Vendor_Payment_Status_20261026.zip
- SHA256 5ac7de033fda1495d1666cdf27e3caa04e0a15df450d6f83564e1bd8a19b7b1f
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Invoice20261027-1532654842.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Invoice20261027-1532654842.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target Vendor_Payment_Status_20261026.zip
- Size 1.9MB
- Sample261027-j9pzfsswcs
- SHA256 5ac7de033fda1495d1666cdf27e3caa04e0a15df450d6f83564e1bd8a19b7b1f
- MD5 c9b386acbea0477abaef17ac622e6d3f
- SHA1 f186b0b4d39642888f04a893106ffd92a38e2adc
- SHA512 c9b4bb7f7934f115400f4f387679ed6c94f49a75af3e88aa58809d6b375d020265682034be405eab2aa622fbb46558d5223457c0b8ae4b9d263b30c1a4e121e7
- SSDEEP 49152:oe1z9HPn6Urx8mtxHMRQ4sIe1GsPMuETPzOrJgg:lx9HS8xNDsRQ4DAdU6JL
- TLSH T1F0953391125EC6474AB59ECFEC5331608E04067394255A4A83CFAEEDDC67EC8FCB246B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/CrashHunter_PC3.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Invoice20261027-1532654842.exe
File Explorer
-
Vendor_Payment_Status_20261026.zip.zip 1.9MB
-
CrashHunter_PC3.dll.dll 3.2MB
-
Invoice20261027-1532654842.exe.exe 842KB
CrashHunter_PC3.dll
- IMPHASH 41393f3d0ba040cb7b54434a049fc3d2
- SHA256 81574ec80b500c27e80ec94fb0a458c53c22ce41d59d891aa806cfa725344a65
- MD5 4e4dfb9a3422306ae69bc88e18544e3d
- SHA1 0e90298f977d65525b006691b1568353cea998a8
- SHA512 188d84f7c595d94a93b0fccf250216844362eaf1044fcd8b428d0d1e24746ad53dccec23e3f795d95505a9a04dc880fd6c418aaff389efdecb5c24d639fb4afc
- SSDEEP 49152:2G289s6Jkgvu2hhs/9+Y9bkJupkFeKrJkqGkUPpT9HFPFYTVu521rQjoCd:N28nnlYatkUUP3H/612d
- TLSH T145F58C16B7A800E4D9B7C23CCA978607E7B2B4159370DBDF06A4467A2F23BE1563E750
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
fa:39:76:e0:d1:2e:74:a5:b4:08:b6:dd:cb:4b:5d:a8:59:2f:15:05:3d:7e:95:16:a3:16:75:68:07:2f:e8:71
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=91330000788831167A,CN=NetEase (Hangzhou) Network Co.\, Ltd,O=NetEase (Hangzhou) Network Co.\, Ltd,L=杭州市,ST=浙江省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Apr 11, 2025
SERIALNUMBER=91330000788831167A,CN=NetEase (Hangzhou) Network Co.\, Ltd,O=NetEase (Hangzhou) Network Co.\, Ltd,L=杭州市,ST=浙江省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91330000788831167A,CN=NetEase (Hangzhou) Network Co.\, Ltd,O=NetEase (Hangzhou) Network Co.\, Ltd,L=杭州市,ST=浙江省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=91330000788831167A,CN=NetEase (Hangzhou) Network Co.\, Ltd,O=NetEase (Hangzhou) Network Co.\, Ltd,L=杭州市,ST=浙江省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
0a:7d:c0:32:ca:30:8f:7f:f2:d5:94:1a:85:b6:29:8a
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 26, 2024 - Aug 28, 2027
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
2264472
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
G:\CrashHunterSDK\wcrashhandler\tmpbuild\Release_x64_v140\CrashHunter_PC3.pdb
dbghelp
SymFunctionTableAccess64
SymGetModuleBase64
StackWalk64
SymInitialize
MiniDumpWriteDump
SymGetModuleInfoW64
SymEnumerateModulesW64
SymRefreshModuleList
SymRegisterCallbackW64
SymInitializeW
SymCleanup
kernel32
CreateEventW
SetThreadPriority
WaitForSingleObject
FindFirstFileW
FileTimeToLocalFileTime
FileTimeToDosDateTime
FindClose
GetSystemTime
GetTimeZoneInformation
GetModuleFileNameW
CreateToolhelp32Snapshot
Process32NextW
CreateFileW
GetFileSize
ReadFile
DeleteFileW
GetFileSizeEx
FormatMessageW
LocalFree
FindNextFileW
RemoveDirectoryW
MoveFileW
GetFileTime
IsDebuggerPresent
Sleep
GetCurrentDirectoryW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
lstrcpyA
WriteConsoleW
GetStdHandle
WriteConsoleA
CreateThread
CopyFileW
