FREE.rar
- SHA256 dad7b30a2fed316f580159e562f152d1ecc573607806124be9190c7766d25b9d
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
FREE WAVE.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
driver.sys
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
mapper.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
General
- Target FREE.rar
- Size 288KB
- Sample260628-ft8vvaft2y
- SHA256 dad7b30a2fed316f580159e562f152d1ecc573607806124be9190c7766d25b9d
- MD5 deb656ecd2b798e3113d6443994cd1a7
- SHA1 848a11773d28672120773e43d8b8afd9acd7dcaa
- SHA512 3419be1cbac69ecefed35d7b203564ae1afb2680f213c61af364debdeec8a181de8f759b205a863eac137c123c36ee980b48663e24ef842fa6b7e32f61491947
- SSDEEP 6144:VjO+De8OkHkfBbfR26au830Y2gUBkoftEk7Cc2PMVSE3TyZZjXt:VJikEfBbO2TkofmkG0SE3TyPZ
- TLSH T1EF5423BC1AAE3C2676929E341C73360AC95777DBCE31B4C6511A7259A06FCC2F04BD1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/FREE WAVE.exe unpack001/driver.sys - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/mapper.exe
File Explorer
-
FREE.rar.rar 288KB
-
FREE WAVE.exe.exe 426KB
-
driver.sys.sys 38KB
-
how to use .txt298B
-
mapper.exe.exe 150KB
FREE WAVE.exe
- IMPHASH 4a8b8e6695edd12ad966eeaeb6e13cfa
- SHA256 d800436b4cc0787ca1cf323c94a1d64a9afb9d8e2684d0056d9d19b1711ae17f
- MD5 a1556ff30b9030c004b3f1357a341e07
- SHA1 d355af8ba8ef82dfed17d420c778dee5360b4f55
- SHA512 3c544711cc385cf795b2ca03f570d5878108be5e5e5237b2cc86492386f665090f651528a4fca1eb1f7f6300b4997d32a2f7ae0603749f84cda16d37a15428a9
- SSDEEP 6144:H5rMrnpFjyWOhYsGBnKIEwnG3jAtkhVROe5cI/NZk49giIngf6XcnCOZ:OFWWJfnKI9gAuh7O8cYuiInK6kpZ
- TLSH T1BF94AE45F1F944F8C067A1399697A60FEE35340817304BDB23E8E5682BE37F496BA712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
349052
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Admin\Desktop\base update by dr7 no driver\Fortnite Private\x64\Release\Nigger Private.pdb
kernel32
FreeLibrary
QueryPerformanceCounter
SetConsoleTitleA
DeviceIoControl
CreateToolhelp32Snapshot
Sleep
Process32NextW
CreateFileA
Process32FirstW
CloseHandle
CreateThread
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceFrequency
GetCurrentProcessId
GetModuleHandleW
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
LoadLibraryA
GetLocaleInfoA
GetModuleHandleA
GlobalLock
GlobalUnlock
GlobalFree
GlobalAlloc
GetCurrentThreadId
MultiByteToWideChar
user32
SetCursor
GetClientRect
EmptyClipboard
DestroyWindow
GetSystemMetrics
ShowWindow
GetAsyncKeyState
DispatchMessageW
MessageBoxA
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
PeekMessageA
PostQuitMessage
RegisterClassExA
UpdateWindow
GetKeyState
ScreenToClient
LoadCursorW
GetForegroundWindow
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ClientToScreen
GetKeyboardLayout
shell32
ShellExecuteW
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
_Mtx_unlock
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
_Mtx_lock
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Id_cnt@id@locale@std@@0HA
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
d3d11
D3D11CreateDeviceAndSwapChain
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
_CxxThrowException
memset
__C_specific_handler
__current_exception_context
memchr
__current_exception
__std_exception_copy
__std_exception_destroy
memmove
memcpy
memcmp
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fflush
fclose
__p__commode
_set_fmode
fseek
__stdio_common_vfprintf
fwrite
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
ftell
