SONdpi-0.1.0-windows-x64.zip
- SHA256 9953945f7445048040f4521fc6329f16547bb90040c3d0b90c164a534488353a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SONdpi-0.1.0\WinDivert.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SONdpi-0.1.0\WinDivert.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
SONdpi-0.1.0\WinDivert64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
SONdpi-0.1.0\sondpi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
SONdpi-0.1.0\sondpi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target SONdpi-0.1.0-windows-x64.zip
- Size 449KB
- Sample261113-we4wcaet8v
- SHA256 9953945f7445048040f4521fc6329f16547bb90040c3d0b90c164a534488353a
- MD5 682a3e4d3ce3e40a82815de81260aae0
- SHA1 0d9e93715b8f2a6121f384ad14a7a878a531233c
- SHA512 2d5b1d50feec659c24d17dbb1485af9cd053c83112c584af9b805d67b476f26d4b7a94430701ba4384ff1204c5538fc2e23ef42a4110caec80e6ff459205defd
- SSDEEP 12288:qbFPntuHccVbVK2Re1RPbEPlFLSOUCA9HvTv:8ufi2R4aDCNHLv
- TLSH T159A4230CE204EB8FC5566EA0DC8B6C3903231590E099F091ED6AFD9E3D366B4E26C5DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/SONdpi-0.1.0\WinDivert.dll unpack001/SONdpi-0.1.0\sondpi.exe
File Explorer
-
SONdpi-0.1.0-windows-x64.zip.zip 449KB
-
SONdpi-0.1.0\LICENSE.txt1KB
-
SONdpi-0.1.0\OKU.txt1KB
-
SONdpi-0.1.0\WinDivert-LICENSE.txt39KB
-
SONdpi-0.1.0\WinDivert.dll.dll 46KB
-
SONdpi-0.1.0\WinDivert64.sys.sys 89KB
-
SONdpi-0.1.0\sondpi.exe.exe 858KB
SONdpi-0.1.0\LICENSE.txt
- SHA256 ff5b4a3a994f8261026d4e93ba18777b56d63adfaae95909ddd0b1bcedf46173
- MD5 9bfa4e0827d789900705ce017a8659f8
- SHA1 cd2e48c35685e1ceade6476f30efe81de7d39209
- SHA512 b9ae7d80b551ff90701e35f647d14e52f88970427193add136ca16dadb114739940701737557cf11db2c30f03839cd5d0b32eec50495f12161da4ab582d21c13
- TLSH T1BA11822EB25007621C9A13A05578A8C5B23BB25FBA9F2A85246DF345232A06CC6FF840
- MD5 SHA1 SHA512 TLSH
SONdpi-0.1.0\OKU.txt
- SHA256 63c8300ed9f70263ac0297a91fb25ce2df762527cb6325bad174a6f4d3165859
- MD5 35c8148ba995195be88228db92d4df2f
- SHA1 a73c03299487e826a73365b1f09eac28bf74ee55
- SHA512 a15803293d417c1511ee8ea99b6c25676c16d11538394e2a2feaf47f5c9d56f869ff716ce2b57ed95c2000e86be650202486b23a8f1a5555fd898417dccdd33b
- TLSH T19821867434B289128B73B8DF9E9F1327B167C0ABE347F0C245A45F35AE10385C2971A9
- MD5 SHA1 SHA512 TLSH
SONdpi-0.1.0\WinDivert-LICENSE.txt
- SHA256 e5453b2e71e4c4dcdb89a2539655add3a63202521cf3012b768e8bfeda199312
- MD5 b864fbb188a7c3a11cef80f3ee902d77
- SHA1 7a3f0538f8fd2ee1c30fc1952cbf83b13b360b3f
- SHA512 eb03bb26490535d98e270c89d70dfc9d1a0e2a22ad2bc09ed316e522fb52177b24bb6a2c023c9b010837b6b9a28dfe6492dc0b77f45883385a7e66dd00463c32
- SSDEEP 768:Qs57D0LVw7Y+tNdSz3ZlqXOWoInuzx3Y8N3Wib:QspD8VwVtNIq1uzZY1I
- TLSH T1E703735BA74513B202E202516E4FA4CEE32E907A376A4464786DC15C27B7D3483BFBED
- MD5 SHA1 SHA512 SSDEEP TLSH
SONdpi-0.1.0\WinDivert.dll
- IMPHASH 0b649f8e17494bb31b47f6e959a1769c
- SHA256 6110bfa44667405179c3e15e12af1b62037e447ed59b054b19042032995e6c7e
- MD5 88e1c19b978436258f7c938013408a8a
- SHA1 09b77c8c85757e11667a7b83231598dd67fe0b8b
- SHA512 eaa0d8369b76fd9a4978f14702716ae31d801cd0dc36a86531f9320b4ddb683265c4f0e07af2b9d2e85f513270d98d1b11ae7d501d08287442bc505176d16e14
