詳しい.rar
- SHA256 86128f8fe13e37e24fddbfd200611cc0763be0bc1c9b9229bc37b0da7548cd49
Password
123
Static task
static1
2 signatures
General
- Target 詳しい.rar
- Size 101.0MB
- Sample260702-gpdpkscs8w
- SHA256 86128f8fe13e37e24fddbfd200611cc0763be0bc1c9b9229bc37b0da7548cd49
- MD5 d200361c476aee871e19389bb8f2ac27
- SHA1 b3e829f3f8692cf5efbd9bf1dc5b22dfceab6fda
- SHA512 678ea59548ee92143c89d293331ac50b723ef8c4a461a203bc34723d1d88640e1e8c3dceeb465864fb583f35e01f4530f559d2bfaf176af7693b4b222a0aa010
- SSDEEP 3145728:NuKvtcBxcEEtNBeNWmHPHyov5fh33AXuIfOmOLxqJ1:NuKOoTNAPyAfhYWLFqJ1
- TLSH T1B538337766D5E3E281B24EB511E5CD400A313578A3D93BDEE6E184CB727FCE015AA2C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/vrfcore.dll - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Service.dll unpack001/vrfcore.dll
File Explorer
-
詳しい.rar.rar 101.0MB
-
1.y.rar 100.6MB
-
Service.dll.dll 214KB
-
atl.ini1KB
-
vrfcore.dll.dll 109KB
-
詳しい内容.exe.exe 159KB
1.y
- SHA256 1dac2165082edda2486ec703f5ebeb8a827f286915ddbf44d3b98adb13ef0202
- MD5 61753d78552a4baa96beb73a1a5ab213
- SHA1 18466e1f5f35a1deb6bac4da0173de8d2e739d14
- SHA512 b5b13a42829e44f214a5c202d77df187bf962a4564ef83699fd95471078dfd63b5e0bfe081d7ce1af48f96551691911876880373553bffef41c1064bfccfa603
- SSDEEP 3145728:lhnSOYyggpbx4IZ3ToUtyl1kN1I43hVOAQIYK:ljYy3zKiyl1kN1IoVOAQIR
- TLSH T12C38336B58F12FABB047D868F9330072BDD8290634D5A2658D0927D3165FE2EFE42397
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
Service.dll
- IMPHASH 55b60ff9a86bbcf215f0b3aa27a29ead
- SHA256 3f6fdc8aa466ac27238a456de372c1cf81ec8f357449598218275d7ea10a0fe3
- MD5 8a7a530b804d20be8c4cdbbaac634947
- SHA1 e360d5a3c026fc6268fa0888247c3ba5f0f20b53
- SHA512 f2f467876572ee8dd357b0b1864fec2f892e2cfb36544ea9253881bde7895241cee2185ce4105f7773a28f3c29d29a83de792d076f07df14350b13e09f4e35a1
- SSDEEP 3072:QE46R/H4xn6ITPGUw+ZQI9IxIsTiNXFUKzQ42hf1RfoY46JVgghYOIdm:Q2finfTuUw+Z5yIsTcPUnoh7g2Hd
- TLSH T1D524490973D51CB9EE738675CC534A45E672BC120671EA3F03A4422ADF2F391A93AF25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
2
Major OS version
5
Entry point
20420
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Desktop\ProjectDll\Service\x64\Release\Service.pdb
kernel32
lstrcatW
FreeConsole
CreateThread
GetCurrentDirectoryW
WTSGetActiveConsoleSessionId
GetLastError
CopyFileW
GetTickCount
GetExitCodeProcess
Sleep
GetExitCodeThread
GetVersionExW
GetFileAttributesW
WaitForSingleObject
WaitForMultipleObjects
GetModuleFileNameW
VirtualAlloc
GetCurrentProcess
WriteProcessMemory
ReadFile
FreeLibrary
GetProcAddress
LoadLibraryW
CloseHandle
GlobalFree
Process32FirstW
GlobalAlloc
Process32NextW
CreateToolhelp32Snapshot
GetSystemDirectoryW
GetFileSize
CreateFileW
HeapSize
WriteConsoleW
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
LoadLibraryExW
TerminateProcess
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
HeapFree
HeapAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
SetFilePointerEx
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapReAlloc
RtlUnwind
user32
wsprintfW
advapi32
OpenProcessToken
GetUserNameW
RegNotifyChangeKeyValue
CreateServiceW
CloseServiceHandle
OpenSCManagerW
SetTokenInformation
SetServiceStatus
ChangeServiceConfig2W
RegisterServiceCtrlHandlerW
RegSetValueExW
RegEnumValueW
StartServiceW
CreateProcessAsUserW
ChangeServiceConfigW
OpenServiceW
DuplicateTokenEx
QueryServiceStatusEx
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
iphlpapi
GetAdaptersAddresses
rpcrt4
UuidFromStringW
slwga
SLIsGenuineLocal
MainThread
ServiceMain
Name
.text
Size
113KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=151, id=243, version=40116,
count=25, id=242, version=40116,
count=54, id=261, version=26706,
count=30, id=260, version=26706,
