Madium-Files.zip
- SHA256 530ccee12d09f60cbadf7456d302d2ca4c0475c7070661e8c8cbf295e0fd77a7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Bin/Loader.exe
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
Bin/Madium-Module.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Bin/Madium.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target Madium-Files.zip
- Size 9.3MB
- Sample260620-stem8afx4l
- SHA256 530ccee12d09f60cbadf7456d302d2ca4c0475c7070661e8c8cbf295e0fd77a7
- MD5 df02f94662b6cacbdd4a18063ebd4855
- SHA1 7b17149083b99c2c8a810ba8d588ca2bb1490cbf
- SHA512 17fad75e45721b8d8cc1344e09eac3490adad5efb051ef705f5445528f2508d5ffae0448de63e0c8b970dca9c20c55bbfb09a74d48a3ed5a57b6574bc7bc1358
- SSDEEP 196608:Wu86BBbLWpqJ966PytLs22l0rxZ5SgkVFSYpbqqvC39dNTxZdR:WuVjGqbTb2a0rxZ5SZVFdI8Iv9
- TLSH T162A633662DE27FD6ACF9B41AD4100EA6F29064F20DC39E235FA55C68F567CA810FDD20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Bin/Loader.exe unpack001/Bin/Madium-Module.dll unpack001/Bin/Madium.exe
File Explorer
-
Madium-Files.zip.zip 9.3MB
-
Bin/Loader.exe.exe 270KB
-
Bin/Madium-Module.dll.dll 7.8MB
-
Bin/Madium.exe.exe 15.0MB
-
Bin/version.txt5B
Bin/Loader.exe
- IMPHASH 98935c01b60314eb62db32face92fe8f
- SHA256 4ffe7efe050719355d0e46757212c1b7bdb2a97f4d2d66636ed0207594956081
- MD5 b3392558c7af82e1ffab11cfa98e3647
- SHA1 f4681d108b7c8f517790469fd6d6aff2e7729e82
- SHA512 c297e2d34ddede1383f3d740b24eab445a9af29b54eb0ab12c4db127faa4b1d954e3cd63e409297aee3e0c349a5cc20ac131e3ec95234fe1a2bf9b3a7a8f358d
- SSDEEP 3072:zZ7cu4U2PJYwikSy5Yx1Y968z8e1KYwU5+:17x43PJ3ikSy5a109o0
- TLSH T1DC44C011EC1BE6A7D31F0C74D8130916FD72DCC6CBE9A652A7445EFA0868B54BB1EB02
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
291712
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
IsWow64Process
UnmapViewOfFile
Sleep
CreateFileA
CreateFileMappingA
MapViewOfFile
GetTickCount
SetConsoleTextAttribute
SetConsoleTitleA
GetStdHandle
SetConsoleMode
GetConsoleMode
Thread32Next
Thread32First
OpenThread
GetLastError
VirtualQueryEx
Process32First
K32EnumProcessModulesEx
MultiByteToWideChar
Process32Next
K32GetModuleBaseNameA
LocalFree
ReadProcessMemory
DuplicateHandle
SuspendThread
ResumeThread
VirtualQuery
GetCurrentDirectoryW
CreateFileW
FindClose
VirtualAllocEx
GetProcAddress
VirtualProtectEx
CreateThread
CloseHandle
Process32FirstW
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
GetCurrentProcessId
Process32NextW
CreateToolhelp32Snapshot
OpenProcess
GetModuleHandleA
WaitForMultipleObjects
GetCurrentProcess
WriteProcessMemory
WideCharToMultiByte
FormatMessageA
GetLocaleInfoEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
user32
FindWindowA
GetWindowThreadProcessId
advapi32
OpenProcessToken
GetTokenInformation
msvcp140
?good@ios_base@std@@QEBA_NXZ
?_Xbad_alloc@std@@YAXXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
_Xtime_get_ticks
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
_Query_perf_counter
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?_Id_cnt@id@locale@std@@0HA
?_Xinvalid_argument@std@@YAXPEBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtQueryInformationProcess
NtUnmapViewOfSection
NtQueryObject
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memcmp
__current_exception
__std_exception_copy
__std_exception_destroy
__C_specific_handler
memmove
memset
_CxxThrowException
__current_exception_context
__std_terminate
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_set_app_type
_seh_filter_exe
_initterm
_initterm_e
exit
_exit
terminate
