EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual [FileCR].zip
- SHA256 99fcfa72a4c12834c344d89a1db6a708e356cd0bf7d80fec62e7113c84ebead7
Password
123
General
- Target EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual [FileCR].zip
- Size 69.0MB
- Sample260226-m7zbwsb16d
- SHA256 99fcfa72a4c12834c344d89a1db6a708e356cd0bf7d80fec62e7113c84ebead7
- MD5 9dde8f2d278f04b00237738fa6951b91
- SHA1 76aaa3e3895a8b90c64298263ffbce0fe8568385
- SHA512 3391c9b2a0d27153e8b1fb6a518a96680227b46d2f7bd6ed92eb9afb091978dc398cde68d5422c78fde86b10c8065f755edd51663efc469dffb00f6e45d4c7d6
- SSDEEP 1572864:W8Ck+j95qK9JkJexVPw+yNnHojV8V/RMtVOEZgpO:WYS939JWe3UNHoECOESpO
- TLSH T1BDF733BA178975D14935870C8020759D625F2CA6BC278079A8D9C78DE43A38F71AEF3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack002/2- Patcher/(32-Bit) EDRW Patcher v1.1.exe unpack002/2- Patcher/(64-Bit) EDRW Patcher v1.1.exe unpack002/3- KeyGen (Activator)/EDRW v13 Activator v2.1 - De!.exe - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual/setup.exe innosetup
File Explorer
-
EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual [FileCR].zip.zip 69.0MB
-
EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual/EDRW Patch v1.1 & Activator 2.1 - yaschir.zip.zip 1.1MB
-
1- Hosts blocker/EaseUS hosts blocker.bat.bat .vbs 3KB
-
2- Patcher/(32-Bit) EDRW Patcher v1.1.exe.exe 147KB
-
2- Patcher/(64-Bit) EDRW Patcher v1.1.exe.exe 147KB
-
3- KeyGen (Activator)/EDRW v13 Activator v2.1 - De!.exe.exe 3.5MB
-
ReadMe (EDRW).txt3KB
-
EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual/setup.exe.exe 68.0MB
EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual/EDRW Patch v1.1 & Activator 2.1 - yaschir.zip
- SHA256 4b929efe2753988a399f16c24a26a9610fb9eeffa05d641fdaae8213e907aa9d
- MD5 92de5dbc76ca5302d92b725b0f7fc9c2
- SHA1 52b42ef3c9b86334133f9b916c1bb934822bbd72
- SHA512 3c7c201c38ea59053182fada92b2d0f9b4ded33b0d19ee92c4e41644e647ff252a3b1d06a87efc96ea0d55400fc9ece37810806f131cffe7199bf9fad1f9dc5d
- SSDEEP 24576:8V6ySRNVjIsNG5b2bQ6ah/X0ELUVxAoOc3VK4uW:8V6ySvNLB/cXiV+c3MW
- TLSH T1803533C849AFED5BF4D861B0D8FF94C66FE0295138C247E6F22BB81AB17B11444963D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
1- Hosts blocker/EaseUS hosts blocker.bat
- SHA256 0124f42ac03a8f0ccacb35cf2e57d8ce96a323d66fbe4ebe06ad1def2e4d3b20
- MD5 a20bef352c605997b09e2da7bca1f16e
- SHA1 732df89434737131afb0ebaa94bbdafee76181af
- SHA512 4951e502b532506c7071ca014f2e08fb60731c877ce07af4903433074f710ccce8887e39efb2f5ef7456b206947f3457fc16405c9a4048d53470b7d0c4d620d5
- TLSH T12A714F1C0F4CDD7998AA2818F303A3B16238710AA5AE6BD422DA3495F141F5D1E7BEB0
- MD5 SHA1 SHA512 TLSH
2- Patcher/(32-Bit) EDRW Patcher v1.1.exe
- IMPHASH dc73a9bd8de0fd640549c85ac4089b87
- SHA256 8a66e54eb6a022eeb9063bf8182d3d1dee11aa6990742e25ccd64cc5b7dbe3b0
- MD5 d0d44869d0b87fd8e960951687417cc9
- SHA1 8594dce79ce8745f09498ae5c5ca539d30fd1db6
- SHA512 fe96f3d56345bd6dd9543ec259a6c7b646c44501029b5503453993646404c9dd805d7cae7f73d6e0cf29ae07edf950fefdfd7ec298314af962df2d4f8ec2c67a
- SSDEEP 3072:UEz43VWFR6FJ/V1UM181JjYrAAI4b6CMi23Bq793+MWyt:UEN5Jt4b6CM13BqB36I
- TLSH T1FDE38D808DD31ED8D6D85071E17ADE5062E62D0B17AB05A32993BEB5F7F35F3A422342
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
5
Entry point
4139
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile
Name
.text
Size
512B
Virtual Size
502B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
82B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=18, version=8444,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=17, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
2- Patcher/(64-Bit) EDRW Patcher v1.1.exe
- IMPHASH dc73a9bd8de0fd640549c85ac4089b87
- SHA256 04491956a8b8993e031d632304ff57667bc4c77885da153e75454ff2e25dbc1d
- MD5 087406e501b283f538d66c98b7ea1991
- SHA1 9a8d7d7c82b87ee6875c8f0397f3f61d3508e908
- SHA512 d938192532c84a6c037fc844f2e5bad0cadd10812028b3424ba8db730540c07a52b44646e43dc2c043821bbeaf2cc7586acf0dd22cae44ba77e63cfbd85c8174
- SSDEEP 3072:UEz43VWFR6FJ/V1UM181JjYrAAI4b6CMi23BOMu4Xa061:UEN5Jt4b6CM13BPXaf1
- TLSH T115E38C805D971EC8D6E84470E23ADE6052E66D0713AB05A32997BEB5F7F74F3A432342
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
5
Entry point
4139
