3ntr_Perm.zip
- SHA256 99bb19f1cc82576df3c8b1cb223c731a67da0b733e6ff36e2ebd59ef1b88e709
Overview
overview
10Static
static
93ntr_Perm/...er.exe
windows10-2004-x64
83ntr_Perm/...er.exe
windows11-ltsc_2024-x64
83ntr_Perm/...er.exe
windows10-2004-x64
103ntr_Perm/...er.exe
windows11-ltsc_2024-x64
103ntr_Perm/...er.exe
windows10-2004-x64
13ntr_Perm/...er.exe
windows11-ltsc_2024-x64
83ntr_Perm/...10.exe
windows10-2004-x64
13ntr_Perm/...10.exe
windows11-ltsc_2024-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
3ntr_Perm/#2cleaner.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral2
Sample
3ntr_Perm/#2cleaner.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
900 seconds
Behavioral task
behavioral3
Sample
3ntr_Perm/Perm Spoofer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral4
Sample
3ntr_Perm/Perm Spoofer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
900 seconds
Behavioral task
behavioral5
Sample
3ntr_Perm/perm spoofer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
3ntr_Perm/perm spoofer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral7
Sample
3ntr_Perm/perm spoofer_v10.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
3ntr_Perm/perm spoofer_v10.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target 3ntr_Perm.zip
- Size 17.9MB
- Sample260913-sd7ztsycjf
- SHA256 99bb19f1cc82576df3c8b1cb223c731a67da0b733e6ff36e2ebd59ef1b88e709
- MD5 aac40d53ff3da64beb3b80e58ac4da53
- SHA1 38842e6f99533ab0a40ee881f1c93b7941349da5
- SHA512 81d7317b9856d91ea800f97fba2c1dd9cfdd3b5003a63fa12673c78c6769044642a3a0e859a9ac8a405b4edcdfb31d6501d1858e2d65541a3adf06129356b308
- SSDEEP 393216:QXosSXUVLI6s8XriMmQFGawZjuOA8X2GawZjuOA8X29:QYZXU+6j3mQFGawC8XNawC8X4
- TLSH T1F11733D0C0923EA8EF9BD0E50FE567675E18BC92F35954A647B393CBA249C529FD0320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/3ntr_Perm/Perm Spoofer.exe Nirsoft static1/unpack001/3ntr_Perm/perm spoofer.exe Nirsoft static1/unpack001/3ntr_Perm/perm spoofer_v10.exe Nirsoft - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/3ntr_Perm/#2cleaner.exe unpack001/3ntr_Perm/Perm Spoofer.exe unpack001/3ntr_Perm/perm spoofer.exe unpack001/3ntr_Perm/perm spoofer_v10.exe
File Explorer
-
3ntr_Perm.zip.zip 17.9MB
-
3ntr_Perm/#2cleaner.exe.exe 5.8MB
-
3ntr_Perm/Perm Spoofer.exe.exe 7.1MB
-
3ntr_Perm/perm spoofer.exe.exe 7.0MB
-
3ntr_Perm/perm spoofer_v10.exe.exe 7.0MB
3ntr_Perm/#2cleaner.exe
- IMPHASH 5b95a705aa8ddbe9f017d2e82953162b
- SHA256 6b4a52f825acb200d074d0d4d464952f505ef215b9d1741424c3bb9dfea748ea
- MD5 c0a59b27d3d53bf48fdfde5427ac0055
- SHA1 030ddf0d4538cc7c46def291de2d500febddcce3
- SHA512 6d3a4d4227a102df4f25c2fa823608aebda5d7d0e1b6be49a7579fa9d29ac0c256bfbad09a084fceb8ddc90b95a87301c08835fdf3ebf9e0ee4a46f78ac2b486
- SSDEEP 98304:0Bqbsoulraw/oMXa7Mhq+0EclbMzRRIh3JIDnkhjXev18ijoQaqGJ:2FjXa7Mkoc6IT8kh3QmJ
- TLSH T12B5633C694032DF0DF9A1479BCB19536D794BD272718C387A553BBC82E6A6E8AF30701
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
52944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shell32
SHGetFolderPathW
SHFileOperationW
CommandLineToArgvW
kernel32
SetUnhandledExceptionFilter
InitializeSListHead
CreateDirectoryW
SizeofResource
SetConsoleCtrlHandler
AddDllDirectory
GetCommandLineW
GetStdHandle
WriteFile
GetShortPathNameW
TerminateProcess
GetModuleFileNameW
SetEnvironmentVariableW
K32GetModuleFileNameExW
GetEnvironmentVariableW
GetTempPathW
FindResourceA
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetModuleHandleA
OpenProcess
Sleep
GetLastError
LockResource
GetCurrentThreadId
CloseHandle
LoadResource
GetProcAddress
GetCurrentProcessId
CreateProcessW
GetSystemTimeAsFileTime
FormatMessageA
LoadLibraryExW
GetExitCodeProcess
QueryPerformanceCounter
GetModuleHandleW
vcruntime140
wcschr
__C_specific_handler
__current_exception
__current_exception_context
memmove
