net9.0-windows.rar
- SHA256 55991130359c37eb13272e5233de0d985c28d66d7136640cf1c8d6a05c91cf58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Namz.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Namz.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
SkidUI.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
SkidUI.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
SkidUI.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral6
Sample
SkidUI.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
injector.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
injector.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target net9.0-windows.rar
- Size 339KB
- Sample260824-fgkmgsyscz
- SHA256 55991130359c37eb13272e5233de0d985c28d66d7136640cf1c8d6a05c91cf58
- MD5 ddb5c4896ade2b374f4f3bed55cab601
- SHA1 53aa0bb6cadf61c8c1f7928f165853c8f1b8cca3
- SHA512 7df5f9737dc21a369bfd16e9f5455d7d9d06f101eed1263fed3e3da3f50a874c6df9e336aaf84d69dd6e479e2b0e02db300d33108f5d054bd5ae11785f751dc5
- SSDEEP 6144:Nx/lxTijS5p7xZVEVFa6xhOvvvc6C9lkob4GGT4Zirg6hMn58bLl+f:Nxu0FZqwHcRPko/7ZirDeCl+f
- TLSH T17774238B9E0458644FD8F0BCB3CDAB440D8D80BC4F784799AB7B19CDB68875B195C762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Namz.dll unpack001/SkidUI.dll unpack001/SkidUI.exe unpack001/injector.exe
File Explorer
-
net9.0-windows.rar.rar 339KB
-
Namz.dll.dll 654KB
-
SkidUI.deps.json410B
-
SkidUI.dll.exe 8KB
-
SkidUI.exe.exe 154KB
-
SkidUI.pdb13KB
-
SkidUI.runtimeconfig.json444B
-
injector.exe.exe 50KB
Namz.dll
- IMPHASH d60f0e385fb099ef8a4c72113e935460
- SHA256 b0ff73851deb16415891552d28203e88e24e7517af90ccd3e8c3bbe633513fab
- MD5 0f802a280ce0504d788d599df455a632
- SHA1 8324e287c29a33e21d7ba359beee22c210997b04
- SHA512 0b5ce0ec071ba141ead48600624a934d7184093d2a4fa6c1e605304f8aaa74481c6dd817fc2824f205a8ffa4eeac063350e93cc348fb7fb7bb7a7e0aed752639
- SSDEEP 12288:+dZ4bVttSpxqj2xdP98ehrPDDPso+HCsa:+dmbVyfqQuZH
- TLSH T114E47D26A26410B8D567D13A87579923E7B3B8441360A7EB03E05625BF2BFF91F7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
490076
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\power\Videos\Projects\Project\SkidBase\Release\Module.dll.pdb
kernel32
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleA
Sleep
DisableThreadLibraryCalls
WakeAllConditionVariable
AcquireSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
ReleaseSRWLockExclusive
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
SleepConditionVariableSRW
msvcp140
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
ws2_32
inet_addr
htons
socket
accept
WSAStartup
listen
WSACleanup
closesocket
bind
recv
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memcmp
memchr
__current_exception_context
__C_specific_handler
_CxxThrowException
__std_type_info_destroy_list
strchr
_purecall
__std_exception_copy
__std_exception_destroy
__std_terminate
__current_exception
memset
memmove
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
_invoke_watson
_register_onexit_function
_initterm_e
terminate
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_errno
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
api-ms-win-crt-convert-l1-1-0
strtod
strtoll
atoi
strtoull
strtoul
api-ms-win-crt-string-l1-1-0
isxdigit
strncpy
isalpha
isupper
isgraph
strpbrk
strncmp
iscntrl
isdigit
strspn
strncat
strcspn
islower
strcmp
isalnum
isspace
ispunct
tolower
toupper
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vsprintf
