Film11-main[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Film11-main.zip
Size

14.9MB
MD5

fac1dd5ea0cc2b7ad954a20269386d6b
SHA1

2d93ab6d914ceb7836c365f9dabdb2c7bb50eaf5
SHA256

99bed0345dc2a0dac2cb0f6ceafdfa28b78e81bdfe64707f8d9a3ee5eaa4f562
SHA512

1fa0b9bb54d7e2de8ff960de7c73045803d99e7468aec49b5063ea33dbd438fde80295f0fa172a1852ffe0ba899f5f2a289ca3408385cc0573708698f935d073
SSDEEP

196608:3uaWtplQJGms5ihQrCIhQB/J2QWMSCN5PMT9w7ucnzzyf6ng/tFYEHaASh6O/0bK:fcpKJnQrkflLsw7HnaFV1ShUH7Avd

Score

N/A

Malware Config

Signatures

Files

Film11-main.zip
.zip
Film11-main/Filmora_11_crack.zip
.zip
AdditionalFile/ApplicationInfo.xml
.xml
AdditionalFile/HDBox/HDBox.pimx
AdditionalFile/HDBox/HDBox.sig
.xml
AdditionalFile/Privacy Policy.txt
AdditionalFile/combase.dll
.dll windows x64

ba8646d28f2e7b54e7bcd331d13af3a6

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:29

Not After

02/12/2021, 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c
Signer

Actual PE Digest

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

06/10/2022, 18:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__dllonexit
_unlock
_lock
__C_specific_handler
_onexit
_initterm
_amsg_exit
_XcptFilter
_itoa_s
memcpy_s
??_V@YAXPEAX@Z
memset
memcpy
memcmp
_local_unwind
wcsnlen
wcsncpy_s
??_U@YAPEAX_K@Z
_wcsnicmp
wcsrchr
_vsnprintf
wcsstr
_wcslwr
_wtol
wcstok
wcschr
qsort
realloc
memmove_s
free
malloc
rand_s
wcsncmp
memmove
_wtoi
_resetstkoflw
_purecall
_wcsicmp
_vsnwprintf
__CxxFrameHandler3
swprintf_s
wcscmp

api-ms-win-core-heap-l1-2-0

HeapSize
HeapValidate
HeapAlloc
HeapFree
GetProcessHeap
HeapCreate
HeapDestroy
HeapReAlloc
HeapCompact

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

GetProcessMitigationPolicy
GetCurrentThreadId
TerminateProcess
GetCurrentThread
SetThreadStackGuarantee
SwitchToThread
OpenProcess
ProcessIdToSessionId
GetCurrentProcess
SetThreadToken
OpenThreadToken
OpenProcessToken
CreateThread
GetProcessId
GetCurrentProcessId

api-ms-win-core-registry-l1-1-0

RegGetValueA
RegDeleteKeyExA
RegCloseKey
RegOpenCurrentUser
RegOpenKeyExW
RegOpenUserClassesRoot
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyExW
RegEnumKeyExW
RegCreateKeyExA
RegSetValueExW
RegGetValueW
RegEnumValueW
RegCreateKeyExW

api-ms-win-core-synch-l1-2-0

SleepEx
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
SetWaitableTimerEx
LeaveCriticalSection
Sleep
WaitForSingleObject
ReleaseSRWLockExclusive
InitializeSRWLock
CreateWaitableTimerExW
ResetEvent
CreateEventW
DeleteCriticalSection
OpenEventW
SetEvent
WaitForMultipleObjectsEx
CreateEventA
InitOnceExecuteOnce
ReleaseSRWLockShared
AcquireSRWLockShared
WaitForSingleObjectEx
AcquireSRWLockExclusive
OpenEventA

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

rpcrt4

RpcServerUseProtseqEpW
RpcBindingVectorFree
NdrConvert2
RpcServerUseProtseqExW
RpcServerUseProtseqEpExW
RpcBindingFromStringBindingW
RpcServerUseProtseqW
RpcBindingCreateW
RpcBindingBind
SimpleTypeBufferSize
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeEncode2
RpcAsyncCompleteCall
NdrClientCall2
RpcErrorAddRecord
RpcMgmtSetComTimeout
RpcMgmtInqComTimeout
I_RpcServerSubscribeForDisconnectNotification
I_RpcServerGetAssociationID
I_RpcMgmtEnableDedicatedThreadPool
NdrCorrelationInitialize
NdrFullPointerXlatInit
SimpleTypeMemorySize
NdrFullPointerXlatFree
NdrClearOutParameters
I_RpcBCacheFree
NdrCorrelationFree
I_RpcExceptionFilter
NdrGetTypeFlags
MesEncodeFixedBufferHandleCreate
MesHandleFree
SimpleTypeAlignment
I_RpcBCacheAllocate
MesBufferHandleReset
MesDecodeBufferHandleCreate
I_RpcFixTransferSyntax
I_RpcSendReceive
RpcRaiseException
RpcErrorEndEnumeration
RpcErrorGetNextRecord
RpcErrorStartEnumeration
NdrClientInitializeNew
I_RpcReceive
I_RpcAsyncSetHandle
NdrServerInitialize
I_RpcGetBuffer
I_RpcAllocate
I_RpcFree
I_RpcGetBufferWithObject
UuidCreate
I_RpcRequestMutex
NdrStubCall2
I_RpcNegotiateTransferSyntax
I_RpcClearMutex
I_RpcMgmtQueryDedicatedThreadPool
RpcBindingFree
RpcBindingSetOption
NdrAsyncServerCall
NdrServerCall2
RpcBindingUnbind
RpcBindingCopy
NdrMesTypeDecode3
I_RpcSend
I_RpcAsyncAbortCall
RpcServerUnregisterIf
RpcServerRegisterIf3
RpcImpersonateClient2
RpcServerRegisterAuthInfoW
RpcCertGeneratePrincipalNameW
I_RpcOpenClientProcess
RpcBindingInqAuthClientW
NdrMesTypeEncode3
I_RpcSetDCOMAppId
I_RpcBindingInqCurrentModifiedId
RpcBindingInqObject
I_RpcBindingInqLocalClientPID
RpcBindingServerFromClient
RpcRevertToSelfEx
RpcImpersonateClient
RpcStringBindingParseW
RpcBindingToStringBindingW
I_RpcBindingInqTransportType
RpcServerInqCallAttributesW
I_RpcBindingSetPrivateOption
RpcBindingSetAuthInfoExW
RpcSmDestroyClientContext
NdrClientCall3
NdrStubCall3
RpcStringFreeW
RpcBindingInqAuthInfoExW
RpcCancelThreadEx
RpcMgmtSetCancelTimeout
NdrOleAllocate
NdrOleFree
NdrDllGetClassObject
RpcAsyncCancelCall
RpcServerInqBindings
RpcServerTestCancel
NdrGetUserMarshalInfo
I_RpcFreeBuffer
RpcAsyncInitializeHandle
RpcAsyncGetCallStatus

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
GetComputerNameExW
GetSystemInfo
GetSystemWindowsDirectoryW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
OutputDebugStringA
DebugBreak
IsDebuggerPresent

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
SetEventWhenCallbackReturns
WaitForThreadpoolWaitCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-fibers-l1-1-1

FlsAlloc
FlsSetValue
FlsFree
IsThreadAFiber

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetModuleHandleW
LoadLibraryExA
GetProcAddress
LoadStringW
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
CompareStringOrdinal
CompareStringW
MultiByteToWideChar

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
SearchPathW
FreeEnvironmentStringsW
GetEnvironmentStringsW

api-ms-win-security-base-l1-2-0

CreateWellKnownSid
AccessCheck
CheckTokenMembership
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeSid
GetSidLengthRequired
GetAppContainerAce
InitializeAcl
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
GetAce
MapGenericMask
GetSidSubAuthorityCount
GetKernelObjectSecurity
GetSidSubAuthority
DuplicateToken
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
MakeSelfRelativeSD
IsValidSecurityDescriptor
GetTokenInformation
RevertToSelf
ImpersonateAnonymousToken
AccessCheckByType
GetSecurityDescriptorDacl
GetLengthSid
IsValidSid
GetSecurityDescriptorLength
PrivilegeCheck
CopySid
EqualSid

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-memory-l1-1-2

UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
VirtualProtect
VirtualAlloc
VirtualQuery
MapViewOfFile

api-ms-win-core-localization-l1-2-1

FormatMessageW
LCMapStringW

api-ms-win-core-file-l1-2-1

CreateFileW

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventRegister
EventWriteEx
EventUnregister

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled
QuirkIsEnabledForProcess

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

RaiseFailFastException

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpiA
lstrcmpiW
lstrlenA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize
LocalAlloc
GlobalFree
LocalFree
GlobalUnlock
GlobalReAlloc
GlobalAlloc
GlobalLock

api-ms-win-core-privateprofile-l1-1-1

GetProfileStringW

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx
FindActCtxSectionGuid
FindActCtxSectionStringW
ActivateActCtx
AddRefActCtx
DeactivateActCtx
GetCurrentActCtx
CreateActCtxW

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

ntdll

RtlCopySid
NtQueryInformationToken
RtlLengthSid
NtQueryObject
LdrStandardizeSystemPath
RtlFreeSid
RtlDelete
RtlApplicationVerifierStop
RtlCheckForOrphanedCriticalSections
NtQueryInformationThread
RtlFreeHeap
RtlGetAppContainerNamedObjectPath
NtTerminateProcess
RtlReportException
RtlInitializeCriticalSectionAndSpinCount
NtQueryTimerResolution
RtlLoadString
RtlInitializeConditionVariable
ord1
EvtIntReportEventAndSourceAsync
RtlSplay
RtlDeleteNoSplay
RtlInitUnicodeString
NtOpenKey
RtlEqualUnicodeString
WinSqmSetDWORD
RtlInitializeCriticalSection
RtlImageNtHeader
RtlIsCriticalSectionLockedByThread
RtlDllShutdownInProgress
DbgPrint
EtwEventUnregister
RtlAllocateHeap
NtQueryValueKey
RtlQueryPackageIdentity
ZwQuerySecurityAttributesToken
RtlSidDominates
RtlGetAppContainerSidType
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwGetTraceLoggerHandle
NtQuerySystemInformation
RtlSleepConditionVariableCS
RtlDeleteCriticalSection
RtlWakeAllConditionVariable
NtQueryInformationProcess
NtApphelpCacheControl
RtlInitUnicodeStringEx
RtlValidRelativeSecurityDescriptor
NtClose
NtDuplicateObject
NtCreateKey
RtlRealPredecessor
EtwEventRegister
EtwTraceMessage
EtwEventWrite
RtlNtStatusToDosError
NtQueryKey

