inv.zip
- SHA256 461cded4b93a8deb76810154e7d6eeb8330fb6e0d7b8e462860b1c4f7f42a138
Overview
overview
10Static
static
5amadka.exe
windows7-x64
10amadka.exe
windows10-2004-x64
10amadka.exe
windows11-21h2-x64
10hpproduct.exe
windows7-x64
8hpproduct.exe
windows10-2004-x64
10hpproduct.exe
windows11-21h2-x64
10random.exe
windows7-x64
10random.exe
windows10-2004-x64
10random.exe
windows11-21h2-x64
10random/random.exe
windows7-x64
3random/random.exe
windows10-2004-x64
7random/random.exe
windows11-21h2-x64
3streamer.exe
windows7-x64
1streamer.exe
windows10-2004-x64
10streamer.exe
windows11-21h2-x64
5tuman.exe
windows7-x64
10tuman.exe
windows10-2004-x64
10tuman.exe
windows11-21h2-x64
10Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
amadka.exe
Resource
win7-20240708-en
windows7-x64
25 signatures
300 seconds
Behavioral task
behavioral2
Sample
amadka.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
26 signatures
300 seconds
Behavioral task
behavioral3
Sample
amadka.exe
Resource
win11-20240709-en
windows11-21h2-x64
25 signatures
300 seconds
Behavioral task
behavioral4
Sample
hpproduct.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral5
Sample
hpproduct.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
16 signatures
300 seconds
Behavioral task
behavioral6
Sample
hpproduct.exe
Resource
win11-20240709-en
windows11-21h2-x64
15 signatures
300 seconds
Behavioral task
behavioral7
Sample
random.exe
Resource
win7-20240704-en
windows7-x64
25 signatures
300 seconds
Behavioral task
behavioral8
Sample
random.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
26 signatures
300 seconds
Behavioral task
behavioral9
Sample
random.exe
Resource
win11-20240709-en
windows11-21h2-x64
25 signatures
300 seconds
Behavioral task
behavioral10
Sample
random/random.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral11
Sample
random/random.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral12
Sample
random/random.exe
Resource
win11-20240709-en
windows11-21h2-x64
9 signatures
300 seconds
Behavioral task
behavioral13
Sample
streamer.exe
Resource
win7-20240704-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
streamer.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral15
Sample
streamer.exe
Resource
win11-20240709-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral16
Sample
tuman.exe
Resource
win7-20240705-en
windows7-x64
25 signatures
300 seconds
Behavioral task
behavioral17
Sample
tuman.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
26 signatures
300 seconds
General
- Target inv.zip
- Size 12.6MB
- Sample240712-pxrv6stfll
- SHA256 461cded4b93a8deb76810154e7d6eeb8330fb6e0d7b8e462860b1c4f7f42a138
- MD5 7a8ce0d01d8e873dca82ca9c7377c377
- SHA1 fffd64b43b3810a7390ac9ceb640d3b3b9ee80a1
- SHA512 374c2a435858f283373f977bc8c79f5dedd898d6988045b9e7e80a3f517378c325b921951b65a3c0eec48a5aed3a96c25947d8bfe80966ac31870e5ba7e915dc
