16de2b5aed2f0b5cca6477fb8842ffaa33549ed6b30f6f00072b9d77ffc65b74
- SHA256 16de2b5aed2f0b5cca6477fb8842ffaa33549ed6b30f6f00072b9d77ffc65b74
Overview
overview
3Static
static
3v0_base_PinTo.exe
windows10-2004-x64
1v0_base_PinTo.exe
windows11-ltsc_2024-x64
1v1_noband_PinTo.exe
windows10-2004-x64
1v1_noband_PinTo.exe
windows11-ltsc_2024-x64
1v2_noinject_PinTo.exe
windows10-2004-x64
1v2_noinject_PinTo.exe
windows11-ltsc_2024-x64
1v3_nokill_PinTo.exe
windows10-2004-x64
1v3_nokill_PinTo.exe
windows11-ltsc_2024-x64
1v4_nospawn_PinTo.exe
windows10-2004-x64
1v4_nospawn_PinTo.exe
windows11-ltsc_2024-x64
1v5_noimm_PinTo.exe
windows10-2004-x64
1v5_noimm_PinTo.exe
windows11-ltsc_2024-x64
1v6_lowset_PinTo.exe
windows10-2004-x64
1v6_lowset_PinTo.exe
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
v0_base_PinTo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
v0_base_PinTo.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
v1_noband_PinTo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
v1_noband_PinTo.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
v2_noinject_PinTo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
v2_noinject_PinTo.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
v3_nokill_PinTo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
v3_nokill_PinTo.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
v4_nospawn_PinTo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
v4_nospawn_PinTo.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
v5_noimm_PinTo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
v5_noimm_PinTo.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
v6_lowset_PinTo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
v6_lowset_PinTo.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 16de2b5aed2f0b5cca6477fb8842ffaa33549ed6b30f6f00072b9d77ffc65b74
- Size 290KB
- Sample261001-mn9craxaje
- SHA256 16de2b5aed2f0b5cca6477fb8842ffaa33549ed6b30f6f00072b9d77ffc65b74
- MD5 84fc7dc59cde78a2b3b09c12d1c37f91
- SHA1 9e7560653231a2f97bc5003c0edb97cfee7b5308
- SHA512 512fb384bdc6195df9215ee85b7e449c15f40c2a67c22ac461f7d07b40e44692b911fc17eac198d10b35360629fd73f6fe00509ad3493cf8b4c66c090ac150d9
- SSDEEP 6144:hk3Sq1Nt1bCtbLHacWnil93EzC5+lCJV3cdNGsTpJpWXlVKt9EDy:Po71Y3acWnI93EO5+MJdCTTXgXlVKj7
- TLSH T18E54232067583B23D8F768144142670DFE8DE258E5ED0E47F6EC6C657689A3E3C21E8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/v0_base_PinTo.exe unpack001/v1_noband_PinTo.exe unpack001/v2_noinject_PinTo.exe unpack001/v3_nokill_PinTo.exe unpack001/v4_nospawn_PinTo.exe unpack001/v5_noimm_PinTo.exe unpack001/v6_lowset_PinTo.exe
File Explorer
-
16de2b5aed2f0b5cca6477fb8842ffaa33549ed6b30f6f00072b9d77ffc65b74.zip 290KB
-
v0_base_PinTo.exe.exe 117KB
-
v1_noband_PinTo.exe.exe 116KB
-
v2_noinject_PinTo.exe.exe 117KB
-
v3_nokill_PinTo.exe.exe 116KB
-
v4_nospawn_PinTo.exe.exe 117KB
-
v5_noimm_PinTo.exe.exe 115KB
-
v6_lowset_PinTo.exe.exe 114KB
v0_base_PinTo.exe
- IMPHASH fd3563a6a60a9b5ee372de99b7aa3fc6
- SHA256 03ef1fe6718173bfe65165783bef681229988e2c7ee3b53131db92cb68341c71
- MD5 fbfadf44aaf8d31429a3f2548f2c90c9
- SHA1 11c52d4924bee2e5379ee8c4c2da8acd17e821e2
