbf56ea7b002d99d4b974f
- MD5 60ab964a4ddf67b84682638970e77764
- SHA1 16ccd53d8fb205bbad4f367e93448853be6520b8
- SHA512 62530c993c8f45ce8ca20d23396ec3ad5a17fcd96b6c8258a44e9e0f20fe7bd14401e28e00e3fb57fface0f2d894f43df6ae5ea88f9781e5f22ecb5e6490c1f5
- SSDEEP 3072:IqC7Q+F9LeowP0XX4wXXXXX4XBXXXXXXXXXXXbUYUYUUYYUYUYUYUYUYUUYUYUNe:bC7Q+FYoA03duZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
223502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
210KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
154B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
d6dcee050e7c2accacbfd4de5bbcd2423c970a1437fc6360084c1b3e492315fe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d6dcee050e7c2accacbfd4de5bbcd2423c970a1437fc6360084c1b3e492315fe
- MD5 dedbbcd854e939a54927163a83dafab2
- SHA1 370da3336f97aeb8fdd0bd996c1457903f3ab001
- SHA512 45e808db9c29521bdeef8feafc0ecf3a3f8dbe38d9330676d36963ee1375681e5bc35b3824946f85e04bc1278747751293624a8203f719123a0e8c892f7986a8
- SSDEEP 6144:aI+MKeoURwjxWbbM/JnoI4/B9Wnnphdgbt+:aI+MKrURwlj/JnonEphdr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
621674
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
599KB
Virtual Size
599KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ded5fa93032fa254d49532adab59a7695b352e9a31cafdbc72bde05f5d338b32
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ded5fa93032fa254d49532adab59a7695b352e9a31cafdbc72bde05f5d338b32
- MD5 b10033b91ab6d47547871dfe361272bb
- SHA1 74766f524242b799626825d7737525043eb18379
- SHA512 2dfb55727684d04836b8d04f1b9c7a0dfe1001bf3651e6c1862e0674c132746675521d2b433dd14c9ad44d4da09c6393dbbc367a84f2c7c4977d9f1f44f9b542
- SSDEEP 3072:V4og8uonoyrR/2OAFjvQweJLNK7MeG9sYxyFhClU6VtoD+aqrSlu+uQYBIaEn5bX:+KZReO0ZesMeSr+D+fOvuQ+Z2b
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
223918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
211KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e49e4b815789001951a3798b46898751023974347d8a468a39b2ccbff70282dd
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e49e4b815789001951a3798b46898751023974347d8a468a39b2ccbff70282dd
- MD5 94bfddd0a70e4ca3939b1350d6acc71c
- SHA1 97dad19eaeb8d8d85de8eb2ff878c580d7d106f2
- SHA512 c5467e0423c9dfa7126222b3213c6ea5b59ee9c66105f6cd8894d408c0c0eb1efc72f6f3263454724e5fb54c8fc748ffb5676ddb85cc5941c8af63f483890d42
- SSDEEP 3072:lGzbDSs7bU1NByFMuIBRC0eXLfQzueFsB0yxfWolUJFMXNsz5SkE+pbt8ICjGP:lGzbxOBRmXLP0yJAJFMXNXyC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
193214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
181KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f70521a197291008e7a691566c9d20c6883f1b2199cd4b6be1fbbe61ccda4dc3
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f70521a197291008e7a691566c9d20c6883f1b2199cd4b6be1fbbe61ccda4dc3
- MD5 859fe9dc1478333916c9a94253f93dd2
- SHA1 8a749f88ca6de9621853c9b1de6e5a097493d51c
- SHA512 1b3240cb69816a8d715a519086a8ed28a371e2c40b9b516ea574eb2d132cb1d335c3eaf0807725df09a5651a589869c98c199c0fa640fa1165742ee6a36795b9
- SSDEEP 3072:gcjUEx7tVtLPYNLtdIzM/4iy0eMIwTw1ZSMYQcM+lmsolAIrRuw+mqv9j1MWLQM:Tjrx5VtLPCLtv2gTSSXu+lDAA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
110654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
fce17dd710a05778968a73283e95bb1eb7749c7c5e701c63882082942409522c
- IMPHASH d8060c68008f0305dc0d473775902c2c
- SHA256 fce17dd710a05778968a73283e95bb1eb7749c7c5e701c63882082942409522c
- MD5 ef6cc564bde88b7dc47968c694d5ce50
- SHA1 d552cdf119f268a13b9d814af3b05eb41445b559
- SHA512 c33805e8b6b60fa484ef44af9f1cf9548355789fad1ef4c9b00fd2c9f0b8b55e0ec95613508ef6b509eb86b49614764177105f98a93d269dfea755f1e0c4041f
- SSDEEP 12288:xtHzWJx8kOxpq7ItcCoBmuyEc6dBCs0cF+VA00Avqa31k6269UTm+6b:3HzWJxyektBE53PRepFCm+G
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
10000
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCommState
ReadConsoleA
InterlockedDecrement
SetConsoleActiveScreenBuffer
CreateJobObjectW
ConnectNamedPipe
CallNamedPipeW
SetTapeParameters
LocalFlags
SetProcessPriorityBoost
LoadLibraryW
TerminateThread
lstrcatA
GetBinaryTypeW
lstrlenW
FindNextVolumeMountPointW
RaiseException
SetCurrentDirectoryA
GetStdHandle
FreeLibraryAndExitThread
SetEndOfFile
SetLastError
GetProcAddress
CopyFileA
EnterCriticalSection
GetLocalTime
LocalAlloc
BuildCommDCBAndTimeoutsW
IsSystemResumeAutomatic
FindAtomA
GetPrivateProfileStructA
GetTapeParameters
WaitForMultipleObjects
SetEnvironmentVariableA
GetOEMCP
CreateMutexA
EnumResourceNamesA
GetCurrentDirectoryA
OpenSemaphoreW
GetProfileSectionW
lstrcpyW
AreFileApisANSI
SetPriorityClass
GetLastError
MoveFileA
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
RtlUnwind
HeapFree
DeleteCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetCPInfo
GetACP
IsValidCodePage
GetModuleHandleA
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
advapi32
SetThreadToken
RevertToSelf
winhttp
WinHttpCloseHandle
_asdga@4
_weewgg@8
_wsefwrgwrg@4
_ydtiuiei7@8
Name
.text
Size
631KB
Virtual Size
631KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=21, id=149, productName=VS2008 build 21022, version=21022,
count=101, id=131, productName=VS2008 build 21022, version=21022,
count=39, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=121, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
ffc5e46200f16549f17d2d6e4d6e5e61239b711cd07fbf7932c31e2ea18a7865
- SHA256 ffc5e46200f16549f17d2d6e4d6e5e61239b711cd07fbf7932c31e2ea18a7865
- MD5 b3a17f4ec0e5ea0f406884c69afdd676
- SHA1 fe61098c0e444ac0e20bc70de3d1014ff3b49029
- SHA512 c84f7028d9363f31876ceb31163d6f458ff573e2fb2a6bd03718b9bdab3c3430462e7794d46a461cbea6560a116d7959b51217ac11059fabf2028897bd9ed097
- SSDEEP 6144:5ji4E09S/t71Pnk0vlg6D59mkwxpCkiesHjAqkF5e5BT:Ji4E09qLnrbt9mCeujAJF5e5BT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
314508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
303KB
Virtual Size
303KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