TaxOrganizer24[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

TaxOrganizer24.zip
Size

5.9MB
MD5

81c362ea018f73aabf713791db7e734c
SHA1

0869b217f896fa70d64d8279b1a5796e80db2ae9
SHA256

c1411695a46008567ed81c474298a6cade2e743d50019acb46407ed66cb11b0e
SHA512

24ae50861b8f3b1d89bc94c98a1a53225656c1e85b22e14f1a8b9932a141a5e6d5e15af43eb326b7c17e4e02987f59f56022a326486ab862fa034b531b2192d1
SSDEEP

98304:tb4xcxSmyr32LKxqtjv0j7TctNVCkkvHY+9BlWUQQzS/c30E+WSNfRlXOt7U5E9U:tbacxryroKgtjvAPctNbSHY+9rWUQQzS

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/libcrypto-1_1-x64.dll
unpack001/libcurl-4.dll
unpack001/libiconv-2.dll
unpack001/libintl-8.dll
unpack001/libpcre2-8-0.dll
unpack001/libssp-0.dll
unpack001/msvcp144.dll
unpack001/zlib1.dll

Files

TaxOrganizer24.zip
.zip
TaxOrganizer24.exe
.exe windows:4 windows x64 arch:x64

319a2b3f0fb7a912b54f60d0468581ad

Code Sign

97:0f:49:6d:c0:43:82:b6:cc:56:7e:83:75:54:0f:17
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-12-2019 00:00

Not After

05-06-2020 23:59

Subject

CN=Johannes Schindelin,O=Johannes Schindelin,POSTALCODE=50968,STREET=Raderberger Str. 178,L=Cologne,ST=Northrhine-Westphalia,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

01-02-2010 00:00

Not After

18-01-2038 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-05-2019 00:00

Not After

01-08-2030 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

42:98:5f:41:f8:bc:69:40:3d:e7:b5:ca:67:10:c2:d5:68:60:5c:0d:94:c3:02:82:38:53:5d:d6:ba:2e:a4:00
Signer

Actual PE Digest

42:98:5f:41:f8:bc:69:40:3d:e7:b5:ca:67:10:c2:d5:68:60:5c:0d:94:c3:02:82:38:53:5d:d6:ba:2e:a4:00

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\1\s\git-sdk-64-makepkg-git\usr\src\MINGW-packages\mingw-w64-git\src\git\git-fast-import.pdb

Imports

libiconv-2

libiconv
libiconv_close
libiconv_open

libintl-8

__printf__
libintl_bind_textdomain_codeset
libintl_bindtextdomain
libintl_fprintf
libintl_gettext
libintl_ngettext
libintl_setlocale
libintl_snprintf
libintl_textdomain
libintl_vfprintf
libintl_vprintf
libintl_vsnprintf

libpcre2-8-0

pcre2_code_free_8
pcre2_compile_8
pcre2_compile_context_create_8
pcre2_compile_context_free_8
pcre2_config_8
pcre2_general_context_create_8
pcre2_general_context_free_8
pcre2_get_error_message_8
pcre2_get_ovector_pointer_8
pcre2_jit_compile_8
pcre2_jit_match_8
pcre2_maketables_8
pcre2_match_8
pcre2_match_data_create_from_pattern_8
pcre2_match_data_free_8
pcre2_pattern_info_8
pcre2_set_character_tables_8

zlib1

crc32
deflate
deflateBound
deflateEnd
deflateInit2_
deflateInit_
inflate
inflateEnd
inflateInit2_
inflateInit_

advapi32

GetUserNameW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

CloseHandle
CopyFileW
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreateNamedPipeW
CreatePipe
CreateProcessW
CreateRemoteThread
CreateSymbolicLinkW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DeviceIoControl
DisconnectNamedPipe
DuplicateHandle
EnterCriticalSection
ExitThread
FillConsoleOutputCharacterA
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetHandleInformation
GetLastError
GetLongPathNameW
GetModuleHandleA
GetModuleHandleW
GetNumberOfConsoleInputEvents
GetProcAddress
GetProcessHeap
GetProcessId
GetStartupInfoW
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetVersion
GetVolumeInformationW
HeapAlloc
HeapFree
InitializeCriticalSection
InitializeProcThreadAttributeList
IsDebuggerPresent
IsWow64Process
LeaveCriticalSection
LoadLibraryExA
MapViewOfFileEx
MoveFileExW
OpenProcess
PeekConsoleInputA
PeekNamedPipe
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleTextAttribute
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SleepEx
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
UpdateProcThreadAttribute
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW

msvcrt

__C_specific_handler
___mb_cur_max_func
__iob_func
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_assert
_beginthreadex
_cexit
_commit
_commode
_close
_dup
_dup2
_errno
_fdopen
_fileno
_fileno
_flushall
_fmode
_get_osfhandle
_getpid
_gmtime64
_initterm
_isatty
_localtime64
_lseeki64
_mktime64
_onexit
_open_osfhandle
_read
_setmode
_stricmp
_strnicmp
_strnicmp
_strnicmp
_telli64
_time64
_vsnwprintf
_waccess
_wchdir
_wchmod
_wcmdln
_wcsnicmp
_wcsnicmp
_wfopen
_wfreopen
_wmkdir
_wmktemp
_wopen
_wpgmptr
_write
_wrmdir
_wunlink
abort
atoi
bsearch
exit
fclose
feof
ferror
fflush
fgetc
fgets
fprintf
fputc
fputs
fread
fseek
ftell
fwrite
getc
getchar
getenv
isalnum
isalpha
iscntrl
isgraph
islower
isprint
ispunct
isspace
isupper
iswctype
isxdigit
memchr
memcmp
memcpy
memmove
memset
perror
putc
putchar
puts
raise
rand
setvbuf
signal
srand
sscanf
strchr
strcmp
strcspn
strerror
strftime
strlen
strncmp
strpbrk
strrchr
strspn
strstr
strtol
strtoul
tolower
toupper
ungetc
vfprintf
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncmp
wcsstr
wcstombs

ntdll

NtQueryDirectoryFile
NtQueryObject

user32

DispatchMessageA
MsgWaitForMultipleObjects
PeekMessageA
TranslateMessage

ws2_32

WSACleanup
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSASetLastError
WSASocketA
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
gethostname
getnameinfo
htons
listen
ntohs
recv
select
setsockopt
shutdown

libssp-0

__stack_chk_fail
__stack_chk_guard

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 751KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug
Size: 156B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
libcrypto-1_1-x64.dll
.dll windows:4 windows x64 arch:x64

90700b4f180f212b87c3cb73550ba6c3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\1\s\git-sdk-64\usr\src\MINGW-packages\mingw-w64-openssl\src\build-x86_64\libcrypto-1_1-x64.pdb

Imports

advapi32

CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
DeregisterEventSource
RegisterEventSourceA
RegisterEventSourceW
ReportEventA
ReportEventW

kernel32

CloseHandle
ConvertFiberToThread
ConvertThreadToFiber
CreateFiber
DeleteCriticalSection
DeleteFiber
EnterCriticalSection
FindClose
FindFirstFileW
FindNextFileW
FormatMessageW
FreeLibrary
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableW
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetStdHandle
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetVersion
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
QueryPerformanceCounter
ReadConsoleA
ReadConsoleW
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleMode
SetLastError
SetUnhandledExceptionFilter
Sleep
SwitchToFiber
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile

msvcrt

__iob_func
_amsg_exit
_chmod
_close
_errno
_exit
_fileno
_fstat64
_gmtime64
_initterm
_lock
_lseek
_onexit
_read
_setmode
_stat64
_strdup
_strdup
_stricmp
_strnicmp
_time64
_unlock
_vsnprintf
_vsnwprintf
_wfopen
_write
abort
atoi
calloc
clearerr
fclose
feof
ferror
fflush
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getenv
isspace
malloc
memchr
memcmp
memcpy
memmove
memset
perror
qsort
raise
realloc
setbuf
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strrchr
strspn
strstr
strtol
strtoul
vfprintf
wcscpy
wcsstr

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

ws2_32

WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
getnameinfo
getsockname
getsockopt
ioctlsocket
listen
ntohs
recv
recvfrom
send
sendto
setsockopt
shutdown
socket

