Fortnite-Selium-1.1.5.zip
- SHA256 085374f62b7c4c5346a5b5805f9e720992415ebc230399724f733def8fc94470
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BmV78Pi.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
BmV78Pi.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
driver.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
map.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
map.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target Fortnite-Selium-1.1.5.zip
- Size 2.8MB
- Sample260718-2dhjlset2m
- SHA256 085374f62b7c4c5346a5b5805f9e720992415ebc230399724f733def8fc94470
- MD5 7c5e1677d387c11ceb1c1ebca7ce3005
- SHA1 cf7379f302520b464bb4f9f8c03bd1ef7d1f53a1
- SHA512 792acbc20aaf65d565ade2dbcfc9cbc5277e27fcea308fd26afc02fead4182a19bd66a96bff5d605dea00ce275c71739763809c53dfe087d900ea5abe19fa3af
- SSDEEP 49152:6BWXVMXoVkrW55tE+qWJulB48C9osa7VuNXXN3bUZmacDt1U0iLHXNPEI0yiYveV:TVMXSVE+qEC8oEXdUZmaqtK0iLHJ3iYw
- TLSH T1B6D533F5E8CD17FAF10195E3AE5A6264617D14EE3B0E2190B096FA3E261237CE13D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/BmV78Pi.exe unpack001/driver.sys unpack001/map.exe
File Explorer
-
Fortnite-Selium-1.1.5.zip.zip 2.8MB
-
BmV78Pi.exe.exe 3.3MB
-
README.md964B
-
driver.sys.sys 8KB
-
map.exe.exe 138KB
BmV78Pi.exe
- IMPHASH 6e4b1cb930844f8e08a6f36e049b2c43
- SHA256 d5d9c6f40088e135a8b7dc5dad6479c28eb002a5043981d87e7a00d68dabc6de
- MD5 1aafaa7a40a1336240ecc1a533fb346c
- SHA1 f1e4615b04df2a5d3f2ac190d79a20d8ef743514
- SHA512 18ddd516e1f35f6be7b3264b05e5ef66ae971a09e8875255013d1543b6d1733f8e88f171ed316a9dcbc12fafb5e9a47716fff1f1b5a06fa59a78a4d1555b16b3
- SSDEEP 49152:FTJKj1DpuLBmdltEEGuXyhB48cjiWajVkRlXT3dUZkQ81RR0cgdV1F2Onz9CmLH:lJKfuGEEGYCCiWlxUZkQaRScgdV/rH
- TLSH T180F50253F26602FCC127A038DA91E307F7313C442B15A7CBB3D56AA41F672F05ABA691
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
573424
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Admin\Desktop\Selium\Adrenaline fn src (3)\Adrenaline fn src\vkojii base src fn\x64\Release\SeliumFN.pdb
kernel32
lstrcmpiW
OutputDebugStringA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
IsDBCSLeadByte
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GetModuleFileNameA
CloseHandle
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
SetUnhandledExceptionFilter
WakeAllConditionVariable
GetFileInformationByHandleEx
Process32FirstW
AreFileApisANSI
CreateFile2
SetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
GetCurrentThreadId
Sleep
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Process32NextW
GetLastError
CreateToolhelp32Snapshot
CreateFileW
DeviceIoControl
GetStdHandle
GetModuleHandleW
SetConsoleTitleA
SetConsoleTextAttribute
user32
SetCursorPos
GetFocus
DefWindowProcW
SetClipboardData
GetClipboardData
OpenClipboard
CreateWindowExW
GetSystemMetrics
GetWindowLongPtrW
RegisterClassExW
ReleaseCapture
IsWindowUnicode
CloseClipboard
SetWindowLongPtrW
EmptyClipboard
ShowWindow
GetKeyState
GetAsyncKeyState
DispatchMessageW
PeekMessageW
SetWindowDisplayAffinity
MessageBoxA
GetForegroundWindow
GetMessageExtraInfo
SetLayeredWindowAttributes
SetFocus
TranslateMessage
PostQuitMessage
UpdateWindow
SetForegroundWindow
GetCursorPos
ScreenToClient
GetCapture
ClientToScreen
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetKeyboardLayout
TrackMouseEvent
DestroyWindow
shell32
ShellExecuteW
msvcp140
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?id@?$collate@D@std@@2V0locale@2@A
_Query_perf_frequency
_Strcoll
_Query_perf_counter
_Xtime_get_ticks
_Mtx_unlock
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
__crtLCMapStringA
_Strxfrm
??1_Lockit@std@@QEAA@XZ
_Mtx_lock
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmExtendFrameIntoClientArea
winhttp
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpReadData
WinHttpOpenRequest
imm32
ImmGetContext
ImmSetCandidateWindow
ImmReleaseContext
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
memset
memmove
memcpy
memcmp
memchr
__RTtypeid
__std_exception_copy
strchr
__std_terminate
__std_type_info_compare
api-ms-win-crt-heap-l1-1-0
_callnewh
realloc
malloc
_set_new_mode
free
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vsprintf_s
_get_stream_buffer_pointers
_fseeki64
fsetpos
setvbuf
fgetpos
__stdio_common_vsprintf
fputc
ungetc
fgetc
ftell
fread
_wfopen
fwrite
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
__stdio_common_vsscanf
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
abort
__p___argv
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_errno
system
_set_app_type
terminate
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_exe
api-ms-win-crt-convert-l1-1-0
atof
strtoull
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
strcmp
strlen
strncmp
strncpy
wcslen
strcpy_s
api-ms-win-crt-locale-l1-1-0
___lc_collate_cp_func
___lc_locale_name_func
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
asin
atan2f
sqrt
sinf
sqrtf
atan2
logf
ceilf
cosf
floorf
