Manalyze report for 00ae8b7bab1e8de69162aebbcc518789ccdcad1bd98aff4f08556812604867ea

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2024-Sep-23 22:06:56
Detected languages	English - United States
Debug artifacts	D:\a\_work\1\s\build\ship\x86\burn.pdb
CompanyName	Microsoft Corporation
FileDescription	Microsoft .NET Runtime - 8.0.33 (x64)
FileVersion	`8.0.33.36622`
InternalName	setup
LegalCopyright	Copyright (c) Microsoft Corporation. All rights reserved.
OriginalFilename	dotnet-runtime-8.0.33-win-x64.exe
ProductName	Microsoft .NET Runtime - 8.0.33 (x64)
ProductVersion	`8.0.33.36622`

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++ 6.0 - 8.0`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`May have dropper capabilities: CurrentVersion\Run` `References the BITS service` Contains domain names: appsyndication.org crl.microsoft.com http://appsyndication.org http://crl.microsoft.com http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0 http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z http://www.microsoft.com http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0 http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0 http://www.microsoft.com/pkiops/Docs/Repository.htm0 http://www.microsoft.com/pkiops/certs/Microsoft%20Code%20Signing%20PCA%202024.crt0 http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010 http://www.microsoft.com/pkiops/crl/Microsoft%20Code%20Signing%20PCA%202024.crl0m http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010 http://www.microsoft.com0 microsoft.com www.microsoft.com
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to SHA256` `Microsoft's Cryptography API`
Suspicious	The PE is possibly packed.	`Unusual section name found: .wixburn`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LoadLibraryW GetProcAddress LoadLibraryExW LoadLibraryExA` `Can access the registry: RegCloseKey RegOpenKeyExW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW` `Possibly launches other programs: CreateProcessW` `Uses Microsoft's cryptographic API: CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW` `Can create temporary files: CreateFileW CreateFileA GetTempPathW` `Memory manipulation functions often used by packers: VirtualAlloc VirtualProtect` `Functions related to the privilege level: OpenProcessToken AdjustTokenPrivileges CheckTokenMembership` `Interacts with services: ChangeServiceConfigW ControlService OpenSCManagerW OpenServiceW QueryServiceStatus QueryServiceConfigW` `Manipulates other processes: OpenProcess` `Changes object ACLs: SetNamedSecurityInfoW` `Can shut the system down or lock the screen: InitiateSystemShutdownExW`
Info	The PE is digitally signed.	`Signer: .NET` `Issuer: Microsoft Code Signing PCA 2024`
Safe	VirusTotal score: 0/71 (Scanned on 2026-10-31 21:34:23)	`All the AVs think this file is safe.`

Hashes

MD5	`e326e67a7b161b2e8cdc22d704823671` 🔍
SHA1	`cc4eb24ef8bb0eaa3826547bf1d0bb47969dbf13` 🔍
SHA256	`00ae8b7bab1e8de69162aebbcc518789ccdcad1bd98aff4f08556812604867ea` 🔍
SHA3	`39df0906ea2ad6193f4b25a693ac1169575b5f66cf34796f50fdab96d54e611f` 🔍
SSDeep	`786432:ooQm0ydqU6vQObhP1HbTBzDiAovF9UKHIvR:YPykpQ8t7diAiPHIJ` 🔍
Imports Hash	`c0346260f2600eb35d834dfebf811106` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x108`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`6`
TimeDateStamp	2024-Sep-23 22:06:56
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_NET_RUN_FROM_SWAP` `IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP`