memset
memcpy
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_set_app_type
_errno
exit
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
_exit
_configure_wide_argv
__p___argc
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
__p___wargv
abort
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
api-ms-win-crt-convert-l1-1-0
wcstoul
mbstowcs
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
puts
__stdio_common_vswprintf
_set_fmode
__stdio_common_vfprintf
__stdio_common_vsprintf
api-ms-win-crt-string-l1-1-0
wcslen
iswctype
_wcsicmp
_wcsdup
wcscmp
wcsncmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5.8MB
Virtual Size
5.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35721,
count=2, id=253, version=35721,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=19, id=261, version=35721,
count=5, id=257, version=33145,
count=108, id=1, productName=Unmarked objects,
count=1, id=264, version=36243,
count=1, id=258, version=36243,
3ntr_Perm/Perm Spoofer.exe
- IMPHASH 8c16c795b57934183422be5f6df7d891
- SHA256 edb665b5abbcba04ead33e62a5cdf9775f676741aebf212428ad7b51a157eafd
- MD5 20abdd54c5388ca67f816b289ae0fa61
- SHA1 cb4a6c01b02e1cfd5b12b5ebca0520391f0f5cc2
- SHA512 5982c781dbd1d2c7c26436b2c6be8af24cc4f663d56bf4f55cf40ae685bc1c7985eaf309ce2d3fe9a873c61e48e91879626403087a9827f765ab8417aabc68a1
- SSDEEP 98304:IqHWgKEAk1fi0KmIY0/K5tAdLKSpQ79nBxS:IqHhAk1f/FI//E4WSpQ79nBxS
- TLSH T1E776AD16B3A0C0B9C4668538C9A6C7F6E771BC14972097CB22E47E5B7F336D06A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10508
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
EVENT_SINK_GetIDsOfNames
ord690
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaLenBstr
__vbaLateIdCall
__vbaPut3
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord519
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
ord661
__vbaHresultCheckObj
__vbaNameFile
_adj_fdiv_m32
Zombie_GetTypeInfo
__vbaAryDestruct
ord669
ord593
__vbaExitProc
ord594
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaFpR4
ord705
__vbaStrFixstr
_CIsin
ord631
ord709
ord525
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaGet3
__vbaStrCmp
ord529
__vbaGet4
__vbaPutOwner3
__vbaAryConstruct2
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord714
ord609
__vbaFPException
ord319
__vbaGetOwner3
__vbaUbound
ord535
__vbaFileSeek
ord537
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
ord570
__vbaNew2
__vbaInStr
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
ord689
__vbaAryLock
__vbaVarAdd
ord611
ord320
__vbaVarDup
__vbaStrToAnsi
ord321
__vbaFpI2
__vbaFpI4
ord616
__vbaLateMemCallLd
_CIatan
__vbaStrMove
ord618
__vbaCastObj
__vbaR8IntI4
ord650
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
ord580
ord581
Name
.text
Size
104KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=14, version=7299,
count=8, id=9, version=8041,
count=1, id=13, version=8169,
3ntr_Perm/perm spoofer.exe
- IMPHASH efad9623ce6a458beb1e9f07d58b35d1
- SHA256 d942aadbefdfc52006302bd893666ba0ec83cdc1e0cbd3e7989f659b9e1da3b3
- MD5 4f40c7ebb4914f9bce64ef75da7dfe44
- SHA1 d8a116160944f06aa025e770b1653faa6ca86911
- SHA512 5bd5867d59d73ec12e2cc2a2fba4f6ab4ece70f7b33b54570485888114c29b000a5f7e1f85695843bce262cfb67504684899a77b507f15fbf01a7573a9cc6692
- SSDEEP 98304:JqHWgKEAk1fi0KmIY0/K5tAdLKSpQ79nBx:JqHhAk1f/FI//E4WSpQ79nBx
- TLSH T16776AD56B3A4C0B9C4668538C9A6C7F6E771BC04972097CB22E47E5B7F336D02A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1364940
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\3ntr\Downloads\prv1\x64\Release\Perm Spoofer.pdb
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
CreatePipe
CreateProcessA
GetFileAttributesW
WaitForSingleObject
CreateProcessW
SetLastError
CreateDirectoryA
GetFileSizeEx
CreateFileMappingA
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
