ValSkinChanger.zip
- SHA256 6715455355f6ecb501aa88343b43247ce1cb5e6e4810d3e06a83c2142f720797
Static task
static1
2 signatures
General
- Target ValSkinChanger.zip
- Size 180KB
- Sample260825-eqlqgaswgt
- SHA256 6715455355f6ecb501aa88343b43247ce1cb5e6e4810d3e06a83c2142f720797
- MD5 e5ab831a912698360fddb73adfe35c7a
- SHA1 a8a4a9458e4efde02ca4f54728d0e8cdc0172ee6
- SHA512 22eaf5a9055b50de795aa450a426c99832c033c2ba7652907570b616c0fced5bd44517c2174c0f21912d3948f6e3753f5c2f4d0f96804543214d43d7d86bdd10
- SSDEEP 3072:nvuPh6YfUP2hN6w0/JKSrqohaFiLRzYOtmjFQOO/qQEt5unAIWgGDfIkeoMeMSMs:nveFhMfJKQyiLREXJQEt5unfsDzdVTiG
- TLSH T1B6042231F2FFF815C162A9B3EA88F8CB2E9E0696467581F055AE44172DA27CF5F01187
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ValSkinChanger/hookloader.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/ValSkinChanger/krx legit v4.dll
File Explorer
-
ValSkinChanger.zip.zip 180KB
-
ValSkinChanger/Setup.bat.bat .vbs 522B
-
ValSkinChanger/config.json614B
-
ValSkinChanger/hookloader.exe.exe 37KB
-
ValSkinChanger/krx legit v4.dll.dll 396KB
ValSkinChanger/Setup.bat
- SHA256 ab3f171241326939f3b769a9b86f631cf5ba5dc0925fc1ccd16768de1b0adc43
- MD5 49452d1d75cecc0f10fa79f3ef6f9bfc
- SHA1 0ea4b4f042714788caae23977c5210666041796b
- SHA512 f66a440df949df5ea43480271c8ea11d6743ca90d2aa69035166d8adb9ea0c710dc72de8ed168d26b31fcd6ab8dea43f278e26e0b17c5f0da451036de23bbcee
- TLSH T149F05066674D097B449CC50DA9CD1257BD940BD726842DFEA1CCA0452F4C282D9E6456
- MD5 SHA1 SHA512 TLSH
ValSkinChanger/config.json
- SHA256 053dde331788a91ef3a598a0c0da53b1aec30ad63027d07e3a2c19c89de66139
- MD5 5c5ae3cadff3dcbdc7081c162a3886c8
- SHA1 055b77e74f9440d561d97ea67be7e588c5728cf9
- SHA512 d5d929cdc3a0b42120993b09accfb4b09c52615d9de36b3d95c7fa23c388961937eed653751f6e06cd8d3ab0c4151a2f1133528353ced7e0f68d02d05a35a80c
- TLSH T138F0CFA2D42C25FD25BD866CCE1DC62213809F126A304E93F6BF211C75A0132714BBB0
- MD5 SHA1 SHA512 TLSH
ValSkinChanger/hookloader.exe
- IMPHASH 085deee82875fe85e38462e30bb8a21c
- SHA256 6997cf18bf8dda65c214f63241f62711cac6f7ab6e8da771af0ff095d388683f
- MD5 3a22d97cf09045b3e7302df9f018aea1
- SHA1 2195183f0664e6b6c2a0c047a4e1665bca0366c6
- SHA512 921106af0203363446deda9d2b0853904521540ce9b54b66e00eadc0f02ece2defb5b2a556dff3ce5535b77d8013008a94d9d37dfbc1ae6241c9a64c21a61277
- SSDEEP 768:Oz4mzUBDz/uCdUA3weRr/eYNYfK/c33+B:cqmIeYN9ce
- TLSH T12C033A67A79904E8F0A6D27C9AE75A09D3B2BC060763EBCF1341924B0F672C5297FD50
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
20480
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\user\Desktop\hookloader\output\hookloader.pdb
dbghelp
ImageDirectoryEntryToData
kernel32
FormatMessageA
LocalFree
SetConsoleTextAttribute
SetConsoleScreenBufferSize
GetStdHandle
SetConsoleMode
SetConsoleWindowInfo
GetConsoleScreenBufferInfoEx
GetModuleHandleA
GetConsoleMode
SetConsoleScreenBufferInfoEx
LoadLibraryA
GetProcAddress
SetConsoleCP
FreeLibrary
GetConsoleWindow
SetConsoleOutputCP
SetConsoleTitleW
LoadLibraryExW
GetLastError
GetLocaleInfoEx
FindClose
FindFirstFileW
GetModuleHandleW
GetFileInformationByHandleEx
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
AreFileApisANSI
CreateFile2
CloseHandle
GetFileAttributesExW
user32
GetWindowLongPtrW
SendMessageW
SetWindowLongPtrW
SetWindowPos
ShowScrollBar
GetWindowThreadProcessId
FindWindowW
msvcp140
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
memset
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memcpy
memmove
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argc
system
_register_onexit_function
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
terminate
_exit
_initialize_onexit_table
abort
__p___argv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-string-l1-1-0
strlen
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35721,
count=10, id=260, version=35721,
count=27, id=261, version=35721,
count=6, id=257, version=35721,
