b13027ca47f55fa6eb3fda1ef84ebfa98be63dd701a2f61938177a06fdc3a014

Sharing

Copy URL Twitter E-mail

General

Target
b13027ca47f55fa6eb3fda1ef84ebfa98be63dd701a2f61938177a06fdc3a014
Size 13.5MB
Sample261102-2dkzqszw8j
SHA256 b13027ca47f55fa6eb3fda1ef84ebfa98be63dd701a2f61938177a06fdc3a014
MD5 4ee97aeda49d6e33a8621ec4936fa672
SHA1 fd5ebb5c7d0e3ee3e78279cfd2c05eb91755e014
SHA512 ba62d1a0c050ef2ebf4c7949692b4955320aa45bcbe5d7ba06c1c945ca38a6fb2c4ed90617c77da55e6ab58071b0b15c7c4afe3c2e85e491cef4e7752eb5366e
SSDEEP 196608:OHf2j2V39hcAij4Xi3uDmTB+3w9jlxJVJI/59:OHqs9eAUUi3uV8xSz
TLSH
T1CFE68D26B665D165E89040B0AAADABDF112CB7381B3405C3A3DEAE5C7C745F33B32647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b13027ca47f55fa6eb3fda1ef84ebfa98be63dd701a2f61938177a06fdc3a014

File Explorer

b13027ca47f55fa6eb3fda1ef84ebfa98be63dd701a2f61938177a06fdc3a014

.exe 13.5MB

b13027ca47f55fa6eb3fda1ef84ebfa98be63dd701a2f61938177a06fdc3a014

IMPHASH 0ac17476c7c22671e8e5c8ce482da92e
SHA256 b13027ca47f55fa6eb3fda1ef84ebfa98be63dd701a2f61938177a06fdc3a014
MD5 4ee97aeda49d6e33a8621ec4936fa672
SHA1 fd5ebb5c7d0e3ee3e78279cfd2c05eb91755e014
SHA512 ba62d1a0c050ef2ebf4c7949692b4955320aa45bcbe5d7ba06c1c945ca38a6fb2c4ed90617c77da55e6ab58071b0b15c7c4afe3c2e85e491cef4e7752eb5366e
SSDEEP 196608:OHf2j2V39hcAij4Xi3uDmTB+3w9jlxJVJI/59:OHqs9eAUUi3uV8xSz
TLSH
T1CFE68D26B665D165E89040B0AAADABDF112CB7381B3405C3A3DEAE5C7C745F33B32647
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9604432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\YoRHa\bin\ElementClient.pdb

yorha

ord10 ord58 ord27 ord60 ord13 ord29 ord15 ord18 ord53 ord2 ord31 ord48 ord26 ord40 ord8 ord55 ord42 ord28 ord39 ord23 ord19 ord47 ord20 ord5 ord41 ord17 ord52 ord22 ord7

