01052026_1546_Tax-Number52563.img.zip
- SHA256 3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Tax-Number52563.iso
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tax-Number52563.iso
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
BugSplat64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
BugSplat64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Tax-Number52563.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral6
Sample
Tax-Number52563.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target 01052026_1546_Tax-Number52563.img.zip
- Size 4.6MB
- Sample260723-fd1vasdr5t
- SHA256 3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e
- MD5 892c4fe5f33f77b850c8419f450d1745
- SHA1 490e76dfbe99a5931cbd3baae5756d6e1e89c69a
- SHA512 3b301da7ddd0d24f35a3bdb09d2af8df7a5b9a2de27d0e4853c895bb566f86edcaf2d5dc033ceea0c15924cb7e62ea8d8561c29845284ba31fb7c880d5a14ebb
- SSDEEP 98304:1Ve/Sb1DHcZv7bNNFEtBnHNS5thUOwwbZXdHJ04EJZ:nUSeR7bnCnn85thBJbh0LL
- TLSH T1D926233AFB783180F55C6DB0BB04998453EFAEDA469CCF5062447F198CFA69096CD836
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack002/Tax-Number52563.exe - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/BugSplat64.dll
File Explorer
-
01052026_1546_Tax-Number52563.img.zip.zip 4.6MB
-
Tax-Number52563.img.iso 324.4MB
-
BugSplat64.dll.dll 323.5MB
-
Tax-Number52563.exe.exe 324KB
Tax-Number52563.img
- SHA256 646689ca806b1bd2d02ee23daf12a4ab174953f017306bc032423b8b59aabd4b
- MD5 496e489322721eb1106301ac71e2b8db
- SHA1 0dff48ad199ccefb2a082cd92a7d8c8786290b19
- SHA512 25962e7cef00737aacb117b81eca0790ab89d5185a376b724150b6a5403f6c22a80d285d439f92db3bfa7ee3841bbca032b528d2b5610885e089ffc23be0d483
- SSDEEP 786432:vTgVDqF7/BdDTGO3ZSWtTEsxWmmM8H66X70:vsRqh/fDTDQ/mmMK66
- TLSH T1A8F88E8673C4BADAC745DD3A6714F3314D939D338EBA90C6A997170A85B99730F38AC0
- MD5 SHA1 SHA512 SSDEEP TLSH
BugSplat64.dll
- IMPHASH 6ebf5b7632506f2cfa75dd687cf09739
- SHA256 8e6b931599f2b6a6b3de024e6dcd42992fbf4aad7ec9838d91a1b49fdb57788f
- MD5 b0ef12c82220537385cd2e6a846af14f
- SHA1 abfa362b04be036d77142a0498926f4e2ccf38a5
- SHA512 4c34b057585867fe8d399d9f408ca66cd222ce9656668174702993a6f05ab026d43b0343f52fc8a137fd59aec5f29d176da353c7169bf1703e47dd7a5f178b01
- SSDEEP 786432:mTgVDqF7/BdDTGO3ZSWtTEsxWmmM8H66X706:msRqh/fDTDQ/mmMK66j
- TLSH T121F89C9673C4BADA8745DD1B6704F3314D9399338EBB90C6AD97170A86B99730F38AC0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
394172
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
bcrypt
BCryptGenRandom
kernel32
EncodePointer
FlsFree
GetCurrentProcessId
MultiByteToWideChar
GetStdHandle
RaiseFailFastException
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
GetTickCount64
GetCurrentProcess
GetCurrentThread
WaitForSingleObject
Sleep
DeleteCriticalSection