fwrite
api-ms-win-crt-math-l1-1-0
atan
asin
tanh
acos
_dclass
atan2
floor
ceil
ceilf
floorf
frexp
modf
fmod
log
cos
exp
round
ldexp
log10
log2
_dsign
sin
sinh
sqrt
sqrtf
tan
cosh
pow
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_localtime64_s
strftime
_difftime64
_time64
clock
Name
.text
Size
485KB
Virtual Size
484KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
124KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=22, id=261, version=35207,
count=6, id=257, version=35207,
count=5, id=257, version=33140,
count=140, id=1, productName=Unmarked objects,
count=63, id=265, version=35209,
count=1, id=255, version=35209,
count=1, id=258, version=35209,
SkidUI.deps.json
- SHA256 0f16b503cb98ad622eaf232b152c817032347e83e221e2cf188160fde417ae3d
- MD5 6bfaee64c5f18e2dd7b5a2e9ae5c8956
- SHA1 a9c684b8c081971e2282eeab106c05c345c1ee21
- SHA512 91460ab4ee0f02985c20027d8456a0c7077bd0b2532e660a381b204bcfb5536ce22b78fe8b0f8a6219dc70a8652d70359ddbcefa8b6a7bcbb16b10813c04599b
- TLSH T1DFE09A2DEAA40C9700BA27B2583E8746F533573310211C0AB9FEA01C1FB282B5420F79
- MD5 SHA1 SHA512 TLSH
SkidUI.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1728a4f8a666645bdd80ce5786bc58ecdab442730cd50f7b078cddcae1f6387d
- MD5 8db12e363abd236ffe10bce666266946
- SHA1 f78cf994d43a3bb8546b0ddcf512dbc1ea74c007
- SHA512 82bac8a06bb64eab32aa010fa05e35d4628b09a2a58a8b111bc98d4664ba4f0bf9844278ef214e96c002d9434d44b2812ec7c275a2f3ed7ea0d628bc6c7ceeb3
- SSDEEP 192:uu83PwkZSq6EZSRT0WVf99fkVVeYePmDcw8jF2B:uXPwkZSq6FS+fDfkVVe9PmDc30
- TLSH T16702D6147354C332C4AA077599B7A5400BB5B665A89ACF2F6C8B90C7EE1739405F37E3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\power\Videos\Projects\Project\SkidUI\obj\Debug\net9.0-windows\SkidUI.pdb
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SkidUI.exe
- IMPHASH 45e4653ae633e067079dd72666b0158b
- SHA256 018d49b66c687fc2b3acdb3c08d170ddd3d61297e95ed365a18b1fb5bc264e73
- MD5 a787ab49645cd4a3b8a459db23861626
- SHA1 bc9f293b6c4b26d2e9d927720e9d9acaa080e4e7
- SHA512 fcffa518dc9a4d37ef36c77b136da082547b2a270c1feb21b796266efc8fe1680492c2e6decdb67e2e493ed3f6e5ffa62216886366badefc3b31b7dc12f29f59
- SSDEEP 3072:6XzmjBL9h647B6peduTUxpvuegQtA6dnnOeoLV1CIRiJ:Vh647IUTvuegQtAGs3CS
- TLSH T141F32903E6A950FEE2BBA67889521901F7727C5947B1A7CF135049B60F66BD0AF3E301
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
76544
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetFinalPathNameByHandleW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
CreateFileW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
CloseHandle
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
_get_initial_wide_environment
_initialize_wide_environment
_errno
_configure_wide_argv
_initterm
_set_app_type
_seh_filter_exe
_cexit
_initterm_e
exit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_exit
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
__p___argc
terminate
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
calloc
free
api-ms-win-crt-time-l1-1-0
_time64
wcsftime
_gmtime64_s
api-ms-win-crt-stdio-l1-1-0
fputwc
_set_fmode
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
__p__commode
setvbuf
_wfsopen
fflush
__acrt_iob_func
api-ms-win-crt-locale-l1-1-0
___lc_locale_name_func
__pctype_func
setlocale
___mb_cur_max_func
_unlock_locales
_lock_locales
_create_locale
_configthreadlocale
_free_locale
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
_wcsdup
toupper