GetFileAttributesExW
CreateFileA
GetFileInformationByHandleEx
GetComputerNameA
IsDebuggerPresent
OpenThread
Module32NextW
GetCurrentProcessId
VirtualProtectEx
Module32FirstW
LocalFree
MapViewOfFile
CreateFileMappingW
QueryFullProcessImageNameW
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
HeapAlloc
CreateThread
CloseHandle
HeapReAlloc
GetLastError
Sleep
HeapSize
GetLocaleInfoEx
LoadLibraryW
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
Process32FirstW
Process32NextW
WriteProcessMemory
CreateToolhelp32Snapshot
OpenProcess
ResumeThread
SuspendThread
GetEnvironmentVariableA
Thread32First
Thread32Next
FreeLibrary
QueryPerformanceCounter
GetModuleFileNameA
VirtualProtect
HeapFree
GetCurrentProcess
GetModuleFileNameW
InitializeCriticalSectionEx
CreateFileW
UnmapViewOfFile
OutputDebugStringW
ReadFile
TerminateProcess
AreFileApisANSI
user32
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
GetKeyState
MessageBoxA
UnregisterClassW
EnumWindows
LoadCursorW
GetSystemMetrics
GetWindowThreadProcessId
ShowWindow
FindWindowExW
SetCursor
MoveWindow
GetWindowRect
UpdateWindow
PostQuitMessage
TranslateMessage
SetCapture
GetWindowTextA
GetClientRect
IsWindowUnicode
ReleaseCapture
SetLayeredWindowAttributes
PeekMessageW
SetWindowLongA
DispatchMessageW
RegisterClassExW
CreateWindowExW
DestroyWindow
DefWindowProcW
GetWindowLongW
SetCursorPos
GetCursorPos
OpenClipboard
MessageBoxW
CloseClipboard
EmptyClipboard
GetClipboardData
GetClassNameA
SetClipboardData
advapi32
CryptCreateHash
AddAccessAllowedAce
GetLengthSid
SetSecurityInfo
InitializeAcl
OpenProcessToken
IsValidSid
ConvertSidToStringSidW
CopySid
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
GetTokenInformation
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
shell32
ShellExecuteW
ShellExecuteA
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
_Query_perf_frequency
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Query_perf_counter
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Random_device@std@@YAIXZ
_Thrd_detach
??Bios_base@std@@QEBA_NXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Syserror_map@std@@YAPEBDH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xbad_alloc@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
imm32
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord33
ord35
ord30
ord27
ord200
ord211
ord26
ord301
ord46
ord22
ord217
ord41
ord143
ord79
ord60
ord50
ord45
ord32
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertGetNameStringA
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindCertificateInStore
CertFindExtension
ws2_32
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
ntohl
WSAIoctl
gethostname
sendto
recvfrom
freeaddrinfo
WSAStartup
getaddrinfo
select
WSACleanup
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
shlwapi
PathFindFileNameW
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
winhttp
WinHttpOpenRequest
WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpOpen
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
wininet
InternetCloseHandle
InternetOpenW
InternetOpenUrlW
InternetReadFile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__intrinsic_setjmp
__current_exception_context
__current_exception
strchr
memcmp
memchr
memset
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
__C_specific_handler
wcsstr
strrchr
longjmp
memcpy
memmove
api-ms-win-crt-stdio-l1-1-0
fwrite
__stdio_common_vsscanf
ftell
_lseeki64
fflush
fread
feof
fputs
fopen
_open
_close
fputc
_pclose
fgetc
_set_fmode
fgets
_write
_read
__stdio_common_vsprintf
fgetpos
__p__commode
fclose
__acrt_iob_func
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
_popen
fseek
__stdio_common_vfprintf
setvbuf
_wfopen
api-ms-win-crt-runtime-l1-1-0
_c_exit
_invalid_parameter_noinfo
_beginthreadex
_errno
terminate
system
_exit
strerror
