4870fcdc704d7a16493b5c978db8f9b132daa360cb6cb97ae0f439e45a161e70

Sharing

Copy URL Twitter E-mail

General

Target

4870fcdc704d7a16493b5c978db8f9b132daa360cb6cb97ae0f439e45a161e70
Size

924KB
MD5

f07742ba4f885cd8586c00c42d390ded
SHA1

a82223824e000f59f1c8870398b9bce7bca109a9
SHA256

4870fcdc704d7a16493b5c978db8f9b132daa360cb6cb97ae0f439e45a161e70
SHA512

f794cc9573cd893096940949440519978c4c709f39d847a71f4a0adcc9687a007505cf53617c610b526642cc095c448f5c2a4d78d47688dc9fb60ee72a7fa90f
SSDEEP

24576:SNgV2eISrgJlA9uMGlbgfblxpC6mzSqBH2AG0vSowIAZKWda:kNeISZ9uMcWbo6mpF2AG6anMSa

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/pecompact_/pecompact_/pecompact/RL!dePeCompact.exe
unpack001/pecompact_/pecompact_/pecompact/TitanEngine.dll

Files

4870fcdc704d7a16493b5c978db8f9b132daa360cb6cb97ae0f439e45a161e70
.zip
pecompact_/Readme-ZOL.htm
pecompact_/pecompact_/pecompact/RL!dePeCompact.exe
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pecompact_/pecompact_/pecompact/TitanEngine.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

