36d2d16f5fb6aaf7a666f0e11334628892229aac7f8e0ed9d0072f72de6051f3
- SHA256 36d2d16f5fb6aaf7a666f0e11334628892229aac7f8e0ed9d0072f72de6051f3
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ENQUIRY_PO25-07-780_NAFFCO_ORDER .exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ENQUIRY_PO25-07-780_NAFFCO_ORDER .exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
pdh.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral4
Sample
pdh.dll
Resource
win11-20260130-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target 36d2d16f5fb6aaf7a666f0e11334628892229aac7f8e0ed9d0072f72de6051f3
- Size 2.1MB
- Sample260424-jafxhabv21
- SHA256 36d2d16f5fb6aaf7a666f0e11334628892229aac7f8e0ed9d0072f72de6051f3
- MD5 92e0e958f9996c2bf1d06ad56fa6fd82
- SHA1 8151b98508e1baee0614ddb03495d590b0be1ec3
- SHA512 f58f13fc6f6a0f31f51152783798eaf24f1df6dd056674ca80a2c4fc6757040ab0465819be6551548c796ff6ed545d7ec227f4f2979634b9fb1cac7926736249
- SSDEEP 49152:Olv5bKg/Zo1NVI76i8/2KcSlZt+XPz1I/+hBVpAqy507w2b6h5/f:OygRIZ3bjlfiPZIWpAkwXXH
- TLSH T179A533F7929F6C78F19416247B22D70334367C1975AD732E3EA6080BA322BDBCD16129
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/pdh.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/pdh.dll
File Explorer
-
36d2d16f5fb6aaf7a666f0e11334628892229aac7f8e0ed9d0072f72de6051f3.zip 2.1MB
-
ENQUIRY_PO25-07-780_NAFFCO_ORDER .exe.exe 173KB
-
pdh.dll.dll 4.4MB
ENQUIRY_PO25-07-780_NAFFCO_ORDER .exe
- IMPHASH 095755983554d7d86ae8014c857865ff
- SHA256 7705a9dc869e70ef5b9790b26c03558e79add5327de0b52e44308196fc312e24
- MD5 97822cdc8f3dbed2c0cf6d848d0a9fe6
- SHA1 b729bf0444dd2b205d4cd5ec79706bf9fe8d5760
- SHA512 58918d091d6946c1102004d3bbf422fc141e2c85f4e46737c37ee90129fc7c34d4ebd08ae8a0f8f87eb760ae2266e242a8efa16116389a7ca9a43c40c8e09365
- SSDEEP 3072:OoltDLHp+Gyn8OFUP8p+ZsHpO5b+ENbnADEEvdgXp6srt:Ool9Nztc+8NH85b7ivdgXpP
- TLSH T1C004B40222A10098F3564774A676E991C765BCB807A0E7DFD234BA391F722935E7732F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ff:ac:96:a1:77:33:9a:b3:10:9e:ce:f8:40:60:4f:62:a0:5f:01:d4:4a:a1:7e:4b:9f:87:f7:99:49:39:0a:33
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=23829868,CN=CyberLink Corp.,O=CyberLink Corp.,ST=New Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Chains
Oct 23, 2025
SERIALNUMBER=23829868,CN=CyberLink Corp.,O=CyberLink Corp.,ST=New Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=23829868,CN=CyberLink Corp.,O=CyberLink Corp.,ST=New Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=23829868,CN=CyberLink Corp.,O=CyberLink Corp.,ST=New Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Serial Number
0a:fc:c7:b3:fa:44:49:92:34:0a:28:87:47:89:e3:c3
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 5, 2024 - Jul 30, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Minor OS version
0
Major OS version
6
Entry point
55144
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\RDBuildPool\20250704-16403\AITranscoder\x64\ReleaseFull\PDAITransformer.pdb
shlwapi
PathAddBackslashA
PathIsDirectoryA
PathIsDirectoryW
PathAppendA
PathFileExistsW
PathRemoveFileSpecA
PathRemoveFileSpecW