count=9, id=259, version=26706,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=145, id=1, productName=Unmarked objects,
count=4, id=265, version=27054,
count=1, id=256, version=27054,
count=1, id=255, version=27054,
count=1, id=258, version=27054,
atl.ini
- SHA256 55e3024423590e87cf182c602204b04996635f64c6afc6df667057e376f4d3d5
- MD5 7668815170c91817a17675b87b2bf12e
- SHA1 b4f46460c6c97709b2c6b318e5dc521b7747db4b
- SHA512 24b9fc573660ba82d959d12bba94d2f0fa5e96d09eba9583ffcceeb6f2c4ff1444ba2370a0eb59d41f5efd8fd38d4b1486903daea298da372de6224535b48a90
- TLSH T1A731A413C0C4A46207526E0D8DD2513B5F23F0CEB7D44FA2D3B046181AE9A5D61AF695
- MD5 SHA1 SHA512 TLSH
vrfcore.dll
- IMPHASH 83bdbff5663ed956ae584e1a0b8dcb2f
- SHA256 c8cbdf7460a27808b7663ae0a179a2a425f03d4a9974c184363b78715b040b44
- MD5 5d6b4151d0b2e5b37355e761f1888cfc
- SHA1 ae8d35d69e3965552422b4b9c96057e9fc5d38b9
- SHA512 3d6a1d18b5be6e51665add12a4c0cfede862a7d054fd8386c1aab21f3ad5d64d48309e473dd385dcd2b75bdfea138ba8152c17d9aeb909925b80bc14ff8549d4
- SSDEEP 1536:Cp75OW4fcR6VIseUczDSoy2miSfvQNEIC5inH+Z4uCJXsWld09dl09tdvM4S:GOF0IczOfjiavZIC4nH9pJZMibdvM3
- TLSH T197B37C4B73A500BBE5779678C8635E49E772B8110530EB6F03A0825E1F737A19D3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
6
Entry point
10152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Desktop\ProjectDll\ProjectDll\vrfcore\x64\Release\vrfcore.pdb
kernel32
WriteConsoleW
lstrcpyW
CopyFileW
GetLastError
Sleep
GetModuleFileNameW
GetModuleHandleExW
lstrlenW
CloseHandle
GlobalFree
Process32FirstW
GlobalAlloc
Process32NextW
CreateToolhelp32Snapshot
__C_specific_handler
SetFilePointerEx
CreateFileW
GetConsoleMode
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
RtlUnwind
user32
wsprintfW
advapi32
GetUserNameW
RegOpenKeyExW
RegCloseKey
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
RegDeleteKeyW
ChangeServiceConfig2W
RegCreateKeyExW
RegSetValueExW
StartServiceW
RegDeleteValueW
OpenServiceW
RegEnumValueW
rpcrt4
UuidFromStringW
iphlpapi
GetAdaptersAddresses
slwga
SLIsGenuineLocal
AVrfAPILookupCallback
VerifierAreStaticDllsInitialized
VerifierChainDuplicateHooks
VerifierCloseLayerProperties
VerifierConfigureStopOptions
VerifierCreateLayerProperties
VerifierDisableFaultInjectionExclusionRange
VerifierDisableFaultInjectionTargetRange
VerifierDisableLayer
VerifierDisableVerifier
VerifierEnableFaultInjectionExclusionRange
VerifierEnableFaultInjectionTargetRange
VerifierEnableLayer
VerifierGetAppCallerAddress
VerifierGetInfoForException
VerifierGetLoggingDirectory
VerifierGetRecursionTlsSlot
VerifierHandleVerifierStopException
VerifierIsDllEntryActive
VerifierIsInsideVerifierStop
VerifierIsLayerEnabled
VerifierLdrGetProcedureAddress
VerifierOpenLayerProperties
VerifierQueryGlobalProperties
VerifierQueryLayerBreak
VerifierQueryLayerBreaks
VerifierQueryLayerProperties
VerifierQueryLayerProperty
VerifierQueryRegisteredLayers
VerifierRegisterFaultInjectProvider
VerifierRegisterLayer
VerifierRegisterLayerEx
VerifierRegisterProvider
VerifierResetFaultInjectionAddressRanges
VerifierSetAPIClassName
VerifierSetFaultInjectionProbability
VerifierSetFaultInjectionSeed
VerifierSetLayerBreak
VerifierSetLayerProperty
VerifierShouldFaultInject
VerifierStopMessageEx
VerifierSuspendFaultInjection
VerifierTlsGetValue
VerifierTlsSetValue
VerifierUnregisterLayer
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gehcont
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=133, id=261, version=27412,
count=13, id=260, version=26706,
count=8, id=259, version=26706,
count=33, id=261, version=26706,
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=27412,
count=115, id=1, productName=Unmarked objects,
count=2, id=265, version=27054,
count=1, id=256, version=27054,
count=1, id=255, version=27054,