- SSDEEP 393216:dB66OcY0MyA4HFsyg0EB+4ZI+6jUoGoxUrUIg0EB+40:dY6OAM/ytYtR9KGUItf
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/random/random.exe autoit_exe - Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/amadka.exe unpack001/hpproduct.exe unpack001/random.exe unpack001/random/random.exe unpack001/streamer.exe unpack001/tuman.exe
File Explorer
-
inv.zip.zip 12.6MB
-
amadka.exe.exe 1.8MB
-
hpproduct.exe.exe 5.0MB
-
random.exe.exe 2.4MB
-
random/random.exe.exe 1.2MB
-
streamer.exe.exe 4.7MB
-
tuman.exe.exe 2.4MB
amadka.exe
- IMPHASH 2eabe9054cad5152567f0699947a2c5b
- SHA256 bb25aeb8d3150e94b5ace83bc5d2550776d71dff9c78898951faab7a1af751e8
- MD5 8cdbb4f2b779e6d1d1c31144a31deca6
- SHA1 48f9262ed6283c824e52a49f1981318fa7f712ab
- SHA512 1a58b511f69c9fd4f3dc31ed3114aedba8284409600fb2a22daeb8e9110e3e2f040931404e6b5c6b63215e2555085738f837ebbd4783097a3d9aa303c2277144
- SSDEEP 49152:4VjQ5fRdyuULwLakuM6WAKx+1G18+ZpE0/eQM+7PTId9J:UjufR4uULsPVvxjy+ZnQ+L+9J
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4988928
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpy
Name
Size
183KB
Virtual Size
416KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
zbjpduxe
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
vekcqctx
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.taggant
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=14, id=259, version=26715,
count=160, id=261, version=26715,
count=18, id=260, version=28117,
count=22, id=259, version=28117,
count=117, id=261, version=28117,
count=20, id=260, version=26715,
count=19, id=257, version=26715,
count=214, id=1, productName=Unmarked objects,
count=1, id=265, version=28315,
count=1, id=255, productName=VS2019 v16.4.3 build 28315, version=28315,
count=1, id=258, productName=VS2019 v16.4.3 build 28315, version=28315,
hpproduct.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d1c5dce3d438c76addcfed20a46330ddadbe829fd49452f5728414057b441923
- MD5 63138dfb6f059b316cef364b01ce34e6
- SHA1 5c225a8f99eb3992a0a0ce416648fef02023244d
- SHA512 69a40a3e156ed950458fc6f79fffd42b2ee67a03be616b2874aa3dd1e60ded73a363e8f8d82543b8b0fa00f626439508f799c06a559e3466b589d7e6d3e1fb78
- SSDEEP 98304:WPaFb2DelKDuO4za6WtlXtAJMT1VqHuH3qk8Nfs9H+:fFailK6O418NtAST1eM/8Nfs9H+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5090126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
hpproduct.pdb
mscoree
_CorExeMain
Name
.text
Size
4.8MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
138KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
random.exe
- SHA256 f085c6c04bb96f24fdbf974025a25ca0baaf01093996d5b8be8f4b03045892c2
- MD5 f320a471da179c2cdb8f920a58d5a49e
- SHA1 c0587747ea1f01591f56df772436487759a56cb3