- SSDEEP 768:itSVluu2agCfRSB3QEw2VWHxWYuaO6JXtltdUUwhqWB8TicI:bUZWECHxWDABdIyTic
- TLSH T13E23C703F64251BBC568C27083AED3526E22FCC66354FADF829FF7952885F42DB1A509
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31106
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
CloseServiceHandle
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegSetValueExW
StartServiceW
kernel32
CloseHandle
CreateEventW
CreateFileW
CreateMutexW
DeviceIoControl
GetLastError
GetModuleFileNameW
GetOverlappedResult
HeapAlloc
HeapCreate
HeapDestroy
ReleaseMutex
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WinDivertClose
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperCompileFilter
WinDivertHelperDecrementTTL
WinDivertHelperEvalFilter
WinDivertHelperFormatFilter
WinDivertHelperFormatIPv4Address
WinDivertHelperFormatIPv6Address
WinDivertHelperHashPacket
WinDivertHelperHtonIPv6Address
WinDivertHelperHtonIpv6Address
WinDivertHelperHtonl
WinDivertHelperHtonll
WinDivertHelperHtons
WinDivertHelperNtohIPv6Address
WinDivertHelperNtohIpv6Address
WinDivertHelperNtohl
WinDivertHelperNtohll
WinDivertHelperNtohs
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam
WinDivertShutdown
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
SONdpi-0.1.0\WinDivert64.sys
- IMPHASH 505c54af7fa8f0482014ca4fe5cdd53d
- SHA256 e69b5ba3f0cd6cfb2983e442636e7f0b342b61b15264b0328317d4559c82cf50
- MD5 6a33620de63bccaf5e5314ee49cd58fb
- SHA1 ac728b339681b2e27099fecc1419821f01d04b34
- SHA512 638d1b8aa4dc0e4ac504f51aaa3ec8375ccc3d69a4d36821f6bb98060b58586007f47966b9d58d222b9f067e12e80755f56559286cbabec8746146acaf24f945
- SSDEEP 1536:8ovgCRgYL/h//oJJw5AdPtey2AyWpdsihch9WXi2v6MuO2:84jmJJsKle9A5pdsiqg/vsO2
- TLSH T1D9934C46A2E201C5F9F6C97895B59213EF31FA81AB22D7DF11D0981E4F61BE0BD78321
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 24, 2019
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
22:28:bf:92:4d:da:52:a7:8d:1d:5e:42:49:58:10:79:54:b9:1b:20:4d:70:75:56:77:34:96:94:0a:13:9c:2e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Nov 24, 2019
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
SERIALNUMBER=8313827,CN=Cloudveil Technology Inc.,O=Cloudveil Technology Inc.,POSTALCODE=67107,STREET=100 Ave C,L=Moundridge,ST=Kansas,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13064b616e736173,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
f4:8b:a9:cb:78:dd:96:f2:dc:60:2f:ef:35:68:c9:2a
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 13, 2017 - Oct 12, 2020
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
61:18:54:86:00:00:00:00:00:24
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 11, 2011 - Apr 11, 2021
Subject
CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Aug 1, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:31:94:79:a3:18:f5:52:2d:06:00:00:00:00:00:31
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 5, 2019 - Jun 3, 2020
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:06:61:b5:44:99:f8:ea:f2:ed:00:00:00:00:01:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
10
Entry point
4484
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\WinDivert\install\MSVC\amd64\WinDivert64.pdb
ntoskrnl.exe
ExFreePoolWithTag
