zircon-0.10.0-win64.zip
- SHA256 0d8f4c70f7247d43ec7ddd23ca1c2473437dd02a1cf5f40b4c56321542bffe3f
Overview
overview
3Static
static
3zircon-0.1...LOG.js
windows10-2004-x64
3zircon-0.1...LOG.js
windows11-ltsc_2024-x64
3zircon-0.1...DME.js
windows10-2004-x64
3zircon-0.1...DME.js
windows11-ltsc_2024-x64
3zircon-0.1...LOG.js
windows10-2004-x64
3zircon-0.1...LOG.js
windows11-ltsc_2024-x64
3zircon-0.1...INS.js
windows10-2004-x64
3zircon-0.1...INS.js
windows11-ltsc_2024-x64
3zircon-0.1...ng.bat
windows10-2004-x64
3zircon-0.1...ng.bat
windows11-ltsc_2024-x64
3zircon-0.1...ua.dll
windows10-2004-x64
1zircon-0.1...ua.dll
windows11-ltsc_2024-x64
1zircon-0.1...ui.exe
windows10-2004-x64
1zircon-0.1...ui.exe
windows11-ltsc_2024-x64
1zircon-0.1...on.dll
windows10-2004-x64
1zircon-0.1...on.dll
windows11-ltsc_2024-x64
1zircon-0.1...on.exe
windows10-2004-x64
1zircon-0.1...on.exe
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
zircon-0.10.0/CHANGELOG.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
zircon-0.10.0/CHANGELOG.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
zircon-0.10.0/README.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
zircon-0.10.0/README.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
zircon-0.10.0/docs/ENGINEERING-LOG.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
zircon-0.10.0/docs/ENGINEERING-LOG.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
zircon-0.10.0/docs/PLUGINS.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
zircon-0.10.0/docs/PLUGINS.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
zircon-0.10.0/plugins/padding.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
zircon-0.10.0/plugins/padding.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
zircon-0.10.0/plugins/zircon_lua.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
zircon-0.10.0/plugins/zircon_lua.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
zircon-0.10.0/zircon-gui.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
zircon-0.10.0/zircon-gui.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
zircon-0.10.0/zircon.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
zircon-0.10.0/zircon.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
zircon-0.10.0/zircon.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
zircon-0.10.0/zircon.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target zircon-0.10.0-win64.zip
- Size 4.2MB
- Sample261107-vcsvmazwev
- SHA256 0d8f4c70f7247d43ec7ddd23ca1c2473437dd02a1cf5f40b4c56321542bffe3f
- MD5 f03ac27760ab029fbc11686d3e16c277
- SHA1 718f015a0fd73b7066d63c2ec556a2d988167cd0
- SHA512 dd89a9536f9847887f53f04087e49f5cdca03f3d84e0cdd3d9e2a54abdf842b9cd59871545cf79af444c6cc8e9ffa84d289b254311b9a4e8fbf19f8d57be319c
- SSDEEP 98304:I1Q34nl6dBWv0SDnGLf7pyXulIVDuIZSovd0Xxy:d3TBvunGpyulIVDuItvd0Xxy
- TLSH T13A1633F96FEC1E85D1313F39267D9D09EC0373A8046191F13A9894E4778E3AEE19AE44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/zircon-0.10.0/plugins/zircon_lua.dll unpack001/zircon-0.10.0/zircon-gui.exe unpack001/zircon-0.10.0/zircon.dll unpack001/zircon-0.10.0/zircon.exe
File Explorer
-
zircon-0.10.0-win64.zip.zip 4.2MB
-
zircon-0.10.0/CHANGELOG.md.js 88KB
-
zircon-0.10.0/CONTRIBUTING.md11KB
-
zircon-0.10.0/LICENSE11KB
-
zircon-0.10.0/NOTICE774B
-
zircon-0.10.0/README.md.js 78KB
-
zircon-0.10.0/docs/ARCHITECTURE.md9KB