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

CLSIDFromOle1Class
CLSIDFromProgID
CLSIDFromString
CleanupOleStateInAllTls
CleanupTlsOleState
ClearCleanupFlag
CoAddRefServerProcess
CoAllowUnmarshalerCLSID
CoCancelCall
CoCopyProxy
CoCreateErrorInfo
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoCreateInstanceEx
CoCreateInstanceFromApp
CoCreateObjectInContext
CoDeactivateObject
CoDecodeProxy
CoDecrementMTAUsage
CoDisableCallCancellation
CoDisconnectContext
CoDisconnectObject
CoEnableCallCancellation
CoFreeUnusedLibraries
CoFreeUnusedLibrariesEx
CoGetActivationState
CoGetApartmentID
CoGetApartmentType
CoGetCallContext
CoGetCallState
CoGetCallerTID
CoGetCancelObject
CoGetClassObject
CoGetClassVersion
CoGetContextToken
CoGetCurrentLogicalThreadId
CoGetCurrentProcess
CoGetDefaultContext
CoGetErrorInfo
CoGetInstanceFromFile
CoGetInstanceFromIStorage
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoGetMarshalSizeMax
CoGetModuleType
CoGetObjectContext
CoGetPSClsid
CoGetProcessIdentifier
CoGetStandardMarshal
CoGetStdMarshalEx
CoGetSystemSecurityPermissions
CoGetTreatAsClass
CoImpersonateClient
CoIncrementMTAUsage
CoInitializeEx
CoInitializeSecurity
CoInitializeWOW
CoInvalidateRemoteMachineBindings
CoIsHandlerConnected
CoLockObjectExternal
CoMarshalHresult
CoMarshalInterThreadInterfaceInStream
CoMarshalInterface
CoPopServiceDomain
CoPushServiceDomain
CoQueryAuthenticationServices
CoQueryClientBlanket
CoQueryProxyBlanket
CoReactivateObject
CoRegisterActivationFilter
CoRegisterClassObject
CoRegisterInitializeSpy
CoRegisterMallocSpy
CoRegisterMessageFilter
CoRegisterPSClsid
CoRegisterSurrogate
CoRegisterSurrogateEx
CoReleaseMarshalData
CoReleaseServerProcess
CoResumeClassObjects
CoRetireServer
CoRevertToSelf
CoRevokeClassObject
CoRevokeInitializeSpy
CoRevokeMallocSpy
CoSetCancelObject
CoSetErrorInfo
CoSetProxyBlanket
CoSuspendClassObjects
CoSwitchCallContext
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoTestCancel
CoUninitialize
CoUnloadingWOW
CoUnmarshalHresult
CoUnmarshalInterface
CoVrfCheckThreadState
CoVrfGetThreadState
CoVrfReleaseThreadState
CoWaitForMultipleHandles
CoWaitForMultipleObjects
CreateErrorInfo
CreateStreamOnHGlobal
DcomChannelSetHResult
DllDebugObjectRPCHook
DllGetActivationFactory
DllGetClassObject
EnableHookObject
FreePropVariantArray
FreePropVariantArrayWorker
GetCatalogHelper
GetErrorInfo
GetFuncDescs
GetHGlobalFromStream
GetHookInterface
GetRestrictedErrorInfo
HSTRING_UserFree
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserMarshal64
HSTRING_UserSize
HSTRING_UserSize64
HSTRING_UserUnmarshal
HSTRING_UserUnmarshal64
HkOleRegisterObject
IIDFromString
InternalAppInvokeExceptionFilter
InternalCCFreeUnused
InternalCCGetClassInformationForDde
InternalCCGetClassInformationFromKey
InternalCCSetDdeServerWindow
InternalCMLSendReceive
InternalCallAsProxyExceptionFilter
InternalCallFrameExceptionFilter
InternalCallerIsAppContainer
InternalCanMakeOutCall
InternalCoIsSurrogateProcess
InternalCoRegisterDisconnectCallback
InternalCoRegisterSurrogatedObject
InternalCoStdMarshalObject
InternalCoUnregisterDisconnectCallback
InternalCompleteObjRef
InternalCreateCAggId
InternalCreateIdentityHandler
InternalDoATClassCreate
InternalFillLocalOXIDInfo
InternalFreeObjRef
InternalGetWindowPropInterface
InternalIrotEnumRunning
InternalIrotEnumRunning2
InternalIrotGetObject
InternalIrotGetObject2
InternalIrotGetObject3
InternalIrotGetTimeOfLastChange
InternalIrotGetTimeOfLastChange2
InternalIrotIsRunning
InternalIrotIsRunning2
InternalIrotNoteChangeTime
InternalIrotRegister
InternalIrotRevoke
InternalIsApartmentInitialized
InternalIsProcessInitialized
InternalMarshalObjRef
InternalNotifyDDStartOrStop
InternalOleModalLoopBlockFn
InternalRegisterWindowPropInterface
InternalReleaseMarshalObjRef
InternalSTAInvoke
InternalServerExceptionFilter
InternalSetAptCallCtrlOnTlsIfRequired
InternalSetOleThunkWowPtr
InternalStubInvoke
InternalTlsAllocData
InternalUnmarshalObjRef
IsErrorPropagationEnabled
NdrExtStubInitialize
NdrOleDllGetClassObject
NdrOleInitializeExtension
NdrProxyForwardingFunction10
NdrProxyForwardingFunction11
NdrProxyForwardingFunction12
NdrProxyForwardingFunction13
NdrProxyForwardingFunction14
NdrProxyForwardingFunction15
NdrProxyForwardingFunction16
NdrProxyForwardingFunction17
NdrProxyForwardingFunction18
NdrProxyForwardingFunction19
NdrProxyForwardingFunction20
NdrProxyForwardingFunction21
NdrProxyForwardingFunction22
NdrProxyForwardingFunction23
NdrProxyForwardingFunction24
NdrProxyForwardingFunction25
NdrProxyForwardingFunction26
NdrProxyForwardingFunction27
NdrProxyForwardingFunction28
NdrProxyForwardingFunction29
NdrProxyForwardingFunction3
NdrProxyForwardingFunction30
NdrProxyForwardingFunction31
NdrProxyForwardingFunction32
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction6
NdrProxyForwardingFunction7
NdrProxyForwardingFunction8
NdrProxyForwardingFunction9
NdrpFindInterface
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient14
ObjectStublessClient15
ObjectStublessClient16
ObjectStublessClient17
ObjectStublessClient18
ObjectStublessClient19
ObjectStublessClient20
ObjectStublessClient21
ObjectStublessClient22
ObjectStublessClient23
ObjectStublessClient24
ObjectStublessClient25
ObjectStublessClient26
ObjectStublessClient27
ObjectStublessClient28
ObjectStublessClient29
ObjectStublessClient3
ObjectStublessClient30
ObjectStublessClient31
ObjectStublessClient32
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient9
ProgIDFromCLSID
PropVariantClear
PropVariantCopy
ReleaseFuncDescs
RoActivateInstance
RoCaptureErrorContext
RoClearError
RoFailFastWithErrorContext
RoFailFastWithErrorContextInternal
RoFailFastWithErrorContextInternal2
RoFreeParameterizedTypeExtra
RoGetActivatableClassRegistration
RoGetActivationFactory
RoGetAgileReference
RoGetApartmentIdentifier
RoGetErrorReportingFlags
RoGetMatchingRestrictedErrorInfo
RoGetParameterizedTypeInstanceIID
RoGetServerActivatableClasses
RoInitialize
RoInspectCapturedStackBackTrace
RoInspectThreadErrorInfo
RoOriginateError
RoOriginateErrorW
RoOriginateLanguageException
RoParameterizedTypeExtraGetTypeSignature
RoRegisterActivationFactories
RoRegisterForApartmentShutdown
RoReportCapabilityCheckFailure
RoReportFailedDelegate
RoReportUnhandledError
RoResolveRestrictedErrorInfoReference
RoRevokeActivationFactories
RoSetErrorReportingFlags
RoTransformError
RoTransformErrorW
RoUninitialize
RoUnregisterForApartmentShutdown
SetCleanupFlag
SetErrorInfo
SetRestrictedErrorInfo
StringFromCLSID
StringFromGUID2
StringFromIID
UpdateDCOMSettings
UpdateProcessTracing
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserMarshal64
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserSize64
WdtpInterfacePointer_UserUnmarshal
WdtpInterfacePointer_UserUnmarshal64
WindowsCompareStringOrdinal
WindowsConcatString
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsDeleteStringBuffer
WindowsDuplicateString
WindowsGetStringLen
WindowsGetStringRawBuffer
WindowsInspectString
WindowsIsStringEmpty
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsReplaceString
WindowsStringHasEmbeddedNull
WindowsSubstring
WindowsSubstringWithSpecifiedLength
WindowsTrimStringEnd
WindowsTrimStringStart

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ndr64
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Data/IPCBox.pimx
Data/IPCBox.sig
.xml
Data/MetroFramework.Design.dll
Data/MetroFramework.Fonts.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

rdata
Size: 524B - Virtual size: 523B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

data
Size: 82B - Virtual size: 125B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

pdata
Size: 100B - Virtual size: 98B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

CONST
Size: 2B - Virtual size:

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ext
Size: 52B - Virtual size: 50B

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ata
Size: 130B - Virtual size: 129B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

rsrc
Size: 4B - Virtual size: 3B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

reloc
Size: 22B - Virtual size: 20B
Data/MetroFramework.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 354KB - Virtual size: 527KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Data/Privacy Policy.txt
Data/advapi32.dll
.dll windows x64

cf49de37d6832a2e30a495cfe792c5d3

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:71:3a:ed:36:6c:0f:91:c7:97:71:46:7d:89:eb:e2:d5:18:ad:17:62:cf:4f:58:50:46:12:28:d5:7c:7a:8d
Signer

Actual PE Digest

35:71:3a:ed:36:6c:0f:91:c7:97:71:46:7d:89:eb:e2:d5:18:ad:17:62:cf:4f:58:50:46:12:28:d5:7c:7a:8d

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

06/10/2022, 18:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memmove
iswctype
_vsnwprintf
memset
memcpy
memcmp
__C_specific_handler
_vsnprintf
mbstowcs
iswalpha
_stricmp
_wcstoi64
_i64tow_s
_wcstoui64
_ui64tow_s
_ultow
wcscat_s
_wcsicmp
_errno
wcschr
wcscpy_s
wcstok_s
swscanf_s
wcsrchr
wcsncpy_s
wcsstr
swprintf_s
_wcsnicmp
wcsncmp
strstr
strchr
tolower
wcstoul
_ultow_s
wcscmp

