EMX-Window-Deck_0.4.2_CUSTOMER-PACKAGE.zip
- SHA256 28032466f9e9aa347ca62c3d39e650fb469acecdc79c08b82a16fd94cb75f1ed
Overview
overview
7Static
static
3SETUP-EMX-...CK.exe
windows10-2004-x64
7SETUP-EMX-...CK.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3emx-window-deck.exe
windows10-2004-x64
6emx-window-deck.exe
windows11-ltsc_2024-x64
6Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SETUP-EMX-WINDOW-DECK.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
SETUP-EMX-WINDOW-DECK.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
emx-window-deck.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral14
Sample
emx-window-deck.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target EMX-Window-Deck_0.4.2_CUSTOMER-PACKAGE.zip
- Size 5.8MB
- Sample260831-ppcraage37
- SHA256 28032466f9e9aa347ca62c3d39e650fb469acecdc79c08b82a16fd94cb75f1ed
- MD5 c9313e5e1d0f8c6ffeae9181d50507aa
- SHA1 7018588da719b422b068c792df5bc981f5110cc1
- SHA512 9e8afa66ddc6fa12b154c20cb93b64f9c4f7e21c1f2217c559a7d6b049f64f97613fc81caecde11318346f8f882035a5e2f7d92b003ff61c1f0a49586965f215
- SSDEEP 98304:rL7G0+rMd+UVDXTR29hlOf53mXb4O5OMqQZa033UmZiU6JUNxK/SgAzfc/sI+r2a:37ZV0ipShMf5WXb4pQN33jWUNx/L7c/i
- TLSH T19E563373209B885D65B6BF3AC43C5FA9943C789E490DD1F78204E0522758E8A3E6F1BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/SETUP-EMX-WINDOW-DECK.exe unpack002/$PLUGINSDIR/NSISdl.dll unpack002/$PLUGINSDIR/StartMenu.dll unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsDialogs.dll unpack002/$PLUGINSDIR/nsis_tauri_utils.dll unpack002/emx-window-deck.exe
File Explorer
-
EMX-Window-Deck_0.4.2_CUSTOMER-PACKAGE.zip.zip 5.8MB
-
EMX-WINDOW-DECK-WALKTHROUGH.mp41.6MB
-
LICENSE.md873B
-
PRIVACY.md1KB
-
README-FIRST.txt2KB
-
RELEASE-NOTES.md2KB
-
SETUP-EMX-WINDOW-DECK.exe.exe 4.2MB
-
$PLUGINSDIR/NSISdl.dll.dll 15KB
-
$PLUGINSDIR/StartMenu.dll.dll 7KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
$PLUGINSDIR/modern-header.bmp33KB
-
$PLUGINSDIR/modern-wizard.bmp201KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
$PLUGINSDIR/nsis_tauri_utils.dll.dll 33KB
-
emx-window-deck.exe.exe 13.8MB
EMX-WINDOW-DECK-WALKTHROUGH.mp4
- SHA256 bc6b8bd16e79629ed2e2ae72774d0e69448d92d599b49cf19605ffc5746f543e
- MD5 a9e0fb07ce778df33e797de4d731db3e
- SHA1 2ee710508504a320fde3d031af841dc0d78a31ad
- SHA512 09e86b43157cd9cc7a4d96e1db6b1f3c94a7a5fdd3e32834c9183aef107e825987eaaf8887e40e02f3eb1bf268f44ba446b47c163e4ce0a5bad9b865a8105988
- SSDEEP 49152:6IXpdZbOeoga0ELGdaEWjCBXbwBIM3dQ6T74ioxB1R:nfTa0IGdbWjGybT0ioX
- TLSH T1CD75332797F9068ECE74B73949F89B81B27CF06AB118C3E709CA501EA6947C45D877B0
- MD5 SHA1 SHA512 SSDEEP TLSH
LICENSE.md
- SHA256 600539b2db06a0422d60b6dc51c38ab7b6ce455008e8b741be9683f6f7736981
- MD5 0c46bef2c3e2ac2f535862713418839d
- SHA1 e5287d574098cd75c75564fead83d7d4e09cf8f8
- SHA512 1cd73352009aeba90a54eb28155c3ccd1877f86d5b36fa27a24f1b71c2a3bc503dc9c9aaa845461a0c5e286937b92f2a581ab03561c825313a7d7003df5af3b8
- TLSH T157112375F50506A9628123D5CB3FE9ABE21E81292E4E14F451CD810C117692867BCE39
