byfron-01a570a3cd0a46f2[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

byfron-01a570a3cd0a46f2.zip
Size

23.6MB
MD5

f37e9fe25f88bee86e868c8796ba7624
SHA1

b8b0f2969f70ac8656ca082cb4206fd1eb83ee9e
SHA256

4932535e1109fad42425fc977e09c9743b5aa904a7161b8600b4a989532d3974
SHA512

6b0238be58859276c1f3ad99e5b38642b0c5d92b4b86f6010c10590c568b5bc0b0559a8524993e587844d8f3652dbfdbf841039cc2f781905250b5d65acab5fe
SSDEEP

393216:MZwPobA50pfTb7dQyftimFEH9ALcVxq1+TtIiFg0VQxh6uUlI6uUlT:MZwPoXpfP7Gmtim62aq1QtI6yCICT

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/byfron-01a570a3cd0a46f2/CelestialLLC.exe	pyinstaller

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/byfron-01a570a3cd0a46f2/CelestialLLC.exe
unpack001/byfron-01a570a3cd0a46f2/driver.dll

Files

byfron-01a570a3cd0a46f2.zip
.zip
byfron-01a570a3cd0a46f2/Celestial/Analysis-00.toc
byfron-01a570a3cd0a46f2/Celestial/Celestial.pkg
byfron-01a570a3cd0a46f2/Celestial/EXE-00.toc
byfron-01a570a3cd0a46f2/Celestial/PKG-00.toc
byfron-01a570a3cd0a46f2/Celestial/PYZ-00.pyz
byfron-01a570a3cd0a46f2/Celestial/PYZ-00.toc
byfron-01a570a3cd0a46f2/Celestial/base_library.zip
.zip
_collections_abc.pyc
_weakrefset.pyc
abc.pyc
codecs.pyc
collections/__init__.pyc
collections/abc.pyc
copyreg.pyc
encodings/__init__.pyc
encodings/aliases.pyc
encodings/ascii.pyc
encodings/base64_codec.pyc
encodings/big5.pyc
encodings/big5hkscs.pyc
encodings/bz2_codec.pyc
encodings/charmap.pyc
encodings/cp037.pyc
encodings/cp1006.pyc
encodings/cp1026.pyc
encodings/cp1125.pyc
encodings/cp1140.pyc
encodings/cp1250.pyc
encodings/cp1251.pyc
encodings/cp1252.pyc
encodings/cp1253.pyc
encodings/cp1254.pyc
encodings/cp1255.pyc
encodings/cp1256.pyc
encodings/cp1257.pyc
encodings/cp1258.pyc
encodings/cp273.pyc
encodings/cp424.pyc
encodings/cp437.pyc
encodings/cp500.pyc
encodings/cp720.pyc
encodings/cp737.pyc
encodings/cp775.pyc
encodings/cp850.pyc
encodings/cp852.pyc
encodings/cp855.pyc
encodings/cp856.pyc
encodings/cp857.pyc
encodings/cp858.pyc
encodings/cp860.pyc
encodings/cp861.pyc
encodings/cp862.pyc
encodings/cp863.pyc
encodings/cp864.pyc
encodings/cp865.pyc
encodings/cp866.pyc
encodings/cp869.pyc
encodings/cp874.pyc
encodings/cp875.pyc
encodings/cp932.pyc
encodings/cp949.pyc
encodings/cp950.pyc
encodings/euc_jis_2004.pyc
encodings/euc_jisx0213.pyc
encodings/euc_jp.pyc
encodings/euc_kr.pyc
encodings/gb18030.pyc
encodings/gb2312.pyc
encodings/gbk.pyc
encodings/hex_codec.pyc
encodings/hp_roman8.pyc
encodings/hz.pyc
encodings/idna.pyc
encodings/iso2022_jp.pyc
encodings/iso2022_jp_1.pyc
encodings/iso2022_jp_2.pyc
encodings/iso2022_jp_2004.pyc
encodings/iso2022_jp_3.pyc
encodings/iso2022_jp_ext.pyc
encodings/iso2022_kr.pyc
encodings/iso8859_1.pyc
encodings/iso8859_10.pyc
encodings/iso8859_11.pyc
encodings/iso8859_13.pyc
encodings/iso8859_14.pyc
encodings/iso8859_15.pyc
encodings/iso8859_16.pyc
encodings/iso8859_2.pyc
encodings/iso8859_3.pyc
encodings/iso8859_4.pyc
encodings/iso8859_5.pyc
encodings/iso8859_6.pyc
encodings/iso8859_7.pyc
encodings/iso8859_8.pyc
encodings/iso8859_9.pyc
encodings/johab.pyc
encodings/koi8_r.pyc
encodings/koi8_t.pyc
encodings/koi8_u.pyc
encodings/kz1048.pyc
encodings/latin_1.pyc
encodings/mac_arabic.pyc
encodings/mac_croatian.pyc
encodings/mac_cyrillic.pyc
encodings/mac_farsi.pyc
encodings/mac_greek.pyc
encodings/mac_iceland.pyc
encodings/mac_latin2.pyc
encodings/mac_roman.pyc
encodings/mac_romanian.pyc
encodings/mac_turkish.pyc
encodings/mbcs.pyc
encodings/oem.pyc
encodings/palmos.pyc
encodings/ptcp154.pyc
encodings/punycode.pyc
encodings/quopri_codec.pyc
encodings/raw_unicode_escape.pyc
encodings/rot_13.pyc
encodings/shift_jis.pyc
encodings/shift_jis_2004.pyc
encodings/shift_jisx0213.pyc
encodings/tis_620.pyc
encodings/undefined.pyc
encodings/unicode_escape.pyc
encodings/utf_16.pyc
encodings/utf_16_be.pyc
encodings/utf_16_le.pyc
encodings/utf_32.pyc
encodings/utf_32_be.pyc
encodings/utf_32_le.pyc
encodings/utf_7.pyc
encodings/utf_8.pyc
encodings/utf_8_sig.pyc
encodings/uu_codec.pyc
encodings/zlib_codec.pyc
enum.pyc
functools.pyc
genericpath.pyc
heapq.pyc
io.pyc
keyword.pyc
linecache.pyc
locale.pyc
ntpath.pyc
operator.pyc
os.pyc
posixpath.pyc
re/__init__.pyc
re/_casefix.pyc
re/_compiler.pyc
re/_constants.pyc
re/_parser.pyc
reprlib.pyc
sre_compile.pyc
sre_constants.pyc
sre_parse.pyc
stat.pyc
traceback.pyc
types.pyc
warnings.pyc
weakref.pyc
byfron-01a570a3cd0a46f2/Celestial/localpycs/pyimod01_archive.pyc
byfron-01a570a3cd0a46f2/Celestial/localpycs/pyimod02_importers.pyc
byfron-01a570a3cd0a46f2/Celestial/localpycs/pyimod03_ctypes.pyc
byfron-01a570a3cd0a46f2/Celestial/localpycs/pyimod04_pywin32.pyc
byfron-01a570a3cd0a46f2/Celestial/localpycs/struct.pyc
byfron-01a570a3cd0a46f2/CelestialLLC.exe
.exe windows:6 windows x86 arch:x86