InitializeCriticalSection
RtlCaptureStackBackTrace
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
CreateProcessW
OpenThread
GetLocalTime
WideCharToMultiByte
MultiByteToWideChar
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueEx
DeleteTimerQueueTimer
WerRegisterRuntimeExceptionModule
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
QueryPerformanceCounter
GetTickCount
MoveFileExA
SetEvent
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableA
GetFileType
PeekNamedPipe
VerSetConditionMask
VerifyVersionInfoA
SystemTimeToFileTime
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
WriteFile
GetModuleHandleExW
GlobalMemoryStatus
SetFilePointer
GetFullPathNameW
SetEndOfFile
ResetEvent
WaitForMultipleObjects
RaiseException
LoadLibraryExW
SuspendThread
GetCurrentThread
SetThreadContext
GetThreadContext
ResumeThread
GetCurrentThreadId
VirtualFree
VirtualAlloc
FlushInstructionCache
VirtualProtect
VirtualQuery
GetCurrentProcess
K32GetModuleBaseNameW
K32EnumProcessModules
GlobalMemoryStatusEx
GetLastError
GetVersionExW
GetSystemInfo
GetProcAddress
HeapSize
GetModuleHandleW
SetStdHandle
FlushFileBuffers
EnumSystemLocalesW
CloseHandle
K32GetProcessMemoryInfo
OpenProcess
GetCurrentProcessId
FileTimeToSystemTime
GetProcessHeap
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
FreeLibrary
WaitForSingleObjectEx
GetDateFormatW
GetACP
GetConsoleCP
HeapReAlloc
HeapFree
HeapAlloc
ExitProcess
GetModuleFileNameA
SetFilePointerEx
GetDriveTypeW
CreateDirectoryW
SetConsoleCtrlHandler
GetFileAttributesExW
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
ExitThread
RtlUnwindEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
FreeLibraryAndExitThread
GetThreadTimes
OutputDebugStringW
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
ChangeTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
DecodePointer
EncodePointer
RtlPcToFileHeader
GetStringTypeW
DuplicateHandle
TryEnterCriticalSection
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
InitializeCriticalSectionAndSpinCount
user32
GetProcessWindowStation
EnumDisplayDevicesA
MessageBoxW
GetUserObjectInformationW
gdi32
D3DKMTQueryAdapterInfo
D3DKMTOpenAdapterFromDeviceName
D3DKMTCloseAdapter
D3DKMTQueryStatistics
advapi32
CryptGenRandom
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetKeyValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
RegOpenKeyExA
shell32
SHGetPathFromIDListW
SHGetSpecialFolderLocation
cfgmgr32
CM_Get_Device_Interface_PropertyW
CM_Locate_DevNodeW
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Get_DevNode_PropertyW
rpcrt4
RpcStringFreeA
UuidToStringA
iphlpapi
GetAdaptersInfo
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
wldap32
ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord30
ord200
ord301
ord79
ws2_32
WSAEnumNetworkEvents
WSACreateEvent
WSAEventSelect
send
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
recv
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
gethostname
shutdown
getnameinfo
WSACloseEvent
crypt32
CertGetCertificateContextProperty
CertFindCertificateInStore
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CertDuplicateCertificateContext
CertOpenStore
?GetInstance@AppDumpWorker@@SAPEAV1@XZ
?getInstance@MyCrashHandler@@SAPEAV1@XZ
addFiles
captureStackBackTrace
endCrashHunter
frameCallback
getAutoUploadMode
getBranch
getCrashHandlerInstance
getDebugMode
getDumpDir
getDumpType
getFullDumpDir
getParam
getSdkVersion
getStartUpNumberURL
getUploadURL
initWithFile
isLastTimeCrash
ntExtendFunc
postFile
postFileEx
postOtherError
postScriptError
safelyBindCondition
safelyUnbindCondition
setAutoUploadMode
setBranch
