passathook-cs2-9.86.5.zip
- SHA256 39095c8362696b365aa639c78ee29ae994c5324f106c96a8e9b99a7112881723
Password
31
Overview
overview
6Static
static
5BetaDecoder.dll
windows11-ltsc_2024-x64
1EliteOptimizer.dll
windows11-ltsc_2024-x64
1README.txt
windows11-ltsc_2024-x64
1commons-ag...nt.txt
windows11-ltsc_2024-x64
1github-about.txt
windows11-ltsc_2024-x64
1icon-github.png
windows11-ltsc_2024-x64
1libcurl.dll
windows11-ltsc_2024-x64
1passathook....5.exe
windows11-ltsc_2024-x64
6Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
BetaDecoder.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
EliteOptimizer.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
README.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
commons-aggreement.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
github-about.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
icon-github.png
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
libcurl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target passathook-cs2-9.86.5.zip
- Size 124.2MB
- Sample260709-trdhtads9r
- SHA256 39095c8362696b365aa639c78ee29ae994c5324f106c96a8e9b99a7112881723
- MD5 ea44b3f24dea6a702a04f1ebe9afdc8c
- SHA1 c796a0f3e32780a545abff69319e65dffef6b434
- SHA512 d078c554f46b667dfc611e3e004274e7f69b275d962c2096b3c95de55b53b6c57170b2617baa2c321f633c59e4f6ebb2092e095e6e131f170675b5bb0cadc4eb
- SSDEEP 3145728:JxkXQCSr8Hcbgpa5g8Inu45LiuZXrIVD0:f7r8HcbQJuQuW
- TLSH T15E581263605C21E79476421ADE32D462C9B9A5E61B2982C370CE700D3BEFCFA457FB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/libcurl.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/libcurl.dll
File Explorer
-
passathook-cs2-9.86.5.zip.zip 124.2MB
-
BetaDecoder.dll17.4MB
-
EliteOptimizer.dll95.9MB
-
README.txt164B
-
commons-aggreement.txt6KB
-
github-about.txt28B
-
icon-github.png.png 22KB
-
libcurl.dll.dll 10.1MB
-
passathook-cs2-9.86.5.exe.exe 789KB
BetaDecoder.dll
- SHA256 1b4a5b44d527b313b57a39d8b0e4569a15a07ef297fb713603bcbf3f08da66de
- MD5 9688a3d5eb9b84843fe92683d9f798b9
- SHA1 4672ef5966ec69dbb1f3a413fd08f5d893a67029
- SHA512 83fed94535ff45e67ac3ba912c140ed76ceb0623e337304176869a3776770d544f8927dcf2ae6526a29104a4b222c2909d26ab1c5932cc157501fac76668d46c
- SSDEEP 196608:VWsHHGTaxG36cx6p5+ZVAP/VFKztgTG1hDBA9balZq9Rzmyj:Xgb76p5+ZVByTG1hDBA9mS7myj
- TLSH T121077C976068A1B0A57E934CCF32CD09DA7152C90F648AC334DD7A8507AFEFA55BE702
- MD5 SHA1 SHA512 SSDEEP TLSH
EliteOptimizer.dll
- SHA256 925f784ef935ba832b60beb2d653dfd7931950bd28ba400cad98336ddde5131b
- MD5 84ef284ae284248150085fbe627d4795
- SHA1 aae648e5c755ce4c90b85c3f9034a132162c8f3f
- SHA512 0d08244727ca067b03b76f0540dd2ad0a8786919b669f3818bac374e4c3ac1f017f8f45940c4b3417bf9202e8938d56669f7c78a48d288329f03131135d59ee6
- SSDEEP 1572864:XtkXzkCSrUtVBcbDMpiEeVrK7n9i3IPe+u/bbcNH59BiuZ2S71BKjVDBTs:dkXQCSr8Hcbgpa5g8Inu45LiuZXrIVDq
- TLSH T14D2833132889C7A6E6BDDD61B23035C9255AC6E70429EEF16A7C44A3CC0494FAF0D7DE
- MD5 SHA1 SHA512 SSDEEP TLSH
README.txt
- SHA256 351ebcc62f3e95cab329631ab367a34799331bd88861f0f30df86f5c322b4364
- MD5 8e4bcb8b0619816daa94a30068ea2b85
- SHA1 8541e9414ca7fa5ace31b01ca8ae3a4e2d53958b
- SHA512 40c76fd724b4a7d7410c10d3d9da6e89888dde6311aeea79f51ab0986c3cab223ba251ab8b8746c5cbbd4a300d220c0bc6284cc1faeff593624d880f66963e51
- TLSH T1E6C080B3CBC153752540C68DA1AD16D49634525866B314E19A41C1C4424E4C657375DC
- MD5 SHA1 SHA512 TLSH
commons-aggreement.txt
- SHA256 2b0ff1a66769222b85996fae92f7fa734bcdfd422ac864cbf28659b243baa182
- MD5 357667cc150eae3179af95d0f75bee98
- SHA1 69fe5bc431df3b3e03a5ba32ae5b92748fbb82d9
- SHA512 d3d326949168f98a136deb84557d7ecfe925872ab2364eb797f8b3a7c7707fc3190bab199644827d56413813f6881c5e0554745dbcadbb89c5a68f9ad81f774a