- SHA512 392f7e1c70ef8445b85d08e554b220b25e228939ecaac90cb55f91a12b826b153cc0ffc0f1a1946a2cca878242080c62a6e64d86cba220deff0012cdd765886e
- SSDEEP 49152:ua+frLou6hg9lGyMJt6ygLSfhJCddlHBf2RwrLfKIlN:efr8hclGS+JkdlHMwnf
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12504240
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
���ê�d eG���
Z���L�qRO��1�����nZ��:;�\4+C��"m�K��up��V����MO��w�؝�����RP6�e+u�x#8l`+0^K����=�i��+_}�!��`���.j��p:�2cN�/��Ep9 }k�sw���J��~3���^��^�Ɏ��ݲ
�1澝3�ͽzh����c����=�C��<���]��m�`N/�CH#Fk���� ip_���)�;m�����_9fy�T�\7�����\R�
���@�M�Xlzɽ�'������f9� ~�RH��v6�*z����<C�U�i0�� eN����8����|40��1���Sy�)�)��y���������z3@�-�*�Co:z�6��hJ6����QQ!-]%Z�7�rA_���-P��g�I�V���H�S�ǚ�\��A�A�{�(�,���/�*9 � ž{���ah�?���i���r/���d�Q���$�����ˀ�`��A���i��61�:W5�7t�Y ��xe������L�Xu���)!�3�����o�������ȭ����Ͽ?���9���x��R�
������6�N �m�
�q�㋡
�p�������L��G�y
�f�g:&"kQH�{`]�[^��-�`�� �����2:d�8�.o��Y�5Yr3Ό�#]���5�{�0-)�ibt{�����^*i0�MzoP���K,:��/$]��쒞Ae���w�}Z�Uh���߂�*'�`-�ʰs"��j�V
� X+%)� ��b>�����YC!�WC�<�wQ��
<��+ Z�Od�� !�PE)�;)���m IT�n�^٢ ��z@�4���-��W�j�iP��%�rid_ٴwݖ����]�
����s������:��O#�
�=<�3(Ƕ�r��C*�Ν:���y�C�� =?R�A�ǣf�A}<�
�ȇ�=�����`��B�� ��0��QId�Ģ�gB�1�Bm�`璅{��r �Z��4ca ��#$r��`j�B!`�*���Ws{��`����@ud�P�I��%�@�+�s���AУ�ZʻlV+�� F���Y7*s2����N�r���!�s��z�ȑ�Yt��rRtĜ �ߘ|��i:ܔ�͖��*?:۱(�x.O'-a�����H%h�=ƙ����E����y-|��L^�Ǣ�6lk���NO P\.�ޟ���ġ��Qh����bǛ�b��
=-�R��#n冖S��f\$ ��dz[c M�6�����ո��(�2I'Di��ٿ������ ��)4r�.�]����t��L6J���/P ��kuq~$�:
a�C"�&���42.��UvP� �u��Q;n;�Ŗ$/�<���j��q��̒�wXxv�jI"� mzR74]�Xw� �o9F����` x#�9�J-~�x�kf ��,y� X*�:Q��T�)Љ�������8������r�֞�0����Y)>G�&�<ؑ_��83��o�)� ��F�@ԯa��Ϊ�� M
����=�+� ܿ�T�H��kEπǍk��&ͪ3����<�Z*�e��y D��퉥�|�|������ ���W��HsBl��-�w&
���עM�E�� ������1���T�|G���� �6qs�qSS1��!��=�͢Y��Fb8��\�
6
D�&e-����{F���۹��I� uO��{��"�Q���##>�Hw0��SYy��a� U�#"�}� ��<ŕd�U�M�Uz�"�U�0����`;n�BA��M����PR$s�J)�3Tu H��j���2��iXe�C ����)��X�X�c)� �>u��q��������9��^g�WFsL��AjX����Y �I� dy!����uJ�Ʉ������㍴���`b1���km�������Ѧ��U� �V<X�"i�,\�B��B��-/n�t�S L���%��`����@�i�(ˆ���0��;43��e�Gdz��Й��[C��R�bzLW��Pk|%]��/X�����>s<�����X 5��Wz�E�y��~ ��=(�� F��Q �@k�ܔ^��.���b�,��'eUOL���CӡZ��hvqخ���$L�r��
�(�
?F[������Q��vL�x��!=Sd? 1� ���3hS��+�ʕ ��4��m.q����xk~]��� �, qA���#p�� f^���nIoT�O����&�7ȡ[��0:���S��o K;M%z���
��Ȕ����aɥ/ }��@#CÑօL��,����PG�f�Cr
�¯Е�ѹ6���A�n�:�� Nu�� �%�T�<*]�ڝ8C@�k���2�7=H���Y��B�u�G��t�
�Mg�#�uo�'A��!1�B:�>��'Ɯ!�hG ����Ow*�W�{[�7.��+� �Y�"M�8���PK�.���3���2n�/]�G ��}(�Veq��*)8bi ����[A(��!�
�G����? c�� 7m�i�g�u���[�� ���z+b ��G ���H�QA�M+��NW�!�vA}CY��6�6��lÙJ��E/Y�[�n�4m�jBӯ|O� p4��~��i)���o@����hF�a��/-�mI�'��1����Ӑ�K$OgfW E�!����#�P�d����W#e�ml�h�q���T"���:��
:�$��y���s^��|���P/��l��˿�&鱦+`�hD<�YȨxs���}r�C�7S<\漆��f��91o��0%� C @6s���2�U�Ҹ���^xf�p�=[���ž�ݶU�� �cXVPg
K�����5��~k{���M�[�:b�s&�B ����|�`�5��A
