c615a9c381de5824a8f94f74f71ce9f7c74c70a4fbcaf87fde4aa2c9268be793.exe

Executable memory allocation indicator 0x4abf6–0x4ac26

0x4abf6498bc2498bf9f348ab4c8b15faed0100I..I...H.L......
0x4ac0641b840000000498d7908418bc8418bc2[email protected]..
0x4ac1683e03f2bc8498b4708488b10418bc048..?+.I.G.H..A..H
0x4ac26d3ca                            ..              

.dll extension reference 0x64a10–0x64a40

0x64a106e00740064006c006c00000000000000n.t.d.l.l.......
0x64a206d00730063006f007200650065002e00m.s.c.o.r.e.e...
0x64a3064006c006c0000006b00650072006e00d.l.l...k.e.r.n.
0x64a4065006c00330032002e0064          e.l.3.2...d     

Close handle 0x66434–0x66494

0x664344c6f636b4578636c7573697665009400LockExclusive...
0x66444436c6f736548616e646c6500d2004372CloseHandle...Cr
0x664546561746546696c654100da0043726561eateFileA...Crea
⋯4 more rows

Initialize thread-safe list header 0x67158–0x67438

0x6715816540c0016340b00163212f010e00ec0.T...4...2......
0x671680c700b60191c03000e011c0002500000.p.`.........P..
0x6717844630400d000000001250c0025680500Dc.......%..%h..
0x67188197411001964100019540f0019340e00.t...d...T...4..
0x6719819b215e00114080014640d0014540c00.........d...T..
0x671a814340b00147210700114080014641100.4...r.p.....d..
0x671b81454100014340f0014b2107009180200.T...4.....p....
0x671c818d21430f07104000100000043800400...0.q......C...
0x671d86380040026c205006380040001080400c...&...c.......
0x671e808720470035002300918020018d21430.r.p.P.0.......0
0x671f8f07104000100000097800400b7800400.q..............
0x672087ec10500b7800400090d01000d820000~...............
0x67218f071040001000000fd8004000c810400.q..............
0x67228dcc205000c8104000107030007420350.............B.P
0x6723802300000011508001574080015640700.0.......t...d..
0x6724815340600153211e00202040003160006.4...2..........
0x6725802600170000000000100000000000000.`.p............
0x6726802010300021600060170000001100500.........p......
0x6727810011600047003300250000001060200.....p.0.P......
0x67288063202702105020005340700e0880400.2.p!....4......
0x67298ef8804008482060021000000e0880400........!.......
0x672a8ef8804008482060001180a0018640a00.............d..
0x672b81854090018340800183214f012e01070.T...4...2.....p
0x672c801190a0019740b0019640a0019540900.....t...d...T..
0x672d819340800195215e00114080014640b00.4...R.......d..
0x672e814540a00143409001452107019270a00.T...4...R.p.'..
0x672f81964120019341100199212f010e00ec0.d...4..........
0x673080c700b504463040040000000010a0400.p.PDc..@.......
0x673180a3408000a5206700114080014640f00.4...R.p.....d..
0x6732814540e0014340d001492107019330b00.T...4.....p.3..
0x6733822749b0022649a002234990022019400"t.."d.."4.."...
0x6734814f012e0105000004463040090040000.....P..Dc......
0x67358110f04000f3406000f320b70f0710400.....4...2.p.q..
0x6736801000000cea10400d8a1040072c30500............r...
0x6737800000000011c0c001c640e001c540d00.........d...T..
0x673881c340c001c5218f016e014d012c01070.4...R.........p
⋯5 more rows
0x673e8daaa0400ffffffff191e04001e340c00.............4..
0x673f811920a50d47e0400d8e10500ffffffff...P.~..........
0x674083481040000000000f6ab0400000000004...............
0x674180906020006520230f071040001000000.....R.0.q......
0x6742839ac040092ac0400a7c30500ddac04009...............
0x67438110f04000f3406000f              .....4...       

PE version resource structure 0x12124e–0x12127e

0x12124e000000000000000000008c0334000000............4...
0x12125e560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x12126e4f004e005f0049004e0046004f000000O.N._.I.N.F.O...
0x12127e0000bd04effe0000010000000a0001  ............... 

c615a9c381de5824a8f94f74f71ce9f7c74c70a4fbcaf87fde4aa2c9268be793.exe

Evidence