ec4c6449b24c9d32ab43eca7a329e0d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CreateWindowExW
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongW
GetWindowLongW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW

comctl32

ord380

kernel32

GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
GetLastError
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
WaitForSingleObject
Sleep
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
UnhandledExceptionFilter
DecodePointer
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
CompareStringW
LCMapStringW

advapi32

OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

gdi32

SelectObject
DeleteObject
CreateFontIndirectW

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Stub.pyc
byfron-01a570a3cd0a46f2/driver.dll
.dll windows:5 windows x86 arch:x86

b3c4ec8f87c32b67ea2b2518da9a465c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

getsockname
inet_ntoa
htons
ntohs
WSAAddressToStringA
WSARecvFrom
WSASendTo
listen
WSAStartup
WSADuplicateSocketA
setsockopt
closesocket
WSACloseEvent
WSASetEvent
WSACreateEvent
WSAResetEvent
WSAWaitForMultipleEvents
WSAIoctl
WSAGetLastError
bind
WSASocketA

mswsock

TransmitFile
GetAcceptExSockaddrs
AcceptEx

secur32

DecryptMessage
AcquireCredentialsHandleA
FreeCredentialsHandle
EncryptMessage
FreeContextBuffer
QueryContextAttributesA
AcceptSecurityContext

crypt32

CertOpenStore
CertFindCertificateInStore

kernel32

GetConsoleMode
GetConsoleCP
HeapSize
GetLocaleInfoA
GetStringTypeW
SetStdHandle
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTimeZoneInformation
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
GetStringTypeA
WriteConsoleA
GetConsoleOutputCP
GetLastError
PostQueuedCompletionStatus
CreateIoCompletionPort
SetFilePointerEx
WriteFile
ReadFile
CloseHandle
GetCurrentProcessId
CreateFileA
GetProcAddress
LoadLibraryA
GetFileAttributesExA
GetFileAttributesA
GetTempPathA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
RaiseException
GetExitCodeThread
SetWaitableTimer
CancelWaitableTimer
SetEvent
CreateEventA
WaitForMultipleObjects
CreateWaitableTimerA
FormatMessageA
LocalFree
CancelIo
WriteConsoleW
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
GetQueuedCompletionStatus
HeapFree
SetEnvironmentVariableA
HeapAlloc
HeapReAlloc
GetModuleHandleW
Sleep
ExitProcess
GetSystemTimeAsFileTime
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
RtlUnwind

advapi32

CryptDestroyHash
CryptCreateHash
CryptGenRandom
CryptAcquireContextA
CryptGetHashParam
CryptHashData