- MD5 SHA1 SHA512 TLSH
PRIVACY.md
- SHA256 75282364369179c8832e763e7480f08248e92863a2420c4d407fe3162cb33761
- MD5 c2ac8a4d09c8a45cc945cd65f60c32a8
- SHA1 6aca3789b36b0b2428d2aad63fc8e46a30eba06d
- SHA512 7f440c50e44b605eb88b1c8d87383c9698110c8d996452bc919dcb58b9047b5173322cb393283c65384ae2b070a629d611bfe79fab227c295397c0c4d7f28980
- TLSH T12341549B661723760FD612B7AA4BD3E1DE1B505C266F05B034A4808C35509BDC32F3AE
- MD5 SHA1 SHA512 TLSH
README-FIRST.txt
- SHA256 7cc9d5bba929b96243b26827622e459d377830794a40d03cb3c0b44667a198ee
- MD5 cbbacbfc3102831fd194e46ceee69ef0
- SHA1 c2b20adffcce53f1f47a3c672576972f3fc4dc5a
- SHA512 b0536d17919f2bb960419f982367c1c4feeed5648bb59cba2015c9e9dc1ac9e425ee1a09846bee420eac08947b742fe61cc3f852826f87f15d10a01e53eacd1d
- TLSH T13E417243BE56C3322F72C503A64FB374FB1248AA124B4893A029814C13657B3E38FD99
- MD5 SHA1 SHA512 TLSH
RELEASE-NOTES.md
- SHA256 313c221e4c4c575d18982ea70a4129184e808e43e40eda37ca119bbf6e2681ae
- MD5 f887df7f6859532b38cea388118f8d99
- SHA1 2aef8596c753c91265a7ae907048a4d76f2e08bc
- SHA512 92fbe141ea62634ef7367148d1ca05de12d29bdc0ee8598a8935e5a89848a96687fb439a095bb0fcb0513cc2ff68cfc21d5d3d7757083df73b86d2199b6a2470
- TLSH T171416403A72993510EB30153664AE2A6CE15C43EA11F0993B0AE92CC73E55AE81FF998
- MD5 SHA1 SHA512 TLSH
SETUP-EMX-WINDOW-DECK.exe
- IMPHASH 46ce5c12b293febbeb513b196aa7f843
- SHA256 11fc29fba2e376a9e13f8bcfa30bac81b1de5f37b9de648c018144098512622a
- MD5 6b3aac9031b33bd4898bc0332de9b420
- SHA1 48946dcd46b2f04d41b773384f941e544aea12b9
- SHA512 6c64b626770d41e1dfe009649fc5487a6b1aa8fd98cc88bc2f7ff5b8373ff2b892ce4d8ca5431c10f0f4e6ae4e1572169f7a764951dc5bd4088a94c1b5f3aa5c
- SSDEEP 98304:cSRr34PH4wNqYKq/GYzFiCx8s6nI1XERoomnb4/iAKVIxW3:c0roPH4zq5zFdCI1XlPb4/cVIA
- TLSH T1F22633521053C83EF1B77E36C52EAF994438B89E4C0DA6F7C310E1A46A259537A2F1ED
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13983
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
kernel32
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
CreateProcessW
CreateDirectoryW
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
WriteFile
GetCurrentProcess
GetModuleFileNameW
GetLastError
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
ExitProcess
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
173KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/NSISdl.dll
- IMPHASH db80d5e142e716e818b7f4614dcade3c
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
- MD5 8eabbe36e8b52e69322780d0f541fd19
- SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
- SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
- SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
- TLSH T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9321
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
wsock32
WSAStartup
WSACleanup
send
WSAGetLastError
recv
select
__WSAFDIsSet
connect
shutdown
closesocket
socket
htons
inet_ntoa
ioctlsocket
gethostbyname
user32
CharPrevA
SetWindowLongW
