possible_irt_8base-16940971753.zip
- SHA256 8dcd2cfd4c38ceb5e80e08e17c50bcca2232b33c2e78112545b2ede73cb5b8e3
Password
infected
Overview
overview
10Static
static
32288a0c896...fb.exe
windows7-x64
102288a0c896...fb.exe
windows10-2004-x64
10518544e56e...9c.exe
windows7-x64
10518544e56e...9c.exe
windows10-2004-x64
10a31a45f1c6...a5.exe
windows7-x64
10a31a45f1c6...a5.exe
windows10-2004-x64
10b4b8982838...53.exe
windows7-x64
10b4b8982838...53.exe
windows10-2004-x64
10Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe
Resource
win7-20240215-en
windows7-x64
19 signatures
300 seconds
Behavioral task
behavioral2
Sample
2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
22 signatures
300 seconds
Behavioral task
behavioral3
Sample
518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c.exe
Resource
win7-20240221-en
windows7-x64
19 signatures
300 seconds
Behavioral task
behavioral4
Sample
518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
22 signatures
300 seconds
Behavioral task
behavioral5
Sample
a31a45f1c686c1ae2ff1733e7e7636a17010b85091b17bdf68c27543866dfca5.exe
Resource
win7-20240221-en
windows7-x64
19 signatures
300 seconds
Behavioral task
behavioral6
Sample
a31a45f1c686c1ae2ff1733e7e7636a17010b85091b17bdf68c27543866dfca5.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
22 signatures
300 seconds
Behavioral task
behavioral7
Sample
b4b89828380c4781c7beafa6dce00ae38cd4adc13ad56792996e28c41def5c53.exe
Resource
win7-20240419-en
windows7-x64
19 signatures
300 seconds
Behavioral task
behavioral8
Sample
b4b89828380c4781c7beafa6dce00ae38cd4adc13ad56792996e28c41def5c53.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
21 signatures
300 seconds
General
- Target possible_irt_8base-16940971753.zip
- Size 471KB
- Sample240501-vfdvwadh33
- SHA256 8dcd2cfd4c38ceb5e80e08e17c50bcca2232b33c2e78112545b2ede73cb5b8e3
- MD5 554dea0d7bb2c4524944c1c80312658c
- SHA1 5cfefb427c7a0bada534dae293f3ec890c4b5a80
- SHA512 ca3e247d3b8e95cba070a6cfb63c6f886607026c4d13c262bb7a6e6317516d4acb1ba23ca9cd978281b3c20f0a22421e3aa9a8d311f62a1e959f23611be5d172
- SSDEEP 12288:hH6t4FdgTCjnlvHDgKuJZycwmEshmhcS0LfSVaTFILS6:p6kgTC+KuJIcSsscS0DSATuLn
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb unpack001/518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c unpack001/a31a45f1c686c1ae2ff1733e7e7636a17010b85091b17bdf68c27543866dfca5 unpack001/b4b89828380c4781c7beafa6dce00ae38cd4adc13ad56792996e28c41def5c53
File Explorer
-
possible_irt_8base-16940971753.zip.zip 471KB
-
2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb.exe 235KB
-
518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c.exe 281KB
-
a31a45f1c686c1ae2ff1733e7e7636a17010b85091b17bdf68c27543866dfca5.exe 221KB
-
b4b89828380c4781c7beafa6dce00ae38cd4adc13ad56792996e28c41def5c53.exe 56KB
2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb
- IMPHASH 4527c8db200cf9545daac89557b3bc37
- SHA256 2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb
- MD5 0f281d2506515a64082d6e774573afb7
- SHA1 8949f27465913bf475fceb5796b205429083df58
- SHA512 f4ddb22c7dec04ca862d3df88e285025e02c185dbb2c061e9d0092ba3e8e8e083ca55612aae6b2d5792038729c55c0eaf193048991c0b06c8639a52017102622
- SSDEEP 3072:tkq8P0CtmR0TW3gu8/j/ZCTFPBMBbfYjQF5MLyfLTJ1:GPJTOgr/0XgjYY5gULT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
21842
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTempFileNameW
GetPrivateProfileSectionNamesW
SearchPathW
SetPriorityClass
GetConsoleAliasesLengthW
InterlockedIncrement
InterlockedDecrement
WaitNamedPipeA
GetModuleHandleW
GetTickCount
GetCurrentThread
FindNextVolumeMountPointA
ConvertFiberToThread
GetNumberFormatA
EnumTimeFormatsW
GetCommandLineA
GetVolumePathNameW
GlobalAlloc
LoadLibraryW
FreeConsole
GetCalendarInfoA
GetConsoleAliasExesLengthW
LeaveCriticalSection
GetExitCodeProcess
GetFileAttributesW
WriteConsoleW
GetCompressedFileSizeA
CompareStringW
GetVolumePathNameA
FindNextVolumeMountPointW
EnumSystemLocalesA
GetLastError
GetCurrentDirectoryW
GetProcAddress
BeginUpdateResourceW
MoveFileW
SearchPathA
SetFileAttributesA
GlobalFree
OpenWaitableTimerA
LoadLibraryA
OpenThread
InterlockedExchangeAdd
SetCalendarInfoW
MoveFileA
VirtualLock
AddAtomA
HeapWalk
OpenJobObjectW
EnumDateFormatsA
OpenFileMappingW
FreeEnvironmentStringsW
FindNextFileW
CreateMailslotA
WaitForDebugEvent
GetCPInfoExA
