Aimware.zip
- SHA256 cfd5c5126f60374ca508a3ae471addd92788c2302ecb481283b21f41e6a4861d
Overview
overview
3Static
static
3Aimware/bi...ge.bin
windows10-2004-x64
3Aimware/bi...gs.bin
windows10-2004-x64
3Aimware/binfuser.dbg
windows10-2004-x64
3Aimware/capstone.dll
windows10-2004-x64
3Aimware/csgo-x86.dll
windows10-2004-x64
3Aimware/cs...ll.mem
windows10-2004-x64
3Aimware/csgo-x86.map
windows10-2004-x64
3Aimware/devldr
windows10-2004-x64
3Aimware/de...al.exe
windows10-2004-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Aimware/binfuser-image.bin
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral2
Sample
Aimware/binfuser-strings.bin
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral3
Sample
Aimware/binfuser.dbg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral4
Sample
Aimware/capstone.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
Aimware/csgo-x86.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
Aimware/csgo-x86.dll.mem
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral7
Sample
Aimware/csgo-x86.map
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral8
Sample
Aimware/devldr
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral9
Sample
Aimware/devldr_original.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
General
- Target Aimware.zip
- Size 5.8MB
- Sample260925-2v9dnaydmf
- SHA256 cfd5c5126f60374ca508a3ae471addd92788c2302ecb481283b21f41e6a4861d
- MD5 60d76598bb1b8b2d3c1a81e420854ef8
- SHA1 d021875c2bed5c914113a418c0aa08f8eb0ed10a
- SHA512 d7e2505e10e7666af57189ac54297cb5e0fa1a61a021ea78d9da4f02d01e537b29cd91944d2a681390347caac9d348f63aa1f5c1f53f34f2cc7d3b1a9c370933
- SSDEEP 98304:9QIlrZ5lK3lWdcjeBvodoBWj/zQAJ/4jL3r6411kGWjvtwAa0CS/PFhyKgtvnwXi:ycTl+ucjeBvoyMVJ/4jbrH12GWxw6Dhc
- TLSH T1BC5633591C3B7A5BE40D6AB46531359EF945BB20E37AB00C285B3FB10DE2ACCD587932
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Aimware/capstone.dll unpack001/Aimware/csgo-x86.dll unpack001/Aimware/devldr_original.exe
File Explorer
-
Aimware.zip.zip 5.8MB
-
Aimware/binfuser-image.bin2.9MB
-
Aimware/binfuser-strings.bin56KB
-
Aimware/binfuser.dbg2.5MB
-
Aimware/capstone.dll.dll 4.6MB
-
Aimware/csgo-x86.dll.dll 2.6MB
-
Aimware/csgo-x86.dll.mem536B
-
Aimware/csgo-x86.map1.6MB
-
Aimware/devldr1KB
-
Aimware/devldr_original.exe.exe 948KB
Aimware/binfuser-image.bin
- SHA256 4bbac73ef1843e236d20bdce85cbaf05c3497467f01aabe84ec9619bb90a49b2
- MD5 e55c477ca9b366d10dc7cfc5648fae40
- SHA1 38b1a0d43652a2b0346470a2f1d2f0528bd387c1
- SHA512 ae804fbe81200f9587a5a50b1ea7e8b1c90d6b36bd340db1ac2f32dc4ab842697bc1b4811e2daf9e3d5f5bdf3d7ae7642f37871e900c7f828bee2b2b66b4d7f8
- SSDEEP 49152:y+Y+VTSKdufQsSgGfgLPKo1VgPSXbt6k16TVY9EY5ftSi:yL+v4fSgGgT3kGtV6pY9EYttb
- TLSH T129E59D80F99750F2E9861571701FF73FDA79271988189EE7C6E03EB1F122611468B3AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Aimware/binfuser-strings.bin
- SHA256 b69736072661a9c9da5849533db15d534714f040299a939021fd331ca8622921
- MD5 44ec8435242cf6bf7691494726d87d32
- SHA1 b50258e92ba5de2f2fe5d11e6c4c1a44340e1bab
- SHA512 7fd95f9f4e4799a331cb5c7aaf36c2c22f3f6cb40c8ea0c05053f05672d681715e49f4a7cd681858bc2bb78e2c8c9f188c57fc4ffd50fc52895515680c295881
- SSDEEP 1536:HPMtc8SBLqk1/CfUzu3an9mNopwZr2PM+:Hic8SBLP1/jum9mNopDE+
- TLSH T15143AFE3335065A1D4E109FEA1D09A07BBB0A2F88766A150DCD9E2DD0099CF5173FA9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Aimware/binfuser.dbg
- SHA256 44b8ae604d4917aa7ded9bfc44d8c4aa2be2db3da010d7f762ceae414f33c3c2