AddNewSection
AddNewSectionEx
AddNewSectionExW
AddNewSectionW
AddOverlay
AddOverlayW
AttachDebugger
AutoDebugEx
AutoDebugExW
ClearExceptionNumber
ConvertFileOffsetToVA
ConvertFileOffsetToVAEx
ConvertVAtoFileOffset
ConvertVAtoFileOffsetEx
CopyOverlay
CopyOverlayW
CurrentExceptionNumber
DebugLoop
DebugLoopEx
DeleteAPIBreakPoint
DeleteBPX
DeleteHardwareBreakPoint
DeleteLastSection
DeleteLastSectionEx
DeleteLastSectionExW
DeleteLastSectionW
DetachDebugger
DetachDebuggerEx
DisableBPX
Disassemble
DisassembleEx
DumpMemory
DumpMemoryEx
DumpMemoryExW
DumpMemoryW
DumpModule
DumpModuleEx
DumpModuleExW
DumpModuleW
DumpProcess
DumpProcessEx
DumpProcessExW
DumpProcessW
DumpRegions
DumpRegionsEx
DumpRegionsExW
DumpRegionsW
EnableBPX
EngineAddUnpackerWindowLogMessage
EngineCreateMissingDependencies
EngineCreateMissingDependenciesW
EngineCreateUnpackerWindow
EngineDeleteCreatedDependencies
EngineFakeMissingDependencies
EngineUnpackerFinalizeUnpacking
EngineUnpackerInitialize
EngineUnpackerInitializeW
EngineUnpackerSetBreakCondition
EngineUnpackerSetEntryPointAddress
EnumProcessesWithLibrary
ExporterAddNewExport
ExporterAddNewOrdinalExport
ExporterBuildExportTable
ExporterBuildExportTableEx
ExporterBuildExportTableExW
ExporterCleanup
ExporterEstimatedSize
ExporterGetAddedExportCount
ExporterInit
ExporterLoadExportTable
ExporterLoadExportTableW
ExporterSetImageBase
ExtensionManagerDisableAllPlugins
ExtensionManagerDisablePlugin
ExtensionManagerEnableAllPlugins
ExtensionManagerEnablePlugin
ExtensionManagerGetPluginInfo
ExtensionManagerIsPluginEnabled
ExtensionManagerIsPluginLoaded
ExtensionManagerUnloadAllPlugins
ExtensionManagerUnloadPlugin
ExtractOverlay
ExtractOverlayW
ExtractSection
ExtractSectionW
Fill
FillEx
Find
FindEx
FindOEPGenerically
FindOEPGenericallyW
FindOEPInit
FindOverlay
FindOverlayW
FixBrokenPE32FileEx
FixBrokenPE32FileExW
FixHeaderCheckSum
FixHeaderCheckSumW
ForceClose
GetActiveProcessId
GetActiveProcessIdW
GetContextData
GetContextDataEx
GetContextFPUDataEx
GetDebugData
GetDebuggedDLLBaseAddress
GetDebuggedFileBaseAddress
GetExitCode
GetFunctionParameter
GetJumpDestination
GetJumpDestinationEx
GetPE32Data
GetPE32DataEx
GetPE32DataExW
GetPE32DataFromMappedFile
GetPE32DataFromMappedFileEx
GetPE32DataW
GetPE32SectionNumberFromVA
GetPEBLocation
GetProcessInformation
GetRemoteString
GetSharedOverlay
GetSharedOverlayW
GetStartupInformation
GetTerminationData
GetUnusedHardwareBreakPointRegister
HandlerCloseAllLockHandles
HandlerCloseAllLockHandlesW
HandlerCloseRemoteHandle
HandlerEnumerateLockHandles
HandlerEnumerateLockHandlesW
HandlerEnumerateOpenHandles
HandlerEnumerateOpenMutexes
HandlerGetActiveHandleCount
HandlerGetHandleDetails
HandlerGetHandleName
HandlerGetHandleNameW
HandlerGetOpenMutexHandle
HandlerGetOpenMutexHandleW
HandlerGetProcessIdWhichCreatedMutex
HandlerGetProcessIdWhichCreatedMutexW
HandlerIsFileLocked
HandlerIsFileLockedW
HandlerIsHandleOpen
HashTracerLevel1
HideDebugger
HooksDisableIATRedirection
HooksDisableRedirection
HooksDisableRedirectionsForModule
HooksEnableIATRedirection
HooksEnableRedirection
HooksEnableRedirectionsForModule
HooksGetHookEntryDetails
HooksGetTrampolineAddress
HooksInsertNewIATRedirection
HooksInsertNewIATRedirectionEx
HooksInsertNewRedirection
HooksIsAddressRedirected
HooksRemoveIATRedirection
HooksRemoveRedirection
HooksRemoveRedirectionsForModule
HooksSafeTransition
HooksSafeTransitionEx
HooksScanEntireProcessMemory
HooksScanEntireProcessMemoryEx
HooksScanModuleMemory
ImporterAddNewAPI
ImporterAddNewDll
ImporterAddNewOrdinalAPI
ImporterAutoFixIAT
ImporterAutoFixIATEx
ImporterAutoFixIATExW
ImporterAutoFixIATW
ImporterAutoSearchIAT
ImporterAutoSearchIATEx
ImporterAutoSearchIATW
ImporterCleanup
ImporterCopyOriginalIAT
ImporterCopyOriginalIATW
ImporterEnumAddedData
ImporterEstimatedSize
ImporterExportIAT
ImporterExportIATEx
ImporterExportIATExW
ImporterFindAPIByWriteLocation
ImporterFindAPIWriteLocation
ImporterFindDLLByWriteLocation
ImporterFindOrdinalAPIWriteLocation
ImporterGetAPIName
ImporterGetAPINameEx
ImporterGetAPINameFromDebugee
ImporterGetAPIOrdinalNumber
ImporterGetAPIOrdinalNumberFromDebugee
ImporterGetAddedAPICount
ImporterGetAddedDllCount
ImporterGetCurrentDelta
ImporterGetDLLIndex
ImporterGetDLLIndexEx
ImporterGetDLLName
ImporterGetDLLNameFromDebugee