Exports

Exports

??0Address@Lacewing@@QAE@AAU01@@Z
??0Address@Lacewing@@QAE@PBD0H@Z
??0Address@Lacewing@@QAE@PBDHH@Z
??0Client@Lacewing@@QAE@AAUPump@1@@Z
??0Error@Lacewing@@QAE@XZ
??0Event@Lacewing@@QAE@XZ
??0EventPump@Lacewing@@QAE@H@Z
??0FDStream@Lacewing@@QAE@AAUPump@1@@Z
??0File@Lacewing@@QAE@AAUPump@1@@Z
??0File@Lacewing@@QAE@AAUPump@1@PBD1@Z
??0Filter@Lacewing@@QAE@AAU01@@Z
??0Filter@Lacewing@@QAE@XZ
??0FlashPolicy@Lacewing@@QAE@AAUPump@1@@Z
??0Lock@Sync@Lacewing@@QAE@AAU12@@Z
??0Pipe@Lacewing@@QAE@AAUPump@1@@Z
??0Pipe@Lacewing@@QAE@XZ
??0Pump@Lacewing@@QAE@XZ
??0Request@Webserver@Lacewing@@QAE@AAUPump@2@@Z
??0Server@Lacewing@@QAE@AAUPump@1@@Z
??0Stream@Lacewing@@QAE@AAUPump@1@@Z
??0Stream@Lacewing@@QAE@XZ
??0Sync@Lacewing@@QAE@XZ
??0Thread@Lacewing@@QAE@PBDPAX@Z
??0Timer@Lacewing@@QAE@AAUPump@1@@Z
??0UDP@Lacewing@@QAE@AAUPump@1@@Z
??0Webserver@Lacewing@@QAE@AAUPump@1@@Z
??1Address@Lacewing@@QAE@XZ
??1Client@Lacewing@@UAE@XZ
??1Error@Lacewing@@QAE@XZ
??1Event@Lacewing@@QAE@XZ
??1EventPump@Lacewing@@UAE@XZ
??1FDStream@Lacewing@@UAE@XZ
??1File@Lacewing@@UAE@XZ
??1Filter@Lacewing@@QAE@XZ
??1FlashPolicy@Lacewing@@QAE@XZ
??1Lock@Sync@Lacewing@@QAE@XZ
??1Pipe@Lacewing@@UAE@XZ
??1Pump@Lacewing@@UAE@XZ
??1Request@Webserver@Lacewing@@UAE@XZ
??1Server@Lacewing@@QAE@XZ
??1Stream@Lacewing@@UAE@XZ
??1Sync@Lacewing@@QAE@XZ
??1Thread@Lacewing@@QAE@XZ
??1Timer@Lacewing@@QAE@XZ
??1UDP@Lacewing@@QAE@XZ
??1Webserver@Lacewing@@QAE@XZ
??8Address@Lacewing@@QAE_NAAU01@@Z
??9Address@Lacewing@@QAE_NAAU01@@Z
??BAddress@Lacewing@@QAEPBDXZ
??BError@Lacewing@@QAEPBDXZ
??_FEventPump@Lacewing@@QAEXXZ
?Add@Error@Lacewing@@QAAXPBDZZ
?Add@Error@Lacewing@@QAEXH@Z
?Add@Error@Lacewing@@QAEXPBDPAD@Z
?Add@EventPump@Lacewing@@UAEPAUWatch@Pump@2@PAX0P6AX0PAU_OVERLAPPED@@IH@Z@Z
?AddFilterDownstream@Stream@Lacewing@@QAEXAAU12@_N1@Z
?AddFilterUpstream@Stream@Lacewing@@QAEXAAU12@_N1@Z
?AddHandlerClose@Stream@Lacewing@@QAEXP6AXAAU12@PAX@Z1@Z
?AddHandlerData@Stream@Lacewing@@QAEXP6AXAAU12@PAXPBDI@Z1@Z
?AddHeader@Request@Webserver@Lacewing@@QAEXPBD0@Z
?AddNPN@Server@Lacewing@@QAEXPBD@Z
?AddUser@Pump@Lacewing@@QAEXXZ
?BeginQueue@Stream@Lacewing@@QAEXXZ
?Body@Request@Webserver@Lacewing@@QAEPBDXZ
?BytesLeft@FDStream@Lacewing@@UAEIXZ
?BytesLeft@Stream@Lacewing@@UAEIXZ
?CanNPN@Server@Lacewing@@QAE_NXZ
?Cast@FDStream@Lacewing@@UAEPAXPAX@Z
?Cast@Stream@Lacewing@@UAEPAXPAX@Z
?CertificateLoaded@Server@Lacewing@@QAE_NXZ
?CertificateLoaded@Webserver@Lacewing@@QAE_NXZ
?ClientCount@Server@Lacewing@@QAEHXZ
?Clone@Error@Lacewing@@QAEPAU12@XZ
?Close@FDStream@Lacewing@@QAEXXZ
?Close@Stream@Lacewing@@QAEXXZ
?CloseSession@Request@Webserver@Lacewing@@QAEXXZ
?CloseSession@Webserver@Lacewing@@QAEXPBD@Z
?Connect@Client@Lacewing@@QAEXAAUAddress@2@@Z
?Connect@Client@Lacewing@@QAEXPBDH@Z
?Connected@Client@Lacewing@@QAE_NXZ
?Connecting@Client@Lacewing@@QAE_NXZ
?Cookie@Request@Webserver@Lacewing@@QAEPBDPBD@Z
?Cookie@Request@Webserver@Lacewing@@QAEXPBD00@Z
?Cookie@Request@Webserver@Lacewing@@QAEXPBD0@Z
?Cork@FDStream@Lacewing@@QAEXXZ
?Data@Stream@Lacewing@@IAEXPBDI@Z
?DisableCache@Request@Webserver@Lacewing@@QAEXXZ
?Disconnect@Request@Webserver@Lacewing@@QAEXXZ
?EnableManualRequestFinish@Webserver@Lacewing@@QAEXXZ
?EndQueue@Stream@Lacewing@@QAEXHPAPBDPAI@Z
?EndQueue@Stream@Lacewing@@QAEXXZ
?Filename@Upload@Webserver@Lacewing@@QAEPBDXZ
?Finish@Request@Webserver@Lacewing@@QAEXXZ
?FirstClient@Server@Lacewing@@QAEPAUClient@12@XZ
?FirstCookie@Request@Webserver@Lacewing@@QAEPAUCookie@123@XZ
?FirstHeader@Request@Webserver@Lacewing@@QAEPAUHeader@123@XZ
?FirstHeader@Upload@Webserver@Lacewing@@QAEPAUHeader@123@XZ
?FirstSessionItem@Request@Webserver@Lacewing@@QAEPAUSessionItem@123@XZ
?ForceTick@Timer@Lacewing@@QAEXXZ
?FormElementName@Upload@Webserver@Lacewing@@QAEPBDXZ