�Ԍ{����Jg&4$�� ��*G[�Y�R22x�5;��)�Q��]���d��oM��%Cx��om$W�T�u����X-��4"y�f�-y�h� ���L��HPT8�GK��x��s�`f7�).��8_̫�� �:jP۲{�m���I��8�fbfo.�?]�_��W4S?����MIm�ۏI��-uT#83 vآ#�R�h�~М����y]D�w�?���8yvfI�I�f3/D��[�;�P�#Ǐ��`���듮Z��7� ��qTv����4!^Ӑ����~I �{�� �v�r ���Q����ߎ
ɖ��x�
#�y��ƹ�>KJ �C��r�%�n������ĥU�UNZ���n
�{��z��=���Lsa�̲��J`�Y-���I��/. Dm���d��+���/A
�M�����3Ӌ̌�1Oa�u^@h�
�-_<$b�y�1�M|�K������m*n �d�0� �����)d@w"�K��̕��#��Gf�`o��I�A-玐XDg�
�y-����E��Lm��a����1}(S%�`��0B��AԞ�f��v-���sʯ���&,k� �ԱHj�����������%��>̋���wkbcY���CM��'��u�x��:�� ������5,��0v�h �X( �
�д�F����ϊ����\u��Ծ�MF����by�/�CSP:��p�"dwǢo�r|W�f F~ļE�Ќ9������2��[x����嬣��F����; ���ae3�D���B>q��W��$��u��u������(8 �� ���Tml�G� ���.X��'�:����S\��I� ��� �e�t���+�Nn��-�i��
�r��v[�T�h٫�edf��6r���b��:�2�� ����"6�FGA۟��I�[ݷ����铞� 2=����ZL�Q��9,~�
Name
Size
41KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
17KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
1024B
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
8KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
202KB
Virtual Size
7.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=24, id=171, productName=VS2010 build 30319, version=30319,
count=13, id=158, productName=VS2010 build 30319, version=30319,
count=59, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31104,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=16, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
random/random.exe
- IMPHASH c4540f421523fe2dc591e50be5ad7d0b
- SHA256 749b3f520c92d562330c4f8ce1632933917969d82cdc4fd6293ca2f465d47603
- MD5 65596da80c64cf01a226b19835385b52
- SHA1 4adf4690332eea67d1de16b1eb9196ac4911c93d
- SHA512 ae06264269320aa41216f699bdfb6c0b79f9d030c57372e140ffc6d93a5dfdfd7c41bc0a8e7e4d25823bc9a190e655865f135da049416be2eed912de0dbaed2b
- SSDEEP 24576:kqDEvCTbMWu7rQYlBQcBiT6rprG8aLC2Sbly7TWEPje:kTvC/MTQYxsWR7aLC2dW
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132471
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
gethostbyname
recv
send
socket
inet_ntoa
setsockopt
ntohs
WSACleanup
WSAStartup
sendto
htons
__WSAFDIsSet
select
accept
listen
bind
inet_addr
ioctlsocket
recvfrom
WSAGetLastError
closesocket
gethostname
connect
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create
mpr
WNetGetConnectionW
WNetCancelConnection2W
WNetUseConnectionW
WNetAddConnection2W
wininet
HttpOpenRequestW
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
InternetConnectW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpSendEcho
IcmpCloseHandle
IcmpCreateFile
userenv
DestroyEnvironmentBlock
LoadUserProfileW
CreateEnvironmentBlock
UnloadUserProfile
uxtheme
IsThemeActive
kernel32
DuplicateHandle
CreateThread
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetShortPathNameW
DeleteFileW
IsDebuggerPresent
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
LoadResource
LockResource
SizeofResource