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAllocateErrorLogEntry
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
IoWriteErrorLogEntry
RtlCopyUnicodeString
ObfReferenceObject
ObfDereferenceObject
KeBugCheckEx
IoGetRequestorProcess
PsGetProcessId
ExUuidCreate
ExAllocatePoolWithTag
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
RtlGetVersion
RtlIntegerToUnicodeString
hal
KeQueryPerformanceCounter
ndis.sys
NdisAllocateNetBufferPool
NdisFreeNetBufferPool
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
fwpkclnt.sys
FwpsAllocateNetBufferAndNetBufferList0
FwpmFilterDeleteByKey0
FwpmFilterAdd0
FwpmCalloutDeleteByKey0
FwpmCalloutAdd0
FwpmSubLayerDeleteByKey0
FwpmSubLayerAdd0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmTransactionBegin0
FwpmEngineClose0
FwpmEngineOpen0
FwpsQueryPacketInjectionState0
FwpsInjectNetworkReceiveAsync0
FwpsInjectForwardAsync0
FwpsInjectNetworkSendAsync0
FwpsCalloutRegister0
FwpsCalloutUnregisterByKey0
FwpsFlowAssociateContext0
FwpsFlowRemoveContext0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsFreeNetBufferList0
wdfldr.sys
WdfVersionBind
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionUnbind
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=262, version=24610,
count=3, id=136, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=55, id=1, productName=Unmarked objects,
count=9, id=257, version=24610,
count=5, id=259, version=24610,
count=5, id=260, version=24610,
count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
SONdpi-0.1.0\sondpi.exe
- IMPHASH d2b557efcd7ccbae6b08c4db827c6dc0
- SHA256 dc872a9060f7259f9affc0d03fbf5c545643be1fedaee27c5432a6704c2aa2aa
- MD5 20de381c48e9f64ae424c3a99c6a690a
- SHA1 57b7392abf7347dd182f582a512478cf8ef45dc3
- SHA512 c345760b44a8f11c39cd8b55039c38589e504a429ee6674ce926f90e887bed58fa0bd12724152ab22194d0dac96f2b8b56b69970df93eb5e25f51c8ad3baca09
- SSDEEP 12288:9gcpg9UWWiX5SPbxE0qEQmRhN24XbJtHsX7xe3AghTk8sR1aQjYNNopmQH1:9gcpg9oY4XbjHsLizhozR1aQ8NNDQV
- TLSH T1ED1508257A5B99BDD84AC870834786B31E2130CB1B36BDEF40C596793FA9AF51B38314
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
649536
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
sondpi.pdb
kernel32
GetConsoleWindow
GetCurrentProcess
FindClose
SetEvent
CreateMutexW
GetTickCount64
SetStdHandle
GetExitCodeProcess
CreateFileW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
QueryFullProcessImageNameW
TerminateProcess
MoveFileExW
CreateEventW
GetSystemTimeAsFileTime
LocalFree
InitializeSListHead
CreateNamedPipeW
WaitNamedPipeW
WriteFile
ResetEvent
DisconnectNamedPipe
ConnectNamedPipe
GetStdHandle
GetOverlappedResult
CancelIoEx
ReadFile
SetConsoleCtrlHandler
LoadLibraryW
GetProcAddress
SleepEx
ReadFileEx
WriteFileEx
SetLastError
GetFullPathNameW
GetCurrentThreadId
DuplicateHandle
CopyFileExW
CreateThread
SetFileTime
SetFileInformationByHandle
GetCurrentProcessId
GetFileInformationByHandleEx
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
CreateDirectoryW
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetCurrentDirectoryW
GetCommandLineW
RemoveDirectoryW
FindFirstFileExW
ExitProcess
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetFinalPathNameByHandleW
DeleteFileW
GetEnvironmentVariableW