RegisterWindowMessageW
CallWindowProcW
DestroyWindow
EnableWindow
SetDlgItemTextA
CreateWindowExW
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExW
SetWindowTextA
SendMessageW
wsprintfA
GetWindowLongW
kernel32
MultiByteToWideChar
WideCharToMultiByte
lstrcpynW
lstrcpyW
CreateFileW
WriteFile
Sleep
DeleteFileW
GetTickCount
MulDiv
GlobalFree
GlobalAlloc
lstrcatA
lstrlenA
lstrcpynA
WaitForSingleObject
CloseHandle
lstrcmpiA
lstrcpyA
CreateThread
download
download_quiet
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=14, version=7299,
count=59, id=1, productName=Unmarked objects,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=48, version=9044,
count=5, id=49, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/StartMenu.dll
- IMPHASH 646971a3aef724d6f553f40ae84fe26b
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
lstrcatW
FindClose
FindNextFileW
lstrcmpW
MulDiv
GlobalFree
lstrcpynW
GlobalAlloc
lstrcmpiW
FindFirstFileW
lstrcpyW
user32
TranslateMessage
GetMessageW
IsDialogMessageW
DispatchMessageW
CallWindowProcW
GetWindowLongW
CheckDlgButton
ShowWindow
LoadIconW
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextW
SendMessageW
IsDlgButtonChecked
GetWindowTextW
DestroyWindow
GetDlgItem
CreateDialogParamW
SetWindowLongW
wsprintfW
PostMessageW
gdi32
GetTextMetricsW
SelectObject
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ole32
CoTaskMemFree
Init
Select
Show
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=1, productName=Unmarked objects,
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/System.dll
- IMPHASH 509a34b3a68a773e0afb4259e68f9f82
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-header.bmp
- SHA256 61097deafbb403f2756482059e406f2cb55a1b8c8e11d687df44239c425eabbc
- MD5 9b9b8fb2bdc7a117e750c6f5a1fd7ae5
- SHA1 027acd4d1011f9be729519376ff9ecbd84587054
- SHA512 8976f2436f8c05edc2d4fe0a11e3ac6e7b4fa34b7148deb280f307931ae71701bd253aa6eed3b1f4f4ea33d993de409fae746eae44f230eafe97f59c3a5eab1d
- SSDEEP 192:y2N5qUWWun6WVuDw2+CG5yx/3BelZSI1nPi6af49taZ89m6tVm3uNw:x3WWunRVV5yfeltSf49taim6tVFe
- TLSH T1BDF2B6C8AD5B743D62813BF6B51D51B49F38FEC260E5A238973A3B45D735E041EAE081
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/modern-wizard.bmp
- SHA256 106af4c1c7134679f5d8779fc718966b61437c77d20ae2cd2814f4d211e47a1f
- MD5 8797ed0fcba20ade2808a862af0ae132
- SHA1 6517c34ac6c885851d9be735ed6909b6a25ae143
- SHA512 a961d381bdc970c8786ea1a2564a2fac1ecfbcf5ddfc0addedadc310022123ca37c65ec0060f9613a35d958617be9e6aef4281b0ae29b0657a1f4a3f7bef0ca1
- SSDEEP 3072:RZZZZZZZZZZZZZZZZZZZZZZZ/ZZZZZZZZZZZlZZZZZZZZZZZTZZZZZZZZZZZxZZK:OzOH9woEG4
- TLSH T1111431C96A4BD8A7BAB03CFA347C9219012ED68B5CC57804D5D3F549F73CE8D386AA11
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/nsDialogs.dll
- IMPHASH 3b477381217c97b22146297f93df2a92
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpyW
GetFileAttributesW
lstrcmpiW
MulDiv
lstrlenW
HeapFree
GetProcessHeap
GetCurrentDirectoryW
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