__p___argc
__p___argv
_c_exit
_invoke_watson
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
abort
_errno
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vsprintf
_fileno
_isatty
__acrt_iob_func
__stdio_common_vsprintf_s
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-string-l1-1-0
_stricmp
strncmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
146KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
216B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.folk
Size
90KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=35, id=261, version=35207,
count=6, id=257, version=35207,
count=15, id=257, version=33145,
count=270, id=1, productName=Unmarked objects,
count=10, id=265, version=35225,
count=1, id=255, version=35225,
count=1, id=258, version=35225,
Bin/Madium-Module.dll
- IMPHASH 528abc3f3f9751c64a4d2aac98035755
- SHA256 52c19cf3b9b5d72e8255a79191991d5a9fe79bedb361705b0a85114a8a1c7cea
- MD5 ee739f9bd6fbe821bc6f8de8472c288d
- SHA1 19a8ccf0b730875eda3a0c36a70e87c5dadc146f
- SHA512 ceb4b1c274dbcaf7db1ab8086591a78b44ae68bbda9d6b2b07a7bf03954e636734e7b2e2453633e15d512c38eeedfa1bb1fd6b9fed0ef513d2906952fa3e385e
- SSDEEP 98304:uUyE518R9GgjPEdd5cbHpVjnhcl2M4TqtyYN:uUyEz8RQg7Edd5cbHbjn24Mwql
- TLSH T11686AD5AB7A400ACD87BD13CC6A79603E7B2B855273097DF16A456BA1F23BE0173E740
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4563448
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntdll
RtlPcToFileHeader
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlUnwindEx
VerSetConditionMask
RtlUnwind
bcrypt
BCryptGenRandom
advapi32
CryptExportKey
CryptHashData
CryptGetHashParam
CryptAcquireContextA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptEnumProvidersW
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
kernel32
FreeLibrary
FlushInstructionCache
QueryPerformanceFrequency
QueryPerformanceCounter
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
GetLocaleInfoA
IsDBCSLeadByte
GetProcAddress
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetLocalTime
GetCurrentProcessId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FormatMessageA
GetTickCount
GetHandleInformation
GetLastError
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatusEx
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitOnceExecuteOnce
GetTickCount64
GetModuleHandleW
SetFileCompletionNotificationModes
VirtualProtect
VirtualFree
SwitchToFiber
DeleteFiber
CreateFiberEx
GetSystemTime
SystemTimeToFileTime
FindClose
FindFirstFileW
FindNextFileW
GetSystemDirectoryA
ReleaseSemaphore
WaitForSingleObject
GetExitCodeThread
CreateSemaphoreA
GetEnvironmentVariableW
GetACP
GetStdHandle
GetFileType
GetSystemTimeAsFileTime
ConvertFiberToThread
ConvertThreadToFiberEx
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionEx
CreateFileW
FormatMessageW
MoveFileExA
WaitForSingleObjectEx
SleepEx
VerifyVersionInfoW
WakeAllConditionVariable
LoadLibraryA
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
SetEndOfFile
SetStdHandle
DeleteFileW
HeapReAlloc
FlushFileBuffers
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryExW
HeapFree
HeapAlloc
UnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetConsoleOutputCP
SetFilePointerEx
IsProcessorFeaturePresent
GetTimeZoneInformation
SetConsoleCtrlHandler
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
ExitProcess
ReadFile
FreeLibraryAndExitThread
ExitThread
CreateThread
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
InterlockedFlushSList
InitializeSListHead
GetStartupInfoW
SetUnhandledExceptionFilter
