Manalyze report for 2cd958f26b193a8465a63b01150a9f1638dc1a9e4169ee7d56cdc2f15797be48

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2026-Jun-10 05:45:02
TLS Callbacks	2 callback(s) detected.

Plugin Output

Suspicious	The PE is possibly packed.	`Unusual section name found: .xdata`
Info	The PE contains common functions which appear in legitimate applications.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryA` `Can access the registry: RegCloseKey RegOpenKeyExA` `Can create temporary files: CreateFileA GetTempPathA`
Malicious	VirusTotal score: 31/70 (Scanned on 2026-06-11 09:29:59)	`ALYac: Gen:Variant.Yogi.750` `AVG: MalwareX-gen [Misc]` `AhnLab-V3: Malware/Win.Generic.R775170` `Antiy-AVL: Trojan/Win32.Posilod` `Arcabit: Trojan.Yogi.750` `Avast: MalwareX-gen [Misc]` `Avira: TR/W64.Agent` `BitDefender: Gen:Variant.Yogi.750` `CTX: dll.trojan.yogi` `Cylance: Unsafe` `DeepInstinct: MALICIOUS` `ESET-NOD32: Win64/Agent.JLS trojan` `Elastic: malicious (high confidence)` `Emsisoft: Gen:Variant.Yogi.750 (B)` `F-Secure: Trojan.TR/W64.Agent` `GData: Gen:Variant.Yogi.750` `Google: Detected` `MaxSecure: Trojan.Malware.121218.susgen` `McAfeeD: ti!2CD958F26B19` `MicroWorld-eScan: Gen:Variant.Yogi.750` `Microsoft: Trojan:Win32/Posilod.EB!cl` `Paloalto: generic.ml` `Rising: Malware.Undefined!8.C (TFE:6:0joMe7twQ2T)` `Sangfor: Trojan.Win32.Agent.V2m3` `Sophos: Mal/Generic-S` `Symantec: ML.Attribute.HighConfidence` `TrellixENS: Artemis!CCA1CF96AB28` `TrendMicro: Trojan.Win32.ZYX.USBLFA26` `TrendMicro-HouseCall: Trojan.Win32.ZYX.USBLFA26` `VIPRE: Gen:Variant.Yogi.750` `Varist: W64/ABTrojan.AKDU-7882`

Hashes

MD5	`cca1cf96ab28a1408c732c538848d64f`
SHA1	`7268bcb86ab0ed1b158a143b96c8f3ad16ee650c`
SHA256	`2cd958f26b193a8465a63b01150a9f1638dc1a9e4169ee7d56cdc2f15797be48`
SHA3	`9ab96022fc93311c6f03410db76bc42a5b0ed403bb3d3a999847a43a41137ad1`
SSDeep	`12288:wny+JaGeBv8Df3ojQ79smOBu81DhM6iDxOSqP5xFfOQYMZ:rBvSKGnOBPlM6iDgSqP5vfjYM`
Imports Hash	`e3ce4dc185bf76ea607a53efd404cc48`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`11`
TimeDateStamp	2026-Jun-10 05:45:02
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DEBUG_STRIPPED` `IMAGE_FILE_DLL` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE` `IMAGE_FILE_LINE_NUMS_STRIPPED` `IMAGE_FILE_LOCAL_SYMS_STRIPPED`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`2.0`
SizeOfCode	`0x3c00`
SizeOfInitializedData	`0xc3c00`
SizeOfUninitializedData	`0xa00`
AddressOfEntryPoint	`0x00000000000013E0 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x63080000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`5.2`
Win32VersionValue	`0`
SizeOfImage	`0xcf000`
SizeOfHeaders	`0x400`
Checksum	`0xcc8c7`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x200000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`2a3a1ef1d30c2610073979700229d537`
SHA1	`048327bdd29291dfaf699fb8a488a3138c5ee3bb`
SHA256	`fb33dc7aab46c420fc9d2833542a159f1598872ced2714b585aecaacf07eb529`
SHA3	`4909d371e8404ecd47dd97ac41bc9eb5484ef8d50e49016b4a1b66ba641b2003`
VirtualSize	`0x3ad0`
VirtualAddress	`0x1000`
SizeOfRawData	`0x3c00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.97677`

.data

MD5	`f5117fd145a0a2f5a9810605e0656879`
SHA1	`66ac0b9a7cfc59bc9dd892fa9d354ecc02d0d24d`
SHA256	`30a295a97ca5d8cb24b717f642f969d4966d82b36dbdf3ce8bb7ca8d794727ca`
SHA3	`83f9027f8972efd2bced90b03f6b2f20fc08ae1a1e277653278b33d361aa6c03`
VirtualSize	`0x1ffc0`
VirtualAddress	`0x5000`
SizeOfRawData	`0x20000`
PointerToRawData	`0x4000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.87699`

