a59cf9609a895ee90dc880fe3c198fd0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

a59cf9609a895ee90dc880fe3c198fd0_NeikiAnalytics.exe
Size

796KB
MD5

a59cf9609a895ee90dc880fe3c198fd0
SHA1

b9a9b3a0f2bb39c6458accc8a24e61bc8b4600bd
SHA256

71b472a83db94bb344866acaa5435caa8066ebe1b2d98034d7e7808632ef6fde
SHA512

60f9e76c3c9388d1977d4840a1a52fbcec599f99424fc0412efd1706a791e8b8820ad6ab95da1fc9d350d4baa0db4dece36c1772026e12f1abf3b5788be9acc7
SSDEEP

24576:s2TDWGnRuHGylnj31bulcJw1R8bgMprEH7U:s23WGq35ulcJw1R8nT

Score

1^/10

Malware Config

Signatures

Files

a59cf9609a895ee90dc880fe3c198fd0_NeikiAnalytics.exe
.dll windows:10 windows x86 arch:x86

91e47aebde0c2785a5cf7bd08eb7ce7a

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/04/2021, 00:00

Not After

19/06/2024, 23:59

Subject

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

50:55:ac:c9:c8:4f:9c:11:a0:07:d5:2f:fb:f0:de:00:17:8c:4e:66:a3:6e:1f:41:ad:0b:0f:28:89:22:68:2e
Signer

Actual PE Digest

50:55:ac:c9:c8:4f:9c:11:a0:07:d5:2f:fb:f0:de:00:17:8c:4e:66:a3:6e:1f:41:ad:0b:0f:28:89:22:68:2e

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mozglue.pdb

Imports

crypt32

CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CertOpenStore
CryptBinaryToStringW
CryptMsgClose
CryptMsgGetParam
CryptMsgOpenToDecode
CryptMsgUpdate
CryptQueryObject

ntdll

NtQueryVirtualMemory
RtlAllocateHeap
RtlCaptureContext
RtlCaptureStackBackTrace
RtlCompareMemory
RtlDuplicateUnicodeString
RtlFreeHeap
RtlFreeUnicodeString
RtlNtStatusToDosError
RtlReAllocateHeap
RtlSetLastWin32Error
VerSetConditionMask

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0_Lockit@std@@QAE@H@Z
??0ios_base@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1_Lockit@std@@QAE@XZ
??1ios_base@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??Bid@locale@std@@QAEIXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?classic@locale@std@@SAABV12@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?fail@ios_base@std@@QBE_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?good@ios_base@std@@QBE_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

bcrypt

BCryptGenRandom

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
CloseHandle
CreateEventW
CreateFileMappingW
CreateFileW
CreateThread
DeleteCriticalSection
DisableThreadLibraryCalls
DuplicateHandle
EncodePointer
EnterCriticalSection
FlushInstructionCache
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetProcessTimes
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetThreadContext
GetThreadId
GetTickCount64
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InitializeSRWLock
IsBadReadPtr
IsDebuggerPresent
IsProcessorFeaturePresent
K32EnumProcessModules
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
QueryUnbiasedInterruptTime
RaiseException
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ResetEvent
ResumeThread
SearchPathW
SetEnvironmentVariableW
SetEvent
SetLastError
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SuspendThread
SystemTimeToFileTime
TerminateProcess
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
UnhandledExceptionFilter
UnmapViewOfFile
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WerRegisterRuntimeExceptionModule
WerUnregisterRuntimeExceptionModule
WideCharToMultiByte

vcruntime140

__CxxFrameHandler3
__std_type_info_destroy_list
_except_handler3
_except_handler4_common
memchr
memcmp
memcpy
memmove
memset
strchr
wcsrchr

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_cexit
_configure_narrow_argv
_crt_atexit
_errno
_execute_onexit_table
_getpid
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_invoke_watson
_register_onexit_function
_seh_filter_dll
abort
exit

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vswprintf
_fileno
_fseeki64
_get_stream_buffer_pointers
_write
fclose
fflush
fgetc
fgetpos
fputc
fputs
fread
fsetpos
fwrite
setvbuf
ungetc

api-ms-win-crt-math-l1-1-0

_dsign
_dtest
ceil
floor

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file
_wsplitpath_s

api-ms-win-crt-convert-l1-1-0

_ltoa_s
_strtoui64
strtol

api-ms-win-crt-string-l1-1-0

_stricmp
_strnicmp
_wcsnicmp
_wcsupr_s
islower
isxdigit
strcmp
strlen
strncmp
strncpy
tolower
wcscat_s
wcscmp
wcscpy_s
wcslen
wcsncpy
wcsncpy_s
wcstok_s