- SHA512 fca92108e05abf5dfbfa5a55908b3e1f58437d4fd1c5c90516408f54478447a49d8e1f1fb0b05d234132c734f8c58cf201d413ec55b4ca0acdf5c0a1a338795b
- SSDEEP 1536:1h6rmUVRLYFkZReteb6NJP2NJLXBtY7R6OGa+iaqOiQWY/6OGa+iaqOiQWY/Dag:1h6rmENZHbe2NJ8N4eDag
- TLSH T1E3C384427BE529D8F4B2DA7498B1413177B3BCA02E30DB1D0694C52D2E37691FE74B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegDeleteTreeW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetKeySecurity
RegSetValueExW
SetEntriesInAclW
SetSecurityDescriptorDacl
kernel32
CloseHandle
CopyFileW
CreateFileW
CreateMutexW
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
GetCommandLineW
GetFileAttributesW
GetFileSize
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetSystemDirectoryW
GetTempPathW
GetTickCount
GetUserDefaultUILanguage
GetVolumeNameForVolumeMountPointW
GetWindowsDirectoryW
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalFree
MoveFileW
OpenMutexW
OpenProcess
QueryPerformanceCounter
ReadFile
ReleaseMutex
RemoveDirectoryW
SetErrorMode
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
msvcrt
__C_specific_handler
__iob_func
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_fmode
_initterm
_snwprintf_s
_wcmdln
_wcsicmp
_wfopen
_wtoi
atexit
abort
calloc
exit
fclose
fflush
fprintf
free
malloc
memcmp
memcpy
memmove
rand
setvbuf
signal
srand
strlen
strncmp
swprintf_s
towlower
vfprintf
wcscat_s
wcschr
wcscmp
wcscpy_s
wcslen
wcsncpy
wcsncpy_s
wcsrchr
wcsstr
wcstoul
ole32
CoCreateGuid
CoCreateInstance
CoInitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemFree
CoUninitialize
shell32
CommandLineToArgvW
ILCreateFromPathW
ILFree
SHBindToParent
SHChangeNotify
SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW
SHParseDisplayName
StrStrIW
shlwapi
PathAppendW
PathCombineW
PathRemoveExtensionW
PathRemoveFileSpecW
user32
CreatePopupMenu
DestroyMenu
DispatchMessageW
FindWindowExW
FindWindowW
GetMenuItemCount
GetMenuItemInfoW
GetMessageW
GetPropW
GetWindowLongPtrW
GetWindowThreadProcessId
IsWindow
MessageBoxW
PostMessageW
SendMessageTimeoutW
TranslateMessage
wsprintfW
Name
.text
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
v1_noband_PinTo.exe
- IMPHASH a74b94ea585d15a8dc548a8bb5ddf576
- SHA256 4c0b2eb39bb34542f5d1681554bd1dd060aaa6856a65408dc70d54d59a80b332
- MD5 2d8337c98b962eb093cda61cdeda53d7
- SHA1 25750afa6da742cb973f196776bb095e6e88f897
- SHA512 f3a0ebe920f98d12b2328c99dc310c4fbcc3a804b068305320f14e0df2220a36a477461113556b07082edf3173e2397dea08413abefcfd3f5d0969bcd1d3c1c0
- SSDEEP 1536:aITTxQzbEzJeimHHa2NJLXBjY+k444x+2KuSKa+SAGIc15+2KuSKa+SAGIc13DaX:aITTxQz2p2NJKkDaX
- TLSH T18FC3854277E529D8F4B2DB7499B14131B7B3BCA02A30DB1D0694C52D2E37690FE74B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegDeleteTreeW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetKeySecurity
RegSetValueExW
SetEntriesInAclW
SetSecurityDescriptorDacl
kernel32
CloseHandle
CopyFileW
CreateFileW
CreateMutexW
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
GetCommandLineW
GetFileAttributesW
GetFileSize
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetSystemDirectoryW
GetTempPathW
GetTickCount
GetUserDefaultUILanguage
GetVolumeNameForVolumeMountPointW
GetWindowsDirectoryW
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalFree
MoveFileW
OpenMutexW
OpenProcess