.rdata

MD5	`bcd1f12303208b1d33d461029c20235b`
SHA1	`6a95681e51ac7ac30182311071ee663c9ca6c1a8`
SHA256	`4fa39d96a3f11b9ca2861474315ac72f04ac7a4fe137634433d1916dbd89acb8`
SHA3	`d52e7e8248cf54bbe8981152cef9db516afc536f34f4884af6c395b19af29fb4`
VirtualSize	`0x99d30`
VirtualAddress	`0x25000`
SizeOfRawData	`0x99e00`
PointerToRawData	`0x24000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.13807`

.pdata

MD5	`a8dccc03f020988b5977f78bf31e5d74`
SHA1	`cb0e193f93b48f815c2c22980dca5452eeb18aab`
SHA256	`10bc94dd733ef5baa50864bca65b5782d731e1712ffc41c1ecde12907d4b13fb`
SHA3	`8ec277ce0b8bec47c18b5fa89a0e7cd4ac0eb8f4518e9d71f7e8a43725e00528`
VirtualSize	`0x39c`
VirtualAddress	`0xbf000`
SizeOfRawData	`0x400`
PointerToRawData	`0xbde00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.9928`

.xdata

MD5	`f529317a33c9356369ef4f48aa22d126`
SHA1	`76f8fa5b3aa064adb6335f2b57cd4ff98779aa6e`
SHA256	`ce5f679a594f5e34fb9b3cc81093727f22c6d9f0b99970a43c7a8059b9c92ae7`
SHA3	`8bc70825897f988af55ede2d26ca94b26fffe47951a56c158ee1dabcd101e096`
VirtualSize	`0x32c`
VirtualAddress	`0xc0000`
SizeOfRawData	`0x400`
PointerToRawData	`0xbe200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.67005`

.bss

MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
SHA3	`a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a`
VirtualSize	`0x990`
VirtualAddress	`0xc1000`
SizeOfRawData	`0`
PointerToRawData	`0`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_UNINITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`

.edata

MD5	`76ae19d9a6d36e496160bd3d935505f6`
SHA1	`f9903c2298c65d864626b190fa4a289990f75210`
SHA256	`17cb209c2eaf7488b9d8ae47bc9c378f97f383a710827306f8d4d7f1391e7cdc`
SHA3	`f84b1b4e713b54f8eb3ea6753b603b3d398b29e96e49dd04d688ae9829f865a1`
VirtualSize	`0x3c4`
VirtualAddress	`0xc2000`
SizeOfRawData	`0x400`
PointerToRawData	`0xbe600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.07272`

.idata

MD5	`cd0db67b0692710e33e9cdfe54b9c359`
SHA1	`fb0cef6273d7aae3a1cd5fc8ade26bf36b9a301d`
SHA256	`7a80c3cdfb3877a8f6376f09597f8c5cd18f70fac8adf818bf5a3369a9980be3`
SHA3	`b34b3c1457fad09d0bef4da1d0961e915254f86e778207397d33983f09d38d93`
VirtualSize	`0xa30`
VirtualAddress	`0xc3000`
SizeOfRawData	`0xc00`
PointerToRawData	`0xbea00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.97846`

.CRT

MD5	`7072b2668a099a5f70b996e48794240c`
SHA1	`3d7546edcee09d9730c2e83e2c730bca7e3f0772`
SHA256	`2bb016aa19d07d02d96fbdf6d2b747263facd45144da94d2498cbd360af583ad`
SHA3	`ab9b7a3cb7df293d67fe8d5267a9e745d29f9f44f08b4cbfeea479221b897b61`
VirtualSize	`0x58`
VirtualAddress	`0xc4000`
SizeOfRawData	`0x200`
PointerToRawData	`0xbf600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.201539`

.tls

MD5	`3b1099a0fda911fab489931995da471a`
SHA1	`cf5f7b3d76e41236c15c7c00f551368884f3519c`
SHA256	`a331d119d9c9ce4f83ad527f7f2306dfbfa8b43826e3df6caeae45085d2fec9e`
SHA3	`7fefea475a9cccd75184f9f34a796014c6a7ab13d3fd2a38fd93287d7b2c254c`
VirtualSize	`0x68`
VirtualAddress	`0xc5000`
SizeOfRawData	`0x200`
PointerToRawData	`0xbf800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_2048BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_8BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.270157`

.reloc

MD5	`08633dac032002d70e84cb5f83032908`
SHA1	`7b5affee55ddb32a5d2b9e1e808061d59725300e`
SHA256	`5b1eb8423e3691b7adafffb47bbfbce8270bea25e46967d4d116d1607c66c441`
SHA3	`985ad8053f1f7931f586e520d716811fbcade71404264c118ce7d3e1d8f67129`
VirtualSize	`0x80d0`
VirtualAddress	`0xc6000`
SizeOfRawData	`0x8200`
PointerToRawData	`0xbfa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_ALIGN_1024BYTES` `IMAGE_SCN_ALIGN_16BYTES` `IMAGE_SCN_ALIGN_1BYTES` `IMAGE_SCN_ALIGN_256BYTES` `IMAGE_SCN_ALIGN_2BYTES` `IMAGE_SCN_ALIGN_32BYTES` `IMAGE_SCN_ALIGN_4096BYTES` `IMAGE_SCN_ALIGN_4BYTES` `IMAGE_SCN_ALIGN_512BYTES` `IMAGE_SCN_ALIGN_64BYTES` `IMAGE_SCN_ALIGN_8192BYTES` `IMAGE_SCN_ALIGN_MASK` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.42841`