PathAddBackslashW
StrCmpW
gdiplus
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipImageRotateFlip
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipCreateHBITMAPFromBitmap
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipDeleteGraphics
GdipSetImageAttributesWrapMode
GdipDisposeImageAttributes
GdipCreateImageAttributes
pdh
PdhCollectQueryData
PdhAddCounterW
PdhOpenQueryA
PdhGetFormattedCounterValue
mfc140
ord14136
ord2962
ord4343
ord9343
ord2367
ord1487
ord1485
ord316
ord1032
ord2207
ord265
ord266
ord2342
ord2338
ord6483
ord2416
ord4937
ord12189
ord310
ord306
ord12391
ord4503
ord4648
ord2395
ord286
ord1031
ord1497
ord4500
ord8416
ord8024
ord2394
ord11978
ord14144
ord12035
ord14197
ord3137
ord4686
ord8862
ord7890
ord5211
ord7420
ord7431
ord7430
ord5049
ord5213
ord5067
ord5323
ord9001
ord5536
ord5347
ord5064
ord6595
ord988
ord4715
ord11798
ord3165
ord3271
ord3270
ord3804
ord11754
ord2627
ord5704
ord5566
ord7620
ord4351
ord4817
ord4756
ord13284
ord11357
ord6607
ord14134
ord4741
ord7364
ord5982
ord13331
ord3205
ord3202
ord9903
ord7881
ord2696
ord1450
ord14279
ord9933
ord9935
ord9934
ord9932
ord9936
ord5435
ord11365
ord11366
ord8792
ord11719
ord3710
ord11575
ord14128
ord8618
ord11850
ord6703
ord10644
ord8909
ord3166
ord13438
ord11892
ord11888
ord1695
ord1717
ord1743
ord1729
ord1750
ord4765
ord4832
ord4777
ord4795
ord4789
ord4783
ord4842
ord4826
ord4771
ord4848
ord4803
kernel32
lstrcmpiA
InitializeSListHead
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentProcessId
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
QueryPerformanceCounter
GlobalMemoryStatus
OutputDebugStringW
WideCharToMultiByte
LoadLibraryA
GetModuleFileNameW
GetModuleFileNameA
GetVersionExA
TerminateThread
SetThreadPriority
CreateThread
Sleep
CreateEventA
WaitForSingleObject
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
OutputDebugStringA
GetTempPathW
FindNextFileA
FindFirstFileA
FindClose
SetCurrentDirectoryA
SetEnvironmentVariableA
GetEnvironmentVariableA
GetCommandLineA
K32GetModuleFileNameExA
Thread32Next
Thread32First
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrlenA
OpenProcess
ResumeThread
SuspendThread
OpenThread
CloseHandle
GetLongPathNameA
LocalFree
LoadLibraryExW
GetProcAddress
GetModuleHandleA
FreeLibrary
GetCurrentThreadId
SetErrorMode
GetCommandLineW
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
user32
UnregisterClassA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
PostQuitMessage
RegisterClassExA
CreateWindowExA
DestroyWindow
ShowWindow
SetTimer
KillTimer
UpdateWindow
BeginPaint
EndPaint
GetWindowTextW
FindWindowA
LoadCursorA
LoadIconA
IsWindowVisible
IsIconic
PostMessageA
GetWindowTextA
GetDesktopWindow
EnumThreadWindows
GetWindowThreadProcessId
PeekMessageA
SendMessageA
RegisterClassA
FindWindowW
EnableWindow
gdi32
DeleteObject
GetStockObject
GetObjectA
advapi32
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExA
RegFlushKey
RegQueryValueExW
RegQueryValueExA
RegCloseKey
shell32
SHGetSpecialFolderPathA
CommandLineToArgvW
ole32
CoInitialize
CoCreateInstance
CoUninitialize
vcruntime140