-
zircon-0.10.0/docs/ENGINEERING-LOG.md.js 64KB
-
zircon-0.10.0/docs/IL2CPP.md26KB
-
zircon-0.10.0/docs/MONO.md7KB
-
zircon-0.10.0/docs/PLUGINS.md.js 9KB
-
zircon-0.10.0/docs/SCOPE.md7KB
-
zircon-0.10.0/docs/UE-Test.md25KB
-
zircon-0.10.0/plugins/csv.lua2KB
-
zircon-0.10.0/plugins/padding.lua.bat 4KB
-
zircon-0.10.0/plugins/zircon_lua.dll.dll 654KB
-
zircon-0.10.0/zircon-gui.exe.exe 2.2MB
-
zircon-0.10.0/zircon.dll.dll 2.6MB
-
zircon-0.10.0/zircon.exe.exe 2.4MB
zircon-0.10.0/CHANGELOG.md
- SHA256 89c89858c20f1f9670bdc15165ece8257d0b18348acdb40c3b1f28b6ffb56644
- MD5 e599384c67b01fda8fc0c228451f678d
- SHA1 1ff3277c6e8a1dfcf67f257583cc42df774501a0
- SHA512 eacd21a1a92328bed00c2826581d50ad8377a40e456e5e6b599f3ecad545f974aaf35b68874a5758ae008c3256b5e272f619e6fda2e24a0e4a1c1a76918381ec
- SSDEEP 1536:EnK+ycUUjdIqpQ873qN/LkpCQn3bqugf7AJiPkMChr0JEKF:i6cBjaqO8DY/LOHMc8
- TLSH T14393D827734853760EE301B5A30E72DADB29C1B973226A7074AF816D331647D827B7E5
- MD5 SHA1 SHA512 SSDEEP TLSH
zircon-0.10.0/CONTRIBUTING.md
- SHA256 d14c075353e81720eaaaf347f36a0d420eba04d3ae2597be4dc79027d264c27e
- MD5 f01be97de23db98b85c817a5554ac9a2
- SHA1 98ab720cbf87769b5cc13da91586d4420cb639bb
- SHA512 077b6cb9cae2f7a46886a35868588925093d6e7805a81d645c6ffb2dc78db5d589bbad6e416b0a03cee8c6c2f3538fe22ef34b1db244848989010615e2ea8cd9
- SSDEEP 192:sl3e+q6YJ1tuj0PbIr1ew9PRg2//pBMl0mP/EEYfUImVDkzgnK+DChH9RSSr+YuH:sV1gJU0PbXwg2//pBVfU/V4zguHRJ7Kl
- TLSH T16142C76B634A437605B20266924D72CEE335C0FD27356930B59FE1AD3321474633EADE
- MD5 SHA1 SHA512 SSDEEP TLSH
zircon-0.10.0/LICENSE
- SHA256 561e22b9ae78454fd4c971585b3d270c3040ea36e18d6bd50e72f27fe6b35ded
- MD5 a34e5f6051413de1daf7bf34653ebf91
- SHA1 d76858e518ffc5cbba168914d7e67d387bddf7c1
- SHA512 d278d388019751323486b177519f9707da1b5e349934dce5623a8b96b84f47506654e9094157ffa8d6162cfecee67cbb7fb9fbc691b98cd5a748f8795f43cc00
- SSDEEP 192:tU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEw7HbHR:G9vlKM1zJlFvmNz5VrlkTS77Ht
- TLSH T11C32523FBA48037706C20162BB9764CBF21E903F3B552568354CD1681F6BA6543FB6EA
- MD5 SHA1 SHA512 SSDEEP TLSH
zircon-0.10.0/NOTICE
- SHA256 c623ee18a2fe8a8b4abf42ae0d5987ba8d24fcd4ca5cdcb5c127f7a3e5dfa35d
- MD5 89f0d21d32a5a492a59a54dfa9a6da1d
- SHA1 d2e905ce43239005488efe6a3946790d6cb1a1cd
- SHA512 df9420091d9f0c0eeeafff3de1656c46891de9890f41a68c6d05af71a1f79fc1cb05a820a39652222d6614bcaa3bffe48b94af5be53296ef07e1cd416ebd6839
- TLSH T10001DD7C2C6829730A40FC59CD02FA9BE76A900D2BEBD0319A1450AD756E00957CC131
- MD5 SHA1 SHA512 TLSH
zircon-0.10.0/README.md
- SHA256 69149a44d151858b9689830b91478961929bc87f783db63033c87cc0f0badd0c
- MD5 eebdf260e0e9bc16401e70f63b21f7a1
- SHA1 fbfde0e198606749980dcb385bbd9ce68c58a6aa
- SHA512 7d56389daa3e4b8df869bdb8bb52f10ebadc002a3e58046348643464fc42dfb425d7787a63d6e72000a7f738cca785c53feb3e144eb649fec0b2346cdcdf490c
- SSDEEP 1536:n4my60vd2weBiey2pTFseVqGJgmqUFy/KhsvtMSvjdHvFhS:n4plmikic7Hmt8
- TLSH T167833B57A316937B05B34272A30E70C6E714C06D27222C7578DEC16D373AA6C527EAEE
- MD5 SHA1 SHA512 SSDEEP TLSH
zircon-0.10.0/docs/ARCHITECTURE.md
- SHA256 9d8e5d219344dec31f515b8fe4e1de6c7a37b43236aa4c154dd8163c9574bbb4
- MD5 b677f75aa6c12794e30f56ccc6c1cb8b
- SHA1 1551a798464d6591313c9355ef7cfd53f39a2632
- SHA512 112b7d3c6e1b9faa17197392f520779eafa25be3022a2adec308a9735b846a2e96968666b4be93e5e532f2d267969c4f0029d1fd596a498d62c86d8a5be1fe8c