Exports

Exports

ACCESS_DESCRIPTION_free
ACCESS_DESCRIPTION_it
ACCESS_DESCRIPTION_new
ADMISSIONS_free
ADMISSIONS_get0_admissionAuthority
ADMISSIONS_get0_namingAuthority
ADMISSIONS_get0_professionInfos
ADMISSIONS_it
ADMISSIONS_new
ADMISSIONS_set0_admissionAuthority
ADMISSIONS_set0_namingAuthority
ADMISSIONS_set0_professionInfos
ADMISSION_SYNTAX_free
ADMISSION_SYNTAX_get0_admissionAuthority
ADMISSION_SYNTAX_get0_contentsOfAdmissions
ADMISSION_SYNTAX_it
ADMISSION_SYNTAX_new
ADMISSION_SYNTAX_set0_admissionAuthority
ADMISSION_SYNTAX_set0_contentsOfAdmissions
AES_bi_ige_encrypt
AES_cbc_encrypt
AES_cfb128_encrypt
AES_cfb1_encrypt
AES_cfb8_encrypt
AES_decrypt
AES_ecb_encrypt
AES_encrypt
AES_ige_encrypt
AES_ofb128_encrypt
AES_options
AES_set_decrypt_key
AES_set_encrypt_key
AES_unwrap_key
AES_wrap_key
ASIdOrRange_free
ASIdOrRange_it
ASIdOrRange_new
ASIdentifierChoice_free
ASIdentifierChoice_it
ASIdentifierChoice_new
ASIdentifiers_free
ASIdentifiers_it
ASIdentifiers_new
ASN1_ANY_it
ASN1_BIT_STRING_check
ASN1_BIT_STRING_free
ASN1_BIT_STRING_get_bit
ASN1_BIT_STRING_it
ASN1_BIT_STRING_name_print
ASN1_BIT_STRING_new
ASN1_BIT_STRING_num_asc
ASN1_BIT_STRING_set
ASN1_BIT_STRING_set_asc
ASN1_BIT_STRING_set_bit
ASN1_BMPSTRING_free
ASN1_BMPSTRING_it
ASN1_BMPSTRING_new
ASN1_BOOLEAN_it
ASN1_ENUMERATED_free
ASN1_ENUMERATED_get
ASN1_ENUMERATED_get_int64
ASN1_ENUMERATED_it
ASN1_ENUMERATED_new
ASN1_ENUMERATED_set
ASN1_ENUMERATED_set_int64
ASN1_ENUMERATED_to_BN
ASN1_FBOOLEAN_it
ASN1_GENERALIZEDTIME_adj
ASN1_GENERALIZEDTIME_check
ASN1_GENERALIZEDTIME_free
ASN1_GENERALIZEDTIME_it
ASN1_GENERALIZEDTIME_new
ASN1_GENERALIZEDTIME_print
ASN1_GENERALIZEDTIME_set
ASN1_GENERALIZEDTIME_set_string
ASN1_GENERALSTRING_free
ASN1_GENERALSTRING_it
ASN1_GENERALSTRING_new
ASN1_IA5STRING_free
ASN1_IA5STRING_it
ASN1_IA5STRING_new
ASN1_INTEGER_cmp
ASN1_INTEGER_dup
ASN1_INTEGER_free
ASN1_INTEGER_get
ASN1_INTEGER_get_int64
ASN1_INTEGER_get_uint64
ASN1_INTEGER_it
ASN1_INTEGER_new
ASN1_INTEGER_set
ASN1_INTEGER_set_int64
ASN1_INTEGER_set_uint64
ASN1_INTEGER_to_BN
ASN1_ITEM_get
ASN1_ITEM_lookup
ASN1_NULL_free
ASN1_NULL_it
ASN1_NULL_new
ASN1_OBJECT_create
ASN1_OBJECT_free
ASN1_OBJECT_it
ASN1_OBJECT_new
ASN1_OCTET_STRING_NDEF_it
ASN1_OCTET_STRING_cmp
ASN1_OCTET_STRING_dup
ASN1_OCTET_STRING_free
ASN1_OCTET_STRING_it
ASN1_OCTET_STRING_new
ASN1_OCTET_STRING_set
ASN1_PCTX_free
ASN1_PCTX_get_cert_flags
ASN1_PCTX_get_flags
ASN1_PCTX_get_nm_flags
ASN1_PCTX_get_oid_flags
ASN1_PCTX_get_str_flags
ASN1_PCTX_new
ASN1_PCTX_set_cert_flags
ASN1_PCTX_set_flags
ASN1_PCTX_set_nm_flags
ASN1_PCTX_set_oid_flags
ASN1_PCTX_set_str_flags
ASN1_PRINTABLESTRING_free
ASN1_PRINTABLESTRING_it
ASN1_PRINTABLESTRING_new
ASN1_PRINTABLE_free
ASN1_PRINTABLE_it
ASN1_PRINTABLE_new
ASN1_PRINTABLE_type
ASN1_SCTX_free
ASN1_SCTX_get_app_data
ASN1_SCTX_get_flags
ASN1_SCTX_get_item
ASN1_SCTX_get_template
ASN1_SCTX_new
ASN1_SCTX_set_app_data
ASN1_SEQUENCE_ANY_it
ASN1_SEQUENCE_it
ASN1_SET_ANY_it
ASN1_STRING_TABLE_add
ASN1_STRING_TABLE_cleanup
ASN1_STRING_TABLE_get
ASN1_STRING_clear_free
ASN1_STRING_cmp
ASN1_STRING_copy
ASN1_STRING_data
ASN1_STRING_dup
ASN1_STRING_free
ASN1_STRING_get0_data
ASN1_STRING_get_default_mask
ASN1_STRING_length
ASN1_STRING_length_set
ASN1_STRING_new
ASN1_STRING_print
ASN1_STRING_print_ex
ASN1_STRING_print_ex_fp
ASN1_STRING_set
ASN1_STRING_set0
ASN1_STRING_set_by_NID
ASN1_STRING_set_default_mask
ASN1_STRING_set_default_mask_asc
ASN1_STRING_to_UTF8
ASN1_STRING_type
ASN1_STRING_type_new
ASN1_T61STRING_free
ASN1_T61STRING_it
ASN1_T61STRING_new
ASN1_TBOOLEAN_it
ASN1_TIME_adj
ASN1_TIME_check
ASN1_TIME_cmp_time_t
ASN1_TIME_compare
ASN1_TIME_diff
ASN1_TIME_free
ASN1_TIME_it
ASN1_TIME_new
ASN1_TIME_normalize
ASN1_TIME_print
ASN1_TIME_set
ASN1_TIME_set_string
ASN1_TIME_set_string_X509
ASN1_TIME_to_generalizedtime
ASN1_TIME_to_tm
ASN1_TYPE_cmp
ASN1_TYPE_free
ASN1_TYPE_get
ASN1_TYPE_get_int_octetstring
ASN1_TYPE_get_octetstring
ASN1_TYPE_new
ASN1_TYPE_pack_sequence
ASN1_TYPE_set
ASN1_TYPE_set1
ASN1_TYPE_set_int_octetstring
ASN1_TYPE_set_octetstring
ASN1_TYPE_unpack_sequence
ASN1_UNIVERSALSTRING_free
ASN1_UNIVERSALSTRING_it
ASN1_UNIVERSALSTRING_new
ASN1_UNIVERSALSTRING_to_string
ASN1_UTCTIME_adj
ASN1_UTCTIME_check
ASN1_UTCTIME_cmp_time_t
ASN1_UTCTIME_free
ASN1_UTCTIME_it
ASN1_UTCTIME_new
ASN1_UTCTIME_print
ASN1_UTCTIME_set
ASN1_UTCTIME_set_string
ASN1_UTF8STRING_free
ASN1_UTF8STRING_it
ASN1_UTF8STRING_new
ASN1_VISIBLESTRING_free
ASN1_VISIBLESTRING_it
ASN1_VISIBLESTRING_new
ASN1_add_oid_module
ASN1_add_stable_module
ASN1_bn_print
ASN1_buf_print
ASN1_check_infinite_end
ASN1_const_check_infinite_end
ASN1_d2i_bio
ASN1_d2i_fp
ASN1_digest
ASN1_dup
ASN1_generate_nconf
ASN1_generate_v3
ASN1_get_object
ASN1_i2d_bio
ASN1_i2d_fp
ASN1_item_d2i
ASN1_item_d2i_bio
ASN1_item_d2i_fp
ASN1_item_digest
ASN1_item_dup
ASN1_item_ex_d2i
ASN1_item_ex_free
ASN1_item_ex_i2d
ASN1_item_ex_new
ASN1_item_free
ASN1_item_i2d
ASN1_item_i2d_bio
ASN1_item_i2d_fp
ASN1_item_ndef_i2d
ASN1_item_new
ASN1_item_pack
ASN1_item_print
ASN1_item_sign
ASN1_item_sign_ctx
ASN1_item_unpack
ASN1_item_verify
ASN1_mbstring_copy
ASN1_mbstring_ncopy
ASN1_object_size
ASN1_parse
ASN1_parse_dump
ASN1_put_eoc
ASN1_put_object
ASN1_sign
ASN1_str2mask
ASN1_tag2bit
ASN1_tag2str
ASN1_verify
ASRange_free
ASRange_it
ASRange_new
ASYNC_WAIT_CTX_clear_fd
ASYNC_WAIT_CTX_free
ASYNC_WAIT_CTX_get_all_fds
ASYNC_WAIT_CTX_get_changed_fds
ASYNC_WAIT_CTX_get_fd
ASYNC_WAIT_CTX_new
ASYNC_WAIT_CTX_set_wait_fd
ASYNC_block_pause
ASYNC_cleanup_thread
ASYNC_get_current_job
ASYNC_get_wait_ctx
ASYNC_init_thread
ASYNC_is_capable
ASYNC_pause_job
ASYNC_start_job
ASYNC_unblock_pause
AUTHORITY_INFO_ACCESS_free
AUTHORITY_INFO_ACCESS_it
AUTHORITY_INFO_ACCESS_new
AUTHORITY_KEYID_free
AUTHORITY_KEYID_it
AUTHORITY_KEYID_new
BASIC_CONSTRAINTS_free
BASIC_CONSTRAINTS_it
BASIC_CONSTRAINTS_new
BF_cbc_encrypt
BF_cfb64_encrypt
BF_decrypt
BF_ecb_encrypt
BF_encrypt
BF_ofb64_encrypt
BF_options
BF_set_key
BIGNUM_it
BIO_ADDRINFO_address
BIO_ADDRINFO_family
BIO_ADDRINFO_free
BIO_ADDRINFO_next
BIO_ADDRINFO_protocol
BIO_ADDRINFO_socktype
BIO_ADDR_clear
BIO_ADDR_family
BIO_ADDR_free
BIO_ADDR_hostname_string
BIO_ADDR_new
BIO_ADDR_path_string
BIO_ADDR_rawaddress
BIO_ADDR_rawmake
BIO_ADDR_rawport
BIO_ADDR_service_string
BIO_accept
BIO_accept_ex
BIO_asn1_get_prefix
BIO_asn1_get_suffix
BIO_asn1_set_prefix
BIO_asn1_set_suffix
BIO_bind
BIO_callback_ctrl
BIO_clear_flags
BIO_closesocket
BIO_connect
BIO_copy_next_retry
BIO_ctrl
BIO_ctrl_get_read_request
BIO_ctrl_get_write_guarantee
BIO_ctrl_pending
BIO_ctrl_reset_read_request
BIO_ctrl_wpending
BIO_debug_callback
BIO_dgram_non_fatal_error
BIO_dump
BIO_dump_cb
BIO_dump_fp
BIO_dump_indent
BIO_dump_indent_cb
BIO_dump_indent_fp
BIO_dup_chain
BIO_f_asn1
BIO_f_base64
BIO_f_buffer
BIO_f_cipher
BIO_f_linebuffer
BIO_f_md
BIO_f_nbio_test
BIO_f_null
BIO_f_reliable
BIO_f_zlib
BIO_fd_non_fatal_error
BIO_fd_should_retry
BIO_find_type
BIO_free
BIO_free_all
BIO_get_accept_socket
BIO_get_callback
BIO_get_callback_arg
BIO_get_callback_ex
BIO_get_data
BIO_get_ex_data
BIO_get_host_ip
BIO_get_init
BIO_get_new_index
BIO_get_port
BIO_get_retry_BIO
BIO_get_retry_reason
BIO_get_shutdown
BIO_gethostbyname
BIO_gets
BIO_hex_string
BIO_indent
BIO_int_ctrl
BIO_listen
BIO_lookup
BIO_lookup_ex
BIO_meth_free
BIO_meth_get_callback_ctrl
BIO_meth_get_create
BIO_meth_get_ctrl
BIO_meth_get_destroy
BIO_meth_get_gets
BIO_meth_get_puts
BIO_meth_get_read
BIO_meth_get_read_ex
BIO_meth_get_write
BIO_meth_get_write_ex
BIO_meth_new
BIO_meth_set_callback_ctrl
BIO_meth_set_create
BIO_meth_set_ctrl
BIO_meth_set_destroy
BIO_meth_set_gets
BIO_meth_set_puts
BIO_meth_set_read
BIO_meth_set_read_ex
BIO_meth_set_write
BIO_meth_set_write_ex
BIO_method_name
BIO_method_type
BIO_new
BIO_new_CMS
BIO_new_NDEF
BIO_new_PKCS7
BIO_new_accept
BIO_new_bio_pair
BIO_new_connect
BIO_new_dgram
BIO_new_fd
BIO_new_file
BIO_new_fp
BIO_new_mem_buf
BIO_new_socket
BIO_next
BIO_nread
BIO_nread0
BIO_number_read
BIO_number_written
BIO_nwrite
BIO_nwrite0
BIO_parse_hostserv
BIO_pop
BIO_printf
BIO_ptr_ctrl
BIO_push
BIO_puts
BIO_read
BIO_read_ex
BIO_s_accept
BIO_s_bio
BIO_s_connect
BIO_s_datagram
BIO_s_fd
BIO_s_file
BIO_s_log
BIO_s_mem
BIO_s_null
BIO_s_secmem
BIO_s_socket
BIO_set_callback
BIO_set_callback_arg
BIO_set_callback_ex
BIO_set_cipher
BIO_set_data
BIO_set_ex_data
BIO_set_flags
BIO_set_init
BIO_set_next
BIO_set_retry_reason
BIO_set_shutdown
BIO_set_tcp_ndelay
BIO_snprintf
BIO_sock_error
BIO_sock_info
BIO_sock_init
BIO_sock_non_fatal_error
BIO_sock_should_retry
BIO_socket
BIO_socket_ioctl
BIO_socket_nbio
BIO_test_flags
BIO_up_ref
BIO_vfree
BIO_vprintf
BIO_vsnprintf
BIO_write
BIO_write_ex
BN_BLINDING_convert
BN_BLINDING_convert_ex
BN_BLINDING_create_param
BN_BLINDING_free
BN_BLINDING_get_flags
BN_BLINDING_invert
BN_BLINDING_invert_ex
BN_BLINDING_is_current_thread
BN_BLINDING_lock
BN_BLINDING_new
BN_BLINDING_set_current_thread
BN_BLINDING_set_flags
BN_BLINDING_unlock
BN_BLINDING_update
BN_CTX_end
BN_CTX_free
BN_CTX_get
BN_CTX_new
BN_CTX_secure_new
BN_CTX_start
BN_GENCB_call
BN_GENCB_free
BN_GENCB_get_arg
BN_GENCB_new
BN_GENCB_set
BN_GENCB_set_old
BN_GF2m_add
BN_GF2m_arr2poly
BN_GF2m_mod
BN_GF2m_mod_arr
BN_GF2m_mod_div
BN_GF2m_mod_div_arr

