2026-10-01_b5334e5937b5d0f70475f42e83ce3a34_coinminer_darkgate_elex_glassworm_mespinoza_remcos_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_b5334e5937b5d0f70475f42e83ce3a34_coinminer_darkgate_elex_glassworm_mespinoza_remcos_revil
Size 6.5MB
Sample261002-ftvm8azyfw
SHA256 80e375879e6f27b7289e35f094725c40ae2faac5672814de64919584cb867b86
MD5 b5334e5937b5d0f70475f42e83ce3a34
SHA1 aac44a809794e6c20f60a921f3423b9c5c9b9215
SHA512 60380b87e638aaf68419404035d502d8871a30cfaf0e76d14ca370252e93a4dfdb56c2d09e891e75567e7f25711fe65d667c00e96902915bcd72c0f77c5941e1
SSDEEP 98304:O28TePs5T9Q6eStl02poZYQ/3ahZZKfqerVLk5QS1gbKJo9/Y:AhyGyCJQChZmqiVI51gUo9/
TLSH
T1FF669D01A7E20925F4F3097698BD462E893ABD520724ECE7D2C5345B4A74ED2BA31F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-01_b5334e5937b5d0f70475f42e83ce3a34_coinminer_darkgate_elex_glassworm_mespinoza_remcos_revil

.exe 6.5MB

2026-10-01_b5334e5937b5d0f70475f42e83ce3a34_coinminer_darkgate_elex_glassworm_mespinoza_remcos_revil

IMPHASH 105e2ea913045235c6dfa358e37db6b1
SHA256 80e375879e6f27b7289e35f094725c40ae2faac5672814de64919584cb867b86
MD5 b5334e5937b5d0f70475f42e83ce3a34
SHA1 aac44a809794e6c20f60a921f3423b9c5c9b9215
SHA512 60380b87e638aaf68419404035d502d8871a30cfaf0e76d14ca370252e93a4dfdb56c2d09e891e75567e7f25711fe65d667c00e96902915bcd72c0f77c5941e1
SSDEEP 98304:O28TePs5T9Q6eStl02poZYQ/3ahZZKfqerVLk5QS1gbKJo9/Y:AhyGyCJQChZmqiVI51gUo9/
TLSH
T1FF669D01A7E20925F4F3097698BD462E893ABD520724ECE7D2C5345B4A74ED2BA31F37
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

4b:7f:98:f5:9c:3a:4d:16:6f:a4:6e:c6:28:11:9c:9b:c7:9c:8e:1d:42:63:e1:4c:0f:dd:b0:f1:fc:a5:12:fc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91440400MA7FWRMCXK,CN=珠海市莫停之科技有限公司,O=珠海市莫停之科技有限公司,L=珠海市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c09e78fa0e6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2026

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

7b:44:70:92:7a:f6:c8:9e:3e:2c:2e:2c:d9:40:da:75

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 21, 2025 - Jan 21, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1904314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\jekins_work\workspace\sysoptasst_build_2022\product\win32\dbginfo\wmvipmain.pdb

