b3c25ea72103c711582a8f9a8b0b4a8b7c5bd6fbc043fa0f18276e8e6ca7e4bf

Sharing

Copy URL Twitter E-mail

General

Target

b3c25ea72103c711582a8f9a8b0b4a8b7c5bd6fbc043fa0f18276e8e6ca7e4bf
Size

513KB
MD5

b02da5cc8706a2dff827515f7eacd41a
SHA1

5ada727e6befa8cc0daafb97afea432c2b76e328
SHA256

b3c25ea72103c711582a8f9a8b0b4a8b7c5bd6fbc043fa0f18276e8e6ca7e4bf
SHA512

18ad1a8761dc2c06d2dafa0652166c5109eaf67c02a6aae921e60397c368e9b6af0c66cb0d223252fc4ee98a47b17121aa0a63bb808c1f4de52e9f59040c71df
SSDEEP

12288:n1Wj0UAjl/lg1bmAaBSw6L8KeC7lsXspO9gGrvg5uI7/:n1mDAh/obIAsXsoabuIz

Score

N/A

Malware Config

Signatures

Files

b3c25ea72103c711582a8f9a8b0b4a8b7c5bd6fbc043fa0f18276e8e6ca7e4bf
.zip
uDWM.dll
.dll windows x86

3a73e6abb7c208a1c1c37c38619573f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_purecall
memmove
wcsrchr
_wcsicmp
memset
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_ftol2_sse
floor
memcpy
_CIsqrt
_amsg_exit
_initterm
_finite
_XcptFilter
malloc
modf
free
_ftol2

ntdll

EtwEventWrite
DbgPrintEx
DbgPrompt
RtlCaptureStackBackTrace
WinSqmIncrementDWORD
RtlIsGenericTableEmpty
WinSqmIsOptedIn
EtwEventUnregister
EtwEventRegister
NtQuerySystemInformation
RtlEnumerateGenericTableWithoutSplaying
RtlDeleteElementGenericTable
RtlInsertElementGenericTable
RtlLookupElementGenericTable
RtlInitializeGenericTable
WinSqmAddToStream
EtwEventEnabled

api-ms-win-core-localregistry-l1-1-0

RegGetValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

user32

SetRect
MonitorFromRect
GetPropW
InternalGetWindowText
DestroyIcon
GetGuiResources
PaintMonitor
GetWindowRgnEx
GetWindowMinimizeRect
SetWindowRgnEx
UpdateWindowTransform
ReleaseDC
GetSysColor
InflateRect
GetDC
GetDesktopWindow
IntersectRect
MonitorFromWindow
GetClassNameW
EqualRect
GetWindowPlacement
AdjustWindowRectEx
NotifyWinEvent
UnionRect
SetRectEmpty
IsRectEmpty
CopyRect
OffsetRect
EnumDisplayMonitors
GetSystemMetrics
SystemParametersInfoW
PostThreadMessageW
GetKeyState
LoadCursorW
RegisterClassW
MsgWaitForMultipleObjectsEx
PeekMessageW
DispatchMessageW
UnregisterClassW
GetWindowThreadProcessId
DrawTextW
SetWindowPos
SetForegroundWindow
LockSetForegroundWindow
DefWindowProcW
IsWindowEnabled
GetLastActivePopup
GetMonitorInfoW
GetAncestor
SwitchToThisWindow
RemovePropW
SetPropW
SendNotifyMessageW
GetForegroundWindow
CreateWindowExW
SetCursor
PostMessageW
RegisterHotKey
UnregisterHotKey
CharNextW
GetWindowLongW
GetAsyncKeyState
FindWindowW
BroadcastSystemMessageW
LoadStringW
PtInRect
GetWindowRect

gdi32

GetTextAlign
SetTextAlign
GetTextMetricsW
SetBkMode
CreateFontIndirectW
PtInRegion
DeleteDC
SetWindowOrgEx
GdiFlush
SelectObject
CreateCompatibleDC
CreateBitmap
DeleteObject
CombineRgn
CreateRectRgn
GetDeviceCaps
CreateRoundRectRgn
GetRegionData
CreateRectRgnIndirect
SelectClipRgn
CreateDIBSection

uxtheme

GetThemeRect
GetThemeColor
GetThemeStream
OpenThemeData
GetCurrentThemeName
GetThemeInt
CloseThemeData
GetThemeMargins

slc

SLGetWindowsInformationDWORD

dwmcore

MilChannel_EndCommand
MilChannel_SendSyncCommand
MilChannel_BeginCommand
MilResource_CreateOrAddRefOnChannel
MilChannel_CommitChannel
MilChannel_GetMarshalType
MilConnection_CreateChannel
MilConnection_DestroyChannel
MilResource_ReleaseOnChannel
MilResource_SendCommandBitmapSource
MilChannel_FreeSyncCommandReplay
MilChannel_AppendCommandData
MilResource_SendCommand