?GET@Request@Webserver@Lacewing@@QAEPAUParameter@123@XZ
?GET@Request@Webserver@Lacewing@@QAEPBDPBD@Z
?GetAddress@Client@Server@Lacewing@@QAEAAUAddress@3@XZ
?GetAddress@Request@Webserver@Lacewing@@QAEAAUAddress@3@XZ
?GetAutoSaveFilename@Upload@Webserver@Lacewing@@QAEPBDXZ
?GuessMimeType@Request@Webserver@Lacewing@@QAEXPBD@Z
?Header@Request@Webserver@Lacewing@@QAEPBDPBD@Z
?Header@Request@Webserver@Lacewing@@QAEXPBD0@Z
?Header@Upload@Webserver@Lacewing@@QAEPBDPBD@Z
?Host@FlashPolicy@Lacewing@@QAEXPBD@Z
?Host@FlashPolicy@Lacewing@@QAEXPBDAAUFilter@2@@Z
?Host@Server@Lacewing@@QAEXAAUFilter@2@@Z
?Host@Server@Lacewing@@QAEXH@Z
?Host@UDP@Lacewing@@QAEXAAUAddress@2@@Z
?Host@UDP@Lacewing@@QAEXAAUFilter@2@@Z
?Host@UDP@Lacewing@@QAEXH@Z
?Host@Webserver@Lacewing@@QAEXAAUFilter@2@@Z
?Host@Webserver@Lacewing@@QAEXH@Z
?HostSecure@Webserver@Lacewing@@QAEXAAUFilter@2@@Z
?HostSecure@Webserver@Lacewing@@QAEXH@Z
?Hosting@FlashPolicy@Lacewing@@QAE_NXZ
?Hosting@Server@Lacewing@@QAE_NXZ
?Hosting@UDP@Lacewing@@QAE_NXZ
?Hosting@Webserver@Lacewing@@QAE_NXZ
?HostingSecure@Webserver@Lacewing@@QAE_NXZ
?Hostname@Request@Webserver@Lacewing@@QAEPBDXZ
?IPv6@Address@Lacewing@@QAE_NXZ
?IPv6@Filter@Lacewing@@QAEX_N@Z
?IPv6@Filter@Lacewing@@QAE_NXZ
?IdleTimeout@Request@Webserver@Lacewing@@QAEHXZ
?IdleTimeout@Request@Webserver@Lacewing@@QAEXH@Z
?IdleTimeout@Webserver@Lacewing@@QAEHXZ
?IdleTimeout@Webserver@Lacewing@@QAEXH@Z
?InUse@Pump@Lacewing@@QAE_NXZ
?IsEventPump@EventPump@Lacewing@@UAE_NXZ
?IsEventPump@Pump@Lacewing@@UAE_NXZ
?IsTransparent@Pipe@Lacewing@@UAE_NXZ
?IsTransparent@Stream@Lacewing@@UAE_NXZ
?Join@Thread@Lacewing@@QAEHXZ
?LastModified@Request@Webserver@Lacewing@@QAEX_J@Z
?LastModified@Request@Webserver@Lacewing@@QAE_JXZ
?LoadCertificateFile@Server@Lacewing@@QAE_NPBD0@Z
?LoadCertificateFile@Webserver@Lacewing@@QAE_NPBD0@Z
?LoadSystemCertificate@Server@Lacewing@@QAE_NPBD00@Z
?LoadSystemCertificate@Webserver@Lacewing@@QAE_NPBD00@Z
?Local@Filter@Lacewing@@QAEPAUAddress@2@XZ
?Local@Filter@Lacewing@@QAEXPAUAddress@2@@Z
?LocalPort@Filter@Lacewing@@QAEHXZ
?LocalPort@Filter@Lacewing@@QAEXH@Z
?Nagle@FDStream@Lacewing@@QAEX_N@Z
?Name@Cookie@Request@Webserver@Lacewing@@QAEPBDXZ
?Name@File@Lacewing@@QAEPBDXZ
?Name@Header@Request@Webserver@Lacewing@@QAEPBDXZ
?Name@Header@Upload@Webserver@Lacewing@@QAEPBDXZ
?Name@Parameter@Request@Webserver@Lacewing@@QAEPBDXZ
?Name@SessionItem@Request@Webserver@Lacewing@@QAEPBDXZ
?Next@Client@Server@Lacewing@@QAEPAU123@XZ
?Next@Cookie@Request@Webserver@Lacewing@@QAEPAU1234@XZ
?Next@Header@Request@Webserver@Lacewing@@QAEPAU1234@XZ
?Next@Header@Upload@Webserver@Lacewing@@QAEPAU1234@XZ
?Next@Parameter@Request@Webserver@Lacewing@@QAEPAU1234@XZ
?Next@SessionItem@Request@Webserver@Lacewing@@QAEPAU1234@XZ
?Open@File@Lacewing@@QAE_NPBD0@Z
?OpenTemp@File@Lacewing@@QAE_NXZ
?POST@Request@Webserver@Lacewing@@QAEPAUParameter@123@XZ
?POST@Request@Webserver@Lacewing@@QAEPBDPBD@Z
?Port@Address@Lacewing@@QAEHXZ
?Port@Address@Lacewing@@QAEXH@Z
?Port@Server@Lacewing@@QAEHXZ
?Port@UDP@Lacewing@@QAEHXZ
?Port@Webserver@Lacewing@@QAEHXZ
?Post@EventPump@Lacewing@@UAEXPAX0@Z
?PostEventLoopExit@EventPump@Lacewing@@QAEXXZ
?Put@FDStream@Lacewing@@MAEIAAUStream@2@I@Z
?Put@FDStream@Lacewing@@MAEIPBDI@Z
?Put@Pipe@Lacewing@@UAEIPBDI@Z
?Put@Stream@Lacewing@@MAEIAAU12@I@Z
?Queued@Stream@Lacewing@@QAEIXZ
?Read@FDStream@Lacewing@@UAEXI@Z
?Read@Stream@Lacewing@@UAEXI@Z
?Ready@Address@Lacewing@@QAE_NXZ
?Release@Lock@Sync@Lacewing@@QAEXXZ
?Remote@Filter@Lacewing@@QAEPAUAddress@2@XZ
?Remote@Filter@Lacewing@@QAEXPAUAddress@2@@Z
?RemotePort@Filter@Lacewing@@QAEHXZ
?RemotePort@Filter@Lacewing@@QAEXH@Z
?Remove@EventPump@Lacewing@@UAEXPAUWatch@Pump@2@@Z
?RemoveHandlerClose@Stream@Lacewing@@QAEXP6AXAAU12@PAX@Z1@Z