count=1, id=258, version=27054,
詳しい内容.exe
- IMPHASH ce8842560d1c3541ab1f260b0e3d0d36
- SHA256 a9f321b86f00d55bf508f77a588d7d7d05ee2fde1207ce3562a48d5e5fb003ec
- MD5 4f0e3c99c369b9d35d3a37dc74969d30
- SHA1 e3ad90c6e481fd33ad55683d990e4e91f712f98f
- SHA512 b90e451f32bc3dcc9d07c0075fdbd98e373d38a1c446079889d56aba3f9d3ad131956defda968cb68e5dba004c761c3fa8881bc5f27c8c5d5729ebcac31f7691
- SSDEEP 3072:vmJesSoZCF7pxm7wWwBWtkbqHij1vUAc5UYL/cTR8ft++s5naG0AE1tBPB9lmenJ:vmJes/CF7po7XwBWtkbqHijp3c5UYL/J
- TLSH T178F3D41A27E921A4F0B7A6389AB58602D777B8715B3197DF02D4C17D0F23AD8AD34F12
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
Digest
d0:3b:fa:98:a8:ae:71:a7:ac:22:40:ca:04:45:71:a7:8a:44:b4:83:5d:dc:3c:36:a7:6b:21:92:63:9f:bc:53
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Kits Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 12, 2025
CN=Microsoft Windows Kits Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Windows Kits Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:8a:17:14:a0:e7:24:85:0a:08:00:00:00:00:00:8a
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0a:47:b2:14:d9:ee:b2:b3:0f:00:01:00:00:02:0a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5952
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
appverif.pdb
msvcrt
__CxxFrameHandler3
fputws
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_wcmdln
memset
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
_wcsicmp
?what@exception@@UEBAPEBDXZ
__iob_func
_vsnprintf
wcschr
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_vsnwprintf
_callnewh
malloc
_wcsnicmp
wcstoul
_wcstoui64
__C_specific_handler
wcsrchr
printf
wcsstr
wcstol
??_V@YAXPEAX@Z
??0exception@@QEAA@AEBV0@@Z
ntdll
RtlLeaveCriticalSection
RtlInitializeCriticalSection
RtlEnterCriticalSection
RtlAllocateHeap
RtlInitUnicodeString
NtQueryValueKey
RtlDosPathNameToNtPathName_U
NtClose
RtlFreeHeap
NtCreateFile
RtlDoesFileExists_U
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
kernel32
MapViewOfFile
CreateFileMappingW
FileTimeToLocalFileTime
FileTimeToSystemTime
MultiByteToWideChar
UnmapViewOfFile
CreateFileW
WriteFile
GetFileSizeEx
GetProcAddress
HeapAlloc
FindFirstFileW
FindNextFileW
LockFile
SetFilePointer
FindClose
UnlockFile
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx
FreeLibrary
GetModuleHandleW
HeapSetInformation
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
Sleep
LocalAlloc
GetModuleFileNameW
CloseHandle
GetCurrentProcess
SetLastError
LocalFree
CopyFileExW
DeleteFileW
GetSystemDirectoryW
CompareFileTime
LoadLibraryExW
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
HeapFree
WideCharToMultiByte
CreateMutexW
GetCurrentThreadId
FormatMessageW
GetLastError
GlobalFree
FreeConsole
GetProcessHeap
advapi32
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
LookupPrivilegeValueW
OpenProcessToken
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
user32
LoadStringW
vrfcore
VerifierOpenLayerProperties
VerifierCreateLayerProperties
VerifierSetLayerProperty
VerifierQueryLayerProperty
VerifierCloseLayerProperties
VerifierEnableLayer
VerifierDisableLayer
VerifierQueryLayerProperties
VerifierSetLayerBreak
VerifierQueryRegisteredLayers
VerifierDisableVerifier
VerifierIsLayerEnabled
VerifierQueryLayerBreaks
VerifierGetLoggingDirectory
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
dbghelp
SymInitialize
SymSetOptions
SymGetModuleInfo64
SymGetSymFromAddr64
SymCleanup
SymRegisterCallback64
SymLoadModule64
SymGetLineFromAddr64
SymUnloadModule64
Name
.text
Size
76KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=178, id=1, productName=Unmarked objects,
count=9, id=257, version=33145,
count=11, id=261, version=33145,
count=23, id=260, version=33145,
count=12, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,