ImporterGetForwardedAPIName
ImporterGetForwardedAPIOrdinalNumber
ImporterGetForwardedDLLIndex
ImporterGetForwardedDLLName
ImporterGetLastAddedDLLName
ImporterGetLocalAPIAddress
ImporterGetNearestAPIAddress
ImporterGetNearestAPIName
ImporterGetRemoteAPIAddress
ImporterGetRemoteAPIAddressEx
ImporterGetRemoteDLLBase
ImporterGetRemoteDLLBaseEx
ImporterInit
ImporterIsForwardedAPI
ImporterLoadImportTable
ImporterLoadImportTableW
ImporterMoveIAT
ImporterMoveOriginalIAT
ImporterMoveOriginalIATW
ImporterRelocateWriteLocation
ImporterSetImageBase
ImporterSetUnknownDelta
InitDLLDebug
InitDLLDebugW
InitDebug
InitDebugEx
InitDebugExW
InitDebugW
IsBPXEnabled
IsFileBeingDebugged
IsFileDLL
IsFileDLLW
IsJumpGoingToExecute
IsJumpGoingToExecuteEx
IsPE32FileValidEx
IsPE32FileValidExW
LengthDisassemble
LengthDisassembleEx
LibrarianEnumLibraryInfo
LibrarianEnumLibraryInfoW
LibrarianGetLibraryInfo
LibrarianGetLibraryInfoEx
LibrarianGetLibraryInfoExW
LibrarianGetLibraryInfoW
LibrarianRemoveBreakPoint
LibrarianSetBreakPoint
MakeAllSectionsRWE
MakeAllSectionsRWEW
MatchPattern
MatchPatternEx
PastePEHeader
PastePEHeaderW
Patch
PatchEx
RealignPE
RealignPEEx
RealignPEExW
RelocaterAddNewRelocation
RelocaterChangeFileBase
RelocaterChangeFileBaseW
RelocaterCleanup
RelocaterCompareTwoSnapshots
RelocaterCompareTwoSnapshotsW
RelocaterEstimatedSize
RelocaterExportRelocation
RelocaterExportRelocationEx
RelocaterExportRelocationExW
RelocaterGrabRelocationTable
RelocaterGrabRelocationTableEx
RelocaterInit
RelocaterMakeSnapshot
RelocaterMakeSnapshotW
RelocaterRelocateMemoryBlock
RelocaterWipeRelocationTable
RelocaterWipeRelocationTableW
RemoteExitProcess
RemoteFreeLibrary
RemoteFreeLibraryW
RemoteLoadLibrary
RemoteLoadLibraryW
RemoveAllBreakPoints
RemoveMemoryBPX
RemoveOverlay
RemoveOverlayW
Replace
ReplaceEx
ResizeLastSection
ResizeLastSectionW
ResortFileSections
ResortFileSectionsW
ResourcerEnumerateResource
ResourcerEnumerateResourceEx
ResourcerEnumerateResourceW
ResourcerExtractResourceFromFile
ResourcerExtractResourceFromFileEx
ResourcerExtractResourceFromFileW
ResourcerFindResource
ResourcerFindResourceEx
ResourcerFindResourceW
ResourcerFreeLoadedFile
ResourcerLoadFileForResourceUse
ResourcerLoadFileForResourceUseW
SafeDeleteAPIBreakPoint
SafeDeleteBPX
SetAPIBreakPoint
SetBPX
SetBPXEx
SetBPXOptions
SetContextData
SetContextDataEx
SetContextFPUDataEx
SetCustomHandler
SetDebugLoopTimeOut
SetEngineVariable
SetErrorModel
SetHardwareBreakPoint
SetHardwareBreakPointEx
SetMemoryBPX
SetMemoryBPXEx
SetNextDbgContinueStatus
SetPE32Data
SetPE32DataEx
SetPE32DataExW
SetPE32DataForMappedFile
SetPE32DataForMappedFileEx
SetPE32DataW
SetSharedOverlay
SetSharedOverlayW
SingleStep
StaticDisassemble
StaticDisassembleEx
StaticFileClose
StaticFileGetContent
StaticFileLoad
StaticFileLoadW
StaticFileOpen
StaticFileOpenW
StaticFileUnload
StaticFileUnloadW
StaticHashFile
StaticHashFileW
StaticHashMemory
StaticLengthDisassemble
StaticMemoryDecompress
StaticMemoryDecrypt
StaticMemoryDecryptEx
StaticMemoryDecryptSpecial
StaticRawMemoryCopy
StaticRawMemoryCopyEx
StaticRawMemoryCopyEx64
StaticRawMemoryCopyEx64W
StaticRawMemoryCopyExW
StaticRawMemoryCopyW
StaticSectionDecrypt
StepInto
StepOver
StopDebug
TLSBackupData
TLSBackupDataW
TLSBreakOnCallBack
TLSBreakOnCallBackEx
TLSBreakOnCallBackExW
TLSBuildNewTable
TLSBuildNewTableEx
TLSBuildNewTableExW
TLSGrabCallBackData
TLSGrabCallBackDataW
TLSRemoveCallback
TLSRemoveCallbackW
TLSRemoveTable
TLSRemoveTableW
TLSRestoreData
ThreaderCreateRemoteThread
ThreaderCreateRemoteThreadEx
ThreaderEnumThreadInfo
ThreaderExecuteOnlyInjectedThreads
ThreaderGetOpenHandleForThread
ThreaderGetThreadData
ThreaderGetThreadInfo
ThreaderImportRunningThreadData
ThreaderInjectAndExecuteCode
ThreaderInjectAndExecuteCodeEx
ThreaderIsAnyThreadActive
ThreaderIsExceptionInMainThread
ThreaderIsThreadActive
ThreaderIsThreadStillRunning
ThreaderPauseAllThreads
ThreaderPauseProcess
ThreaderPauseThread
ThreaderResumeAllThreads
ThreaderResumeProcess
ThreaderResumeThread
ThreaderSetCallBackForNextExitThreadEvent
ThreaderTerminateThread
TracerDetectRedirection
TracerFixKnownRedirection
TracerFixRedirectionViaImpRecPlugin
TracerInit
TracerLevel1
TranslateNativeName
TranslateNativeNameW
UnHideDebugger
WipeSection
WipeSectionW
distorm_decode64
distorm_version