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtSetSystemInformation
DbgPrint
RtlFreeAnsiString
RtlGetCurrentTransaction
ord1
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlIsTextUnicode
RtlLengthSid
NlsMbCodePageTag
NtQueryInformationToken
RtlxUnicodeStringToAnsiSize
RtlSubAuthoritySid
RtlGetThreadPreferredUILanguages
RtlSubAuthorityCountSid
RtlMakeSelfRelativeSD
RtlConvertSidToUnicodeString
RtlUnicodeStringToInteger
RtlAllocateHandle
RtlIsValidIndexHandle
RtlFreeHandle
NtOpenKey
NtQueryValueKey
NtClose
NtOpenThreadToken
NtOpenProcessToken
RtlEqualSid
RtlAddAccessAllowedAceEx
NtSetInformationToken
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
NtDuplicateToken
NtCompareTokens
RtlAllocateAndInitializeSid
RtlFreeSid
RtlIsGenericTableEmpty
RtlEnumerateGenericTableWithoutSplaying
RtlDuplicateUnicodeString
RtlExpandEnvironmentStrings_U
NtOpenFile
RtlCreateUnicodeString
NtQueryInformationProcess
RtlGetLastNtStatus
NtQueryKey
RtlValidSid
LdrLoadDll
RtlImageNtHeader
LdrUnloadDll
NtDeviceIoControlFile
NtQuerySystemInformation
EtwEventRegister
EtwEventWrite
NtCreateKey
NtSetValueKey
RtlDeleteElementGenericTable
RtlAppendUnicodeToString
NtDeleteKey
RtlInsertElementGenericTable
RtlCopySid
RtlInitializeHandleTable
RtlDestroyHandleTable
EtwEventUnregister
NtEnumerateKey
RtlIntegerToUnicodeString
RtlStringFromGUID
RtlAppendUnicodeStringToString
RtlFormatCurrentUserKeyPath
RtlInitializeGenericTable
RtlQueryRegistryValuesEx
RtlLookupElementGenericTable
RtlNumberGenericTableElements
RtlGUIDFromString
RtlUpcaseUnicodeChar
NtQueryVolumeInformationFile
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
RtlPrefixUnicodeString
RtlDetermineDosPathNameType_U
NtQueryInformationFile
RtlGetFullPathName_U
RtlUnicodeToMultiByteN
RtlNtStatusToDosErrorNoTeb
RtlAnsiCharToUnicodeChar
RtlMultiByteToUnicodeN
RtlSetLastWin32Error
NtTraceControl
NtTraceEvent
EtwpGetCpuSpeed
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
RtlInitAnsiStringEx
RtlInitUnicodeStringEx
RtlCreateUnicodeStringFromAsciiz
NtRenameKey
RtlAddAce
RtlGetAce
RtlAddAccessDeniedAceEx
RtlSetDaclSecurityDescriptor
RtlFirstFreeAce
RtlValidAcl
RtlAddAuditAccessObjectAce
RtlGetSaclSecurityDescriptor
RtlAddAccessDeniedObjectAce
RtlSetGroupSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlxAnsiStringToUnicodeSize
RtlGetControlSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedObjectAce
RtlGetDaclSecurityDescriptor
RtlInitializeSid
RtlGetOwnerSecurityDescriptor
RtlAddAuditAccessAceEx
NtQuerySystemTime
RtlTimeToSecondsSince1970
EtwEventSetInformation
RtlImpersonateSelf
RtlAdjustPrivilege
RtlCopyString
EtwEventWriteTransfer
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
NtWaitForSingleObject
RtlGetVersion
NtQueryInformationThread
NtSetInformationThread
NtQuerySecurityObject
RtlRunOnceExecuteOnce
RtlRunOnceBeginInitialize
RtlDllShutdownInProgress
RtlRunOnceInitialize
NtQueryPerformanceCounter
NtWaitForMultipleObjects
WinSqmAddToStream
RtlCreateAcl
RtlValidRelativeSecurityDescriptor
NtCreateFile
NtWriteFile
NtReadFile
RtlWaitOnAddress
RtlWakeAddressAll
RtlQueryPerformanceCounter
RtlAddAccessAllowedAce
RtlAcquireSRWLockExclusive
RtlInsertElementGenericTableAvl
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockShared
RtlLookupElementGenericTableAvl
RtlReleaseSRWLockShared
RtlEnumerateGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlReAllocateHeap
RtlDosPathNameToRelativeNtPathName_U
RtlReleaseRelativeName
RtlWakeAddressSingle
RtlDestroyQueryDebugBuffer
RtlEqualUnicodeString
RtlQueryProcessDebugInformation
NtQueryMutant
NtQueryObject
NtAlpcQueryInformation
RtlInitializeSRWLock
RtlCreateQueryDebugBuffer
RtlOpenCurrentUser
NtQueryMultipleValueKey
NtReplaceKey
NtSaveMergedKeys
NtSaveKey
RtlValidSecurityDescriptor
RtlLengthSecurityDescriptor
RtlGetNtProductType
RtlCopyUnicodeString
RtlOemStringToUnicodeString
RtlUnicodeToMultiByteSize
RtlUnicodeStringToAnsiString
RtlDosPathNameToNtPathName_U
RtlAllocateHeap
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
NtOpenKeyEx
NtSetInformationKey
RtlFreeHeap
RtlAnsiStringToUnicodeString
RtlInitializeCriticalSection
RtlDeleteCriticalSection

api-ms-win-eventing-controller-l1-1-0

TraceSetInformation
ControlTraceW
QueryAllTracesW
EventAccessQuery
EnumerateTraceGuidsEx
StartTraceW
EventAccessControl
StopTraceW
EventAccessRemove
EnableTraceEx2

api-ms-win-eventing-consumer-l1-1-0

CloseTrace
OpenTraceW
ProcessTrace

kernelbase

RegKrnGetHKEY_ClassesRootAddress
RegKrnGetClassesEnumTableAddressInternal
RegKrnGetTermsrvRegistryExtensionFlags
RegDeleteKeyExInternalW
RegOpenKeyExInternalW
RegCreateKeyExInternalW
CLOSE_LOCAL_HANDLE_INTERNAL
MapPredefinedHandleInternal
RegDeleteKeyExInternalA
RegCreateKeyExInternalA
RegOpenKeyExInternalA
RemapPredefinedHandleInternal
DisablePredefinedHandleTableInternal
GetPackagePath
PackageIdFromFullName
Sleep
lstrcmpiW
lstrcmpW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
CreateProcessAsUserW
CreateProcessInternalA
AreFileApisANSI
lstrlenW
LocalReAlloc
LocalFree
LocalAlloc

sechost

QueryAllTracesA
StartTraceA
ControlTraceA

api-ms-win-service-core-l1-1-1

EnumDependentServicesW
QueryServiceDynamicInformation
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
EnumServicesStatusExW

api-ms-win-service-management-l1-1-0

CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
ControlServiceExW
OpenServiceW
StartServiceW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW
QueryServiceStatusEx
QueryServiceConfigW
NotifyServiceStatusChangeW
SetServiceObjectSecurity
ChangeServiceConfig2W
QueryServiceObjectSecurity
QueryServiceConfig2W

api-ms-win-service-private-l1-1-1

I_ScRpcBindW
I_ScRpcBindA
I_ScSetServiceBitsA
I_ScSetServiceBitsW
I_ScRegisterPreshutdownRestart
WaitServiceState

api-ms-win-service-winsvc-l1-2-0

OpenServiceA
QueryServiceConfig2A
ControlService
RegisterServiceCtrlHandlerW
QueryServiceConfigA
OpenSCManagerA
QueryServiceStatus
RegisterServiceCtrlHandlerExA
ChangeServiceConfigA
StartServiceA
CreateServiceA
RegisterServiceCtrlHandlerA
NotifyServiceStatusChangeA
ControlServiceExA
ChangeServiceConfig2A
StartServiceCtrlDispatcherA

api-ms-win-core-namedpipe-l1-2-0

ImpersonateNamedPipeClient

api-ms-win-core-processthreads-l1-1-2

OpenProcess
CreateThread
IsProcessorFeaturePresent
GetCurrentThread
OpenThread
GetProcessId
GetCurrentProcess
OpenProcessToken
OpenThreadToken
SetThreadToken
GetPriorityClass
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-security-base-l1-2-0

RevertToSelf
AddAccessAllowedAce
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
AllocateAndInitializeSid
AllocateLocallyUniqueId
InitializeAcl
SetKernelObjectSecurity
MakeAbsoluteSD
ImpersonateLoggedOnUser
DuplicateTokenEx
QuerySecurityAccessMask
CreatePrivateObjectSecurityEx
GetSecurityDescriptorLength
ImpersonateSelf
GetAce
AccessCheckByTypeResultList
CreatePrivateObjectSecurity
SetSecurityDescriptorDacl
IsTokenRestricted
AddAuditAccessObjectAce
AdjustTokenGroups
AddAccessDeniedAce
AreAllAccessesGranted
SetTokenInformation
PrivilegeCheck
InitializeSecurityDescriptor
GetPrivateObjectSecurity
DuplicateToken
CreatePrivateObjectSecurityWithMultipleInheritance
SetAclInformation
GetSidIdentifierAuthority
FreeSid
GetTokenInformation
PrivilegedServiceAuditAlarmW
AccessCheckByTypeResultListAndAuditAlarmW
ObjectOpenAuditAlarmW
ObjectPrivilegeAuditAlarmW
ObjectCloseAuditAlarmW
SetFileSecurityW
GetFileSecurityW
ObjectDeleteAuditAlarmW
CopySid
AccessCheckByTypeResultListAndAuditAlarmByHandleW
AccessCheckAndAuditAlarmW
AccessCheckByTypeAndAuditAlarmW
IsValidSid
EqualPrefixSid
AddAccessDeniedObjectAce
AddAccessAllowedObjectAce
AccessCheckByType
AddAuditAccessAce
SetPrivateObjectSecurityEx
EqualSid
GetSecurityDescriptorControl
CreateRestrictedToken
GetAclInformation
GetKernelObjectSecurity
AccessCheck
AddAccessAllowedAceEx
GetSecurityDescriptorRMControl
SetSecurityDescriptorRMControl
GetSidSubAuthorityCount
GetSidLengthRequired
MapGenericMask
InitializeSid
AddAce
IsValidAcl
ImpersonateAnonymousToken
MakeSelfRelativeSD
IsValidSecurityDescriptor
GetLengthSid
AddAccessDeniedAceEx
CheckTokenMembership
SetSecurityDescriptorSacl
AreAnyAccessesGranted
AdjustTokenPrivileges
SetSecurityDescriptorGroup
DeleteAce
SetSecurityDescriptorControl
GetWindowsAccountDomainSid
FindFirstFreeAce
ConvertToAutoInheritPrivateObjectSecurity
SetPrivateObjectSecurity
EqualDomainSid
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
CreateWellKnownSid
DestroyPrivateObjectSecurity
AddAuditAccessAceEx
SetSecurityAccessMask
IsWellKnownSid
GetSidSubAuthority
GetSecurityDescriptorSacl

api-ms-win-security-base-private-l1-1-1

MakeAbsoluteSD2

api-ms-win-core-registry-l1-1-0

RegRestoreKeyW
RegLoadAppKeyW
RegCopyTreeW
RegCloseKey
RegOpenKeyExW
RegLoadMUIStringA
RegLoadAppKeyA
RegOpenUserClassesRoot
RegDeleteKeyExW
RegUnLoadKeyA
RegRestoreKeyA
RegDeleteTreeA
RegSetValueExA
RegCreateKeyExW
RegQueryValueExA
RegQueryInfoKeyW
RegEnumKeyExA
RegLoadMUIStringW
RegSaveKeyExA
RegUnLoadKeyW
RegSetValueExW
RegLoadKeyW
RegDisablePredefinedCacheEx
RegEnumKeyExW
RegFlushKey
RegNotifyChangeKeyValue
RegDeleteKeyExA
RegSetKeySecurity
RegEnumValueW
RegLoadKeyA
RegEnumValueA
RegOpenCurrentUser
RegGetValueW
RegSaveKeyExW
RegDeleteTreeW
RegDeleteValueA
RegDeleteValueW
RegQueryInfoKeyA
RegGetValueA
RegGetKeySecurity
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExW

api-ms-win-core-sysinfo-l1-2-1

GetComputerNameExW
GetTickCount
GetSystemTimeAsFileTime
GetLocalTime
GetNativeSystemInfo
GlobalMemoryStatusEx
GetSystemFirmwareTable
GetSystemWindowsDirectoryW
GetSystemTime
GetSystemDirectoryW

