82cfb222429feeb530fa74d62b84661b1c77f0ae2cf636ef8101a907fc2e2f3e

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2013-Jun-16 09:38:19
Detected languages English - United States
Debug artifacts mscoree.pdb
CompanyName Microsoft Corporation
FileDescription Microsoft .NET Runtime Execution Engine
FileVersion 10.0.19041.1 (WinBuild.160101.0800)
InternalName mscoree.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename mscoree.dll
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.19041.1

Plugin Output

Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
  • LoadLibraryExW
  • LoadLibraryExA
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
 Manipulates other processes:
  • ReadProcessMemory
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 7e2d4da22e6161e442ba2834f59a4a20
SHA1 c190bc256280cfcfb7c56bd7906b62bb3fda6401
SHA256 82cfb222429feeb530fa74d62b84661b1c77f0ae2cf636ef8101a907fc2e2f3e
SHA3 20d66c60fd73b485f84507762be147186ef96ee2011e6ecfd06c08a151b6c4d2
SSDeep 12288:g8eu1AuwaYXCVg4nZ1qewl5qyrYtHSak:deuK0u5I+5xrYHSak
Imports Hash ab9f9eedee78d18d79976991efd37bc5

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2013-Jun-16 09:38:19
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x3fc00
SizeOfInitializedData 0x63a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000000000002BD50 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion A.0
ImageVersion A.0
SubsystemVersion A.0
Win32VersionValue 0
SizeOfImage 0xab000
SizeOfHeaders 0x400
Checksum 0x6ab0d
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x40000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 45ffa404877a815f9a50676a12e64def
SHA1 12005f51177453589e0760d750805db065b226bd
SHA256 18a524ac2df13083969fb91f0d7626bd8b1528064e5020c1628b75c362235e70
SHA3 e05e1fb9872bcb09edffef8621b70c4fdfa509fcf3242782d9913571d210f369
VirtualSize 0x3fb25
VirtualAddress 0x1000
SizeOfRawData 0x3fc00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.34679

.rdata

MD5 9d96ac084c8acab21bac879d9d460865
SHA1 4ac7ac890a9e7754c83194bd2955c611757e8147
SHA256 787a15424e6dad9b94a10d4bf2d9cc3ed97526d665547ce603153ab802a5fd15
SHA3 c6c876bc09cf43792c73d1821b4d1cc1dbd6c31d7f31f7c16cee910d080234d1
VirtualSize 0x176f0
VirtualAddress 0x41000
SizeOfRawData 0x17800
PointerToRawData 0x40000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.65025

.data

MD5 0662e1cc653f7a0fabadf1b4d712a77d
SHA1 9415dae28d1d13e29579f6721834c9a31b0b1831
SHA256 72e6037bc7cd165d3eb0877311e3751bdbcb77f5daeddb41531e364f262bac9a
SHA3 4b8713d36cbffcf4aa39a6645e5e5f754b1bdd73d64cb5e5588a7b0d604ad75f
VirtualSize 0x5208
VirtualAddress 0x59000
SizeOfRawData 0x2000
PointerToRawData 0x57800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.00364

.pdata

MD5 6b3dece676be37a5241356b22792f710
SHA1 ce2b2d4bba4af425142685ec281398714319e82b
SHA256 46f01b4a8c1e1e273eb816b124e44cc817c93afe9c317b15d9e06ae562032ce0
SHA3 4ab56f791c622e56fc6ac5cd5b8507b04307e94ec90c7ab16b5e34ec6155e962
VirtualSize 0x288c
VirtualAddress 0x5f000
SizeOfRawData 0x2a00
PointerToRawData 0x59800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.61043

.didat

MD5 94b185cd5edaf2ee8f1f00b846c6a314
SHA1 9883251e8829228cf2a84b6cffe0a1a2dfbd570f
SHA256 154786fa4a969880ecb63bded2fdc116588226cda71487dff90ae4f673f35e6f
SHA3 2f19fd9beaea2174300764545542b20e35d82ca5d7e274e33713039f78e49407
VirtualSize 0xe8
VirtualAddress 0x62000
SizeOfRawData 0x200
PointerToRawData 0x5c200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.57774