dwmredir

DwmRedirectionManagerShutdown
DwmRedirectionManagerSetClientRenderTarget
DwmVersionCheck
DwmRedirectionManagerSetClientChannel
DwmRedirectionManagerInitialize

windowscodecs

WICCreateImagingFactory_Proxy

kernel32

RegSetValueExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DebugBreak
GetCurrentThread
TerminateThread
TerminateProcess
IsDebuggerPresent
ExitProcess
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree
LoadLibraryExA
InterlockedCompareExchange
GetProcAddress
DelayLoadFailureHook
QueryFullProcessImageNameW
OpenProcess
GetTickCount
lstrcmpW
GetCurrentProcessId
DisableThreadLibraryCalls
MulDiv
GetModuleHandleW
InterlockedExchange
GetLocaleInfoW
GetUserDefaultUILanguage
EnumUILanguagesW
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
RaiseException
SetWaitableTimer
CancelWaitableTimer
SetEvent
QueryPerformanceFrequency
CreateWaitableTimerW
QueryPerformanceCounter
FreeLibrary
LoadLibraryExW
WaitForSingleObject
GetThreadId
CloseHandle
WaitForMultipleObjects
CreateThread
CreateEventW
GetCurrentProcess
SetPriorityClass
DeleteCriticalSection
InitializeCriticalSection
LocalFree
LocalAlloc
GetLastError
SetLastError
RegCreateKeyExW
GetSystemTimeAsFileTime
Sleep

Sections

.text
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uexfat.dll
.dll windows x86

cd72a3805ad0e696e468b11b5af3ca16

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
_itow_s
wcsncmp
_vsnwprintf
_vsnprintf
memcpy
memset

ntdll

RtlAllocateHeap
RtlCompareMemory
RtlTimeToTimeFields
RtlSystemTimeToLocalTime
RtlFreeHeap

kernel32

GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
Sleep
InterlockedExchange
lstrlenW
GetLocalTime
InterlockedCompareExchange
DeviceIoControl
GetLastError
GetSystemTimeAsFileTime
GetLocaleInfoW
LoadLibraryExW
FormatMessageA
FreeLibrary
DisableThreadLibraryCalls
SetLastError
GetWindowsDirectoryW

user32

CharToOemA

ulib

?SyncLength@WSTRING@@QAEKXZ
?Strcat@WSTRING@@QAEEPBV1@@Z
?SPrintfAppend@DSTRING@@UAAEPBGZZ
?SPrintf@DSTRING@@UAAEPBGZZ
?NewBuf@DSTRING@@UAEEK@Z
?Resize@DSTRING@@UAEEK@Z
?InsertString@WSTRING@@QAEEKPBV1@KK@Z
??1OBJECT@@UAE@XZ
??0OBJECT@@IAE@XZ
?Initialize@HMEM@@QAEEXZ
?MakeFileToken@MESSAGE@@SG_KPBD@Z
?DisplayMsg@MESSAGE@@QAAEKW4MESSAGE_TYPE@@KPBDZZ
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?Initialize@WSTRING@@QAEEPBDK@Z
?Initialize@WSTRING@@QAEEXZ
??0HMEM@@QAE@XZ
?QueryChCount@WSTRING@@QBEKXZ
?QueryChAt@WSTRING@@QBEGK@Z
?DisplayMsg@MESSAGE@@QAAEKPBDZZ
?SetClassDescriptor@OBJECT@@IAEXPBVCLASS_DESCRIPTOR@@@Z
?Compare@OBJECT@@UBEJPBV1@@Z
??0MESSAGE@@QAE@XZ
?Initialize@MESSAGE@@QAEEXZ
??1MESSAGE@@UAE@XZ
??0DSTRING@@QAE@XZ
?Initialize@WSTRING@@QAEEPBGK@Z
?Stricmp@WSTRING@@QBEJPBV1@@Z
??1DSTRING@@UAE@XZ
?DisplayMsg@MESSAGE@@QAEEK@Z
?Display@MESSAGE@@QAAEPBDZZ
?Construct@OBJECT@@IAEXXZ
?Initialize@CONT_MEM@@QAEEPAXK@Z
??0CONT_MEM@@QAE@XZ
?UlibRealloc@@YGPAXPAXK@Z
?GetWSTR@WSTRING@@QBEPBGXZ
??1HMEM@@UAE@XZ

