ad517a305e4a0e627c35eef92a4fa8047e3bd2c390d868efad9fd518d7a1b78e
- SHA256 ad517a305e4a0e627c35eef92a4fa8047e3bd2c390d868efad9fd518d7a1b78e
Overview
overview
5Static
static
57z.dll
windows10-2004-x64
37z.dll
windows11-ltsc_2024-x64
3core.dll
windows10-2004-x64
1core.dll
windows11-ltsc_2024-x64
1dwmapi.dll
windows10-2004-x64
1dwmapi.dll
windows11-ltsc_2024-x64
1hid.dll
windows10-2004-x64
1hid.dll
windows11-ltsc_2024-x64
1versions.dll
windows10-2004-x64
5versions.dll
windows11-ltsc_2024-x64
5xinput1_4.dll
windows10-2004-x64
1xinput1_4.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
7z.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
7z.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
core.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
dwmapi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
dwmapi.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
hid.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
hid.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
versions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
versions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
xinput1_4.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
xinput1_4.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target ad517a305e4a0e627c35eef92a4fa8047e3bd2c390d868efad9fd518d7a1b78e
- Size 4.1MB
- Sample260808-k8svdscf97
- SHA256 ad517a305e4a0e627c35eef92a4fa8047e3bd2c390d868efad9fd518d7a1b78e
- MD5 2fc04415c42386c2aae18c1a73ccb59b
- SHA1 8d44b6e037e321d4326846ef8f06e4cef8511d9f
- SHA512 da3f7c9374fbb75fc4aa1323aeaad702733c85ce65cf58ce6ff313e409064cdce632b8256108ee3fd1f31eb9138a914d83afcf5d4078632c19df92a41a934a21
- SSDEEP 98304:huk5rDz77EJYzArLKESmNctWrtKMlXcedSgoB:n5f7NM7SOyOoMZcedSgoB
- TLSH T1BA1633910A3CFEF5D6B76D013892C34563F56EBBB00AF44289608B437B4A5A4AF74F25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/versions.dll upx - Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/7z.dll unpack001/core.dll unpack001/versions.dll unpack002/out.upx unpack001/xinput1_4.dll - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/dwmapi.dll unpack001/hid.dll
File Explorer
-
ad517a305e4a0e627c35eef92a4fa8047e3bd2c390d868efad9fd518d7a1b78e.zip 4.1MB
-
7z.dll.dll 1.1MB
-
core.dll.dll 3.1MB
-
dwmapi.dll.dll 144KB
-
hid.dll.dll 156KB
-
versions.dll.dll 2.0MB
-
out.upx.dll 5.8MB
-
xinput1_4.dll.dll 144KB
7z.dll
- IMPHASH 6a7be52633b01426b17d148203c82793
- SHA256 3db62076e5fcc897ff29da47fe4029900a4ad696b395b6fa96acff1229444c1d
- MD5 0dce103b0102adec3279797665b7a4ae
- SHA1 c121392bab6dba8d04bee89c6b526e8e67650cc8
- SHA512 20f0f02097694579ac8794d56411fbe2d97c47d37794cb52afdabc9956c0452e8a3bb273ed34e463f31927e29e7e41c0fddb82fbbe688dd39c4113c00ec91bc9
- SSDEEP 24576:Gxb5vMX35l5UVrIdhcMEKWnttf7eePboHvVxSfOtl:GxbSz5UVrIdhnW1Pc96Otl
- TLSH T132458D15F7F1C0B4D98E56318A2CBBF550F8E71ECA1068C76780BE6E6F328D6C225949
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
868031
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharPrevExA
CharUpperW
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
exit
strchr
strcat
strcpy
memset
realloc
free
malloc
strlen
wcscmp
strcmp
strstr
_CxxThrowException
memmove
memcpy
memcmp
_purecall
__CxxFrameHandler
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
GetOEMCP
FileTimeToLocalFileTime
DeleteCriticalSection
GetVersionExW
LocalFileTimeToFileTime
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
CompareFileTime
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetModuleHandleA
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
885KB
Virtual Size
885KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=9, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=104, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=220, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=39, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
core.dll
- IMPHASH 96dae0b74a947a0e06301f10e3c76d7f
- SHA256 c6adbde4cd32ff615d5b4286cb022d291be3697fd103f3e6e1d2572447afbb4d
- MD5 69ef86d1b24d15e01123132aaaed41a4
- SHA1 bc49d827fff0ac16d7a7c8fa92cc9ba3c6a61f7b
- SHA512 a8e8c24e8ee07a7a0a4fe7a5203e36ff0d58b81d38e9962273e9f23590d63d3f49ae03a8309d190a6440aa76c39c74900d8b8bd3ef9a7bfb45612d2e83c92880
- SSDEEP 49152:8Q9QiQ/gdloU/CDSVlLIqRQIHNytXCIf6+qx8EtIjgWp75+9:NowKqRXH9W
- TLSH T137E54A0BAAA510E4D5BAC038CA53312BFEB174A54372DBCB9691575B5B33BF4A53E300
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2004940
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Desktop\core\bin\x64\Public\core64_Public_raw.pdb
kernel32
OpenProcess
MultiByteToWideChar
QueryFullProcessImageNameA
CloseHandle
WideCharToMultiByte
GetExitCodeProcess
GetModuleHandleA
CreateFileW
ReadFile
CreateToolhelp32Snapshot
GetSystemDirectoryW
GetWindowsDirectoryW
Module32FirstW
Module32NextW
Sleep
ReadProcessMemory
K32EnumProcessModules
VirtualQueryEx
GetLastError
GetModuleFileNameA
GetProcAddress
LoadLibraryExA
FormatMessageA
HeapCreate
GetCurrentProcess
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
K32GetModuleInformation
InitializeConditionVariable
InitializeSRWLock
OutputDebugStringA
GetLogicalProcessorInformation
WriteConsoleW
DisableThreadLibraryCalls
FreeLibrary
DeleteFileA
LoadLibraryA
HeapDestroy
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetEndOfFile
SetStdHandle
DeleteFileW
GetTimeZoneInformation
CreatePipe
WaitForSingleObject
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetCurrentDirectoryW
FindClose
FindFirstFileW
FindNextFileW
SetLastError
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
FindFirstFileExW
GetFileAttributesExW
GetTempPathW
CreateFile2
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
LocalFree
GetLocaleInfoEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
SwitchToThread
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
WakeConditionVariable
WakeAllConditionVariable
CompareStringEx
GetCPInfo
SetUnhandledExceptionFilter
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
RaiseException
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
IsProcessorFeaturePresent
DuplicateHandle
CreateProcessW
ExitProcess
TerminateProcess
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetEnvironmentVariableW
GetFileType
ReadConsoleW
GetModuleFileNameW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
FlushFileBuffers
SetFilePointerEx
GetStdHandle
GetFileSizeEx
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetCurrentDirectoryA
user32
GetWindowThreadProcessId
EnumChildWindows
EnumWindows
IsWindowVisible
GetWindowTextW
advapi32
RegCloseKey
RegGetValueA
RegCreateKeyExA
RegSetValueExA
shell32
ShellExecuteA
winhttp
WinHttpReceiveResponse
WinHttpOpen
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpQueryHeaders
wininet
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenA
InternetSetOptionA
InternetOpenUrlA
dbghelp
SymFromAddr
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
583KB
Virtual Size
583KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
119KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
138KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=224, id=261, version=33145,
count=45, id=260, version=33145,
count=24, id=259, version=33145,
count=1, id=253, version=35403,
count=12, id=259, version=35403,
count=18, id=260, version=35403,
count=99, id=261, version=35403,
count=134, id=261, version=35729,
