Relay-Windows-Real.zip
- SHA256 f32d3fb9db2233033a984bb1bd0938fdddd47ebfec5c26f737fcc339e68c28ec
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Relay-Windows-Real/Relay.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Relay-Windows-Real/Relay.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target Relay-Windows-Real.zip
- Size 15.7MB
- Sample261113-pg53vsvw7m
- SHA256 f32d3fb9db2233033a984bb1bd0938fdddd47ebfec5c26f737fcc339e68c28ec
- MD5 f70b3b690c7605d49b3a8715a9fe735e
- SHA1 d8277e4aeb342e11e6d1ddd988e213dfcf7c3084
- SHA512 38dd876113347db4f85f977dfb5cdba389df8c4669d7ffca0fa090867c11a0f58eb82c856d7b2106dd239360ade85ebf7dc84b2ec10e9ea5d70ab6646c5c9bf4
- SSDEEP 393216:HthhDYejV2GLG4A27rdjOadzSlNrngD0Qbz1EWt5tn12KqKF:7b/LGS7rtOWWNEwMVXEKqKF
- TLSH T194F633E4599070C9D72BE152E19F52ED568B40FFFD0C0407A611958ABEC5CBCA8F2E72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Relay-Windows-Real/Relay.exe
File Explorer
-
Relay-Windows-Real.zip.zip 15.7MB
-
Relay-Windows-Real/LICENSE-Syncthing.txt16KB
-
Relay-Windows-Real/README-Windows.txt4KB
-
Relay-Windows-Real/Relay.exe.exe 4.5MB
-
Relay-Windows-Real/SHA256SUMS156B
-
Relay-Windows-Real/syncthing.exe.exe 33.2MB
Relay-Windows-Real/LICENSE-Syncthing.txt
- SHA256 9221c2f936159b8446d329249fb4c0f25be510f447383a0f13336ac7985668a3
- MD5 8761d7bce160c25d9b2f1d0a72ad89a4
- SHA1 f23e533c04aebff9478663e00ba16f5717a682f9
- SHA512 62fd20d81677dfafe6d5fdac46ec4a65dfe19c0bdfe667bd065f097a666acf10df9ae9aaeaf7eeeabfe7d301af89f1640e90109a04ee3f2fc045f613d3418aea
- SSDEEP 384:njK80R6A5Xgao4Oy4ji4GNdUrw9j4cCg9kcjTPoBt:nmjR15XZFFUuj4cCg9kc3Poz
- TLSH T18F7252BE3F4A1F320AD2C2515B07A4DBF31AA13965691074309CB12C27BF96543BF6AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Relay-Windows-Real/README-Windows.txt
- SHA256 ff4e8c80a7065b2126d2d960d56a95f7d66615627c67634d0a22aedcc0bdc9de
- MD5 565bb5a3cc842e2f9c6884ffd6de6824
- SHA1 cd4de10e9586b0eb180d6bd40ff1f7c868196120
- SHA512 310995e1805665e3abc8b5cb6d24398cf51ba6d080e01386e955d8188ab2049099b54014fe9fdf9e6b2778f81de227909f165d6c15c09374fe12cd414203ed0f
- SSDEEP 96:H8u9L0cMD8RJZPnMtc00k47BqSoSHgTGuMYktBARGFtdEz/97gbCh/:cu9L+MBMtIk47sZ5rQBA0Fji/9gw
- TLSH T129A194A77D0A43B349F2E120824DA79BE30EC19D52595135786E52CC3B2016B9BFF1D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Relay-Windows-Real/Relay.exe
- IMPHASH 6a953c4a6f73e4b3c4df04f5f10f57a3
- SHA256 861769d71f5c0b59231d8620d8f94cfb5a44994c5bf06c00c206cd81636af1d9
- MD5 9d1b7905f6bf23756a88598218f1ed1f
- SHA1 d160be413cb54b32bdff192c1a2a364f620eb613
- SHA512 4b6c7a078703f44c17b40341fcd59acba16fe4eed048fae312d762a43d23a4b2dcc148d7cf84004923d8e15751ca3537184fb5ea959d1874819d1c65874b6644
- SSDEEP 49152:FhGg3nLOuOWeJr+Iqxc9ybmvv/bD9QcxShjr0NAE+MFFAP123ZT3ST7uV48vfV0G:FhB/n6jTvrqcW0NfDLdl+
- TLSH T1C9268D43F29541EDC05FC1B8874B9632FA36B88A0920B5EF26D857302F76F905B1EB59
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
441456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
RegGetValueW
SystemFunction036
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
bcrypt
BCryptGenRandom
dwmapi
DwmEnableBlurBehindWindow
DwmSetWindowAttribute
imm32
ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
kernel32
AddVectoredExceptionHandler
CancelIo
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreatePipe
CreateProcessW
CreateThread
CreateToolhelp32Snapshot
CreateWaitableTimerExW
DeleteCriticalSection
DeleteProcThreadAttributeList
DeviceIoControl
EnterCriticalSection
ExitProcess
FlsAlloc
FlsFree
FlsSetValue
FormatMessageW
FreeEnvironmentStringsW
GetCommandLineW
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetOverlappedResult
GetProcessHeap
GetProcessId
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitializeCriticalSection
InitializeProcThreadAttributeList
IsThreadAFiber
LeaveCriticalSection
LockFileEx
MapViewOfFile
Module32FirstW
Module32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReadFileEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlRestoreContext
RtlUnwindEx
RtlVirtualUnwind
SetCurrentDirectoryW
SetEnvironmentVariableW
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SleepEx
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnmapViewOfFile
UpdateProcThreadAttribute
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WriteFileEx
GetTimeZoneInformationForYear
CloseHandle
CompareStringOrdinal
CopyFileExW
CreateSymbolicLinkW
DeleteFileW
DuplicateHandle
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetConsoleMode
GetConsoleOutputCP
GetConsoleWindow
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetLogicalDrives
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimePreciseAsFileTime
GetTempPathW
GetWindowsDirectoryW
LoadLibraryA
LoadLibraryW
MoveFileExW
MultiByteToWideChar
QueryDosDeviceW
ReadConsoleW
RemoveDirectoryW
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetStdHandle
UnlockFile
WideCharToMultiByte
WriteConsoleW
lstrlenW
__C_specific_handler
ntdll
NtCreateFile
NtOpenFile
NtReadFile
NtSetInformationFile
NtWriteFile
RtlNtStatusToDosError
NtCreateNamedPipeFile
ole32
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize
OleInitialize
RegisterDragDrop
RevokeDragDrop
shell32
SHCreateItemFromParsingName
DragFinish
DragQueryFileW
SHGetKnownFolderPath
SHGetStockIconInfo
Shell_NotifyIconGetRect
Shell_NotifyIconW
user32
CloseTouchInputHandle
GetTouchInputInfo
RegisterTouchWindow
AdjustWindowRectEx
AppendMenuW
ChangeDisplaySettingsExW
ChangeWindowMessageFilterEx
CheckMenuItem
ClientToScreen
ClipCursor
CreateAcceleratorTableW
CreateIcon
CreateIconIndirect
CreateMenu
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DestroyAcceleratorTable
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageW
DrawIconEx
DrawMenuBar
DrawTextW
EnableMenuItem
EnumDisplayMonitors
FillRect
GetActiveWindow
GetAsyncKeyState
GetClientRect
GetClipCursor
GetCursorPos
GetDC
GetKeyState
GetKeyboardLayout
GetKeyboardState
GetMenu
GetMenuBarInfo
GetMenuItemInfoW
GetMonitorInfoW
GetRawInputData
GetRawInputDeviceInfoW
GetSystemMenu
GetSystemMetrics
GetWindowDC
GetWindowLongPtrW
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
InsertMenuW
InvalidateRgn
IsIconic
IsProcessDPIAware
KillTimer
LoadCursorW
LoadImageW
MapVirtualKeyExW
MapVirtualKeyW
MapWindowPoints
MessageBoxW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MsgWaitForMultipleObjectsEx
OffsetRect
PeekMessageW
PostMessageW
PostQuitMessage
RedrawWindow
RegisterClassExW
RegisterClassW
RegisterRawInputDevices
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemoveMenu
ScreenToClient
SendInput
SendMessageW
SetCapture
SetCursor
SetForegroundWindow
SetMenu
SetMenuDefaultItem
SetMenuItemInfoW
SetTimer
SetWindowDisplayAffinity
SetWindowLongPtrW
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowTextW
ShowCursor
ShowWindow
SystemParametersInfoA
ToUnicode
ToUnicodeEx
TrackMouseEvent
TrackPopupMenu
TranslateMessage
ValidateRect
VkKeyScanW
ws2_32
GetHostNameW
WSADuplicateSocketW
WSAGetLastError
WSARecv
WSASend
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
recvfrom
select
send
sendto
setsockopt
shutdown
bcryptprimitives
ProcessPrng
comctl32
DefSubclassProc
RemoveWindowSubclass
SetWindowSubclass
gdi32
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
GetDeviceCaps
SelectObject
SetBitmapBits
SetBkMode
SetTextColor
userenv
GetUserProfileDirectoryW
uxtheme
SetWindowTheme
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
_cexit
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_exit
_initialize_narrow_environment
_initialize_wide_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
fflush
fwrite
api-ms-win-crt-string-l1-1-0
strlen
strncmp
wcslen
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_tzset
_GCC_specific_handler
_Unwind_Backtrace
_Unwind_DeleteException
_Unwind_FindEnclosingFunction
_Unwind_Find_FDE
_Unwind_ForcedUnwind
_Unwind_GetCFA
_Unwind_GetDataRelBase
_Unwind_GetGR
_Unwind_GetIP
_Unwind_GetIPInfo
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_GetTextRelBase
_Unwind_RaiseException
_Unwind_Resume
_Unwind_Resume_or_Rethrow
_Unwind_SetGR
_Unwind_SetIP
unw_get_fpreg
unw_get_proc_info
unw_get_proc_name
unw_get_reg
unw_getcontext
unw_init_local
unw_is_fpreg
unw_is_signal_frame
unw_local_addr_space
unw_regname
unw_resume
unw_set_fpreg
unw_set_reg
unw_step
Name
.text
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
118KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Relay-Windows-Real/SHA256SUMS