Sections

.text
Size: 1.9MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 481KB - Virtual size: 481KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug
Size: 156B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
libcurl-4.dll
.dll windows:4 windows x64 arch:x64

0436bf783880308ca19dd01c9fab2973

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\1\s\git-sdk-64\usr\src\MINGW-packages\mingw-w64-curl\src\build-x86_64\lib\.libs\libcurl-4.pdb

Imports

advapi32

CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptReleaseContext

crypt32

CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetNameStringA
CertOpenStore
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryA

kernel32

CloseHandle
CreateFileA
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetFileSizeEx
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExA
GetProcAddress
GetStdHandle
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MoveFileExA
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
SleepEx
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoA
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WideCharToMultiByte

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_access
_amsg_exit
_close
_errno
_fstat64
_gmtime64
_initterm
_lock
_lseeki64
_open
_read
_stat64
_strdup
_sys_nerr
_time64
_unlink
_unlock
_write
abort
atoi
calloc
fclose
feof
fflush
fgets
fopen
fputc
fputs
fread
free
fseek
ftell
fwrite
getc
islower
isspace
isupper
isxdigit
localeconv
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
qsort
realloc
setlocale
setvbuf
signal
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtol
strtoul
tolower
ungetc
vfprintf
wcslen
wcstombs

libwinpthread-1

pthread_create
pthread_detach
pthread_join
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock

wldap32

ber_free
ldap_bind_s
ldap_err2string
ldap_first_attribute
ldap_first_entry
ldap_get_dn
ldap_get_values_len
ldap_init
ldap_memfree
ldap_msgfree
ldap_next_attribute
ldap_next_entry
ldap_search_s
ldap_set_option
ldap_simple_bind_s
ldap_sslinit
ldap_unbind_s
ldap_value_free_len

ws2_32

WSACleanup
WSAGetLastError
WSAIoctl
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getpeername
getsockname
getsockopt
htonl
htons
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket

libcrypto-1_1-x64

ASN1_STRING_get0_data
ASN1_STRING_length
ASN1_STRING_print
ASN1_STRING_to_UTF8
ASN1_STRING_type
ASN1_TIME_print
BIO_ctrl
BIO_free
BIO_new
BIO_printf
BIO_puts
BIO_s_file
BIO_s_mem
BN_num_bits
BN_print
CONF_modules_load_file
CRYPTO_free
CRYPTO_get_ex_new_index
CRYPTO_malloc
DH_get0_key
DH_get0_pqg
DSA_get0_key
DSA_get0_pqg
ENGINE_by_id
ENGINE_ctrl
ENGINE_ctrl_cmd
ENGINE_finish
ENGINE_free
ENGINE_get_first
ENGINE_get_id
ENGINE_get_next
ENGINE_init
ENGINE_load_builtin_engines
ENGINE_load_private_key
ENGINE_set_default
ERR_clear_error
ERR_error_string_n
ERR_get_error
ERR_peek_error
EVP_DigestFinal_ex
EVP_DigestInit_ex
EVP_DigestUpdate
EVP_MD_CTX_free
EVP_MD_CTX_new
EVP_PKEY_copy_parameters
EVP_PKEY_free
EVP_PKEY_get0_DH
EVP_PKEY_get0_DSA
EVP_PKEY_get0_RSA
EVP_PKEY_get1_RSA
EVP_PKEY_id
EVP_md5
EVP_sha256
GENERAL_NAMES_free
MD4_Final
MD4_Init
MD4_Update
MD5_Final
MD5_Init
MD5_Update
OCSP_BASICRESP_free
OCSP_RESPONSE_free
OCSP_basic_verify
OCSP_cert_status_str
OCSP_check_validity
OCSP_crl_reason_str
OCSP_resp_count
OCSP_resp_get0
OCSP_response_get1_basic
OCSP_response_status
OCSP_response_status_str
OCSP_single_get0_status
OPENSSL_load_builtin_modules
OPENSSL_sk_num
OPENSSL_sk_pop
OPENSSL_sk_pop_free
OPENSSL_sk_value
OpenSSL_version_num
PEM_read_bio_X509
PEM_write_bio_X509
PKCS12_PBE_add
PKCS12_free
PKCS12_parse
RAND_add
RAND_bytes
RAND_file_name
RAND_load_file
RAND_status
RSA_flags
RSA_free
RSA_get0_key
SHA256_Final
SHA256_Init
SHA256_Update
UI_OpenSSL
UI_create_method
UI_destroy_method
UI_get0_user_data
UI_get_input_flags
UI_get_string_type
UI_method_get_closer
UI_method_get_opener
UI_method_get_reader
UI_method_get_writer
UI_method_set_closer
UI_method_set_opener
UI_method_set_reader
UI_method_set_writer
UI_set_result
X509V3_EXT_print
X509_EXTENSION_get_data
X509_EXTENSION_get_object
X509_LOOKUP_file
X509_NAME_ENTRY_get_data
X509_NAME_get_entry
X509_NAME_get_index_by_NID
X509_NAME_print_ex
X509_PUBKEY_get0_param
X509_STORE_add_lookup
X509_STORE_set_flags
X509_check_issued
X509_free
X509_get0_extensions
X509_get0_notAfter
X509_get0_notBefore
X509_get0_signature
X509_get_X509_PUBKEY
X509_get_ext_d2i
X509_get_issuer_name
X509_get_pubkey
X509_get_serialNumber
X509_get_subject_name
X509_get_version
X509_load_crl_file
X509_verify_cert_error_string
d2i_OCSP_RESPONSE
d2i_PKCS12_bio
i2a_ASN1_OBJECT
i2d_X509_PUBKEY
i2t_ASN1_OBJECT