- SSDEEP 192:A/LWkki71NEJXCosakqva3XLJ6V3x08/4rbNp3bFz4XzDsYGT:A/nkUNmXCosaZvYLJ6V3x0E6bX3bFODu
- TLSH T188223C57631593B64AA30161A70F61C7DB14817A373A28B0745FC23D3B0A8B8C6777DD
- MD5 SHA1 SHA512 SSDEEP TLSH
zircon-0.10.0/docs/ENGINEERING-LOG.md
- SHA256 2aed6669f29c679372526ac6ed20ff9c8c5b22e1b8eb475452aba7439e8e4c2a
- MD5 4291ad1929695b0e898b22bcb3f12099
- SHA1 05b44f7c5c33720f9cb6d3b9ee886fdec199af77
- SHA512 51d2fd2eef74bd57bcf2c552a75ac70bd263d88c58deaa738d40d891783bd11c387fe54594a95e48cea27b758be9a6b7c6f2730aae0c8453311f66e594e7aa79
- SSDEEP 768:5TfPm174os09FXxr4G0LUR22sQ0UUP+KBfmxVBNx8SJqkff+Ntwf97fXiin1J1b8:5zPm17RPtEHXL+KQxVBNx8GAW7VlEQU
- TLSH T18A53F727A30A937509F302A1A30E71DAE715C0B853766970B49ED2AD33164BC877F6DE
- MD5 SHA1 SHA512 SSDEEP TLSH
zircon-0.10.0/docs/IL2CPP.md
- SHA256 65eaf1cee8f8ef1b32430abf8f8a6b5cdb70b36c7556cd7563c5572a28fbfc46
- MD5 dc39d58e006d8b0de73cba408f8083ed
- SHA1 d3f1dded2a4cde17f3da530105a6d472d5d1f77f
- SHA512 d6da0c43450fb1ad3b5a4bd9d2907dbed08628128704ebe7e84ed2d2005d311d1f7068df92d85ab995b9cb807cc9f627b282acf84969303e304a7c8e9d232ed6
- SSDEEP 384:Wrag1EeDkeNAZ9P7SCZ7gnp+W85aEvdff4qyJ0wS4PKyupOrBXpq9QO/WPSmRWG5:voD5QT/xQqMXjgN/cSmRBYFmeO7VCi
- TLSH T194C2E7A7774453330DA34271A20EB6DAEB25C1B523266970BC9EC03D33265B9473B7E1
- MD5 SHA1 SHA512 SSDEEP TLSH
zircon-0.10.0/docs/MONO.md
- SHA256 bd13f4c551a54ee23397ba3084c103e2f1280a269e5480805ee53afc47b82d8c
- MD5 3184b70538cbf76a6ad42c8eaf86552b
- SHA1 db806e4ca08880942d7141338b382002e2c90f0d
- SHA512 71179766d6545909ef79be087c11735db7bbe2314f1e0e288c6b15bac4a5e7f57e273dba51b8936409369c10bb2f692b53d1c092c009e95392a982a1dab01473
- SSDEEP 96:IaLYXeMew9TyeXnH5VUBeLwX3lg3GAlRs3Y4chgUrOSNuF4fo8db6gYOa8LH/leo:DLYqeXH5VAe3CJcFrxou8PQflyytAsT
- TLSH T11EF1E6172B08133E0A5281275F0F71DBD72E836896521CA4B8BFC03DB322A9D117FAE4
- MD5 SHA1 SHA512 SSDEEP TLSH
zircon-0.10.0/docs/PLUGINS.md
- SHA256 ac71b87c19f023cb298611787b373e472d91bdd6b96aa07c7bd86d1b561e6e97
- MD5 a83d0a191844acaa9ad851e2cfa57f64
- SHA1 d71c73accfce33352a6674cec9158366316d9772
- SHA512 58494a802f42199ace12ace4db15e040bdab2f76f2fd1e194f60c8ac337eda75e3f71f941440d791333b0e6356c93630e6a20ff7772a05d2975e04f1fe013ea6
- SSDEEP 192:GU4Jwo9rX4nGsoKKUyIzp0GtWHigZ+JJUlsIyrHgj3HTJ6HWedHtGrg0NaFlPb:GU4JTroGXKPdtWHB8JJ9Lr0V69XbFlD
- TLSH T15E2209136794633211E74460630CE0D8EB6CD1FB332176B1BB9D42A43B1A269D1BBEE4
- MD5 SHA1 SHA512 SSDEEP TLSH
zircon-0.10.0/docs/SCOPE.md
- SHA256 20e948322362ccdf39d2f8276c4780318748647e94f5f31ed9acf35a60783957
- MD5 cb4a1c98584404c4133869f6290606bb
- SHA1 08b51b290d6cdc3cebcbcf30c0afceb55ab41d7a
- SHA512 92c887ec100d5c3e3c60d54df90a170cd0b59ac08d87c8b23a5ae857c438c3d2b16d000b493294f027df2a171104fa70aaed9fc1ef2cf474c4a9f1b23de69ca8
- SSDEEP 192:7Z3sWzeQdgaQ6OW11t72EguBp0BGDhv/L3/75SPu:7oh6OW11tUap0Bq3b/7yu
- TLSH T169F1E957A730A3B106B103669F1A70D6E729805953591803FCEFA22832187AD977BEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
zircon-0.10.0/docs/UE-Test.md
- SHA256 56d9c30becb07ab849a5f4e5789cf49da286c969b3210cefb177a0fb33e146d7
- MD5 2b6dcdae55221cd0bf20aa9c06257522
- SHA1 80286e154a6f481b8bd231136cad342988260133
- SHA512 c4ef3d06cbd63611b24fc70cb4d89fc2f34fcef24fa8e42bc71e0d8d2ba7d43c7314c46861aec62d46253c9e4e16134ee3ceb03e97e6684fdc918ff3446b3fa6
- SSDEEP 384:GvDYCqjKvlQ9ealoaVVjlVE82t10qWYk2Qw9jRFQEuQKeQhi5+Wzym9tlytD2MOM:GiDZldVjly8tqdD9jTQUSw+QVyoZu7em