HeapAlloc
GetModuleFileNameW
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
CreateWaitableTimerExW
SetWaitableTimer
Sleep
GetFileAttributesW
FlsFree
FlsAlloc
GetModuleHandleExW
IsThreadAFiber
FlsSetValue
FormatMessageW
GetModuleHandleA
GetTempPathW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
FindNextFileW
IsDebuggerPresent
AttachConsole
GetLocalTime
SwitchToThread
CloseHandle
UnhandledExceptionFilter
GetFileInformationByHandle
GetSystemTimePreciseAsFileTime
SetUnhandledExceptionFilter
WaitForMultipleObjects
GetModuleHandleW
GetLastError
HeapReAlloc
HeapFree
WaitForSingleObject
GetProcessHeap
IsProcessorFeaturePresent
QueryPerformanceFrequency
WideCharToMultiByte
lstrlenW
QueryPerformanceCounter
CompareStringOrdinal
MultiByteToWideChar
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
shell32
Shell_NotifyIconW
ShellExecuteExW
SHGetKnownFolderPath
ShellExecuteW
user32
IsWindowVisible
DestroyMenu
TrackPopupMenu
SetForegroundWindow
AppendMenuW
CreatePopupMenu
GetCursorPos
DestroyWindow
DefWindowProcW
PostQuitMessage
KillTimer
GetWindowTextW
DispatchMessageW
TranslateMessage
GetMessageW
SetTimer
SetWindowTextW
RegisterWindowMessageW
RegisterClassExW
SetProcessDpiAwarenessContext
MessageBoxW
GetSystemMetricsForDpi
GetDpiForSystem
GetDpiForWindow
FindWindowW
CheckMenuItem
ModifyMenuW
CreateIconIndirect
ReleaseDC
GetDC
DestroyIcon
PostMessageW
CreateWindowExW
winhttp
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetOption
WinHttpSetTimeouts
WinHttpQueryHeaders
WinHttpOpen
WinHttpConnect
WinHttpReadData
WinHttpQueryOption
WinHttpOpenRequest
WinHttpCloseHandle
advapi32
ControlService
DeleteService
RegQueryValueExW
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenServiceW
OpenSCManagerW
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegDeleteValueW
StartServiceCtrlDispatcherW
ChangeServiceConfigW
CloseServiceHandle
QueryServiceConfigW
ChangeServiceConfig2W
RegDeleteTreeW
StartServiceW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
CreateServiceW
QueryServiceStatusEx
gdi32
DeleteObject
CreateDIBSection
CreateBitmap
combase
CoTaskMemFree
ntdll
NtOpenFile
NtCreateNamedPipeFile
NtReadFile
RtlNtStatusToDosError
NtWriteFile
bcryptprimitives
ProcessPrng
vcruntime140
__current_exception
__current_exception_context
memcpy
__CxxFrameHandler3
memmove
memcmp
_CxxThrowException
__C_specific_handler
memset
api-ms-win-crt-math-l1-1-0
roundf
__setusermatherr
api-ms-win-crt-string-l1-1-0
strlen
wcslen
api-ms-win-crt-runtime-l1-1-0
exit
_initterm_e
_initterm
_get_initial_narrow_environment
__p___argc
_configure_narrow_argv
_register_onexit_function
_crt_atexit
_set_app_type
_seh_filter_exe
_exit
_initialize_onexit_table
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
terminate
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Name
.text
Size
655KB
Virtual Size
654KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
170KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=3, id=259, version=35207,
count=9, id=260, version=35207,
count=23, id=261, version=35207,
count=3, id=257, version=33145,
count=238, id=1, productName=Unmarked objects,
count=53, productName=Unmarked objects (old),
count=1, id=258, version=35229,