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc
realloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

rand_s

Exports

Exports

??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??$AddMarkerToBuffer@UNoPayload@markers@baseprofiler@mozilla@@$$V@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AAVProfileChunkedBuffer@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UNoPayload@markers@01@@Z
??$AddMarkerToBuffer@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AAVProfileChunkedBuffer@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0AwakeTimeDuration@mozilla@@QAE@XZ
??0ConditionVariableImpl@detail@mozilla@@QAE@XZ
??0Decimal@blink@@QAE@ABV01@@Z
??0Decimal@blink@@QAE@ABVEncodedData@01@@Z
??0Decimal@blink@@QAE@H@Z
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z
??0LZ4FrameCompressionContext@Compression@mozilla@@QAE@HI_N0@Z
??0LZ4FrameDecompressionContext@Compression@mozilla@@QAE@_N@Z
??0LockedMarkerTypeFunctionsList@Streaming@base_profiler_markers_detail@mozilla@@QAE@XZ
??0MutexImpl@detail@mozilla@@QAE@XZ
??0PrintfTarget@mozilla@@IAE@XZ
??0RWLockImpl@detail@mozilla@@QAE@XZ
??0SHA1Sum@mozilla@@QAE@XZ
??0TimeStampValue@mozilla@@AAE@_K0_N@Z
??0TimeStampValue@mozilla@@AAE@_K@Z
??0UniqueJSONStrings@baseprofiler@mozilla@@QAE@AAVFailureLatch@2@@Z
??0UniqueJSONStrings@baseprofiler@mozilla@@QAE@AAVFailureLatch@2@ABV012@VProgressLogger@2@@Z
??1ConditionVariableImpl@detail@mozilla@@QAE@XZ
??1LZ4FrameCompressionContext@Compression@mozilla@@QAE@XZ
??1LZ4FrameDecompressionContext@Compression@mozilla@@QAE@XZ
??1LockedMarkerTypeFunctionsList@Streaming@base_profiler_markers_detail@mozilla@@QAE@XZ
??1MutexImpl@detail@mozilla@@QAE@XZ
??1ProfilingStack@baseprofiler@mozilla@@QAE@XZ
??1RWLockImpl@detail@mozilla@@QAE@XZ
??1UniqueJSONStrings@baseprofiler@mozilla@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIABUnothrow_t@std@@@Z
??3@YAXPAX@Z
??3@YAXPAXABUnothrow_t@std@@@Z
??3@YAXPAXI@Z
??4Decimal@blink@@QAEAAV01@ABV01@@Z
??8AwakeTimeDuration@mozilla@@QBE_NABV01@@Z
??8AwakeTimeStamp@mozilla@@QBE_NABV01@@Z
??8Decimal@blink@@QBE_NABV01@@Z
??9AwakeTimeDuration@mozilla@@QBE_NABV01@@Z
??9AwakeTimeStamp@mozilla@@QBE_NABV01@@Z
??9Decimal@blink@@QBE_NABV01@@Z
??DDecimal@blink@@QBE?AV01@ABV01@@Z
??GAwakeTimeDuration@mozilla@@QBE?AV01@ABV01@@Z
??GAwakeTimeStamp@mozilla@@QBE?AVAwakeTimeDuration@1@ABV01@@Z
??GDecimal@blink@@QBE?AV01@ABV01@@Z
??GDecimal@blink@@QBE?AV01@XZ
??GTimeStampValue@mozilla@@QBE_KABV01@@Z
??HAwakeTimeDuration@mozilla@@QBE?AV01@ABV01@@Z
??HAwakeTimeStamp@mozilla@@QBE?AV01@ABVAwakeTimeDuration@1@@Z
??HDecimal@blink@@QBE?AV01@ABV01@@Z
??KDecimal@blink@@QBE?AV01@ABV01@@Z
??MAwakeTimeDuration@mozilla@@QBE_NABV01@@Z
??MAwakeTimeStamp@mozilla@@QBE_NABV01@@Z
??MDecimal@blink@@QBE_NABV01@@Z
??NAwakeTimeDuration@mozilla@@QBE_NABV01@@Z
??NAwakeTimeStamp@mozilla@@QBE_NABV01@@Z
??NDecimal@blink@@QBE_NABV01@@Z
??OAwakeTimeDuration@mozilla@@QBE_NABV01@@Z