- SSDEEP 192:Dqmp8oexXBebMulgRHumb3hpaEuMISHON:DqeehB+Edjpa9MI1N
- TLSH T1ABD1B6A5378A03A54ACF01516B0B5084F66AC13E71AE56E572AC514C33FB16D83FE39F
- MD5 SHA1 SHA512 SSDEEP TLSH
github-about.txt
- SHA256 209179469c1e695941800566fb504e7dc7040f883dd67f7d6caf6c4170103406
- MD5 8af80a3db0423f0255edb2dfb0a9e98c
- SHA1 e7cb05336b4e3cbc386fd06a2e7bb57098f9eb38
- SHA512 6a7e425e6b232d7b8191f080e3c8ce3e0690ac22ef90b0ed5a5ed470f9127af49a65d8f0486726c9bd2cb26692580c7a2a20591b25fff934be1742551545a1f3
- MD5 SHA1 SHA512
icon-github.png
- SHA256 17eba628a7dda862d236bca66899be4b80c02c57244f0fbaca573f31740ef730
- MD5 f0fca642b1b10c65c5388d54264df46a
- SHA1 2827ddafa45d9aad3c54f4ff581d046699e015fa
- SHA512 48d09410cba82a923efc3974c98d77afea09a92bdeac603cb2439f8dcd033a863c59ffa3260abb4f9595d3fc2bff1718f627db96c695b6cf700dd910348795c2
- SSDEEP 384:kagku6S2KQRNMvWsx5IK12VpYArX/JpZx3vag01/TqWrZy7sL4nGCOmWW6j0sBJ/:kagkur2KQRhYIZVbrj3ELfJL8GS6oGJ/
- TLSH T15BA2DF617E58A481D72F6DF2FD94CA91AB0E180D46584C93A20AE678F7C6D3CDC9070B
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
31
libcurl.dll
- IMPHASH 83d9ea0801ad5566b167710eaec8af4c
- SHA256 319025f95ce5f6e6b61d4bf56923475c3ac5042175c7f6846d7db520ed79a654
- MD5 90d773980a5cbfcc7e363ef06c125e73
- SHA1 c091c662e5933334d86657faf9d4be59a3ef3fc4
- SHA512 55b871492cd47003aef3c28d485e174cfb08b467cf558433c7245ba44eefaacfd7b13b3855fe6a47e1bb3b483c2249574de245ca3d697bd9cb6bea509fa2202b
- SSDEEP 49152:ZiAfq/9uyKjwV/4Gp2G5dAnkB2z0p8qga8+U8uipPJ7vTHs7Hi1YOEzwyLAyla4R:b
- TLSH T191B60733644D32CF58920452E512A0F38CBEE936A71A93E5D48B902D39EE0ED956FF71
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
31
PE Signature issue
Digest
ec:c4:0a:4e:25:55:b6:a8:bf:54:d5:0b:32:85:85:3f:01:83:c9:70:0f:b6:a4:d8:62:c8:06:cf:98:20:2d:41
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nimble Mechanics Pty Ltd.,OU=Field 3F4F4929,O=Nimble Mechanics Pty Ltd.,L=Denver,ST=Massachusetts,C=BR
Chains
Jul 6, 2026
CN=Nimble Mechanics Pty Ltd.,OU=Field 3F4F4929,O=Nimble Mechanics Pty Ltd.,L=Denver,ST=Massachusetts,C=BR
Subject
CN=Nimble Mechanics Pty Ltd.,OU=Field 3F4F4929,O=Nimble Mechanics Pty Ltd.,L=Denver,ST=Massachusetts,C=BR
Serial Number
1a:72:e5:fb:87:d5:a1:9d:42:d7:02:16:0b:1b:25:99
Issuer
CN=Nimble Mechanics Pty Ltd.,OU=Field 3F4F4929,O=Nimble Mechanics Pty Ltd.,L=Denver,ST=Massachusetts,C=BR
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 6, 2026 - Jul 6, 2028
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
1
Major OS version
5
Entry point
86104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetComputerNameW
GetUserDefaultLCID
GetCommandLineW
LocalFree
DisableThreadLibraryCalls
GetCurrentProcessId
GetCurrentDirectoryW
GlobalAlloc
VirtualAlloc
VirtualFree
GetSystemTime
GetCurrentThreadId
GetCurrentProcess
GetConsoleOutputCP
GetConsoleCP
GetLastError
GetWindowsDirectoryW
GetACP
K32GetProcessImageFileNameA
WriteConsoleW
CreateFileW
CloseHandle
GetConsoleMode
WriteFile
FlushFileBuffers
HeapReAlloc
HeapSize
SetStdHandle
SetFilePointerEx
GetStringTypeW
GetProcessHeap
GetLogicalDrives
LCMapStringW
GetFileType
VirtualProtect
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
TerminateProcess
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
user32
GetMessagePos
LoadIconW
GetSystemMetrics
GetCaretBlinkTime
GetFocus
GetSysColor
advapi32
RegOpenKeyExW
ole32
CoTaskMemAlloc
gdi32
GetStockObject
GetTextAlign
shlwapi
StrCatW
PathIsRelativeW
comctl32
ord17
dwmapi
DwmIsCompositionEnabled
DwmFlush
curl_easy_cleanup
curl_easy_init
curl_easy_perform
curl_easy_setopt
Name
fb012c5f
Size
133KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
4e59da55
Size
7.4MB
Virtual Size
7.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
e6dd0a65
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
acc1e85b
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
e7b3a0fa
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
a6e16705
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
3414dd9b
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
passathook-cs2-9.86.5.exe
- IMPHASH 0b43764663ba024c8202f35227fe0bff
- SHA256 b9c965aa538c21b4702ec7e4f3ac47fc999e1cd505d69e0896a309f7956bb351
- MD5 7744ed6fac4775706938298f9cb5ba0d
- SHA1 2f20777a19b81a4b37de89e4d5a9b8eda21b51a6
- SHA512 9a6d02f58367c3bb728e81566685b0292232e4cd3e5c6b4eed65928026115e7a1fe20e1248950431a5a9d0b5e477310d756f9a70b9337edebee9b2a9acae47fb
- SSDEEP 12288:r/uMr7FsWEt/e51oHpbIp+UfhbkK4crxzB4uhBTpbAhTPCUe2F:7uOzC9IVkK4CxVToTPB
- TLSH T18C058E2A676C01F8E1B7E27989954507F7B6B859137197CF43A0867A2F236E05F3E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
31
Digest
90:4a:9e:b9:9d:36:e8:4b:ee:15:f4:30:0b:9f:29:d8:db:0d:56:16:66:2a:d2:ff:0f:7e:36:0c:b9:b4:17:dd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Chains
May 12, 2024
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Serial Number
03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 13, 2022 - May 14, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
261552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
libcurl
curl_easy_setopt
curl_easy_cleanup
curl_easy_init
curl_easy_perform
comctl32
InitCommonControlsEx
shlwapi
PathFileExistsA
PathFindExtensionW
PathIsDirectoryW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
kernel32
CreateFileW
HeapSize
SetEndOfFile
HeapReAlloc
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateDirectoryW
lstrlenW
GetCurrentThreadId
Sleep
OutputDebugStringW
DeleteFileW
CreateThread
lstrcpyW
lstrcmpW
MulDiv
MoveFileW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
InitializeCriticalSection
WriteConsoleW
CreateEventW
GetLastError
SetEvent
CloseHandle
ResetEvent
CreateSemaphoreW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetConsoleOutputCP
WaitForSingleObject
FlushFileBuffers
GetFileSizeEx
HeapAlloc
HeapFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
WideCharToMultiByte
WakeConditionVariable
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
GetExitCodeThread
RtlUnwind
InitializeCriticalSectionEx
EncodePointer
DecodePointer
GetLocaleInfoEx
LCMapStringEx
GetProcAddress
GetStringTypeW
CompareStringEx
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ReadFile
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
user32
CallNextHookEx
EndDialog
SetWindowTextW
SetDlgItemTextW
CreateWindowExW
MessageBoxA
UnhookWindowsHookEx
SetWindowsHookExW
GetDlgItemInt
SystemParametersInfoW
SetDlgItemInt
DialogBoxParamW
LoadImageW
ReleaseDC
MessageBoxW
SendMessageW
SetWindowPos
GetDC
GetWindowRect
FindWindowExW
GetDlgItemTextW
gdi32
GetDeviceCaps
shell32
SHGetFolderPathW
ShellExecuteW
SHFileOperationW
Name
.text
Size
599KB
Virtual Size
598KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
135KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=190, id=261, version=30795,
count=16, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=1, id=253, version=33218,
count=90, id=261, version=33218,
count=16, id=260, version=33218,
count=18, id=259, version=33218,
count=12, id=257, version=30795,
count=3, id=257, version=33522,
count=182, id=1, productName=Unmarked objects,
count=35, id=265, version=33522,
count=1, id=255, version=33522,
count=1, id=151,
count=1, id=258, version=33522,