elementskill

?GetName@ElementSkill@GNET@@SAPB_WI@Z ?GetIcon@ElementSkill@GNET@@SAPBDI@Z ?GetRequiredMoney@ElementSkill@GNET@@SAHIH@Z ?GetRequiredSp@ElementSkill@GNET@@SAHIH@Z ?Query@TeamState@GNET@@SAPBV12@H@Z ?IsGoblinSkill@ElementSkill@GNET@@SA_NI@Z ?GetType@ElementSkill@GNET@@SADI@Z ?IsOverridden@ElementSkill@GNET@@SA_NI@Z ?GetRequiredRealmLevel@ElementSkill@GNET@@SAHIH@Z ?GetRequiredLevel@ElementSkill@GNET@@SAHIH@Z ?GetMaxAbility@ElementSkill@GNET@@SAHIH@Z ?GetAbility@ElementSkill@GNET@@SAHI@Z ?IsMovingSkill@ElementSkill@GNET@@SA_NI@Z ?InitStaticData@ElementSkill@GNET@@SAXXZ ?GetInherentSkills@ElementSkill@GNET@@SAABV?$vector@IV?$allocator@I@std@@@std@@H@Z ?GetComboSkPreSkill@ElementSkill@GNET@@SAHI@Z ?NextSkill@ElementSkill@GNET@@SAII@Z ?GetRequiredBook@ElementSkill@GNET@@SAHIH@Z ?GetNativeName@ElementSkill@GNET@@SAPBDI@Z ?GetExecuteTime@ElementSkill@GNET@@SAHIH@Z ?GetVersion@ElementSkill@GNET@@SAHXZ ?GoblinCondition@ElementSkill@GNET@@SAHIAAUGoblinUseRequirement@2@H@Z ?LoadSkillData@ElementSkill@GNET@@SAXPAX@Z ?SetAbility@ElementSkill@GNET@@SAHIH@Z ?GetComboSkActivated@ElementSkill@GNET@@SAXABUComboSkillState@2@AAV?$vector@U?$pair@IH@std@@V?$allocator@U?$pair@IH@std@@@2@@std@@@Z ?SetLevel@ElementSkill@GNET@@SAHIH@Z ?PetLearn@ElementSkill@GNET@@SAHIAAUPetRequirement@2@H@Z ?LearnCondition@ElementSkill@GNET@@SAHIAAULearnRequirement@2@H@Z ?GetAbilityPercent@ElementSkill@GNET@@SAHI@Z ?Condition@ElementSkill@GNET@@SAHIAAUUseRequirement@2@H@Z ?Destroy@ElementSkill@GNET@@QAEXXZ ?Create@ElementSkill@GNET@@SAPAV12@IH@Z ?GoblinLearn@ElementSkill@GNET@@SAHIAAUGoblinRequirement@2@H@Z ?GetEffect@ElementSkill@GNET@@SAPBDI@Z ?Query@VisibleState@GNET@@SAPBV12@HH@Z ?GetCommonCoolDown@ElementSkill@GNET@@SAHI@Z

immwrapper

??0AMImmWrapper@@QAE@XZ ?Init@AMImmWrapper@@QAE_NPAUHINSTANCE__@@PAUHWND__@@PAD2@Z ?LoadImmEffect@AMImmWrapper@@QAE_NPADPAPAVAMImmEffect@@@Z ?ReleaseImmEffect@AMImmWrapper@@QAE_NAAPAVAMImmEffect@@@Z ?Start@AMImmEffect@@QAE_NXZ ??1AMImmWrapper@@QAE@XZ ?Release@AMImmWrapper@@QAE_NXZ ?Stop@AMImmEffect@@QAE_NXZ

ftdriver

?CreateFTManager@@YAPAVIFTManager@@HHH@Z

speedtreert

?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z ?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z ?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z ?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z ?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z ?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ ?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z ?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z ?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z ?GetDiscreteLeafLodLevel@CSpeedTreeRT@@QBEGM@Z ?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ ?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ ?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z ?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z ?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z ?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z ??0SGeometry@CSpeedTreeRT@@QAE@XZ ??1SGeometry@CSpeedTreeRT@@QAE@XZ ??0STextures@CSpeedTreeRT@@QAE@XZ ??1STextures@CSpeedTreeRT@@QAE@XZ ?SetLightState@CSpeedTreeRT@@SAXI_N@Z ?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z ?SetCamera@CSpeedTreeRT@@SAXPBM0@Z ?SetTime@CSpeedTreeRT@@SAXM@Z ?Authorize@CSpeedTreeRT@@SAXPBD@Z ?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z ?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z ?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z ?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ ?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z ??3CSpeedTreeRT@@SAXPAX@Z ??2CSpeedTreeRT@@SAPAXI@Z ??1CSpeedTreeRT@@QAE@XZ ??0CSpeedTreeRT@@QAE@XZ ?SetLodLevel@CSpeedTreeRT@@QAEXM@Z

d3d9

Direct3DCreate9

d3dx9_43

D3DXGetImageInfoFromFileInMemory D3DXCreateBuffer D3DXLoadSurfaceFromFileInMemory D3DXMatrixOrthoOffCenterLH D3DXSaveSurfaceToFileA D3DXCreateTextureFromFileInMemoryEx D3DXMatrixRotationAxis D3DXSaveTextureToFileA D3DXMatrixLookAtLH D3DXPlaneTransform D3DXMatrixInverse D3DXVec4Transform D3DXMatrixPerspectiveFovLH D3DXMatrixMultiply D3DXLoadSurfaceFromSurface D3DXGetImageInfoFromFileA D3DXAssembleShader D3DXMatrixShadow D3DXVec3TransformCoord

dsound

ord11

wininet

InternetOpenA InternetOpenUrlW InternetCloseHandle InternetReadFile InternetConnectA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA HttpQueryInfoA