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile
Name
.text
Size
512B
Virtual Size
502B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
82B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=18, version=8444,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=17, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
3- KeyGen (Activator)/EDRW v13 Activator v2.1 - De!.exe
- SHA256 10badd3b49c88ac87ce720c47ccd79f0db4f8125d63b52d328e554fb549c44a8
- MD5 284182f0388fe891ed6b6a1da5b4196e
- SHA1 ee4ffea0eb3ceef561c7b02fbcc11f14a8775027
- SHA512 6797010284372abade5b8ad4c7c84bfedc9d40be56f6a159f4e804933038c57954e5b99915230db41f5b4bb0a975352257629bb2963616e7e41fa0346e1befea
- SSDEEP 24576:E3ub5cDzp/Ook9bVHIKAuTVijaUH2AcQNoMJ+CeWwIpA1JeuoSOBRcSrBIMmCpCB:q57cQKauDOTcSrqMmpnF8OMJLjelXl
- TLSH T1FE060612B2446639DE5F1B36F5238160B937AED3E7929C5B06E07C08FE76B40367E606
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
5
Entry point
2295284
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
26KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
72B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
201KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
ReadMe (EDRW).txt
- SHA256 d95dd67969972258d255169d95f5eb948494c8e1c092e1fcfd69dda1c5ce98fe
- MD5 5590d164c5a5933c6d76cb7c51ec3c61
- SHA1 e2738fb23099d2556ce04a3756e6af26f2137346
- SHA512 802532601bc4cc5022ec52be6f6861abff98ff85f7983c04d5cba66f28b32e55ee027e688db648391a38fa656d9479ab9b4103e5c3a1f7fb3fa20de578963d3e
- TLSH T117613429515E41FD28E30A9660EAB1B7D307F4A58898FAF16CF9C0843129B0C39EF11C
- MD5 SHA1 SHA512 TLSH
EaseUS Data Recovery Wizard Technician 17.0.0.0 Build 20231121 Multilingual/setup.exe
- IMPHASH 20dd26497880c05caed9305b3c8b9109
- SHA256 c4469510af58535ff16e62d1bcdc28ffd3f6c0356868d36bb0fe64305706d8b7
- MD5 da6cb209e8266ad3b0ada9a1b25b88e4
- SHA1 cd66ef2552745dc5cceda2e59ba1a0c7b6111ca0
- SHA512 909ce5f0268937611034cd2afec9c52a5b89d495b9e18adf0ba7960249397062acd6a06ad35f2d9307e708ef9661aa6b5a3bf78f1455233f60705fadf9d9a54c
- SSDEEP 1572864:yB1Vkowk8PFVlLDLV7q5KzIy/LW4hxtD2o9qhxsfCnj9o+:3zfldhIzOX2kK
- TLSH T1A7F7339193CA75B6CD8849368666074DACE1B80599F274AE1FF5E90CB8FD0C2CB7E113
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Password
123
Digest
77:5f:02:6d:95:9d:13:a0:af:65:ce:1d:aa:55:21:ab:fd:84:fb:08:f9:90:aa:3b:93:88:26:59:a2:03:13:20
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91510107765360104N,CN=CHENGDU YIWO Tech Development Co.\, Ltd.,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6ada6e4beafe58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Nov 21, 2023
SERIALNUMBER=91510107765360104N,CN=CHENGDU YIWO Tech Development Co.\, Ltd.,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6ada6e4beafe58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91510107765360104N,CN=CHENGDU YIWO Tech Development Co.\, Ltd.,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6ada6e4beafe58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=91510107765360104N,CN=CHENGDU YIWO Tech Development Co.\, Ltd.,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6ada6e4beafe58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
03:bd:22:19:37:f2:d7:96:fa:70:29:54:7b:19:03:01
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 21, 2022 - Dec 2, 2024
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
5
Entry point
71644
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
user32
GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
TranslateMessage
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
ExitWindowsEx
DispatchMessageW
DestroyWindow
CharUpperBuffW
CallWindowProcW
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
SignalObjectAndWait
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LoadLibraryW
GetWindowsDirectoryW
GetVersionExW
GetVersion
GetUserDefaultLangID
GetThreadLocale
GetSystemInfo
GetSystemDirectoryW
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
DeleteFileW
CreateProcessW
CreateFileW
CreateEventW
CreateDirectoryW
CloseHandle
Sleep
comctl32
InitCommonControls
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
21KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
114KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