c691bc2e25ed5b5ca7a187d0666d02e513097f2ef5ffa9eb12a0554c5e0d8d27
- SHA256 c691bc2e25ed5b5ca7a187d0666d02e513097f2ef5ffa9eb12a0554c5e0d8d27
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
memreduct/dsetup.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
memreduct/dsetup.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
Behavioral task
behavioral3
Sample
memreduct/dsetup_orig.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
memreduct/dsetup_orig.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral5
Sample
memreduct/memreduct-3.5.2-setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral6
Sample
memreduct/memreduct-3.5.2-setup.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
General
- Target c691bc2e25ed5b5ca7a187d0666d02e513097f2ef5ffa9eb12a0554c5e0d8d27
- Size 13.5MB
- Sample260706-pygrlabs7l
- SHA256 c691bc2e25ed5b5ca7a187d0666d02e513097f2ef5ffa9eb12a0554c5e0d8d27
- MD5 0e554726e5b40d4e3a119fda106c4edf
- SHA1 b2187f17d2d53018b7a6890b7f91a28d5a03a552
- SHA512 1855c477bde3b831c9083faa44253374be37f597ea4ebdc797ab3369ebe12a6e225216e4713d171b5760f6d6d5cccf99c3fc8ed149958058afd2c4b33b929f6b
- SSDEEP 393216:NDkb03mDhBeRWjU7g07L2yihG1SCeEP9Uk+kU:Sw3MBWWQD+dGiEdU
- TLSH T1B4E63375B2487176E76B79AF29223416F0706800D4A627E773EF6382817CDDAC61C29F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/memreduct/dsetup.dll - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/memreduct/dsetup_orig.dll unpack001/memreduct/memreduct-3.5.2-setup.exe
File Explorer
-
c691bc2e25ed5b5ca7a187d0666d02e513097f2ef5ffa9eb12a0554c5e0d8d27.zip 13.5MB
-
memreduct/dsetup.dll.dll 13.8MB
-
memreduct/dsetup_orig.dll.dll 93KB
-
memreduct/memreduct-3.5.2-setup.exe.exe 505KB
memreduct/dsetup.dll
- IMPHASH 80f72d72e50f01c0ad751a94969d0be6
- SHA256 351feb2f629cc9b6c4da4f47a12aaa2dd5016b8fb609d6a574c706d45c166052
- MD5 8cdc0b22e85fc568f7d17c5139686c68
- SHA1 17b3b7be8299488b69e9f2d44a89d5a178415d7f
- SHA512 15d89cb4d98b2d4807097242460ac790ec1bf12324dd6c6a506ef7b60cce76f4fb966ddd9b004bfd55c4f51b9cf8da5851bb3cec0726b0597e1154a49aa20cee
- SSDEEP 393216:mDadaPKDNFQluRu70A35CqWN6ZGUaoPN2ameB:lcPgFuuIfQL64oNB
- TLSH T1EAE6235032F4E526F2F32B743AB9E22158BA7D40A534C64E2212565D1BF3B40E96CF7B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8986
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32
wsprintfA
wsprintfW
GetSystemMetrics
EnumDisplayDevicesA
wvsprintfA
bcrypt
BCryptDecrypt
BCryptGenerateSymmetricKey
BCryptCreateHash
BCryptSetProperty
BCryptOpenAlgorithmProvider
BCryptDestroyKey
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
kernel32
FlsSetValue
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetStdHandle
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
GetShortPathNameW
WriteFile
GetTempPathW
GetTempPathA
CloseHandle
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
CreateMutexA
GetCurrentProcessId
CreateProcessA
CreateProcessW
GlobalMemoryStatusEx
GetLocalTime
GetTickCount
DisableThreadLibraryCalls
GetModuleFileNameA
LoadResource
LockResource
SizeofResource
lstrlenA
FindResourceA
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
IsProcessorFeaturePresent
InterlockedFlushSList
RtlUnwind
SetLastError
FlsAlloc
FlsGetValue
DecodePointer
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
RaiseException
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetModuleFileNameW
IsDebuggerPresent
UnhandledExceptionFilter
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualProtect
LoadLibraryExW
LCMapStringW
DirectXDeviceDriverSetupA
DirectXDeviceDriverSetupW
DirectXLoadString
DirectXRegisterApplicationA
DirectXRegisterApplicationW
DirectXSetupA
DirectXSetupCallback
DirectXSetupGetEULAA
DirectXSetupGetEULAW
DirectXSetupGetFileVersion
DirectXSetupGetVersion
DirectXSetupIsEng
DirectXSetupIsJapan
DirectXSetupIsJapanNec
DirectXSetupSetCallback
DirectXSetupShowEULA
DirectXSetupW
DirectXUnRegisterApplication
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13.7MB
Virtual Size
13.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33145,
count=137, id=261, version=33145,
count=19, id=260, version=33145,
count=20, id=259, version=35403,
count=15, id=260, version=35403,
count=29, id=261, version=35403,
count=7, id=257, version=33145,
count=116, id=1, productName=Unmarked objects,
count=1, id=260, version=35728,
count=1, id=256, version=35728,
count=1, id=255, version=35728,
count=1, id=258, version=35728,
memreduct/dsetup_orig.dll
- IMPHASH fcc13f8625d566aaaa2bb3f0da90254b
- SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
- MD5 eb701def7d0809e8da765a752ab42be5
- SHA1 7897418f0fae737a3ebe4f7954118d71c6c8b426
- SHA512 6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
- SSDEEP 1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
- TLSH T113937D107694D076D9D620BD718CD7715ABEA6B41F6880CBBB461BDA8C653C0BA3E30F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
38:29:f8:13:65:88:5c:bf:c5:fa:66:63:11:cb:3f:22:25:39:e2:6c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 30, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:b2:9b:00:00:00:00:00:15