qr

qrFinalize qrSymbolToBMP qrAddData qrInit

crypt32

CertOpenStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertCloseStore

kernel32

ReleaseMutex FormatMessageW GetCurrentProcessId GetTickCount InterlockedExchange GetPrivateProfileIntW InterlockedDecrement GetPrivateProfileStringW InterlockedIncrement lstrcmpW MulDiv IsBadWritePtr OpenMutexW GetComputerNameW lstrcmpiW LoadLibraryExW MoveFileW lstrlenW OutputDebugStringW WaitForMultipleObjects GetStdHandle GetEnvironmentVariableW GetFileType TlsAlloc TlsGetValue TlsSetValue CreateMutexW GetModuleHandleExW SwitchToFiber DeleteFiber CreateFiber QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber LoadLibraryA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualFree LoadLibraryExA SetLastError GetFileSizeEx ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW SleepEx VerSetConditionMask GetModuleHandleA GetSystemDirectoryA QueryPerformanceFrequency VerifyVersionInfoA LocalAlloc SetFilePointer CreateThread TerminateThread Sleep GetModuleFileNameA GetLocalTime SetEndOfFile VirtualAlloc GetVersionExW GetWindowsDirectoryW GetSystemDirectoryW GetTempPathW GetFileSize ReadFile SystemTimeToFileTime DeleteFileW GetFileAttributesW FindClose InitializeCriticalSection LeaveCriticalSection GetModuleFileNameW FindNextFileW EnterCriticalSection FindFirstFileW CreateDirectoryW CreateFileW WriteFile GetExitCodeProcess CreateProcessW OutputDebugStringA LocalFree CloseHandle SetEvent CreateEventW WaitForSingleObject GlobalUnlock GlobalLock GlobalFree GlobalAlloc FreeResource GetCurrentThreadId GetCommandLineW WideCharToMultiByte FreeLibrary GetModuleHandleW GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW LoadLibraryW RaiseException HeapReAlloc LockResource GetLastError MultiByteToWideChar HeapSize InitializeCriticalSectionAndSpinCount HeapFree SizeofResource ExpandEnvironmentStringsA PeekNamedPipe FormatMessageA GetSystemTime TlsFree IsDebuggerPresent

user32

SetWindowRgn OffsetRect IsDialogMessageW DestroyIcon PeekMessageW IsRectEmpty IntersectRect SetCursor SetRectEmpty SetRect DrawIconEx PtInRect IsIconic GetCursorPos GetNextDlgTabItem LoadBitmapW LoadImageW InflateRect MapWindowPoints SystemParametersInfoW EnableWindow IsWindowEnabled GetActiveWindow CopyRect OpenClipboard CloseClipboard EmptyClipboard SetClipboardData DrawTextW GetWindowTextLengthW CallWindowProcW GetWindow GetFocus GetDC EqualRect SendMessageW SetWindowTextW InvalidateRgn GetDlgCtrlID ClientToScreen DestroyAcceleratorTable IsChild GetSysColor MoveWindow CreateAcceleratorTableW SetFocus CharNextW FindWindowW GetClassNameW SetCapture GetDlgItem GetDesktopWindow RegisterWindowMessageW EnumDisplaySettingsW GetClassInfoExW GetParent ReleaseCapture InvalidateRect ReleaseDC GetWindowTextW CharLowerA GetWindowRect MonitorFromWindow SetTimer RedrawWindow GetMonitorInfoW LoadIconW LoadCursorW UpdateLayeredWindow KillTimer BeginPaint EndPaint GetWindowLongW DefWindowProcW PostMessageW SendMessageTimeoutW DestroyWindow CreateWindowExW RegisterClassExW IsWindow SetWindowLongW FillRect GetClientRect GetWindowThreadProcessId SetWindowPos IsWindowVisible PostThreadMessageW EnumDisplayDevicesW GetSystemMetrics UnionRect GetProcessWindowStation MessageBoxW ScreenToClient SetActiveWindow ShowWindow AttachThreadInput MessageBoxA GetForegroundWindow BringWindowToTop PostQuitMessage SetForegroundWindow GetMessageW DispatchMessageW TranslateMessage UnregisterClassW GetUserObjectInformationW

gdi32

GetClipRgn CreateEllipticRgn RectInRegion MoveToEx ExtSelectClipRgn GetCurrentObject CombineRgn RoundRect GetViewportOrgEx CreateBitmap StretchBlt GetStretchBltMode SetStretchBltMode CreateRectRgnIndirect CreatePen SaveDC SelectClipRgn RestoreDC ExtTextOutW Rectangle SetTextColor SetBkColor CreateFontIndirectW GetStockObject GetDeviceCaps GetObjectW CreateDIBSection BitBlt CreateRoundRectRgn GetTextColor TextOutW GetTextExtentPoint32W SetBkMode LineTo CreateRectRgn SetViewportOrgEx CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC OffsetRgn CreateSolidBrush DeleteObject