kernel32

GetFileAttributesExW
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
LoadLibraryExA
CloseHandle
FreeLibrary
LoadLibraryExW
LeaveCriticalSection
GetLastError
EnterCriticalSection
GetFullPathNameW
SearchPathW
HeapAlloc
ResolveDelayLoadedAPI
DelayLoadFailureHook
HeapFree
SleepEx
GetProcessHeap
GetFileAttributesW
CreateFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
CreateEventW
GetThreadUILanguage
GetCommandLineW
LoadLibraryW
GetModuleHandleExW
SetFilePointer
OutputDebugStringW
WriteFile
TermsrvDeleteKey
TermsrvOpenUserClasses
DuplicateHandle
DecodePointer
FreeLibraryAndExitThread
ReadProcessMemory
EncodePointer
CreateThreadpoolIo
FreeLibraryWhenCallbackReturns
CancelIoEx
CloseThreadpoolIo
FormatMessageW
MoveFileW
DeleteFileW
ExpandEnvironmentStringsW
GetModuleHandleW
GetFileSizeEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetLongPathNameW
CompareFileTime
FindResourceExW
LoadResource
GetVolumePathNameW
DeleteCriticalSection
WaitForSingleObject
GetActiveProcessorCount
GetOverlappedResult
DeviceIoControl
GetVolumeInformationW
GetComputerNameW
ReleaseMutex
ExpandEnvironmentStringsA
GetModuleFileNameW
LoadLibraryA
GetComputerNameA
LocalUnlock
LocalLock
CreateMutexW
InitializeCriticalSection
StartThreadpoolIo
CancelThreadpoolIo
EnumUILanguagesW
GetFileMUIPath
SetErrorMode
SetFileInformationByHandle
CopyFileExW
FindClose
FindNextFileW
FindFirstFileExW
lstrcmpiA
GetFileSize
DosDateTimeToFileTime
FileTimeToDosDateTime
GetFileTime
ResetEvent
SetEvent
HeapReAlloc
LockResource
SizeofResource
SetLastError

rpcrt4

RpcStringBindingComposeW
RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoExA
RpcBindingSetAuthInfoExW
NdrClientCall3
I_RpcExceptionFilter
I_RpcMapWin32Status
RpcEpResolveBinding
RpcBindingSetAuthInfoW
RpcBindingSetAuthInfoA
RpcBindingFromStringBindingW
RpcSsDestroyClientContext
RpcBindingCreateW
RpcBindingBind
I_RpcSNCHOption
NdrClientCall2
UuidFromStringW
UuidToStringW
RpcExceptionFilter

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformationEffectiveYears
EnumDynamicTimeZoneInformation

api-ms-win-security-audit-l1-1-1

AuditSetSecurity
AuditEnumeratePerUserPolicy
AuditQueryGlobalSaclW
AuditFree
AuditSetPerUserPolicy
AuditEnumerateSubCategories
AuditComputeEffectivePolicyBySid
AuditLookupCategoryNameW
AuditLookupSubCategoryNameW
AuditEnumerateCategories
AuditQueryPerUserPolicy
AuditSetGlobalSaclW
AuditQuerySecurity
AuditQuerySystemPolicy
AuditSetSystemPolicy

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

A_SHAFinal
A_SHAInit
A_SHAUpdate
AbortSystemShutdownA
AbortSystemShutdownW
AccessCheck
AccessCheckAndAuditAlarmA
AccessCheckAndAuditAlarmW
AccessCheckByType
AccessCheckByTypeAndAuditAlarmA
AccessCheckByTypeAndAuditAlarmW
AccessCheckByTypeResultList
AccessCheckByTypeResultListAndAuditAlarmA
AccessCheckByTypeResultListAndAuditAlarmByHandleA
AccessCheckByTypeResultListAndAuditAlarmByHandleW
AccessCheckByTypeResultListAndAuditAlarmW
AddAccessAllowedAce
AddAccessAllowedAceEx
AddAccessAllowedObjectAce
AddAccessDeniedAce
AddAccessDeniedAceEx
AddAccessDeniedObjectAce
AddAce
AddAuditAccessAce
AddAuditAccessAceEx
AddAuditAccessObjectAce
AddConditionalAce
AddMandatoryAce
AddUsersToEncryptedFile
AddUsersToEncryptedFileEx
AdjustTokenGroups
AdjustTokenPrivileges
AllocateAndInitializeSid
AllocateLocallyUniqueId
AreAllAccessesGranted
AreAnyAccessesGranted
AuditComputeEffectivePolicyBySid
AuditComputeEffectivePolicyByToken
AuditEnumerateCategories
AuditEnumeratePerUserPolicy
AuditEnumerateSubCategories
AuditFree
AuditLookupCategoryGuidFromCategoryId
AuditLookupCategoryIdFromCategoryGuid
AuditLookupCategoryNameA
AuditLookupCategoryNameW
AuditLookupSubCategoryNameA
AuditLookupSubCategoryNameW
AuditQueryGlobalSaclA
AuditQueryGlobalSaclW
AuditQueryPerUserPolicy
AuditQuerySecurity
AuditQuerySystemPolicy
AuditSetGlobalSaclA
AuditSetGlobalSaclW
AuditSetPerUserPolicy
AuditSetSecurity
AuditSetSystemPolicy
BackupEventLogA
BackupEventLogW
BaseRegCloseKey
BaseRegCreateKey
BaseRegDeleteKeyEx
BaseRegDeleteValue
BaseRegFlushKey
BaseRegGetVersion
BaseRegLoadKey
BaseRegOpenKey
BaseRegRestoreKey
BaseRegSaveKeyEx
BaseRegSetKeySecurity
BaseRegSetValue
BaseRegUnLoadKey
BuildExplicitAccessWithNameA
BuildExplicitAccessWithNameW
BuildImpersonateExplicitAccessWithNameA
BuildImpersonateExplicitAccessWithNameW
BuildImpersonateTrusteeA
BuildImpersonateTrusteeW
BuildSecurityDescriptorA
BuildSecurityDescriptorW
BuildTrusteeWithNameA
BuildTrusteeWithNameW
BuildTrusteeWithObjectsAndNameA
BuildTrusteeWithObjectsAndNameW
BuildTrusteeWithObjectsAndSidA
BuildTrusteeWithObjectsAndSidW
BuildTrusteeWithSidA
BuildTrusteeWithSidW
CancelOverlappedAccess
ChangeServiceConfig2A
ChangeServiceConfig2W
ChangeServiceConfigA
ChangeServiceConfigW
CheckForHiberboot
CheckTokenMembership
ClearEventLogA
ClearEventLogW
CloseCodeAuthzLevel
CloseEncryptedFileRaw
CloseEventLog
CloseServiceHandle
CloseThreadWaitChainSession
CloseTrace
CommandLineFromMsiDescriptor
ComputeAccessTokenFromCodeAuthzLevel
ControlService
ControlServiceExA
ControlServiceExW
ControlTraceA
ControlTraceW
ConvertAccessToSecurityDescriptorA
ConvertAccessToSecurityDescriptorW
ConvertSDToStringSDDomainW
ConvertSDToStringSDRootDomainA
ConvertSDToStringSDRootDomainW
ConvertSecurityDescriptorToAccessA
ConvertSecurityDescriptorToAccessNamedA
ConvertSecurityDescriptorToAccessNamedW
ConvertSecurityDescriptorToAccessW
ConvertSecurityDescriptorToStringSecurityDescriptorA
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertSidToStringSidA
ConvertSidToStringSidW
ConvertStringSDToSDDomainA
ConvertStringSDToSDDomainW
ConvertStringSDToSDRootDomainA
ConvertStringSDToSDRootDomainW
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidA
ConvertStringSidToSidW
ConvertToAutoInheritPrivateObjectSecurity
CopySid
CreateCodeAuthzLevel
CreatePrivateObjectSecurity
CreatePrivateObjectSecurityEx
CreatePrivateObjectSecurityWithMultipleInheritance
CreateProcessAsUserA
CreateProcessAsUserW
CreateProcessWithLogonW
CreateProcessWithTokenW
CreateRestrictedToken
CreateServiceA
CreateServiceW
CreateTraceInstanceId
CreateWellKnownSid
CredBackupCredentials
CredDeleteA
CredDeleteW
CredEncryptAndMarshalBinaryBlob
CredEnumerateA
CredEnumerateW
CredFindBestCredentialA
CredFindBestCredentialW
CredFree
CredGetSessionTypes
CredGetTargetInfoA
CredGetTargetInfoW
CredIsMarshaledCredentialA
CredIsMarshaledCredentialW
CredIsProtectedA
CredIsProtectedW
CredMarshalCredentialA
CredMarshalCredentialW
CredProfileLoaded
CredProfileLoadedEx
CredProfileUnloaded
CredProtectA
CredProtectW
CredReadA
CredReadByTokenHandle
CredReadDomainCredentialsA
CredReadDomainCredentialsW
CredReadW
CredRenameA
CredRenameW
CredRestoreCredentials
CredUnmarshalCredentialA
CredUnmarshalCredentialW
CredUnprotectA
CredUnprotectW
CredWriteA
CredWriteDomainCredentialsA
CredWriteDomainCredentialsW
CredWriteW
CredpConvertCredential
CredpConvertOneCredentialSize
CredpConvertTargetInfo
CredpDecodeCredential
CredpEncodeCredential
CredpEncodeSecret
CryptAcquireContextA
CryptAcquireContextW
CryptContextAddRef
CryptCreateHash
CryptDecrypt
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptDuplicateHash
CryptDuplicateKey
CryptEncrypt
CryptEnumProviderTypesA
CryptEnumProviderTypesW
CryptEnumProvidersA
CryptEnumProvidersW
CryptExportKey
CryptGenKey
CryptGenRandom
CryptGetDefaultProviderA
CryptGetDefaultProviderW
CryptGetHashParam
CryptGetKeyParam
CryptGetProvParam
CryptGetUserKey
CryptHashData
CryptHashSessionKey
CryptImportKey
CryptReleaseContext
CryptSetHashParam
CryptSetKeyParam
CryptSetProvParam
CryptSetProviderA
CryptSetProviderExA
CryptSetProviderExW
CryptSetProviderW
CryptSignHashA
CryptSignHashW
CryptVerifySignatureA
CryptVerifySignatureW
DecryptFileA
DecryptFileW
DeleteAce
DeleteService
DeregisterEventSource
DestroyPrivateObjectSecurity
DuplicateEncryptionInfoFile
DuplicateToken
DuplicateTokenEx
ElfBackupEventLogFileA
ElfBackupEventLogFileW
ElfChangeNotify
ElfClearEventLogFileA
ElfClearEventLogFileW
ElfCloseEventLog
ElfDeregisterEventSource
ElfFlushEventLog
ElfNumberOfRecords
ElfOldestRecord
ElfOpenBackupEventLogA
ElfOpenBackupEventLogW
ElfOpenEventLogA
ElfOpenEventLogW
ElfReadEventLogA
ElfReadEventLogW
ElfRegisterEventSourceA
ElfRegisterEventSourceW
ElfReportEventA
ElfReportEventAndSourceW
ElfReportEventW
EnableTrace
EnableTraceEx
EnableTraceEx2
EncryptFileA
EncryptFileW
EncryptedFileKeyInfo
EncryptionDisable
EnumDependentServicesA
EnumDependentServicesW
EnumDynamicTimeZoneInformation
EnumServiceGroupW
EnumServicesStatusA
EnumServicesStatusExA
EnumServicesStatusExW
EnumServicesStatusW
EnumerateTraceGuids
EnumerateTraceGuidsEx
EqualDomainSid
EqualPrefixSid
EqualSid
EtwLogSysConfigExtension
EventAccessControl
EventAccessQuery
EventAccessRemove
EventActivityIdControl
EventEnabled
EventProviderEnabled
EventRegister
EventSetInformation
EventUnregister
EventWrite
EventWriteEndScenario
EventWriteEx
EventWriteStartScenario
EventWriteString
EventWriteTransfer
FileEncryptionStatusA
FileEncryptionStatusW
FindFirstFreeAce
FlushEfsCache
FlushTraceA
FlushTraceW
FreeEncryptedFileKeyInfo
FreeEncryptedFileMetadata
FreeEncryptionCertificateHashList
FreeInheritedFromArray
FreeSid
GetAccessPermissionsForObjectA
GetAccessPermissionsForObjectW
GetAce
GetAclInformation
GetAuditedPermissionsFromAclA
GetAuditedPermissionsFromAclW
GetCurrentHwProfileA
GetCurrentHwProfileW
GetDynamicTimeZoneInformationEffectiveYears
GetEffectiveRightsFromAclA
GetEffectiveRightsFromAclW
GetEncryptedFileMetadata
GetEventLogInformation
GetExplicitEntriesFromAclA
GetExplicitEntriesFromAclW
GetFileSecurityA
GetFileSecurityW
GetInformationCodeAuthzLevelW
GetInformationCodeAuthzPolicyW
GetInheritanceSourceA
GetInheritanceSourceW
GetKernelObjectSecurity
GetLengthSid
GetLocalManagedApplicationData
GetLocalManagedApplications
GetManagedApplicationCategories
GetManagedApplications
GetMultipleTrusteeA
GetMultipleTrusteeOperationA
GetMultipleTrusteeOperationW
GetMultipleTrusteeW
GetNamedSecurityInfoA
GetNamedSecurityInfoExA
GetNamedSecurityInfoExW
GetNamedSecurityInfoW
GetNumberOfEventLogRecords
GetOldestEventLogRecord
GetOverlappedAccessResults
GetPrivateObjectSecurity
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorLength
GetSecurityDescriptorOwner
GetSecurityDescriptorRMControl
GetSecurityDescriptorSacl
GetSecurityInfo
GetSecurityInfoExA
GetSecurityInfoExW
GetServiceDisplayNameA
GetServiceDisplayNameW
GetServiceKeyNameA
GetServiceKeyNameW
GetSidIdentifierAuthority
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetStringConditionFromBinary
GetThreadWaitChain
GetTokenInformation
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
GetTrusteeFormA
GetTrusteeFormW
GetTrusteeNameA
GetTrusteeNameW
GetTrusteeTypeA
GetTrusteeTypeW
GetUserNameA
GetUserNameW
GetWindowsAccountDomainSid
I_QueryTagInformation
I_ScGetCurrentGroupStateW
I_ScIsSecurityProcess
I_ScPnPGetServiceName
I_ScQueryServiceConfig
I_ScRegisterPreshutdownRestart
I_ScSendPnPMessage
I_ScSendTSMessage
I_ScSetServiceBitsA
I_ScSetServiceBitsW
I_ScValidatePnPService
IdentifyCodeAuthzLevelW
ImpersonateAnonymousToken
ImpersonateLoggedOnUser
ImpersonateNamedPipeClient
ImpersonateSelf
InitializeAcl
InitializeSecurityDescriptor
InitializeSid
InitiateShutdownA
InitiateShutdownW
InitiateSystemShutdownA
InitiateSystemShutdownExA
InitiateSystemShutdownExW
InitiateSystemShutdownW
InstallApplication
IsTextUnicode
IsTokenRestricted
IsTokenUntrusted
IsValidAcl
IsValidRelativeSecurityDescriptor
IsValidSecurityDescriptor
IsValidSid
IsWellKnownSid
LockServiceDatabase
LogonUserA
LogonUserExA
LogonUserExExW
LogonUserExW
LogonUserW
LookupAccountNameA
LookupAccountNameW
LookupAccountSidA
LookupAccountSidW
LookupPrivilegeDisplayNameA
LookupPrivilegeDisplayNameW
LookupPrivilegeNameA
LookupPrivilegeNameW
LookupPrivilegeValueA
LookupPrivilegeValueW
LookupSecurityDescriptorPartsA
LookupSecurityDescriptorPartsW
LsaAddAccountRights
LsaAddPrivilegesToAccount
LsaClearAuditLog
LsaClose
LsaCreateAccount
LsaCreateSecret
LsaCreateTrustedDomain
LsaCreateTrustedDomainEx
LsaDelete
LsaDeleteTrustedDomain
LsaEnumerateAccountRights
LsaEnumerateAccounts
LsaEnumerateAccountsWithUserRight
LsaEnumeratePrivileges
LsaEnumeratePrivilegesOfAccount
LsaEnumerateTrustedDomains
LsaEnumerateTrustedDomainsEx
LsaFreeMemory
LsaGetAppliedCAPIDs
LsaGetQuotasForAccount
LsaGetRemoteUserName
LsaGetSystemAccessAccount
LsaGetUserName
LsaICLookupNames
LsaICLookupNamesWithCreds
LsaICLookupSids
LsaICLookupSidsWithCreds
LsaInvokeTrustScanner
LsaLookupNames
LsaLookupNames2
LsaLookupPrivilegeDisplayName
LsaLookupPrivilegeName
LsaLookupPrivilegeValue
LsaLookupSids
LsaLookupSids2
LsaManageSidNameMapping
LsaNtStatusToWinError
LsaOpenAccount
LsaOpenPolicy
LsaOpenPolicySce
LsaOpenSecret
LsaOpenTrustedDomain
LsaOpenTrustedDomainByName
LsaQueryCAPs
LsaQueryDomainInformationPolicy
LsaQueryForestTrustInformation
LsaQueryForestTrustInformation2
LsaQueryInfoTrustedDomain
LsaQueryInformationPolicy
LsaQuerySecret
LsaQuerySecurityObject
LsaQueryTrustedDomainInfo
LsaQueryTrustedDomainInfoByName
LsaRemoveAccountRights
LsaRemovePrivilegesFromAccount
LsaRetrievePrivateData
LsaSetCAPs
LsaSetDomainInformationPolicy
LsaSetForestTrustInformation
LsaSetForestTrustInformation2
LsaSetInformationPolicy
LsaSetInformationTrustedDomain
LsaSetQuotasForAccount
LsaSetSecret
LsaSetSecurityObject
LsaSetSystemAccessAccount
LsaSetTrustedDomainInfoByName
LsaSetTrustedDomainInformation