- TLSH T1CCC21A276306A7FA0AF78260620931DBE318C07423767979B44ED59C335296D4B3F7EA
- MD5 SHA1 SHA512 SSDEEP TLSH
zircon-0.10.0/plugins/csv.lua
- SHA256 7a020b1874cab36b08b406d4caa594af7c0f7acbadb4202e881c607fc5492ca3
- MD5 12b894fc91e64e451057e81028082a8c
- SHA1 b48d2886534da5b5158ae2031c567622c7fa60bf
- SHA512 520d9acc6abb1b8727cee5dc9dca4f2ed77cef01bf7079353bb9d4b8ac29c5ab4a14cdad84489b045df35df20252641ea4c8aa0edf1ce37f3ea58ed48bcbb997
- TLSH T18841630EB652A7E063C188305E469586FB5C7522621413C1B3EF43623B1EB3A40BBF79
- MD5 SHA1 SHA512 TLSH
zircon-0.10.0/plugins/padding.lua
- SHA256 b22e512c58c715d9964f406d0c310870dfc02aa286083b2ab347b7c4de2a2edc
- MD5 9e6fa555c1d3f81eb83cd02a6c965638
- SHA1 f0b4cbe3d8d401859f95d3e9ccf6d9d6c971db42
- SHA512 25d3080fb077d89e22205cec425b3ed93c01baea06d6c748c517da3ec18518b03959baec17013000d7304eba829550f8efaeb24e448690e321f0689a05b58752
- SSDEEP 96:v/ftsQFPzUs494hwSRXGU0r/b7QnYJo3gsYjBD4dCWXvmSZ0auv+B:vHtsQBzL4mhwSR2U0r/b8nqo3VYjBDmv
- TLSH T190A1820BA3891AF016C30091E9C71998F755A137269855BA37DF430C3F1CE9E52F2AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
zircon-0.10.0/plugins/zircon_lua.dll
- IMPHASH efa37d8fcde2f05aa1ad658306bda9e3
- SHA256 9f09ab8f8c3da5bf3ae1a6356bfbf1f488f615b9b20bcd1365c5e3514def36f1
- MD5 15f91849527410ae02bfc8aeb784dc2b
- SHA1 ba2a7ca68d71323c9eb24aa75bc914a020e41674
- SHA512 96c6ab4fbfd44994c2df91dba7de310c534ab01b083b8e0c1918744dca6018331db020fe21814aa57741dc673fed6a4ab76ad1235de3b0a05290322d2183d0e1
- SSDEEP 12288:d7qJcawOlsjgcyRoSIdTOtLJEbvUoklUl3EUOFScoB2:IJcanlsWRk1OtLbxQ5O43B2
- TLSH T177E4AD59B2B807A8D8B7813889634607E6F2782507B09BEF13E157B72F237E0567B711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
192260
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
FindClose
FindFirstFileA
FindNextFileA
GetLastError
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadLibraryExA
FormatMessageA
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
QueryPerformanceFrequency
ReadFile
CloseHandle
DuplicateHandle
CreateProcessW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
HeapReAlloc
GetCPInfo
GetFileSizeEx
SetFilePointerEx
WaitForSingleObject
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
CreateFileW
GetTimeZoneInformation
MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
MoveFileExW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetStringTypeW
SetStdHandle
HeapSize
SetEndOfFile
zircon_plugin_main
Name
.text
Size
383KB
Virtual Size
382KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
108KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
133KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=207, id=261, version=33140,
count=31, id=260, version=33140,
count=22, id=259, version=33140,
count=1, id=253, version=35207,
count=12, id=259, version=35207,
count=17, id=260, version=35207,
count=34, id=261, version=35207,
count=3, id=257, version=33140,
count=108, id=1, productName=Unmarked objects,
count=33, id=260, version=35216,
count=1, id=256, version=35216,
count=1, id=255, version=35216,
count=1, id=151,
count=1, id=258, version=35216,
zircon-0.10.0/zircon-gui.exe
- IMPHASH dab4db5c271921eec1ca71b8237e28f9
- SHA256 01aafb8e823b0c0ec33e9a4abaef18f464f4b7ca05b0da1c1eb559f4697f5c05
- MD5 811c7f47e2076dd895bfcb93104ee0b7