GetWindowsDirectoryW
GetVolumeNameForVolumeMountPointW
GetFileInformationByHandle
ReadConsoleOutputCharacterW
LocalFileTimeToFileTime
ReadFile
CreateFileW
WideCharToMultiByte
MultiByteToWideChar
HeapSetInformation
GetStartupInfoW
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
DecodePointer
TlsFree
SetLastError
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapFree
IsProcessorFeaturePresent
EnterCriticalSection
SetFilePointer
CloseHandle
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringW
GetStringTypeW
Sleep
RtlUnwind
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
HeapReAlloc
user32
GetAltTabInfoW
Name
.text
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
108KB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.jotoxi
Size
1024B
Virtual Size
580B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=113, id=170, productName=VS2010 build 30319, version=30319,
count=37, id=171, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=125, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c
- IMPHASH 493c0587242c6f974644a1959b9764db
- SHA256 518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c
- MD5 2809e15a3a54484e042fe65fffd17409
- SHA1 4a8f0331abaf8f629b3c8220f0d55339cfa30223
- SHA512 698e16fd67861377e2ccaace4d0e1a619a8b7c68e8aefc4090e9d1cbbcdfb8d8aede76f9e63f81479f5a035e8008699a4d7175da6248e6e49eb7c81b3dba30c3
- SSDEEP 3072:D5IwIMZKkczttW5ivhjqKO1I9Goh6F4mAqeormMkpCWlunhNGA5yjszVIEe9:NIMsztZZ+KQqGo5QfmLpCoun6W
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
33004
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\bonafocogahet cunevun.pdb
kernel32
InterlockedDecrement
UnlockFile
GetModuleHandleW
GetTickCount
GetConsoleAliasesA
GetDateFormatA
CreateActCtxW
GetVolumePathNameW
FindResourceExA
GlobalAlloc
LoadLibraryW
SetCommConfig
GetCalendarInfoW
FormatMessageW
WriteConsoleOutputA
FindNextVolumeW
WriteConsoleW
GetACP
GetStringTypeExA
GetProfileIntA
SetCurrentDirectoryA
GetLogicalDriveStringsA
GetLastError
GetCurrentDirectoryW
SetLastError
GetProcAddress
ReadConsoleA
IsValidCodePage
ReadFileEx
LoadLibraryA
OpenMutexA
BeginUpdateResourceA
GetModuleFileNameA
QueryMemoryResourceNotification
PurgeComm
OpenSemaphoreW
FindFirstVolumeA
GetVersionExA
ReadConsoleInputW
GetWindowsDirectoryW
GetCurrentProcessId
AddConsoleAliasA
CommConfigDialogW
CreateFileA
GetConsoleOutputCP
WriteConsoleA
CloseHandle
SetUnhandledExceptionFilter
CreateTimerQueue
VirtualAlloc
SetProcessAffinityMask
FlushFileBuffers
GetConsoleMode
GetConsoleCP
InterlockedIncrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
HeapFree
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetCPInfo
ExitProcess
WriteFile
GetStdHandle
HeapAlloc
HeapCreate
VirtualFree
HeapReAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
HeapSize
SetHandleCount
GetFileType
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetOEMCP
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetLocaleInfoW
user32
LoadMenuW
GetSysColorBrush
GetCaretPos
CharUpperBuffW
CharToOemBuffW
gdi32
GetTextExtentPointW
advapi32
ReportEventA
ReadEventLogW
winhttp
WinHttpSetDefaultProxyConfiguration
WinHttpOpen
WinHttpCheckPlatform
Name
.text
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=44, id=132, productName=VS2008 build 21022, version=21022,
count=98, id=131, productName=VS2008 build 21022, version=21022,
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=135, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
a31a45f1c686c1ae2ff1733e7e7636a17010b85091b17bdf68c27543866dfca5
- IMPHASH 8577a8bca69eb3cc886ffba8fc991a9d
- SHA256 a31a45f1c686c1ae2ff1733e7e7636a17010b85091b17bdf68c27543866dfca5
- MD5 8a62691e9921ee88ab036aba6f9e45eb
- SHA1 288d8268254bf799aef8db58beb18cb35fd903a1
- SHA512 75939ee7257ff3a327f89d88612462b31058bb1e09888d055379e77bb2e9c7d7282ba4edfc0e875298318d2bc1fc63741fd8f5e2697855173cf822619ac67a44
- SSDEEP 3072:jr80jG3/pNoCOTkEY6ARea8TPUwlCIRSrYIv2FSlSDhkE64Jww6+C3Ul:80jWsCOTkE6v8Ti9slF9JwwR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
22598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetVolumeNameForVolumeMountPointA
GetPrivateProfileSectionNamesW
SearchPathW
SetPriorityClass
GetConsoleAliasesLengthW
GetConsoleAliasExesLengthA
InterlockedIncrement
InterlockedDecrement
GetUserDefaultLCID
GetModuleHandleW
GetTickCount