ifsutil

?Initialize@SECRUN@@QAEEPAVMEM@@PAVIO_DP_DRIVE@@VBIG_INT@@K@Z
?GetDrive@SECRUN@@QAEPAVIO_DP_DRIVE@@XZ
??1SECRUN@@UAE@XZ
??0SECRUN@@QAE@XZ
?Initialize@VOL_LIODPDRV@@IAE?AW4FORMAT_ERROR_CODE@@PBVWSTRING@@PAVSUPERAREA@@PAVMESSAGE@@EEW4_MEDIA_TYPE@@GEIE@Z
??0VOL_LIODPDRV@@IAE@XZ
?QuerySectors@DP_DRIVE@@UBE?AVBIG_INT@@XZ
?QueryWriteBlockSize@DP_DRIVE@@UBEKXZ
?QuerySectorSize@DP_DRIVE@@UBEKXZ
??1VOL_LIODPDRV@@UAE@XZ
?QueryNtfsTime@IFS_SYSTEM@@SGXPAT_LARGE_INTEGER@@@Z
?QueryDriveType@DP_DRIVE@@QBE?AW4DRIVE_TYPE@@XZ
?DismountVolume@IFS_SYSTEM@@SGEPBVWSTRING@@@Z
??0DP_DRIVE@@QAE@XZ
?Initialize@DP_DRIVE@@QAEEPBVWSTRING@@PAVMESSAGE@@EEG@Z
?Format@VOL_LIODPDRV@@QAE?AW4FORMAT_ERROR_CODE@@PBVWSTRING@@PAVMESSAGE@@KKK@Z
?DosDriveNameToNtDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z
?DismountAndLock@IO_DP_DRIVE@@QAEEXZ
?SetFileSystemName@VOL_LIODPDRV@@QAEEPBG@Z
?Lock@IO_DP_DRIVE@@QAEEXZ
?QueryHotPlugInfo@DP_DRIVE@@QBEEXZ
??0NUMBER_SET@@QAE@XZ
?Initialize@NUMBER_SET@@QAEEXZ
?Verify@IO_DP_DRIVE@@QAEEVBIG_INT@@0PAVNUMBER_SET@@@Z
??1NUMBER_SET@@UAE@XZ
?QueryDriveHandle@DP_DRIVE@@QBEPAXXZ
?QueryMediaByte@DP_DRIVE@@QBEEXZ
?DoesIntersectSet@NUMBER_SET@@QBEEVBIG_INT@@0@Z
?FormatScaleTotalFreeClusters@IFS_SYSTEM@@SGE_K0PAK1PA_K2@Z
?QueryNumber@NUMBER_SET@@QBE?AVBIG_INT@@V2@@Z
?Write@LOG_IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
?Read@LOG_IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
?Initialize@SUPERAREA@@IAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@KPAVMESSAGE@@@Z
??1SUPERAREA@@UAE@XZ
?Write@SECRUN@@UAEEXZ
?Read@SECRUN@@UAEEXZ
??0SUPERAREA@@IAE@XZ
?Initialize@LOG_IO_DP_DRIVE@@QAEEPBVWSTRING@@PAVMESSAGE@@EG@Z
?SetSystemId@LOG_IO_DP_DRIVE@@QAEEE@Z
?HardWrite@IO_DP_DRIVE@@QAEEVBIG_INT@@KPAXE@Z
?Add@NUMBER_SET@@QAEEVBIG_INT@@@Z
?ChkDsk@VOL_LIODPDRV@@QAEEW4FIX_LEVEL@@PAVMESSAGE@@KKGPAKPBVWSTRING@@@Z

Exports

Exports

??0CLUSTER_CHAIN@@QAE@XZ
??0EXFATDIR@@QAE@XZ
??0EXFAT_DIRENT@@QAE@XZ
??0EXFAT_SA@@QAE@XZ
??0EXFAT_VOL@@QAE@XZ
??1CLUSTER_CHAIN@@UAE@XZ
??1EXFATDIR@@UAE@XZ
??1EXFAT_DIRENT@@UAE@XZ
??1EXFAT_SA@@UAE@XZ
??1EXFAT_VOL@@UAE@XZ
?AllocChain@FAT@@QAEKPAVEXFATBITMAP@@KPAK@Z
?FreeChain@FAT@@QAEXPAVEXFATBITMAP@@K@Z
?Initialize@CLUSTER_CHAIN@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVEXFAT_SA@@PBVFAT@@KKE@Z
?Initialize@EXFATDIR@@QAEEPAVHMEM@@PAVLOG_IO_DP_DRIVE@@PAVEXFAT_SA@@PBVFAT@@KKE@Z
?Initialize@EXFAT_DIRENT@@QAEEPAVEXFAT_SA@@PAXPAVEXFATDIR@@K@Z
?Initialize@EXFAT_SA@@QAEEPAVLOG_IO_DP_DRIVE@@PAVMESSAGE@@@Z
?Initialize@EXFAT_VOL@@QAE?AW4FORMAT_ERROR_CODE@@PBVWSTRING@@PAVMESSAGE@@EEW4_MEDIA_TYPE@@EE@Z
?QueryAllocatedClusters@FAT@@QBEKXZ
?QueryFileSize@EXFAT_DIRENT@@QAE_JXZ
?QueryLengthOfChain@FAT@@QBEKKPAK@Z
?QueryNthCluster@FAT@@QBEKKK@Z
?QueryStartingCluster@EXFAT_DIRENT@@QAEKXZ
?Read@CLUSTER_CHAIN@@UAEEXZ
?ReadAndRecordBadSectors@CLUSTER_CHAIN@@QAEEPAVEXFATSECRUNBITMAP@@@Z
?SetFileSize@EXFAT_DIRENT@@QAEE_J@Z
?SetStartingCluster@EXFAT_DIRENT@@QAEEK@Z
?VerifyAndFixPhase2@EXFAT_DIRENT@@QAEEPAVEXFATBITMAP@@0PAVWSTRING@@EEEW4FIX_LEVEL@@PAEPAVMESSAGE@@@Z
?Write@CLUSTER_CHAIN@@UAEEXZ
?WriteAndSkipBadSectors@CLUSTER_CHAIN@@QAEEXZ
Chkdsk
ChkdskEx
Format
FormatEx
GetFilesystemInformation
Recover