??OAwakeTimeStamp@mozilla@@QBE_NABV01@@Z
??ODecimal@blink@@QBE_NABV01@@Z
??PAwakeTimeDuration@mozilla@@QBE_NABV01@@Z
??PAwakeTimeStamp@mozilla@@QBE_NABV01@@Z
??PDecimal@blink@@QBE_NABV01@@Z
??RFileHandleDeleter@detail@mozilla@@QAEXUFileHandleHelper@12@@Z
??RProfilerBacktraceDestructor@baseprofiler@mozilla@@QAEXPAVProfilerBacktrace@12@@Z
??XDecimal@blink@@QAEAAV01@ABV01@@Z
??YAwakeTimeDuration@mozilla@@QAEXABV01@@Z
??YAwakeTimeStamp@mozilla@@QAEXABVAwakeTimeDuration@1@@Z
??YDecimal@blink@@QAEAAV01@ABV01@@Z
??YTimeStampValue@mozilla@@QAEAAV01@_J@Z
??ZAwakeTimeDuration@mozilla@@QAEXABV01@@Z
??ZAwakeTimeStamp@mozilla@@QAEXABVAwakeTimeDuration@1@@Z
??ZDecimal@blink@@QAEAAV01@ABV01@@Z
??ZTimeStampValue@mozilla@@QAEAAV01@_J@Z
??_0Decimal@blink@@QAEAAV01@ABV01@@Z
??_FDecimal@blink@@QAEXXZ
??_FLZ4FrameDecompressionContext@Compression@mozilla@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIABUnothrow_t@std@@@Z
??_V@YAXPAX@Z
??_V@YAXPAXABUnothrow_t@std@@@Z
??_V@YAXPAXI@Z
?AddRef@PageInformation@baseprofiler@mozilla@@QBEXXZ
?AddRef@ThreadInfo@baseprofiler@mozilla@@QBEXXZ
?BeginCompressing@LZ4FrameCompressionContext@Compression@mozilla@@QAE?AV?$Result@V?$Span@$$CBD$0PPPPPPPP@@mozilla@@I@3@V?$Span@D$0PPPPPPPP@@3@@Z
?BeginProcessRuntimeInit@detail@mscom@mozilla@@YAAAW4ProcessInitState@123@XZ
?CacheNtDllThunk@mozilla@@YAXXZ
?CheckQPC@TimeStampValue@mozilla@@ABE_KABV12@@Z
?CleanupProcessRuntime@mozilla@@YAXXZ
?ClearAndSetFailure@UniqueJSONStrings@baseprofiler@mozilla@@AAEXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ
?ConsumePreXULSkeletonUIHandle@mozilla@@YAPAUHWND__@@XZ
?ContinueCompressing@LZ4FrameCompressionContext@Compression@mozilla@@QAE?AV?$Result@V?$Span@$$CBD$0PPPPPPPP@@mozilla@@I@3@V?$Span@$$CBD$0PPPPPPPP@@3@@Z
?CreateAndStorePreXULSkeletonUI@mozilla@@YAXPAUHINSTANCE__@@HPAPAD@Z
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z
?Decompress@LZ4FrameDecompressionContext@Compression@mozilla@@QAE?AV?$Result@ULZ4FrameDecompressionResult@Compression@mozilla@@I@3@V?$Span@D$0PPPPPPPP@@3@V?$Span@$$CBD$0PPPPPPPP@@3@@Z
?DeserializerForTag@Streaming@base_profiler_markers_detail@mozilla@@SAP6AXAAVProfileBufferEntryReader@3@AAVSpliceableJSONWriter@baseprofiler@3@@ZE@Z
?DllBlocklist_CheckStatus@@YA_NXZ
?DllBlocklist_Initialize@@YAXI@Z
?DllBlocklist_SetBasicDllServices@@YAXPAVDllServicesBase@detail@glue@mozilla@@@Z
?DllBlocklist_SetFullDllServices@@YAXPAVDllServicesBase@detail@glue@mozilla@@@Z
?DllBlocklist_WriteNotes@@YAXAAVAnnotationWriter@CrashReporter@@@Z
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z
?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ
?EndCompressing@LZ4FrameCompressionContext@Compression@mozilla@@QAE?AV?$Result@V?$Span@$$CBD$0PPPPPPPP@@mozilla@@I@3@XZ
?EndProcessRuntimeInit@detail@mscom@mozilla@@YAXXZ
?EnsureBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ
?ExtractBaseProfilerChunkManager@detail@baseprofiler@mozilla@@YA?AV?$UniquePtr@VProfileBufferChunkManagerWithLocalLimit@mozilla@@V?$DefaultDelete@VProfileBufferChunkManagerWithLocalLimit@mozilla@@@2@@3@XZ
?FeaturesIfActive@RacyFeatures@detail@baseprofiler@mozilla@@SA?AV?$Maybe@I@4@XZ
?FilterHasPid@detail@profiler@mozilla@@YA_NPBDVBaseProfilerProcessId@baseprofiler@3@@Z
?FiltersExcludePid@detail@profiler@mozilla@@YA_NV?$Span@QBD$0PPPPPPPP@@3@VBaseProfilerProcessId@baseprofiler@3@@Z
?FirstTimeStamp@TimeStamp@mozilla@@SA?AV12@XZ
?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z
?FramePointerStackWalk@mozilla@@YAXP6AXIPAX00@ZI0PAPAX0@Z
?GenerateRandomBytesFromOS@mozilla@@YA_NPAXI@Z
?GetCachedNtDllThunk@mozilla@@YAPAV?$Buffer@U_IMAGE_THUNK_DATA32@@@1@XZ
?GetClearedBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAPAVProfileChunkedBuffer@2@XZ
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAE?AV?$Maybe@I@3@ABV?$Span@$$CBD$0PPPPPPPP@@3@@Z
?GetPreXULSkeletonUIEnabled@mozilla@@YA_NXZ
?GetPreXULSkeletonUIErrorReason@mozilla@@YA?AV?$Maybe@W4PreXULSkeletonUIError@mozilla@@@1@XZ
?GetPreXULSkeletonUIWasShown@mozilla@@YA_NXZ
?GetProfilerEnvVarsForChildProcess@baseprofiler@mozilla@@YAX$$QAV?$function@$$A6AXPBD0@Z@std@@@Z
?GetProfilingCategoryPairInfo@baseprofiler@mozilla@@YAABUProfilingCategoryPairInfo@12@W4ProfilingCategoryPair@12@@Z
?GetProfilingStack@AutoProfilerLabel@baseprofiler@mozilla@@SAPAVProfilingStack@23@XZ
?GetProfilingStartTime@detail@baseprofiler@mozilla@@YA?AVTimeStamp@3@XZ
?GetQueryPerformanceFrequencyPerSec@mozilla@@YA_KXZ
?GetThreadRegistrationTime@detail@baseprofiler@mozilla@@YA?AVTimeStamp@3@XZ
?GraphColorToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4GraphColor@12@@Z
?GraphTypeToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4GraphType@12@@Z
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z
?HashBytes@mozilla@@YAIPBXI@Z
?InitializeUptime@mozilla@@YAXXZ
?InvalidArrayIndex_CRASH@detail@mozilla@@YAXII@Z
?IsActive@RacyFeatures@detail@baseprofiler@mozilla@@SA_NXZ
?IsActiveAndSamplingUnpaused@RacyFeatures@detail@baseprofiler@mozilla@@SA_NXZ
?IsActiveAndUnpaused@RacyFeatures@detail@baseprofiler@mozilla@@SA_NXZ
?IsActiveWithFeature@RacyFeatures@detail@baseprofiler@mozilla@@SA_NI@Z
?IsActiveWithoutFeature@RacyFeatures@detail@baseprofiler@mozilla@@SA_NI@Z
?IsDynamicCodeDisabled@mozilla@@YA_NXZ
?IsEafPlusEnabled@mozilla@@YA_NXZ
?IsFloat32Representable@mozilla@@YA_NN@Z
?IsThreadBeingProfiled@detail@baseprofiler@mozilla@@YA_NXZ
?IsUserShadowStackEnabled@mozilla@@YA_NXZ
?IsValidUtf8@detail@mozilla@@YA_NPBXI@Z
?IsWin32kLockedDown@mozilla@@YA_NXZ
?LocationToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Location@12@@Z
?MapRemoteViewOfFile@mozilla@@YAPAXPAX0_K0KKK@Z
?MozStackWalkThread@@YAXP6AXIPAX00@ZI00PAU_CONTEXT@@@Z
?NotePreXULSkeletonUIRestarting@mozilla@@YA?AV?$Result@UOk@mozilla@@W4PreXULSkeletonUIError@2@@1@XZ
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z