.rsrc

MD5 0ea9382f320c6a0980242d14d94a18ce
SHA1 1bb72d6c7ccd777157ce6330ad3257d32c2b50dc
SHA256 81b21158770e972332cf18644a3a9989ac468b1823221daac7aa242087fc14c1
SHA3 0b5d17a98d554cc62ce78836bf33a4b7a96bc839fedd901d5e7bc03d1a208116
VirtualSize 0x466d4
VirtualAddress 0x63000
SizeOfRawData 0x46800
PointerToRawData 0x5c400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.73728

.reloc

MD5 aca6afe92aaaf8caf5d4afd0784b93f5
SHA1 911997c974579f863d033d16901ecd853a5f58f5
SHA256 e99947375028e14c5d03ead378ea9cb7a386d79fade25b248f36ad5e43062002
SHA3 ceb68d6806251d3037bce8cd89219ed3d8490edd6d89c922ce04ef0911245fd4
VirtualSize 0xd90
VirtualAddress 0xaa000
SizeOfRawData 0xe00
PointerToRawData 0xa2c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.23766

Imports

KERNEL32.dll EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetVersionExW
GetProcAddress
DeleteCriticalSection
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
GetFullPathNameW
GetLastError
GetEnvironmentVariableW
GetModuleFileNameW
GetFileAttributesW
SetErrorMode
GetModuleHandleW
CreateFileW
SetLastError
GetFileSize
CreateFileMappingW
MapViewOfFile
LoadLibraryW
GetWindowsDirectoryW
GetSystemInfo
LoadLibraryExW
DisableThreadLibraryCalls
ExitProcess
VirtualProtect
WaitForSingleObject
ReleaseMutex
CloseHandle
CreateMutexW
UnmapViewOfFile
GetCurrentProcess
CreateToolhelp32Snapshot
GetSystemDirectoryW
ReadProcessMemory
ReadFile
WriteFile
HeapCreate
HeapDestroy
GetLocalTime
GetTimeFormatW
GetDateFormatW
FindFirstFileW
FindClose
GetFileAttributesExW
IsDBCSLeadByteEx
GetStringTypeW
TlsGetValue
RaiseException
TerminateProcess
OutputDebugStringW
FormatMessageW
lstrlenW
LocalFree
GetACP
GetCPInfo
IsDBCSLeadByte
DebugBreak
GetEnvironmentStringsW
FreeEnvironmentStringsW
QueryActCtxW
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
TlsSetValue
TlsAlloc
TlsFree
HeapAlloc
GetProcessHeap
HeapFree
WaitForSingleObjectEx
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
HeapValidate
GetCurrentProcessId
GetSystemDefaultLCID
LCMapStringW
EncodePointer
DecodePointer
ReleaseSRWLockExclusive
GetCommandLineA
FlsSetValue
RtlLookupFunctionEntry
RtlUnwindEx
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsFree
GetCurrentThreadId
GetModuleHandleExW
HeapSetInformation
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA
IsValidCodePage
GetOEMCP
HeapReAlloc
HeapSize
Sleep
LoadLibraryExA
RtlPcToFileHeader
GetConsoleCP
GetConsoleMode
SetFilePointer
SetThreadStackGuarantee
SetStdHandle
WriteConsoleW
ReadConsoleW
FlushFileBuffers
AcquireSRWLockExclusive
USER32.dll (delay-loaded) GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
LoadStringW

Delayed Imports

Attributes 0x1
Name USER32.dll
ModuleHandle 0x5aec0
DelayImportAddressTable 0x62090
DelayImportNameTable 0x56880
BoundDelayImportTable 0x56a70
UnloadDelayImportTable 0
TimeStamp 1970-Jan-01 00:00:00