__C_specific_handler
__current_exception_context
memcpy
__RTDynamicCast
memset
__current_exception
__std_terminate
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
api-ms-win-crt-string-l1-1-0
strcpy_s
strncpy_s
wcscpy_s
api-ms-win-crt-multibyte-l1-1-0
_mbscmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
__stdio_common_vsprintf_s
__p__commode
_set_fmode
api-ms-win-crt-convert-l1-1-0
_wtoi
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
_splitpath_s
api-ms-win-crt-runtime-l1-1-0
exit
_register_thread_local_exe_atexit_callback
_c_exit
_get_narrow_winmain_command_line
_initterm
_initterm_e
_set_app_type
_exit
_seh_filter_exe
terminate
_cexit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
23KB
Virtual Size
286KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
432B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=260, version=27412,
count=10, id=260, version=33030,
count=4, id=259, version=33030,
count=33, id=261, version=33030,
count=6, id=257, version=33030,
count=23, id=257, version=27412,
count=363, id=1, productName=Unmarked objects,
count=4, id=261, version=33145,
count=10, id=261, version=33133,
count=1, id=255, version=33133,
count=1, id=258, version=33133,
pdh.dll
- IMPHASH b1ca4f99aa188364d5170a21e93b5cb6
- SHA256 d8a05deefe97c6bbe1e083e9d8a182e6b6e5fbc77af483d2cdef0b4cadec22ce
- MD5 ff185b05b231eed98d33239f1b202241
- SHA1 fa12ecc7f62ab4af572a2ff261ff7c88f525bfe6
- SHA512 47d90ab9aa0d2cfe0d5756cdf38464d9c57b71b84b870ae596fb764ef9552b9ac450fc9dc4b38a4e3ded326b33715e5d0db3434fff48d7a809e7f80c82c1e034
- SSDEEP 98304:j87K9q2QTS2cvDVu8lPs/4jXISObkpXsd5KPiba4jkwUoyETGUJGYSBKshieGdXS:qKuGu8lxXfJXsKab5L1shih0
- TLSH T15926BF06B7D40995D11BCA34CA1BE332C2B2B9650A36D2CB1965E74B2FB3F914F3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
403484
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advapi32
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
EventWrite
EventRegister
EventEnabled
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
bcrypt
BCryptGenRandom
kernel32
TlsFree
TlsSetValue
SetLastError
GetModuleFileNameW
GetLastError
MultiByteToWideChar
GetStdHandle
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
LoadLibraryExW
FileTimeToSystemTime
GetSystemTime
GetTickCount64
GetCurrentProcessorNumber
GetCurrentProcess
GetCurrentThread
Sleep
InitializeCriticalSection
InitializeConditionVariable
DeleteCriticalSection
LocalFree
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
WaitForMultipleObjectsEx
SetThreadErrorMode
GetFileAttributesExW
GetFullPathNameW
GetLongPathNameW
LocalAlloc
GetConsoleOutputCP
WideCharToMultiByte
WriteFile
GetProcAddress
RaiseFailFastException
CreateDirectoryW
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FreeLibrary
DuplicateHandle
GetThreadPriority
GetDynamicTimeZoneInformation
GetTimeZoneInformation
CloseHandle
SetEvent
CreateEventExW
GetEnvironmentVariableW
FormatMessageW
CreateFileW
FlushProcessWriteBuffers
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
TerminateProcess
SwitchToThread
CreateThread
SetThreadPriority
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