count=15, id=257, version=33145,
count=214, id=1, productName=Unmarked objects,
count=5, id=260, version=35729,
count=32, id=260, version=31329,
count=24, id=265, version=35729,
count=1, id=255, version=35729,
count=1, id=258, version=35729,
dwmapi.dll
- IMPHASH 23ed50c22e4d44cd918a51a00db74632
- SHA256 14fd13955ed0e6db8b9bb49c13cdc640ca0ed5967984bcdc54b36724de179086
- MD5 db340310ddfe7fdf40477a59970172a8
- SHA1 2a02c93586244d9faa9322ac442087bcbc9c1b25
- SHA512 9022ed59f1f656813959e679f576235d55322a9685ad6a7b4025ffdf7217bb18b951a0cee7cf9c636c9bdb136cfec90dde3bc27fbd7180cc39e61ac2820e6694
- SSDEEP 3072:yEqDLBwnkOMDAPlg8qdZganBLnygkBWVaok:yzVgkv8GvganBgjp
- TLSH T196E37C1BB2A600BBE4B7D278C9970646E773B85507609BEF036843661F137D19E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
15:bc:8e:a1:c2:ee:22:59:c7:bb:63:04:a5:5a:da:3e:c3:e4:2d:4a:43:ff:3b:cd:3b:ac:5a:56:96:19:3c:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Yongquan Fu,O=Yongquan Fu,L=佛山,ST=广东,C=CN
Chains
Aug 6, 2026
CN=Yongquan Fu,O=Yongquan Fu,L=佛山,ST=广东,C=CN
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Yongquan Fu,O=Yongquan Fu,L=佛山,ST=广东,C=CN
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 6, 2011 - Oct 6, 2046
Subject
CN=Yongquan Fu,O=Yongquan Fu,L=佛山,ST=广东,C=CN
Serial Number
28:58:83:6e:bd:cb:ee:61:83:c6:a9:1e:ac:d2:3c:26
Issuer
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 30, 2025 - Jun 30, 2026
Subject
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Minor OS version
0
Major OS version
6
Entry point
8916
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\vs\steam\劫持\dwmapi\bin\x64\Release\dwmapi.pdb
kernel32
GetModuleHandleExW
GetSystemDirectoryW
GetCurrentDirectoryA
GetModuleHandleA
CopyFileA
DisableThreadLibraryCalls
LoadLibraryA
lstrcatW
LoadLibraryW
GetProcAddress
FreeLibrary
WriteConsoleW
CreateFileW
CloseHandle
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
user32
wsprintfW
MessageBoxW
DllCanUnloadNow
DllGetClassObject
DwmAttachMilContent
DwmDefWindowProc
DwmDetachMilContent
DwmEnableBlurBehindWindow
DwmEnableComposition
DwmEnableMMCSS
DwmExtendFrameIntoClientArea
DwmFlush
DwmGetColorizationColor
DwmGetCompositionTimingInfo
DwmGetGraphicsStreamClient
DwmGetGraphicsStreamTransformHint
DwmGetTransportAttributes
DwmGetUnmetTabRequirements
DwmGetWindowAttribute
DwmInvalidateIconicBitmaps
DwmIsCompositionEnabled
DwmModifyPreviousDxFrameDuration
DwmQueryThumbnailSourceSize
DwmRegisterThumbnail
DwmRenderGesture
DwmSetDxFrameDuration
DwmSetIconicLivePreviewBitmap
DwmSetIconicThumbnail
DwmSetPresentParameters
DwmSetWindowAttribute
DwmShowContact
DwmTetherContact
DwmTetherTextContact
DwmTransitionOwnedWindow
DwmUnregisterThumbnail
DwmUpdateThumbnailProperties
DwmpAllocateSecurityDescriptor
DwmpDxGetWindowSharedSurface
DwmpDxUpdateWindowSharedSurface
DwmpDxgiIsThreadDesktopComposited
DwmpEnableDDASupport
DwmpFreeSecurityDescriptor
DwmpGetColorizationParameters
DwmpRenderFlick
DwmpSetColorizationParameters
DwmpUpdateProxyWindowForCapture
Name
.text
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=32, id=261, version=35207,
count=5, id=257, version=33145,
count=102, id=1, productName=Unmarked objects,
count=1, id=259, version=35221,
count=1, id=265, version=35221,
count=1, id=256, version=35221,
count=1, id=255, version=35221,
count=1, id=258, version=35221,
hid.dll
- IMPHASH a194adedf2e90a682dbf72fd0081b08f
- SHA256 335799bac6fa8fdc391da594444a50e4dbf5494f79e51b038011d9af64a9ef76
- MD5 d0279d81b9f8428f710b2d0e3c3c684e
- SHA1 e5059aef07e96a3975eccd74ce41cc8487b3f621
- SHA512 0731d38897e0ba1b359d72a52ce0eb1ef0dde4f67e32912cc2292c1a77cd304b2b03c29e9bf01603fa52f3aa7491b3d57a5bf7d19a445ccd98f407420890baac