setCrashCallback
setCrashCallbackEx
setDebugMode
setDumpDir
setDumpType
setFullDumpDir
setHost
setParam
setPostCallback
setUrl
startCrashHunter
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
829KB
Virtual Size
828KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
79KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
124KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.ew5l
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=190, id=243, version=40116,
count=30, id=242, version=40116,
count=6, id=199, version=41118,
count=8, id=259, version=24123,
count=112, id=261, version=24123,
count=41, id=260, version=24123,
count=672, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=27, id=203, version=65501,
count=328, id=1, productName=Unmarked objects,
count=26, id=265, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Invoice20261027-1532654842.exe
- IMPHASH e337b8679aa3abf4b930c3c4a62eb79b
- SHA256 4ad22e0c2974defaf9a3c21408093a92c9a7091b40b537d741e0b993687a6d0f
- MD5 779d70322c7851878b97f32bcfbe7240
- SHA1 47a5a02f4f24cd539bb80754f4aadb278c4fc247
- SHA512 45fb4a137e275e32c97b4434f026973660ceefc4204dfc3a4ed8a911a0928b1ff07d177d331ef61da0f74af0e620ef788ce4ad234e8a600ff453e741c4a73458
- SSDEEP 12288:34nlIWnN2rfmfOlso02Qz72EnAonrkUkPYsAvw2:dWnYr+OsoHQziEAMBhY2
- TLSH T1B2058C5DA2A404E9D47B9139C9C13637E6B2B885076097DB13A0966B2F336D31FFE321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
251596
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\tx4\repo\messiah_multiprocess_patch\Engine\Binaries\Win64Publish\Tianxia_x64r.pdb
crashhunter_pc3
?getInstance@MyCrashHandler@@SAPEAV1@XZ
kernel32
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryExA
GetCurrentProcess
TerminateProcess
CreateProcessW
GetLastError
CloseHandle
FlushFileBuffers
ReadFile
SetHandleInformation
SetLastError
CreatePipe
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
WaitForSingleObjectEx
CreateEventW
CreateEventExW
Sleep
WaitForMultipleObjects
CreateSemaphoreW
GetExitCodeProcess
CreateThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
OpenProcess
VirtualAllocEx
VirtualQueryEx
VirtualFreeEx
GetModuleHandleW
WideCharToMultiByte
GetFullPathNameA
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetStdHandle
GetEnvironmentVariableA
WriteFile
GetProcessTimes
GetCurrentProcessorNumber
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
LoadLibraryW
WriteConsoleA
GetConsoleScreenBufferInfo
LocalFree
FormatMessageA
GetLocaleInfoEx
GetCurrentDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
GetModuleFileNameW
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
InitializeSListHead
GetCurrentProcessId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleHandleExW
ExitProcess
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
SetStdHandle
GetTimeZoneInformation
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
SetEndOfFile
SwitchToThread
RtlUnwind
user32
MessageBoxA
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
Name
.text
Size
441KB
Virtual Size
440KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
23KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
190KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=186, id=261, version=30795,
count=19, id=260, version=30795,
count=10, id=259, version=34321,
count=18, id=260, version=34321,
count=87, id=261, version=34321,
count=1, id=260, version=34435,
count=6, id=257, version=30795,
count=3, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=190, id=1, productName=Unmarked objects,
count=20, id=261, version=34435,
count=1, id=255, version=34435,
count=1, id=151,
count=1, id=258, version=34435,