QueryPerformanceCounter
ReadFile
ReleaseMutex
RemoveDirectoryW
SetErrorMode
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
msvcrt
__C_specific_handler
__iob_func
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_fmode
_initterm
_snwprintf_s
_wcmdln
_wcsicmp
_wfopen
_wtoi
atexit
abort
calloc
exit
fclose
fflush
fprintf
free
malloc
memcmp
memcpy
memmove
rand
setvbuf
signal
srand
strlen
strncmp
swprintf_s
towlower
vfprintf
wcscat_s
wcschr
wcscmp
wcscpy_s
wcslen
wcsncpy
wcsncpy_s
wcsrchr
wcsstr
wcstoul
ole32
CoCreateGuid
CoCreateInstance
CoInitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemFree
CoUninitialize
shell32
CommandLineToArgvW
ILCreateFromPathW
ILFree
SHBindToParent
SHChangeNotify
SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW
SHParseDisplayName
StrStrIW
shlwapi
PathAppendW
PathCombineW
PathRemoveExtensionW
PathRemoveFileSpecW
user32
CreatePopupMenu
DestroyMenu
DispatchMessageW
FindWindowExW
FindWindowW
GetMenuItemCount
GetMenuItemInfoW
GetMessageW
GetPropW
GetWindowThreadProcessId
IsWindow
MessageBoxW
PostMessageW
SendMessageTimeoutW
TranslateMessage
wsprintfW
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
v2_noinject_PinTo.exe
- IMPHASH f43ccaa02f04f7bea1ddf18230ce289e
- SHA256 f9441e048d842bef2224b1e0853b561a913977151f0ab84e4f19fbb998e2bfb5
- MD5 2f9df02e70fe203092ed1f1abc5d2c22
- SHA1 1b62d98161503b313f96024b67955d7130929286
- SHA512 491d1cda82fe90f002b2af5a606e87a88c1a68608f2e47f7e2a03e09628522e5f56e860ede54e2883009161ae5e4f75e76cb505ff650ab23521578bf8fcb41ee
- SSDEEP 1536:YpazXgnfMKgyPpDy396zP2NJLXBgY+fom6eC6eygmo8MYAm6eC6eygmo8MY7DaR:YpargBbFT2NJv0DaR
- TLSH T1DEC384437BE525D8F4B2DB7498B1413277B3BCA02A30DB1D0694C52D2E37691EE74B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegDeleteTreeW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetKeySecurity
RegSetValueExW
SetEntriesInAclW
SetSecurityDescriptorDacl
kernel32
CloseHandle
CopyFileW
CreateFileW
CreateMutexW
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
GetCommandLineW
GetFileAttributesW
GetFileSize
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetSystemDirectoryW
GetTempPathW
GetTickCount
GetUserDefaultUILanguage
GetVolumeNameForVolumeMountPointW
GetWindowsDirectoryW
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LocalFree
MoveFileW
OpenMutexW
OpenProcess
QueryPerformanceCounter
ReadFile
ReleaseMutex
RemoveDirectoryW
SetErrorMode
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
msvcrt
__C_specific_handler
__iob_func
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_fmode
_initterm
_snwprintf_s
_wcmdln
_wcsicmp
_wfopen
_wtoi
atexit
abort
calloc
exit
fclose
fflush
fprintf
free
malloc
memcmp
memcpy
memmove
rand
setvbuf
signal
srand
strlen
strncmp
swprintf_s
towlower
vfprintf
wcscat_s
wcschr
wcscmp
wcscpy_s
wcslen
wcsncpy
wcsncpy_s
wcsrchr
wcsstr
wcstoul
ole32
CoCreateGuid
CoCreateInstance
CoInitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemFree
CoUninitialize
shell32
CommandLineToArgvW
ILCreateFromPathW
ILFree
SHBindToParent
SHChangeNotify
SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW
SHParseDisplayName
StrStrIW
shlwapi
PathCombineW
PathRemoveExtensionW
PathRemoveFileSpecW
user32
CreatePopupMenu