__sys_nerr
_initterm_e
abort
exit
_getpid
_configure_narrow_argv
_initterm
_get_narrow_winmain_command_line
_register_thread_local_exe_atexit_callback
_invoke_watson
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_resetstkoflw
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-string-l1-1-0
strncpy_s
isupper
tolower
strcmp
strpbrk
strcspn
strncmp
strspn
strncpy
_strdup
_wcsicmp
api-ms-win-crt-heap-l1-1-0
free
calloc
_set_new_mode
_callnewh
realloc
malloc
_recalloc
api-ms-win-crt-convert-l1-1-0
atoi
strtoll
strtod
strtoull
strtol
strtoul
api-ms-win-crt-math-l1-1-0
_dsign
sinf
powf
__setusermatherr
pow
fmodf
cosf
ceilf
acosf
_dclass
sqrtf
api-ms-win-crt-time-l1-1-0
strftime
_gmtime64
_time64
_localtime64
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_stat64
_unlock_file
_unlink
_access
_fstat64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
340KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5.2MB
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35207,
count=9, id=253, version=35207,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=40, id=261, version=35207,
count=105, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,
count=26, id=260, version=31107,
count=38, id=257, version=33145,
count=7, id=156, version=21202,
count=562, id=1, productName=Unmarked objects,
count=29, id=265, version=35222,
count=1, id=255, version=35222,
count=1, id=151,
count=1, id=258, version=35222,
3ntr_Perm/perm spoofer_v10.exe
- IMPHASH efad9623ce6a458beb1e9f07d58b35d1
- SHA256 d942aadbefdfc52006302bd893666ba0ec83cdc1e0cbd3e7989f659b9e1da3b3
- MD5 4f40c7ebb4914f9bce64ef75da7dfe44
- SHA1 d8a116160944f06aa025e770b1653faa6ca86911
- SHA512 5bd5867d59d73ec12e2cc2a2fba4f6ab4ece70f7b33b54570485888114c29b000a5f7e1f85695843bce262cfb67504684899a77b507f15fbf01a7573a9cc6692
- SSDEEP 98304:JqHWgKEAk1fi0KmIY0/K5tAdLKSpQ79nBx:JqHhAk1f/FI//E4WSpQ79nBx
- TLSH T16776AD56B3A4C0B9C4668538C9A6C7F6E771BC04972097CB22E47E5B7F336D02A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1364940
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\3ntr\Downloads\prv1\x64\Release\Perm Spoofer.pdb
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
CreatePipe
CreateProcessA
GetFileAttributesW
WaitForSingleObject
CreateProcessW
SetLastError
CreateDirectoryA
GetFileSizeEx
CreateFileMappingA
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
GetFileAttributesExW
CreateFileA
GetFileInformationByHandleEx
GetComputerNameA
IsDebuggerPresent
OpenThread
Module32NextW
GetCurrentProcessId
VirtualProtectEx
Module32FirstW
LocalFree
MapViewOfFile
CreateFileMappingW
QueryFullProcessImageNameW
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
HeapDestroy
HeapAlloc
CreateThread
CloseHandle
HeapReAlloc
GetLastError
Sleep
HeapSize
GetLocaleInfoEx
LoadLibraryW
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
Process32FirstW
Process32NextW
WriteProcessMemory
CreateToolhelp32Snapshot
OpenProcess
ResumeThread
SuspendThread
GetEnvironmentVariableA
Thread32First
Thread32Next
FreeLibrary
QueryPerformanceCounter
GetModuleFileNameA
VirtualProtect
HeapFree
GetCurrentProcess
GetModuleFileNameW
InitializeCriticalSectionEx
CreateFileW
UnmapViewOfFile
OutputDebugStringW
ReadFile
TerminateProcess
AreFileApisANSI
user32
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
GetKeyState
MessageBoxA
UnregisterClassW
EnumWindows
LoadCursorW
GetSystemMetrics
GetWindowThreadProcessId
ShowWindow
FindWindowExW
SetCursor
MoveWindow
GetWindowRect
UpdateWindow
PostQuitMessage
TranslateMessage
SetCapture
GetWindowTextA
GetClientRect
IsWindowUnicode
ReleaseCapture
SetLayeredWindowAttributes
PeekMessageW
SetWindowLongA
DispatchMessageW
RegisterClassExW
CreateWindowExW
DestroyWindow
DefWindowProcW
GetWindowLongW
SetCursorPos
GetCursorPos
OpenClipboard
MessageBoxW
CloseClipboard
EmptyClipboard