InitErrors

Ordinal 17
Address 0x7c90

PostError

Ordinal 18
Address 0xaac0

InitSSAutoEnterThread

Ordinal 19
Address 0x7dd0

UpdateError

Ordinal 20
Address 0x7f00

CloseCtrs

Ordinal 21
Address 0x8d90

LoadStringRC

Ordinal 22
Address 0x4f90

ReOpenMetaDataWithMemory

Ordinal 23
Address 0x9540

Ordinal 24
Address 0xaf50

CollectCtrs

Ordinal 25
Address 0x8c60

CorDllMainWorker

Ordinal 26
Address 0x7b80

EEDllGetClassObjectFromClass

Ordinal 27
Address 0x9ef0

GetPrivateContextsPerfCounters

Ordinal 28
Address 0x5700

GetProcessExecutableHeap

Ordinal 29
Address 0x7940

GetStartupFlags

Ordinal 30
Address 0x49e0

GetTargetForVTableEntry

Ordinal 31
Address 0x1a70

GetTokenForVTableEntry

Ordinal 32
Address 0x17c0

LogHelp_LogAssert

Ordinal 33
Address 0x8020

LogHelp_NoGuiOnAssert

Ordinal 34
Address 0x8170

LogHelp_TerminateOnAssert

Ordinal 35
Address 0x82a0

OpenCtrs

Ordinal 36
Address 0x8b60

SetTargetForVTableEntry

Ordinal 37
Address 0x1920

CLRCreateInstance

Ordinal 38
Address 0xb080

CallFunctionShim

Ordinal 39
Address 0x6cf0

ClrCreateManagedInstance

Ordinal 40
Address 0x54d0

CoEEShutDownCOM

Ordinal 41
Address 0x53a0

CoInitializeCor

Ordinal 42
Address 0x4d30

CoInitializeEE

Ordinal 43
Address 0x4ad0

CoUninitializeCor

Ordinal 44
Address 0x4e60

CoUninitializeEE

Ordinal 45
Address 0x4c00

CorBindToCurrentRuntime

Ordinal 46
Address 0x66e0

CorBindToRuntime

Ordinal 47
Address 0x6200

CorBindToRuntimeByCfg

Ordinal 48
Address 0x6080

CorBindToRuntimeByPath

Ordinal 49
Address 0x84f0

CorBindToRuntimeByPathEx

Ordinal 50
Address 0x8600

CorBindToRuntimeEx

Ordinal 51
Address 0x6380

CorBindToRuntimeHost

Ordinal 52
Address 0x6510

CorExitProcess

Ordinal 53
Address 0x7450

CorGetSvc

Ordinal 54
Address 0x8860

CorIsLatestSvc

Ordinal 55
Address 0x8960

CorMarkThreadInThreadPool

Ordinal 56
Address 0x5630

CorTickleSvc

Ordinal 57
Address 0x8a70

CreateConfigStream

Ordinal 58
Address 0x7340

CreateDebuggingInterfaceFromVersion

Ordinal 59
Address 0x6a90

CreateInterface

Ordinal 60
Address 0xafe0

DllCanUnloadNow

Ordinal 61
Address 0x1e90

DllGetClassObject

Ordinal 62
Address 0x1d70

DllRegisterServer

Ordinal 63
Address 0x1fc0

DllUnregisterServer

Ordinal 64
Address 0x2130

EEDllRegisterServer

Ordinal 65
Address 0x9b40

EEDllUnregisterServer

Ordinal 66
Address 0x9c70

GetAssemblyMDImport

Ordinal 67
Address 0x9da0

GetCLRMetaHost

Ordinal 68
Address 0xaeb0

GetCORRequiredVersion

Ordinal 69
Address 0x5a70

GetCORRootDirectory

Ordinal 70
Address 0x83d0

GetCORSystemDirectory

Ordinal 71
Address 0x5830

GetCORVersion

Ordinal 72
Address 0x5950

GetCompileInfo

Ordinal 73
Address 0x5270

GetFileVersion

Ordinal 74
Address 0x1c30

GetHashFromAssemblyFile

Ordinal 75
Address 0x23e0

GetHashFromAssemblyFileW

Ordinal 76
Address 0x2580

GetHashFromBlob

Ordinal 77
Address 0x2720

GetHashFromFile