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
LoadLibraryW
GetLocalTime
CompareStringW
GetCurrentThread
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
VirtualAlloc
GetCurrentDirectoryW
lstrcmpiW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
CloseHandle
GetFullPathNameW
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
ExitProcess
GetModuleHandleExW
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetACP
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetStringTypeW
GetFileType
SetStdHandle
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetCurrentDirectoryW
FindNextFileW
WriteConsoleW
user32
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
PeekMessageW
GetInputState
UnregisterHotKey
CharLowerBuffW
MonitorFromPoint
MonitorFromRect
LoadImageW
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
ClientToScreen
GetCursorPos
DeleteMenu
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
SystemParametersInfoW
LockWindowUpdate
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
RegisterHotKey
GetCursorInfo
SetWindowPos
CopyImage
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
TrackPopupMenuEx
GetMessageW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
DispatchMessageW
keybd_event
TranslateMessage
ScreenToClient
gdi32
EndPath
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
GetDeviceCaps
SetPixel
CloseFigure
LineTo
AngleArc
MoveToEx
Ellipse
CreateCompatibleBitmap
CreateCompatibleDC
PolyDraw
BeginPath
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
SelectObject
StretchBlt
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
CreateDCW
GetPixel
DeleteDC
GetDIBits
StrokePath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
RegCreateKeyExW
GetSecurityDescriptorDacl
GetAclInformation
GetUserNameW
AddAce
SetSecurityDescriptorDacl
InitiateSystemShutdownExW
shell32
DragFinish
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
CreateStdDispatch
CreateDispTypeInfo
UnRegisterTypeLi
UnRegisterTypeLibForUser
RegisterTypeLibForUser
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
VariantChangeType
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SafeArrayCreateVector
SysStringLen
QueryPathOfRegTypeLi
SysAllocString
VariantInit
VariantClear
DispCallFunc
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
SafeArrayDestroyDescriptor
VariantCopy
OleLoadPicture
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
323KB
Virtual Size
322KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
streamer.exe
- IMPHASH 5929190c8765f5bc37b052ab5c6c53e7
- SHA256 b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2
- MD5 9635389d4492a1bb338d7467cc79a84f
- SHA1 5bf4e06b683c07b6b59da041bc81fdc0e2accf5c
- SHA512 106e536e589a4f76176ea5ecb564f46b6f6d1dda2bf33431fff682a3b2ef8fd4df11b6101118f52e14bb46ea2469697ac5738be07fc97fae28c7ec41dbaa5508