Sections

.text
Size: 595KB - Virtual size: 594KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Data/combase.dll
.dll windows x64

ba8646d28f2e7b54e7bcd331d13af3a6

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:29

Not After

02/12/2021, 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c
Signer

Actual PE Digest

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

06/10/2022, 18:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__dllonexit
_unlock
_lock
__C_specific_handler
_onexit
_initterm
_amsg_exit
_XcptFilter
_itoa_s
memcpy_s
??_V@YAXPEAX@Z
memset
memcpy
memcmp
_local_unwind
wcsnlen
wcsncpy_s
??_U@YAPEAX_K@Z
_wcsnicmp
wcsrchr
_vsnprintf
wcsstr
_wcslwr
_wtol
wcstok
wcschr
qsort
realloc
memmove_s
free
malloc
rand_s
wcsncmp
memmove
_wtoi
_resetstkoflw
_purecall
_wcsicmp
_vsnwprintf
__CxxFrameHandler3
swprintf_s
wcscmp

api-ms-win-core-heap-l1-2-0

HeapSize
HeapValidate
HeapAlloc
HeapFree
GetProcessHeap
HeapCreate
HeapDestroy
HeapReAlloc
HeapCompact

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

GetProcessMitigationPolicy
GetCurrentThreadId
TerminateProcess
GetCurrentThread
SetThreadStackGuarantee
SwitchToThread
OpenProcess
ProcessIdToSessionId
GetCurrentProcess
SetThreadToken
OpenThreadToken
OpenProcessToken
CreateThread
GetProcessId
GetCurrentProcessId

api-ms-win-core-registry-l1-1-0

RegGetValueA
RegDeleteKeyExA
RegCloseKey
RegOpenCurrentUser
RegOpenKeyExW
RegOpenUserClassesRoot
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyExW
RegEnumKeyExW
RegCreateKeyExA
RegSetValueExW
RegGetValueW
RegEnumValueW
RegCreateKeyExW

api-ms-win-core-synch-l1-2-0

SleepEx
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
SetWaitableTimerEx
LeaveCriticalSection
Sleep
WaitForSingleObject
ReleaseSRWLockExclusive
InitializeSRWLock
CreateWaitableTimerExW
ResetEvent
CreateEventW
DeleteCriticalSection
OpenEventW
SetEvent
WaitForMultipleObjectsEx
CreateEventA
InitOnceExecuteOnce
ReleaseSRWLockShared
AcquireSRWLockShared
WaitForSingleObjectEx
AcquireSRWLockExclusive
OpenEventA

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

rpcrt4

RpcServerUseProtseqEpW
RpcBindingVectorFree
NdrConvert2
RpcServerUseProtseqExW
RpcServerUseProtseqEpExW
RpcBindingFromStringBindingW
RpcServerUseProtseqW
RpcBindingCreateW
RpcBindingBind
SimpleTypeBufferSize
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeEncode2
RpcAsyncCompleteCall
NdrClientCall2
RpcErrorAddRecord
RpcMgmtSetComTimeout
RpcMgmtInqComTimeout
I_RpcServerSubscribeForDisconnectNotification
I_RpcServerGetAssociationID
I_RpcMgmtEnableDedicatedThreadPool
NdrCorrelationInitialize
NdrFullPointerXlatInit
SimpleTypeMemorySize
NdrFullPointerXlatFree
NdrClearOutParameters
I_RpcBCacheFree
NdrCorrelationFree
I_RpcExceptionFilter
NdrGetTypeFlags
MesEncodeFixedBufferHandleCreate
MesHandleFree
SimpleTypeAlignment
I_RpcBCacheAllocate
MesBufferHandleReset
MesDecodeBufferHandleCreate
I_RpcFixTransferSyntax
I_RpcSendReceive
RpcRaiseException
RpcErrorEndEnumeration
RpcErrorGetNextRecord
RpcErrorStartEnumeration
NdrClientInitializeNew
I_RpcReceive
I_RpcAsyncSetHandle
NdrServerInitialize
I_RpcGetBuffer
I_RpcAllocate
I_RpcFree
I_RpcGetBufferWithObject
UuidCreate
I_RpcRequestMutex
NdrStubCall2
I_RpcNegotiateTransferSyntax
I_RpcClearMutex
I_RpcMgmtQueryDedicatedThreadPool
RpcBindingFree
RpcBindingSetOption
NdrAsyncServerCall
NdrServerCall2
RpcBindingUnbind
RpcBindingCopy
NdrMesTypeDecode3
I_RpcSend
I_RpcAsyncAbortCall
RpcServerUnregisterIf
RpcServerRegisterIf3
RpcImpersonateClient2
RpcServerRegisterAuthInfoW
RpcCertGeneratePrincipalNameW
I_RpcOpenClientProcess
RpcBindingInqAuthClientW
NdrMesTypeEncode3
I_RpcSetDCOMAppId
I_RpcBindingInqCurrentModifiedId
RpcBindingInqObject
I_RpcBindingInqLocalClientPID
RpcBindingServerFromClient
RpcRevertToSelfEx
RpcImpersonateClient
RpcStringBindingParseW
RpcBindingToStringBindingW
I_RpcBindingInqTransportType
RpcServerInqCallAttributesW
I_RpcBindingSetPrivateOption
RpcBindingSetAuthInfoExW
RpcSmDestroyClientContext
NdrClientCall3
NdrStubCall3
RpcStringFreeW
RpcBindingInqAuthInfoExW
RpcCancelThreadEx
RpcMgmtSetCancelTimeout
NdrOleAllocate
NdrOleFree
NdrDllGetClassObject
RpcAsyncCancelCall
RpcServerInqBindings
RpcServerTestCancel
NdrGetUserMarshalInfo
I_RpcFreeBuffer
RpcAsyncInitializeHandle
RpcAsyncGetCallStatus