count=7, id=257, version=33145,
count=155, id=1, productName=Unmarked objects,
count=1, id=265, version=36256,
count=1, id=255, version=36256,
count=1, id=258, version=36256,
ValSkinChanger/krx legit v4.dll
- IMPHASH 2c40c78a629c6cf861e94167b6283a8f
- SHA256 99b39b2130e9405cc4c8cf33e974b01eb8476ec16c30fbabd5a1c5fba189d200
- MD5 a77357e81e1b500c1e035f641c69a952
- SHA1 266adc06488da9eea25e92dc3486c84633ccf096
- SHA512 7bb65a8474ce762989932d32e8976148c9679a858cbd11956f978a877c2f84b14fdc08959887e1e41b2c54cac703ff9a39f7c89b146f0beae9a6d6b1faf28390
- SSDEEP 6144:D4c0lva4BPO5rrmw89MLnB9DrWE+I1ntuL3KGUD8BdodbtLwVouJxMeDFdzbcmIF:D4Tlva4BPOlmj1A0exQNcmCvyyP
- TLSH T115847C1DEAA602ACF1B6E5B9CE775442FA31B84D076054DB17E048991F6EBC0773BB02
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
bf:0a:e6:d3:bc:84:f3:f3:40:bd:ae:a6:2e:f8:07:1e:c4:20:72:12:da:71:02:33:08:8b:50:19:dc:78:0e:9e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN
Chains
Aug 20, 2026
CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN
Subject
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Serial Number
47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN
Serial Number
36:ea:f6:1d:c3:95:f6:30:41:f4:24:7d:ae:76:ab:7e
Issuer
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 9, 2016 - Aug 12, 2018
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
12416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\SLAXY\Desktop\legit\legit\hmm Nice\x64\Release\Internal MAGIC BULLET.pdb
kernel32
DisableThreadLibraryCalls
Beep
DeleteCriticalSection
VirtualAlloc
VirtualQuery
SetConsoleTitleA
GetFileAttributesA
WideCharToMultiByte
GetLastError
FormatMessageA
IsProcessorFeaturePresent
ord1464
ord1531
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ord1099
Sleep
InitializeCriticalSectionEx
AllocConsole
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
CloseHandle
GetFileInformationByHandleEx
MultiByteToWideChar
ord944
LocalFree
user32
CallNextHookEx
GetCursorPos
GetAsyncKeyState
MessageBoxA
GetKeyNameTextA
GetSystemMetrics
MapVirtualKeyW
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??7ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?narrow@?$ctype@_W@std@@QEBAPEB_WPEB_W0DPEAD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?uncaught_exceptions@std@@YAHXZ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?good@ios_base@std@@QEBA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xbad_alloc@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Thrd_detach
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
_CxxThrowException
__std_type_info_destroy_list
__std_exception_destroy
__current_exception_context
__std_exception_copy
__current_exception
__C_specific_handler
memmove
memset
memcpy
memcmp
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-runtime-l1-1-0
_errno
_invoke_watson
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_beginthreadex
_initterm
abort
_cexit
_initterm_e
terminate
api-ms-win-crt-stdio-l1-1-0
fgetc
__stdio_common_vfprintf
fread
__stdio_common_vsprintf_s
fwrite
fgetpos
__acrt_iob_func
setvbuf
fflush
__stdio_common_vswprintf_s
fputc
freopen
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
fclose
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-string-l1-1-0
toupper
tolower
isdigit
api-ms-win-crt-convert-l1-1-0
strtof
strtod
strtol
mbstowcs
api-ms-win-crt-math-l1-1-0
sin
atan2
acos
sinf
ceilf
fmax
cos
cosf
fmin
fmod
fmodf
powf
sqrt
atan
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
sfsqofsjqjfsqdnsqnfdsqoif
Name
.text
Size
293KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=6, id=260, version=35207,
count=30, id=261, version=35207,
count=6, id=257, version=35207,
count=9, id=257, version=33145,
count=302, id=1, productName=Unmarked objects,
count=4, id=265, version=35228,
count=1, id=259, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,