- SHA256 5951a553928a599c8def2958f896e6f927072d8ff61ea79b4f8b69b4d903d820
- MD5 8a694459e9821fd9a1ea1f720caa0604
- SHA1 38acb47f2d9012f17404b27b405c1243f6c73232
- SHA512 237f8c74b57629dfd3c8df39f96385462fc528f3bf79f26dbdad352e7d190453f17f0bb8393d9e00d5dcb08fc82607842a6e330e543f152f202b712c5091485e
- TLSH T13FC02B21CB4F200BC06377234EB4B457D647868780E0E02484F711915296B9071075C3
- MD5 SHA1 SHA512 TLSH
Relay-Windows-Real/syncthing.exe
- IMPHASH df6eed69d84a803595455e95fddacc7e
- SHA256 cd9aea20afda2b9bdba5aff2e6ac964ed5c2e741ed4ceb48ad9e1be096ca7891
- MD5 820496030753c37bccff34d9549a0589
- SHA1 fd0af41015cf09795b7bf998a14474c478c173c2
- SHA512 7da896cc4e94aec64732bae0daf814b59bbea7cb6875daeb2c5a97b783f3cec903228f76b982f68b1974398491686c5928f23fea6927e140f5c9079042bb52ab
- SSDEEP 196608:hpNFPKBuX6eejVf0axpX+Xp01tEmesZdRP9jbpFfFyt+DZus0ETIIyAOr1HgrO:RUY450axJ+ZytmYdx9jtRFZrJkRArO
- TLSH T15E776A03F96608E4D6EED531C6668512BFB17C598B3023EB1B60F5202F7EBD069BA354
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c1:2a:4a:30:8f:99:54:47:ed:59:9f:9d:1e:49:70:8f:fc:e0:ff:4d:7e:23:9f:ce:ce:72:4f:d8:62:0b:a7:13
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Syncthing AB,O=Syncthing AB,L=Höllviken,C=SE
Chains
Oct 21, 2026
CN=Syncthing AB,O=Syncthing AB,L=Höllviken,C=SE
CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Syncthing AB,O=Syncthing AB,L=Höllviken,C=SE
Serial Number
33:00:08:f1:19:bb:31:79:e8:56:85:02:ff:00:00:00:08:f1:19
Issuer
CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 19, 2026 - Oct 22, 2026
Subject
CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Mar 26, 2026 - Mar 26, 2031
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 1, 2021 - Apr 1, 2036
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:5e:2e:11:6e:1c:76:9c:ef:05:00:00:00:00:00:5e
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 17, 2026 - Sep 14, 2027
Minor OS version
0
Major OS version
6
Entry point
14821200
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
AddVectoredContinueHandler
AddVectoredExceptionHandler
AreFileApisANSI
CloseHandle
CreateEventA
CreateFileA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateThread
CreateWaitableTimerA
CreateWaitableTimerExW
DeleteCriticalSection
DeleteFileA
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExitProcess
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
GetConsoleMode
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetEnvironmentStringsW
GetErrorMode
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetThreadContext
GetTickCount
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryExW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
PostQueuedCompletionStatus
QueryPerformanceCounter
RaiseFailFastException
ReadFile
ResumeThread
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
SystemTimeToFileTime
TlsAlloc
TlsGetValue
TryEnterCriticalSection
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
realloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-private-l1-1-0
memchr
strchr
strrchr
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_beginthreadex
_cexit
_configure_narrow_argv
_crt_atexit
_endthreadex
_exit
_initialize_narrow_environment
_initterm
_initterm_e
_seh_filter_exe
_set_app_type
_set_invalid_parameter_handler
abort
exit
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
fflush
fwrite
setvbuf
api-ms-win-crt-string-l1-1-0
strcmp
strcspn
strncmp
strspn
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-environment-l1-1-0
__p__environ
api-ms-win-crt-math-l1-1-0
__setusermatherr
authorizerTrampoline
callbackTrampoline
commitHookTrampoline
compareTrampoline
doneTrampoline
preUpdateHookTrampoline
rollbackHookTrampoline
stepTrampoline
updateHookTrampoline
Name
.text
Size
14.2MB
Virtual Size
14.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17.5MB
Virtual Size
17.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.buildid
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
732KB
Virtual Size
33.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
364KB
Virtual Size
364KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
293KB
Virtual Size
292KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