HeapAlloc
SetCurrentDirectoryW
user32
GetPropW
DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
RemovePropW
CharPrevW
GetWindowLongW
DrawTextW
GetWindowTextW
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
MapDialogRect
GetClientRect
CharNextW
SendMessageW
DrawFocusRect
gdi32
SetTextColor
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
638B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsis_tauri_utils.dll
- IMPHASH 2030931b38a854dde8cdd69245a8096a
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
nsis_tauri_utils.pdb
kernel32
GetCurrentProcess
GetLastError
GlobalFree
CloseHandle
TerminateProcess
ExitProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetCurrentProcessId
HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc
GlobalAlloc
lstrcpyW
advapi32
EqualSid
LookupPrivilegeValueW
CreateProcessWithTokenW
DuplicateTokenEx
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
user32
GetShellWindow
GetWindowThreadProcessId
shell32
ShellExecuteW
DllMain
FindProcess
FindProcessCurrentUser
KillProcess
KillProcessCurrentUser
RunAsUser
SemverCompare
StrReplace
memcmp
memcpy
memset
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=1, productName=Unmarked objects,
count=13, productName=Unmarked objects (old),
count=1, id=256, version=35222,
count=1, id=258, version=35222,
emx-window-deck.exe
- IMPHASH a1c177cac73a1d7717b0c8b46e476382
- SHA256 3d3cf286b4f7a8a5df72f4b77b73ffb52be280e4319061017016fcedf6503fb8
- MD5 c7ce321dd4da179ed485dfa1662da9bd
- SHA1 9278b46630355202e90dc2503fc0f5bb75a4d251
- SHA512 fd17af9204a482743af3b6102696a7ae66d84c742b31a36c45e8c56a7d95796db332aaaa33ccfe0dfe47c64dccedec0fb6559b7383981a041de2c8969b9b695d
- SSDEEP 98304:1p3LmAXcUPHzqHc5GKQTdsQlXlyN9ZlL8E7fUPiR0nsKHsTmipJBvUQUvDFC5+l7:1V6oXvWuQTaSUN9T8E7pmwfBvUQUQP6
- TLSH T143E607157A5B989CD05AC87483878A734A2130DF0B36B9BF44C842393FADBF45F29769
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9844016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
emx_window_deck.pdb
bcryptprimitives
ProcessPrng
user32
TrackPopupMenu
SetTimer
ChangeWindowMessageFilterEx
VkKeyScanW
RegisterRawInputDevices
SystemParametersInfoA
SetPropW
SendInput
GetUpdateRect
GetMenu
SetCapture
MsgWaitForMultipleObjectsEx
GetMenuItemInfoW
MonitorFromPoint
ClipCursor
ScreenToClient
GetClipCursor
ShowCursor
SetWindowLongW
EnableMenuItem
GetSystemMenu
CreateIcon
SetWindowTextW
SetWindowDisplayAffinity
ReleaseCapture
RemoveMenu
GetKeyboardLayout
ToUnicodeEx
MapVirtualKeyExW
GetKeyState
GetKeyboardState
GetRawInputData
CreateMenu
SetParent
CreatePopupMenu
DrawMenuBar
GetWindow
MapWindowPoints
SetFocus
EnableWindow
IsWindowEnabled
IsProcessDPIAware
GetParent
FindWindowExW
SetWindowRgn
GetWindowLongW
GetClientRect
SetMenuItemInfoW
RegisterHotKey
UnregisterHotKey
GetAsyncKeyState
GetActiveWindow
CloseTouchInputHandle
GetTouchInputInfo
TrackMouseEvent
CheckMenuItem
MapVirtualKeyW
DrawIconEx
ValidateRect
RegisterTouchWindow
InsertMenuW
AppendMenuW
DestroyAcceleratorTable