LocalFree
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
QueryPerformanceCounter
InitializeCriticalSection
InitializeConditionVariable
WaitForMultipleObjectsEx
GetLastError
QueryPerformanceFrequency
SetLastError
GetFullPathNameW
GetLongPathNameW
GetCPInfo
WideCharToMultiByte
LocalAlloc
GetConsoleOutputCP
GetProcAddress
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FreeLibrary
GetFileAttributesExW
GetModuleFileNameW
LoadLibraryExW
SetThreadErrorMode
CreateThread
ResumeThread
DuplicateHandle
GetThreadPriority
SetThreadPriority
WriteFile
GetCurrentProcessorNumberEx
CloseHandle
SetEvent
CreateEventExW
GetEnvironmentVariableW
FormatMessageW
FlushProcessWriteBuffers
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
GetCurrentThreadId
SuspendThread
GetThreadContext
SetThreadContext
VirtualAlloc
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
VirtualQuery
ResetEvent
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
ole32
CoWaitForMultipleHandles
CoInitializeEx
CoCreateGuid
CoUninitialize
CoGetApartmentType
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
malloc
free
api-ms-win-crt-string-l1-1-0
strlen
strcpy_s
_stricmp
strcmp
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_configure_narrow_argv
abort
terminate
_cexit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_initterm
_initterm_e
_seh_filter_dll
_execute_onexit_table
0EPvEqKx92Y7pwDQ1DpF4oi8
10Ug9TWNVmGeWIR
1ZmR5iQQ
1jkqOgYUUpLwqNM
32aXQbwq6cobGrxPSiHYAj
3Uo8TAxTRlB1Gb
3ZQz3Ez
3ykX8tiKixOV3f7hZntJnufif8nMYtr
5STNCBOQWy3QGadVHaWPmQOAHu
69pm0QkMKRvkHXegaLzyqsN9
6z7EALYl
7Tg8dxjDM
8p3nrKN33OdGQPUkRY0QiC71hXo9gx
8qMKRMX22
9KqII6loTfZDTU0VzfSq
9YLsyZkwOUsOkV7UtoYu6L
??0BugSplatImp@@QEAA@XZ
??0MiniDmpSender@@QEAA@AEBV0@@Z
??0MiniDmpSender@@QEAA@PEB_W000K@Z
??1MiniDmpSender@@UEAA@XZ
??4BugSplatImp@@QEAAAEAV0@$$QEAV0@@Z
??4BugSplatImp@@QEAAAEAV0@AEBV0@@Z
??4MiniDmpSender@@QEAAAEAV0@AEBV0@@Z
??_7MiniDmpSender@@6B@
?CreateMiniDump@BugSplatImp@@QEAAHPEAUHINSTANCE__@@KPEAXKPEAU_EXCEPTION_POINTERS@@W4_BS_MINIDUMP_TYPE@MiniDmpSender@@PEB_WPEA_WK@Z
?GetReducedGuid@BugSplatImp@@QEAAXPEA_WK@Z
?ReduceGuidString@BugSplatImp@@QEAAXPEA_WK@Z
?ResumeSuspendedThreads@BugSplatImp@@QEAAXXZ
?SuspendAllThreadsInProcess@BugSplatImp@@QEAAXPEAX@Z
?SuspendThreadsInCurrentProcess@BugSplatImp@@QEAAXXZ
?createReport@MiniDmpSender@@QEAAXPEAU_EXCEPTION_POINTERS@@@Z
?createReport@MiniDmpSender@@QEAAXPEB_W@Z
?createReportAndExit@MiniDmpSender@@QEAAXXZ
?disableNetworkAccess@MiniDmpSender@@QEAA_N_N@Z
?enableExceptionFilter@MiniDmpSender@@QEAA_N_N@Z
?getFlags@MiniDmpSender@@QEBAKXZ
?getMiniDumpType@MiniDmpSender@@QEBA?AW4_BS_MINIDUMP_TYPE@1@XZ
?getMinidumpPath@MiniDmpSender@@QEAAXPEA_W_K@Z
?imp@MiniDmpSender@@QEAAPEAXXZ
?isExceptionFilterEnabled@MiniDmpSender@@QEBA_NXZ
