C:\Users\RBM\Desktop\BYAPSS\SAM C++\examples\example_win32_directx11\Release\SAM CHEAT.pdb
Overview
overview
10Static
static
10SAM CHEAT bypass.exe
windows7-x64
10SAM CHEAT bypass.exe
windows10-2004-x64
10Realtek HD...ce.exe
windows7-x64
10Realtek HD...ce.exe
windows10-2004-x64
10SAM CHEAT bypass.exe
windows7-x64
1SAM CHEAT bypass.exe
windows10-2004-x64
1Windows Sh...st.exe
windows7-x64
10Windows Sh...st.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
SAM CHEAT bypass.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
SAM CHEAT bypass.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Realtek HD Audio Universal Service.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Realtek HD Audio Universal Service.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
SAM CHEAT bypass.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
SAM CHEAT bypass.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Windows Shell Experience Host.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Windows Shell Experience Host.exe
Resource
win10v2004-20241007-en
General
-
Target
SAM CHEAT bypass.exe
-
Size
762KB
-
MD5
5dde6a5017cbb35cf1710069cf9be274
-
SHA1
a2bb6090abf23364d36210c6fc8ac2c28f8234d2
-
SHA256
83b5438b0b9aebf778440dcb77eb52b0231133487bdb3b372a91523505ab63c2
-
SHA512
c7584c7feb4a90feb330a4c0a7e13ca1e785bea150873f30d61f420d6c917e9cd24f69fcb9acf2fe5b8aa1218abb6ea6f0ca1e76d01a8c70bcf95dffe279031b
-
SSDEEP
12288:5MsLc8V26+8XwREFqAgkRnQWTCoA8JmxfBdEAMjAaDvxCxRc:5MsAT89FDL6oLmhYDjXD4Rc
Malware Config
Extracted
xworm
147.185.221.23:58112
-
Install_directory
%AppData%
-
install_file
Realtek HD Audio Universal Service.exe
Extracted
xworm
5.0
147.185.221.20:65300
RMe1pa1UgjNcB2Un
-
Install_directory
%AppData%
-
install_file
Windows Shell Experience Host.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule static1/unpack001/Realtek HD Audio Universal Service.exe family_xworm static1/unpack001/Windows Shell Experience Host.exe family_xworm -
Xworm family
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource SAM CHEAT bypass.exe unpack001/Realtek HD Audio Universal Service.exe unpack001/SAM CHEAT bypass.exe unpack001/Windows Shell Experience Host.exe -
NSIS installer 2 IoCs
resource yara_rule sample nsis_installer_1 sample nsis_installer_2
Files
-
SAM CHEAT bypass.exe.exe windows:4 windows x86 arch:x86
29b61e5a552b3a9bc00953de1c93be41
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFileAttributesA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CompareFileTime
SearchPathA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
CreateDirectoryA
lstrcmpiA
GetCommandLineA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
LoadLibraryA
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
WaitForSingleObject
GetWindowsDirectoryA
GetTempPathA
GetProcAddress
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
WriteFile
MulDiv
LoadLibraryExA
GetModuleHandleA
MultiByteToWideChar
FreeLibrary
user32
GetWindowRect
EnableMenuItem
GetSystemMenu
ScreenToClient
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetForegroundWindow
PostQuitMessage
RegisterClassA
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
OpenClipboard
TrackPopupMenu
SendMessageTimeoutA
GetDC
LoadImageA
GetDlgItem
FindWindowExA
IsWindow
SetClipboardData
SetWindowLongA
EmptyClipboard
SetTimer
CreateDialogParamA
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegDeleteValueA
SetFileSecurityA
RegOpenKeyExA
RegDeleteKeyA
RegEnumValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_Destroy
ord17
ImageList_AddMasked
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Realtek HD Audio Universal Service.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
SAM CHEAT bypass.exe.exe windows:6 windows x64 arch:x64
fa42aa5fa812ffc9e36433ab24913f3a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
ole32
CoCreateInstance
CoUninitialize
CoInitialize
kernel32
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
VirtualProtect
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
QueryFullProcessImageNameW
SetLastError
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
GetCurrentThreadId
GetLocaleInfoEx
FindClose
FindFirstFileW
GetFileAttributesExW
GetTickCount
VirtualFreeEx
CreateRemoteThread
WinExec
LocalFree
VirtualAllocEx
Beep
GetThreadContext
CreateThread
GetSystemInfo
Process32Next
GetCurrentThread