CreateAcceleratorTableW
SetMenu
PostQuitMessage
GetMenuBarInfo
OffsetRect
GetWindowDC
DrawTextW
DestroyMenu
PostThreadMessageW
PeekMessageW
ClientToScreen
GetCursorPos
MonitorFromWindow
KillTimer
MonitorFromRect
DefWindowProcW
DestroyIcon
GetMonitorInfoW
FillRect
DestroyWindow
PostMessageW
DispatchMessageW
GetMessageW
GetSystemMetrics
IsWindow
AdjustWindowRectEx
IsIconic
EnumChildWindows
DispatchMessageA
TranslateMessage
GetMessageA
SetWindowPos
RegisterClassW
SetWindowLongPtrW
CreateWindowExW
RegisterClassExW
IsZoomed
IsWindowVisible
GetClassNameW
GetWindowTextW
GetWindowTextLengthW
GetWindowLongPtrW
EnumWindows
EnumDisplayMonitors
SetForegroundWindow
BringWindowToTop
ReleaseDC
GetDC
GetIconInfo
RedrawWindow
UpdateWindow
InvalidateRect
SetCursorPos
FindWindowW
SendMessageW
AdjustWindowRect
TranslateAcceleratorW
FlashWindowEx
InvalidateRgn
GetWindowPlacement
SetWindowPlacement
ChangeDisplaySettingsExW
GetWindowRect
GetWindowThreadProcessId
GetForegroundWindow
SystemParametersInfoW
GetDpiForWindow
ShowWindow
RegisterWindowMessageA
SetCursor
LoadCursorW
ole32
RevokeDragDrop
RegisterDragDrop
OleInitialize
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WakeByAddressAll
WaitOnAddress
gdi32
DeleteObject
CreateRectRgn
SetBkMode
GetObjectW
CreateSolidBrush
SetTextColor
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
BitBlt
GetDeviceCaps
GetDIBits
CombineRgn
dwmapi
DwmSetWindowAttribute
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
DwmEnableBlurBehindWindow
DwmGetWindowAttribute
DwmRegisterThumbnail
comctl32
DefSubclassProc
RemoveWindowSubclass
TaskDialogIndirect
SetWindowSubclass
kernel32
HeapAlloc
WriteConsoleW
MultiByteToWideChar
OpenProcess
FormatMessageW
GetCurrentThreadId
SetEnvironmentVariableW
GetLastError
HeapFree
DeleteFileW
GetProcessHeap
DeviceIoControl
Sleep
GetModuleHandleA
GetModuleHandleW
GetUserDefaultUILanguage
LCIDToLocaleName
CreateSymbolicLinkW
GetFinalPathNameByHandleW
CreateMutexA
WaitForSingleObjectEx
WideCharToMultiByte
SwitchToThread
GetSystemInfo
ExitProcess
GetConsoleOutputCP
FindClose
FindFirstFileExW
QueryFullProcessImageNameW
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
FlsAlloc
lstrlenW
LoadLibraryA
FreeLibrary
GetProcAddress
GetCommandLineW
GetCurrentDirectoryW
LoadLibraryExA
LoadLibraryW
SetThreadStackGuarantee
CreateWaitableTimerExW
AddVectoredExceptionHandler
SetFilePointerEx
SetEvent
WaitForSingleObject
CreateEventW
SetWaitableTimer
CreateDirectoryW
GetStdHandle
GetEnvironmentStringsW
GetExitCodeProcess
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
GetFileInformationByHandleEx
CancelIo
GetSystemTimePreciseAsFileTime
RtlLookupFunctionEntry
WaitForMultipleObjects
GetTempPathW
FindNextFileW
RtlCaptureContext
DuplicateHandle
GetCurrentProcess
FlushFileBuffers
ReadFileEx
GetCurrentProcessId
CreateThread
QueryPerformanceCounter
QueryPerformanceFrequency
HeapReAlloc
SetFileTime
SetFileInformationByHandle
GetFullPathNameW
SetLastError
FlsGetValue
SleepEx
WriteFileEx