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
GetComputerNameExW
GetSystemInfo
GetSystemWindowsDirectoryW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
OutputDebugStringA
DebugBreak
IsDebuggerPresent

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
SetEventWhenCallbackReturns
WaitForThreadpoolWaitCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-fibers-l1-1-1

FlsAlloc
FlsSetValue
FlsFree
IsThreadAFiber

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetModuleHandleW
LoadLibraryExA
GetProcAddress
LoadStringW
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
CompareStringOrdinal
CompareStringW
MultiByteToWideChar

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
SearchPathW
FreeEnvironmentStringsW
GetEnvironmentStringsW

api-ms-win-security-base-l1-2-0

CreateWellKnownSid
AccessCheck
CheckTokenMembership
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeSid
GetSidLengthRequired
GetAppContainerAce
InitializeAcl
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
GetAce
MapGenericMask
GetSidSubAuthorityCount
GetKernelObjectSecurity
GetSidSubAuthority
DuplicateToken
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
MakeSelfRelativeSD
IsValidSecurityDescriptor
GetTokenInformation
RevertToSelf
ImpersonateAnonymousToken
AccessCheckByType
GetSecurityDescriptorDacl
GetLengthSid
IsValidSid
GetSecurityDescriptorLength
PrivilegeCheck
CopySid
EqualSid

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-memory-l1-1-2

UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
VirtualProtect
VirtualAlloc
VirtualQuery
MapViewOfFile

api-ms-win-core-localization-l1-2-1

FormatMessageW
LCMapStringW

api-ms-win-core-file-l1-2-1

CreateFileW

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventRegister
EventWriteEx
EventUnregister

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled
QuirkIsEnabledForProcess

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

RaiseFailFastException

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpiA
lstrcmpiW
lstrlenA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize
LocalAlloc
GlobalFree
LocalFree
GlobalUnlock
GlobalReAlloc
GlobalAlloc
GlobalLock

api-ms-win-core-privateprofile-l1-1-1

GetProfileStringW

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx
FindActCtxSectionGuid
FindActCtxSectionStringW
ActivateActCtx
AddRefActCtx
DeactivateActCtx
GetCurrentActCtx
CreateActCtxW

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

ntdll

RtlCopySid
NtQueryInformationToken
RtlLengthSid
NtQueryObject
LdrStandardizeSystemPath
RtlFreeSid
RtlDelete
RtlApplicationVerifierStop
RtlCheckForOrphanedCriticalSections
NtQueryInformationThread
RtlFreeHeap
RtlGetAppContainerNamedObjectPath
NtTerminateProcess
RtlReportException
RtlInitializeCriticalSectionAndSpinCount
NtQueryTimerResolution
RtlLoadString
RtlInitializeConditionVariable
ord1
EvtIntReportEventAndSourceAsync
RtlSplay
RtlDeleteNoSplay
RtlInitUnicodeString
NtOpenKey
RtlEqualUnicodeString
WinSqmSetDWORD
RtlInitializeCriticalSection
RtlImageNtHeader
RtlIsCriticalSectionLockedByThread
RtlDllShutdownInProgress
DbgPrint
EtwEventUnregister
RtlAllocateHeap
NtQueryValueKey
RtlQueryPackageIdentity
ZwQuerySecurityAttributesToken
RtlSidDominates
RtlGetAppContainerSidType
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwGetTraceLoggerHandle
NtQuerySystemInformation
RtlSleepConditionVariableCS
RtlDeleteCriticalSection
RtlWakeAllConditionVariable
NtQueryInformationProcess
NtApphelpCacheControl
RtlInitUnicodeStringEx
RtlValidRelativeSecurityDescriptor
NtClose
NtDuplicateObject
NtCreateKey
RtlRealPredecessor
EtwEventRegister
EtwTraceMessage
EtwEventWrite
RtlNtStatusToDosError
NtQueryKey

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

CLSIDFromOle1Class
CLSIDFromProgID
CLSIDFromString
CleanupOleStateInAllTls
CleanupTlsOleState
ClearCleanupFlag
CoAddRefServerProcess
CoAllowUnmarshalerCLSID
CoCancelCall
CoCopyProxy
CoCreateErrorInfo
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoCreateInstanceEx
CoCreateInstanceFromApp
CoCreateObjectInContext
CoDeactivateObject
CoDecodeProxy
CoDecrementMTAUsage
CoDisableCallCancellation
CoDisconnectContext
CoDisconnectObject
CoEnableCallCancellation
CoFreeUnusedLibraries
CoFreeUnusedLibrariesEx
CoGetActivationState
CoGetApartmentID
CoGetApartmentType
CoGetCallContext
CoGetCallState
CoGetCallerTID
CoGetCancelObject
CoGetClassObject
CoGetClassVersion
CoGetContextToken
CoGetCurrentLogicalThreadId
CoGetCurrentProcess
CoGetDefaultContext
CoGetErrorInfo
CoGetInstanceFromFile
CoGetInstanceFromIStorage
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoGetMarshalSizeMax
CoGetModuleType
CoGetObjectContext
CoGetPSClsid
CoGetProcessIdentifier
CoGetStandardMarshal
CoGetStdMarshalEx
CoGetSystemSecurityPermissions
CoGetTreatAsClass
CoImpersonateClient
CoIncrementMTAUsage
CoInitializeEx
CoInitializeSecurity
CoInitializeWOW
CoInvalidateRemoteMachineBindings
CoIsHandlerConnected
CoLockObjectExternal
CoMarshalHresult
CoMarshalInterThreadInterfaceInStream
CoMarshalInterface
CoPopServiceDomain
CoPushServiceDomain
CoQueryAuthenticationServices
CoQueryClientBlanket
CoQueryProxyBlanket
CoReactivateObject
CoRegisterActivationFilter
CoRegisterClassObject
CoRegisterInitializeSpy
CoRegisterMallocSpy
CoRegisterMessageFilter
CoRegisterPSClsid
CoRegisterSurrogate
CoRegisterSurrogateEx
CoReleaseMarshalData
CoReleaseServerProcess
CoResumeClassObjects
CoRetireServer
CoRevertToSelf
CoRevokeClassObject
CoRevokeInitializeSpy
CoRevokeMallocSpy
CoSetCancelObject
CoSetErrorInfo
CoSetProxyBlanket
CoSuspendClassObjects
CoSwitchCallContext
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoTestCancel
CoUninitialize
CoUnloadingWOW
CoUnmarshalHresult
CoUnmarshalInterface
CoVrfCheckThreadState
CoVrfGetThreadState
CoVrfReleaseThreadState
CoWaitForMultipleHandles
CoWaitForMultipleObjects
CreateErrorInfo
CreateStreamOnHGlobal
DcomChannelSetHResult
DllDebugObjectRPCHook
DllGetActivationFactory
DllGetClassObject
EnableHookObject
FreePropVariantArray
FreePropVariantArrayWorker
GetCatalogHelper
GetErrorInfo
GetFuncDescs
GetHGlobalFromStream
GetHookInterface
GetRestrictedErrorInfo
HSTRING_UserFree
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserMarshal64
HSTRING_UserSize
HSTRING_UserSize64
HSTRING_UserUnmarshal
HSTRING_UserUnmarshal64
HkOleRegisterObject
IIDFromString
InternalAppInvokeExceptionFilter
InternalCCFreeUnused
InternalCCGetClassInformationForDde
InternalCCGetClassInformationFromKey
InternalCCSetDdeServerWindow
InternalCMLSendReceive
InternalCallAsProxyExceptionFilter
InternalCallFrameExceptionFilter
InternalCallerIsAppContainer
InternalCanMakeOutCall
InternalCoIsSurrogateProcess
InternalCoRegisterDisconnectCallback
InternalCoRegisterSurrogatedObject
InternalCoStdMarshalObject
InternalCoUnregisterDisconnectCallback
InternalCompleteObjRef
InternalCreateCAggId
InternalCreateIdentityHandler
InternalDoATClassCreate
InternalFillLocalOXIDInfo
InternalFreeObjRef
InternalGetWindowPropInterface
InternalIrotEnumRunning
InternalIrotEnumRunning2
InternalIrotGetObject
InternalIrotGetObject2
InternalIrotGetObject3
InternalIrotGetTimeOfLastChange
InternalIrotGetTimeOfLastChange2
InternalIrotIsRunning
InternalIrotIsRunning2
InternalIrotNoteChangeTime
InternalIrotRegister
InternalIrotRevoke
InternalIsApartmentInitialized
InternalIsProcessInitialized
InternalMarshalObjRef
InternalNotifyDDStartOrStop
InternalOleModalLoopBlockFn
InternalRegisterWindowPropInterface
InternalReleaseMarshalObjRef
InternalSTAInvoke
InternalServerExceptionFilter
InternalSetAptCallCtrlOnTlsIfRequired
InternalSetOleThunkWowPtr
InternalStubInvoke
InternalTlsAllocData
InternalUnmarshalObjRef
IsErrorPropagationEnabled
NdrExtStubInitialize
NdrOleDllGetClassObject
NdrOleInitializeExtension
NdrProxyForwardingFunction10
NdrProxyForwardingFunction11
NdrProxyForwardingFunction12
NdrProxyForwardingFunction13
NdrProxyForwardingFunction14
NdrProxyForwardingFunction15
NdrProxyForwardingFunction16
NdrProxyForwardingFunction17
NdrProxyForwardingFunction18
NdrProxyForwardingFunction19
NdrProxyForwardingFunction20
NdrProxyForwardingFunction21
NdrProxyForwardingFunction22
NdrProxyForwardingFunction23
NdrProxyForwardingFunction24
NdrProxyForwardingFunction25
NdrProxyForwardingFunction26
NdrProxyForwardingFunction27
NdrProxyForwardingFunction28
NdrProxyForwardingFunction29
NdrProxyForwardingFunction3
NdrProxyForwardingFunction30
NdrProxyForwardingFunction31
NdrProxyForwardingFunction32
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction6
NdrProxyForwardingFunction7
NdrProxyForwardingFunction8
NdrProxyForwardingFunction9
NdrpFindInterface
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient14
ObjectStublessClient15
ObjectStublessClient16
ObjectStublessClient17
ObjectStublessClient18
ObjectStublessClient19
ObjectStublessClient20
ObjectStublessClient21
ObjectStublessClient22
ObjectStublessClient23
ObjectStublessClient24
ObjectStublessClient25
ObjectStublessClient26
ObjectStublessClient27
ObjectStublessClient28
ObjectStublessClient29
ObjectStublessClient3
ObjectStublessClient30
ObjectStublessClient31
ObjectStublessClient32
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient9
ProgIDFromCLSID
PropVariantClear
PropVariantCopy
ReleaseFuncDescs
RoActivateInstance
RoCaptureErrorContext
RoClearError
RoFailFastWithErrorContext
RoFailFastWithErrorContextInternal
RoFailFastWithErrorContextInternal2
RoFreeParameterizedTypeExtra
RoGetActivatableClassRegistration
RoGetActivationFactory
RoGetAgileReference
RoGetApartmentIdentifier
RoGetErrorReportingFlags
RoGetMatchingRestrictedErrorInfo
RoGetParameterizedTypeInstanceIID
RoGetServerActivatableClasses
RoInitialize
RoInspectCapturedStackBackTrace
RoInspectThreadErrorInfo
RoOriginateError
RoOriginateErrorW
RoOriginateLanguageException
RoParameterizedTypeExtraGetTypeSignature
RoRegisterActivationFactories
RoRegisterForApartmentShutdown
RoReportCapabilityCheckFailure
RoReportFailedDelegate
RoReportUnhandledError
RoResolveRestrictedErrorInfoReference
RoRevokeActivationFactories
RoSetErrorReportingFlags
RoTransformError
RoTransformErrorW
RoUninitialize
RoUnregisterForApartmentShutdown
SetCleanupFlag
SetErrorInfo
SetRestrictedErrorInfo
StringFromCLSID
StringFromGUID2
StringFromIID
UpdateDCOMSettings
UpdateProcessTracing
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserMarshal64
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserSize64
WdtpInterfacePointer_UserUnmarshal
WdtpInterfacePointer_UserUnmarshal64
WindowsCompareStringOrdinal
WindowsConcatString
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsDeleteStringBuffer
WindowsDuplicateString
WindowsGetStringLen
WindowsGetStringRawBuffer
WindowsInspectString
WindowsIsStringEmpty
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsReplaceString
WindowsStringHasEmbeddedNull
WindowsSubstring
WindowsSubstringWithSpecifiedLength
WindowsTrimStringEnd
WindowsTrimStringStart