Image Optional Header

Magic	`PE32`
LinkerVersion	`14.0`
SizeOfCode	`0x4a000`
SizeOfInitializedData	`0x27c00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0003054B (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0x4b000`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x76000`
SizeOfHeaders	`0x400`
Checksum	`0x1b514f6`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`bb47277f1937986a08f1166869ae6891 🔍`
SHA1	`25ceebe916e1aea5f7993fa2da83b7f05a7e1f50 🔍`
SHA256	`94fb2c6358a9cde44139dfe025698589d1e4f77714900e7e970b63d8600a8b1a 🔍`
SHA3	`8c26f4b6b5588981d2d40a4f41131c83720ccc857a4fad3bcc7c3de7f9686e52 🔍`
VirtualSize	`0x49fd3`
VirtualAddress	`0x1000`
SizeOfRawData	`0x4a000`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.57128`

.rdata

MD5	`178fbc2ec400c7613bf63111a999e057 🔍`
SHA1	`77a9976fb624167ccc73204cebb6ced39232fa00 🔍`
SHA256	`51e4933f6497d5bc262a48f5cf6d6d822fa8659824a6419ec5986e645766b9ee 🔍`
SHA3	`6ab037a7f97db2d8448207e9d30c3f0421abd7093ba6b856245bd58403c492d1 🔍`
VirtualSize	`0x1f37c`
VirtualAddress	`0x4b000`
SizeOfRawData	`0x1f400`
PointerToRawData	`0x4a400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.07749`

.data

MD5	`59e43e6fcd8d2214332b5e578549f172 🔍`
SHA1	`1198d44983a4efea9ce7ad50ab865f12d0d71503 🔍`
SHA256	`9b32bdfdc15bbd7276b2532f8dfb3a4c5e41b00f2dfba8adc50b621718f8765d 🔍`
SHA3	`8b4ec0f21a54f8bd96539bf76b10037e6a2a9fd8abcc426cb3bd6ba82a086322 🔍`
VirtualSize	`0x181c`
VirtualAddress	`0x6b000`
SizeOfRawData	`0xc00`
PointerToRawData	`0x69800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`2.851`

.wixburn

MD5	`dec5b47253ec9d09cfc77f797f9a7e40 🔍`
SHA1	`356a374a0c7338b4dfcd4f1b242992cc2cad720e 🔍`
SHA256	`1601abcb86d53ad888afa7989fdca2afe8df695f78fbe00a5106a1d486ef6299 🔍`
SHA3	`98aec458a59579ab4bf58312265f153e76b409165fce3a82ac6c78a4366c654a 🔍`
VirtualSize	`0x38`
VirtualAddress	`0x6d000`
SizeOfRawData	`0x200`
PointerToRawData	`0x6a400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.743624`

.rsrc

MD5	`08e49e0490d033a1df180cf1fd600850 🔍`
SHA1	`14802b1c44caa2b4c2a5f1d97abf727d8a2ea5ae 🔍`
SHA256	`5fd939673444764804ca692c73da245a293ad8344c0ab2f543a088ed50998025 🔍`
SHA3	`9572a49564c0e19235864ed3a7a7e5386434a7c65d5652f3638941291da275a2 🔍`
VirtualSize	`0x3afc`
VirtualAddress	`0x6e000`
SizeOfRawData	`0x3c00`
PointerToRawData	`0x6a600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.5093`

.reloc

MD5	`1f930e56b9699bd5e218b4e3d202f8e3 🔍`
SHA1	`a595f3e411b2f0858edd524da27cf55499b47b70 🔍`
SHA256	`431070f9edd9e970c87fc3114e10c67d5d6f910ce9a6106d487f120268d664dc 🔍`
SHA3	`74059a1555b3291a1bdb40a4894630673eadf7c515832990599851b70a1d1ddd 🔍`
VirtualSize	`0x3dec`
VirtualAddress	`0x72000`
SizeOfRawData	`0x3e00`
PointerToRawData	`0x6e200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`6.78711`