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
_wcsicmp
strcmp
strncpy
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
_callnewh
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
__p___argc
_register_thread_local_exe_atexit_callback
_beginthreadex
_invoke_watson
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
__p___argv
terminate
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_c_exit
api-ms-win-crt-math-l1-1-0
logf
fmodf
cosf
ceilf
powf
atan2f
atan2
__setusermatherr
sinf
asin
acosf
_fdclass
_dclass
tanf
sqrtf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
342KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
584B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35207,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=31, id=261, version=35207,
count=17, id=257, version=33145,
count=217, id=1, productName=Unmarked objects,
count=8, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
driver.sys
- IMPHASH e135435959dba6933d95143f08bb43f9
- SHA256 1ec162c54a1d8469b2eed5d631cb0c2db48fadb69d6c73368f17e8f082a38732
- MD5 d204f80f26c24635ad87da2c2334abf3
- SHA1 617dbf4059d306b1dd31e376dbc94bf1419bc365
- SHA512 44d4a42d866d94e989cc4749d785a4b30ea7527b279f4a60698c4cdbf4772a06f4216186fe8f461125b8d6083115bd57e089c602328c8d0affb55374ae5059d2
- SSDEEP 384:LXTDeeEAV4V1L/HZYlYgisDK/pRCY7uFOpHSxQ42BEDCaUh5dm3jpgqKWzp:L3Vc1SYgsTucSxh28Cs+Wzp
- TLSH T16C037092D26152D9DC7AC13DC5AA6336BCA4301DC320BBCB89944ADF57E2AE4B77D340
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
21552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Admin\Desktop\SebwettESP\SebwettESP\build\SteelSeriesHID.pdb
ntoskrnl.exe
wcslen
RtlInitUnicodeString
KeLowerIrql
KfRaiseIrql
IofCompleteRequest
IoCreateSymbolicLink
ObfDereferenceObject
MmIsAddressValid
ObReferenceObjectByName
IoCreateDriver
__C_specific_handler
IoDriverObjectType
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
400B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33136,
count=15, id=1, productName=Unmarked objects,
count=6, id=259, version=33136,
count=8, id=260, version=33136,
count=1, id=261, version=35228,
count=1, id=258, version=35228,
how to use .txt
- SHA256 7bd284fa6651e61f5ae3fbbaa16fcc7650a19e118dd4d0a24c07c91739c294b9
- MD5 4c1b2ccd2344968cd809b9fe3919e66c
- SHA1 8f04b0204fe420500c96c42ceec7c05cc8ae823a
- SHA512 342b66f500d7604fbf4486f4e1cf8c14a9cd9951365618a88e8c4ff39cc1109a171906acc7d2a2c3815c70eff4d6ddc317ef878ffdb21fd05f85cb0a0d2e90b8
- TLSH T18BE07DF302C7E90E4134817FA11E7DB29743088E915B31861C4D150C241B855F1D4FCB
- MD5 SHA1 SHA512 TLSH
mapper.exe
- IMPHASH 862d87edaf0de2510d06c235b2ca984a
- SHA256 acc97d955d1fc80114abde86abe1f9bd1eb61263df537d1b07ad53ab062e267e
- MD5 f75cd34b060d8cc5e4264691c2f6f4fe
- SHA1 f300bea3150b5246f8a0b2a62a2acf648386dbb8
- SHA512 d83a554dc783730eb5e14f798cf77aca3ffb89769e63351404cbe4cbac3f472f00bf9192fec13911f4596c405f89b7d958078b3e88e010771108d56f59a329aa
- SSDEEP 1536:DIFiH7g6DKxwfq3BixCBrrdVMAfZ6b/UB1U7ILNfW6KSLIuiYfz/eJ3N5hag94NT:DfqUK3Job/UI7IBWPK/eT1yNgk
- TLSH T144E34B1AA7A5103AE2B6D978D9A20502EFB3BC454775D3CF175048B90F227D1BE3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
a3:fe:5b:6b:b4:d7:c2:0d:5b:37:62:af:b3:ac:45:8c:a3:d1:36:c8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=BattlEye Innovations e.K.,OU=Code Management,O=BattlEye Innovations e.K.,L=Basingstoke,ST=BattlEye Innovations e.K.,C=GB,1.2.840.113549.1.9.1=#0c15426174746c45796540426174746c4579652e636f6d
Chains
Oct 7, 2025