?NowLoRes@AwakeTimeStamp@mozilla@@SA?AV12@XZ
?PersistPreXULSkeletonUIValues@mozilla@@YA?AV?$Result@UOk@mozilla@@W4PreXULSkeletonUIError@2@@1@ABUSkeletonUISettings@1@@Z
?PollPreXULSkeletonUIEvents@mozilla@@YAXXZ
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ
?ProcessUptimeExcludingSuspendMs@mozilla@@YA?AV?$Maybe@_K@1@XZ
?ProcessUptimeMs@mozilla@@YA?AV?$Maybe@_K@1@XZ
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ
?RandomUint64OrDie@mozilla@@YA_KXZ
?RecordProcessRestart@TimeStamp@mozilla@@SAXXZ
?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z
?RegisterRuntimeExceptionModule@CrashReporter@@YAXXZ
?Release@PageInformation@baseprofiler@mozilla@@QBEXXZ
?Release@ThreadInfo@baseprofiler@mozilla@@QBEXXZ
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ
?ResolutionInTicks@BaseTimeDurationPlatformUtils@mozilla@@SA_JXZ
?SetActive@RacyFeatures@detail@baseprofiler@mozilla@@SAXI@Z
?SetGeckoProcessType@mozilla@@YAXPBD@Z
?SetInactive@RacyFeatures@detail@baseprofiler@mozilla@@SAXXZ
?SetPaused@RacyFeatures@detail@baseprofiler@mozilla@@SAXXZ
?SetPreXULSkeletonUIEnabledIfAllowed@mozilla@@YA?AV?$Result@UOk@mozilla@@W4PreXULSkeletonUIError@2@@1@_N@Z
?SetPreXULSkeletonUIThemeId@mozilla@@YA?AV?$Result@UOk@mozilla@@W4PreXULSkeletonUIError@2@@1@W4ThemeMode@1@@Z
?SetSamplingPaused@RacyFeatures@detail@baseprofiler@mozilla@@SAXXZ
?SetSamplingUnpaused@RacyFeatures@detail@baseprofiler@mozilla@@SAXXZ
?SetUnpaused@RacyFeatures@detail@baseprofiler@mozilla@@SAXXZ
?SetWin32kLockedDownInPolicy@mozilla@@YAXXZ
?Shutdown@TimeStamp@mozilla@@SAXXZ
?SpliceStringTableElements@UniqueJSONStrings@baseprofiler@mozilla@@QAEXAAVSpliceableJSONWriter@23@@Z
?Startup@TimeStamp@mozilla@@SAXXZ
?Stream@MarkerSchema@mozilla@@QHAEXAAVJSONWriter@2@ABV?$Span@$$CBD$0PPPPPPPP@@2@@Z
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBGHPAH@Z
?StringToFloat@StringToDoubleConverter@double_conversion@@QBEMPBDHPAH@Z
?StringToFloat@StringToDoubleConverter@double_conversion@@QBEMPBGHPAH@Z
?TagForMarkerTypeFunctions@Streaming@base_profiler_markers_detail@mozilla@@SAEP6AXAAVProfileBufferEntryReader@3@AAVSpliceableJSONWriter@baseprofiler@3@@ZP6A?AV?$Span@$$CBD$0PPPPPPPP@@3@XZP6A?AVMarkerSchema@3@XZ@Z
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z
?ToExponential@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z
?ToFixed@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z
?ToMicroseconds@AwakeTimeDuration@mozilla@@QBENXZ
?ToMilliseconds@AwakeTimeDuration@mozilla@@QBENXZ
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z
?ToSeconds@AwakeTimeDuration@mozilla@@QBENXZ
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z
?ToSecondsSigDigits@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z
?UnmapRemoteViewOfFile@mozilla@@YA_NPAX0@Z
?UnregisterRuntimeExceptionModule@CrashReporter@@YAXXZ
?Unused@mozilla@@3Uunused_t@1@B
?WasPreXULSkeletonUIMaximized@mozilla@@YA_NXZ
?WindowsBCryptInitialization@mozilla@@YA_NXZ