GetClipboardData
GetClassNameA
SetClipboardData
advapi32
CryptCreateHash
AddAccessAllowedAce
GetLengthSid
SetSecurityInfo
InitializeAcl
OpenProcessToken
IsValidSid
ConvertSidToStringSidW
CopySid
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
GetTokenInformation
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
shell32
ShellExecuteW
ShellExecuteA
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
_Query_perf_frequency
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Query_perf_counter
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Random_device@std@@YAIXZ
_Thrd_detach
??Bios_base@std@@QEBA_NXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Syserror_map@std@@YAPEBDH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xbad_alloc@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
imm32
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord33
ord35
ord30
ord27
ord200
ord211
ord26
ord301
ord46
ord22
ord217
ord41
ord143
ord79
ord60
ord50
ord45
ord32
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertGetNameStringA
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindCertificateInStore
CertFindExtension
ws2_32
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
ntohl
WSAIoctl
gethostname
sendto
recvfrom
freeaddrinfo
WSAStartup
getaddrinfo
select
WSACleanup
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
shlwapi
PathFindFileNameW
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
winhttp
WinHttpOpenRequest
WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpOpen
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
wininet
InternetCloseHandle
InternetOpenW
InternetOpenUrlW
InternetReadFile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__intrinsic_setjmp
__current_exception_context
__current_exception
strchr
memcmp
memchr
memset
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
__C_specific_handler
wcsstr
strrchr
longjmp
memcpy
memmove
api-ms-win-crt-stdio-l1-1-0
fwrite
__stdio_common_vsscanf
ftell
_lseeki64
fflush
fread
feof
fputs
fopen
_open
_close
fputc
_pclose
fgetc
_set_fmode
fgets
_write
_read
__stdio_common_vsprintf
fgetpos
__p__commode
fclose
__acrt_iob_func
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
_popen
fseek
__stdio_common_vfprintf
setvbuf
_wfopen
api-ms-win-crt-runtime-l1-1-0
_c_exit
_invalid_parameter_noinfo
_beginthreadex
_errno
terminate
system
_exit
strerror
__sys_nerr
_initterm_e
abort
exit
_getpid
_configure_narrow_argv
_initterm
_get_narrow_winmain_command_line
_register_thread_local_exe_atexit_callback
_invoke_watson
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_resetstkoflw
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-string-l1-1-0
strncpy_s
isupper
tolower
strcmp
strpbrk
strcspn
strncmp
strspn
strncpy
_strdup
_wcsicmp
api-ms-win-crt-heap-l1-1-0
free
calloc
_set_new_mode
_callnewh
realloc
malloc
_recalloc
api-ms-win-crt-convert-l1-1-0
atoi
strtoll
strtod
strtoull
strtol
strtoul
api-ms-win-crt-math-l1-1-0
_dsign
sinf
powf
__setusermatherr
pow
fmodf
cosf
ceilf
acosf
_dclass
sqrtf
api-ms-win-crt-time-l1-1-0
strftime
_gmtime64
_time64
_localtime64
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_stat64
_unlock_file
_unlink
_access
_fstat64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
340KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5.2MB
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35207,
count=9, id=253, version=35207,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=40, id=261, version=35207,
count=105, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,
count=26, id=260, version=31107,
count=38, id=257, version=33145,
count=7, id=156, version=21202,
count=562, id=1, productName=Unmarked objects,
count=29, id=265, version=35222,
count=1, id=255, version=35222,
count=1, id=151,
count=1, id=258, version=35222,