shlwapi

PathFindExtensionA PathAppendW PathFileExistsW StrToIntW PathFileExistsA PathFindFileNameA

winmm

PlaySoundA timeGetTime

ws2_32

setsockopt htons recv connect ntohs socket send closesocket WSAStartup inet_ntoa gethostbyname WSAGetLastError inet_addr getsockname WSACleanup __WSAFDIsSet ioctlsocket bind sendto select

imm32

ImmSetCompositionStringW ImmNotifyIME ImmGetDescriptionW ImmSetCandidateWindow ImmAssociateContext ImmGetDefaultIMEWnd ImmGetCompositionStringW ImmGetConversionStatus ImmGetProperty ImmSetCompositionWindow ImmGetCandidateListA ImmGetIMEFileNameA ImmGetOpenStatus ImmIsIME ImmSetConversionStatus ImmGetCompositionStringA ImmGetCandidateListW ImmGetContext ImmReleaseContext

ddraw

DirectDrawCreate

zlibwapi

ord2 ord46 ord20 ord26 ord19 ord21 ord7 ord6 ord4

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

glu32

gluTessProperty gluTessEndPolygon gluDeleteTess gluNewTess gluTessBeginContour gluTessBeginPolygon gluTessEndContour gluTessVertex gluTessCallback

kernel32

GetSystemTimeAsFileTime GetStartupInfoW GetNativeSystemInfo WakeAllConditionVariable TryEnterCriticalSection WaitForSingleObjectEx InitializeConditionVariable SleepConditionVariableCS WakeConditionVariable FormatMessageA GetVersionExA CompareStringA GetLocaleInfoA lstrlenW IsDBCSLeadByte GetWindowsDirectoryA LocalAlloc MapViewOfFile CreateFileMappingW UnmapViewOfFile WinExec GlobalReAlloc GlobalFree GlobalSize IsDBCSLeadByteEx SetFilePointer QueryPerformanceCounter QueryPerformanceFrequency SleepConditionVariableSRW LoadLibraryExW MulDiv lstrcmpW lstrcmpiW FindResourceW LoadResource RaiseException SetLastError SizeofResource CreateSemaphoreW ReleaseSemaphore AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW LocalFree GetLocaleInfoEx EncodePointer InterlockedPopEntrySList OpenFile SetCurrentDirectoryW GetPrivateProfileStringA DuplicateHandle SuspendThread SetCurrentDirectoryA GetVersion GetCurrentDirectoryA GetPrivateProfileStringW QueueUserAPC WritePrivateProfileStringW SetThreadPriorityBoost InterlockedPushEntrySList VirtualAlloc VirtualFree LoadLibraryExA InitializeSListHead FindFirstFileW FindFirstFileExW FindNextFileW LCMapStringEx GetModuleFileNameA EnterCriticalSection GetCurrentProcess GetModuleFileNameW LeaveCriticalSection CreateFileW GetCurrentThreadId GetLastError GetCurrentThread CloseHandle LoadLibraryW GetProcAddress GetCurrentProcessId FreeLibrary lstrcpyW IsBadReadPtr GetTickCount GetCommandLineA GetFileAttributesA VirtualProtect InitializeCriticalSection WaitForSingleObject GetModuleHandleA LoadLibraryA CreateThread DeleteCriticalSection Process32First TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32Next ReadProcessMemory VirtualQueryEx lstrlenA GetVersionExW Sleep GetSystemInfo GlobalMemoryStatus HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime GetSystemTime DeviceIoControl CreateFileA GetModuleHandleW FlushInstructionCache CreateMutexW ReleaseMutex IsBadWritePtr MultiByteToWideChar WideCharToMultiByte OutputDebugStringW GlobalAlloc GlobalLock GlobalUnlock DeleteFileA InitializeCriticalSectionAndSpinCount ExitThread CreateEventW SetEvent GetCurrentDirectoryW DecodePointer InitializeCriticalSectionEx FindFirstFileA FindNextFileA CreateDirectoryA WaitForMultipleObjects GetExitCodeThread CopyFileA ResetEvent GetLocalTime GetFileSize ReadFile GetCommandLineW OutputDebugStringA CreateDirectoryW ResumeThread ExitProcess FindClose IsDebuggerPresent SetThreadPriority WriteFile CreateNamedPipeW CreateMutexA CreateProcessW ConnectNamedPipe K32GetProcessMemoryInfo GetDiskFreeSpaceA SignalObjectAndWait