Sleep
HeapDestroy
OpenProcess
SetFileInformationByHandle
HeapAlloc
HeapReAlloc
HeapFree
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
ReadFile
CheckRemoteDebuggerPresent
PeekNamedPipe
CreateFileW
GetLastError
ReleaseMutex
CloseHandle
GetCurrentProcessId
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WakeAllConditionVariable
GetFileInformationByHandleEx
GetModuleFileNameA
Process32First
GetCurrentProcess
OutputDebugStringA
VirtualAlloc
TerminateProcess
CreateMutexA
WaitForSingleObject
AreFileApisANSI
HeapSize
VirtualQueryEx
IsDebuggerPresent
CreateToolhelp32Snapshot
AllocConsole
user32
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
GetClipboardData
ScreenToClient
LoadCursorA
GetKeyState
UpdateWindow
FindWindowA
PostQuitMessage
PeekMessageA
LoadIconA
TranslateMessage
GetClientRect
DefWindowProcA
MoveWindow
MessageBoxA
SetWindowDisplayAffinity
GetWindowLongA
SetWindowLongA
SetClipboardData
IsWindowUnicode
GetAsyncKeyState
ShowWindow
GetActiveWindow
RegisterClassExW
UnregisterClassW
GetSystemMetrics
CreateWindowExW
SetWindowRgn
DestroyWindow
GetWindowRect
DispatchMessageA
ReleaseCapture
SetCursorPos
GetCursorPos
EmptyClipboard
CloseClipboard
OpenClipboard
SetLayeredWindowAttributes
gdi32
CreateRoundRectRgn
advapi32
SetSecurityInfo
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
GetTokenInformation
AddAccessAllowedAce
GetLengthSid
InitializeAcl
IsValidSid
CopySid
CryptAcquireContextA
OpenProcessToken
ConvertSidToStringSidA
CryptReleaseContext
shell32
ShellExecuteW
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
_Thrd_detach
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Winerror_map@std@@YAHH@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Xtime_get_ticks
_Query_perf_counter
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Syserror_map@std@@YAPEBDH@Z
imm32
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
ntdll
NtRaiseHardError
RtlVirtualUnwind
RtlCaptureContext
RtlAdjustPrivilege
RtlLookupFunctionEntry
urlmon
URLDownloadToFileA
winmm
sndPlaySoundA
shlwapi
PathFileExistsA
normaliz
IdnToAscii
wldap32
ord217
ord143
ord200
ord30
ord79
ord35
ord301
ord50
ord46
ord32
ord211
ord27
ord26
ord22
ord60
ord45
ord33
ord41
crypt32
CertCloseStore
CertEnumCertificatesInStore
CryptDecodeObjectEx
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
ws2_32
WSACleanup
bind
WSAStartup
accept
WSAIoctl
WSASetLastError
WSAGetLastError
htonl
listen
ioctlsocket
socket
setsockopt
ntohs
__WSAFDIsSet
htons
select
getsockopt
getsockname
getaddrinfo
getpeername
freeaddrinfo
connect
recvfrom
closesocket
recv
send
sendto
gethostname
ntohl
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
strchr
_CxxThrowException
memchr
memcmp
memset
memcpy
memmove
strrchr
__current_exception
__current_exception_context
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__p__commode
fread
_lseeki64
fwrite
fflush
_read
feof
fputs
fopen
_set_fmode
fclose
_write
_close
_open
__stdio_common_vsprintf
_popen
_pclose
fgets
__acrt_iob_func
ftell
fputc
fsetpos
ungetc
fseek
__stdio_common_vsscanf
setvbuf
fgetpos
fgetwc
_fseeki64
fgetc
__stdio_common_vfprintf
ungetwc
fputwc
_wfopen
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-string-l1-1-0
tolower
strpbrk
strncpy
strcmp
strncmp
strcspn
strspn
isupper
_strdup
_stricmp
api-ms-win-crt-heap-l1-1-0
free
_callnewh
calloc
_msize
realloc
malloc
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
strerror
_errno
terminate
__sys_nerr
_invalid_parameter_noinfo
system
_resetstkoflw
_beginthreadex
_getpid
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_c_exit
_wassert
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
abort
exit
api-ms-win-crt-convert-l1-1-0
atoi
strtod
strtol
strtoll
strtoul
strtoull
api-ms-win-crt-time-l1-1-0
_time64
strftime
_gmtime64
_localtime64
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_unlink
_access
_lock_file
_unlock_file
_stat64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
powf
sinf
fmodf
cosf
__setusermatherr
atan2f
acosf
sqrtf
ceilf
Sections
.text Size: 799KB - Virtual size: 798KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 194KB - Virtual size: 194KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 298KB - Virtual size: 456KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Windows Shell Experience Host.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