- MD5 4fbf1a4992f6aef735639ac4a128a151
- SHA1 e0d2930fc67a7534c2b2a2dffaeb1bc7fa37573d
- SHA512 e614a0af7198d5d4a4ff8977659c716ea455351cf70a48e350a324f1eed83e5d86c617e24ed58814a4ff83969436848e89586b034f8c17ea3438223782206dc8
- SSDEEP 24576:ZiULuiHAiGghlfstlv27z+NyIoMRrI2ujMfSY7j/4CnaC6ENMzZzAN:Z9QUqN
- TLSH T130C567095B42CE6F4EF76AC7A6E98364A6DB146E7273348EA1DCFD4300C7525B1B620C
- MD5 SHA1 SHA512 SSDEEP TLSH
Aimware/capstone.dll
- IMPHASH 76017da816277ac5ba2782d1cd6369f2
- SHA256 7c9688e96fb4d5819bbc8705d51f1c89bf12331200416cebc136ed02c54f9ceb
- MD5 8b24f354f11bedef400a8fe39f5ba0c1
- SHA1 1285688172db1fdccadc87042f363b082115a890
- SHA512 594c1141fb3e379c2fc75ed9922c3d66b8156399689738551b720a5c513530dc104052c947b87c36bed09b05b57f0971f10159a80fa1a9492f86794da4159350
- SSDEEP 49152:4Scixz69kzBiY5+KkyTp4GfEzrZM9ZRtZphmg:4SgKkV4
- TLSH T1F326B441DE92DA31C87D0339467A0FBD7B358A2132946BFB63B4BC518E237E96D23611
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1189685
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
HeapReAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
DecodePointer
CloseHandle
CreateFileW
WriteConsoleW
cs_close
cs_disasm
cs_disasm_ex
cs_disasm_iter
cs_errno
cs_free
cs_group_name
cs_insn_group
cs_insn_name
cs_malloc
cs_op_count
cs_op_index
cs_open
cs_option
cs_reg_name
cs_reg_read
cs_reg_write
cs_regs_access
cs_strerror
cs_support
cs_version
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
179KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=26715,
count=138, id=261, version=26715,
count=18, id=260, version=26715,
count=30, id=261, version=28427,
count=15, id=260, version=28427,
count=21, id=259, version=28427,
count=3, id=257, version=26715,
count=80, id=1, productName=Unmarked objects,
count=56, id=260, productName=VS2019 v16.5.2 build 28612, version=28612,
count=1, id=256, productName=VS2019 v16.5.2 build 28612, version=28612,
count=1, id=258, productName=VS2019 v16.5.2 build 28612, version=28612,
Aimware/csgo-x86.dll
- IMPHASH f5220679cfc13dcb1660eab48fb2a133
- SHA256 958170fd316264dda536688ff8c282ff44a464a06118d7b6227de25e69c3a21d
- MD5 abcd5c92f0245565c4c5372d03fbbda2
- SHA1 023c68eaaad5cb8433554b5af4893bff70cc1ef5
- SHA512 0c2a030d9ba0187bab65906dca989690e6924293ce407acb8d01e040b65913f7d8f547f9f6ba29349e84ab7cf03160cf7dae9d79fbe7cf05e6a1e8ac18cde65a
- SSDEEP 49152:gjpY4E6zD0cxGl83cPb/UQGLQtLPW+S1kY1Ykbtr:gji4E6zYcIl88/eATW+SmY1YEt
- TLSH T1BAC59F41F59380F1FD4225B8305BBA3F962426088B28CDE3C7D42E57E5326E157BB69B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
197664
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_vsnprintf_s
_purecall
__libm_sse2_tanf
__libm_sse2_acosf
strtol
qsort
strrchr
strlen
__libm_sse2_pow
__p__fmode
_ftol2
ldexp
fmod
atan2
tanh
cosh
sinh
atan
acos
asin
tan
cos
sin
exp
log10
log
pow
fgets
__libm_sse2_log
strtoul
putchar
fwrite
fread
fopen
ferror
feof
fclose
fputs
fputc
fflush
strerror
__DestructExceptionObject
exit
_endthread
_beginthread
strchr
_wcsicmp
wcsrchr
realloc
tolower
sscanf
sprintf
malloc
free
__libm_sse2_logf
__libm_sse2_tan
_stricmp
strncpy
strstr
strncmp
__libm_sse2_expf
__libm_sse2_atanf
memchr
__libm_sse2_asinf
atof
ceil
_ftol2_sse
__libm_sse2_sin
atoi
_CIfmod
__libm_sse2_powf
memset
memmove
memcpy
__libm_sse2_sinf
__libm_sse2_cosf
kernel32
GlobalLock
GlobalUnlock
GlobalAlloc
IsBadReadPtr
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
RtlCaptureContext