Imports

ADVAPI32.dll	`RegCloseKey` `RegOpenKeyExA`
KERNEL32.dll	`CloseHandle` `CreateFileA` `CreateFileMappingA` `DeleteCriticalSection` `DeleteFileA` `EnterCriticalSection` `GetACP` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThreadId` `GetFileSize` `GetLastError` `GetModuleHandleA` `GetProcAddress` `GetSystemDirectoryA` `GetSystemTimeAsFileTime` `GetTempFileNameA` `GetTempPathA` `GetTickCount` `InitializeCriticalSection` `LeaveCriticalSection` `LoadLibraryA` `MapViewOfFile` `QueryPerformanceCounter` `RtlAddFunctionTable` `RtlCaptureContext` `RtlLookupFunctionEntry` `RtlVirtualUnwind` `SetUnhandledExceptionFilter` `Sleep` `TerminateProcess` `TlsGetValue` `UnhandledExceptionFilter` `UnmapViewOfFile` `VirtualProtect` `VirtualQuery`
msvcrt.dll	`__dllonexit` `__iob_func` `__setusermatherr` `_amsg_exit` `_errno` `_initterm` `_lock` `_onexit` `_unlock` `abort` `calloc` `fprintf` `free` `fwrite` `malloc` `memcpy` `memset` `printf` `rand` `signal` `strcmp` `strlen` `strncmp` `tan` `vfprintf`
SHELL32.dll	`SHGetFolderPathA`
USER32.dll	`GetSystemMetrics`

Delayed Imports

JLI_AddArgsFromEnvVar

Ordinal	`1`
Address	`0x41b0`

JLI_CmdToArgs

Ordinal	`2`
Address	`0x41c0`

JLI_GetAppArgIndex

Ordinal	`3`
Address	`0x4250`

JLI_GetStdArgc

Ordinal	`4`
Address	`0x4260`

JLI_GetStdArgs

Ordinal	`5`
Address	`0x4270`

JLI_InitArgProcessing

Ordinal	`6`
Address	`0x4280`

JLI_Launch

Ordinal	`7`
Address	`0x4a70`

JLI_List_add

Ordinal	`8`
Address	`0x4a80`

JLI_List_new

Ordinal	`9`
Address	`0x4a90`

JLI_ManifestIterate

Ordinal	`10`
Address	`0x4aa0`

JLI_MemAlloc

Ordinal	`11`
Address	`0x41d0`

JLI_MemFree

Ordinal	`12`
Address	`0x41e0`

JLI_PreprocessArg

Ordinal	`13`
Address	`0x41f0`

JLI_ReportErrorMessage

Ordinal	`14`
Address	`0x4200`

JLI_ReportExceptionDescription

Ordinal	`15`
Address	`0x4210`

JLI_ReportMessage

Ordinal	`16`
Address	`0x4220`

JLI_SetTraceLauncher

Ordinal	`17`
Address	`0x4230`

JLI_StringDup

Ordinal	`18`
Address	`0x4240`

proxy_func_0

Ordinal	`19`
Address	`0x41b0`

proxy_func_1

Ordinal	`20`
Address	`0x41c0`

proxy_func_10

Ordinal	`21`
Address	`0x41d0`

proxy_func_11

Ordinal	`22`
Address	`0x41e0`

proxy_func_12

Ordinal	`23`
Address	`0x41f0`

proxy_func_13

Ordinal	`24`
Address	`0x4200`

proxy_func_14

Ordinal	`25`
Address	`0x4210`

proxy_func_15

Ordinal	`26`
Address	`0x4220`

proxy_func_16

Ordinal	`27`
Address	`0x4230`

proxy_func_17

Ordinal	`28`
Address	`0x4240`

proxy_func_2

Ordinal	`29`
Address	`0x4250`

proxy_func_3

Ordinal	`30`
Address	`0x4260`

proxy_func_4

Ordinal	`31`
Address	`0x4270`

proxy_func_5

Ordinal	`32`
Address	`0x4280`

proxy_func_6

Ordinal	`33`
Address	`0x4a70`

proxy_func_7

Ordinal	`34`
Address	`0x4a80`

proxy_func_8

Ordinal	`35`
Address	`0x4a90`

proxy_func_9

Ordinal	`36`
Address	`0x4aa0`

Version Info

TLS Callbacks

StartAddressOfRawData	`0x63145000`
EndAddressOfRawData	`0x63145060`
AddressOfIndex	`0x631418cc`
AddressOfCallbacks	`0x63144030`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_TYPE_REG`
Callbacks	`0x0000000063082080` `0x0000000063082050`

Load Configuration

RICH Header

Errors

[*] Warning: Section .bss has a size of 0!

Leave a comment

No comments yet.