?isNetworkAccessDisabled@MiniDmpSender@@QEBA_NXZ
?removeAdditionalFile@MiniDmpSender@@QEAA_NPEB_W@Z
?resetAppIdentifier@MiniDmpSender@@QEAAXPEB_W@Z
?resetVersionString@MiniDmpSender@@QEAAXPEB_W@Z
?sendAdditionalFile@MiniDmpSender@@QEAAXPEB_W@Z
?setCallback@MiniDmpSender@@QEAAXP6A_NIPEAX0@Z@Z
?setDefaultUserDescription@MiniDmpSender@@QEAAXPEB_W@Z
?setDefaultUserEmail@MiniDmpSender@@QEAAXPEB_W@Z
?setDefaultUserName@MiniDmpSender@@QEAAXPEB_W@Z
?setFlags@MiniDmpSender@@QEAA_NK@Z
?setGuardByteBufferSize@MiniDmpSender@@QEAAHH@Z
?setLogFilePath@MiniDmpSender@@QEAAXPEB_W@Z
?setMiniDumpType@MiniDmpSender@@QEAAXW4_BS_MINIDUMP_TYPE@1@@Z
?setResourceDllPath@MiniDmpSender@@QEAAXPEB_W@Z
?setUserZipPath@MiniDmpSender@@QEAAXPEB_W@Z
?unhandledExceptionHandler@MiniDmpSender@@QEAAJPEAU_EXCEPTION_POINTERS@@@Z
AM02r1Wy
Av7fPgTrid6fMLGEyBIvrELJzGu9Tj
Cgdj9l01BF
CtFFv7Hm6w
CyfunmEl895HfZDLtIA
D2O1Gw9mfFctCO3RhQIViFAE0CV6qo
FSrWVAtcRXxbdqA7XnoG
FiMihQd
HrghYPhQIaHuxU7dIQlrUTRrlwRTdr
IfPKHh1uXHXH4LNFHHmCPOftKhlLTecN
IwAiyIzuCNpi0vgIIBCO8xI
JQ3cZ2p1RXD5Wy7
JRsjJs9V5QZIubiPQ
JYrztwU6CEehzxMpV9GXR6Dr5F
JrCBgb81XRiqDaypkjpX3Sw
JuOARY8Vr
Kfmpt2ucqxoDV2M1UVxKbAC
KpQKmOQPC
KzthWTOcvHgKIuBK7VeI7
LQiIfHMSu0KDiTd4qSfczDEeLhp
LXRWl7Xt0ElfdHFw
NaaJykUQR6qKkbF
OeMcejLlQVkX
PSXvg8IH2KSRp9GRoEVpFMImAxlGN8
PjjWqoWBHfl7CrKEoe83
QaFdzZRP115HMNMwRILw
RXIZZxWz9c00U2FPcE8sFiVueW4s
RwvM1udkcN21YhW9qT2tPbZ9F4MgkQe0
SI5I2XijcD3cx8OZz9dZxf6ucfK
TPtwngGrCMb0n
TqDrdZARxzbVzAbsfu
TyN8u9gKKdEp4p
UrOxGsCoQLdM
UvMR42eN9CbCXe79VmD
V7lPiMfwasdXtY7ZuN
Vf7NnwqiCwYvUIwZC
Wzzd1P7C
XCwx3qQ6094GBDghq5H
XO1PtqpteAW4yukvwmCoGR79WFBQt2J
XxmFGZnDLCMcmJl2iz7fvukblhOf
YJxFLUx1zcw6Cv7k3FKdYZ
YSDMvOODi2jkCt
YtwgWbKLsklEeV8
aTT2x5M6yMY7X1cl8s
bINH1uoduZmPiXs4xFFDpoW
c70ECODO
idhlppBizmIFTZiJaFg48DLUTb17z2
jgflAajJfiPUaZ2SpUa62qYkAI37GxdN
jpHXy8z
kQPh79PogArOxjrsgh80KXk
l8qoGJC9woyDUuor4Y7kx
lRSshkF
nQhi6uGtWkemd
ohfJBJg8h
ovjgiiODTTLaBaWRDN1qAQ85XGFuMNJ
q6Nk6ya
qwQsJ2FxBLTDfCU2JUndcA0HyD
sLgA1PJ2QP6NM
sRcQmRwxbxuzyjY
thY9pO6d0C5k2BDr0fJm4k4wvCXPeXfU
tkhx2FxFjaFP8PXGmUkR
u29yMLlWej1XxSU
u64t24YsD4Q
uomeT48GfIVA7Ink6wcxQiO
v43yJMmh9oJgq4
xYJdJnWWB0Jrg
xyV3DaZIHi
yCXbuV2EKxJxEc
Name
.text
Size
401KB
Virtual Size
400KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.managed
Size
355KB
Virtual Size
354KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
hydrated
Size
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
252KB
Virtual Size
251KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6.5MB
Virtual Size
6.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Tax-Number52563.exe
- IMPHASH c6969aafb7744e2456439ee86554819a
- SHA256 1ffc8bde92758bc0d2ddcc5a6bb78c73b6409429e52d62191f25afa8ebfad84a
- MD5 60138b3f2791742dd65bdf29376055e8
- SHA1 f6ade6bbdd1828add500aa82505567cf9f21efaf