libidn2-0

idn2_check_version
idn2_free
idn2_lookup_ul
idn2_strerror

libnghttp2-14

nghttp2_is_fatal
nghttp2_pack_settings_payload
nghttp2_priority_spec_init
nghttp2_session_callbacks_del
nghttp2_session_callbacks_new
nghttp2_session_callbacks_set_error_callback
nghttp2_session_callbacks_set_on_begin_headers_callback
nghttp2_session_callbacks_set_on_data_chunk_recv_callback
nghttp2_session_callbacks_set_on_frame_recv_callback
nghttp2_session_callbacks_set_on_header_callback
nghttp2_session_callbacks_set_on_stream_close_callback
nghttp2_session_callbacks_set_send_callback
nghttp2_session_client_new
nghttp2_session_del
nghttp2_session_get_remote_settings
nghttp2_session_get_stream_user_data
nghttp2_session_mem_recv
nghttp2_session_resume_data
nghttp2_session_send
nghttp2_session_set_local_window_size
nghttp2_session_set_stream_user_data
nghttp2_session_upgrade
nghttp2_session_want_read
nghttp2_session_want_write
nghttp2_strerror
nghttp2_submit_ping
nghttp2_submit_priority
nghttp2_submit_request
nghttp2_submit_rst_stream
nghttp2_submit_settings
nghttp2_version

libssh2-1

libssh2_agent_connect
libssh2_agent_disconnect
libssh2_agent_free
libssh2_agent_get_identity
libssh2_agent_init
libssh2_agent_list_identities
libssh2_agent_userauth
libssh2_channel_free
libssh2_channel_read_ex
libssh2_channel_send_eof
libssh2_channel_wait_closed
libssh2_channel_wait_eof
libssh2_channel_write_ex
libssh2_exit
libssh2_hostkey_hash
libssh2_init
libssh2_knownhost_add
libssh2_knownhost_checkp
libssh2_knownhost_free
libssh2_knownhost_get
libssh2_knownhost_init
libssh2_knownhost_readfile
libssh2_knownhost_writefile
libssh2_scp_recv2
libssh2_scp_send64
libssh2_session_block_directions
libssh2_session_disconnect_ex
libssh2_session_flag
libssh2_session_free
libssh2_session_handshake
libssh2_session_hostkey
libssh2_session_init_ex
libssh2_session_last_errno
libssh2_session_last_error
libssh2_session_method_pref
libssh2_session_set_blocking
libssh2_sftp_close_handle
libssh2_sftp_init
libssh2_sftp_last_error
libssh2_sftp_mkdir_ex
libssh2_sftp_open_ex
libssh2_sftp_read
libssh2_sftp_readdir_ex
libssh2_sftp_rename_ex
libssh2_sftp_rmdir_ex
libssh2_sftp_seek64
libssh2_sftp_shutdown
libssh2_sftp_stat_ex
libssh2_sftp_statvfs
libssh2_sftp_symlink_ex
libssh2_sftp_unlink_ex
libssh2_sftp_write
libssh2_userauth_authenticated
libssh2_userauth_keyboard_interactive_ex
libssh2_userauth_list
libssh2_userauth_password_ex
libssh2_userauth_publickey_fromfile_ex

libssl-1_1-x64

BIO_f_ssl
SSL_CIPHER_get_name
SSL_CTX_add_client_CA
SSL_CTX_check_private_key
SSL_CTX_ctrl
SSL_CTX_free
SSL_CTX_get_cert_store
SSL_CTX_load_verify_locations
SSL_CTX_new
SSL_CTX_sess_set_new_cb
SSL_CTX_set_alpn_protos
SSL_CTX_set_cipher_list
SSL_CTX_set_ciphersuites
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_keylog_callback
SSL_CTX_set_msg_callback
SSL_CTX_set_next_proto_select_cb
SSL_CTX_set_options
SSL_CTX_set_post_handshake_auth
SSL_CTX_set_srp_password
SSL_CTX_set_srp_username
SSL_CTX_set_verify
SSL_CTX_use_PrivateKey
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_file
SSL_SESSION_free
SSL_alert_desc_string_long
SSL_connect
SSL_ctrl
SSL_free
SSL_get0_alpn_selected
SSL_get_certificate
SSL_get_current_cipher
SSL_get_error
SSL_get_ex_data
SSL_get_peer_cert_chain
SSL_get_peer_certificate
SSL_get_privatekey
SSL_get_shutdown
SSL_get_verify_result
SSL_new
SSL_pending
SSL_read
SSL_set_bio
SSL_set_connect_state
SSL_set_ex_data
SSL_set_fd
SSL_set_session
SSL_shutdown
SSL_version
SSL_write
TLS_client_method

zlib1

inflate
inflateEnd
inflateInit2_
inflateInit_
zlibVersion

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_version
curl_version_info

Sections

.text
Size: 452KB - Virtual size: 452KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.debug
Size: 156B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
libiconv-2.dll
.dll windows:6 windows x64 arch:x64

b8e5a2139221d2a78b7509ba146f79fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

qyc~H^3o}"@(WzOF9~c/iV@G6&4`2P1$ A)7Cq&pfS4Br})wn{[UFeVFh/5+3aNwf&vTmK8Vk<k$oe6tL[[u5_)FqD9)F$!>4

Imports

advapi32

AdjustTokenPrivileges
DeregisterEventSource
GetTokenInformation
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegisterEventSourceW
ReportEventW

bcrypt

BCryptDestroyHash
BCryptDecrypt
BCryptEncrypt
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptFinishHash
BCryptDestroyKey
BCryptGenRandom
BCryptGetProperty
BCryptHashData
BCryptCreateHash
BCryptImportKey

kernel32

TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
IsProcessorFeaturePresent
CancelThreadpoolIo
CloseHandle
CloseThreadpoolIo
CloseThreadpoolWait
CloseThreadpoolWork
CompareStringEx
CompareStringOrdinal
CreateDirectoryW
CreateEventExW
CreateFileW
CreatePipe
CreateProcessW
CreateThread
CreateThreadpoolIo
CreateThreadpoolWait
CreateThreadpoolWork
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindNLSStringEx
FindStringOrdinal
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCPInfo
GetCPInfoExW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumberEx
GetCurrentThread
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetFullPathNameW
GetLastError
GetLocaleInfoEx
GetLongPathNameW
GetModuleFileNameW
GetOverlappedResult
GetProcAddress
GetProcessId
GetStdHandle
GetSystemDirectoryW
GetThreadPriority
GetTickCount64
InitializeConditionVariable
InitializeCriticalSection
IsDebuggerPresent
K32EnumProcesses
LCMapStringEx
LeaveCriticalSection
LoadLibraryExW
LocalAlloc
LocalFree
LocaleNameToLCID
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseFailFastException
ReadConsoleW
ReadFile
ResolveLocaleName
ResumeThread
SetConsoleTextAttribute
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetLastError
SetThreadErrorMode
SetThreadPriority
SetThreadpoolWait
Sleep
SleepConditionVariableCS
StartThreadpoolIo
SubmitThreadpoolWork
TerminateProcess
VirtualAlloc
VirtualFree
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForThreadpoolWaitCallbacks
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
FlushProcessWriteBuffers
WaitForSingleObjectEx
AddVectoredExceptionHandler
GetModuleHandleW
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
VerSetConditionMask
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
GetCurrentThreadId
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
CreateMemoryResourceNotification
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
VerifyVersionInfoW
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
VirtualQuery
GetSystemTimeAsFileTime
ResetEvent
InitializeCriticalSectionEx
SleepEx
DebugBreak
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry

ole32

CoGetApartmentType
CoInitializeEx
CoWaitForMultipleHandles
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free
_callnewh

api-ms-win-crt-math-l1-1-0

log
ceil
sin

api-ms-win-crt-string-l1-1-0

wcsncmp
memset
strcmp
_stricmp
strcpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initialize_narrow_environment
_execute_onexit_table
abort
_seh_filter_dll
_initterm_e
_cexit
terminate
_crt_atexit
_initialize_onexit_table
_configure_narrow_argv
_initterm