GetStringTypeW
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
RaiseException
GetSystemTimePreciseAsFileTime
GetVolumeInformationA
GetEnvironmentVariableA
GetCurrentThreadId
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
HeapSize
WriteConsoleW
GetFileInformationByHandleEx
MoveFileExW
AreFileApisANSI
CreateFile2
VirtualAlloc
GlobalUnlock
GlobalLock
CloseHandle
GlobalAlloc
FreeEnvironmentStringsW
SetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileAttributesExW
TerminateProcess
GetModuleHandleExW
WriteFile
GetCurrentProcess
Sleep
GetModuleHandleA
SetEnvironmentVariableW
GetProcessHeap
CompareFileTime
FindFirstFileExW
CreateDirectoryW
GetCurrentDirectoryW
GetLocaleInfoEx
LocalFree
WakeConditionVariable
user32
keybd_event
ReleaseCapture
IsWindowUnicode
SetWindowLongW
SetCursor
SetCapture
BringWindowToTop
SetFocus
SetLayeredWindowAttributes
GetPropA
GetMonitorInfoA
GetKeyboardLayout
TrackMouseEvent
IsChild
SetWindowLongA
GetCapture
ShowWindow
WindowFromPoint
RegisterClassExW
ScreenToClient
CreateWindowExW
EnumDisplayMonitors
MonitorFromWindow
SetWindowPos
GetDC
DestroyWindow
LoadCursorA
SetPropA
EnumWindows
GetWindowTextA
GetWindowThreadProcessId
MessageBoxA
GetClientRect
mouse_event
GetMessageExtraInfo
GetKeyState
AdjustWindowRectEx
DefWindowProcW
GetWindowLongW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
IsIconic
SetCursorPos
ReleaseDC
GetCursorPos
GetForegroundWindow
MapVirtualKeyA
ClientToScreen
GetSystemMetrics
SetForegroundWindow
SetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetWindowLongPtrA
CallWindowProcA
GetClipboardData
gdi32
GetDeviceCaps
shell32
ShellExecuteW
SHGetKnownFolderPath
ole32
CoTaskMemFree
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
d3dcompiler_47
D3DCompile
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
crypt32
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertOpenSystemStoreA
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
ws2_32
getsockname
getsockopt
recv
connect
getpeername
ioctlsocket
WSAGetLastError
socket
bind
closesocket
listen
send
setsockopt
accept
__WSAFDIsSet
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
shutdown
getservbyname
getservbyport
gethostbyname
gethostbyaddr
inet_ntoa
inet_addr
WSASetLastError
WSASocketA
WSAIoctl
inet_ntop
inet_pton
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
select
ntohs
htons
htonl
sendto
recvfrom
Name
._mdm
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
904KB
Virtual Size
923KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
246KB
Virtual Size
246KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=211, id=261, version=33145,
count=54, id=260, version=33145,
count=34, id=259, version=33145,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=253, version=35403,
count=10, id=259, version=35403,
count=17, id=260, version=35403,
count=92, id=261, version=35403,
count=1, id=262, version=33145,
count=942, id=260, version=35217,
count=31, id=261, version=35726,
count=133, id=260, version=35726,
count=29, id=257, version=33145,
count=360, id=1, productName=Unmarked objects,
count=1, id=259, version=35726,
count=110, id=265, version=35726,
count=1, id=255, version=35726,
count=1, id=258, version=35726,
Bin/Madium.exe
- IMPHASH fab7884061ecf1fe3f624341e2276d27
- SHA256 edaf6676fe03d0a552f07d7fd438f34d8fe79612c80a365cb42fba679bbea530
- MD5 bb9f911b6b7c613bd00c34e0595ac224
- SHA1 f36e89aa7dc47d4da77b70f04a853ae5d2abd07f
- SHA512 77f139b49b10a17348923f9e0442055ba23aeaae4f412a3f180152e8f324f5d05ff3358ae0bc12b7b8286f379bec974fd41a984eef8c98d0cb032f3d6c48f120