- SHA1 1d624c227998b1a9b13e81b092fb35201e64db6f
- SHA512 d1a3943197c979bb02dc0daec58e695cda9b4bfb95b6745c4389ab1f8938b8070d3e50ab7c16d41e0c4d1ec35602f7ef3b74122dbc69943f51144b9121f18627
- SSDEEP 49152:piXuENPHSvyxdGWo3bQeDqCd2me4znIHfB:iB
- TLSH T149B58D27629811FCD0B7C1798E4A9D07E732740A0371AAEF27E446A11F676E05FBE712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1419268
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
winhttp
WinHttpSetTimeouts
WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
kernel32
GetOEMCP
GetACP
LocalFree
lstrcmpiW
GetLastError
Sleep
GetWindowsDirectoryW
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryW
WideCharToMultiByte
GetCurrentProcessId
GetModuleFileNameW
CloseHandle
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
VerSetConditionMask
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
LoadLibraryA
GetLocaleInfoA
GetEnvironmentVariableA
SetFileAttributesW
FormatMessageA
OpenProcess
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
IsWow64Process
QueryFullProcessImageNameW
Process32FirstW
Process32NextW
WaitForSingleObject
GetCurrentProcess
CreateRemoteThread
GetExitCodeThread
VirtualAllocEx
VirtualFreeEx
K32EnumProcessModulesEx
K32GetModuleBaseNameW
GetCommandLineA
GetConsoleMode
IsValidCodePage
HeapReAlloc
DeleteFileW
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
HeapAlloc
HeapFree
ExitProcess
WriteFile
ReadFile
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwindEx
RaiseException
RtlPcToFileHeader
TerminateProcess
SetStdHandle
GetProcessHeap
HeapSize
SetEndOfFile
WriteConsoleW
GetStdHandle
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
GetCurrentThreadId
RtlUnwind
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
SetFileInformationByHandle
GetTempPathW
AreFileApisANSI
GetFileInformationByHandleEx
GetStringTypeW
SleepConditionVariableSRW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WakeAllConditionVariable
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
LCMapStringEx
GetCPInfo
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
user32
PeekMessageW
RegisterClassExW
PostQuitMessage
DispatchMessageW
TranslateMessage
UnregisterClassW
DefWindowProcW
CreateWindowExW
MonitorFromWindow
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetClientRect
ReleaseDC
GetDC
GetForegroundWindow
IsWindowUnicode
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetMessageExtraInfo
TrackMouseEvent
GetKeyboardLayout
EmptyClipboard
DestroyWindow
SetClipboardData
CloseClipboard
OpenClipboard
LoadImageW
LoadCursorW
MessageBoxW
UpdateWindow
GetSystemMetrics
ShowWindow
GetClipboardData
gdi32
GetDeviceCaps
shell32
ShellExecuteA
SHGetKnownFolderPath
CommandLineToArgvW
ole32
CoTaskMemFree
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
456KB
Virtual Size
456KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
133KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33140,
count=33, id=260, version=33140,
count=23, id=259, version=33140,
count=10, id=259, version=35207,
count=17, id=260, version=35207,
count=100, id=261, version=35207,
count=1, id=262, version=33140,
count=21, id=257, version=33140,
count=253, id=1, productName=Unmarked objects,
count=59, id=261, version=35216,
count=1, id=255, version=35216,
count=1, id=151,
count=1, id=258, version=35216,
zircon-0.10.0/zircon.dll
- IMPHASH 0e47d69dff76d28dcf34534f854a97c0