fmodf
powf
log
tanf
acosf
pow
Name
.text
Size
565KB
Virtual Size
565KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
603KB
Virtual Size
605KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=38, id=261, version=35721,
count=6, id=257, version=35721,
count=19, id=257, version=33145,
count=361, id=1, productName=Unmarked objects,
count=9, id=265, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,
README.md
- SHA256 50537662257dd0d714201f943071e219dc9fc68cc5eafd233c6df2f4dfd97eb2
- MD5 38bd699e1f1af7cb2be99f815123ebab
- SHA1 dc43761bb72d4072553431a9ee62282aefd6ef02
- SHA512 ed1de5f5bdeec9b3572e42feeef24186c5f65cbe70832629dd34b9a108391646563c6bbf56ef62fd20dc1944a71f2283aeb6114fa5fa0de781c8a1ab2796f120
- TLSH T10411504B136B963301F1018B080D23FE97405828503D20293870A41C826CAF9D7F8FCE
- MD5 SHA1 SHA512 TLSH
driver.sys
- IMPHASH 082941a820bbe0f9deef2f93958bb110
- SHA256 fd4a1eb46a25b5e687957300aab62074cf36a7905bbbd0cb0809c150d5f5facc
- MD5 64459649af479f7d4ab915e8d2dc177d
- SHA1 e723c78eff93834f8ec6ea3fefaa4996d3b7fe72
- SHA512 c0d076a765399394c7a9e2e3c1ec9a161469ad8942688d68ca1802f81b3ffe5040c7f78f9581ce620cbd24460acdb6dce67872f3ec3c18542aaf3ddb85d7bb83
- SSDEEP 96:UU8fjUHmSWDb22zvqLcSHWj7nVQOJT0VzvDBhhJ:tWP22zvqYYcTVQ7zbzh
- TLSH T19102C8B061179DC4E25DE17ECA9746A9B6B5F01003924FEF8965CA6E1F12FC12C3BA80
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\vkojiii\Desktop\vkojii driver src\build\driver\driver.pdb
ntoskrnl.exe
RtlInitUnicodeString
DbgPrintEx
ExAllocatePool
ExFreePoolWithTag
MmUnmapIoSpace
MmMapIoSpaceEx
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObfDereferenceObject
MmCopyMemory
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
IoCreateDriver
PsGetProcessSectionBaseAddress
ZwQuerySystemInformation
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
632B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=3, id=257, version=35215,
count=24, id=1, productName=Unmarked objects,
count=6, id=259, version=35215,
count=5, id=260, version=35215,
count=1, id=261, version=36248,
count=1, id=258, version=36248,
map.exe
- IMPHASH 976611f0da1b678bc00c773b400704ae
- SHA256 57832f7a25c5cd0dfca09c54d0019e4f19a0d27a949a92dc68baf35b72be8211
- MD5 365fc713b2097470bd269602b5d54eb2
- SHA1 4e237fb146ed252246ad81231294f877edbc35c7
- SHA512 5033693df40f39a568967b26977603c353d59e538d43da430838875d5955181cc5533a3ae8de4aaf23b8841046e72f970f539879f44c17a633b72df08ead29d3
- SSDEEP 3072:ejVYisyVqzOSDMbfVP+qmJTQSaMm5/6Ygnzg+zOG:ebsyVqzOswfUWlBgns+q
- TLSH T112D35B2BE659207ED2A6D9BDCA524912FBB27C850751B7CF136049B60F627D06F3E302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
66140
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\quent\Documents\Digital\kdmapper-master (1)\kdmapper-master\x64\Release\DigiMapper.pdb
kernel32
GetModuleHandleA
DeleteFileW
CloseHandle
GetProcAddress
GetCurrentProcessId
MoveFileW
FlushFileBuffers
FindFirstFileW
VirtualProtect
FindNextFileW
GetCurrentProcess
FindClose
GetCurrentThreadId
Sleep
Process32NextW
Process32FirstW
GetWindowsDirectoryW
SetProcessWorkingSetSize
SetUnhandledExceptionFilter
GetTempPathW
FormatMessageA
GetLocaleInfoEx
CreateFileW
SetFilePointer
SetFileTime
VirtualAlloc
DeviceIoControl
WriteFile
VirtualFree
CreateToolhelp32Snapshot
GetFileSizeEx
GetFileAttributesExW
AreFileApisANSI
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
user32
GetWindowThreadProcessId
GetShellWindow
advapi32
RegCloseKey
RegDeleteTreeW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegOpenKeyW
RegSetKeyValueW
msvcp140
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?_Xlength_error@std@@YAXPEBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
ntdll
NtLoadDriver
NtUnloadDriver
NtQuerySystemInformation
RtlAdjustPrivilege
RtlInitUnicodeString
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
memcpy
memcmp
__current_exception
__C_specific_handler
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__current_exception_context
wcsstr
memmove
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
__p___argc
_initterm
terminate
_crt_atexit
_register_onexit_function
_get_initial_wide_environment
_cexit
_exit
_seh_filter_exe
exit
__p___wargv
_initialize_wide_environment
_configure_wide_argv
_invoke_watson
abort
_initterm_e
_set_app_type
_initialize_onexit_table
api-ms-win-crt-filesystem-l1-1-0
_wremove
_lock_file
_unlock_file
api-ms-win-crt-string-l1-1-0
_stricmp
_wcsicmp
wcscpy_s
wcscat_s
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
fsetpos
ungetc
setvbuf
fgetpos
fwrite
_get_stream_buffer_pointers
_set_fmode
fgetc
fclose
fflush
fputc
__p__commode
_fseeki64
fread
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
268B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=35, id=261, version=35207,
count=6, id=257, version=35207,
count=9, id=257, version=33145,
count=229, id=1, productName=Unmarked objects,
count=7, id=265, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,