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=34321,
count=12, id=260, version=34321,
count=87, id=261, version=34321,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=206, id=1, productName=Unmarked objects,
count=10, id=265, version=34810,
count=1, id=258, version=34810,
SkidUI.pdb
- SHA256 8ca0d91e5ebe4ced2cddedcc42bc58bcd29daa838ae5ab91dbfe23fd756a337a
- MD5 8af3df195511240d3713bf4646a5f00a
- SHA1 12768a4a9a9f4b0de43622b09659ac8a8fe358f2
- SHA512 3207418b7175dd0db53d4b9605a0eef896821163cda6ac4401c7e1374cd2abbc94058c74b8acb33ea5feafbea9b4e3b2b283c10b7b3377ebf62fbe0998711920
- SSDEEP 384:ShV3G5tLhvBLcZae5N+8u5wQnb3hCd7vKQIu1aNXHAf7LzmpjS9t3GNhclP:iV3GPFBhaNIqt3/
- TLSH T16052D577A35CD6A1C40619725926C1CC7B3083322745EE75F1D82A08EEEF78C03BA1B1
- MD5 SHA1 SHA512 SSDEEP TLSH
SkidUI.runtimeconfig.json
- SHA256 7a21157f13f29927befe4765990d6cfe0a6dd2e23c4d617588712eccad0e631e
- MD5 1726795d988fc0f31ca694a1d5c721d5
- SHA1 c15396fb9ae1f7193e8748986a3e301e61991094
- SHA512 b9e7e2c0a35af6a93b608f6e4c82855dfdc04b39888729dd2b9e6bc44eb6dee60db279e5c2e0ad37789bb283277d3aec8c3af2fa0eadabff2895aa1ae6cf91de
- TLSH T165F0222ACA100DA304B977BAC636C182FF30472B00141957B9FC041C2FB3DA11200F89
- MD5 SHA1 SHA512 TLSH
injector.exe
- IMPHASH f24c02fe4872668333c5ff82f0a1a68d
- SHA256 d0b3bf0f3c66c3fd994ea4821de15ccfd78923d495b6e4a8fad13cebb0014858
- MD5 2c7f55ecf2dc409cc06b4953b588f681
- SHA1 87f05f640d95fd821fc5146b37d8df336373e0ba
- SHA512 9b376b7f60aac3ece6d1b2172d3f5c0188158c3da3b1a21fba4e117b5b570b5361e80aea53c2323180af9f1a266f5f79e68c0a6960c56c761decb6aa08d90cbb
- SSDEEP 768:qcN0gU2SMQwD9IO2zBHNBuSAZIyNYy0e2pH9Zx8kE1HWR6SkTHjk:PRUsHKBtB5baY3e2pH9dE1W6
- TLSH T132332962F2B950E8D02AC1BCD7634B86EA71B858032127DF0395D5D22F53EE4763EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
32096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\main\Nam Module main\injector\module stomping\release\bin\injector.pdb
kernel32
GetProcAddress
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
GetTickCount
GetExitCodeProcess
GetModuleFileNameA
GetCurrentProcess
OpenProcess
GetCurrentProcessId
FindFirstFileA
CloseHandle
FindClose
DuplicateHandle
GetTempPathA
CopyFileA
QueryFullProcessImageNameA
CreateFileA
DeleteFileA
K32EnumProcesses
VirtualProtectEx
VirtualQueryEx
Sleep
GetModuleHandleA
FindNextFileA
WriteProcessMemory
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
msvcp140
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Xbad_alloc@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception
__current_exception_context
memmove
strstr
memcmp
__std_exception_copy
__std_exception_destroy
__C_specific_handler
memset
memcpy
strrchr
api-ms-win-crt-stdio-l1-1-0
fwrite
__stdio_common_vsprintf
__p__commode
_get_stream_buffer_pointers
fgetpos
fputc
_fseeki64
fread
__acrt_iob_func
_set_fmode
fsetpos
ungetc
setvbuf
__stdio_common_vfprintf
fgetc
fclose
fflush
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-string-l1-1-0
strlen
strcat_s
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
terminate
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_register_thread_local_exe_atexit_callback
__p___argc
__p___argv
_c_exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=27, id=261, version=35721,
count=6, id=257, version=35721,
count=5, id=257, version=33145,
count=145, id=1, productName=Unmarked objects,
count=4, id=265, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,