FreeEnvironmentStringsW
CompareStringOrdinal
GetEnvironmentVariableW
CloseHandle
K32EnumProcesses
FlsSetValue
RtlVirtualUnwind
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FlsFree
EncodePointer
GetSystemTimeAsFileTime
MoveFileExW
GetConsoleMode
GetFileInformationByHandle
GetFileAttributesW
CancelIoEx
GetCurrentThread
WriteFile
GetOverlappedResult
SetHandleInformation
ReadFile
SetFileCompletionNotificationModes
OutputDebugStringA
OutputDebugStringW
GetModuleFileNameW
LoadLibraryExW
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
CreateIoCompletionPort
RtlPcToFileHeader
RaiseException
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
CreateMutexW
CreateFileW
InitializeCriticalSectionEx
DeleteCriticalSection
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
RoGetActivationFactory
combase
CoCreateFreeThreadedMarshaler
CoIncrementMTAUsage
CoTaskMemFree
shlwapi
SHCreateMemStream
xinput1_4
XInputGetState
shell32
SHGetFileInfoW
ShellExecuteW
SHCreateItemFromParsingName
SHGetKnownFolderPath
DragQueryFileW
DragFinish
SHAppBarMessage
Shell_NotifyIconW
Shell_NotifyIconGetRect
oleaut32
SysFreeString
GetErrorInfo
SetErrorInfo
SysStringLen
advapi32
EventSetInformation
RegDeleteValueW
RegCloseKey
RegGetValueW
RegOpenKeyExW
EventWriteTransfer
EventUnregister
RegSetValueExW
EventRegister
RegQueryValueExW
SystemFunction036
ntdll
NtOpenFile
RtlGetVersion
NtReadFile
NtCreateFile
NtDeviceIoControlFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtWriteFile
NtCreateNamedPipeFile
crypt32
CertSetCertificateContextProperty
CertFreeCertificateChain
CertAddEncodedCertificateToStore
CertOpenStore
CertGetCertificateChain
CertCreateCertificateChainEngine
CertVerifyCertificateChainPolicy
CertFreeCertificateChainEngine
CertCloseStore
CertFreeCertificateContext
ws2_32
freeaddrinfo
WSACleanup
WSAStartup
getaddrinfo
getsockname
WSAGetLastError
WSAIoctl
setsockopt
getpeername
shutdown
closesocket
bind
WSASocketW
send
recv
getsockopt
connect
ioctlsocket
WSASend
bcrypt
BCryptGenRandom
api-ms-win-crt-math-l1-1-0
ceil
trunc
__setusermatherr
expf
pow
sinf
round
floorf
ceilf
roundf
floor
api-ms-win-crt-string-l1-1-0
strcpy_s
_wcsicmp
strlen
wcslen
wcscmp
api-ms-win-crt-convert-l1-1-0
_ultow_s
wcstol
_wtoi
api-ms-win-crt-runtime-l1-1-0
_set_app_type
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
_configure_narrow_argv
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
abort
_get_initial_narrow_environment
_exit
exit
_initterm_e
_initterm
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
_set_new_mode
free
calloc
Name
.text
Size
9.5MB
Virtual Size
9.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
450KB
Virtual Size
449KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=35721,
count=13, id=260, version=35721,
count=46, id=261, version=35721,
count=500, id=1, productName=Unmarked objects,
count=12, id=260, version=36248,
count=249, productName=Unmarked objects (old),
count=1, id=255, version=36248,
count=1, id=258, version=36248,