Imports

ADVAPI32.dll	`RegCloseKey` `RegOpenKeyExW` `RegCreateKeyExW` `RegDeleteKeyW` `RegDeleteValueW` `RegEnumKeyExW` `RegEnumValueW` `RegQueryInfoKeyW` `RegQueryValueExW` `RegSetValueExW` `OpenProcessToken` `AdjustTokenPrivileges` `LookupPrivilegeValueW` `InitiateSystemShutdownExW` `GetUserNameW` `CloseEventLog` `OpenEventLogW` `ReportEventW` `ConvertStringSecurityDescriptorToSecurityDescriptorW` `CreateWellKnownSid` `InitializeAcl` `DecryptFileW` `SetEntriesInAclW` `ChangeServiceConfigW` `CloseServiceHandle` `ControlService` `OpenSCManagerW` `OpenServiceW` `QueryServiceStatus` `SetNamedSecurityInfoW` `CheckTokenMembership` `AllocateAndInitializeSid` `SetEntriesInAclA` `SetSecurityDescriptorOwner` `SetSecurityDescriptorGroup` `SetSecurityDescriptorDacl` `InitializeSecurityDescriptor` `GetTokenInformation` `CryptDestroyHash` `CryptHashData` `CryptCreateHash` `CryptGetHashParam` `CryptReleaseContext` `CryptAcquireContextW` `QueryServiceConfigW`
USER32.dll	`PeekMessageW` `PostMessageW` `IsWindow` `WaitForInputIdle` `PostQuitMessage` `GetMessageW` `TranslateMessage` `MsgWaitForMultipleObjects` `PostThreadMessageW` `GetMonitorInfoW` `MonitorFromPoint` `IsDialogMessageW` `LoadCursorW` `LoadBitmapW` `SetWindowLongW` `GetWindowLongW` `GetCursorPos` `MessageBoxW` `CreateWindowExW` `UnregisterClassW` `RegisterClassW` `DefWindowProcW` `DispatchMessageW`
OLEAUT32.dll	`VariantInit` `SysAllocString` `VariantClear` `SysFreeString`
GDI32.dll	`DeleteDC` `DeleteObject` `SelectObject` `StretchBlt` `GetObjectW` `CreateCompatibleDC`
SHELL32.dll	`CommandLineToArgvW` `SHGetFolderPathW` `ShellExecuteExW`
ole32.dll	`CoUninitialize` `CoInitializeEx` `CoInitialize` `StringFromGUID2` `CoCreateInstance` `CoTaskMemFree` `CoInitializeSecurity` `CLSIDFromProgID`
KERNEL32.dll	`GetFileType` `GetStdHandle` `InitializeCriticalSectionAndSpinCount` `SetLastError` `RtlUnwind` `CreateFileW` `CloseHandle` `ExitProcess` `CreateFileA` `SetFilePointer` `WriteFile` `GetLastError` `GetCurrentProcessId` `GetSystemDirectoryW` `LoadLibraryW` `lstrlenA` `HeapSetInformation` `GetModuleHandleW` `GetProcAddress` `LocalFree` `SetCurrentDirectoryW` `GetCurrentDirectoryW` `CreateDirectoryW` `DeleteFileW` `FindClose` `FindFirstFileW` `FindNextFileW` `GetFileAttributesW` `GetTempFileNameW` `RemoveDirectoryW` `SetFileAttributesW` `GetTempPathW` `MoveFileExW` `FormatMessageW` `lstrlenW` `MultiByteToWideChar` `IsValidCodePage` `LCMapStringW` `ExpandEnvironmentStringsW` `GetFileSizeEx` `GetFullPathNameW` `ReadFile` `SetFilePointerEx` `SetFileTime` `Sleep` `GlobalAlloc` `GlobalFree` `CopyFileW` `GetLocalTime` `GetModuleFileNameW` `CompareStringW` `HeapAlloc` `HeapReAlloc` `HeapFree` `HeapSize` `GetProcessHeap` `FreeLibrary` `InitializeCriticalSection` `DeleteCriticalSection` `ReleaseMutex` `GetCurrentProcess` `FindFirstFileExW` `TlsAlloc` `TlsGetValue` `TlsSetValue` `TlsFree` `CreateProcessW` `GetVersionExW` `VerSetConditionMask` `GetVolumePathNameW` `EnterCriticalSection` `LeaveCriticalSection` `GetSystemTime` `GetWindowsDirectoryW` `GetNativeSystemInfo` `GetSystemWow64DirectoryW` `GetModuleHandleExW` `GetComputerNameW` `VerifyVersionInfoW` `GetDateFormatW` `GetUserDefaultUILanguage` `GetUserDefaultLangID` `GetSystemDefaultLangID` `GetStringTypeW` `DuplicateHandle` `LoadLibraryExW` `CreateEventW` `ProcessIdToSessionId` `ConnectNamedPipe` `SetNamedPipeHandleState` `CreateNamedPipeW` `WaitForSingleObject` `GetProcessId` `OpenProcess` `CreateThread` `GetExitCodeThread` `SetEvent` `WaitForMultipleObjects` `LocalFileTimeToFileTime` `SetEndOfFile` `ResetEvent` `DosDateTimeToFileTime` `CompareStringA` `GetExitCodeProcess` `SetThreadExecutionState` `CopyFileExW` `CreateMutexW` `CreateFileMappingW` `MapViewOfFile` `UnmapViewOfFile` `GetThreadLocale` `GetStartupInfoW` `IsDebuggerPresent` `GetACP` `GetOEMCP` `GetCPInfo` `GetCommandLineA` `GetCommandLineW` `GetEnvironmentStringsW` `FreeEnvironmentStringsW` `SetStdHandle` `FlushFileBuffers` `GetConsoleCP` `GetConsoleMode` `DecodePointer` `WriteConsoleW` `GetModuleHandleA` `VirtualAlloc` `VirtualFree` `SystemTimeToTzSpecificLocalTime` `SystemTimeToFileTime` `GetCurrentThreadId` `WideCharToMultiByte` `InitializeSListHead` `GetSystemTimeAsFileTime` `QueryPerformanceCounter` `IsProcessorFeaturePresent` `TerminateProcess` `SetUnhandledExceptionFilter` `UnhandledExceptionFilter` `LoadLibraryExA` `VirtualQuery` `VirtualProtect` `GetSystemInfo` `RaiseException` `GetTimeZoneInformation`
RPCRT4.dll	`UuidCreate`
VERSION.dll (delay-loaded)	`GetFileVersionInfoSizeW` `VerQueryValueW` `GetFileVersionInfoW`