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ufat.dll
.dll windows x86

19a7fd9a2488210ec52ecfac74568257

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
_vsnprintf
_purecall
memset
memcpy

ntdll

RtlAllocateHeap
RtlTimeFieldsToTime
RtlTimeToTimeFields
RtlSystemTimeToLocalTime
NtCreateFile
RtlInitUnicodeString
NtClose
NtDeviceIoControlFile
NtQuerySystemTime
RtlFreeHeap

kernel32

SetUnhandledExceptionFilter
SetLastError
InterlockedCompareExchange
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
Sleep
InterlockedExchange
DisableThreadLibraryCalls
LoadLibraryExW
FormatMessageA
FreeLibrary
GetLocaleInfoEx
GetWindowsDirectoryW

user32

MessageBoxA
CharToOemA

ulib

?QueryWSTR@WSTRING@@QBEPAGKKPAGKE@Z
??1BITVECTOR@@UAE@XZ
?Initialize@BITVECTOR@@QAEEKW4BIT@@PAK@Z
??0BITVECTOR@@QAE@XZ
?GetWSTR@WSTRING@@QBEPBGXZ
?QueryTime@TIMEINFO@@QBEEPAVWSTRING@@@Z
?QueryDate@TIMEINFO@@QBEEPAVWSTRING@@@Z
??0TIMEINFO@@QAE@XZ
?SetLoggingEnabled@MESSAGE@@QAEXE@Z
??1SORTED_LIST@@UAE@XZ
?DeleteAllMembers@SORTED_LIST@@UAEEXZ
?Put@SORTED_LIST@@UAEEPAVOBJECT@@@Z
?QueryIterator@SORTED_LIST@@UBEPAVITERATOR@@XZ
?Initialize@SORTED_LIST@@QAEEE@Z
??0SORTED_LIST@@QAE@XZ
?QueryMemberCount@SORTED_LIST@@UBEKXZ
?QueryClassId@OBJECT@@QBEKXZ
?Initialize@CLASS_DESCRIPTOR@@QAEEXZ
??0CLASS_DESCRIPTOR@@QAE@XZ
?Initialize@MACHINE@@QAEEXZ
?MachinePlatform@@3VMACHINE@@A
??0MESSAGE@@QAE@XZ
?Initialize@MESSAGE@@QAEEXZ
??0FSN_FILTER@@QAE@XZ
??0PATH@@QAE@XZ
?DisplayMsg@MESSAGE@@QAEEK@Z
??1PATH@@UAE@XZ
??1FSN_FILTER@@UAE@XZ
?Initialize@TIMEINFO@@QAEEPAU_FILETIME@@@Z
?Stricmp@WSTRING@@QBEJPBV1@@Z
?QueryChCount@WSTRING@@QBEKXZ
?QueryFullPath@PATH@@QBEPAV1@XZ
?MakeFileToken@MESSAGE@@SG_KPBD@Z
?DisplayMsg@MESSAGE@@QAAEKW4MESSAGE_TYPE@@KPBDZZ
?Initialize@PATH@@QAEEPBVWSTRING@@E@Z
?QueryDirectory@SYSTEM@@SGPAVFSN_DIRECTORY@@PBVPATH@@E@Z
?Initialize@FSN_FILTER@@QAEEXZ
?SetFileName@FSN_FILTER@@QAEEPBVWSTRING@@@Z
?QueryFsnodeArray@FSN_DIRECTORY@@QBEPAVARRAY@@PAVFSN_FILTER@@@Z
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?Initialize@WSTRING@@QAEEPBDK@Z
?SPrintfAppend@DSTRING@@UAAEPBGZZ
?SPrintf@DSTRING@@UAAEPBGZZ
?NewBuf@DSTRING@@UAEEK@Z
?Resize@DSTRING@@UAEEK@Z
??0DSTRING@@QAE@XZ
??1DSTRING@@UAE@XZ
?Display@MESSAGE@@QAAEPBDZZ
?QueryString@WSTRING@@QBEPAV1@KK@Z
?Initialize@HMEM@@QAEEXZ
??0CONT_MEM@@QAE@XZ
?Initialize@CONT_MEM@@QAEEPAXK@Z
??0HMEM@@QAE@XZ
??1HMEM@@UAE@XZ
?UlibRealloc@@YGPAXPAXK@Z
??1OBJECT@@UAE@XZ
?Compare@OBJECT@@UBEJPBV1@@Z
??0OBJECT@@IAE@XZ
?SetClassDescriptor@OBJECT@@IAEXPBVCLASS_DESCRIPTOR@@@Z
?EnableBreakHandling@KEYBOARD@@SGEXZ
?DisableBreakHandling@KEYBOARD@@SGEXZ
?Strupr@WSTRING@@QAEPAV1@XZ
??8WSTRING@@QBEEABV0@@Z
?Construct@OBJECT@@IAEXXZ
?QuerySTR@WSTRING@@QBEPADKKPADKE@Z
?Initialize@WSTRING@@QAEEXZ
?Strlwr@WSTRING@@QAEPAV1@KK@Z
?Strcat@WSTRING@@QAEEPBV1@@Z
?Initialize@WSTRING@@QAEEPBGK@Z
?QueryChAt@WSTRING@@QBEGK@Z
??1MESSAGE@@UAE@XZ