?WindowsDpiInitialization@mozilla@@YA?AW4WindowsDpiInitializationResult@1@XZ
?WindowsMsctfInitialization@mozilla@@YA_NXZ
?abs@Decimal@blink@@QBE?AV12@XZ
?aes_enabled@sse_private@mozilla@@3_NA
?alignOperands@Decimal@blink@@CA?AUAlignedOperands@12@ABV12@0@Z
?appendIntDec@PrintfTarget@mozilla@@QAE_NH@Z
?appendIntDec@PrintfTarget@mozilla@@QAE_NI@Z
?appendIntDec@PrintfTarget@mozilla@@QAE_N_J@Z
?appendIntDec@PrintfTarget@mozilla@@QAE_N_K@Z
?appendIntHex@PrintfTarget@mozilla@@QAE_NI@Z
?appendIntHex@PrintfTarget@mozilla@@QAE_N_K@Z
?appendIntOct@PrintfTarget@mozilla@@QAE_NI@Z
?appendIntOct@PrintfTarget@mozilla@@QAE_N_K@Z
?avx2_enabled@sse_private@mozilla@@3_NA
?avx_enabled@sse_private@mozilla@@3_NA
?avxvnni_enabled@sse_private@mozilla@@3_NA
?baseprofiler_save_profile_to_file@baseprofiler@mozilla@@YAXPBD@Z
?ceil@Decimal@blink@@QBE?AV12@XZ
?compareTo@Decimal@blink@@ABE?AV12@ABV12@@Z
?compress@LZ4@Compression@mozilla@@SAIPBDIPAD@Z
?compressLimitedOutput@LZ4@Compression@mozilla@@SAIPBDIPADI@Z
?decompress@LZ4@Compression@mozilla@@SA_NPBDIPADIPAI@Z
?decompressPartial@LZ4@Compression@mozilla@@SA_NPBDIPADIPAI@Z
?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ
?finish@SHA1Sum@mozilla@@QAEXAAY0BE@E@Z
?floor@Decimal@blink@@QBE?AV12@XZ
?fma3_enabled@sse_private@mozilla@@3_NA
?fromDouble@Decimal@blink@@SA?AV12@N@Z
?fromString@Decimal@blink@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?gChaosFeatures@detail@mozilla@@3W4ChaosFeature@2@A
?gChaosModeCounter@detail@mozilla@@3V?$Atomic@I$01X@2@A
?gOOMAllocationSize@@3IA
?gTwoCharEscapes@detail@mozilla@@3QBDB
?has_constant_tsc@sse_private@mozilla@@3_NA
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z
?lock@MutexImpl@detail@mozilla@@IAEXXZ
?memchr16@SIMD@mozilla@@SAPB_SPB_S_SI@Z
?memchr16AVX2@SIMD@mozilla@@SAPB_SPB_S_SI@Z
?memchr16SSE2@SIMD@mozilla@@SAPB_SPB_S_SI@Z
?memchr2x16@SIMD@mozilla@@SAPB_SPB_S_S1I@Z
?memchr2x8@SIMD@mozilla@@SAPBDPBDDDI@Z
?memchr64@SIMD@mozilla@@SAPB_KPB_K_KI@Z
?memchr64AVX2@SIMD@mozilla@@SAPB_KPB_K_KI@Z
?memchr8@SIMD@mozilla@@SAPBDPBDDI@Z
?memchr8AVX2@SIMD@mozilla@@SAPBDPBDDI@Z
?memchr8SSE2@SIMD@mozilla@@SAPBDPBDDI@Z
?mmx_enabled@sse_private@mozilla@@3_NA
?mozalloc_handle_oom@@YAXI@Z
?nan@Decimal@blink@@SA?AV12@XZ
?notify_all@ConditionVariableImpl@detail@mozilla@@QAEXXZ
?notify_one@ConditionVariableImpl@detail@mozilla@@QAEXXZ
?print@PrintfTarget@mozilla@@QAA_NPBDZZ
?profiler_active_without_feature@baseprofiler@mozilla@@YA_NI@Z
?profiler_add_js_marker@baseprofiler@mozilla@@YAXPBD0@Z
?profiler_add_sampled_counter@baseprofiler@mozilla@@YAXPAVBaseProfilerCount@12@@Z
?profiler_capture_backtrace@baseprofiler@mozilla@@YA?AV?$UniquePtr@VProfileChunkedBuffer@mozilla@@V?$DefaultDelete@VProfileChunkedBuffer@mozilla@@@2@@2@XZ
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z
?profiler_current_process_id@baseprofiler@mozilla@@YA?AVBaseProfilerProcessId@12@XZ