user32

SetWindowLongA RedrawWindow SetTimer InvalidateRgn FillRect keybd_event DestroyWindow GetFocus CallWindowProcW GetMessageW GetWindowTextLengthW SendMessageA IntersectRect SetRect DestroyCursor LoadCursorFromFileA RegisterClipboardFormatW GetClipboardData CreateCaret GetKeyboardLayout SetCaretPos IsWindowUnicode EnumThreadWindows GetWindowDC CreateWindowExA WindowFromDC GetCaretBlinkTime GetDesktopWindow PostMessageA GetClassInfoExW GetForegroundWindow TranslateMessage LoadIconW SetCursor GetGUIThreadInfo BeginPaint EndPaint AdjustWindowRectEx GetSystemMetrics SetWindowLongW SystemParametersInfoW GetParent SetCursorPos CharLowerBuffW SetActiveWindow EnumChildWindows SendMessageW DestroyAcceleratorTable GetMenuBarInfo IsWindow GetWindowLongW IsWindowVisible SetWindowPos IsWindowEnabled FindWindowW GetClassNameW IsZoomed IsIconic GetWindowTextW GetActiveWindow GetAsyncKeyState wsprintfW GetClientRect ShowWindow PostMessageW ClientToScreen GetKeyState OpenClipboard CloseClipboard EmptyClipboard SetClipboardData ScreenToClient GetCursorPos PostQuitMessage SetWindowTextW EnumWindows GetWindowRect CallNextHookEx UnhookWindowsHookEx IsRectEmpty SetWindowsHookExW FindWindowA PtInRect GetWindowThreadProcessId RegisterWindowMessageW GetAncestor GetDC ReleaseDC DefWindowProcW MessageBoxA MessageBoxW IsChild GetWindow GetClassNameA GetWindowTextA GetTopWindow CreateWindowExW RegisterClassExW GetSysColor CreateAcceleratorTableW MoveWindow SetFocus CharNextW GetDlgItem UnregisterClassW KillTimer AdjustWindowRect LoadCursorW UpdateWindow SetForegroundWindow IsCharAlphaW GetCapture SetCapture ReleaseCapture FlashWindowEx ChangeDisplaySettingsW DispatchMessageW PeekMessageW InvalidateRect

gdi32

GetObjectW CreateDIBSection CreateSolidBrush DeleteObject GetStockObject PtInRegion CreatePolygonRgn GetGlyphOutlineW CreateEllipticRgn GetDIBits DeleteDC GetDeviceCaps CreateCompatibleDC SelectObject CreateCompatibleBitmap CreateFontIndirectW EnumFontFamiliesExW TextOutA CreateFontW GetTextExtentPoint32W SetMapMode ModifyWorldTransform SetGraphicsMode GetTextMetricsW SetTextColor SetBkColor SetTextAlign ExtTextOutW SetWorldTransform BitBlt

advapi32

OpenThreadToken OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation RegDeleteValueW RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW RegQueryInfoKeyW RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

Shell_NotifyIconW SHAppBarMessage ShellExecuteW ShellExecuteExA SHGetFolderPathW ShellExecuteA SHOpenFolderAndSelectItems

ole32

CLSIDFromString CoTaskMemRealloc OleInitialize CreateStreamOnHGlobal CoTaskMemFree OleLockRunning CLSIDFromProgID CoCreateInstance CoUninitialize CoInitialize CoInitializeEx CoGetClassObject OleUninitialize CoTaskMemAlloc StringFromGUID2

oleaut32

VariantCopy DispCallFunc SysStringLen SysAllocStringLen VarUI4FromStr SysAllocString VariantClear SysFreeString LoadTypeLi VariantInit LoadRegTypeLi OleCreateFontIndirect

msvcp140

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xlength_error@std@@YAXPBD@Z ?_Random_device@std@@YAIXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPBDH@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xinvalid_argument@std@@YAXPBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ _Cnd_signal ?__ExceptionPtrAssign@@YAXPAXPBX@Z _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPAX@Z ?__ExceptionPtrCopyException@@YAXPAXPBX1@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_function_call@std@@YAXXZ ?__ExceptionPtrToBool@@YA_NPBX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z _Mtx_lock ?__ExceptionPtrCurrentException@@YAXPAX@Z ?__ExceptionPtrRethrow@@YAXPBX@Z _Cnd_register_at_thread_exit _Cnd_wait _Mtx_unlock _Cnd_broadcast _Thrd_hardware_concurrency _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z