ifsutil

?Initialize@VOL_LIODPDRV@@IAE?AW4FORMAT_ERROR_CODE@@PBVWSTRING@@PAVSUPERAREA@@PAVMESSAGE@@EEW4_MEDIA_TYPE@@GEIE@Z
?SetSystemId@LOG_IO_DP_DRIVE@@QAEEE@Z
?WriteEntireDrive@VOL_LIODPDRV@@UAE?AW4FORMAT_ERROR_CODE@@PAVMESSAGE@@PAXKII@Z
?Initialize@SUPERAREA@@IAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@KPAVMESSAGE@@@Z
?QueryRecommendedMediaType@DP_DRIVE@@QBE?AW4_MEDIA_TYPE@@XZ
?GetDrive@SUPERAREA@@QAEPAVIO_DP_DRIVE@@XZ
?QueryMrwSupport@DP_DRIVE@@SGEPAX@Z
?Write@LOG_IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
?FormatScaleTotalFreeClusters@IFS_SYSTEM@@SGE_K0PAK1PA_K2@Z
?ComputeVolId@SUPERAREA@@SGKK@Z
?DismountVolume@IFS_SYSTEM@@SGEPBVWSTRING@@@Z
??0DP_DRIVE@@QAE@XZ
?Initialize@DP_DRIVE@@QAEEPBVWSTRING@@PAVMESSAGE@@EEG@Z
?Format@VOL_LIODPDRV@@QAE?AW4FORMAT_ERROR_CODE@@PBVWSTRING@@PAVMESSAGE@@KKK@Z
?SetFileSystemName@VOL_LIODPDRV@@QAEEPBG@Z
?Lock@IO_DP_DRIVE@@QAEEXZ
?DosDriveNameToNtDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z
?DismountAndLock@IO_DP_DRIVE@@QAEEXZ
?ForceAutochk@VOL_LIODPDRV@@QAEEEKKGPBVWSTRING@@@Z
??0READ_CACHE@@QAE@XZ
?Initialize@READ_CACHE@@QAEEPAVIO_DP_DRIVE@@K@Z
?SetCache@IO_DP_DRIVE@@QAEXPAVDRIVE_CACHE@@@Z
?ChkDsk@VOL_LIODPDRV@@QAEEW4FIX_LEVEL@@PAVMESSAGE@@KKGPAKPBVWSTRING@@@Z
??0SECRUN@@QAE@XZ
??1VOL_LIODPDRV@@UAE@XZ
?QuerySectors@DP_DRIVE@@UBE?AVBIG_INT@@XZ
?QueryWriteBlockSize@DP_DRIVE@@UBEKXZ
?QuerySectorSize@DP_DRIVE@@UBEKXZ
??0VOL_LIODPDRV@@IAE@XZ
?Look@INTSTACK@@QBE?AVBIG_INT@@K@Z
?Pop@INTSTACK@@QAEXK@Z
?QueryMediaByte@DP_DRIVE@@QBEEXZ
??0NUMBER_SET@@QAE@XZ
??1NUMBER_SET@@UAE@XZ
?Initialize@NUMBER_SET@@QAEEXZ
?Verify@IO_DP_DRIVE@@QAEEVBIG_INT@@0PAVNUMBER_SET@@@Z
?QueryNumber@NUMBER_SET@@QBE?AVBIG_INT@@V2@@Z
?QueryDriveHandle@DP_DRIVE@@QBEPAXXZ
??1SUPERAREA@@UAE@XZ
??0SUPERAREA@@IAE@XZ
?QueryNtfsTime@IFS_SYSTEM@@SGXPAT_LARGE_INTEGER@@@Z
??1SECRUN@@UAE@XZ
?Write@SECRUN@@UAEEXZ
?Read@SECRUN@@UAEEXZ
?QueryUdfMediaType@DP_DRIVE@@QAEKXZ
?Recover@VOL_LIODPDRV@@QAEEPBVWSTRING@@PAVMESSAGE@@@Z
?QueryDriveType@DP_DRIVE@@QBE?AW4DRIVE_TYPE@@XZ
?QueryUdfMediaNeedsLowLevelFormat@DP_DRIVE@@QAEEXZ
?Initialize@SECRUN@@QAEEPAVMEM@@PAVIO_DP_DRIVE@@VBIG_INT@@K@Z