CN=BattlEye Innovations e.K.,OU=Code Management,O=BattlEye Innovations e.K.,L=Basingstoke,ST=BattlEye Innovations e.K.,C=GB,1.2.840.113549.1.9.1=#0c15426174746c45796540426174746c4579652e636f6d
Subject
CN=BattlEye Innovations e.K.,OU=Code Management,O=BattlEye Innovations e.K.,L=Basingstoke,ST=BattlEye Innovations e.K.,C=GB,1.2.840.113549.1.9.1=#0c15426174746c45796540426174746c4579652e636f6d
Serial Number
0d:68:3e:6a:d0:cd:a9:b4:47:5c:f8:ae:1d:7d:21:33
Issuer
CN=BattlEye Innovations e.K.,OU=Certification Authority,O=BattlEye Innovations e.K.,L=Basingstoke,ST=Hampshire,C=GB,1.2.840.113549.1.9.1=#0c15426174746c45796540426174746c4579652e636f6d
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping, ExtKeyUsageMicrosoftCommercialCodeSigning
Revocation Status
Not revoked
Timespan
Jan 1, 2015 - Jan 1, 2088
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
73300
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Seven\Desktop\Bureau\Mystic\RTCore64_Vulnerability-main\x64\Release\RTCore64_Vulnerability.pdb
kernel32
OpenProcess
GetLastError
CreateFileA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
CloseHandle
GetProcAddress
GetCurrentProcessId
CreateDirectoryA
GetModuleHandleA
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
SetUnhandledExceptionFilter
GetFileAttributesW
GetTempPathW
GetModuleHandleW
FormatMessageA
GetLocaleInfoEx
GetCurrentThreadId
CreateFileW
VirtualAlloc
VirtualFree
SetLastError
GetFileAttributesExA
DeviceIoControl
GetModuleFileNameA
InitializeSListHead
GetSystemTimeAsFileTime
FindClose
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
LocalFree
user32
GetShellWindow
GetWindowThreadProcessId
advapi32
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
StartServiceW
OpenServiceW
CreateServiceW
ole32
StringFromGUID2
msvcp140
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Random_device@std@@YAIXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1_Lockit@std@@QEAA@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
ntdll
NtQuerySystemInformation
dbghelp
SymCleanup
SymLoadModuleEx
SymUnloadModule64
SymSetOptions
SymInitialize
SymFromName
urlmon
URLDownloadToFileA
shlwapi
PathFileExistsA
PathRemoveFileSpecA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
__std_terminate
memcmp
__std_exception_copy
__std_exception_destroy
memcpy
memset
_CxxThrowException
memmove
__current_exception_context
__current_exception
wcsstr
api-ms-win-crt-convert-l1-1-0
_itoa_s
wcstombs_s
api-ms-win-crt-stdio-l1-1-0
_fseeki64
fread
fsetpos
fflush
ungetc
__acrt_iob_func
_get_stream_buffer_pointers
__stdio_common_vfprintf
setvbuf
fgetpos
__stdio_common_vsprintf
fwrite
_set_fmode
__p__commode
fgetc
fputc
fclose
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-runtime-l1-1-0
exit
_exit
_register_onexit_function
__p___argc
__p___wargv
_c_exit
_set_app_type
_initterm
_get_initial_wide_environment
_invoke_watson
terminate
_initialize_onexit_table
_cexit
abort
_initialize_wide_environment
_configure_wide_argv
_initterm_e
_crt_atexit
_seh_filter_exe
_register_thread_local_exe_atexit_callback
api-ms-win-crt-filesystem-l1-1-0
_wremove
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
_wcsicmp
_stricmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
_set_new_mode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=35, id=261, version=35207,
count=6, id=257, version=35207,
count=17, id=257, version=33140,
count=266, id=1, productName=Unmarked objects,
count=7, id=265, version=35217,
count=1, id=255, version=35217,
count=1, id=258, version=35217,