Sections

.text
Size: 320KB - Virtual size: 319KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 461KB - Virtual size: 461KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pecompact_/pecompact_/pecompact/msvcr100d.dll
.dll windows:5 windows x86 arch:x86

0dc7b0e0b0a7b26ca080f7c56e8c0b34

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ed:95:51:94:90:d4:5b:66:67:ce:1b:3d:80:0f:22:cc:dd:98:c9:7b
Signer

Actual PE Digest

ed:95:51:94:90:d4:5b:66:67:ce:1b:3d:80:0f:22:cc:dd:98:c9:7b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msvcr100d.i386.pdb

Imports

kernel32

EncodePointer
DecodePointer
RaiseException
GetModuleFileNameA
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetCurrentThreadId
TlsGetValue
GetCommandLineW
GetCommandLineA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ResumeThread
GetLastError
CreateThread
ExitThread
CloseHandle
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
FindNextFileA
FindFirstFileExA
FindClose
FindNextFileW
FindFirstFileExW
GetLogicalDrives
GetDiskFreeSpaceA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetErrorMode
Sleep
Beep
GetFileAttributesA
SetFileAttributesA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFullPathNameA
GetDriveTypeW
GetCurrentProcessId
CreateDirectoryA
MoveFileA
RemoveDirectoryA
GetDriveTypeA
DeleteFileA
GetFileAttributesW
SetEnvironmentVariableW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
MoveFileW
RemoveDirectoryW
DeleteFileW
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
LoadLibraryA
FreeLibrary
CreateProcessW
ReadFile
DuplicateHandle
GetCurrentProcess
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetLocalTime
WideCharToMultiByte
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetLocalTime
InterlockedPopEntrySList
InterlockedFlushSList
InterlockedPushEntrySList
QueryDepthSList
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateEventW
SetEvent
SwitchToThread
SignalObjectAndWait
TryEnterCriticalSection
GetProcessAffinityMask
SetThreadAffinityMask
VirtualAlloc
SetThreadPriority
GetVersionExW
GetSystemInfo
GetTickCount
VirtualProtect
VirtualFree
InitializeSListHead
CreateSemaphoreW
WaitForMultipleObjects
ReleaseSemaphore
GetThreadPriority
LoadLibraryW
SleepEx
OutputDebugStringW
DebugBreak
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
MultiByteToWideChar
GetStringTypeW
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
GetTimeFormatA
GetDateFormatA
GetTimeFormatW
GetDateFormatW
RtlUnwind
HeapCreate
HeapDestroy
HeapFree
HeapValidate
HeapCompact
HeapWalk
HeapAlloc
VirtualQuery
SetHandleCount
GetFileType
GetStartupInfoW
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
CreateFileW
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CreatePipe
SetStdHandle
ReadConsoleInputA
SetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
WriteConsoleW
ReadConsoleW
SetEndOfFile
GetProcessHeap
InterlockedExchange
LockFile
UnlockFile
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsBadReadPtr
SetConsoleCtrlHandler
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
OutputDebugStringA
LCMapStringW
CompareStringW
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsProcessorFeaturePresent
HeapReAlloc
HeapSize
HeapQueryInformation