VirtualQuery
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
ResetEvent
DebugBreak
WaitForSingleObject
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
InitializeSListHead
GetCurrentProcessId
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ole32
CoUninitialize
CoInitializeEx
CoCreateGuid
CoGetApartmentType
CoWaitForMultipleHandles
api-ms-win-crt-math-l1-1-0
ceil
modf
pow
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
malloc
free
api-ms-win-crt-string-l1-1-0
strcpy_s
wcsncmp
strcmp
_wcsicmp
api-ms-win-crt-runtime-l1-1-0
abort
terminate
_cexit
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_initterm
_initterm_e
_configure_narrow_argv
_seh_filter_dll
0EAe3xPdSypJgac9536iieIS6X1xK8b
1AZhxYmxI
1GzRes75SdQBoNA
1QZk6jUNs2GZR
2lRXBWarZVesBfigDmANAgg
2nF8KG0bOWN
2opEmPz8BUeyEcob7FCWYj8o6zPf02
39Ha9jAn25gQCTKeeIUMcnJ
3KRp1ZGZzWkzjrbF7KW
4vTm7d5NEn
5P1s7vxqabqONzeF
5SdnV3Jljgx6YYFEGPEi
5kkeerFsgdsrpQgVmM9donigU4PKnJ
60YN8G0TFHe2mteryL4IAQN0AEGYoP
6FwCppnrbhteJ2RQMh
6pc94lAzjZsTppaBOqG6Of
6uDjryf6fNvkUt79uGp8l3YhQTwC0
7lBhZ7P2GIygYbOn55pt
87MNpFP8DW97PCvKT
9BV5q4qDpy4k
9SCDujnbLdPZIIdSST9Ctl
ABU6Y5aAp3D2a7zS5paaAtDiMlx
AFWAK2vAFscApI8Kb78xhaSOCNot
AFmq2u0lEvhHDjGiH4gIqQmYgcc
AFuftnpUFzbqm1oE3fMh
AGWsMz7ANU
AcxPbmYRetDXN8MR
BarDsrhK8mkYKfPqS
Brk69821wjQzxho
BwflE9B72mxQntklJg255G6GBns
CpNZmsUkHeKdeI5
DCsHVWYmNNPlCWTxNdyyBrI8ks
EJtodbbgUhiNTMYNXuNzXF
EnrtLwkxgAxW68T1KKH7ax9xH0ryu8
FRI110qdG6iOwMO
GCBaW7cWTAPd
GIDUANstr
GkeGc8i3tXBEH
H0LAhUTYjuH
HQ0jirgM3RiRCVEgAY4v36N
HQApLOR3OKUarrgffNtY
Hbd1Bun3Q4Zanhq0ANy5B47r54kzg8
Hhjf0mTaXbUba0
HmbksxfGR5pSwEcGl
IDYRMphlqXT
J2FDT8VyhoQmhBw0hBnwJ78ys
JfAySgsRQtmCO
K3oiFGdEvAsM4kxw58Jdf
K5TXGvkArvxFm5GNdg1X
K7BGSCQ3YiQiCSwehOYbXImpIQSVY
KBB9ni4MKbxQHtDPSb
LfYXZqjHpu
Llcyfxe0cruhrjMcA4LFn3
MIGuRpP6N8k7iJtdjySYilUBk
NXMBVpEqrLAKFdBeuS4MJJipjS4
NzAJi4zAv
O02Mub3OQq0dU04hUsTMKiNiJ3HVYD
PdhAddCounterA
PdhAddCounterW
PdhAddEnglishCounterA
PdhAddEnglishCounterW
PdhAddRelogCounter
PdhBindInputDataSourceA
PdhBindInputDataSourceW
PdhBrowseCountersA
PdhBrowseCountersHA
PdhBrowseCountersHW
PdhBrowseCountersW
PdhCalculateCounterFromRawValue
PdhCloseLog
PdhCloseQuery
PdhCollectQueryData
PdhCollectQueryDataEx
PdhCollectQueryDataWithTime
PdhComputeCounterStatistics
PdhConnectMachineA
PdhConnectMachineW
PdhCreateSQLTablesA
PdhCreateSQLTablesW
PdhEnumLogSetNamesA
PdhEnumLogSetNamesW
PdhEnumMachinesA
PdhEnumMachinesHA
PdhEnumMachinesHW
PdhEnumMachinesW
PdhEnumObjectItemsA
PdhEnumObjectItemsHA
PdhEnumObjectItemsHW
PdhEnumObjectItemsW
PdhEnumObjectsA
PdhEnumObjectsHA
PdhEnumObjectsHW
PdhEnumObjectsW
PdhExpandCounterPathA
PdhExpandCounterPathW
PdhExpandWildCardPathA
PdhExpandWildCardPathHA
PdhExpandWildCardPathHW
PdhExpandWildCardPathW
PdhFormatFromRawValue
PdhGetCounterInfoA
PdhGetCounterInfoW
PdhGetCounterTimeBase
PdhGetDataSourceTimeRangeA
PdhGetDataSourceTimeRangeH
PdhGetDataSourceTimeRangeW
PdhGetDefaultPerfCounterA
PdhGetDefaultPerfCounterHA
PdhGetDefaultPerfCounterHW
PdhGetDefaultPerfCounterW
PdhGetDefaultPerfObjectA
PdhGetDefaultPerfObjectHA
PdhGetDefaultPerfObjectHW
PdhGetDefaultPerfObjectW
