Physiological_Client.zip
- SHA256 daa8da374a7733265d53152a6fded97c669f964a6881f2310c8bbc3921488a3f
Overview
overview
5Static
static
5Physiologi...nt.zip
windows10-2004-x64
1Physiologi...nt.zip
windows11-ltsc_2024-x64
1Physiologi...nt.exe
windows10-2004-x64
1Physiologi...nt.exe
windows11-ltsc_2024-x64
1Physiologi...DE.txt
windows10-2004-x64
1Physiologi...DE.txt
windows11-ltsc_2024-x64
1Physiologi...rt.dll
windows10-2004-x64
1Physiologi...rt.dll
windows11-ltsc_2024-x64
1Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Physiological_Client.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Physiological_Client.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Physiological_Client/Physiological Client.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Physiological_Client/Physiological Client.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Physiological_Client/README PLEASE CYDE.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Physiological_Client/README PLEASE CYDE.txt
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Physiological_Client/WinDivert.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Physiological_Client/WinDivert.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Physiological_Client.zip
- Size 2.9MB
- Sample260808-kxtbsacm9z
- SHA256 daa8da374a7733265d53152a6fded97c669f964a6881f2310c8bbc3921488a3f
- MD5 62dd61b23d09d01d34ef071b9c4dae5e
- SHA1 b582efd323bfb92aca8bacab15b34ec27ab3f679
- SHA512 bc96f56f703527e5b5556c17d2aeb6a530a2e357cb062d7da6097c03d75206c3990b3400786fc430ec49235380622eb3f2d7921acd48600d8c1d162884fee764
- SSDEEP 49152:edBxbN9BZGsYBO6uY/Sg4MglGMhKhOkIsuEepI8vx+OIfZSsA6ojT23T:KN3BZGUA/tB7hOkIXjpI8RIBvbp3T
- TLSH T16CE533AC1F1FC5DB63098C3DF0BEE858F19AF9169CA9080784918F967A594F06C5F227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule static1/unpack001/Physiological_Client/Physiological Client.exe ConfuserEx - SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
resource yara_rule static1/unpack001/Physiological_Client/Physiological Client.exe SmartAssembly - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Physiological_Client/Physiological Client.exe unpack001/Physiological_Client/WinDivert.dll
File Explorer
-
Physiological_Client.zip.zip 2.9MB
-
Physiological_Client/Physiological Client.exe.exe 5.7MB
-
Physiological_Client/README PLEASE CYDE.txt1KB
-
Physiological_Client/WinDivert.dll.dll 46KB
Physiological_Client/Physiological Client.exe
- IMPHASH 03542a0ccc80c82441f4a9e87b79dbe9
- SHA256 7709e3132ca65089b2d3f7e0184db1f900b1bd34c5ab4e08f5d4552bb39dbedb
- MD5 06f4ee47a677c4f9c343d3041d24b7c8
- SHA1 76ec3a9e8ed54b25de81396f5be18e9ebfc80bd4
- SHA512 25064c86889c81b2c93d04292ee9e90d89c57215027a9eedb6ff3e8a503aa45938621576914544eefa07ee3ee8ddef03e7c98875787cb97666d399cdbe4fbf18
- SSDEEP 49152:yZSjbWnV/XAQU+6hRqi0uAtJouGBKrosQBAT2QrAqWdvhD/y4uod4GOxsHAV34xt:6bVfAQUG9JNbp9nSWaJN
- TLSH T116566B993360E5CFD49B837E8C159F64AB71E82AA7076747401721981EDDB93CEF80A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
480300
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WideCharToMultiByte
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
QueryPerformanceCounter
VerifyVersionInfoA
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemDirectoryA
VerSetConditionMask
SleepEx
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
SetLastError
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameA
UnmapViewOfFile
MapViewOfFile
CreateFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
OutputDebugStringW
ReadProcessMemory
WriteProcessMemory
SetFileAttributesA
CreateProcessA
OpenProcess
CreateToolhelp32Snapshot
Module32First
Module32Next
GetCurrentProcessId
GetCurrentDirectoryW
Beep
GetSystemInfo
VirtualQueryEx
FindResourceA
GetCurrentThreadId
LoadResource
LockResource
SizeofResource
CreateFileMappingA
WaitForMultipleObjects
PeekNamedPipe
GetSystemTimeAsFileTime
GetFileSizeEx
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
MultiByteToWideChar
WaitForSingleObjectEx
MoveFileExA
RtlVirtualUnwind
GetTickCount
Sleep
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
GetLastError
CloseHandle
user32
GetForegroundWindow
GetWindowThreadProcessId
GetWindowTextA
GetCursorInfo
FindWindowA
SetCursorPos
GetCursorPos
SendMessageW
GetAsyncKeyState
keybd_event
advapi32
CryptGetHashParam
GetUserNameA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptImportKey
msvcp140
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Lockit@std@@QEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??Bios_base@std@@QEBA_NXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0_Lockit@std@@QEAA@H@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Random_device@std@@YAIXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Query_perf_frequency
_Xtime_get_ticks
_Thrd_detach