advapi32

RegDeleteValueW InitializeSecurityDescriptor SetSecurityDescriptorSacl CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW GetUserNameW RegSetValueExW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegOpenKeyW RegQueryValueExW GetSecurityDescriptorSacl SetSecurityDescriptorDacl

shell32

SHCreateDirectoryExW ShellExecuteW

ole32

StringFromGUID2 CoTaskMemAlloc OleUninitialize CoGetClassObject CreateStreamOnHGlobal CoInitialize CoTaskMemRealloc CoUninitialize CoCreateInstance CLSIDFromProgID CoTaskMemFree OleInitialize CLSIDFromString OleLockRunning

oleaut32

VariantClear SysAllocStringLen SysStringLen DispCallFunc SysAllocString OleCreateFontIndirect LoadTypeLi VariantInit LoadRegTypeLi VarUI4FromStr SysFreeString

msvcp140

?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?width@ios_base@std@@QAE_J_J@Z ?width@ios_base@std@@QBE_JXZ ?flags@ios_base@std@@QBEHXZ ?good@ios_base@std@@QBE_NXZ ?_BADOFF@std@@3_JB ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE_W_W@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z ?setf@ios_base@std@@QAEHHH@Z _Mbrtowc ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?id@?$numpunct@_W@std@@2V0locale@2@A ?c_str@?$_Yarn@D@std@@QBEPBDXZ ??1facet@locale@std@@MAE@XZ ??0facet@locale@std@@IAE@I@Z ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UAEXXZ ??Bid@locale@std@@QAEIXZ ?_Gettrue@_Locinfo@std@@QBEPBDXZ ?_Getfalse@_Locinfo@std@@QBEPBDXZ ?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ??1_Locinfo@std@@QAE@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ??0_Locinfo@std@@QAE@PBD@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?_Xbad_alloc@std@@YAXXZ

shlwapi

PathIsDirectoryW StrToIntA PathAddBackslashW PathAppendW PathRemoveFileSpecW PathFindFileNameW StrToIntW PathFileExistsW

comctl32

_TrackMouseEvent InitCommonControlsEx DrawShadowText

msimg32

AlphaBlend

gdiplus

GdipDeleteBrush GdipSetStringFormatLineAlign GdipCreateFontFamilyFromName GdipCreateFont GdipCreateSolidFill GdipLoadImageFromStreamICM GdipDrawString GdipAlloc GdipCreateStringFormat GdiplusShutdown GdiplusStartup GdipPrivateAddFontFile GdipDeletePrivateFontCollection GdipCloneFontFamily GdipNewPrivateFontCollection GdipGetImageHeight GdipDisposeImage GdipAddPathLine GdipSetCompositingQuality GdipGetFamily GdipAddPathPieI GdipDrawRectangleI GdipAddPathRectangleI GdipAddPathArcI GdipSetPenStartCap GdipSetSmoothingMode GdipSetStringFormatTrimming GdipFillPath GdipAddPathStringI GdipSetPenDashStyle GdipDrawLine GdipAddPathLineI GdipSetPixelOffsetMode GdipFillRectangle GdipScaleWorldTransform GdipClosePathFigure GdipDrawLinesI GdipCreateFromHDC GdipDrawPath GdipResetWorldTransform GdipAddPathRectangle GdipSetPenEndCap GdipRotateWorldTransform GdipFillRectangleI GdipSetTextRenderingHint GdipCloneBrush ord1 GdipStartPathFigure GdipGetFontSize GdipTranslateWorldTransform GdipDeleteGraphics GdipSetPenMode GdipDeletePen GdipCloneImage GdipDrawImageI GdipCreatePen1 GdipCreateLineBrushFromRectWithAngleI GdipSetStringFormatFlags GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipDrawImagePointsRectI GdipGetImagePixelFormat GdipGraphicsClear GdipDrawImageRectI GdipCloneBitmapArea GdipSetInterpolationMode GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipDrawImageRectRect GdipImageRotateFlip GdipLoadImageFromFile GdipLoadImageFromFileICM GdipAddPathEllipseI GdipDeleteStringFormat GdipDeleteFont GdipGetImageWidth GdipSetStringFormatAlign GdipDrawImageRectRectI GdipLoadImageFromStream GdipDeleteFontFamily GdipFree GdipDeletePath GdipSetClipPath GdipCreatePath GdipCreateFontFromLogfontW GdipCreateFontFromDC GdipGetFontCollectionFamilyList GdipMeasureString GdipGetImageGraphicsContext GdipGetFontCollectionFamilyCount GdipCreateBitmapFromScan0