GetCurrentThread
FindNextVolumeMountPointA
ConvertFiberToThread
GetNumberFormatA
GetWindowsDirectoryA
WaitNamedPipeW
EnumTimeFormatsA
GetCommandLineA
GetVolumePathNameW
GlobalAlloc
FreeConsole
GetCalendarInfoA
LeaveCriticalSection
GetExitCodeProcess
GetFileAttributesW
WriteConsoleW
CompareStringW
FindNextVolumeMountPointW
GetLastError
GetCurrentDirectoryW
GetProcAddress
BeginUpdateResourceW
MoveFileW
SearchPathA
SetFileAttributesA
GetTempFileNameA
OpenWaitableTimerA
LoadLibraryA
OpenThread
InterlockedExchangeAdd
SetCalendarInfoW
MoveFileA
VirtualLock
AddAtomA
OpenJobObjectW
EnumDateFormatsA
OpenFileMappingW
FreeEnvironmentStringsW
FindNextFileW
CreateMailslotA
WaitForDebugEvent
GetCPInfoExA
GetVolumeNameForVolumeMountPointW
GetCurrentProcessId
GetFileInformationByHandle
ReadConsoleOutputCharacterW
EnumSystemLocalesW
DeleteFileA
LocalFileTimeToFileTime
ReadFile
HeapReAlloc
WideCharToMultiByte
MultiByteToWideChar
HeapSetInformation
GetStartupInfoW
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
DecodePointer
TlsFree
SetLastError
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapFree
IsProcessorFeaturePresent
EnterCriticalSection
SetFilePointer
CloseHandle
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
LCMapStringW
GetStringTypeW
Sleep
RtlUnwind
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
LoadLibraryW
CreateFileW
user32
GetAltTabInfoW
Name
.text
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
79KB
Virtual Size
23.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wutexil
Size
1024B
Virtual Size
580B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=152, version=20115,
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=113, id=170, productName=VS2010 build 30319, version=30319,
count=38, id=171, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=124, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
b4b89828380c4781c7beafa6dce00ae38cd4adc13ad56792996e28c41def5c53
- IMPHASH 851a0ba8fbb71710075bdfe6dcef92eb
- SHA256 b4b89828380c4781c7beafa6dce00ae38cd4adc13ad56792996e28c41def5c53
- MD5 966061cecee2b65fe7149dfa1d0f2c3a
- SHA1 691ed7b6c4c0bdd824ede0514aacda9d7adc51f1
- SHA512 da3521494ea83949641137e8e0cc248129d81cb8264619a41b437e0709c445a70ee0ef79863a613c5a1466ca6880b65e1e7e4cefde2513ca6b36a9c7219b8e16
- SSDEEP 1536:RNeRBl5PT/rx1mzwRMSTdLpJOCHAsua6db57m8POe:RQRrmzwR5JWse
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mpr
WNetEnumResourceW
WNetUseConnectionW
WNetOpenEnumW
WNetCloseEnum
ws2_32
ioctlsocket
getpeername
ntohl
select
WSAGetLastError
htons
recv
socket
closesocket
getsockopt
WSAAddressToStringW
htonl
connect
iphlpapi
GetIpAddrTable
winhttp
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSendRequest
kernel32
FindClose
FindNextFileW
SystemTimeToFileTime
OpenProcess
FindFirstFileW
MoveFileW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
GetCurrentThreadId
GetLocalTime
ExitProcess
SetFilePointer
WaitForSingleObject
GetComputerNameW
SetEvent
GetLogicalDrives
GetTickCount
Sleep
CopyFileW
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
CreateEventW
WaitForMultipleObjects
CloseHandle
SetFileAttributesW
CreateThread
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResetEvent
DeleteCriticalSection
AllocConsole
WriteFile
WideCharToMultiByte
WriteConsoleW
GetStdHandle
CreateMutexW
CreateProcessW
GetCurrentProcess
SetHandleInformation
HeapFree
GetLocaleInfoW
ReadProcessMemory
TerminateProcess
GetModuleFileNameW
FlushFileBuffers
OpenMutexW
GetLastError
GetProcAddress
Process32FirstW
GetExitCodeThread
CreatePipe
Process32NextW
GetModuleHandleA
CreateToolhelp32Snapshot
ReleaseMutex
GetVersion
DeleteFileW
GetCurrentProcessId
GetVolumeInformationW
ExpandEnvironmentStringsW
HeapAlloc
GetProcessHeap
HeapReAlloc
QueryPerformanceCounter
user32
GetWindowThreadProcessId
GetShellWindow
advapi32
FreeSid
LookupPrivilegeValueW
OpenProcessToken
GetTokenInformation
EqualSid
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
LookupAccountSidW
AllocateAndInitializeSid
DuplicateTokenEx
RegQueryValueExW
shell32
ShellExecuteExW
ole32
CoGetObject
CoInitializeEx
CoUninitialize
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.cdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=111, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=18, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,