- SSDEEP 49152:ZadqSJa0AzAku0pfKEae72f9tMcf3gBXkjV5Eh/GRJcwq7lSv5TG11kA:IbJa0AFjk5E8a1D
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
5312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddAtomA
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateMutexA
CreateSemaphoreA
CreateThread
CreateWaitableTimerExW
DeleteAtom
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FindAtomA
FormatMessageA
FreeEnvironmentStringsW
GetAtomNameA
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetHandleInformation
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RaiseFailFastException
ReleaseMutex
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetLastError
SetProcessAffinityMask
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_beginthreadex
_cexit
_commode
_endthreadex
_errno
_fmode
_initterm
_lock
_memccpy
_onexit
_setjmp
_strdup
_ultoa
_unlock
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
longjmp
malloc
memcpy
memmove
memset
printf
realloc
signal
strerror
strlen
strncmp
vfprintf
wcslen
_cgo_dummy_export
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
175KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
207KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
tuman.exe
- SHA256 f085c6c04bb96f24fdbf974025a25ca0baaf01093996d5b8be8f4b03045892c2
- MD5 f320a471da179c2cdb8f920a58d5a49e
- SHA1 c0587747ea1f01591f56df772436487759a56cb3
- SHA512 392f7e1c70ef8445b85d08e554b220b25e228939ecaac90cb55f91a12b826b153cc0ffc0f1a1946a2cca878242080c62a6e64d86cba220deff0012cdd765886e
- SSDEEP 49152:ua+frLou6hg9lGyMJt6ygLSfhJCddlHBf2RwrLfKIlN:efr8hclGS+JkdlHMwnf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12504240
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
���ê�d eG���
Z���L�qRO��1�����nZ��:;�\4+C��"m�K��up��V����MO��w�؝�����RP6�e+u�x#8l`+0^K����=�i��+_}�!��`���.j��p:�2cN�/��Ep9 }k�sw���J��~3���^��^�Ɏ��ݲ
�1澝3�ͽzh����c����=�C��<���]��m�`N/�CH#Fk���� ip_���)�;m�����_9fy�T�\7�����\R�
���@�M�Xlzɽ�'������f9� ~�RH��v6�*z����<C�U�i0�� eN����8����|40��1���Sy�)�)��y���������z3@�-�*�Co:z�6��hJ6����QQ!-]%Z�7�rA_���-P��g�I�V���H�S�ǚ�\��A�A�{�(�,���/�*9 � ž{���ah�?���i���r/���d�Q���$�����ˀ�`��A���i��61�:W5�7t�Y ��xe������L�Xu���)!�3�����o�������ȭ����Ͽ?���9���x��R�
������6�N �m�
�q�㋡
�p�������L��G�y
�f�g:&"kQH�{`]�[^��-�`�� �����2:d�8�.o��Y�5Yr3Ό�#]���5�{�0-)�ibt{�����^*i0�MzoP���K,:��/$]��쒞Ae���w�}Z�Uh���߂�*'�`-�ʰs"��j�V
� X+%)� ��b>�����YC!�WC�<�wQ��
<��+ Z�Od�� !�PE)�;)���m IT�n�^٢ ��z@�4���-��W�j�iP��%�rid_ٴwݖ����]�
����s������:��O#�
�=<�3(Ƕ�r��C*�Ν:���y�C�� =?R�A�ǣf�A}<�
�ȇ�=�����`��B�� ��0��QId�Ģ�gB�1�Bm�`璅{��r �Z��4ca ��#$r��`j�B!`�*���Ws{��`����@ud�P�I��%�@�+�s���AУ�ZʻlV+�� F���Y7*s2����N�r���!�s��z�ȑ�Yt��rRtĜ �ߘ|��i:ܔ�͖��*?:۱(�x.O'-a�����H%h�=ƙ����E����y-|��L^�Ǣ�6lk���NO P\.�ޟ���ġ��Qh����bǛ�b��
=-�R��#n冖S��f\$ ��dz[c M�6�����ո��(�2I'Di��ٿ������ ��)4r�.�]����t��L6J���/P ��kuq~$�:
a�C"�&���42.��UvP� �u��Q;n;�Ŗ$/�<���j��q��̒�wXxv�jI"� mzR74]�Xw� �o9F����` x#�9�J-~�x�kf ��,y� X*�:Q��T�)Љ�������8������r�֞�0����Y)>G�&�<ؑ_��83��o�)� ��F�@ԯa��Ϊ�� M
����=�+� ܿ�T�H��kEπǍk��&ͪ3����<�Z*�e��y D��퉥�|�|������ ���W��HsBl��-�w&
���עM�E�� ������1���T�|G���� �6qs�qSS1��!��=�͢Y��Fb8��\�
6
D�&e-����{F���۹��I� uO��{��"�Q���##>�Hw0��SYy��a� U�#"�}� ��<ŕd�U�M�Uz�"�U�0����`;n�BA��M����PR$s�J)�3Tu H��j���2��iXe�C ����)��X�X�c)� �>u��q��������9��^g�WFsL��AjX����Y �I� dy!����uJ�Ʉ������㍴���`b1���km�������Ѧ��U� �V<X�"i�,\�B��B��-/n�t�S L���%��`����@�i�(ˆ���0��;43��e�Gdz��Й��[C��R�bzLW��Pk|%]��/X�����>s<�����X 5��Wz�E�y��~ ��=(�� F��Q �@k�ܔ^��.���b�,��'eUOL���CӡZ��hvqخ���$L�r��
�(�
?F[������Q��vL�x��!=Sd? 1� ���3hS��+�ʕ ��4��m.q����xk~]��� �, qA���#p�� f^���nIoT�O����&�7ȡ[��0:���S��o K;M%z���
��Ȕ����aɥ/ }��@#CÑօL��,����PG�f�Cr
�¯Е�ѹ6���A�n�:�� Nu�� �%�T�<*]�ڝ8C@�k���2�7=H���Y��B�u�G��t�
�Mg�#�uo�'A��!1�B:�>��'Ɯ!�hG ����Ow*�W�{[�7.��+� �Y�"M�8���PK�.���3���2n�/]�G ��}(�Veq��*)8bi ����[A(��!�
�G����? c�� 7m�i�g�u���[�� ���z+b ��G ���H�QA�M+��NW�!�vA}CY��6�6��lÙJ��E/Y�[�n�4m�jBӯ|O� p4��~��i)���o@����hF�a��/-�mI�'��1����Ӑ�K$OgfW E�!����#�P�d����W#e�ml�h�q���T"���:��
:�$��y���s^��|���P/��l��˿�&鱦+`�hD<�YȨxs���}r�C�7S<\漆��f��91o��0%� C @6s���2�U�Ҹ���^xf�p�=[���ž�ݶU�� �cXVPg
K�����5��~k{���M�[�:b�s&�B ����|�`�5��A
�Ԍ{����Jg&4$�� ��*G[�Y�R22x�5;��)�Q��]���d��oM��%Cx��om$W�T�u����X-��4"y�f�-y�h� ���L��HPT8�GK��x��s�`f7�).��8_̫�� �:jP۲{�m���I��8�fbfo.�?]�_��W4S?����MIm�ۏI��-uT#83 vآ#�R�h�~М����y]D�w�?���8yvfI�I�f3/D��[�;�P�#Ǐ��`���듮Z��7� ��qTv����4!^Ӑ����~I �{�� �v�r ���Q����ߎ
ɖ��x�
#�y��ƹ�>KJ �C��r�%�n������ĥU�UNZ���n
�{��z��=���Lsa�̲��J`�Y-���I��/. Dm���d��+���/A
�M�����3Ӌ̌�1Oa�u^@h�
�-_<$b�y�1�M|�K������m*n �d�0� �����)d@w"�K��̕��#��Gf�`o��I�A-玐XDg�
�y-����E��Lm��a����1}(S%�`��0B��AԞ�f��v-���sʯ���&,k� �ԱHj�����������%��>̋���wkbcY���CM��'��u�x��:�� ������5,��0v�h �X( �
�д�F����ϊ����\u��Ծ�MF����by�/�CSP:��p�"dwǢo�r|W�f F~ļE�Ќ9������2��[x����嬣��F����; ���ae3�D���B>q��W��$��u��u������(8 �� ���Tml�G� ���.X��'�:����S\��I� ��� �e�t���+�Nn��-�i��
�r��v[�T�h٫�edf��6r���b��:�2�� ����"6�FGA۟��I�[ݷ����铞� 2=����ZL�Q��9,~�
Name
Size
41KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
17KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
1024B
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
8KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
202KB
Virtual Size
7.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=24, id=171, productName=VS2010 build 30319, version=30319,
count=13, id=158, productName=VS2010 build 30319, version=30319,
count=59, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31104,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=16, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,