ws2_32

recvfrom sendto gethostname shutdown WSAIoctl htons getpeername select __WSAFDIsSet socket setsockopt listen connect closesocket bind accept WSASetLastError send recv getnameinfo freeaddrinfo getaddrinfo WSAGetLastError WSACleanup WSAStartup ntohs getsockopt getsockname ioctlsocket

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

bcrypt

BCryptGenRandom

vcruntime140

__RTDynamicCast _CxxThrowException _except_handler4_common __vcrt_InitializeCriticalSectionEx __CxxFrameHandler3 memchr strrchr strchr memcmp wcsrchr strstr wcschr wcsstr __std_exception_copy __std_exception_destroy memset _purecall memcpy memmove

api-ms-win-crt-string-l1-1-0

isspace tolower isalpha isalnum strncmp wcsncpy wcsspn _wcsnicmp wcscspn strncpy strcspn strspn wcscpy strcmp iswdigit _strdup wcsncpy_s _wcsupr_s strncpy_s strcat wcsncmp strnlen wcsnlen _stricmp wmemcpy_s iswspace _strnicmp _wcslwr_s strlen wcscpy_s _wcsicmp wcscmp wcslen

api-ms-win-crt-heap-l1-1-0

calloc free _callnewh _recalloc realloc malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _crt_atexit _initterm_e signal _initialize_wide_environment _register_thread_local_exe_atexit_callback _get_wide_winmain_command_line _c_exit _configure_wide_argv _beginthreadex _exit _initterm _set_app_type _controlfp_s strerror_s raise terminate _seh_filter_exe exit __sys_nerr _invalid_parameter_noinfo strerror _errno _getpid _cexit _invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

fgetpos __stdio_common_vswprintf __stdio_common_vswprintf_s setvbuf fwrite ungetc fsetpos _fseeki64 fgetc _get_stream_buffer_pointers __acrt_iob_func fflush feof fgets _fileno _setmode _set_fmode _wfopen fopen fputs clearerr setbuf __p__commode __stdio_common_vsprintf_s _read _write __stdio_common_vsnprintf_s _close _open ftell fputc ferror fclose fseek __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf _lseeki64 fread

api-ms-win-crt-convert-l1-1-0

_wtof strtol strtoul atoi _wtoi64 _wtoi strtoll

api-ms-win-crt-time-l1-1-0

_time64 _time32 _mktime64 _gmtime32_s _localtime64 _gmtime64 _localtime64_s strftime

api-ms-win-crt-multibyte-l1-1-0

_mbscmp _mbspbrk _ismbcspace _mbsicmp _mbschr _mbsstr _mbsinc

api-ms-win-crt-filesystem-l1-1-0

_fstat32 _access _unlock_file _stat32 _stat64 _waccess _lock_file _fstat64

api-ms-win-crt-utility-l1-1-0

abs rand srand qsort labs

api-ms-win-crt-math-l1-1-0

_except1 ceil __setusermatherr floor

api-ms-win-crt-locale-l1-1-0

_configthreadlocale setlocale

api-ms-win-crt-environment-l1-1-0

getenv

wldap32

ord79 ord217 ord46 ord211 ord60 ord50 ord301 ord200 ord30 ord143 ord35 ord33 ord32 ord27 ord26 ord22 ord41

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=93, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=8, id=199, version=41118,

count=15, id=259, version=24123,

count=13, id=260, version=24123,

count=4, id=261, version=23013,

count=4, id=257, version=24123,

count=37, id=261, version=24123,

count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=23, productName=Unmarked objects (old),

count=558, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=58, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=814, id=1, productName=Unmarked objects,

count=92, id=265, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=2, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,