Exports

Exports

??0CLUSTER_CHAIN@@QAE@XZ
??0EA_HEADER@@QAE@XZ
??0EA_SET@@QAE@XZ
??0FAT_DIRENT@@QAE@XZ
??0FAT_SA@@QAE@XZ
??0FILEDIR@@QAE@XZ
??0REAL_FAT_SA@@QAE@XZ
??0ROOTDIR@@QAE@XZ
??1CLUSTER_CHAIN@@UAE@XZ
??1EA_HEADER@@UAE@XZ
??1EA_SET@@UAE@XZ
??1FAT_DIRENT@@UAE@XZ
??1FAT_SA@@UAE@XZ
??1FILEDIR@@UAE@XZ
??1REAL_FAT_SA@@UAE@XZ
??1ROOTDIR@@UAE@XZ
?AllocChain@FAT@@QAEKKPAK@Z
?FreeChain@FAT@@QAEXK@Z
?GetEa@EA_SET@@QAEPAU_EA@@KPAJPAE@Z
?Index12@FAT@@ABEKK@Z
?InitFATChkDirty@REAL_FAT_SA@@QAEEPAVLOG_IO_DP_DRIVE@@PAVMESSAGE@@@Z
?Initialize@CLUSTER_CHAIN@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?Initialize@EA_HEADER@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?Initialize@EA_SET@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@KK@Z
?Initialize@FAT_DIRENT@@QAEEPAX@Z
?Initialize@FAT_DIRENT@@QAEEPAXE@Z
?Initialize@FILEDIR@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@PAVFAT_SA@@PBVFAT@@K@Z
?Initialize@REAL_FAT_SA@@UAEEPAVLOG_IO_DP_DRIVE@@PAVMESSAGE@@E@Z
?Initialize@ROOTDIR@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@KJ@Z
?IsValidCreationTime@FAT_DIRENT@@QBEEXZ
?IsValidLastAccessTime@FAT_DIRENT@@QBEEXZ
?IsValidLastWriteTime@FAT_DIRENT@@QBEEXZ
?QueryAllocatedClusters@FAT@@QBEKXZ
?QueryCensusAndRelocate@FAT_SA@@QAEEPAU_CENSUS_REPORT@@PAVINTSTACK@@PAE@Z
?QueryCreationTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
?QueryEaSetClusterNumber@EA_HEADER@@QBEGG@Z
?QueryFileStartingCluster@FAT_SA@@QAEKPBVWSTRING@@PAVHMEM@@PAPAVFATDIR@@PAEPAVFAT_DIRENT@@@Z
?QueryFreeSectors@REAL_FAT_SA@@QBEKXZ
?QueryLastAccessTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
?QueryLastWriteTime@FAT_DIRENT@@QBEEPAT_LARGE_INTEGER@@@Z
?QueryLengthOfChain@FAT@@QBEKKPAK@Z
?QueryLongName@FATDIR@@QAEEJPAVWSTRING@@@Z
?QueryName@FAT_DIRENT@@QBEEPAVWSTRING@@@Z
?QueryNthCluster@FAT@@QBEKKK@Z
?Read@CLUSTER_CHAIN@@UAEEXZ
?Read@EA_SET@@UAEEXZ
?Read@REAL_FAT_SA@@UAEEPAVMESSAGE@@@Z
?SearchForDirEntry@FATDIR@@QAEPAXPBVWSTRING@@@Z
?Set12@FAT@@AAEXKK@Z
?Write@CLUSTER_CHAIN@@UAEEXZ
Chkdsk
ChkdskEx
Format
FormatEx
GetFilesystemInformation
Recover

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
userenv.dll
.dll regsvr32 windows x86

ec133499a747c226d32e9dada5afebd0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memmove
_XcptFilter
_initterm
_amsg_exit
_except_handler4_common
_vsnwprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
malloc
free
memset

ntdll

RtlNtStatusToDosError
RtlAdjustPrivilege
EtwEventWrite
EtwUnregisterTraceGuids
RtlExpandEnvironmentStrings
NtClose
RtlIsDosDeviceName_U
RtlAnsiCharToUnicodeChar
RtlIntegerToChar
RtlInitUnicodeStringEx
EtwEventRegister
EtwLogTraceEvent
EtwEventUnregister
EtwTraceMessage
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle

kernelbase

BemFreeReference
BemCreateReference
GetSystemDefaultUILanguage

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-file-l1-1-0

GetFileAttributesW
CreateFileW
CompareFileTime
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesExW
DeleteFileW
FindNextFileW
SetFileAttributesW
FindClose
SetFileTime
GetDiskFreeSpaceExW
FlushFileBuffers
FindFirstFileW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree

api-ms-win-core-interlocked-l1-1-0

InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-libraryloader-l1-1-0

DisableThreadLibraryCalls
LockResource
FindResourceExW
GetModuleFileNameW
GetProcAddress
FreeLibrary
LoadLibraryExA
LoadStringW
LoadResource

api-ms-win-core-localregistry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegGetValueW

api-ms-win-core-misc-l1-1-0

LocalAlloc
LocalReAlloc
Sleep
lstrlenW
FormatMessageW
LocalFree

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
OpenProcessToken
CreateThread
SetThreadToken
OpenThreadToken

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-synch-l1-1-0

SetEvent
DeleteCriticalSection
WaitForSingleObject
CreateEventW
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-security-base-l1-1-0

AddAccessAllowedAce
PrivilegeCheck
EqualSid
GetSecurityDescriptorOwner
GetFileSecurityW
ImpersonateSelf
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessDeniedAce
FreeSid
CopySid
GetTokenInformation
RevertToSelf
ImpersonateLoggedOnUser

rpcrt4

NdrOleAllocate
NdrOleFree
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrClientCall2
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcRevertToSelf

profapi

ord103
ord102
ord101
ord104
ord105

kernel32

MoveFileExW
DelayLoadFailureHook
FindResourceW
SearchPathW
WaitForMultipleObjects
CreateSymbolicLinkW
PrivCopyFileExW

Exports

Exports

CreateEnvironmentBlock
CreateProfile
DeleteProfileA
DeleteProfileW
DestroyEnvironmentBlock
DllCanUnloadNow
DllGetClassObject
DllGetContractDescription
DllRegisterServer
DllUnregisterServer
EnterCriticalPolicySection
ExpandEnvironmentStringsForUserA
ExpandEnvironmentStringsForUserW
ForceSyncFgPolicy
FreeGPOListA
FreeGPOListW
GetAllUsersProfileDirectoryA
GetAllUsersProfileDirectoryW
GetAppliedGPOListA
GetAppliedGPOListW
GetDefaultUserProfileDirectoryA
GetDefaultUserProfileDirectoryW
GetGPOListA
GetGPOListW
GetNextFgPolicyRefreshInfo
GetPreviousFgPolicyRefreshInfo
GetProfileType
GetProfilesDirectoryA
GetProfilesDirectoryW
GetUserProfileDirectoryA
GetUserProfileDirectoryW
LeaveCriticalPolicySection
LoadUserProfileA
LoadUserProfileW
ProcessGroupPolicyCompleted
ProcessGroupPolicyCompletedEx
RefreshPolicy
RefreshPolicyEx
RegisterGPNotification
RsopAccessCheckByType
RsopFileAccessCheck
RsopLoggingEnabled
RsopResetPolicySettingStatus
RsopSetPolicySettingStatus
UnloadUserProfile
UnregisterGPNotification
WaitForMachinePolicyForegroundProcessing
WaitForUserPolicyForegroundProcessing

Sections

.text
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 51B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
userinit.exe
.exe windows x86

da2666d3347f129193ab91a0eab85c0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

DbgPrint
RtlInitUnicodeString
NtOpenKey
NtClose

api-ms-win-core-localregistry-l1-1-0

RegCreateKeyExW
RegDeleteTreeW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority
GetCurrentThread
CreateThread
GetCurrentProcess
CreateProcessW
OpenProcessToken

user32

CharNextW
GetKeyboardLayout
GetSystemMetrics
ExitWindowsEx
MessageBoxW
LoadStringW
LoadRemoteFonts
DefWindowProcW
RegisterClassExW
DestroyWindow
CreateWindowExW
SystemParametersInfoW

userenv

ord175

msvcrt

_ismbblead
_XcptFilter
_exit
_cexit
exit
_wcsicmp
memset
memmove
_vsnwprintf
_initterm
_acmdln
_amsg_exit
__setusermatherr
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__getmainargs
__p__commode

kernel32

GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedExchange
LoadLibraryA
RegOpenKeyExA
RegQueryValueExA
ExpandEnvironmentStringsA
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
HeapSetInformation
SetCurrentDirectoryW
FormatMessageW
GetFileAttributesExW
GetSystemDirectoryW
SetLastError
ExpandEnvironmentStringsW
GetUserDefaultLangID
SetEvent
OpenEventW
Sleep
WaitForSingleObject
CloseHandle
GetLastError
SetEnvironmentVariableW
SearchPathW
GetCurrentThreadId
CompareFileTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetEnvironmentVariableW
LocalAlloc
LocalFree
GetVersionExW
lstrlenW