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsscanf

Exports

Exports

00hR9iepdUKRYwH3hApp8wej7CAxHIU
02I5uquZflBdpYrlA00LgWH4BVsmc
03Td3myeRrObLfWwgjZys3bVJSWeyoRz
054Y3tqDOZxvTJaKNKB2Nq4j82JfZLXN
06k5RNXMVewrYdGodZVR0bUKXDd
07vFmUp2eDJ2O0SGyKezuMcwoLl49
08bUK8N2QFx5d
0APgJ1y3IZI
0Bc0H4ChVEvy3WlHANrB8FMi2mzmiFbP
0BnTtHf5YEdUvauW8VvNRwdX5Af67
0Cph0jTPuSjHbqlcZ
0DlD3N9erXl
0FbY2dJwMqxXxOv
0Hyao7xAHjPe9UEjzSAfF
0JK6Ptu2MPOOUgtUCqcni7kKG
0JRZE3I9f7XHsJkqi4h
0MI5lXUoEQjk
0OC4Snmg
0OgAfqy7CS
0OxCtYOw
0Rt6CPDZnB23CmVtxK
0SNOjBryRm
0T83XSQ23cZ
0TOGOmjQ2s
0UGFZYQ2qbUzTJVHescBQ
0UVcaptFovPp
0WxTS3YUjRuq
0YFsmbiIYx
0ZylIfbWEwMf3B1xQjbswm65Xp2H
0awZRvbm7WwyK7UrV
0bhs7G40wPHvmxmn3PvS8gVi4FyR
0bq9tvUCvNBF87md
0cxDDVQfLIVtGN8xJPWXTJKDlsvxKsQw
0fV0gbX0oBorapWtwn8HsXVl
0hTYH4eGhqx
0jjBhiDGDqCWfVPhOmdKM2
0klHIsfPlpx30QKtzmnM
0lIgQY17Ar7TsQv01
0nfVmNGePRIkJy055cm00XisS6lgCh
0nhZIONtiqbPpfIzqr
0nnpaDbZVUVx6in6xRX4IyeBW
0qyEMZAI4Nw
0sCfVtec
0tcXB1HKilUkV6Oj7usGlaFc72
0uTEJsMQL17qQuFEB1t3jM
0vj3cQIas
0vwSU1uuXx
0xN20GXOn
1024Dh0coTiDdIk4VDxPN4
11t55dRKfx8DHJUIBsCDu6ooXwIDlpbh
12OW9OGHQ7XjRvy5vb5LZ1fQ
1A3Gwood1EVaUOi52XPej9kK6
1C60IrE6Inxq
1CTim1HcTtGXgM153rXhZM
1D3ArQTKqKqqR1
1ECWK81iic
1GJQ9MPVRE4IEdtqHb7WtOB
1GTkSKZOtJr7e0ohw
1HDKYBBrUohnhDE4AoksE
1JpWA0nXtQ8jN9ykrvP0qtWM
1LFGW15uHp
1NU95YhD5V
1OvVyqSTEmIV6ub171Ez
1R4WjGL8K
1RAKICRpVE2WEydybmfdjvlZkrSH
1Rrwi5lMGT
1YhP98h64QJlcOgLInsDyl3y
1aGV4Po49XZt88tTh53PP
1dEiQ9khhfhhhpH
1ebE97zlShtSxiPvp0Qr
1ezq5YZdBekIbms56oyh
1gtm5Flb5XZXG
1gydr5I7juz8nB8F
1hwAJapdeZ26Qgauw0r5qk
1iBXO1sawXhzIgPJ8hoolwtkVmeIa
1lmo0MIsjIG62HHShaRWYSuHGH22rRbi
1nLTRStAU9parI
1nisZ9icw50nmfREycB
1oNzVrhandR
1odI50aqwpYSeKqn3jWmJxnfEKi
1qb7hSjK1PwDP66nCHSU
1qgA0Gwc4sTLB
1sPiI0xlNWUpkJnMuKA6l
1sygoJfAjHcDzElbfMSV
1uo2SCR
1vjSQHuR4FSGXOcBS8WounNcVEbu7
1xpl7tw6N
1yxaLJmTPDy87cKjm5q
1zEhACvvCXb1HjaxyM6q
21PGUpQ6BJ7zbpAKPkt
21efkN1D9h
21g8pVf3j8ieNwVlH5qy3Nd3eZuNirk7
22DuoWKFCVdopPMzPyPTEJyRzvj5CQ
23lYwyz
26JwS8mcNKPjygEbHQMhHLeb9
2BZTZrWlnp
2BsUDZ1dqgROTby
2CbIHWbPg71RCLzxAmo
2DodvU3cO0sqcMwCJqEbm3ffiB2whG5
2FooMlQAZ7u6DWafqmv
2G0f7VreTJ9zakFhrBpJd
2HYf5PY5qG10Cr6Ue7MVju
2HiTbcUdcrL2nUYRL9
2J8EcB7hvjjAEkrmB2pKuAp
2K7UN73Hqdf8qG7W3LKD6c7TW
2KBmj8xTfIO
2MXUmms
2NC3QHvZrFSKK2omycds
2OWh3J2DcbwKtcEgbB6SyY
2PyKymdk0z28bHupwVRZvycDAx
2QGk8k66k1
2Qd66HA00RUJyr1vm8vh
2R4dVL2raQcd
2Sst2ZBSGmepTqtYLjB7
2TYn5N2eJaf
2TccTS7LJJHBMQn3V
2VBxfP3RVQg4e969aYoeZ
2WJZzaSBTJ9crq9aZG7r58miEn
2We1HnNqZ016WLNDrxSFiEgocyoWFCC6
2WeflYxPtsiy7vFttyhZ
2YbtvXz
2Yq97qwwhEfmrLbTxlj1j1
2ZMm2alYUJCKKr762yAJCrj6
2bWq8nYs9iq9KwNcPT
2cemN9w5HWT7gaMSyjJyjJNnhIy8Y
2dY4H2C
2e0fc1nDjKMvF56wbONsbuN4pGxrrl
2exJDJRKQ8UhU
2fLDkMr6we2ok8fbzr26nr1YvZer8
2gMdUkp6nGkFpEgU4ZLce91ofThRVIs
2hTrHDlBiPtc4oDD0Uf
2ivL4lOTXouybo1Gbijjt2NOop0q
2oHua8m6kwTeJRuaedujtoTEJZOCYK
2oUXeP7vfmde8JxzoQBP
2okuKavDq
2omW6Vu5RyQR6WFF
2p9iIXKN1yhg
2qHl4wddhhy3HlqQXR9fhkJWiTFc8oz
2qKqv5WyYeVKC3qpS
2rGykh5WH0li71epjAoU5eZFKlDsPt
2rga84LODl5WS0RRGNTHgk
2t6IddkMAHjq6Rit8l
2tO0pWsFyFqJb6bKJ9kjMc
2tS7ezxHf
2tgZDmmFTH9
2tsOlDk2oK1EbigP
2udrs2hFC3mHnv1JIY
2vOTTJZn0g9Ria5eAON
2vi0opKUiJAscuAtX55A1KIWmX8
2wKDBQBkpOXn8Z3sFBjL
2wQIJMWIZLWQO
2xlou7kn7RXxz7zDd8iGW5mw
2z4MWfmUssACE
2zXiaIm1QikWUTLkuA
30BjlNzjKTSDzNG3VnpBn1Ep
30JLTDkBXA
31UWg393TaKucmhAayC0bjZ3pzoeOW6
334uxSwiVYilaPYt3
34RdIFUOSz8IrN79z
34txTlrReCSyT6N4n9r57UcUdJhsKTW8
35BwLmUVZPDOGTs74sivrCiB
35j23AN
377MWhMB0Teia61bZc1MiGv
383mrAuBUeJRO0YJ8p2XGllGjjzE
38VLCS2Mo55BOODIw0
3BRy7w7gabVv7wK9A180UEnL8z
3BzgyTYFRjCLdJKeRKihenx9Noo
3CgYGHzcs54f7yy6iBs8hgWEg
3Cu2ZLDj4blgD6pnMQDdKCTHmimj
3CymlKBxx78TjMtT3Ili6XCxAH4OSK
3ETd3bae7
3FcOoRn0icZw
3IX6Lp3IiU6kIr3Wy1L1aYvWtv6
3MDQfWcaLqoh0TMfakp
3NUi1dOeZjzR8mRHlV02Q1wHgzXWu
3PZk5Yoxmaiwwc5RHUaaJMQz
3QBt0WRS7tQg7aoj
3QpeoLKuwQZZhIYgsqyAQf5vq3FYUP
3RLKZlENWhTqM2x7xDdX2v
3TKhK1DD2PyhoF4obhWxEipB
3Y8DpwF
3Z8ArHuRU2Sf0nQoeOGWL6cZ
3aCSSaiZak8D6kidzTdEB
3ao5Lo74wPpNszcYebu29Jd6vKKD4os9
3bYarmlu73ts0xIqrx5wVUe9nMq0i3sE
3cF7rDczAq8Xcptb5bL1XWVNtPMXa7
3dSGndpEuDLTHWPIxhxgGK
3g6sEg8fWOYvgqO
3g760iBtO
3gil8YUt
3h8ItmQMMc3pejKqIF2ufFLwzB
3hicVSF96lP178X8
3kneJvi
3kx0DzkeZGkqlARMK4Ig0gwsZs4F7br
3oTUwe52FZCsSwhJZmY
3pRvwPFjBufZ4ntWBZcNCo252BhEZK
3qyM2Pas
3rlJLIEkoCFkA36fovJ9B9XOkeI6a1TN
3sVJ8poLCKv
3thIbkLydO0hT6hPVGx0qeb1A68
3u1yxADF
3uPXDStD5H
3y1IjjrWRp151DNci
40rESd8fym9xejRq1f
41Wz6C6l3QFlBltp1K
423EqHjkvmK9SzzNGsyj8TcCM
43on3f6sBDkVI6wiCU6I
44S519RjOBcBJn5wCJ4
47jH56S2NFBbd46qCly8G15iwl088bI
47zNh5zK2ug5izaycDXc4V
48lzCeQj2SfZIfBzIpI
4B5xEdW
4CbRU83iufn2Y4UFp4WSL2xI2W
4D0PwA5IqnlHU
4DNRQnunp2yIYMUN2ahWbXhnpzcvsiUH
4F31Z7j7YrasRmT
4FEnIYU5mlbQL0Bb
4GXjXZL5JKiRk3b9ep3
4HOi6Jr7vFJWrQEty1U5Fz7zM
4HPzeFoZCHaQ1nc
4IydWj4nVqyvZiStS
4K6wn5Oir60CLlNOS
4LE6P0RhJNujUikULjLua7gcIXzdcVoZ
4LbVCv1gZtF39ZJi78oaBacAmoPTA
4LdgnkYgDxD83qG
4MbZ1k7
4NRs8fc25rIyvZZ6QFYJA4Lu
4P7KyP6SGNiquduKB
4TQdFzY9rQ4C26QWUNDMuRj
4Tdqijwnnk1elPm
4TyG2K2CHYjbH6PwVcFS3btRvchB
4XpugQ9pC7PimH9UKmMkg5vHTahI
4b51LmW0aA5wH5JQCeDJid9xRpBP9Ps
4cubCzvrEAS4pGW6bmhDC
4cz7q6g
4ezVzGiCVCw
4gfyOP2YXrzWOkVSI
4ih3A6AEP
4lAg02OGPYlZy3W
4mg7VwG3I
4qwIHps2gfqQAaI34fWBvO4
4rF4CUIeA93gl
4sCrxcHXJjxAl9dVkZ
4wnynz99Q
4zH7c92
53RaiOXJlAI1KCfyBBeOvu