?profiler_current_thread_id@baseprofiler@mozilla@@YA?AVBaseProfilerThreadId@12@XZ
?profiler_ensure_started@baseprofiler@mozilla@@YAXV?$PowerOfTwo@I@2@NIPAPBDIABV?$Maybe@N@2@@Z
?profiler_feature_active@baseprofiler@mozilla@@YA_NI@Z
?profiler_get_available_features@baseprofiler@mozilla@@YAIXZ
?profiler_get_backtrace@baseprofiler@mozilla@@YA?AV?$UniquePtr@VProfilerBacktrace@baseprofiler@mozilla@@UProfilerBacktraceDestructor@23@@2@XZ
?profiler_get_buffer_info@baseprofiler@mozilla@@YA?AV?$Maybe@UProfilerBufferInfo@baseprofiler@mozilla@@@2@XZ
?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ
?profiler_get_profile@baseprofiler@mozilla@@YA?AV?$UniquePtr@$$BY0A@DV?$DefaultDelete@$$BY0A@D@mozilla@@@2@N_N0@Z
?profiler_get_start_params@baseprofiler@mozilla@@YAXPAHPAV?$Maybe@N@2@PANPAIPAV?$Vector@PBD$0A@VMallocAllocPolicy@mozilla@@@2@@Z
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z
?profiler_init_main_thread_id@baseprofiler@mozilla@@YAXXZ
?profiler_is_main_thread@baseprofiler@mozilla@@YA_NXZ
?profiler_is_paused@baseprofiler@mozilla@@YA_NXZ
?profiler_is_sampling_paused@baseprofiler@mozilla@@YA_NXZ
?profiler_main_thread_id@baseprofiler@mozilla@@YA?AVBaseProfilerThreadId@12@XZ
?profiler_pause@baseprofiler@mozilla@@YAXXZ
?profiler_pause_sampling@baseprofiler@mozilla@@YAXXZ
?profiler_register_page@baseprofiler@mozilla@@YAX_K0ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?profiler_register_thread@baseprofiler@mozilla@@YAPAVProfilingStack@12@PBDPAX@Z
?profiler_remove_sampled_counter@baseprofiler@mozilla@@YAXPAVBaseProfilerCount@12@@Z
?profiler_resume@baseprofiler@mozilla@@YAXXZ
?profiler_resume_sampling@baseprofiler@mozilla@@YAXXZ
?profiler_set_process_name@baseprofiler@mozilla@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBV34@@Z
?profiler_shutdown@baseprofiler@mozilla@@YAXXZ
?profiler_start@baseprofiler@mozilla@@YAXV?$PowerOfTwo@I@2@NIPAPBDIABV?$Maybe@N@2@@Z
?profiler_stop@baseprofiler@mozilla@@YAXXZ
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z
?profiler_thread_is_sleeping@baseprofiler@mozilla@@YA_NXZ
?profiler_thread_sleep@baseprofiler@mozilla@@YAXXZ
?profiler_thread_wake@baseprofiler@mozilla@@YAXXZ
?profiler_time@baseprofiler@mozilla@@YANXZ
?profiler_unregister_page@baseprofiler@mozilla@@YAX_K@Z
?profiler_unregister_thread@baseprofiler@mozilla@@YAXXZ
?readLock@RWLockImpl@detail@mozilla@@IAEXXZ
?readUnlock@RWLockImpl@detail@mozilla@@IAEXXZ
?remainder@Decimal@blink@@QBE?AV12@ABV12@@Z
?round@Decimal@blink@@QBE?AV12@XZ
?sChildProcessType@startup@mozilla@@3W4GeckoProcessType@@A
?sse3_enabled@sse_private@mozilla@@3_NA
?sse4_1_enabled@sse_private@mozilla@@3_NA
?sse4_2_enabled@sse_private@mozilla@@3_NA
?sse4a_enabled@sse_private@mozilla@@3_NA
?ssse3_enabled@sse_private@mozilla@@3_NA
?toDouble@Decimal@blink@@QBENXZ
?toString@Decimal@blink@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?toString@Decimal@blink@@QBE_NPADI@Z
?tryLock@MutexImpl@detail@mozilla@@IAE_NXZ
