Release.zip
- SHA256 2d4c6a43d7ea17e3b0700072aa82e837b284100ca3ef6616a47e06225015df44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Release/evga_kdrv.sys
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral2
Sample
Release/kokoro.sys
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral3
Sample
Release/notorious.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
General
- Target Release.zip
- Size 54KB
- Sample260802-c8ptqsbr81
- SHA256 2d4c6a43d7ea17e3b0700072aa82e837b284100ca3ef6616a47e06225015df44
- MD5 0d16be6ce1166cc5d31e12657440db87
- SHA1 d9af3a1b3927ca399f44cf3862bce1d250f2b138
- SHA512 b7a216f1779687119ebe6e0374fef0df2eafe69f954ecdc46f6962a796cef56df3941224815e0dc45fe32991e505bc816551f30d18c2f56d5c7bfff208630363
- SSDEEP 768:VQJwHJWQogirv47tERAOxQYyfA8s7hWAI+eoMzXsOsJyu8tl2Im87PPXjyOTehkw:V0mJNojM7ylQYwgeR8OmX8tlvLTynlX
- TLSH T169430225D10C14D5E5D63732B6BFEF6F96A8F7402C949498B48B82936C32E2F428E7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/kokoro.sys unpack001/Release/notorious.exe
File Explorer
-
Release.zip.zip 54KB
-
Release/evga_kdrv.sys.sys 38KB
-
Release/kokoro.sys.sys 5KB
-
Release/notorious.exe.exe 75KB
Release/evga_kdrv.sys
- IMPHASH 71893549487f7704e76dc8929aa437a0
- SHA256 33da2ce240b4559cc6e847d56c5fbeaa3d644ec160841920ea0a098dcee28d0e
- MD5 8dc9504fb5eda1a354971bacffe61ccc
- SHA1 da66b66dca5ea8689db903ec23e98f2c881de6f8
- SHA512 e14750029d50b55f0077ff171cf9882bc8d4a65f4642640cc49dcb6cf168c20b6af3a1d50ca0b3e6b1eff218b26cf64ac92f448827ea76616259b2482c47ad1c
- SSDEEP 768:5tYCFfVj/gom4cTTOiIcm03AiljoyGfhPPKgDz3aCIB:53j4M03myyRNFIB
- TLSH T1E4037C52DBE84882D9B3DA3052F6D627BD34B2835620E7DF012DC5950F62BC5AF2E325
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5c:b9:8f:5d:5e:bd:97:fa:1d:2d:6e:d7:d0:d1:ed:28:ec:ed:93:ef:5c:ea:a2:00:52:43:ee:af:3f:4d:6f:9d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2020
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
a8:d1:6f:ed:89:99:03:31:26:d6:0c:65:6a:3b:a3:59:df:aa:55:9f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=29087808,CN=EVGA Corp.,O=EVGA Corp.,L=New Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Chains
Jul 23, 2020
SERIALNUMBER=29087808,CN=EVGA Corp.,O=EVGA Corp.,L=New Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=29087808,CN=EVGA Corp.,O=EVGA Corp.,L=New Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
Serial Number
02:51:4c:8d:86:cb:84:8e:fc:de:67:e8:3b:d0:82:a3
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 25, 2019 - May 18, 2022
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:3b:cd:6b:d8:3b:c6:71:b8:fe:00:00:00:00:00:3b
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:4D2F-E3DD-BEEF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:2b:93:d0:ed:8e:0a:f7:f0:47:00:00:00:00:01:2b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
2
Major OS version
5
Entry point
5936
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Driver.pdb
ntoskrnl.exe
RtlInitUnicodeString
IoDeleteDevice
RtlCopyUnicodeString
IoDeleteSymbolicLink
IoRegisterShutdownNotification
ExAllocatePoolWithTag
IoUnregisterShutdownNotification
_vsnwprintf
IofCompleteRequest
IoCreateSymbolicLink
wcsrchr
__C_specific_handler
MmMapIoSpace
MmUnmapIoSpace
RtlFreeUnicodeString
DbgPrint
ExFreePoolWithTag
_vsnprintf
MmGetSystemRoutineAddress
IoCreateDevice
ZwClose
ObOpenObjectByPointer
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
KeBugCheckEx
hal
HalSetBusDataByOffset
HalGetBusDataByOffset
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
720B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=135, version=30729,
count=47, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=264, version=28107,