54JeDvaajh0GY716KanxyrNvPgvAn
5Azljq4RWRivb9wgUtl
5FyfAhylKkW9jreOLCHqzatMCDew3xA
5FzSGRFWCdF0tPGFoe
5GC92ogJIdR09Y9KJC41Zgau31dXTs
5Hqy3xFyxdN
5HrpQeGWIk
5IeucMcU2jg
5KH5tA8rSHXMBj6Lpf
5Mmv0TMl
5NoL0PdyonzPxtC
5ObiBlhdKeHkVFuk
5Q2MJmc0CMoVYWM
5QTjFE7XBNY4gim6AXEYUtVOb3bb
5RznZ4zh2RcSv485mBFk9uGYpEV7H49
5SdtgJqVxn8L6VxPJunH
5UtUWDpcE0eyb
5XnKSLpaW6OcsV77QqHvtt
5XvRSDhrls1Tfzg5AmlwMp4xnz7L
5YS108GujqdBkQkzVoLTaR9r
5YbZ05o5
5ac2Dsf49mJB7Xky
5cBgkfXBNVPWFaGHX
5cTvQtMwZ4NVN5kSYw7qk0hW6GPMOB
5fWHfxWfbmxMAdl7OR
5kRiy5au4G
5muY7EOsel8FQJnXG51ObrV1XDgRSi
5nhmbB8qU
5pL2O4xALihbIB
5sr9368oOYX71Gec
5u4nTDWrQ812syA5gZfb
5xENsideVfIhyWudFb
5xsdgHG
5y4Ke9YBcwXJ3SkBkxheroO
5z2C7sfrsi
5zprQBiWI79hCG8zo0
61GnI5qFDmTUPJDy6lGe789lpJCQBd
65VzsHqMjwIWpv
672eQ3VjZXa
67xH4L68pPHXPJp29wHxaz0D7aiVv
6A9s7r7pY
6AESRxsylfpTIq2U2OPJoXyL
6B2PEoz3v5ue0AFu5nLEbJbt
6DrexWvrhpY
6E4yLo39IAcZ
6EZFqskGWJjROxC0WVjdfsKOFvE
6F1FiENPjhL7TE1mu3qfgQJQK7
6GhaS4KgzGxGYUZrw5FETzaK
6GtmTeRdNHNP9A
6H0ST4Yg8bOKkMBlUq28DktARf1vgr
6KjkUgM7aJfrIT7N
6LKXE4N3LK
6Ll3tLVoqdsZT
6LsQo1CXYd
6MGGWoKl7DA2ZqGX
6Mb3ZewYoozaSuSCG0tw
6OlKuKD6
6PKt64ExuLFEvsu78J2cwWnyQ
6PaCw3tZ8R1ATSsr
6Qsjkn7uYkaElridS3MUhDGrY
6RdMor2D6wMEbupTg2v5fPTlNOfZv
6UCa9nk1EsNaETVeGwi
6UaRoUbq53Eo9AKz
6W3SEcg1G2dtA3Y2KTK
6Y8oWR2bDdbnadCYJg
6YzP2bWtJa
6Z547UoN7ty
6a8T9had35zeI
6d2HiMRGbe11UZQKyOfX0
6j7OOxLOZUiil3MHedgNM
6niuvzwPMrp0
6qHfg6lScfroH
6qxXMdgM2hv7mnlWq43zJIzD
6vLeUdgvyZpLaeAwe
6x8pHd9pYVEobUTtO6zOSVk
6xCTlewytiWdFaGDbpaI6n4hMTIN
6xb4idYQZaZJo7UZlv1QF
6xmVC8Jj82fDD
71CTWLJxVYgEYiDCnzeWo1puKNcVKKs
72TgMCEtTz6UUCAP
75yskVojxWnwmrbPJvEHd8u
7674yrD8is
76qFa5RdfHQKzeoEdmj7IPlRLnPMjPJ
781HwupgokLi0T7yDSegB
796huRhdDYS4QQFnKQyBjKKDhHjxV
79g2u93sbWR6cW03EMdBPWpdCoT
7BfVcaMJWzOr3
7EA8St6rISSa8hcwNnNl4vUsa
7FiWeFtsTKuBsB42O
7JL3Spd5c
7JaRldBkMm4Xk1m2lnl
7JdGIHMSitUHnUj
7N2gTg8Hsue
7OxG8bMor4HmUJxCn3dAlRpuYgA
7VXg3h1dWaLjkuyeU9exgmRI
7eDmdfudK3CRz1eWjaJpoS7GPRoJ
7erjp2AJxAv
7ezu74vvJoa
7f5jydimApqQakrDsrFwSjMuPjpE
7fQtP2tuLjNmjfIMY6dTUotOa
7hXAvbCxpLAQ98hKRn8r
7hfH4dpUduG84physlg5FT1Qv
7iGM5AbDmpZ9Bqkp11Koo4
7lyz5zph5yPxVB8KhmAMS0KZkkCSik4u
7mf5rgjjCJvInnPAHN9M
7noN1AYPJyqphnMFu5l4RjL
7oDpnzxygSEolooD3
7oike6y3u4k
7pYnpF9ttk
7qiHTDwoCwoDgSWw0cRmM
7qqPZ6rppcwvJu43qOK
7rxpL1uV1uu4HTLhKzUQ2f1XRix
7tC07lj404vNKo98VuPD
7trwYAWkkmqhwwZf
7uFbKWPemuKj5Kqo6avDnpZnn9HR
7v5iX1jmNRsFktFkHVrBwK6Rk
7xfUd5MI99xlGWR5sxGSxp
7zgA0qzSyhP5LNyp8l6oGMCsrQHs
80A35HT3JqccmpzuB9NmOwkizqsv
80IVmdlZ6nwEyQffmftTIzU
81XKxWPzLCNWdABuqBSGL45m1oxZX
82L9NHAX1y9QspsJKvn
82beNxrr8EEVttpf1qW575uC19Lzvb
82qJlHF8btrVZr5cvKzQlqtnw9
84l42mWHuE6spkJ0
858GHwXYAmg
87ugyci0rrLTuX3ByfFSJaJzIi
8959TSP7dUyq2VJ7l6YDUM1cfP
89y4rHCT38SFjIJvYoN
8AW6vzjkRv
8At0OPtSq0eZrKNc1wbA
8AzjTzAJ8LsnjBOriG2Ys
8C7YjpBmZU
8CDY1rPQyU
8D5ZPgDsZp9U7
8EuNQMBFwp47bs
8G1ULIkHLoFXghtcG
8HeBZGkD
8InsITrlpo5iLOGxcvECT
8Kix7h1ie9slg
8L2f8mgIULlvw1i2
8NTJVoPeAknc5onSKtcJKXHG3yJ
8QFETxu4D6kf146uJJn0gB
8RGBeotNSr
8UqfpUzRRJTZJFMZ8LLhvJz9kINojb
8VXf09P0U
8Vkt3z5KsQO11S3AxZ1Hy4pVWbmcKli3
8W7pQsH
8YUoskmdd2h3Lz
8ZfHaOpaUUTflDwU0ppH0v7CKsKA4CkE
8ZwnYZY4POPFq2U7hittb93Eql9
8b1Ol6DJ5HRmMwntsv5hFHDer1wd4YSY
8cKo1if1th0SfQlErhi1JG9UD
8ce2jeiV3lT0y
8fFD88he99nBVh6qwvRYOb7DwLcYacu
8fsYHBt
8hMqRkUq2BH
8jSpGkWOAq
8jcL8p2
8jkWDAtfcw30lPmHhlu2mp3PU
8lX3RZHaqPyvVKY8hL
8oq4xsWsycQoxRcAWLGLKCBON
8p206V012ltA4K1D7Lyv3nfajDUz
8pH8Vb2fPIT
8rHL9wN0vOigGZbLt021G5HE3pOK4
8wN7xFf
8xGMv9JNJETQsOyx56B
8zmmpyKQvz864ZkZ58B3OiR1EKhh7
945yCWeq9XumvNjKM
97n30HViDu
99XCFC0
9BIlxZWrVxt684TbJGc6cAIYAQkN6bS9
9C7hEzaRXj61
9CW8KtyhRwDlAPn
9Ea2FLH
9HCRlp5as78eYESwrn
9Iiatlx7ree9uuS3Qkdeiv1LPr
9JCK2HU1znqJe
9JXkOdjkNm8grp1cs
9KKNJjqrzP3038EHxEu25jdu5MTYr8
9LyVVbL579igvFEcdMfjRF39LwLayYIF
9M5GdOFPrfUKZ2V6Y5ZpPfWYKyPIf
9Mxu08NMDFGFfmtj6eVCfwrsC
9NQPUcIfgHc91OAB5o7SBftZ5
9NrriqK3Jlb4IYkFxmbn
9P8m3eBUAddXMWB
9PVRSNUjiIDf
9Q78Hv2tUh1TcZwQGB0UC
9QfBMNje4daLmXr
9SUyDjpHxWCW
9SnIOY88s7EfvRpsziqW3QdhjKHmK
9UPjCgD4Q773CD8YfwVM2Clkl
9YSJOlGoZg8fG8SNPmTm
9Yq7JCpd4XjRZJgsZJdmSyNQuyPV51Rs
9auy5RoRmpQaSuF
9b5su5d7fx
9bLHxNntJWWp4PmbviPJRxHgdFL1sk
9cK0U9AgWj9prUSSNh
9dnlm8tQ
9faJoZT1QIBjl
9fwO1HqU99XjruB
9iKfpet1DPZZklcFCDV87
9iND2oaiLEwK9Xh04Z2fvne4cGwLXcxy
9jVNlCy1U7Q7uSjcfH94wvr6q2ff9F
9lK2LZuUq4PgCGe
9lnZ7CBj
9ltni3AGi8DYzmH9AIJyq
9ny2UCS4J
9o8mkJwEv1U7DCnvoTq5j
9pEakJFmD
9s0ttJHJbhOwFW
9vtFo01gvUklhCSJJm9oMMb
9w9YJsB1jtpVuJssNSPPKHaY
9wIq3F5zCdpQhJn
9x0mxFfgttW4q
9x2jeq8LhYGTnGrV
9y2Zi7BOVAhc3s8h2QwaTl5
9yOxSiPGmupjj5KVlpfCVnaleIyGjK
9zq0hYj1OulUwKqU2g5THTAgivaxqfZk
A12wbg2FHgUj
A4fBC6M4XLRg5bD6wZUlD7LetS4fvp1I
A5pcn73
A7Dn7u3wJ
A7EFSy80
A9fEItfxmztb7WNzPqcxcu
A9xfpPW
ADf8RPj5kRzQVDF3l
AEA2yfKqILcT8H4LavEnHgtDyr2ud96
AEM1RWViMpK8q68A5dp15R46etyy
AGaBmMxbaKkSpe1I8U
AICW4Ne9U50ZQOh5UcoLuWKY5GDmmF
ALRYCaq5LjoK3
ANtiGuClsp
AOJUMPoTSf
AOJvp0i
APD3dQKWs
AQBSWtpw
AQvDn0dKOA0cV2DN5jxiYpboO7gYEOT3
ASSDDv9cFrjQAByvCuPYriT2AOE0D
AUCVSruwq6
AXfVIYqPUP3Fu
AZrNJ1lK06TKpdo9pieJpRoj3o7Mwe
Adn1CZh43C0
AeyhXc1gkp572MFPv3D4OPJ
AiShNJ0EpHHsOG5xaz9XwbP75K
AoRrxFfSfz5mL
ApLFTBXL09MakzjIhqH7Mn
Apt8IJ0yBBzuKNoi1XhjF
ArRuEgTZgjM0LZKHuT
At5kK7awImZkRda5OeQUbll6e7qa9g
AvGIuIWL8JJ1o
Aw3CeeLWScV4wRiY2
Azj9h6GHUFvGSnCX3lqEbIxB
B00vfEgp6vKy3McuOy0