- SSDEEP 98304:mrIWZS8bcjmxyhAs8qPC3Pf3JMApcQ1nqj3I/JW+kAX42+PKdILdlhXpGR5o:mEW3bc7vC3XJMsJhBAKdIdB
- TLSH T183F607217B5A99ACC05BC47483478A725A7570CB0B35B9FF448492383FAABF52F38359
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9750124
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Madium.pdb
kernel32
GetCurrentProcess
GetModuleHandleW
GetUserDefaultUILanguage
LCIDToLocaleName
CreateJobObjectW
AssignProcessToJobObject
GetLastError
SetInformationJobObject
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
OpenProcess
FlsSetValue
FlsGetValue
FlsAlloc
RaiseException
RtlPcToFileHeader
RtlUnwindEx
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
DeleteCriticalSection
TerminateProcess
FlsFree
CloseHandle
DuplicateHandle
SetHandleInformation
FreeLibrary
LoadLibraryExW
HeapFree
GetProcessHeap
SetFileTime
GetModuleFileNameW
FindNextFileW
RtlLookupFunctionEntry
RtlCaptureContext
GetProcessId
GetExitCodeProcess
GetSystemInfo
QueryPerformanceCounter
GetSystemTimePreciseAsFileTime
WriteFileEx
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
CompareStringOrdinal
FreeEnvironmentStringsW
SleepEx
ReadFileEx
WaitForMultipleObjects
CreateThread
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerExW
SetFileInformationByHandle
LoadLibraryExA
OutputDebugStringW
HeapAlloc
OutputDebugStringA
GetStdHandle
WriteConsoleW
MultiByteToWideChar
ReleaseMutex
FormatMessageW
CancelIo
CreateMutexA
QueryPerformanceFrequency
ExitProcess
GetTempPathW
GetFullPathNameW
SetThreadStackGuarantee
GetCurrentProcessId
FindClose
FindFirstFileExW
DeleteFileW
CreateEventW
SwitchToThread
WaitForSingleObjectEx
GetFileInformationByHandleEx
GetFinalPathNameByHandleW
CreateDirectoryW
MoveFileExW
CreatePipe
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
GetOverlappedResult
ReadFile
WideCharToMultiByte
HeapReAlloc
GetEnvironmentVariableW
SetFileCompletionNotificationModes
GetFileAttributesW
CreateFileW
GetFileInformationByHandle
GetConsoleMode
GetCommandLineW
AddVectoredExceptionHandler
lstrlenW
LoadLibraryA
LoadLibraryW
GetConsoleOutputCP
GetModuleHandleA
RtlVirtualUnwind
SetEnvironmentVariableW
Sleep
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
GetCurrentThread
GetProcAddress
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
user32
DispatchMessageW
SendMessageW
LoadCursorW
SetWindowPos
EnumWindows
AdjustWindowRectEx
CreateWindowExW
IsWindow
RegisterTouchWindow
RegisterClassExW
GetMessageA
DispatchMessageA
EnumChildWindows
IsIconic
InvalidateRgn
SetCursorPos
InvalidateRect
TranslateMessage
GetActiveWindow
GetForegroundWindow
AdjustWindowRect
GetWindowThreadProcessId
IsWindowVisible
MapVirtualKeyW
GetMessageW
DefWindowProcW
FlashWindowEx
ChangeDisplaySettingsExW
SetWindowPlacement
GetWindowPlacement
TranslateAcceleratorW
GetCursorPos
PostThreadMessageW
ValidateRect
SetCursor
GetUpdateRect
UpdateWindow
ClientToScreen
GetClientRect
GetWindowLongW
MonitorFromWindow
ScreenToClient
PostMessageW
MonitorFromRect
GetMonitorInfoW
GetSystemMetrics
FillRect
SystemParametersInfoW
TrackMouseEvent
DestroyWindow
PeekMessageW
RedrawWindow
GetTouchInputInfo
CloseTouchInputHandle
GetSystemMenu
ShowCursor
GetMenu
EnableMenuItem
GetClipCursor
ClipCursor
RegisterRawInputDevices
ReleaseCapture
SetCapture
MsgWaitForMultipleObjectsEx
RegisterWindowMessageA
SetParent
MapWindowPoints
GetWindow
SetFocus
ShowWindow
ReleaseDC
EnableWindow
IsWindowEnabled
GetWindowRect
SetWindowLongPtrW
GetParent
GetWindowLongPtrW
SetPropW