PdhGetDllVersion
PdhGetExplainText
PdhGetFormattedCounterArrayA
PdhGetFormattedCounterArrayW
PdhGetFormattedCounterValue
PdhGetLogFileSize
PdhGetLogFileTypeW
PdhGetLogSetGUID
PdhGetRawCounterArrayA
PdhGetRawCounterArrayW
PdhGetRawCounterValue
PdhIsRealTimeQuery
PdhLookupPerfIndexByNameA
PdhLookupPerfIndexByNameW
PdhLookupPerfNameByIndexA
PdhLookupPerfNameByIndexW
PdhMakeCounterPathA
PdhMakeCounterPathW
PdhOpenLogA
PdhOpenLogW
PdhOpenQuery
PdhOpenQueryA
PdhOpenQueryH
PdhOpenQueryW
PdhParseCounterPathA
PdhParseCounterPathW
PdhParseInstanceNameA
PdhParseInstanceNameW
PdhReadRawLogRecord
PdhRelogW
PdhRemoveCounter
PdhResetRelogCounterValues
PdhSelectDataSourceA
PdhSelectDataSourceW
PdhSetCounterScaleFactor
PdhSetCounterValue
PdhSetDefaultRealTimeDataSource
PdhSetLogSetRunID
PdhSetQueryTimeRange
PdhTranslate009CounterW
PdhTranslateLocaleCounterW
PdhUpdateLogA
PdhUpdateLogFileCatalog
PdhUpdateLogW
PdhValidatePathA
PdhValidatePathExA
PdhValidatePathExW
PdhValidatePathW
PdhVbAddCounter
PdhVbCreateCounterPathList
PdhVbGetCounterPathElements
PdhVbGetCounterPathFromList
PdhVbGetDoubleCounterValue
PdhVbGetLogFileSize
PdhVbGetOneCounterPath
PdhVbIsGoodStatus
PdhVbOpenLog
PdhVbOpenQuery
PdhVbUpdateLog
PdhVerifySQLDBA
PdhVerifySQLDBW
PdhWriteRelogSample
PyB0OUBzY5OTdVuHLMCgHU
Q8fXG9R19nNLj3JKlEUI1PDZs1nOM
Q9XHcq7A
QivOgAVrawDzcea
QnEl74g1I2
RbnO1oWucvX
SKy6NlC7az5TV0V8cjqIf
SgHkHwomhBpt58Fo9Jr8xipQ7
TrEa9QREZ3Qn
Tx4DrTB
U0se9QfyXu3J6HnA
UJuQ8L3fg37pU1knKyVApRQp0r5i
UU2MblHmdIDUCLdEdQGNxfcvist4n1i
UiJh4v75S9nMILQ5yGkKdyA
W4XoNOxT9F1Vo64dqZry1U5ZVrC
W5hBpSY54yQUBz8YrpBlJ
XLLXF6Rh8VV5DYrq4oc4tRB6TXa
XwCD3QbPkijnuwYeIlyOGGdtInfZ2H
YCorG75UxiyRM4KuJgmm
ZMii5rxl
aDl5vokJP
aY69Jph
c2COzgsnUslyDv
cBgyVk4K4wNAfJFXHtY6uTrw3
cqH4yQ2XNjhEC5O
d1AHjFBBrvrY4z1SznfYesBQiWNha
dXUFNTW6uptyTYPwmZY9HVVYVa8O77L
dghVQuVUwYRNR
diDRNDa0iaPnsrplhT1u49Xg7GTnJS
e8tW09wihpaE
eBJacM0yEp
eKxeelmBAcZ
eXH9f04P
eY0LFtwZuYY30xfb
euCyeDEyVJ1nILFrl
f08dmrL
fTNdEzpqUrZ2DP9bJOATwixOpdOkTQ
g7R7FSCKbJx4jPjDubA
gEI8UhwTbuvRwFuBrcwVt3zDOd6
gzHxzPGwVfY2lZ
hJDBqwJyQG8P70gaQpk
hNL1m24ZK79EEhJw2aP
hwJRXJG4Jg
ij85ZLoqJ0unDAO6fM1
iy6M05VVpFj8b0hpPk1ULzU
jQpfiIwhIWuaqQe0ccofxVXJ2
kIGkIDow9fAwVweTtTCGgQgva9R
ka8LiWn1bMFD
khKYfJDwYKd6uVFmNI71fYR
ktxkyKJOknZnA
l6yaVxRBn0dvtBNqJH7pZKX1FaZU
lAmRtudgIHR90swwMjaeQhMpE8ayy
lIerVtlZYEF8I616Z0jW5dLW9gL93t
lZjsi5yZKAk6xmvHKa8RURXuobFx50a2
mF7HO8LeYE
naX7vz1BgY3KEdm
oadYaGzNQ8PBVtSuaWeLoCBWIz
ojUSjPMz2L6H
p6MS24EoudTm3
pUhOp4JOdv4Bzbb00IA
pkJmyzYS1
prQyDH5Vvge4vd8SKFdSZ
ptuGK9HYDaKpLN2BZ
qVAZgqeoQrPIwRxc9OraN0g
r0HNTkJ4U
t5W7e8yCDKPicEGEG
tTWT9Cef0NltDFaqKEt
tb3X9elFQvdrCr4MQTNztzsHq8xWSKVX
tp6qMJ4r2YAp5hxLgoNn9537Vl
uhKCyUOhNyWkj
ujmyvlVO9yDTaTWUAJfzA9PcNm0
vTWcYsELPydXOFGPmrB1uQnUeHjuGU3I
xDYnOu3yfZf40cdvBt
xUsCLx08J1SopRIWnQFq1qn1m8j
xmz2zS2
y9toNHENYXOPJ8T1u6z
ydEjOLZGha94KlWuqo
zL7qFgbx7nDnX5wVD3dyPp
zdZu46zla4FmrQVNI
znOUPE6YjMf
zt23h4UX6r3hl45
Name
.text
Size
417KB
Virtual Size
416KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.managed
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
106KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