gta_check[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
gta_check.zip
Size 3.1MB
Sample261030-b9tnmsgv91
SHA256 83fcc9adbb16f96e19c09f68d321cccc5759f5845bff25dae70c08f588a28cb2
MD5 fc295af3f4ab7efab5d2f7b599407632
SHA1 8bf2aa607c4511fe6582685d1b81e65f225f4c69
SHA512 2a9871bc99f8c7c9f895678602c5866449d2c85aa7020bf7d80b888acf71fa04685ed48e4e61157d829383dbca31d77677c302ee018a269413a552eb35f21a3c
SSDEEP 98304:1mb1IfaprHhiC1VuQQfUycVnyeaH3dW9U:MSfadhizfUymyHH3cu
TLSH
T14BE53358BABC0B63D82222D47E9B182B165F481C18626C33F5D9E7D448E1ECBD4B7B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/gta_check/Xenos64.exe
unpack001/gta_check/YimMenuV2.dll

File Explorer

gta_check.zip

.zip 3.1MB
gta_check/Xenos64.exe

.exe 1.3MB
gta_check/YimMenuV2.dll

.dll 6.8MB

gta_check.zip

SHA256 83fcc9adbb16f96e19c09f68d321cccc5759f5845bff25dae70c08f588a28cb2
MD5 fc295af3f4ab7efab5d2f7b599407632
SHA1 8bf2aa607c4511fe6582685d1b81e65f225f4c69
SHA512 2a9871bc99f8c7c9f895678602c5866449d2c85aa7020bf7d80b888acf71fa04685ed48e4e61157d829383dbca31d77677c302ee018a269413a552eb35f21a3c
SSDEEP 98304:1mb1IfaprHhiC1VuQQfUycVnyeaH3dW9U:MSfadhizfUymyHH3cu
TLSH
T14BE53358BABC0B63D82222D47E9B182B165F481C18626C33F5D9E7D448E1ECBD4B7B47
MD5 SHA1 SHA512 SSDEEP TLSH

gta_check/Xenos64.exe

IMPHASH d8c629b29d617e5840b52a1eb7e78d11
SHA256 922163713b973cf8c4ad80f16cf69305ed0ca319b314e7ec8ae1982ed5f2a9ed
MD5 e2be25ec1c860b98ea99a835cc981d28
SHA1 cd0498ef91cd6c7ce9ebf78b3ee43032d65deee2
SHA512 355f1ec630268ae41e5740592697d1e9d6b05001b71a1e8dc29206c59ff59d9cf23200f8755fb9d7ce639d27d0fd03ca1f203da70a652bb9a30587b5a93146a6
SSDEEP 24576:iSBsKAhjPTMl1xPiZvL9IyK4LEaDnmfSVgPCS3tMrMyj3F9hIF1SqY5cbaF:iSBsvPTMlLqR6N4waDWSVE3tMx3FE1Sr
TLSH
T16A556D4A77A841F8D076D175C9A78A56E7B2B8060B3187EF07D0A21A1F77AF05E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

459772

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Ton\Documents\Visual Studio 2017\Projects\Xenos\build\x64\Release\Xenos64.pdb