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_C_error@std@@YAXH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??Bid@locale@std@@QEAA_KXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?width@ios_base@std@@QEAA_J_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QEBA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
normaliz
IdnToAscii
wldap32
ord50
ord46
ord45
ord143
ord22
ord211
ord26
ord41
ord217
ord60
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
crypt32
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertCloseStore
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertFreeCertificateChain
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertOpenStore
CertAddCertificateContextToStore
ws2_32
setsockopt
socket
closesocket
recv
WSAIoctl
WSAStartup
WSACleanup
send
WSAGetLastError
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
recvfrom
sendto
gethostname
bind
ntohl
connect
getpeername
ntohs
htons
getsockopt
WSASetLastError
getsockname
api-ms-win-crt-stdio-l1-1-0
_lseeki64
ungetc
fgetc
ftell
fseek
_fseeki64
_get_stream_buffer_pointers
feof
setvbuf
fgetpos
_open
_close
__stdio_common_vsscanf
fputs
_write
_read
fsetpos
fopen
fclose
fputc
fwrite
fread
__acrt_iob_func
__stdio_common_vsprintf
fgets
fflush
api-ms-win-crt-runtime-l1-1-0
_cexit
terminate
_register_onexit_function
__sys_nerr
strerror
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_errno
exit
system
_beginthreadex
_getpid
abort
_crt_atexit
api-ms-win-crt-heap-l1-1-0
calloc
realloc
free
malloc
_callnewh
api-ms-win-crt-convert-l1-1-0
strtoul
strtol
atoi
strtoll
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
api-ms-win-crt-math-l1-1-0
round
roundf
truncf
api-ms-win-crt-string-l1-1-0
strncpy
strncmp
tolower
strpbrk
strcmp
strcspn
toupper
_stricmp
isdigit
_strdup
isupper
strspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_access
_stat64
_fstat64
_lock_file
_unlock_file
_unlink
vcruntime140
strchr
__FrameUnwindFilter
__CxxUnregisterExceptionObject
__CxxDetectRethrow
__current_exception_context
__current_exception
strstr
strrchr
__CxxExceptionFilter
memcmp
memchr
memset
memmove
memcpy
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
windivert
WinDivertClose
WinDivertOpen
WinDivertRecv
WinDivertSend
gdi32
CreateRoundRectRgn
winmm
timeBeginPeriod
shlwapi
PathFindFileNameA
PathFindExtensionA
mscoree
_CorExeMain
Name
Size
472KB
Virtual Size
471KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
1007KB
Virtual Size
1006KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
3KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
240KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
;sFI39(w
Size
682KB
Virtual Size
682KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
545KB
Virtual Size
544KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=8, id=253, version=31616,
count=7, id=260, version=31616,
count=4, id=259, version=31616,
count=30, id=261, version=31616,
count=6, id=257, version=31616,
count=31, id=257, version=27412,
count=411, id=1, productName=Unmarked objects,
count=105, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,
count=2, id=260, version=31935,
count=2, id=261, version=31935,
count=6, productName=Unmarked objects (old),
count=19, id=261, version=31630,
count=1, id=255, version=31630,
count=1, id=151,
count=1, id=258, version=31630,
Physiological_Client/README PLEASE CYDE.txt
- SHA256 c66d8ea634df6ff0ff3fc735ecad0e3e76f260b77df2c1b98d2fb582e99dbaba
- MD5 171fb9b6d4d7b274bea29703791ec94a
- SHA1 6c6bc0b8d91b0a560da80b076eb5c5fa0948bd75
- SHA512 696476ad166f94652ebe1742196ca6a27b4dcbc277ce96c0c14a48a146b1b4e52657f6d961b32b9d3912fd6446b5850c86863124ca6e6e1310651ff06d93f1f5
- TLSH T14D21546B0309B337483243D7254AA3DBE726483E671A1304566EE19C3A6D424D3F29E8
- MD5 SHA1 SHA512 TLSH
Physiological_Client/WinDivert.dll
- IMPHASH 0b649f8e17494bb31b47f6e959a1769c
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
CloseServiceHandle
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegSetValueExW
StartServiceW
kernel32
CloseHandle
CreateEventW
CreateFileW
CreateMutexW
DeviceIoControl
GetLastError
GetModuleFileNameW
GetOverlappedResult
HeapAlloc
HeapCreate
HeapDestroy
ReleaseMutex
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WinDivertClose
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperCompileFilter
WinDivertHelperDecrementTTL
WinDivertHelperEvalFilter
WinDivertHelperFormatFilter
WinDivertHelperFormatIPv4Address
WinDivertHelperFormatIPv6Address
WinDivertHelperHashPacket
WinDivertHelperHtonIPv6Address
WinDivertHelperHtonIpv6Address
WinDivertHelperHtonl
WinDivertHelperHtonll
WinDivertHelperHtons
WinDivertHelperNtohIPv6Address
WinDivertHelperNtohIpv6Address
WinDivertHelperNtohl
WinDivertHelperNtohll
WinDivertHelperNtohs
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam
WinDivertShutdown
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