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ndr64
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Data/freebl3.dll
.dll windows x64

8a564fee0e9aa5547525f921a1b23c12

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

nss3

NSS_SecureMemcmp
NSS_SecureMemcmpZero
PORT_Alloc_Util
PORT_ArenaAlloc_Util
PORT_ArenaZAlloc_Util
PORT_FreeArena_Util
PORT_Free_Util
PORT_GetError_Util
PORT_NewArena_Util
PORT_SetError_Util
PORT_ZAllocAlignedOffset_Util
PORT_ZAlloc_Util
PORT_ZFree_Util
PR_CallOnce
PR_DestroyCondVar
PR_DestroyLock
PR_GetEnvSecure
PR_Lock
PR_NewCondVar
PR_NewLock
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_Unlock
PR_WaitCondVar
SECITEM_AllocItem_Util
SECITEM_CompareItem_Util
SECITEM_CopyItem_Util
SECITEM_FreeItem_Util
SECITEM_ZfreeItem_Util
SECOID_FindOIDTag_Util

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
SystemFunction036

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc

api-ms-win-crt-private-l1-1-0

memcmp
memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort

api-ms-win-crt-string-l1-1-0

_strdup
islower
isupper
memset
strlen
strncmp
tolower
toupper

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_time64
_tzset

api-ms-win-crt-utility-l1-1-0

rand

kernel32

DeleteCriticalSection
EnterCriticalSection
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetLastError
GetLogicalDrives
GetTickCount
GetVolumeInformationA
GlobalMemoryStatus
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
_close
_open
_write
fwrite

api-ms-win-crt-environment-l1-1-0

__p__environ
__p__wenviron

Exports

Exports

FREEBL_GetVector

Sections

.text
Size: 559KB - Virtual size: 558KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 149B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Setup.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
msvcr100.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 574KB - Virtual size: 573KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_CONST
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
packages/ADS/ADS.pimx
packages/ADS/ADS.sig
.xml
packages/CEF/CEF.pimx
packages/CEF/CEF.sig
.xml
packages/ElevationManager/ElevationManager.pimx
packages/ElevationManager/ElevationManager.sig
.xml
products/AAM/IPC/IPC.pima
.zip
products/AAM/IPC/IPC.pimx
products/AAM/IPC/IPC.sig
.xml
products/HDBox/HDBox.pimx
products/HDBox/HDBox.sig
.xml
products/IPCBox/IPCBox.pimx
products/IPCBox/IPCBox.sig
.xml
resources/DATA PROTECTION/Privacy Policy.txt
resources/DATA PROTECTION/advapi32.dll
.dll windows x64

cf49de37d6832a2e30a495cfe792c5d3

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:71:3a:ed:36:6c:0f:91:c7:97:71:46:7d:89:eb:e2:d5:18:ad:17:62:cf:4f:58:50:46:12:28:d5:7c:7a:8d
Signer

Actual PE Digest

35:71:3a:ed:36:6c:0f:91:c7:97:71:46:7d:89:eb:e2:d5:18:ad:17:62:cf:4f:58:50:46:12:28:d5:7c:7a:8d

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

06/10/2022, 18:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memmove
iswctype
_vsnwprintf
memset
memcpy
memcmp
__C_specific_handler
_vsnprintf
mbstowcs
iswalpha
_stricmp
_wcstoi64
_i64tow_s
_wcstoui64
_ui64tow_s
_ultow
wcscat_s
_wcsicmp
_errno
wcschr
wcscpy_s
wcstok_s
swscanf_s
wcsrchr
wcsncpy_s
wcsstr
swprintf_s
_wcsnicmp
wcsncmp
strstr
strchr
tolower
wcstoul
_ultow_s
wcscmp

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtSetSystemInformation
DbgPrint
RtlFreeAnsiString
RtlGetCurrentTransaction
ord1
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlIsTextUnicode
RtlLengthSid
NlsMbCodePageTag
NtQueryInformationToken
RtlxUnicodeStringToAnsiSize
RtlSubAuthoritySid
RtlGetThreadPreferredUILanguages
RtlSubAuthorityCountSid
RtlMakeSelfRelativeSD
RtlConvertSidToUnicodeString
RtlUnicodeStringToInteger
RtlAllocateHandle
RtlIsValidIndexHandle
RtlFreeHandle
NtOpenKey
NtQueryValueKey
NtClose
NtOpenThreadToken
NtOpenProcessToken
RtlEqualSid
RtlAddAccessAllowedAceEx
NtSetInformationToken
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
NtDuplicateToken
NtCompareTokens
RtlAllocateAndInitializeSid
RtlFreeSid
RtlIsGenericTableEmpty
RtlEnumerateGenericTableWithoutSplaying
RtlDuplicateUnicodeString
RtlExpandEnvironmentStrings_U
NtOpenFile
RtlCreateUnicodeString
NtQueryInformationProcess
RtlGetLastNtStatus
NtQueryKey
RtlValidSid
LdrLoadDll
RtlImageNtHeader
LdrUnloadDll
NtDeviceIoControlFile
NtQuerySystemInformation
EtwEventRegister
EtwEventWrite
NtCreateKey
NtSetValueKey
RtlDeleteElementGenericTable
RtlAppendUnicodeToString
NtDeleteKey
RtlInsertElementGenericTable
RtlCopySid
RtlInitializeHandleTable
RtlDestroyHandleTable
EtwEventUnregister
NtEnumerateKey
RtlIntegerToUnicodeString
RtlStringFromGUID
RtlAppendUnicodeStringToString
RtlFormatCurrentUserKeyPath
RtlInitializeGenericTable
RtlQueryRegistryValuesEx
RtlLookupElementGenericTable
RtlNumberGenericTableElements
RtlGUIDFromString
RtlUpcaseUnicodeChar
NtQueryVolumeInformationFile
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
RtlPrefixUnicodeString
RtlDetermineDosPathNameType_U
NtQueryInformationFile
RtlGetFullPathName_U
RtlUnicodeToMultiByteN
RtlNtStatusToDosErrorNoTeb
RtlAnsiCharToUnicodeChar
RtlMultiByteToUnicodeN
RtlSetLastWin32Error
NtTraceControl
NtTraceEvent
EtwpGetCpuSpeed
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
RtlInitAnsiStringEx
RtlInitUnicodeStringEx
RtlCreateUnicodeStringFromAsciiz
NtRenameKey
RtlAddAce
RtlGetAce
RtlAddAccessDeniedAceEx
RtlSetDaclSecurityDescriptor
RtlFirstFreeAce
RtlValidAcl
RtlAddAuditAccessObjectAce
RtlGetSaclSecurityDescriptor
RtlAddAccessDeniedObjectAce
RtlSetGroupSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlxAnsiStringToUnicodeSize
RtlGetControlSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedObjectAce
RtlGetDaclSecurityDescriptor
RtlInitializeSid
RtlGetOwnerSecurityDescriptor
RtlAddAuditAccessAceEx
NtQuerySystemTime
RtlTimeToSecondsSince1970
EtwEventSetInformation
RtlImpersonateSelf
RtlAdjustPrivilege
RtlCopyString
EtwEventWriteTransfer
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
NtWaitForSingleObject
RtlGetVersion
NtQueryInformationThread
NtSetInformationThread
NtQuerySecurityObject
RtlRunOnceExecuteOnce
RtlRunOnceBeginInitialize
RtlDllShutdownInProgress
RtlRunOnceInitialize
NtQueryPerformanceCounter
NtWaitForMultipleObjects
WinSqmAddToStream
RtlCreateAcl
RtlValidRelativeSecurityDescriptor
NtCreateFile
NtWriteFile
NtReadFile
RtlWaitOnAddress
RtlWakeAddressAll
RtlQueryPerformanceCounter
RtlAddAccessAllowedAce
RtlAcquireSRWLockExclusive
RtlInsertElementGenericTableAvl
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockShared
RtlLookupElementGenericTableAvl
RtlReleaseSRWLockShared
RtlEnumerateGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlReAllocateHeap
RtlDosPathNameToRelativeNtPathName_U
RtlReleaseRelativeName
RtlWakeAddressSingle
RtlDestroyQueryDebugBuffer
RtlEqualUnicodeString
RtlQueryProcessDebugInformation
NtQueryMutant
NtQueryObject
NtAlpcQueryInformation
RtlInitializeSRWLock
RtlCreateQueryDebugBuffer
RtlOpenCurrentUser
NtQueryMultipleValueKey
NtReplaceKey
NtSaveMergedKeys
NtSaveKey
RtlValidSecurityDescriptor
RtlLengthSecurityDescriptor
RtlGetNtProductType
RtlCopyUnicodeString
RtlOemStringToUnicodeString
RtlUnicodeToMultiByteSize
RtlUnicodeStringToAnsiString
RtlDosPathNameToNtPathName_U
RtlAllocateHeap
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
NtOpenKeyEx
NtSetInformationKey
RtlFreeHeap
RtlAnsiStringToUnicodeString
RtlInitializeCriticalSection
RtlDeleteCriticalSection

api-ms-win-eventing-controller-l1-1-0

TraceSetInformation
ControlTraceW
QueryAllTracesW
EventAccessQuery
EnumerateTraceGuidsEx
StartTraceW
EventAccessControl
StopTraceW
EventAccessRemove
EnableTraceEx2

api-ms-win-eventing-consumer-l1-1-0

CloseTrace
OpenTraceW
ProcessTrace

kernelbase

RegKrnGetHKEY_ClassesRootAddress
RegKrnGetClassesEnumTableAddressInternal
RegKrnGetTermsrvRegistryExtensionFlags
RegDeleteKeyExInternalW
RegOpenKeyExInternalW
RegCreateKeyExInternalW
CLOSE_LOCAL_HANDLE_INTERNAL
MapPredefinedHandleInternal
RegDeleteKeyExInternalA
RegCreateKeyExInternalA
RegOpenKeyExInternalA
RemapPredefinedHandleInternal
DisablePredefinedHandleTableInternal
GetPackagePath
PackageIdFromFullName
Sleep
lstrcmpiW
lstrcmpW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
CreateProcessAsUserW
CreateProcessInternalA
AreFileApisANSI
lstrlenW
LocalReAlloc
LocalFree
LocalAlloc

sechost

QueryAllTracesA
StartTraceA
ControlTraceA

api-ms-win-service-core-l1-1-1

EnumDependentServicesW
QueryServiceDynamicInformation
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
EnumServicesStatusExW

api-ms-win-service-management-l1-1-0

CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
ControlServiceExW
OpenServiceW
StartServiceW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW
QueryServiceStatusEx
QueryServiceConfigW
NotifyServiceStatusChangeW
SetServiceObjectSecurity
ChangeServiceConfig2W
QueryServiceObjectSecurity
QueryServiceConfig2W

api-ms-win-service-private-l1-1-1

I_ScRpcBindW
I_ScRpcBindA
I_ScSetServiceBitsA
I_ScSetServiceBitsW
I_ScRegisterPreshutdownRestart
WaitServiceState

api-ms-win-service-winsvc-l1-2-0

OpenServiceA
QueryServiceConfig2A
ControlService
RegisterServiceCtrlHandlerW
QueryServiceConfigA
OpenSCManagerA
QueryServiceStatus
RegisterServiceCtrlHandlerExA
ChangeServiceConfigA
StartServiceA
CreateServiceA
RegisterServiceCtrlHandlerA
NotifyServiceStatusChangeA
ControlServiceExA
ChangeServiceConfig2A
StartServiceCtrlDispatcherA

api-ms-win-core-namedpipe-l1-2-0

ImpersonateNamedPipeClient

api-ms-win-core-processthreads-l1-1-2

OpenProcess
CreateThread
IsProcessorFeaturePresent
GetCurrentThread
OpenThread
GetProcessId
GetCurrentProcess
OpenProcessToken
OpenThreadToken
SetThreadToken
GetPriorityClass
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-security-base-l1-2-0