FindWindowExW
SetWindowRgn
IsProcessDPIAware
GetDC
SetWindowDisplayAffinity
SetWindowLongW
DrawTextW
GetWindowDC
OffsetRect
GetMenuBarInfo
DestroyMenu
CheckMenuItem
RemoveMenu
CreatePopupMenu
CreateMenu
SetMenuItemInfoW
AppendMenuW
InsertMenuW
TrackPopupMenu
PostQuitMessage
CreateAcceleratorTableW
DestroyAcceleratorTable
DrawMenuBar
SetMenu
DrawIconEx
GetMenuItemInfoW
CreateIcon
GetKeyboardLayout
ToUnicodeEx
GetKeyState
GetAsyncKeyState
GetKeyboardState
MapVirtualKeyExW
GetRawInputData
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
SendInput
SetForegroundWindow
DestroyIcon
EnumDisplayMonitors
MonitorFromPoint
SystemParametersInfoA
advapi32
OpenProcessToken
GetTokenInformation
RegQueryValueExW
RegCloseKey
EventUnregister
RegGetValueW
RegOpenKeyExW
EventRegister
SystemFunction036
EventWriteTransfer
EventSetInformation
shell32
ShellExecuteW
DragFinish
SHAppBarMessage
SHGetKnownFolderPath
ShellExecuteExW
ILCreateFromPathW
ILFree
SHOpenFolderAndSelectItems
DragQueryFileW
bcryptprimitives
ProcessPrng
ntdll
RtlGetVersion
RtlNtStatusToDosError
NtReadFile
NtCreateFile
NtCancelIoFileEx
NtDeviceIoControlFile
NtOpenFile
NtCreateNamedPipeFile
NtWriteFile
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressSingle
WakeByAddressAll
ole32
OleInitialize
CoCreateFreeThreadedMarshaler
CoInitializeEx
CoCreateInstance
CoInitialize
RevokeDragDrop
CoTaskMemAlloc
RegisterDragDrop
CoTaskMemFree
CoUninitialize
comctl32
DefSubclassProc
TaskDialogIndirect
RemoveWindowSubclass
SetWindowSubclass
gdi32
CreateDIBSection
SelectObject
CreateSolidBrush
BitBlt
SetBkMode
SetTextColor
DeleteDC
CreateRectRgn
CombineRgn
GetDeviceCaps
DeleteObject
CreateCompatibleDC
dwmapi
DwmGetWindowAttribute
DwmEnableBlurBehindWindow
DwmSetWindowAttribute
shlwapi
SHCreateMemStream
oleaut32
SysFreeString
GetErrorInfo
SysStringLen
SetErrorInfo
ws2_32
WSAStartup
closesocket
recv
WSASend
send
getsockname
getpeername
getsockopt
accept
setsockopt
ioctlsocket
connect
WSACleanup
WSAIoctl
WSASocketW
bind
listen
shutdown
WSAGetLastError
socket
freeaddrinfo
getaddrinfo
bcrypt
BCryptGenRandom
api-ms-win-crt-math-l1-1-0
__setusermatherr
pow
roundf
trunc
floor
round
api-ms-win-crt-string-l1-1-0
wcslen
_wcsicmp
strcpy_s
wcscmp
wcsncat
api-ms-win-crt-convert-l1-1-0
_ultow_s
_wtoi
wcstol
api-ms-win-crt-runtime-l1-1-0
__p___argv
_initialize_narrow_environment
__p___argc
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
exit
abort
_configure_narrow_argv
_initialize_onexit_table
terminate
_crt_atexit
_exit
_get_initial_narrow_environment
_initterm
_initterm_e
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
malloc
_callnewh
calloc
Name
.text
Size
9.5MB
Virtual Size
9.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
529KB
Virtual Size
529KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.taubndl
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=35403,
count=13, id=260, version=35403,
count=46, id=261, version=35403,
count=4, id=257, version=30151,
count=12, id=260, version=35728,
count=11, id=257, version=33145,
count=463, id=1, productName=Unmarked objects,
count=674, productName=Unmarked objects (old),
count=1, id=255, version=35728,
count=1, id=258, version=35728,
Bin/version.txt
- SHA256 79a97ba3e92ae5f7c8de323fa922a136e6b28a664a40a439e44ccea18ed4e97c
- MD5 bac9dadaa07b105d8919d3e0ddbd6c9c
- SHA1 f75831f2389d5e390fe1c499e0f268bcbf40e248
- SHA512 daf2d50f303d6db81aa7d933ba1657dbe7733cb1e3828dbd71e6f03fc545b0e0fec4cb1333ef0b739f73c39b79616b306f2fa2bf4cc95efd41744bac14831ffa
- MD5 SHA1 SHA512