?RemoveHandlerData@Stream@Lacewing@@QAEXP6AXAAU12@PAXPBDI@Z1@Z
?RemoveUser@Pump@Lacewing@@QAEXXZ
?Resolve@Address@Lacewing@@QAEPAUError@2@XZ
?Retry@Stream@Lacewing@@MAEXH@Z
?Reuse@Filter@Lacewing@@QAEX_N@Z
?Reuse@Filter@Lacewing@@QAE_NXZ
?Secure@Request@Webserver@Lacewing@@QAE_NXZ
?SecurePort@Webserver@Lacewing@@QAEHXZ
?ServerAddress@Client@Lacewing@@QAEAAUAddress@2@XZ
?Session@Request@Webserver@Lacewing@@QAEPBDPBD@Z
?Session@Request@Webserver@Lacewing@@QAEPBDXZ
?Session@Request@Webserver@Lacewing@@QAEXPBD0@Z
?SetAutoSave@Upload@Webserver@Lacewing@@QAEXXZ
?SetFD@FDStream@Lacewing@@QAEXPAXPAUWatch@Pump@2@_N@Z
?SetMimeType@Request@Webserver@Lacewing@@QAEXPBD0@Z
?SetRedirect@Request@Webserver@Lacewing@@QAEXPBD@Z
?SetUnmodified@Request@Webserver@Lacewing@@QAEXXZ
?Signal@Event@Lacewing@@QAEXXZ
?Signalled@Event@Lacewing@@QAE_NXZ
?Size@Error@Lacewing@@QAEHXZ
?Start@Thread@Lacewing@@QAEXPAX@Z
?Start@Timer@Lacewing@@QAEXH@Z
?StartEventLoop@EventPump@Lacewing@@QAEPAUError@2@XZ
?StartSleepyTicking@EventPump@Lacewing@@QAEPAUError@2@P6AXAAU12@@Z@Z
?Started@Thread@Lacewing@@QAE_NXZ
?Started@Timer@Lacewing@@QAE_NXZ
?Status@Request@Webserver@Lacewing@@QAEXHPBD@Z
?Stop@Timer@Lacewing@@QAEXXZ
?Tick@EventPump@Lacewing@@QAEPAUError@2@XZ
?ToString@Address@Lacewing@@QAEPBDXZ
?ToString@Error@Lacewing@@QAEPBDXZ
?URL@Request@Webserver@Lacewing@@QAEPBDXZ
?Uncork@FDStream@Lacewing@@QAEXXZ
?Unhost@FlashPolicy@Lacewing@@QAEXXZ
?Unhost@Server@Lacewing@@QAEXXZ
?Unhost@UDP@Lacewing@@QAEXXZ
?Unhost@Webserver@Lacewing@@QAEXXZ
?UnhostSecure@Webserver@Lacewing@@QAEXXZ
?Unsignal@Event@Lacewing@@QAEXXZ
?UpdateCallbacks@EventPump@Lacewing@@UAEXPAUWatch@Pump@2@PAXP6AX1PAU_OVERLAPPED@@IH@Z@Z
?Valid@FDStream@Lacewing@@QAE_NXZ
?Value@Cookie@Request@Webserver@Lacewing@@QAEPBDXZ
?Value@Header@Request@Webserver@Lacewing@@QAEPBDXZ
?Value@Header@Upload@Webserver@Lacewing@@QAEPBDXZ
?Value@Parameter@Request@Webserver@Lacewing@@QAEPBDXZ
?Value@SessionItem@Request@Webserver@Lacewing@@QAEPBDXZ
?Wait@Event@Lacewing@@QAE_NH@Z
?Write@Stream@Lacewing@@QAEXAAU12@I_N@Z
?Write@Stream@Lacewing@@QAEXPBDI@Z
?Write@UDP@Lacewing@@QAEXAAUAddress@2@PBDI@Z
?WriteFile@Stream@Lacewing@@QAEXPBD@Z
?WritePartial@Stream@Lacewing@@QAEIPBDI@Z
?onConnect@Client@Lacewing@@QAEXP6AXAAU12@@Z@Z
?onConnect@Server@Lacewing@@QAEXP6AXAAU12@AAUClient@12@@Z@Z
?onDisconnect@Client@Lacewing@@QAEXP6AXAAU12@@Z@Z
?onDisconnect@Server@Lacewing@@QAEXP6AXAAU12@AAUClient@12@@Z@Z
?onDisconnect@Webserver@Lacewing@@QAEXP6AXAAU12@AAURequest@12@@Z@Z
?onError@Client@Lacewing@@QAEXP6AXAAU12@AAUError@2@@Z@Z
?onError@FlashPolicy@Lacewing@@QAEXP6AXAAU12@AAUError@2@@Z@Z
?onError@Server@Lacewing@@QAEXP6AXAAU12@AAUError@2@@Z@Z
?onError@UDP@Lacewing@@QAEXP6AXAAU12@AAUError@2@@Z@Z
?onError@Webserver@Lacewing@@QAEXP6AXAAU12@AAUError@2@@Z@Z
?onGet@Webserver@Lacewing@@QAEXP6AXAAU12@AAURequest@12@@Z@Z
?onHead@Webserver@Lacewing@@QAEXP6AXAAU12@AAURequest@12@@Z@Z
?onPost@Webserver@Lacewing@@QAEXP6AXAAU12@AAURequest@12@@Z@Z
?onReceive@Client@Lacewing@@QAEXP6AXAAU12@PBDI@Z@Z
?onReceive@Server@Lacewing@@QAEXP6AXAAU12@AAUClient@12@PBDI@Z@Z
?onReceive@UDP@Lacewing@@QAEXP6AXAAU12@AAUAddress@2@PADI@Z@Z
?onTick@Timer@Lacewing@@QAEXP6AXAAU12@@Z@Z
?onUploadChunk@Webserver@Lacewing@@QAEXP6AXAAU12@AAURequest@12@AAUUpload@12@PBDI@Z@Z
?onUploadDone@Webserver@Lacewing@@QAEXP6AXAAU12@AAURequest@12@AAUUpload@12@@Z@Z
?onUploadPost@Webserver@Lacewing@@QAEXP6AXAAU12@AAURequest@12@QAPAUUpload@12@H@Z@Z
?onUploadStart@Webserver@Lacewing@@QAEXP6AXAAU12@AAURequest@12@AAUUpload@12@@Z@Z
lw_addr_copy
lw_addr_delete
lw_addr_is_equal
lw_addr_is_ipv6
lw_addr_is_ready
lw_addr_new
lw_addr_new_ex
lw_addr_new_port
lw_addr_new_port_ex
lw_addr_port
lw_addr_set_port
lw_client_connect
lw_client_connect_addr
lw_client_connected
lw_client_connecting
lw_client_new
lw_client_onconnect