CreateDirectoryW
QueryPerformanceCounter
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
GetModuleHandleExA
GlobalFree
CreateFileW
DeleteFileW
FindClose
GetCurrentProcessId
FindFirstFileW
FindNextFileW
GetFileSize
WriteFile
MoveFileW
RtlUnwind
SetLastError
GetLastError
GetTickCount64
Sleep
QueryPerformanceFrequency
FormatMessageA
ReadFile
CloseHandle
user32
GetCursorPos
SetWindowLongW
GetRawInputData
GetForegroundWindow
GetWindowLongW
ScreenToClient
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
GetWindowThreadProcessId
MessageBoxA
IsIconic
GetWindowTextW
GetClientRect
EnumWindows
CallWindowProcW
IsClipboardFormatAvailable
GetClassNameW
gdi32
SetTextColor
RemoveFontMemResourceEx
CreateCompatibleDC
CreateFontA
DeleteDC
DeleteObject
GetGlyphOutlineW
GetTextExtentPoint32W
GetFontUnicodeRanges
SelectObject
SetBkColor
SetMapMode
SetTextAlign
CreateDIBSection
ExtTextOutW
AddFontMemResourceEx
shell32
ShellExecuteW
ntdll
NtProtectVirtualMemory
NtFreeVirtualMemory
NtDelayExecution
NtQueryInformationProcess
NtQueryVirtualMemory
NtAllocateVirtualMemory
NtTerminateProcess
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.init
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.prot3
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.prot2
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.prot0
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.prot1
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
828KB
Virtual Size
827KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ldr
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=257, version=30795,
count=3, id=257, version=29304,
count=180, id=1, productName=Unmarked objects,
count=9, id=259, version=31937,
count=1, productName=Unmarked objects (old),
count=63, id=260, version=31937,
count=477, id=261, version=31937,
count=1, id=258, version=31937,
Aimware/csgo-x86.dll.mem
- SHA256 bb9426b1cc7bcfcbb7e92f4296a398e88f54c4b10c05860d3c86b1f73dc41b4a
- MD5 de419fcbfd92836e3858e245d457efb8
- SHA1 79b6dd2184ad38ea9f03d5c579ec8961d817cc73
- SHA512 13a964bd1c3c0c6767abf33ba96d861d20105c8c21d54d45f76c2c93483d05e3845888684eb8cff850f12b9f839e5da638e392a5c431df884e07878eab1d227c
- TLSH T1F8F00404441751C0D010043514351D5745D050000757C077D005CC554DD330045451C1
- MD5 SHA1 SHA512 TLSH
Aimware/csgo-x86.map
- SHA256 10847d4ca9003d13cfd51c72d89ba1c52d45a76a27e90212fadb268e16106aa9
- MD5 8689480c0e8c18594fbfff2318c4591e
- SHA1 580d5901df1fd3152f91eabaf840d069cd5e481a
- SHA512 6b2a60263d2d5092fedd4e5d963f94e3260f4a3b9da26fc6f130dabfe6d069358236c6e6959a42e21f793136e495943f438f28fdb50be94922f1a42488eece7c
- SSDEEP 12288:IC41Z3eIYm8zYIg4q771Dre340mOt24KjL1+qb8rW9D+8CHAzSmlRqOKgGn/V0tE:9B8HsAXeh
- TLSH T168750E35155ED0D7C4B7E682AFA56B10315CF483E273746A76ECE38207852AAE68730F
- MD5 SHA1 SHA512 SSDEEP TLSH
Aimware/devldr
- SHA256 0ded06323746283adf6f2180e0b43b84f0ed0f11d5476b281596146f95aff795
- MD5 513c6477eff08b65d5091eabd614d73e
- SHA1 38275316591dbbfc6bbff0b14b36bf124b892424
- SHA512 4b6228bc28f6dd41ae2f4db7c119daa9fc5cb70d92f92485a99f93f31e1e350fa100e79b293d2529f1d7f800642f3505efc4a301a8c7ae77a81ef9d3fdf67d7e
- TLSH T10D2198939ACACEDD40AA9D2973049D2D281815C5148ED31F245E657DA91F9228C9C0FE
- MD5 SHA1 SHA512 TLSH
Aimware/devldr_original.exe
- IMPHASH 5047801ed1877e0cd5cb9c2ecec3de36
- SHA256 52e798a8040650a15e1fddd293a8091930cdab85550da07273198de890f56b0a
- MD5 85b8270ea892901994a35719afe40e04
- SHA1 53273b885d907c7a8dd962686a29bad5e59421b8