count=1, id=255, version=28107,
count=1, id=258, version=28107,
Release/kokoro.sys
- IMPHASH c575b6f52fb906c91a95c379bd1a2223
- SHA256 a986abaa4725a518960101410d77ba1b56e3ec4e51d7ff4bce76e98d2b8c430e
- MD5 325ed9a0320f07bac4956ef23a050da8
- SHA1 066772b9393d893ddfb01b93c4792cf02c5bd597
- SHA512 27e4bea56386353d9aab4e1dafa279b88482baf018cd84e25a1c22133b0c286b3e71b563072ce05e0c1c630cf948b7f95e17bf9782b6a03a73900c4e428b40c3
- SSDEEP 48:aorC+NvowSAdQbUdsDraNDyVyqEhIhLATAoy5R1h6:LDXd0ksD+NDyVbf5D
- TLSH T1BEC13150753284E3E11A80BDC9864958B3B9F05027515BDFD84861654A46FDEBE39E83
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Hypwer\Downloads\cool fancy new injector\kokoro\x64\Release\kokoro.pdb
ntoskrnl.exe
RtlInitUnicodeString
MmMapIoSpace
MmUnmapIoSpace
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
Name
.text
Size
1024B
Virtual Size
894B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
290B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=33145,
count=4, id=260, version=33145,
count=3, id=257, version=33145,
count=8, id=1, productName=Unmarked objects,
count=1, id=260, version=36248,
count=1, id=258, version=36248,
Release/notorious.exe
- IMPHASH e54a6c05b81e9e33d6e6a605a8f71dd7
- SHA256 6fa7946a88482a4c2d7f35fe04d4ed401a658f280373e6791f934e00040c783f
- MD5 60e271ea13f7288a1105250bd52142e1
- SHA1 cac4249509cd79927505ff358f19a66a58f206a3
- SHA512 c745529d9b3fbd5e7219314964a7cc3763cf009749c6adb0aa0100ced1a62e1996cf9328d39bc0315a0eb58062fd7f330bd2b063d6a14e3bda6088cd2d044dd0
- SSDEEP 1536:NUwDrFKri0DnFAv9oBe5b9d3pbUT1da6dXf:vrsrdDnk9fnK1dNdX
- TLSH T15A731916DA56106ED26ACAF8CA534C01DF73BC8717A5B7CF63801CD60E66AD45F3E602
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
41536
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Hypwer\Downloads\cool fancy new injector\shhh\x64\Release\notorious.pdb
kernel32
GetModuleHandleA
GetCurrentProcess
GetModuleHandleW
GetProcAddress
LoadLibraryW
CreateFileA
GetLastError
GetModuleFileNameW
FormatMessageA
DeviceIoControl
GetLocaleInfoEx
FindClose
FindFirstFileW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
CloseHandle
GetFileInformationByHandleEx
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
LocalFree
advapi32
CloseServiceHandle
OpenSCManagerW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
OpenServiceW
QueryServiceStatusEx
RegCloseKey
msvcp140
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?good@ios_base@std@@QEBA_NXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
ntdll
RtlAdjustPrivilege
NtQuerySystemInformation
dbghelp
SymSetOptions
SymFromNameW
SymFindFileInPathW
SymSrvGetFileIndexInfoW
SymCleanup
SymInitializeW
SymLoadModuleExW
SymUnloadModule64
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
memset
memmove
memcmp
__std_terminate
__std_exception_copy
__std_exception_destroy
memcpy
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
_set_new_mode
free
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
__stdio_common_vfprintf
__p__commode
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_register_onexit_function
__p___argc
_initialize_onexit_table
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
terminate
_register_thread_local_exe_atexit_callback
abort
_c_exit
_cexit
__p___argv
system
api-ms-win-crt-string-l1-1-0
strlen
_stricmp
wcslen
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
ceilf
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=33, id=261, version=35721,
count=6, id=257, version=35721,
count=9, id=257, version=33145,
count=169, id=1, productName=Unmarked objects,
count=4, id=265, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,