lw_client_ondisconnect
lw_client_onerror
lw_client_onreceive
lw_client_server_addr
lw_dump
lw_error_add
lw_error_addf
lw_error_clone
lw_error_delete
lw_error_new
lw_error_tostring
lw_fdstream_cork
lw_fdstream_nagle
lw_fdstream_new
lw_fdstream_set_fd
lw_fdstream_uncork
lw_file_exists
lw_file_new
lw_file_open
lw_file_open_new
lw_file_size
lw_filter_copy
lw_filter_delete
lw_filter_get_local
lw_filter_get_local_port
lw_filter_get_remote
lw_filter_get_remote_port
lw_filter_is_ipv6
lw_filter_is_reuse_set
lw_filter_new
lw_filter_set_ipv6
lw_filter_set_local
lw_filter_set_local_port
lw_filter_set_remote
lw_filter_set_remote_port
lw_flashpolicy_delete
lw_flashpolicy_host
lw_flashpolicy_host_filter
lw_flashpolicy_hosting
lw_flashpolicy_new
lw_flashpolicy_onerror
lw_flashpolicy_unhost
lw_guess_mime_type
lw_md5
lw_md5_hex
lw_path_exists
lw_pipe_new
lw_pipe_new_pump
lw_pump_add
lw_pump_add_user
lw_pump_delete
lw_pump_in_use
lw_pump_is_eventpump
lw_pump_post
lw_pump_remove
lw_pump_remove_user
lw_pump_update_callbacks
lw_random
lw_server_cert_loaded
lw_server_client_address
lw_server_client_next
lw_server_delete
lw_server_host
lw_server_host_filter
lw_server_hosting
lw_server_load_cert_file
lw_server_load_sys_cert
lw_server_new
lw_server_onconnect
lw_server_ondisconnect
lw_server_onerror
lw_server_onreceive
lw_server_port
lw_server_unhost
lw_sha1
lw_sha1_hex
lw_stream_add_filter_downstream
lw_stream_add_filter_upstream
lw_stream_add_handler_data
lw_stream_begin_queue
lw_stream_bytes_left
lw_stream_cast
lw_stream_close
lw_stream_end_queue
lw_stream_is_transparent
lw_stream_queued
lw_stream_read
lw_stream_remove_handler_data
lw_stream_write
lw_stream_write_file
lw_stream_write_partial
lw_stream_write_stream
lw_stream_write_text
lw_stream_writef
lw_sync_delete
lw_sync_lock_delete
lw_sync_lock_new
lw_sync_lock_release
lw_sync_new
lw_temp_path
lw_thread_delete
lw_thread_join
lw_thread_new
lw_thread_start
lw_thread_started
lw_timer_delete
lw_timer_force_tick
lw_timer_ontick
lw_timer_start
lw_timer_stop
lw_udp_delete
lw_udp_host
lw_udp_host_addr
lw_udp_host_filter
lw_udp_hosting
lw_udp_new
lw_udp_onerror
lw_udp_onreceive
lw_udp_port
lw_udp_unhost
lw_version
lw_ws_cert_loaded
lw_ws_close_session
lw_ws_delete
lw_ws_enable_manual_finish
lw_ws_host
lw_ws_host_filter
lw_ws_host_secure
lw_ws_host_secure_filter
lw_ws_hosting
lw_ws_hosting_secure
lw_ws_idle_timeout
lw_ws_load_cert_file
lw_ws_load_sys_cert
lw_ws_new
lw_ws_ondisconnect
lw_ws_onerror
lw_ws_onget
lw_ws_onhead
lw_ws_onpost
lw_ws_port
lw_ws_port_secure
lw_ws_req_GET
lw_ws_req_POST
lw_ws_req_addr
lw_ws_req_cookie_name
lw_ws_req_cookie_next
lw_ws_req_cookie_value
lw_ws_req_disable_cache
lw_ws_req_disconnect
lw_ws_req_finish
lw_ws_req_first_GET
lw_ws_req_first_POST
lw_ws_req_first_cookie
lw_ws_req_first_header
lw_ws_req_first_session_item
lw_ws_req_get_cookie
lw_ws_req_guess_mime_type
lw_ws_req_hdr_name
lw_ws_req_hdr_next
lw_ws_req_hdr_value
lw_ws_req_header
lw_ws_req_hostname
lw_ws_req_idle_timeout
lw_ws_req_last_modified
lw_ws_req_param_name
lw_ws_req_param_next
lw_ws_req_param_value
lw_ws_req_secure
lw_ws_req_session_close
lw_ws_req_session_id
lw_ws_req_session_read
lw_ws_req_session_write
lw_ws_req_set_cookie
lw_ws_req_set_cookie_ex
lw_ws_req_set_header
lw_ws_req_set_idle_timeout
lw_ws_req_set_last_modified
lw_ws_req_set_mime_type
lw_ws_req_set_mime_type_ex
lw_ws_req_set_redirect
lw_ws_req_set_status
lw_ws_req_set_unmodified
lw_ws_req_ssnitem_name
lw_ws_req_ssnitem_next
lw_ws_req_ssnitem_value
lw_ws_req_url
lw_ws_set_idle_timeout
lw_ws_unhost
lw_ws_unhost_secure
lw_ws_upload_autosave_fname
lw_ws_upload_filename
lw_ws_upload_form_el_name
lw_ws_upload_hdr_name
lw_ws_upload_hdr_next
lw_ws_upload_hdr_value
lw_ws_upload_header
lw_ws_upload_set_autosave