- SHA512 5f331c57b6fbbdd8ab819cddfab1a9859da07b59de849ba34b556598b9d9647938bc7d8fc82bf3e7e35521be355bb316d80665b4cf75b9f71800d50b574055e2
- SSDEEP 3072:RxOb8VXWstpmWU/ya8UGEPzxP8EpwHUlHcTCuyuO/sOX52G99X6yoY46lhMAQG1Z:RxjtWGEPNP8Epw0lmEn0OplohRCyxzy
- TLSH T18A643946735408E8F76783398811D585E6727C390AB0E62FD3647A366E332939D3BB1E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
c7:9b:b0:40:7f:17:c7:17:39:2e:5a:ba:a8:76:5f:bd:ab:e5:72:ac
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=BugSplat,O=BugSplat,L=Henniker,ST=New Hampshire,C=US
Chains
Aug 5, 2020
CN=BugSplat,O=BugSplat,L=Henniker,ST=New Hampshire,C=US
CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
Serial Number
07
Issuer
CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 3, 2011 - May 3, 2031
Subject
CN=BugSplat,O=BugSplat,L=Henniker,ST=New Hampshire,C=US
Serial Number
f8:49:5e:22:4e:fa:55:d4
Issuer
CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 24, 2020 - May 21, 2023
Minor OS version
0
Major OS version
6
Entry point
47816
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\www\src\BugSplat\bin64\BugSplatHD64.pdb
kernel32
GetFileInformationByHandle
CreateFileMappingW
MapViewOfFile
OpenProcess
CloseHandle
GetLastError
Sleep
GetCurrentThread
TerminateProcess
GetTempPathW
WritePrivateProfileStringW
CreateFileW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WriteConsoleW
HeapSize
ReadConsoleW
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnmapViewOfFile
GetACP
MultiByteToWideChar
GetModuleFileNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
GetFileAttributesW
FreeLibrary
CreateProcessW
LoadLibraryW
GetCommandLineW
GetCommandLineA
GetOEMCP
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
LoadLibraryExW
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
RtlUnwind
user32
GetWindow
GetWindowThreadProcessId
GetTopWindow
MessageBoxW
SendMessageTimeoutW
LoadStringW
advapi32
OpenThreadToken
LookupPrivilegeValueW
AdjustTokenPrivileges
ImpersonateSelf
bugsplat64
??1MiniDmpSender@@UEAA@XZ
??0BugSplatImp@@QEAA@XZ
?SuspendAllThreadsInProcess@BugSplatImp@@QEAAXPEAX@Z
?CreateMiniDump@BugSplatImp@@QEAAHPEAUHINSTANCE__@@KPEAXKPEAU_EXCEPTION_POINTERS@@W4_BS_MINIDUMP_TYPE@MiniDmpSender@@PEB_WPEA_WK@Z
??0MiniDmpSender@@QEAA@PEB_W000K@Z
shlwapi
PathAppendW
PathFileExistsW
Name
.text
Size
157KB
Virtual Size
157KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26213,
count=18, id=260, version=26213,
count=168, id=261, version=26213,
count=9, id=259, version=26706,
count=2, id=257, version=27041,
count=61, id=261, version=26706,
count=32, id=260, version=26706,
count=9, id=257, version=26213,
count=125, id=1, productName=Unmarked objects,
count=2, id=265, version=27041,
count=1, id=255, version=27041,
count=1, id=151,
count=1, id=258, version=27041,