urlmon

URLDownloadToFileW

vcruntime140

__std_exception_copy _local_unwind4 __RTDynamicCast _purecall wcsstr _CxxThrowException _except_handler4_common __current_exception_context __current_exception memchr memmove memcpy memset _setjmp3 longjmp __std_type_info_name strchr wcsrchr wcschr __CxxFrameHandler3 __std_terminate strstr strrchr __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

_wfopen __stdio_common_vswprintf_s feof fgets _set_fmode fopen fclose fwrite __stdio_common_vsscanf __stdio_common_vsprintf fread __stdio_common_vswscanf fflush __stdio_common_vfwprintf __acrt_iob_func __stdio_common_vfprintf _fileno fputs _ftelli64 _popen _fseeki64 ungetc tmpfile setvbuf _pclose clearerr tmpnam ftell __stdio_common_vfscanf fseek __stdio_common_vswprintf freopen ferror getc __p__commode

api-ms-win-crt-convert-l1-1-0

_itow strtol strtoul wcstol _wtoi atof _itoa strtod atol atoi

api-ms-win-crt-string-l1-1-0

wcsncpy isspace isalpha _strnicmp _strlwr iscntrl _wcsicmp toupper _strupr wcsncpy_s strcoll wcsncat iswdigit strcat_s strtok wcscat_s isdigit strpbrk isupper tolower isxdigit ispunct islower _stricmp wcscpy_s strncat strcpy_s strcspn wcsncmp _wcslwr strncpy strnlen strncmp isalnum

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-runtime-l1-1-0

system abort _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm strerror _initterm_e _exit _cexit _c_exit _register_thread_local_exe_atexit_callback exit _initialize_onexit_table _register_onexit_function _beginthreadex _beginthread _crt_atexit _controlfp_s terminate _invalid_parameter_noinfo _errno _invoke_watson _resetstkoflw

api-ms-win-crt-time-l1-1-0

_time32 _time64 _localtime64 _localtime32 _gmtime64 strftime _mktime64 clock _difftime64 _mktime32 _gmtime32 asctime

api-ms-win-crt-heap-l1-1-0

calloc _recalloc realloc malloc free _set_new_mode

api-ms-win-crt-filesystem-l1-1-0

_findnext32 remove _findnext64i32 _findfirst32 _stat64i32 _access rename _mkdir _fstat64i32 _findclose _findfirst64i32 _rmdir _wremove _splitpath _stat32

api-ms-win-crt-math-l1-1-0

__libm_sse2_asin ldexp frexp __libm_sse2_asinf __libm_sse2_atan __libm_sse2_atan2 __libm_sse2_cos __libm_sse2_cosf __setusermatherr __libm_sse2_exp __libm_sse2_acosf ceil _CIsinh _CIfmod __libm_sse2_log10 _CIcosh __libm_sse2_pow _libm_sse2_log10_precise _libm_sse2_log_precise __libm_sse2_powf round _libm_sse2_sqrt_precise _isnan _libm_sse2_exp_precise _libm_sse2_pow_precise modf __libm_sse2_sin __libm_sse2_sinf __libm_sse2_acos __libm_sse2_tan _CItanh __libm_sse2_tanf __libm_sse2_log

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale setlocale

api-ms-win-crt-environment-l1-1-0

getenv

Name

.text

Size

9.5MB

Virtual Size

9.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.a3dext

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

214KB

Virtual Size

454KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

158KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

265KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

575KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=9, id=253, version=35207,

count=41, id=259, version=35207,

count=12, id=260, version=35207,

count=46, id=261, version=35207,

count=4, id=257, version=35207,

count=8, id=260, version=33145,

count=205, id=260, version=35221,

count=33, productName=Unmarked objects (old),

count=2, id=93, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=156, version=21202,

count=1, id=261, version=33145,

count=36, id=257, version=33145,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=9, id=257, version=35221,

count=949, id=1, productName=Unmarked objects,

count=1348, id=265, version=35221,

count=1, id=256, version=35221,

count=1, id=255, version=35221,

count=1, id=151,

count=1, id=258, version=35221,