Delayed Imports

Attributes	`0x1`
Name	`VERSION.dll`
ModuleHandle	`0x6bbcc`
DelayImportAddressTable	`0x6ba5c`
DelayImportNameTable	`0x689e8`
BoundDelayImportTable	`0x68c7c`
UnloadDelayImportTable	`0`
TimeStamp	`1970-Jan-01 00:00:00`

1

Type	`RT_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x8a8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`4.27817`
MD5	`dd74ac90d0252284f1ce309880b60a82 🔍`
SHA1	`add64a2bb1668d419438ce849b4dee87ec84267f 🔍`
SHA256	`9e3bdf1cc1dcfd284924c25050c51cca0412ec699da8dc2046e6f76096bce5ee 🔍`
SHA3	`1d44a4f6d410b654acadbadd50c6e757bbf9802e022d732bcbdf1c1fb6cdfa63 🔍`

1 (#2)

Type	`RT_MESSAGETABLE`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x2840`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.06919`
MD5	`a99c9f2aba6eb725972156b7a4943e46 🔍`
SHA1	`9bfca5062deb9d067f118019fe748d110962a8d7 🔍`
SHA256	`e580ff987740c1e27979aaaa14ba001b06c86929cc321945cf1bdb614d257255 🔍`
SHA3	`4266b8855f8b84c8583e3f5c0ffccc59eece1761a21cfeff04601c9bfa9e6db4 🔍`