Ordinal 78
Address 0x28a0

GetHashFromFileW

Ordinal 79
Address 0x2a40

GetHashFromHandle

Ordinal 80
Address 0x2be0

GetHostConfigurationFile

Ordinal 81
Address 0x7a30

GetMetaDataInternalInterface

Ordinal 82
Address 0x93c0

GetMetaDataInternalInterfaceFromPublic

Ordinal 83
Address 0x9270

GetMetaDataPublicInterfaceFromInternal

Ordinal 84
Address 0x9120

GetPermissionRequests

Ordinal 85
Address 0x9990

GetRealProcAddress

Ordinal 86
Address 0x6ec0

GetRequestedRuntimeInfo

Ordinal 87
Address 0x5b90

GetRequestedRuntimeVersion

Ordinal 88
Address 0x5de0

GetRequestedRuntimeVersionForCLSID

Ordinal 89
Address 0x5f20

GetVersionFromProcess

Ordinal 90
Address 0x6bb0

GetXMLElement

Ordinal 91
Address 0x7010

GetXMLElementAttribute

Ordinal 92
Address 0x7110

GetXMLObject

Ordinal 93
Address 0x7240

IEE

Ordinal 94
Address 0x8ea0

LoadLibraryShim

Ordinal 95
Address 0x6960

LoadLibraryWithPolicyShim

Ordinal 96
Address 0x8720

LoadStringRCEx

Ordinal 97
Address 0x50f0

LockClrVersion

Ordinal 98
Address 0xd070

MetaDataGetDispenser

Ordinal 99
Address 0x8fd0

ND_CopyObjDst

Ordinal 100
Address 0xa990

ND_CopyObjSrc

Ordinal 101
Address 0xa860

ND_RI2

Ordinal 102
Address 0xa120

ND_RI4

Ordinal 103
Address 0xa220

ND_RI8

Ordinal 104
Address 0xa320

ND_RU1

Ordinal 105
Address 0xa020

ND_WI2

Ordinal 106
Address 0xa530

ND_WI4

Ordinal 107
Address 0xa640

ND_WI8

Ordinal 108
Address 0xa750

ND_WU1

Ordinal 109
Address 0xa420

ReOpenMetaDataWithMemoryEx

Ordinal 110
Address 0x9690

RunDll32ShimW

Ordinal 111
Address 0x6820

RuntimeOSHandle

Ordinal 112
Address 0x7800

RuntimeOpenImage

Ordinal 113
Address 0x7590

RuntimeReleaseHandle

Ordinal 114
Address 0x76d0

StrongNameCompareAssemblies

Ordinal 115
Address 0x2d80

StrongNameErrorInfo

Ordinal 116
Address 0x22a0

StrongNameFreeBuffer

Ordinal 117
Address 0x2ef0

StrongNameGetBlob

Ordinal 118
Address 0x3050

StrongNameGetBlobFromImage

Ordinal 119
Address 0x31c0

StrongNameGetPublicKey

Ordinal 120
Address 0x3350

StrongNameHashSize

Ordinal 121
Address 0x3510

StrongNameKeyDelete

Ordinal 122
Address 0x3670

StrongNameKeyGen

Ordinal 123
Address 0x37c0

StrongNameKeyGenEx

Ordinal 124
Address 0x3950

StrongNameKeyInstall

Ordinal 125
Address 0x3b10

StrongNameSignatureGeneration

Ordinal 126
Address 0x3c80

StrongNameSignatureGenerationEx

Ordinal 127
Address 0x3e00

StrongNameSignatureSize

Ordinal 128
Address 0x3fa0

StrongNameSignatureVerification

Ordinal 129
Address 0x4110

StrongNameSignatureVerificationEx

Ordinal 130
Address 0x4280

StrongNameSignatureVerificationFromImage

Ordinal 131
Address 0x43f0

StrongNameTokenFromAssembly

Ordinal 132
Address 0x4580

StrongNameTokenFromAssemblyEx

Ordinal 133
Address 0x46f0

StrongNameTokenFromPublicKey

Ordinal 134
Address 0x48b0

TranslateSecurityAttributes

Ordinal 135
Address 0x9800

_CorDllMain

Ordinal 136