- SHA256 6ac9483b79b5ece2cec69a4e904727e8a3a529a1dede91d81364a767fbe6b3af
- MD5 21d04fe3060de9e7eae524bbb0ce43a1
- SHA1 2e891022e3e584a7065e247c1236985ec56cee5d
- SHA512 7c5967e86292d0053a9426af60bae05e8064595abb79686bd7d08f6e4b306c61e9cb14c72eaf6075df99f10216a3ad001c13a9fd491864d2abfa298494a7ae97
- SSDEEP 49152:UdCjZrvsAXYrL8u8jvX/ZP2BMu9/eOXh5zMen7reTKnqQYMtB:JB2/J/BB
- TLSH T1D5D58D2B669401ECD0BBC1B98F4B9D47E732700A037069EF17E455A25FA7AF05A3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1659888
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
Module32NextW
GetLastError
GetWindowsDirectoryW
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryW
WideCharToMultiByte
CreateFileW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetStdHandle
GetConsoleMode
SetConsoleMode
VirtualProtect
VirtualQuery
OpenProcess
IsWow64Process
QueryFullProcessImageNameW
Process32FirstW
Process32NextW
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
LocalFree
FormatMessageA
WaitForSingleObject
GetCurrentProcess
CreateRemoteThread
GetExitCodeThread
VirtualAllocEx
VirtualFreeEx
K32EnumProcessModulesEx
K32GetModuleBaseNameW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
VerSetConditionMask
QueryPerformanceCounter
CreateThread
GetModuleHandleA
Module32FirstW
GetLocaleInfoA
GetCurrentProcessId
Sleep
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetEnvironmentVariableA
WriteConsoleW
SetEndOfFile
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
DeleteFileW
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
CreateToolhelp32Snapshot
SetConsoleTitleW
FreeConsole
AllocConsole
FlsAlloc
HeapFree
HeapAlloc
GetModuleFileNameW
FreeLibraryAndExitThread
DisableThreadLibraryCalls
LoadLibraryA
GetCurrentThreadId
QueryPerformanceFrequency
CloseHandle
ExitProcess
ReadFile
ExitThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
RtlUnwindEx
RaiseException
RtlPcToFileHeader
InitializeSListHead
TerminateProcess
IsProcessorFeaturePresent
GetLocaleInfoEx
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
SetFileAttributesW
SetFileInformationByHandle
GetTempPathW
AreFileApisANSI
GetFileInformationByHandleEx
SetLastError
LoadLibraryExW
GetStringTypeW
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
LCMapStringEx
WakeAllConditionVariable
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
RtlUnwind
user32
TranslateMessage
PeekMessageW
DefWindowProcW
PostQuitMessage
UnregisterClassW
GetAsyncKeyState
CreateWindowExW
DestroyWindow
ShowWindow
GetSystemMetrics
UpdateWindow
MessageBoxW
LoadCursorW
LoadImageW
DispatchMessageW
RegisterClassExW
OpenClipboard
MonitorFromWindow
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetClientRect
ReleaseDC
GetDC
GetForegroundWindow
IsWindowUnicode
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetMessageExtraInfo
TrackMouseEvent
GetKeyboardLayout
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
gdi32
GetDeviceCaps
shell32
ShellExecuteA
SHGetKnownFolderPath
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
winhttp
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpQueryDataAvailable
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
ole32
CoTaskMemFree
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
zircon_find_object
zircon_process_event_index
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
504KB
Virtual Size
503KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
133KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33140,
count=33, id=260, version=33140,
count=23, id=259, version=33140,
count=10, id=259, version=35207,
count=15, id=260, version=35207,
count=96, id=261, version=35207,
count=1, id=262, version=33140,
count=23, id=257, version=33140,
count=265, id=1, productName=Unmarked objects,
count=72, id=261, version=35216,
count=1, id=256, version=35216,
count=1, id=255, version=35216,
count=1, id=151,
count=1, id=258, version=35216,
zircon-0.10.0/zircon.exe
- IMPHASH d1160d9d21d1914e01696b58e8b443eb
- SHA256 62d7bc8c713b1d0d830bd3d3e296310becfe93676052fedb7f484c002055e860
- MD5 3edbcfdc81ca5fb08f67f5d1939e4da1
- SHA1 262b677652b35f1906989a97819eee6b02e1e270
- SHA512 e754ad036e54bb5f483b16cbfe27d6f4d02202c26423626bc398447e3d19110008eafacfefbbcaac582201441591e48b1119ebb8be40638f6914271559bca7d3
- SSDEEP 49152:99yx1OWoLHZlYKfeNSmigrU3ol3FP+WFqCmoyefAcGOB:KyClqFaGOB
- TLSH T161C55B3A629401ECD0BAC1B9CF4A9D43EB32740A03B169FF1AD455A26F675E05B3E713
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1636556
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
winhttp
WinHttpOpen
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpConnect
kernel32
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetEnvironmentVariableA
GetDriveTypeA
CloseHandle
GetLastError
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
OpenProcess
GetModuleFileNameW
CompareStringOrdinal
GetStdHandle
GetConsoleMode
SetConsoleMode
FreeLibrary
GetProcAddress
LoadLibraryW
SetFileAttributesW
GetModuleHandleW
LocalFree
FormatMessageA
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
GetProcessHeap
Module32NextW
WaitForSingleObject
GetCurrentProcess
CreateRemoteThread
GetExitCodeThread
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
IsWow64Process
K32EnumProcessModulesEx
K32GetModuleBaseNameW
QueryFullProcessImageNameW
Process32FirstW
Process32NextW
GetCurrentProcessId
VirtualProtect
VirtualQuery
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
CreateFileW
GetFileSizeEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
HeapReAlloc
DeleteFileW
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
ReadFile
GetConsoleOutputCP
HeapSize
WriteConsoleW
SetEndOfFile
Module32FirstW
QueryPerformanceCounter
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
SetFileInformationByHandle
GetTempPathW
AreFileApisANSI
GetFileInformationByHandleEx
GetLocaleInfoEx
RtlUnwind
QueryPerformanceFrequency
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetCPInfo
WakeAllConditionVariable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
user32
SendMessageTimeoutW
shell32
SHGetKnownFolderPath
ShellExecuteA
ole32
CoTaskMemFree
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
480KB
Virtual Size
480KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
133KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=176, id=261, version=33140,
count=19, id=260, version=33140,
count=8, id=259, version=33140,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=98, id=261, version=35207,
count=1, id=262, version=33140,
count=13, id=257, version=33140,
count=196, id=1, productName=Unmarked objects,
count=67, id=261, version=35216,
count=1, id=255, version=35216,
count=1, id=151,
count=1, id=258, version=35216,