Exports

Exports

$I10_OUTPUT
??0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
??0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
??0SchedulerPolicy@Concurrency@@QAA@IZZ
??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z
??0SchedulerPolicy@Concurrency@@QAE@XZ
??0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_ReaderWriterLock@details@Concurrency@@QAE@XZ
??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_ReentrantLock@details@Concurrency@@QAE@XZ
??0_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_SpinLock@details@Concurrency@@QAE@ACJ@Z
??0_TaskCollection@details@Concurrency@@QAE@XZ
??0_Timer@details@Concurrency@@IAE@I_N@Z
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0__non_rtti_object@std@@QAE@PBD@Z
??0bad_cast@std@@AAE@PBQBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@XZ
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@XZ
??0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z
??0context_unblock_unbalanced@Concurrency@@QAE@XZ
??0critical_section@Concurrency@@QAE@XZ
??0default_scheduler_exists@Concurrency@@QAE@PBD@Z
??0default_scheduler_exists@Concurrency@@QAE@XZ
??0event@Concurrency@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??0improper_lock@Concurrency@@QAE@PBD@Z
??0improper_lock@Concurrency@@QAE@XZ
??0improper_scheduler_attach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_attach@Concurrency@@QAE@XZ
??0improper_scheduler_detach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_detach@Concurrency@@QAE@XZ
??0improper_scheduler_reference@Concurrency@@QAE@PBD@Z
??0improper_scheduler_reference@Concurrency@@QAE@XZ
??0invalid_link_target@Concurrency@@QAE@PBD@Z
??0invalid_link_target@Concurrency@@QAE@XZ
??0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z
??0invalid_multiple_scheduling@Concurrency@@QAE@XZ
??0invalid_operation@Concurrency@@QAE@PBD@Z
??0invalid_operation@Concurrency@@QAE@XZ
??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z
??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_value@Concurrency@@QAE@XZ
??0message_not_found@Concurrency@@QAE@PBD@Z
??0message_not_found@Concurrency@@QAE@XZ
??0missing_wait@Concurrency@@QAE@PBD@Z
??0missing_wait@Concurrency@@QAE@XZ
??0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z
??0nested_scheduler_missing_detach@Concurrency@@QAE@XZ
??0operation_timed_out@Concurrency@@QAE@PBD@Z
??0operation_timed_out@Concurrency@@QAE@XZ
??0reader_writer_lock@Concurrency@@QAE@XZ
??0scheduler_not_attached@Concurrency@@QAE@PBD@Z
??0scheduler_not_attached@Concurrency@@QAE@XZ
??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z
??0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z
??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z
??0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0task_canceled@details@Concurrency@@QAE@PBD@Z
??0task_canceled@details@Concurrency@@QAE@XZ
??0unsupported_os@Concurrency@@QAE@PBD@Z
??0unsupported_os@Concurrency@@QAE@XZ
??1SchedulerPolicy@Concurrency@@QAE@XZ
??1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_SpinLock@details@Concurrency@@QAE@XZ
??1_TaskCollection@details@Concurrency@@QAE@XZ
??1_Timer@details@Concurrency@@IAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1critical_section@Concurrency@@QAE@XZ
??1event@Concurrency@@QAE@XZ
??1exception@std@@UAE@XZ
??1reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock@critical_section@Concurrency@@QAE@XZ
??1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z
??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z
??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@@6B@
??_7exception@std@@6B@
??_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ
??_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?Alloc@Concurrency@@YAPAXI@Z
?Block@Context@Concurrency@@SAXXZ
?Create@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?Create@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z
?CreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ
?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ
?CurrentContext@Context@Concurrency@@SAPAV12@XZ
?Detach@CurrentScheduler@Concurrency@@SAXXZ
?DisableTracing@Concurrency@@YAJXZ
?EnableTracing@Concurrency@@YAJXZ
?Free@Concurrency@@YAXPAX@Z
?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ
?GetExecutionContextId@Concurrency@@YAIXZ
?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ
?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ
?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ
?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z
?GetProcessorCount@Concurrency@@YAIXZ
?GetProcessorNodeCount@Concurrency@@YAIXZ
?GetSchedulerId@Concurrency@@YAIXZ
?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ
?Id@Context@Concurrency@@SAIXZ
?Id@CurrentScheduler@Concurrency@@SAIXZ
?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ
?Log2@details@Concurrency@@YAKI@Z
?Oversubscribe@Context@Concurrency@@SAX_N@Z
?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z
?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ
?ScheduleGroupId@Context@Concurrency@@SAIXZ
?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z
?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z
?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z
?VirtualProcessorId@Context@Concurrency@@SAIXZ
?Yield@Context@Concurrency@@SAXXZ
?_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ
?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ
?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ
?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ
?_ConcRT_Assert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_DumpMessage@details@Concurrency@@YAXPB_WZZ
?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ
?_Copy_str@exception@std@@AAEXPBD@Z
?_CrtDbgReportW@@YAHHPBGH00ZZ
?_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ
?_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ
?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ
?_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ
?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z
?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z
?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ
?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ
?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ
?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ
?_SpinYield@Context@Concurrency@@SAXXZ
?_Start@_Timer@details@Concurrency@@IAEXXZ
?_Stop@_Timer@details@Concurrency@@IAEXXZ
?_Tidy@exception@std@@AAEXXZ
?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z
?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ
?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_UnderlyingYield@details@Concurrency@@YAXXZ
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_Value@_SpinCount@details@Concurrency@@SAIXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCompare@@YA_NPBX0@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZH@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBEHABV1@@Z
?commonFlags@?1??_control87@@9@9
?get_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ
?lock@critical_section@Concurrency@@QAEXXZ
?lock@reader_writer_lock@Concurrency@@QAEXXZ
?lock_read@reader_writer_lock@Concurrency@@QAEXXZ
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?native_handle@critical_section@Concurrency@@QAEAAV12@XZ
?raw_name@type_info@@QBEPBDXZ
?reset@event@Concurrency@@QAEXXZ
?set@event@Concurrency@@QAEXXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?try_lock@critical_section@Concurrency@@QAE_NXZ
?try_lock@reader_writer_lock@Concurrency@@QAE_NXZ
?try_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ
?unexpected@@YAXXZ
?unlock@critical_section@Concurrency@@QAEXXZ
?unlock@reader_writer_lock@Concurrency@@QAEXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?wait@Concurrency@@YAXI@Z
?wait@event@Concurrency@@QAEII@Z
?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z
?what@exception@std@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_CreateFrameInfo
_CrtCheckMemory
_CrtDbgBreak
_CrtDbgReport
_CrtDbgReportW
_CrtDoForAllClientObjects
_CrtDumpMemoryLeaks
_CrtGetAllocHook
_CrtGetCheckCount
_CrtGetDumpClient
_CrtGetReportHook
_CrtIsMemoryBlock
_CrtIsValidHeapPointer
_CrtIsValidPointer
_CrtMemCheckpoint
_CrtMemDifference
_CrtMemDumpAllObjectsSince
_CrtMemDumpStatistics
_CrtReportBlockType
_CrtSetAllocHook
_CrtSetBreakAlloc
_CrtSetCheckCount
_CrtSetDbgBlockType
_CrtSetDbgFlag
_CrtSetDebugFillThreshold
_CrtSetDumpClient
_CrtSetReportFile
_CrtSetReportHook
_CrtSetReportHook2
_CrtSetReportHookW2
_CrtSetReportMode
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_Strftime
_VCrtDbgReportA
_VCrtDbgReportW
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindStdDelDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___fls_getvalue@4
___fls_setvalue@8
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__commode
__p__crtAssertBusy
__p__crtBreakAlloc
__p__crtDbgFlag
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__set_flsgetvalue
__setlc_active
__setusermatherr
__strncnt
__swprintf_l
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__unDNameHelper
__uncaught_exception
__unguarded_readlc_active
__vswprintf_l
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_aligned_free
_aligned_free_dbg
_aligned_malloc
_aligned_malloc_dbg
_aligned_msize
_aligned_msize_dbg
_aligned_offset_malloc
_aligned_offset_malloc_dbg
_aligned_offset_realloc
_aligned_offset_realloc_dbg
_aligned_offset_recalloc
_aligned_offset_recalloc_dbg
_aligned_realloc
_aligned_realloc_dbg
_aligned_recalloc
_aligned_recalloc_dbg
_amsg_exit
_assert

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.textbss Size: - Virtual size: 64KB

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 247KB - Virtual size: 247KB

.reloc Size: 2KB - Virtual size: 2KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 320KB - Virtual size: 319KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 34KB - Virtual size: 142KB

.rsrc Size: 461KB - Virtual size: 461KB

.reloc Size: 23KB - Virtual size: 23KB

0dc7b0e0b0a7b26ca080f7c56e8c0b34

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:06:27:81:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

ed:95:51:94:90:d4:5b:66:67:ce:1b:3d:80:0f:22:cc:dd:98:c9:7bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.data Size: 13KB - Virtual size: 23KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 48KB - Virtual size: 48KB

.textbss
Size: - Virtual size: 64KB

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 247KB - Virtual size: 247KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 320KB - Virtual size: 319KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 34KB - Virtual size: 142KB

.rsrc
Size: 461KB - Virtual size: 461KB

.reloc
Size: 23KB - Virtual size: 23KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

ed:95:51:94:90:d4:5b:66:67:ce:1b:3d:80:0f:22:cc:dd:98:c9:7b
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 13KB - Virtual size: 23KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 48KB - Virtual size: 48KB