Address 0x1bd0

_CorExeMain

Ordinal 137
Address 0xabd0

_CorExeMain2

Ordinal 138
Address 0xad20

_CorImageUnloading

Ordinal 139
Address 0x139a0

_CorValidateImage

Ordinal 140
Address 0x137d0

(#2)

Ordinal 142
Address 0x1670

UCVVGC1IXGFB

Type RT_RCDATA
Language English - United States
Codepage Latin 1 / Western European
Size 0x45f2b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.71782
MD5 dc00f95daa60e9944a71f68e501d7d48
SHA1 ea66b1ae750d9cf68a5ff8ffc5e5b2a431071518
SHA256 54f01c6df4a07baa3a787ba3f894d58cf9390e09e8f655c48824dc7e20bd5bad
SHA3 df24656f47a5dba8577b53ef863dac61e4e960968a43a1d6f8c6225316eed02c

1

Type RT_MESSAGETABLE
Language English - United States
Codepage Latin 1 / Western European
Size 0x2e8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.06977
MD5 19318c91616b53c55f154ce4c17b4c27
SHA1 7d111be93570cd2c5282c0368b37dbed40ebc7ff
SHA256 1f94db6279fe79ef416e9cca2374c83d79e121ff0c6ad6a016025d1d2f62fd5e
SHA3 f8e37f937d063b0eda93506639bd4120a64f85db0060f055145ac72e4ce17e93

1 (#2)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x3bc
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.4358
MD5 cb0382ee23e39d7dff3448b7d14e11fb
SHA1 0f554f6dcb3ae8c09ffc79c00af9801c6d289eb3
SHA256 54d477d605f1a1a3a303209aaa964f9e9b2db2ccb6ad5a506711db9361f7393b
SHA3 1f6775b06de5b87c6f85cdd264d964447d464cc5bfed3ce37960e0d9c45faecf

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 10.0.19041.1
ProductVersion 10.0.19041.1
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_DLL
Language English - United States
CompanyName Microsoft Corporation
FileDescription Microsoft .NET Runtime Execution Engine
FileVersion (#2) 10.0.19041.1 (WinBuild.160101.0800)
InternalName mscoree.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename mscoree.dll
ProductName Microsoft® Windows® Operating System
ProductVersion (#2) 10.0.19041.1
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2013-Jun-16 09:38:19
Version 0.0
SizeofData 36
AddressOfRawData 0x51ea4
PointerToRawData 0x50ea4
Referenced File mscoree.pdb

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2013-Jun-16 09:38:19
Version 0.0
SizeofData 888
AddressOfRawData 0x51ec8
PointerToRawData 0x50ec8

UNKNOWN

Characteristics 0
TimeDateStamp 2013-Jun-16 09:38:19
Version 0.0
SizeofData 36
AddressOfRawData 0x52240
PointerToRawData 0x51240

TLS Callbacks

Load Configuration

Size 0x118
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180059a60
GuardCFCheckFunctionPointer 6442741840
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0xce3b9255
Unmarked objects 0
C++ objects (27412) 57
C objects (27412) 140
Imports (VS2008 SP1 build 30729) 3
Total imports 189
ASM objects (27412) 11
Exports (27412) 1
C objects (LTCG) (27412) 52
Resource objects (27412) 1
Linker (27412) 1

Errors

[*] Warning: 1 invalid export(s) not shown.
Leave a comment

No comments yet.