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 846KB - Virtual size: 845KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libintl-8.dll
.dll windows:4 windows x64 arch:x64

80f1810da224adcc57a56426b8f0a9f7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

CloseHandle
CreateEventA
DeleteCriticalSection
EnterCriticalSection
EnumResourceLanguagesA
EnumSystemLocalesA
GetACP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFullPathNameA
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetShortPathNameA
GetSystemTimeAsFileTime
GetThreadLocale
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SearchPathA
SetEvent
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
_access
_amsg_exit
_close
_errno
_fstat64
_getcwd
_initterm
_lock
_open
_read
_strdup
_stricmp
_unlock
_vsnwprintf
abort
bsearch
calloc
fclose
feof
fgets
fopen
fputc
fputwc
free
fwprintf
fwrite
getenv
isalnum
isalpha
isspace
localeconv
malloc
memcpy
putc
qsort
realloc
setlocale
signal
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strrchr
strstr
strtoul
tolower
vfprintf
wcschr
wcslen

libiconv-2

libiconv
libiconv_open
libiconv_set_relocation_prefix

Exports

Exports

__canonicalize_file_name
__printf__
__realpath
_nl_expand_alias
_nl_explode_name
_nl_find_domain
_nl_find_msg
_nl_language_preferences_default
_nl_load_domain
_nl_locale_name
_nl_locale_name_canonicalize
_nl_locale_name_default
_nl_locale_name_environ
_nl_locale_name_from_win32_LANGID
_nl_locale_name_from_win32_LCID
_nl_locale_name_posix
_nl_locale_name_thread
_nl_locale_name_thread_unsafe
_nl_log_untranslated
_nl_make_l10nflist
_nl_msg_cat_cntr
_nl_normalize_codeset
_nl_state_lock
bind_textdomain_codeset
bindtextdomain
canonicalize_file_name
dcgettext
dcngettext
dgettext
dngettext
getshortpath
gettext
libintl_asprintf
libintl_bind_textdomain_codeset
libintl_bindtextdomain
libintl_dcgettext
libintl_dcigettext
libintl_dcngettext
libintl_dgettext
libintl_dngettext
libintl_fprintf
libintl_fwprintf
libintl_gettext
libintl_gettext_extract_plural
libintl_gettext_free_exp
libintl_gettext_germanic_plural
libintl_gettextparse
libintl_hash_string
libintl_lock_destroy_func
libintl_lock_init_func
libintl_lock_lock_func
libintl_lock_unlock_func
libintl_ngettext
libintl_nl_current_default_domain
libintl_nl_default_default_domain
libintl_nl_default_dirname
libintl_nl_domain_bindings
libintl_once_func
libintl_recursive_lock_destroy_func
libintl_recursive_lock_init_func
libintl_recursive_lock_lock_func
libintl_recursive_lock_unlock_func
libintl_relocate
libintl_rwlock_destroy_func
libintl_rwlock_init_func
libintl_rwlock_rdlock_func
libintl_rwlock_unlock_func
libintl_rwlock_wrlock_func
libintl_set_relocation_prefix
libintl_setlocale
libintl_snprintf
libintl_sprintf
libintl_swprintf
libintl_textdomain
libintl_vasnprintf
libintl_vasnwprintf
libintl_vasprintf
libintl_version
libintl_vfprintf
libintl_vfwprintf
libintl_vprintf
libintl_vsnprintf
libintl_vsprintf
libintl_vswprintf
libintl_vwprintf
libintl_wprintf
locale_charset
ngettext
relocate2
relocaten
relocaten2
relocatenx
relocatepx
relocatex
textdomain
win2posixpath
win2unixpath
xmax
xsum
xsum3
xsum4

Sections

.text
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libpcre2-8-0.dll
.dll windows:4 windows x64 arch:x64

2c9bb9391d6e8d73cb8aecfb80eef61e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CreateMutexA
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
ReleaseMutex
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
isalnum
isalpha
iscntrl
isgraph
islower
isprint
ispunct
isspace
isupper
isxdigit
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
signal
strchr
strlen
strncmp
tolower
toupper
vfprintf

Exports

Exports

_pcre2_OP_lengths_8
_pcre2_auto_possessify_8
_pcre2_callout_end_delims_8
_pcre2_callout_start_delims_8
_pcre2_check_escape_8
_pcre2_default_compile_context_8
_pcre2_default_convert_context_8
_pcre2_default_match_context_8
_pcre2_default_tables_8
_pcre2_extuni_8
_pcre2_find_bracket_8
_pcre2_hspace_list_8
_pcre2_is_newline_8
_pcre2_jit_free_8
_pcre2_jit_free_rodata_8
_pcre2_jit_get_size_8
_pcre2_jit_get_target_8
_pcre2_memctl_malloc_8
_pcre2_ord2utf_8
_pcre2_script_run_8
_pcre2_strcmp_8
_pcre2_strcmp_c8_8
_pcre2_strcpy_c8_8
_pcre2_strlen_8
_pcre2_strncmp_8
_pcre2_strncmp_c8_8
_pcre2_study_8
_pcre2_ucd_caseless_sets_8
_pcre2_ucd_digit_sets_8
_pcre2_ucd_records_8
_pcre2_ucd_script_sets_8
_pcre2_ucd_stage1_8
_pcre2_ucd_stage2_8
_pcre2_ucp_gbtable_8
_pcre2_ucp_gentype_8
_pcre2_ucp_typerange_8
_pcre2_unicode_version_8
_pcre2_utf8_table1
_pcre2_utf8_table1_size
_pcre2_utf8_table2
_pcre2_utf8_table3
_pcre2_utf8_table4
_pcre2_utt_8
_pcre2_utt_names_8
_pcre2_utt_size_8
_pcre2_valid_utf_8
_pcre2_vspace_list_8
_pcre2_was_newline_8
_pcre2_xclass_8
pcre2_callout_enumerate_8
pcre2_code_copy_8
pcre2_code_copy_with_tables_8
pcre2_code_free_8
pcre2_compile_8
pcre2_compile_context_copy_8
pcre2_compile_context_create_8
pcre2_compile_context_free_8
pcre2_config_8
pcre2_convert_context_copy_8
pcre2_convert_context_create_8
pcre2_convert_context_free_8
pcre2_converted_pattern_free_8
pcre2_dfa_match_8
pcre2_general_context_copy_8
pcre2_general_context_create_8
pcre2_general_context_free_8
pcre2_get_error_message_8
pcre2_get_mark_8
pcre2_get_ovector_count_8
pcre2_get_ovector_pointer_8
pcre2_get_startchar_8
pcre2_jit_compile_8
pcre2_jit_free_unused_memory_8
pcre2_jit_match_8
pcre2_jit_stack_assign_8
pcre2_jit_stack_create_8
pcre2_jit_stack_free_8
pcre2_maketables_8
pcre2_match_8
pcre2_match_context_copy_8
pcre2_match_context_create_8
pcre2_match_context_free_8
pcre2_match_data_create_8
pcre2_match_data_create_from_pattern_8
pcre2_match_data_free_8
pcre2_pattern_convert_8
pcre2_pattern_info_8
pcre2_serialize_decode_8
pcre2_serialize_encode_8
pcre2_serialize_free_8
pcre2_serialize_get_number_of_codes_8
pcre2_set_bsr_8
pcre2_set_callout_8
pcre2_set_character_tables_8
pcre2_set_compile_extra_options_8
pcre2_set_compile_recursion_guard_8
pcre2_set_depth_limit_8
pcre2_set_glob_escape_8
pcre2_set_glob_separator_8
pcre2_set_heap_limit_8
pcre2_set_match_limit_8
pcre2_set_max_pattern_length_8
pcre2_set_newline_8
pcre2_set_offset_limit_8
pcre2_set_parens_nest_limit_8
pcre2_set_recursion_limit_8
pcre2_set_recursion_memory_management_8
pcre2_set_substitute_callout_8
pcre2_substitute_8
pcre2_substring_copy_byname_8
pcre2_substring_copy_bynumber_8
pcre2_substring_free_8
pcre2_substring_get_byname_8
pcre2_substring_get_bynumber_8
pcre2_substring_length_byname_8
pcre2_substring_length_bynumber_8
pcre2_substring_list_free_8
pcre2_substring_list_get_8
pcre2_substring_nametable_scan_8
pcre2_substring_number_from_name_8