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
usp10.dll
.dll windows x86

6ab63b69defe1dfe2516d054c3c43e22

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler4_common
wcscpy_s
_amsg_exit
_initterm
free
malloc
_XcptFilter
memmove
_vsnprintf
sprintf_s
memset
memcpy

kernel32

HeapDestroy
HeapFree
InterlockedCompareExchange
InterlockedExchange
TlsGetValue
HeapSize
TlsSetValue
HeapCreate
LoadResource
LockResource
DelayLoadFailureHook
FreeLibrary
LoadLibraryExA
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetUserDefaultLCID
DisableThreadLibraryCalls
TlsFree
DeleteCriticalSection
ExpandEnvironmentStringsW
GetVersionExA
InitializeCriticalSection
TlsAlloc
LoadLibraryA
CloseHandle
ReadFile
CreateFileA
lstrcmpiA
GetProfileStringA
GetProfileIntA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
MulDiv
InterlockedIncrement
GetLastError
GetProcAddress
GetACP
GetLocaleInfoW
IsValidLocale
ConvertDefaultLocale
LeaveCriticalSection
EnterCriticalSection
MapViewOfFile
UnmapViewOfFile
CreateFileW
GetFileSizeEx
CreateFileMappingA
LocalAlloc
FindResourceA
GetCurrentProcess
LocalFree

user32

CharUpperW
GetSystemMetrics
ReleaseDC
GetDC
GetSysColor
SetRect

gdi32

GetObjectType
ExtTextOutW
GetTextMetricsW
CreateFontA
CreateFontIndirectW
TranslateCharsetInfo
GetCharWidthA
GetObjectW
CreateSolidBrush
Ellipse
GetTextExtentExPointW
ExtTextOutA
LineTo
CreatePen
DPtoLP
GetGlyphOutlineA
GetTextCharset
GetTextFaceA
GetDeviceCaps
GetTextFaceW
GetOutlineTextMetricsW
GetTextMetricsA
SelectObject
CreateFontIndirectA
GetObjectA
GetCurrentObject
GetViewportExtEx
GetWindowExtEx
GetFontData
SetTextAlign
SetTextColor
SetBkColor
GetCurrentPositionEx
GetTextAlign
DeleteObject
SetBkMode
MoveToEx
CreateCompatibleDC
GetGraphicsMode
SetGraphicsMode
DeleteDC
GetTextColor
GetStockObject
GetBkMode

Exports

Exports

LpkPresent
ScriptApplyDigitSubstitution
ScriptApplyLogicalWidth
ScriptBreak
ScriptCPtoX
ScriptCacheGetHeight
ScriptFreeCache
ScriptGetCMap
ScriptGetFontAlternateGlyphs
ScriptGetFontFeatureTags
ScriptGetFontLanguageTags
ScriptGetFontProperties
ScriptGetFontScriptTags
ScriptGetGlyphABCWidth
ScriptGetLogicalWidths
ScriptGetProperties
ScriptIsComplex
ScriptItemize
ScriptItemizeOpenType
ScriptJustify
ScriptLayout
ScriptPlace
ScriptPlaceOpenType
ScriptPositionSingleGlyph
ScriptRecordDigitSubstitution
ScriptShape
ScriptShapeOpenType
ScriptStringAnalyse
ScriptStringCPtoX
ScriptStringFree
ScriptStringGetLogicalWidths
ScriptStringGetOrder
ScriptStringOut
ScriptStringValidate
ScriptStringXtoCP
ScriptString_pLogAttr
ScriptString_pSize
ScriptString_pcOutChars
ScriptSubstituteSingleGlyph
ScriptTextOut
ScriptXtoCP
UspAllocCache
UspAllocTemp
UspFreeMem

Sections

.text
Size: 361KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a73e6abb7c208a1c1c37c38619573f5

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-localregistry-l1-1-0

user32

gdi32

uxtheme

slc

dwmcore

dwmredir

windowscodecs

kernel32

Sections

.text Size: 215KB - Virtual size: 215KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 6KB

cd72a3805ad0e696e468b11b5af3ca16

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

kernel32

user32

ulib

ifsutil

Exports

Exports

Sections

.text Size: 61KB - Virtual size: 61KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 2KB - Virtual size: 2KB

19a7fd9a2488210ec52ecfac74568257

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

kernel32

user32

ulib

ifsutil

Exports

Exports

Sections

.text Size: 84KB - Virtual size: 84KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 4KB - Virtual size: 3KB

ec133499a747c226d32e9dada5afebd0

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

kernelbase

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

.text
Size: 215KB - Virtual size: 215KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 6KB

.text
Size: 61KB - Virtual size: 61KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 84KB - Virtual size: 84KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 67KB - Virtual size: 66KB

.orpc
Size: 512B - Virtual size: 51B

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 20KB - Virtual size: 19KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 361KB - Virtual size: 360KB

.data
Size: 512B - Virtual size: 5KB

Shared
Size: 167KB - Virtual size: 167KB

.rsrc
Size: 71KB - Virtual size: 70KB

.reloc
Size: 10KB - Virtual size: 10KB