- SSDEEP 1536:GI9dwVtYxK8J8Ujkfc4lrt2LZIidk8GVu1F8TH4SM/BC/RMgnEwUUsWzdX9dlEUY:5HwOr2lPKdkozwYrZC/RHEEXV2LdGS
- TLSH T116F36B07B3B544BBF1B7823489A30647E772781217609BDF03A4467A1F273E5AD3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
58:a6:21:cd:58:65:d7:7f:4c:d9:63:46:4d:5f:58:88:6d:3e:2b:2e:10:df:06:9c:f6:19:b1:db:2f:90:a6:f1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Yongquan Fu,O=Yongquan Fu,L=佛山,ST=广东,C=CN
Chains
Aug 6, 2026
CN=Yongquan Fu,O=Yongquan Fu,L=佛山,ST=广东,C=CN
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Yongquan Fu,O=Yongquan Fu,L=佛山,ST=广东,C=CN
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 6, 2011 - Oct 6, 2046
Subject
CN=Yongquan Fu,O=Yongquan Fu,L=佛山,ST=广东,C=CN
Serial Number
28:58:83:6e:bd:cb:ee:61:83:c6:a9:1e:ac:d2:3c:26
Issuer
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 30, 2025 - Jun 30, 2026
Subject
CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 19, 2021 - May 18, 2036
Minor OS version
0
Major OS version
6
Entry point
9028
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\vs\steam\劫持\hid\bin\x64\Release\hid.pdb
kernel32
GetModuleFileNameA
GetSystemDirectoryW
GetCurrentDirectoryA
GetModuleHandleA
CopyFileA
DisableThreadLibraryCalls
LoadLibraryA
lstrcatW
LoadLibraryW
CreateThread
GetProcAddress
FreeLibrary
WriteConsoleW
CreateFileW
CloseHandle
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
user32
wsprintfW
MessageBoxW
HidD_FlushQueue
HidD_FreePreparsedData
HidD_GetAttributes
HidD_GetConfiguration
HidD_GetFeature
HidD_GetHidGuid
HidD_GetIndexedString
HidD_GetInputReport
HidD_GetManufacturerString
HidD_GetMsGenreDescriptor
HidD_GetNumInputBuffers
HidD_GetPhysicalDescriptor
HidD_GetPreparsedData
HidD_GetProductString
HidD_GetSerialNumberString
HidD_Hello
HidD_SetConfiguration
HidD_SetFeature
HidD_SetNumInputBuffers
HidD_SetOutputReport
HidP_GetButtonArray
HidP_GetButtonCaps
HidP_GetCaps
HidP_GetData
HidP_GetExtendedAttributes
HidP_GetLinkCollectionNodes
HidP_GetScaledUsageValue
HidP_GetSpecificButtonCaps
HidP_GetSpecificValueCaps
HidP_GetUsageValue
HidP_GetUsageValueArray
HidP_GetUsages
HidP_GetUsagesEx
HidP_GetValueCaps
HidP_GetVersionInternal
HidP_InitializeReportForID
HidP_MaxDataListLength
HidP_MaxUsageListLength
HidP_SetButtonArray
HidP_SetData
HidP_SetScaledUsageValue
HidP_SetUsageValue
HidP_SetUsageValueArray
HidP_SetUsages
HidP_TranslateUsagesToI8042ScanCodes
HidP_UnsetUsages
HidP_UsageListDifference
Name
.text
Size
91KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=138, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=36, id=261, version=35207,
count=5, id=257, version=33145,
count=104, id=1, productName=Unmarked objects,
count=1, id=259, version=35222,
count=1, id=265, version=35222,
count=1, id=256, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,
versions.dll
- SHA256 9c56331c510a5725994c9f691f444a39fb8cf3868adf7e44af39253fdf4f564f
- MD5 cb9e30de2bfe7b61316e6c9d616d2a22
- SHA1 179a0d4bbe36bf603a0082002a0a965da841c4bb
- SHA512 d1c5a1c8f2064e5c673a3e596079c359d5910895566b325cc91fbc23f6a827095348919dd52f2792e949c7f0debdc2cf36332ff095fbe3d076c5efa13d1e2f59
- SSDEEP 49152:c1Q3MyKBfV1BTBzfnrS08yCxhewT+r8PaVbhA:OVH1BTBe3xj+g
- TLSH T12E95339189C62B77C794867C3A98B6F13742F02304FC81EA6955D102C6B67F1D89ABCF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6206096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
DetourFinishHelperProcess
RestartPIDW
Name
UPX0
Size
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=209, id=261, version=33145,
count=10, id=259, version=33145,
count=4, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=253, version=35207,