shlwapi

SHDeleteKeyW SHSetValueW

dbghelp

MiniDumpWriteDump

kernel32

RaiseException LoadResource FindResourceW DecodePointer GetWindowsDirectoryW DeleteCriticalSection CreateProcessW GetCurrentProcess GetModuleFileNameW WaitForSingleObject GetCurrentThreadId Sleep CreateThread GetLocalTime ExitProcess GetCurrentProcessId SetUnhandledExceptionFilter FlushFileBuffers GetFileAttributesW ResumeThread CloseHandle GetNativeSystemInfo GetModuleHandleW DeleteFileW LockResource GetLastError Wow64RevertWow64FsRedirection CreateFileW InitializeCriticalSectionEx Wow64DisableWow64FsRedirection WriteFile VirtualProtect SetEndOfFile WriteConsoleW ReadConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetTimeZoneInformation SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID SizeofResource GetCommandLineW CreateNamedPipeW IsValidLocale GetTimeFormatW GetDateFormatW HeapFree GetConsoleMode GetConsoleCP HeapAlloc EnterCriticalSection LeaveCriticalSection InitializeCriticalSection MultiByteToWideChar FormatMessageW LocalFree WideCharToMultiByte DeviceIoControl GetSystemTimeAsFileTime QueryPerformanceCounter VirtualFree VirtualAlloc TerminateProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetExitCodeProcess Thread32Next Thread32First CreateActCtxW GetTempPathW UnmapViewOfFile GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile DuplicateHandle ResetEvent GetTickCount LoadLibraryW GetProcAddress FreeLibrary GetCurrentThread GetSystemInfo VirtualAllocEx VirtualFreeEx ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW ReadFile TerminateThread GetExitCodeThread OpenProcess IsWow64Process SuspendThread GetThreadTimes OpenThread WriteProcessMemory VirtualProtectEx GetThreadContext ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx GetStringTypeW TryEnterCriticalSection WaitForSingleObjectEx SwitchToThread SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwindEx RtlPcToFileHeader ExitThread GetModuleHandleExW GetStdHandle GetFileType

user32

GetWindowTextW GetMenu CreateWindowExW DestroyIcon LoadIconW ChangeWindowMessageFilterEx EnableMenuItem wsprintfW GetMessageW CreateDialogParamW CallWindowProcW DestroyWindow MessageBoxW SetWindowLongPtrW SendMessageW EndDialog SetWindowTextW LoadAcceleratorsW ShowWindow IsWindow DispatchMessageW IsDialogMessageW TranslateAcceleratorW TranslateMessage SendMessageA GetDlgItem DialogBoxParamW EnableWindow

comdlg32

GetOpenFileNameW GetSaveFileNameW

shell32

CommandLineToArgvW DragQueryFileW

ole32

CoUninitialize CoCreateInstance CoInitialize

advapi32

RegCreateKeyW RegOpenKeyExW RegEnumValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenThreadToken RegOpenKeyW OpenProcessToken RegSetValueExW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

gta_check/YimMenuV2.dll

IMPHASH 61328ebb214f28582529e1f898565496
SHA256 bc21abd238f710f7b0e01675ad636253752a39b04d2a1548bd15a2ebf3fcf5dc
MD5 ce890e452c1b866857b939c080d2e53c
SHA1 083375180d07af2cf9f50f48038615b9e39244b8
SHA512 bcc5e08a5e7e4582275ae9de469ce8638a9ab6865f9e3f32af71cb1d67bf0b515900bffa20781cad14c6e670a16ddde47d5d95b67ec622bec942b21be1f8c52f
SSDEEP 98304:zTVW5wdKlEp6voBKkSQkJdt20qMUXlZu8:zc5wqEp6ggkrqYM4Du
TLSH
T113668D07BA4AA47CC116C6B1A24F4E679D35B4CA0B3478DF47C493782E727F48B3A949
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3969856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\YimMenuV2\YimMenuV2\build\YimMenuV2.pdb

dbghelp

StackWalk64 SymCleanup SymFromAddr SymFunctionTableAccess64 SymGetLineFromAddr64 SymGetModuleBase64 SymInitialize

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AllocConsole AreFileApisANSI AttachConsole CloseHandle ConvertThreadToFiber CopyFile2 CreateDirectoryExW CreateDirectoryW CreateEventA CreateFiber CreateFile2 CreateFileW CreateHardLinkW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFiber DeviceIoControl DisableThreadLibraryCalls EnterCriticalSection FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlushInstructionCache FormatMessageA FreeConsole FreeLibrary FreeLibraryAndExitThread GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocaleInfoA GetLocaleInfoEx GetModuleFileNameA GetModuleHandleA GetModuleHandleExA GetModuleHandleW GetProcAddress GetStartupInfoW GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetTickCount64 GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeSListHead IsBadReadPtr LeaveCriticalSection LoadLibraryA LoadLibraryExA LocalFree MoveFileExW MoveFileW MultiByteToWideChar OpenThread QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetConsoleOutputCP SetConsoleTitleA SetCurrentDirectoryW SetErrorMode SetFileAttributesW SetFileInformationByHandle SetFileTime SetLastError SetThreadContext SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SuspendThread SwitchToFiber Thread32First Thread32Next TryAcquireSRWLockExclusive TryAcquireSRWLockShared VerSetConditionMask VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte

user32

ClientToScreen CloseClipboard EmptyClipboard GetAsyncKeyState GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyNameTextA GetKeyState GetKeyboardLayout GetMessageExtraInfo IsWindowUnicode LoadCursorA MapVirtualKeyA MonitorFromWindow OpenClipboard ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetProcessDPIAware TrackMouseEvent

shell32

ShellExecuteA ShellExecuteW

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ??0facet@locale@std@@IEAA@_K@Z ??0ios_base@std@@IEAA@XZ ??0task_continuation_context@Concurrency@@AEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1facet@locale@std@@MEAA@XZ ??1ios_base@std@@UEAA@XZ ??4?$_Yarn@_W@std@@QEAAAEAV01@PEB_W@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Incref@facet@locale@std@@UEAAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Random_device@std@@YAIXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?classic@locale@std@@SAAEBV12@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?init@?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAAXPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?setf@ios_base@std@@QEAAHH@Z ?setf@ios_base@std@@QEAAHHH@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?uncaught_exceptions@std@@YAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z _Cnd_broadcast _Cnd_do_broadcast_at_thread_exit _Cnd_register_at_thread_exit _Cnd_signal _Cnd_unregister_at_thread_exit _Cnd_wait _Mtx_lock _Mtx_trylock _Mtx_unlock _Query_perf_counter _Query_perf_frequency _Strcoll _Strxfrm _Thrd_id _Thrd_join _Thrd_yield _Xtime_get_ticks __crtLCMapStringA __crtLCMapStringW

d3dcompiler_47

D3DCompile

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __DestructExceptionObject __RTDynamicCast __RTtypeid __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list _purecall memchr memcmp memcpy memmove memset strchr strrchr strstr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-time-l1-1-0

_W_Getdays _W_Getmonths _difftime64 _gmtime64 _localtime64 _mktime64 _time64 clock strftime

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___lc_collate_cp_func ___lc_locale_name_func localeconv setlocale

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vsscanf _fseeki64 _get_stream_buffer_pointers _wfopen fclose feof ferror fflush fgetc fgetpos fgets fopen fputc fputs fread fseek fsetpos ftell fwrite putchar setvbuf tmpnam ungetc

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _cexit _configure_narrow_argv _crt_at_quick_exit _crt_atexit _errno _execute_onexit_table _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _seh_filter_dll abort exit strerror system terminate

api-ms-win-crt-math-l1-1-0

_dsign _fdsign _ldsign acos acosf asin atan atan2 atan2f ceilf cos cosf cosh exp fmod fmodf frexp ldexp log log10 logf modf pow powf sin sinf sinh sqrt sqrtf tan tanh

api-ms-win-crt-environment-l1-1-0

_dupenv_s getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file remove rename

api-ms-win-crt-convert-l1-1-0

atof strtod strtof strtol strtoll strtoul strtoull

api-ms-win-crt-utility-l1-1-0

bsearch qsort rand srand

api-ms-win-crt-heap-l1-1-0

_callnewh calloc free malloc realloc

api-ms-win-crt-string-l1-1-0

islower isspace isupper strcmp strcpy strlen strncmp strncpy strnlen tolower wcslen

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

135KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

gta_check.zip

gta_check/Xenos64.exe

shlwapi

dbghelp

kernel32

user32

comdlg32

shell32

ole32

advapi32

generic

gta_check/YimMenuV2.dll

dbghelp

kernel32

user32

shell32

msvcp140

d3dcompiler_47

gdi32

dwmapi

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

generic