DestroyMenu
DispatchMessageW
FindWindowExW
FindWindowW
GetMenuItemCount
GetMenuItemInfoW
GetMessageW
GetPropW
GetWindowLongPtrW
GetWindowThreadProcessId
IsWindow
MessageBoxW
PostMessageW
SendMessageTimeoutW
TranslateMessage
wsprintfW
Name
.text
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
v3_nokill_PinTo.exe
- IMPHASH 5bbc958ff5d1c15eedd2105f56dc67ec
- SHA256 e17fbc9df1deca24b732080a13169ca96f89963975636f2ccdeddc9c82eeb716
- MD5 979c046ebf76428b464b058382a8b0ed
- SHA1 dd152157629bcd0add85c6b005cc6923adac2b6c
- SHA512 722d1aa32bbb031f436fd84f46565ba7e92eaf3a614fbc6e38afe8a84c28317b3ca93ef5d137223bda3d94985cf2d895fe36f52287e46b05660f208e270b179d
- SSDEEP 1536:7aen0+DYUEQGbKDNZWm4dc2NJLXBQY++0VWMm6eC6KuCw24Mc/m6eC6KuCw24McW:7aen0+DEsiT22NJ/B0V0Da8
- TLSH T1B4C3840377E525D8F4B2DB7499B14131B7B3BCA12A30DB1E0694C52D2E37690BE74B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegDeleteTreeW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetKeySecurity
RegSetValueExW
SetEntriesInAclW
SetSecurityDescriptorDacl
kernel32
CloseHandle
CopyFileW
CreateFileW
CreateMutexW
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
GetCommandLineW
GetFileAttributesW
GetFileSize
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetSystemDirectoryW
GetTempPathW
GetTickCount
GetUserDefaultUILanguage
GetVolumeNameForVolumeMountPointW
GetWindowsDirectoryW
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalFree
MoveFileW
OpenMutexW
OpenProcess
QueryPerformanceCounter
ReadFile
ReleaseMutex
RemoveDirectoryW
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
msvcrt
__C_specific_handler
__iob_func
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_fmode
_initterm
_snwprintf_s
_wcmdln
_wcsicmp
_wfopen
_wtoi
atexit
abort
calloc
exit
fclose
fflush
fprintf
free
malloc
memcmp
memcpy
memmove
rand
setvbuf
signal
srand
strlen
strncmp
swprintf_s
towlower
vfprintf
wcscat_s
wcschr
wcscmp
wcscpy_s
wcslen
wcsncpy
wcsncpy_s
wcsrchr
wcsstr
wcstoul
ole32
CoCreateGuid
CoCreateInstance
CoInitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemFree
CoUninitialize
shell32
CommandLineToArgvW
ILCreateFromPathW
ILFree
SHBindToParent
SHChangeNotify
SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW
SHParseDisplayName
StrStrIW
shlwapi
PathAppendW
PathCombineW
PathRemoveExtensionW
PathRemoveFileSpecW
user32
CreatePopupMenu
DestroyMenu
DispatchMessageW
FindWindowExW
FindWindowW
GetMenuItemCount
GetMenuItemInfoW
GetMessageW
GetPropW
GetWindowLongPtrW
GetWindowThreadProcessId
IsWindow
MessageBoxW
PostMessageW
SendMessageTimeoutW
TranslateMessage
wsprintfW
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
v4_nospawn_PinTo.exe
- IMPHASH fd3563a6a60a9b5ee372de99b7aa3fc6
- SHA256 f4fc9e87d0c59f007f6f27105387b8a61f2fea6fd2201e19016c480d8e975701
- MD5 c06bc3cbcc41b47a2c5fac302fc86df6
- SHA1 c52aba5615b789a263420b5c87a910d74e9c2b02
- SHA512 39c36dfd3c3d57deb3fc38734697b16d8d80f374a6dddd0c314182bc2faed5ef93258eb9af270939a9273529cb6518c81527553f08765ca8bbd8551163d44c3b
- SSDEEP 1536:JTaGllgi2s0cqNmt89qzb2NJLXBnY+fF06OGa+iaqOiQWY/6OGa+iaqOiQWY/Dag:JTaGlz2shqNWN2NJeg04eDag
- TLSH T12AC3944277E629D8F4B2DB7498B1413177B3BCA12A30DB1D0694C52D2E37690FE74B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegDeleteTreeW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetKeySecurity
RegSetValueExW
SetEntriesInAclW
SetSecurityDescriptorDacl
kernel32
CloseHandle
CopyFileW
CreateFileW
CreateMutexW
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
GetCommandLineW
GetFileAttributesW
GetFileSize
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetSystemDirectoryW
GetTempPathW
GetTickCount
GetUserDefaultUILanguage
GetVolumeNameForVolumeMountPointW
GetWindowsDirectoryW
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalFree
MoveFileW
OpenMutexW
OpenProcess
QueryPerformanceCounter
ReadFile
ReleaseMutex
RemoveDirectoryW
SetErrorMode
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
msvcrt
__C_specific_handler
__iob_func
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_fmode
_initterm
_snwprintf_s
_wcmdln
_wcsicmp
_wfopen
_wtoi
atexit
abort
calloc
exit
fclose
fflush
fprintf
free
malloc
memcmp
memcpy
memmove
rand
setvbuf
signal
srand
strlen
strncmp
swprintf_s
towlower
vfprintf
wcscat_s
wcschr
wcscmp
wcscpy_s
wcslen
wcsncpy
wcsncpy_s
wcsrchr
wcsstr
wcstoul
ole32
CoCreateGuid
CoCreateInstance
CoInitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemFree
CoUninitialize
shell32
CommandLineToArgvW
ILCreateFromPathW
ILFree
SHBindToParent
SHChangeNotify
SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW
SHParseDisplayName
StrStrIW
shlwapi
PathAppendW
PathCombineW
PathRemoveExtensionW
PathRemoveFileSpecW
user32
CreatePopupMenu
DestroyMenu
DispatchMessageW
FindWindowExW
FindWindowW
GetMenuItemCount
GetMenuItemInfoW
GetMessageW
GetPropW
GetWindowLongPtrW
GetWindowThreadProcessId
IsWindow
MessageBoxW
PostMessageW
SendMessageTimeoutW
TranslateMessage
wsprintfW
Name
.text
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
v5_noimm_PinTo.exe
- IMPHASH 290ff59fbdedaf4cf2378652393ad61b
- SHA256 be54ea3c351bc373563d3607de6dc9a2993c3ea82bed21b8b0f49b7ffc60af5a
- MD5 90e33a0f80103af078c308d340cbdbe8
- SHA1 70a8c1dfd12e89f119959b86da1d0efc54b77e2c
- SHA512 79e4bdf48e1f71df46f6676630659ae5bfe34947907f2bc28f739f31b28e14c09086f23270fb6c3516ab2ddd5dfd1bf91f7ea66f7ecd3ff8cc9d493a2f9c8e02
- SSDEEP 1536:zqqyQ2Ns8L/TtrzDOTLa2NJLXBsYvuy+2KuSKa+SAa+O9+2KuSKa+SAa+ObDac:zqqy9LJXJ2NJ7pDac
- TLSH T1E7C3850277E625D8F4B2DB7498B1413177B3BCA12E30DB1D0694C52D2E37691BE74B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegDeleteTreeW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetKeySecurity
RegSetValueExW
SetEntriesInAclW
SetSecurityDescriptorDacl
kernel32
CloseHandle
CopyFileW
CreateFileW
CreateMutexW
CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
GetCommandLineW
GetFileAttributesW
GetFileSize
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetSystemDirectoryW
GetTempPathW
GetTickCount
GetUserDefaultUILanguage
GetVolumeNameForVolumeMountPointW
GetWindowsDirectoryW
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalFree
MoveFileW
OpenProcess
QueryPerformanceCounter
ReadFile
ReleaseMutex
RemoveDirectoryW
SetErrorMode
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
msvcrt
__C_specific_handler
__iob_func
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_fmode
_initterm
_snwprintf_s
_wcmdln
_wcsicmp
_wfopen
_wtoi
atexit