Sections

.text
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
byfron-01a570a3cd0a46f2/mapper.dll
.dll windows:5 windows x86 arch:x86

5271d5ce8b44dd47bc92563e27585466

Code Sign

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07-09-2016 17:58

Not After

07-09-2018 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-08-2016 20:17

Not After

02-11-2017 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b7:57:d3:aa:6a:54:e7:ef:5a:aa:a9:8b:bd:dc:73:ca:1b:d1:ce:ec
Signer

Actual PE Digest

b7:57:d3:aa:6a:54:e7:ef:5a:aa:a9:8b:bd:dc:73:ca:1b:d1:ce:ec

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msvcr100.i386.pdb

Imports

kernel32

EncodePointer
DecodePointer
RaiseException
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetCurrentThreadId
TlsGetValue
GetCommandLineW
GetCommandLineA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
FindNextFileA
FindFirstFileExA
FindClose
FindNextFileW
FindFirstFileExW
GetLogicalDrives
GetDiskFreeSpaceA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetErrorMode
Sleep
Beep
GetFileAttributesA
SetFileAttributesA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFullPathNameA
GetDriveTypeW
GetCurrentProcessId
CreateDirectoryA
MoveFileA
RemoveDirectoryA
GetDriveTypeA
DeleteFileA
GetFileAttributesW
SetEnvironmentVariableW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
MoveFileW
RemoveDirectoryW
DeleteFileW
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
LoadLibraryA
FreeLibrary
CreateProcessW
ReadFile
DuplicateHandle
GetCurrentProcess
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetLocalTime
WideCharToMultiByte
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetLocalTime
InterlockedPopEntrySList
InterlockedFlushSList
QueryDepthSList
InterlockedPushEntrySList
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueTimer
SetEvent
CreateEventW
SwitchToThread
SignalObjectAndWait
TryEnterCriticalSection
GetTickCount
VirtualFree
GetVersionExW
SetThreadPriority
VirtualAlloc
GetSystemInfo
GetProcessAffinityMask
VirtualProtect
SetThreadAffinityMask
InitializeSListHead
ReleaseSemaphore
CreateSemaphoreW
WaitForMultipleObjects
GetThreadPriority
LoadLibraryW
SleepEx
OutputDebugStringW
FreeLibraryAndExitThread
GetModuleHandleA
GetThreadTimes
DebugBreak
MultiByteToWideChar
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
GetTimeFormatW
GetDateFormatW
RtlUnwind
HeapAlloc
HeapFree
HeapCreate
HeapDestroy
HeapQueryInformation
HeapReAlloc
HeapSize
HeapValidate
HeapCompact
HeapWalk
VirtualQuery
SetHandleCount
GetFileType
GetStartupInfoW
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
CreateFileW
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CreatePipe
SetStdHandle
ReadConsoleInputA
SetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
WriteConsoleW
ReadConsoleW
SetEndOfFile
GetProcessHeap
InterlockedExchange
LockFile
UnlockFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
SetConsoleCtrlHandler
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
LCMapStringW
CompareStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsProcessorFeaturePresent

Exports

Exports

$I10_OUTPUT
??0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
??0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
??0SchedulerPolicy@Concurrency@@QAA@IZZ
??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z
??0SchedulerPolicy@Concurrency@@QAE@XZ
??0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_ReaderWriterLock@details@Concurrency@@QAE@XZ
??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_ReentrantLock@details@Concurrency@@QAE@XZ
??0_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_SpinLock@details@Concurrency@@QAE@ACJ@Z
??0_TaskCollection@details@Concurrency@@QAE@XZ
??0_Timer@details@Concurrency@@IAE@I_N@Z
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0__non_rtti_object@std@@QAE@PBD@Z
??0bad_cast@std@@AAE@PBQBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@XZ
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@XZ
??0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z
??0context_unblock_unbalanced@Concurrency@@QAE@XZ
??0critical_section@Concurrency@@QAE@XZ
??0default_scheduler_exists@Concurrency@@QAE@PBD@Z
??0default_scheduler_exists@Concurrency@@QAE@XZ
??0event@Concurrency@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??0improper_lock@Concurrency@@QAE@PBD@Z
??0improper_lock@Concurrency@@QAE@XZ
??0improper_scheduler_attach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_attach@Concurrency@@QAE@XZ
??0improper_scheduler_detach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_detach@Concurrency@@QAE@XZ
??0improper_scheduler_reference@Concurrency@@QAE@PBD@Z
??0improper_scheduler_reference@Concurrency@@QAE@XZ
??0invalid_link_target@Concurrency@@QAE@PBD@Z
??0invalid_link_target@Concurrency@@QAE@XZ
??0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z
??0invalid_multiple_scheduling@Concurrency@@QAE@XZ
??0invalid_operation@Concurrency@@QAE@PBD@Z
??0invalid_operation@Concurrency@@QAE@XZ
??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z
??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_value@Concurrency@@QAE@XZ
??0message_not_found@Concurrency@@QAE@PBD@Z
??0message_not_found@Concurrency@@QAE@XZ
??0missing_wait@Concurrency@@QAE@PBD@Z
??0missing_wait@Concurrency@@QAE@XZ
??0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z
??0nested_scheduler_missing_detach@Concurrency@@QAE@XZ
??0operation_timed_out@Concurrency@@QAE@PBD@Z
??0operation_timed_out@Concurrency@@QAE@XZ
??0reader_writer_lock@Concurrency@@QAE@XZ
??0scheduler_not_attached@Concurrency@@QAE@PBD@Z
??0scheduler_not_attached@Concurrency@@QAE@XZ
??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z
??0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z
??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z
??0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0task_canceled@details@Concurrency@@QAE@PBD@Z
??0task_canceled@details@Concurrency@@QAE@XZ
??0unsupported_os@Concurrency@@QAE@PBD@Z
??0unsupported_os@Concurrency@@QAE@XZ
??1SchedulerPolicy@Concurrency@@QAE@XZ
??1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_SpinLock@details@Concurrency@@QAE@XZ
??1_TaskCollection@details@Concurrency@@QAE@XZ
??1_Timer@details@Concurrency@@IAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1critical_section@Concurrency@@QAE@XZ
??1event@Concurrency@@QAE@XZ
??1exception@std@@UAE@XZ
??1reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock@critical_section@Concurrency@@QAE@XZ
??1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z
??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z
??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@@6B@
??_7exception@std@@6B@
??_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ
??_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?Alloc@Concurrency@@YAPAXI@Z
?Block@Context@Concurrency@@SAXXZ
?Create@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?Create@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z
?CreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ
?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ
?CurrentContext@Context@Concurrency@@SAPAV12@XZ
?Detach@CurrentScheduler@Concurrency@@SAXXZ
?DisableTracing@Concurrency@@YAJXZ
?EnableTracing@Concurrency@@YAJXZ
?Free@Concurrency@@YAXPAX@Z
?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ
?GetExecutionContextId@Concurrency@@YAIXZ
?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ
?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ
?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ
?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z
?GetProcessorCount@Concurrency@@YAIXZ
?GetProcessorNodeCount@Concurrency@@YAIXZ
?GetSchedulerId@Concurrency@@YAIXZ
?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ
?Id@Context@Concurrency@@SAIXZ
?Id@CurrentScheduler@Concurrency@@SAIXZ
?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ
?Log2@details@Concurrency@@YAKI@Z
?Oversubscribe@Context@Concurrency@@SAX_N@Z
?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z
?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ
?ScheduleGroupId@Context@Concurrency@@SAIXZ
?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z
?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z
?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z
?VirtualProcessorId@Context@Concurrency@@SAIXZ
?Yield@Context@Concurrency@@SAXXZ
?_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ
?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ
?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ
?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ
?_ConcRT_Assert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_DumpMessage@details@Concurrency@@YAXPB_WZZ
?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ
?_Copy_str@exception@std@@AAEXPBD@Z
?_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ
?_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ
?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ
?_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ
?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z
?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z
?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ
?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ
?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ
?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ
?_SpinYield@Context@Concurrency@@SAXXZ
?_Start@_Timer@details@Concurrency@@IAEXXZ
?_Stop@_Timer@details@Concurrency@@IAEXXZ
?_Tidy@exception@std@@AAEXXZ
?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z
?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ
?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_UnderlyingYield@details@Concurrency@@YAXXZ
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_Value@_SpinCount@details@Concurrency@@SAIXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCompare@@YA_NPBX0@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZH@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBEHABV1@@Z
?get_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ
?lock@critical_section@Concurrency@@QAEXXZ
?lock@reader_writer_lock@Concurrency@@QAEXXZ
?lock_read@reader_writer_lock@Concurrency@@QAEXXZ
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?native_handle@critical_section@Concurrency@@QAEAAV12@XZ
?raw_name@type_info@@QBEPBDXZ
?reset@event@Concurrency@@QAEXXZ
?set@event@Concurrency@@QAEXXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?try_lock@critical_section@Concurrency@@QAE_NXZ
?try_lock@reader_writer_lock@Concurrency@@QAE_NXZ
?try_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ
?unexpected@@YAXXZ
?unlock@critical_section@Concurrency@@QAEXXZ
?unlock@reader_writer_lock@Concurrency@@QAEXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?wait@Concurrency@@YAXI@Z
?wait@event@Concurrency@@QAEII@Z
?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z
?what@exception@std@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_Strftime
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindStdDelDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___fls_getvalue@4
___fls_setvalue@8
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__set_flsgetvalue
__setlc_active
__setusermatherr
__strncnt
__swprintf_l
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__unDNameHelper
__uncaught_exception
__unguarded_readlc_active
__vswprintf_l
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_amsg_exit
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_crt
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_commode
_configthreadlocale
_control87
_controlfp
_controlfp_s
_copysign
_cprintf
_cprintf_l
_cprintf_p

Sections

.text
Size: 709KB - Virtual size: 708KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
byfron-01a570a3cd0a46f2/version.txt

Sharing

General

Malware Config

Signatures

Files

ec4c6449b24c9d32ab43eca7a329e0d7

Headers

DLL Characteristics

File Characteristics

Imports

user32

comctl32

kernel32

advapi32

gdi32

Sections

.text Size: 150KB - Virtual size: 149KB

.rdata Size: 53KB - Virtual size: 53KB

.data Size: 3KB - Virtual size: 26KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 7KB - Virtual size: 7KB

b3c4ec8f87c32b67ea2b2518da9a465c

Headers

File Characteristics

Imports

ws2_32

mswsock

secur32

crypt32

kernel32

advapi32

Exports

Exports

Sections

.text Size: 139KB - Virtual size: 138KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 10KB - Virtual size: 10KB

5271d5ce8b44dd47bc92563e27585466

Code Sign

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:caCertificate

Extended Key Usages

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

b7:57:d3:aa:6a:54:e7:ef:5a:aa:a9:8b:bd:dc:73:ca:1b:d1:ce:ecSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 709KB - Virtual size: 708KB

.data Size: 19KB - Virtual size: 22KB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 19KB - Virtual size: 19KB

.text
Size: 150KB - Virtual size: 149KB

.rdata
Size: 53KB - Virtual size: 53KB

.data
Size: 3KB - Virtual size: 26KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 7KB - Virtual size: 7KB

.text
Size: 139KB - Virtual size: 138KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 10KB - Virtual size: 10KB

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca
Certificate

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

b7:57:d3:aa:6a:54:e7:ef:5a:aa:a9:8b:bd:dc:73:ca:1b:d1:ce:ec
Signer

.text
Size: 709KB - Virtual size: 708KB

.data
Size: 19KB - Virtual size: 22KB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 19KB - Virtual size: 19KB