?tryReadLock@RWLockImpl@detail@mozilla@@IAE_NXZ
?tryWriteLock@RWLockImpl@detail@mozilla@@IAE_NXZ
?unlock@MutexImpl@detail@mozilla@@IAEXXZ
?update@SHA1Sum@mozilla@@QAEXPBXI@Z
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z
?wait@ConditionVariableImpl@detail@mozilla@@QAEXAAVMutexImpl@23@@Z
?wait_for@ConditionVariableImpl@detail@mozilla@@QAE?AW4CVStatus@3@AAVMutexImpl@23@ABV?$BaseTimeDuration@VTimeDurationValueCalculator@mozilla@@@3@@Z
?writeLock@RWLockImpl@detail@mozilla@@IAEXXZ
?writeUnlock@RWLockImpl@detail@mozilla@@IAEXXZ
?xgetbv@mozilla@@YA_KI@Z
?zero@Decimal@blink@@SA?AV12@W4Sign@12@@Z
GetAllocatorStallSpecs
MOZ_CrashPrintf
MozDescribeCodeAddress
MozFormatCodeAddress
MozFormatCodeAddressDetails
MozStackWalk
MozWalkTheStack
MozWalkTheStackWithWriter
_HeapAlloc@12
_HeapFree@12
_HeapReAlloc@16
_aligned_free
_aligned_malloc
_expand
_msize
_recalloc
_strdup
_wcsdup
calloc
fprint_stderr
fprintf_stderr
free
gMozCrashReason
gMozillaPoisonBase
gMozillaPoisonSize
gMozillaPoisonValue
jemalloc_free_dirty_pages
jemalloc_ptr_info
jemalloc_purge_freed_pages
jemalloc_set_main_thread
jemalloc_stats_internal
jemalloc_stats_num_bins
jemalloc_thread_local_arena
malloc
malloc_good_size
malloc_usable_size
moz_arena_calloc
moz_arena_free
moz_arena_malloc
moz_arena_memalign
moz_arena_realloc
moz_create_arena_with_params
moz_dispose_arena
moz_malloc_enclosing_size_of
moz_malloc_size_of
moz_malloc_usable_size
moz_set_max_dirty_page_modifier
moz_xcalloc
moz_xmalloc
moz_xmemalign
moz_xmemdup
moz_xrealloc
moz_xstrdup
mozalloc_abort
posix_memalign
print_stderr
printf_stderr
realloc
strdup
strndup
vprintf_stderr
wcsdup

Sections

.text
Size: 610KB - Virtual size: 609KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 25B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91e47aebde0c2785a5cf7bd08eb7ce7a

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fdCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

50:55:ac:c9:c8:4f:9c:11:a0:07:d5:2f:fb:f0:de:00:17:8c:4e:66:a3:6e:1f:41:ad:0b:0f:28:89:22:68:2eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

ntdll

msvcp140

bcrypt

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

Exports

Exports

Sections

.text Size: 610KB - Virtual size: 609KB

.rdata Size: 70KB - Virtual size: 70KB

.data Size: 1024B - Virtual size: 7KB

.00cfg Size: 512B - Virtual size: 4B

.tls Size: 512B - Virtual size: 25B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 24KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fd
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

50:55:ac:c9:c8:4f:9c:11:a0:07:d5:2f:fb:f0:de:00:17:8c:4e:66:a3:6e:1f:41:ad:0b:0f:28:89:22:68:2e
Signer

.text
Size: 610KB - Virtual size: 609KB

.rdata
Size: 70KB - Virtual size: 70KB

.data
Size: 1024B - Virtual size: 7KB

.00cfg
Size: 512B - Virtual size: 4B

.tls
Size: 512B - Virtual size: 25B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 24KB