abort
calloc
exit
fclose
fflush
fprintf
free
malloc
memcmp
memcpy
memmove
rand
setvbuf
signal
srand
strlen
strncmp
swprintf_s
towlower
vfprintf
wcscat_s
wcschr
wcscmp
wcscpy_s
wcslen
wcsncpy
wcsncpy_s
wcsrchr
wcsstr
wcstoul
ole32
CoCreateGuid
CoCreateInstance
CoInitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemFree
CoUninitialize
shell32
CommandLineToArgvW
ILCreateFromPathW
ILFree
SHBindToParent
SHChangeNotify
SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW
SHParseDisplayName
StrStrIW
shlwapi
PathAppendW
PathCombineW
PathRemoveExtensionW
PathRemoveFileSpecW
user32
CreatePopupMenu
DestroyMenu
DispatchMessageW
FindWindowExW
FindWindowW
GetMenuItemCount
GetMenuItemInfoW
GetMessageW
GetPropW
GetWindowLongPtrW
GetWindowThreadProcessId
IsWindow
MessageBoxW
PostMessageW
SendMessageTimeoutW
TranslateMessage
wsprintfW
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
400B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
v6_lowset_PinTo.exe
- IMPHASH cb894ad47e2cd826e8cf4f4426bd8c59
- SHA256 06e70651bc44f1720d80dab1d1b7bd493045880f4eadbdf1f90811269b0501c2
- MD5 546fa0b2c8dff92034231d2df25eeaa0
- SHA1 e7ee9e5073133d3971b0c16df232166cb0428717
- SHA512 a0e84704e53b01901a85e006906ed09028c770ce0f3dfa817e08b0e3b8176dee79e56c7af4a9fadad961db2e2cc3c80da4e96fa7fe7f6658d3893ab829ebe40b
- SSDEEP 1536:GbFiJykIwGGAPEVe99ZyM2NJLXBPW1L8gtJFtJcDaY:GbkJzlJ/e3T2NJJDo16DaY
- TLSH T1F6B3830277E526D8F4B3DB7499B14136A7B3BCA12D30DB1D0694C52D2E37680AE74F2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegDeleteTreeW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetKeySecurity
RegSetValueExW
SetEntriesInAclW
SetSecurityDescriptorDacl
kernel32
CloseHandle
CopyFileW
CreateFileW
CreateMutexW
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
GetCommandLineW
GetFileAttributesW
GetFileSize
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetSystemDirectoryW
GetTempPathW
GetTickCount
GetUserDefaultUILanguage
GetVolumeNameForVolumeMountPointW
GetWindowsDirectoryW
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LocalFree
MoveFileW
QueryPerformanceCounter
ReadFile
ReleaseMutex
RemoveDirectoryW
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
msvcrt
__C_specific_handler
__iob_func
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_fmode
_initterm
_snwprintf_s
_wcmdln
_wcsicmp
_wfopen
_wtoi
atexit
abort
calloc
exit
fclose
fflush
fprintf
free
malloc
memcmp
memcpy
memmove
rand
setvbuf
signal
srand
strlen
strncmp
swprintf_s
towlower
vfprintf
wcscat_s
wcschr
wcscmp
wcscpy_s
wcslen
wcsncpy
wcsncpy_s
wcsrchr
wcsstr
wcstoul
ole32
CoCreateGuid
CoCreateInstance
CoInitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemFree
CoUninitialize
shell32
CommandLineToArgvW
ILCreateFromPathW
ILFree
SHBindToParent
SHChangeNotify
SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW
SHParseDisplayName
StrStrIW
shlwapi
PathCombineW
PathRemoveExtensionW
PathRemoveFileSpecW
user32
CreatePopupMenu
DestroyMenu
DispatchMessageW
FindWindowExW
FindWindowW
GetMenuItemCount
GetMenuItemInfoW
GetMessageW
GetPropW
GetWindowThreadProcessId
IsWindow
MessageBoxW
PostMessageW
SendMessageTimeoutW
TranslateMessage
wsprintfW
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