1 (#3)

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x14`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`1.81924`
Detected Filetype	Icon file
MD5	`cbee427fa121aba9b9b265ff05de5383 🔍`
SHA1	`24fcae33001c8e0f5ec795c6edf076a69d59589f 🔍`
SHA256	`494e4fd717fa1ee0c5c7bb3b4e28fdab4b7f6e95b4f9865f5ab86f03f62ae62c 🔍`
SHA3	`a3fa35d56632275ba55716a4964f02031270f61f06a903fc460ac2dd6bebde85 🔍`

1 (#4)

Type	`RT_VERSION`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x3b4`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.44939`
MD5	`ca099263848b4eaa867414f790f45725 🔍`
SHA1	`fc00424084fab70e19a4cc359895e74a1d4eb4e2 🔍`
SHA256	`2aa1274bd85f7cffdb4b361866c97e244eb548d9781e9096014fcaefc725fa1d 🔍`
SHA3	`b8dfc49bf98fb9cb4b20b0314926784bb3ede5b7fe768bd6db03f6129d5fbe12 🔍`

1 (#5)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x4d2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.30829`
MD5	`8ff25bb3faceb412f946beb4d4b70aba 🔍`
SHA1	`e77a0a3c8dcda8fca1bf8032ced5c633bd13695b 🔍`
SHA256	`409b7a72f95793e29fe6b03ef2c28effbc5b80ffe57fb7a974439022cc7a0e75 🔍`
SHA3	`3fe08b5bceae3a00c5e5c93835e5efd035482c03a6c9aae3749b8dba22bacd0b 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	8.0.33.36622
ProductVersion	8.0.33.36622
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	English - United States
CompanyName	Microsoft Corporation
FileDescription	Microsoft .NET Runtime - 8.0.33 (x64)
FileVersion (#2)	8.0.33.36622
InternalName	setup
LegalCopyright	Copyright (c) Microsoft Corporation. All rights reserved.
OriginalFilename	dotnet-runtime-8.0.33-win-x64.exe
ProductName	Microsoft .NET Runtime - 8.0.33 (x64)
ProductVersion (#2)	8.0.33.36622

Resource LangID	English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2024-Sep-23 22:06:56
Version	`0.0`
SizeofData	`63`
AddressOfRawData	`0x6802c`
PointerToRawData	`0x6742c`
Referenced File	D:\a\_work\1\s\build\ship\x86\burn.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics	`0`
TimeDateStamp	2024-Sep-23 22:06:56
Version	`0.0`
SizeofData	`20`
AddressOfRawData	`0x6806c`
PointerToRawData	`0x6746c`

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2024-Sep-23 22:06:56
Version	`0.0`
SizeofData	`984`
AddressOfRawData	`0x68080`
PointerToRawData	`0x67480`

TLS Callbacks

StartAddressOfRawData	`0x468468`
EndAddressOfRawData	`0x468470`
AddressOfIndex	`0x46bbec`
AddressOfCallbacks	`0x44b42c`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_4BYTES`
Callbacks	`(EMPTY)`

Load Configuration

Size	`0xa0`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0x800`
EditList	`0`
SecurityCookie	`0x46b008`
SEHandlerTable	`0x468020`
SEHandlerCount	`3`

RICH Header

XOR Key	`0x8aea3c3`
Unmarked objects	`0`
ASM objects (26213)	`10`
C++ objects (26213)	`143`
C objects (VS 2015/2017 runtime 26706)	`19`
ASM objects (VS 2015/2017 runtime 26706)	`19`
C++ objects (VS 2015/2017 runtime 26706)	`43`
C objects (26213)	`21`
C objects (CVTCIL) (26213)	`2`
Imports (26213)	`17`
Total imports	`334`
C++ objects (27051)	`75`
Resource objects (27051)	`1`
151	`2`
Linker (27051)	`1`

Errors

Leave a comment

No comments yet.