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 21, 2011 - May 21, 2012
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:06:94:2d:00:00:00:00:00:09
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
0
Major OS version
6
Entry point
27580
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
DSETUP.pdb
kernel32
GetCurrentDirectoryW
LocalFree
LocalAlloc
lstrcmpA
WideCharToMultiByte
GetSystemDefaultLCID
LoadLibraryW
GetModuleFileNameW
MultiByteToWideChar
CompareStringA
CreateDirectoryA
GetWindowsDirectoryA
FormatMessageA
GetCommandLineA
HeapFree
HeapReAlloc
HeapAlloc
GetLocalTime
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemDirectoryA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
RtlUnwind
WriteFile
InitializeCriticalSection
GetModuleHandleW
GetCPInfo
GetACP
GetOEMCP
Sleep
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
CreateFileA
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
ReadFile
VirtualProtect
GetSystemInfo
VirtualQuery
SetCurrentDirectoryA
GetVersionExA
LoadLibraryA
GetProcAddress
SetCurrentDirectoryW
OutputDebugStringA
CreateMutexA
GetLastError
CloseHandle
GetSystemTimeAsFileTime
FreeLibrary
user32
GetKeyboardType
DestroyWindow
SetFocus
CreateDialogParamA
SetDlgItemTextA
MessageBoxA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
winmm
mmioRead
mmioDescend
mmioClose
mmioOpenA
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
ole32
StringFromGUID2
DirectXDeviceDriverSetupA
DirectXDeviceDriverSetupW
DirectXLoadString
DirectXRegisterApplicationA
DirectXRegisterApplicationW
DirectXSetupA
DirectXSetupCallback
DirectXSetupGetEULAA
DirectXSetupGetEULAW
DirectXSetupGetFileVersion
DirectXSetupGetVersion
DirectXSetupIsEng
DirectXSetupIsJapan
DirectXSetupIsJapanNec
DirectXSetupSetCallback
DirectXSetupShowEULA
DirectXSetupW
DirectXUnRegisterApplication
Name
.text
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=137, id=1, productName=Unmarked objects,
count=17, id=125, productName=VS2005 build 50727, version=50727,
count=30, id=110, productName=VS2005 build 50727, version=50727,
count=108, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=3, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
memreduct/memreduct-3.5.2-setup.exe
- IMPHASH c3f46af231fa1b9042c9d1b85247a291
- SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
- MD5 bf3f290275c21bdd3951955c9c3cf32c
- SHA1 9fd00f3bb8a870112dae464f555fcd5e7f9200c0
- SHA512 d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
- SSDEEP 3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
- TLSH T103B4B05036F4D926F2F32B743ABDE26158BA7E80A934C20D2501665D1BF3B40A96CF77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
7c:43:ce:81:54:6c:17:23:08:58:c5:e8:17:dc:76:a3:4b:3b:a7:d9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 30, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:b2:9b:00:00:00:00:00:15
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 21, 2011 - May 21, 2012
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:06:94:2d:00:00:00:00:00:09
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
0
Major OS version
6
Entry point
28831
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
DXSETUP.pdb
advapi32
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
kernel32
FindClose
FindFirstFileA
lstrlenA
ReadFile
GetFileSize
CreateFileA
GetCurrentDirectoryA
GetCurrentProcess
GetModuleFileNameA
SetErrorMode
CreateMutexA
GetModuleHandleA
CreateThread
GetSystemDirectoryA
CloseHandle
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
CompareStringA
GetWindowsDirectoryA
FormatMessageA
lstrcmpiA
GetProcessHeap
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
VirtualQuery
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
HeapReAlloc
VirtualAlloc
Sleep
GetModuleHandleW
InitializeCriticalSection
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetOEMCP
OutputDebugStringA
CreateDirectoryA
GetLastError
LocalFree
GetCommandLineA
GetStartupInfoA
GetLocalTime
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
HeapAlloc
GetCPInfo
GetACP
gdi32
StretchBlt
GetObjectA
DeleteDC
CreateCompatibleDC
SelectObject
CreateFontIndirectA
DeleteObject
GetDeviceCaps
user32
ReleaseDC
GetDC
LoadImageA
SystemParametersInfoA
SendDlgItemMessageA
SetDlgItemTextW
SetWindowTextW
GetWindowLongA
SetWindowLongA
PostMessageA
GetParent
SetDlgItemTextA
GetDlgItem
SendMessageA
ShowWindow
SetFocus
GetAsyncKeyState
ExitWindowsEx
EnumWindows
CharLowerA
LoadStringW
MessageBoxW
LoadStringA
MessageBoxA
GetWindowTextA
GetClassNameA
SetForegroundWindow
version
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoA
VerQueryValueA
comctl32
CreatePropertySheetPageA
PropertySheetA
ord17
Name
.text
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
399KB
Virtual Size
399KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=125, productName=VS2005 build 50727, version=50727,
count=35, id=110, productName=VS2005 build 50727, version=50727,
count=123, id=109, productName=VS2005 build 50727, version=50727,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=161, id=1, productName=Unmarked objects,
count=1, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,