count=17, id=260, version=35207,
count=42, id=261, version=32215,
count=12, id=259, version=35207,
count=22, id=260, version=33145,
count=1, id=262, version=33145,
count=21, id=261, version=34808,
count=97, id=261, version=35207,
count=35, productName=Unmarked objects (old),
count=904, id=260, version=34808,
count=35, id=257, version=33145,
count=379, id=1, productName=Unmarked objects,
count=20, id=265, version=35211,
count=1, id=256, version=35211,
count=1, id=255, version=35211,
count=1, id=258, version=35211,
out.upx
- SHA256 3f3653ec3866554289537792ea6e6fed5591c3b3afb39851a5f586dacd8e4e07
- MD5 2f5ac5cd54320a5ff6e3344a686eec1f
- SHA1 021df7f53b1ecd4714fd356ba25876ac52e46060
- SHA512 c17461eae995127b94b1edfd0b57c18ec498a166580a773a9a996efce4b408716c9a5fe137cfd7d1a54c170c1a4f619f7868044582d454e7e9ca2a28d556a046
- SSDEEP 49152:ogGtlq5VwASODwjgZtGfwdzEBwTYhQmiq0WOEfa4v5GYgWjQLuUMSH/kniHun/3K:o4P8iq3f5Zcun4r53+3
- TLSH T1FB565B6AB67C00B5D4BAC1B9C28E6B27E671745553F057CB5A708AF61F33AE0163EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3700212
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
4.3MB
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
50KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
201KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=209, id=261, version=33145,
count=10, id=259, version=33145,
count=4, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=11, id=253, version=35207,
count=17, id=260, version=35207,
count=42, id=261, version=32215,
count=12, id=259, version=35207,
count=22, id=260, version=33145,
count=1, id=262, version=33145,
count=21, id=261, version=34808,
count=97, id=261, version=35207,
count=35, productName=Unmarked objects (old),
count=904, id=260, version=34808,
count=35, id=257, version=33145,
count=379, id=1, productName=Unmarked objects,
count=20, id=265, version=35211,
count=1, id=256, version=35211,
count=1, id=255, version=35211,
count=1, id=258, version=35211,
xinput1_4.dll
- IMPHASH 73b5f5cf5786efe212f075d86ed3096c
- SHA256 b5f273b58e374f2bc4f2004130b39b79fc442bcbcdfc80859863632c6fcec1b6
- MD5 d4d27175d026a3a499489a247c3891ec
- SHA1 e67fba95dda43e915c2b0a07e07a7dbfdb3c57b7
- SHA512 5c3b662b4535a99ec269dfa499634009ec2a22e23c442e70b4992b17c5d248d1d92068fade79bf64097f1f8158fe79d7cc5e60cb24bd966012a679274596770d
- SSDEEP 1536:tqGJz5MZE/5SClK51ybX/x9/5Y3ZwqkcGkUD6OTxad7HRSiNCXw6gW8otwcjHsWZ:00KepvD/WDG0usxAXw6PttSv/NyiS
- TLSH T1F7E35A57B2A500FBE1B78238C9630A05F772B81247609BEF43A847752F277D19D3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12100
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\vs\steam\劫持\xinput1_4\bin\x64\Release\xinput1_4.pdb
kernel32
GetModuleHandleExW
OutputDebugStringA
GetSystemDirectoryW
GetCurrentDirectoryA
GetModuleHandleA
CopyFileA
DisableThreadLibraryCalls
LoadLibraryA
lstrcatW
LoadLibraryW
GetProcAddress
FreeLibrary
WriteConsoleW
CreateFileW
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
GetLastError
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleFileNameW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
user32
wsprintfW
MessageBoxW
DllMain
XInputEnable
XInputGetAudioDeviceIds
XInputGetBatteryInformation
XInputGetCapabilities
XInputGetKeystroke
XInputGetState
XInputSetState
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=35215,
count=12, id=260, version=35215,
count=8, id=259, version=35215,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=32, id=261, version=35207,
count=5, id=257, version=35215,
count=119, id=1, productName=Unmarked objects,
count=1, id=259, version=35221,
count=5, id=265, version=35222,
count=1, id=256, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,