Sections

.text
Size: 418KB - Virtual size: 418KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libssp-0.dll
.dll windows:4 windows x64 arch:x64

7983c35a4ee9749189a72033ac9be46d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__iob_func
_amsg_exit
_close
_exit
_initterm
_lock
_open
_unlock
_vscprintf
_vsnprintf
_write
abort
calloc
fgets
free
fwrite
gets
malloc
memcpy
memmove
memset
realloc
signal
strlen
strncmp
strncpy
vfprintf
vsprintf

Exports

Exports

__chk_fail
__gets_chk
__memcpy_chk
__memmove_chk
__mempcpy_chk
__memset_chk
__snprintf_chk
__sprintf_chk
__stack_chk_fail
__stack_chk_fail_local
__stack_chk_guard
__stpcpy_chk
__strcat_chk
__strcpy_chk
__strncat_chk
__strncpy_chk
__vsnprintf_chk
__vsprintf_chk

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
msvcp144.dll
.dll windows:6 windows x64 arch:x64

8b6b97ef61a371ea003e86f4961554ca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

4}Gdc<fgTRa-[%WA g'h]*S-13}#S-C$c&'X#K'+@*y=PA8f{8F=tyl68{ym;Rz4V8ME`z<@q~0sLq1sGVmHVk

Imports

advapi32

RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
GetTokenInformation
DuplicateTokenEx
OpenThreadToken
RevertToSelf
ImpersonateLoggedOnUser
CheckTokenMembership
LookupPrivilegeValueW
AdjustTokenPrivileges
EventWrite
EventRegister
EventEnabled

bcrypt

BCryptCreateHash
BCryptFinishHash
BCryptGetProperty
BCryptHashData
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenRandom

kernel32

TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
CloseThreadpoolIo
GetCurrentProcessId
MultiByteToWideChar
GetStdHandle
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetCalendarInfoEx
CompareStringOrdinal
CompareStringEx
FindNLSStringEx
GetLocaleInfoEx
ResolveLocaleName
GetUserPreferredUILanguages
FindStringOrdinal
GetTickCount64
GetCurrentProcessorNumber
GetCurrentProcess
GetCurrentThread
WaitForSingleObject
Sleep
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
InitializeCriticalSection
InitializeConditionVariable
DeleteCriticalSection
LocalFree
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
WaitForMultipleObjectsEx
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
GetFullPathNameW
GetLongPathNameW
LocalAlloc
GetConsoleOutputCP
WideCharToMultiByte
GetProcAddress
RaiseFailFastException
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
LocaleNameToLCID
LCMapStringEx
EnumTimeFormatsEx
EnumCalendarInfoExEx
CopyFileExW
CreateDirectoryW
CreateFileW
DeviceIoControl
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FlushFileBuffers
FreeLibrary
GetCurrentDirectoryW
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetOverlappedResult
GetSystemDirectoryW
LoadLibraryExW
ReadFile
SetFileAttributesW
SetFilePointerEx
SetThreadErrorMode
CreateThread
ResumeThread
DuplicateHandle
GetThreadPriority
SetThreadPriority
GetDynamicTimeZoneInformation
GetTimeZoneInformation
WriteFile
CloseHandle
SetEvent
ResetEvent
CreateEventExW
GetEnvironmentVariableW
FormatMessageW
GetCPInfoExW
GetConsoleMode
ReadConsoleW
WriteConsoleW
K32EnumProcessModulesEx
IsWow64Process
GetExitCodeProcess
CreateProcessW
OpenProcess
K32EnumProcesses
K32GetModuleInformation
K32GetModuleBaseNameW
K32GetModuleFileNameExW
GetProcessId
CreatePipe
GetConsoleCP
FlushProcessWriteBuffers
GetCurrentThreadId
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
TerminateProcess
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
VirtualQuery
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
InitializeSListHead
InitializeCriticalSectionAndSpinCount

ole32

CoTaskMemFree
CoGetApartmentType
CoCreateGuid
CoUninitialize
CoInitializeEx
CoWaitForMultipleHandles
CoTaskMemAlloc

user32

LoadStringW

api-ms-win-crt-heap-l1-1-0

_callnewh
calloc
free
malloc

api-ms-win-crt-string-l1-1-0

wcsncmp
_stricmp
strncpy_s
_wcsicmp
strcpy_s
strcmp
memset

api-ms-win-crt-math-l1-1-0

modf
ceil
tan
sin
pow
cos
floor

api-ms-win-crt-runtime-l1-1-0

_initterm
abort
terminate
_crt_atexit
_cexit
_seh_filter_dll
_initterm_e
_configure_narrow_argv
_initialize_narrow_environment
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsscanf

Exports

Exports

qwko120p

Sections

.text
Size: 461KB - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vcruntime211.dll
zlib1.dll
.dll windows:4 windows x64 arch:x64

bc1891389bc989e6f0c48d238537f59d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__iob_func
_amsg_exit
_close
_errno
_initterm
_lock
_lseek
_open
_read
_unlock
_vsnprintf
_wopen
_write
abort
calloc
free
fwrite
malloc
memchr
memcpy
memset
realloc
signal
strerror
strlen
strncmp
vfprintf
wcstombs

Exports

Exports

_dist_code
_length_code
_tr_align
_tr_flush_bits
_tr_flush_block
_tr_init
_tr_stored_block
_tr_tally
adler32
adler32_combine
adler32_combine64
adler32_z
compress
compress2
compressBound
crc32
crc32_combine
crc32_combine64
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
deflate_copyright
get_crc_table
gz_error
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzfread
gzfwrite
gzgetc
gzgetc_
gzgets
gzoffset
gzoffset64
gzopen
gzopen64
gzopen_w
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzseek64
gzsetparams
gztell
gztell64
gzungetc
gzvprintf
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
inflate_copyright
inflate_fast
inflate_table
uncompress
uncompress2
zError
z_errmsg
zcalloc
zcfree
zlibCompileFlags
zlibVersion

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

319a2b3f0fb7a912b54f60d0468581ad

Code Sign

97:0f:49:6d:c0:43:82:b6:cc:56:7e:83:75:54:0f:17Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2dCertificate

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

42:98:5f:41:f8:bc:69:40:3d:e7:b5:ca:67:10:c2:d5:68:60:5c:0d:94:c3:02:82:38:53:5d:d6:ba:2e:a4:00Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libiconv-2

libintl-8

libpcre2-8-0

zlib1

advapi32

kernel32

msvcrt

ntdll

user32

ws2_32

libssp-0

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.data Size: 27KB - Virtual size: 26KB

.rdata Size: 212KB - Virtual size: 211KB

.pdata Size: 49KB - Virtual size: 48KB

.xdata Size: 55KB - Virtual size: 55KB

.bss Size: - Virtual size: 751KB

.edata Size: 512B - Virtual size: 60B

.idata Size: 12KB - Virtual size: 11KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

.debug Size: 156B - Virtual size: 512B

90700b4f180f212b87c3cb73550ba6c3

Headers

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

user32

ws2_32

Exports

Exports

Sections

.text Size: 1.9MB - Virtual size: 1.8MB

.data Size: 7KB - Virtual size: 7KB

.rdata Size: 481KB - Virtual size: 481KB

.pdata Size: 75KB - Virtual size: 74KB

.xdata Size: 63KB - Virtual size: 63KB

.bss Size: - Virtual size: 17KB

.edata Size: 128KB - Virtual size: 128KB

.idata Size: 6KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 952B

.reloc Size: 20KB - Virtual size: 20KB

.debug Size: 156B - Virtual size: 512B

0436bf783880308ca19dd01c9fab2973

Headers

97:0f:49:6d:c0:43:82:b6:cc:56:7e:83:75:54:0f:17
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

42:98:5f:41:f8:bc:69:40:3d:e7:b5:ca:67:10:c2:d5:68:60:5c:0d:94:c3:02:82:38:53:5d:d6:ba:2e:a4:00
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 27KB - Virtual size: 26KB

.rdata
Size: 212KB - Virtual size: 211KB

.pdata
Size: 49KB - Virtual size: 48KB

.xdata
Size: 55KB - Virtual size: 55KB

.bss
Size: - Virtual size: 751KB

.edata
Size: 512B - Virtual size: 60B

.idata
Size: 12KB - Virtual size: 11KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB

.debug
Size: 156B - Virtual size: 512B

.text
Size: 1.9MB - Virtual size: 1.8MB

.data
Size: 7KB - Virtual size: 7KB

.rdata
Size: 481KB - Virtual size: 481KB

.pdata
Size: 75KB - Virtual size: 74KB

.xdata
Size: 63KB - Virtual size: 63KB

.bss
Size: - Virtual size: 17KB

.edata
Size: 128KB - Virtual size: 128KB

.idata
Size: 6KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 952B

.reloc
Size: 20KB - Virtual size: 20KB

.debug
Size: 156B - Virtual size: 512B

.text
Size: 452KB - Virtual size: 452KB

.data
Size: 1024B - Virtual size: 528B

.rdata
Size: 85KB - Virtual size: 85KB

.pdata
Size: 13KB - Virtual size: 13KB

.xdata
Size: 13KB - Virtual size: 13KB

.bss
Size: - Virtual size: 6KB

.edata
Size: 2KB - Virtual size: 2KB

.idata
Size: 20KB - Virtual size: 20KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 1KB - Virtual size: 1KB

.debug
Size: 156B - Virtual size: 512B

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 846KB - Virtual size: 845KB

.data
Size: 7KB - Virtual size: 384KB

.pdata
Size: 110KB - Virtual size: 110KB

.rsrc
Size: 1024B - Virtual size: 812B

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 86KB - Virtual size: 86KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 21KB - Virtual size: 20KB