- SHA512 91219267cd37e222880fee45d89b137e19ff0042156bf7ce3cba247585a113cfcdf8e848015eca7b3fe15942bc7b3d4e7cb02b4b089e75c430dfb84cc14768fa
- SSDEEP 24576:CdZjSZHElaTW2tcigdXqSNLmTLeDQYEd2AcsQ:gBHj76E6vekYns
- TLSH T1C025BF01F643A0F2FA87357820BBBE3F9725A51457265ED3C3D02D57E5123F12A7A0AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27248
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memchr
atoi
_wcslwr
__libm_sse2_sinf
atof
_CIfmod
_stricmp
strstr
strrchr
sscanf
_wcsnicmp
free
malloc
realloc
strtoul
_vsnprintf_s
_strlwr
ceil
memmove
system
strchr
_purecall
memcpy
wcsrchr
memset
kernel32
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
LeaveCriticalSection
EnterCriticalSection
RtlCaptureContext
GetCurrentDirectoryA
CreateFileW
GetVolumeInformationW
CloseHandle
GetLastError
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MoveFileW
GetCommandLineA
ExitProcess
GetProcAddress
GetModuleFileNameA
GetFileSize
ReadFile
Sleep
CreateDirectoryW
DeleteFileW
GetProcessTimes
OpenProcess
HeapAlloc
HeapFree
GetProcessHeap
Wow64EnableWow64FsRedirection
ContinueDebugEvent
DebugActiveProcess
DebugActiveProcessStop
WaitForDebugEventEx
CreateThread
OpenThread
GetThreadContext
GetSystemTimePreciseAsFileTime
ReadProcessMemory
DebugSetProcessKillOnExit
FindClose
FindFirstFileA
FindNextFileA
GetModuleHandleW
GetCurrentProcessId
QueryPerformanceCounter
QueryPerformanceFrequency
FindFirstFileW
FindNextFileW
GetFileTime
GetCurrentDirectoryW
WriteFile
user32
UpdateWindow
AdjustWindowRectEx
GetWindowLongA
SetWindowLongA
LoadCursorW
DefWindowProcW
GetClientRect
MessageBoxA
ScreenToClient
PtInRect
CallWindowProcW
GetForegroundWindow
GetCursorPos
GetWindowLongW
SetWindowLongW
SetCapture
ShowWindow
DestroyWindow
GetDesktopWindow
GetWindowRect
PeekMessageW
DispatchMessageW
TranslateMessage
SetProcessDPIAware
CreateWindowExW
GetWindowThreadProcessId
SendMessageTimeoutW
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
IsIconic
GetRawInputData
RegisterClassExW
GetClassNameW
EnumWindows
GetWindowTextW
SetWindowPos
gdi32
AddFontMemResourceEx
CreateCompatibleDC
CreateFontA
DeleteDC
DeleteObject
GetGlyphOutlineW
GetTextExtentPoint32W
RemoveFontMemResourceEx
GetFontUnicodeRanges
SelectObject
SetBkColor
SetMapMode
SetTextColor
SetTextAlign
CreateDIBSection
ExtTextOutW
shell32
ShellExecuteW
ntdll
NtQueryVirtualMemory
NtAllocateVirtualMemory
NtQueryInformationThread
RtlAdjustPrivilege
NtDelayExecution
NtFreeVirtualMemory
NtQueryInformationProcess
NtClose
NtQuerySystemInformation
RtlFreeHeap
RtlAllocateHeap
NtCreateFile
NtOpenProcess
NtTerminateProcess
psapi
GetModuleFileNameExA
capstone
cs_malloc
cs_open
cs_close
cs_option
cs_free
cs_disasm_iter
d3d9
Direct3DCreate9Ex
dwmapi
DwmExtendFrameIntoClientArea
DwmSetWindowAttribute
Name
.text
Size
466KB
Virtual Size
465KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.init
Size
1024B
Virtual Size
522B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
288KB
Virtual Size
287KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
173KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=221, productName=VS2013 UPD5 build 40629, version=40629,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=257, version=30795,
count=3, id=257, version=29304,
count=198, id=1, productName=Unmarked objects,
count=8, id=259, version=31937,
count=203, id=261, version=31937,
count=1, id=255, version=31937,
count=1, id=151,
count=1, id=258, version=31937,