RevertToSelf
AddAccessAllowedAce
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
AllocateAndInitializeSid
AllocateLocallyUniqueId
InitializeAcl
SetKernelObjectSecurity
MakeAbsoluteSD
ImpersonateLoggedOnUser
DuplicateTokenEx
QuerySecurityAccessMask
CreatePrivateObjectSecurityEx
GetSecurityDescriptorLength
ImpersonateSelf
GetAce
AccessCheckByTypeResultList
CreatePrivateObjectSecurity
SetSecurityDescriptorDacl
IsTokenRestricted
AddAuditAccessObjectAce
AdjustTokenGroups
AddAccessDeniedAce
AreAllAccessesGranted
SetTokenInformation
PrivilegeCheck
InitializeSecurityDescriptor
GetPrivateObjectSecurity
DuplicateToken
CreatePrivateObjectSecurityWithMultipleInheritance
SetAclInformation
GetSidIdentifierAuthority
FreeSid
GetTokenInformation
PrivilegedServiceAuditAlarmW
AccessCheckByTypeResultListAndAuditAlarmW
ObjectOpenAuditAlarmW
ObjectPrivilegeAuditAlarmW
ObjectCloseAuditAlarmW
SetFileSecurityW
GetFileSecurityW
ObjectDeleteAuditAlarmW
CopySid
AccessCheckByTypeResultListAndAuditAlarmByHandleW
AccessCheckAndAuditAlarmW
AccessCheckByTypeAndAuditAlarmW
IsValidSid
EqualPrefixSid
AddAccessDeniedObjectAce
AddAccessAllowedObjectAce
AccessCheckByType
AddAuditAccessAce
SetPrivateObjectSecurityEx
EqualSid
GetSecurityDescriptorControl
CreateRestrictedToken
GetAclInformation
GetKernelObjectSecurity
AccessCheck
AddAccessAllowedAceEx
GetSecurityDescriptorRMControl
SetSecurityDescriptorRMControl
GetSidSubAuthorityCount
GetSidLengthRequired
MapGenericMask
InitializeSid
AddAce
IsValidAcl
ImpersonateAnonymousToken
MakeSelfRelativeSD
IsValidSecurityDescriptor
GetLengthSid
AddAccessDeniedAceEx
CheckTokenMembership
SetSecurityDescriptorSacl
AreAnyAccessesGranted
AdjustTokenPrivileges
SetSecurityDescriptorGroup
DeleteAce
SetSecurityDescriptorControl
GetWindowsAccountDomainSid
FindFirstFreeAce
ConvertToAutoInheritPrivateObjectSecurity
SetPrivateObjectSecurity
EqualDomainSid
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
CreateWellKnownSid
DestroyPrivateObjectSecurity
AddAuditAccessAceEx
SetSecurityAccessMask
IsWellKnownSid
GetSidSubAuthority
GetSecurityDescriptorSacl

api-ms-win-security-base-private-l1-1-1

MakeAbsoluteSD2

api-ms-win-core-registry-l1-1-0

RegRestoreKeyW
RegLoadAppKeyW
RegCopyTreeW
RegCloseKey
RegOpenKeyExW
RegLoadMUIStringA
RegLoadAppKeyA
RegOpenUserClassesRoot
RegDeleteKeyExW
RegUnLoadKeyA
RegRestoreKeyA
RegDeleteTreeA
RegSetValueExA
RegCreateKeyExW
RegQueryValueExA
RegQueryInfoKeyW
RegEnumKeyExA
RegLoadMUIStringW
RegSaveKeyExA
RegUnLoadKeyW
RegSetValueExW
RegLoadKeyW
RegDisablePredefinedCacheEx
RegEnumKeyExW
RegFlushKey
RegNotifyChangeKeyValue
RegDeleteKeyExA
RegSetKeySecurity
RegEnumValueW
RegLoadKeyA
RegEnumValueA
RegOpenCurrentUser
RegGetValueW
RegSaveKeyExW
RegDeleteTreeW
RegDeleteValueA
RegDeleteValueW
RegQueryInfoKeyA
RegGetValueA
RegGetKeySecurity
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExW

api-ms-win-core-sysinfo-l1-2-1

GetComputerNameExW
GetTickCount
GetSystemTimeAsFileTime
GetLocalTime
GetNativeSystemInfo
GlobalMemoryStatusEx
GetSystemFirmwareTable
GetSystemWindowsDirectoryW
GetSystemTime
GetSystemDirectoryW

kernel32

GetFileAttributesExW
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
LoadLibraryExA
CloseHandle
FreeLibrary
LoadLibraryExW
LeaveCriticalSection
GetLastError
EnterCriticalSection
GetFullPathNameW
SearchPathW
HeapAlloc
ResolveDelayLoadedAPI
DelayLoadFailureHook
HeapFree
SleepEx
GetProcessHeap
GetFileAttributesW
CreateFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
CreateEventW
GetThreadUILanguage
GetCommandLineW
LoadLibraryW
GetModuleHandleExW
SetFilePointer
OutputDebugStringW
WriteFile
TermsrvDeleteKey
TermsrvOpenUserClasses
DuplicateHandle
DecodePointer
FreeLibraryAndExitThread
ReadProcessMemory
EncodePointer
CreateThreadpoolIo
FreeLibraryWhenCallbackReturns
CancelIoEx
CloseThreadpoolIo
FormatMessageW
MoveFileW
DeleteFileW
ExpandEnvironmentStringsW
GetModuleHandleW
GetFileSizeEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetLongPathNameW
CompareFileTime
FindResourceExW
LoadResource
GetVolumePathNameW
DeleteCriticalSection
WaitForSingleObject
GetActiveProcessorCount
GetOverlappedResult
DeviceIoControl
GetVolumeInformationW
GetComputerNameW
ReleaseMutex
ExpandEnvironmentStringsA
GetModuleFileNameW
LoadLibraryA
GetComputerNameA
LocalUnlock
LocalLock
CreateMutexW
InitializeCriticalSection
StartThreadpoolIo
CancelThreadpoolIo
EnumUILanguagesW
GetFileMUIPath
SetErrorMode
SetFileInformationByHandle
CopyFileExW
FindClose
FindNextFileW
FindFirstFileExW
lstrcmpiA
GetFileSize
DosDateTimeToFileTime
FileTimeToDosDateTime
GetFileTime
ResetEvent
SetEvent
HeapReAlloc
LockResource
SizeofResource
SetLastError

rpcrt4

RpcStringBindingComposeW
RpcBindingFree
RpcStringFreeW
RpcBindingSetAuthInfoExA
RpcBindingSetAuthInfoExW
NdrClientCall3
I_RpcExceptionFilter
I_RpcMapWin32Status
RpcEpResolveBinding
RpcBindingSetAuthInfoW
RpcBindingSetAuthInfoA
RpcBindingFromStringBindingW
RpcSsDestroyClientContext
RpcBindingCreateW
RpcBindingBind
I_RpcSNCHOption
NdrClientCall2
UuidFromStringW
UuidToStringW
RpcExceptionFilter

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformationEffectiveYears
EnumDynamicTimeZoneInformation

api-ms-win-security-audit-l1-1-1

AuditSetSecurity
AuditEnumeratePerUserPolicy
AuditQueryGlobalSaclW
AuditFree
AuditSetPerUserPolicy
AuditEnumerateSubCategories
AuditComputeEffectivePolicyBySid
AuditLookupCategoryNameW
AuditLookupSubCategoryNameW
AuditEnumerateCategories
AuditQueryPerUserPolicy
AuditSetGlobalSaclW
AuditQuerySecurity
AuditQuerySystemPolicy
AuditSetSystemPolicy

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

A_SHAFinal
A_SHAInit
A_SHAUpdate
AbortSystemShutdownA
AbortSystemShutdownW
AccessCheck
AccessCheckAndAuditAlarmA
AccessCheckAndAuditAlarmW
AccessCheckByType
AccessCheckByTypeAndAuditAlarmA
AccessCheckByTypeAndAuditAlarmW
AccessCheckByTypeResultList
AccessCheckByTypeResultListAndAuditAlarmA
AccessCheckByTypeResultListAndAuditAlarmByHandleA
AccessCheckByTypeResultListAndAuditAlarmByHandleW
AccessCheckByTypeResultListAndAuditAlarmW
AddAccessAllowedAce
AddAccessAllowedAceEx
AddAccessAllowedObjectAce
AddAccessDeniedAce
AddAccessDeniedAceEx
AddAccessDeniedObjectAce
AddAce
AddAuditAccessAce
AddAuditAccessAceEx
AddAuditAccessObjectAce
AddConditionalAce
AddMandatoryAce
AddUsersToEncryptedFile
AddUsersToEncryptedFileEx
AdjustTokenGroups
AdjustTokenPrivileges
AllocateAndInitializeSid
AllocateLocallyUniqueId
AreAllAccessesGranted
AreAnyAccessesGranted
AuditComputeEffectivePolicyBySid
AuditComputeEffectivePolicyByToken
AuditEnumerateCategories
AuditEnumeratePerUserPolicy
AuditEnumerateSubCategories
AuditFree
AuditLookupCategoryGuidFromCategoryId
AuditLookupCategoryIdFromCategoryGuid
AuditLookupCategoryNameA
AuditLookupCategoryNameW
AuditLookupSubCategoryNameA
AuditLookupSubCategoryNameW
AuditQueryGlobalSaclA
AuditQueryGlobalSaclW
AuditQueryPerUserPolicy
AuditQuerySecurity
AuditQuerySystemPolicy
AuditSetGlobalSaclA
AuditSetGlobalSaclW
AuditSetPerUserPolicy
AuditSetSecurity
AuditSetSystemPolicy
BackupEventLogA
BackupEventLogW
BaseRegCloseKey
BaseRegCreateKey
BaseRegDeleteKeyEx
BaseRegDeleteValue
BaseRegFlushKey
BaseRegGetVersion
BaseRegLoadKey
BaseRegOpenKey
BaseRegRestoreKey
BaseRegSaveKeyEx
BaseRegSetKeySecurity
BaseRegSetValue
BaseRegUnLoadKey
BuildExplicitAccessWithNameA
BuildExplicitAccessWithNameW
BuildImpersonateExplicitAccessWithNameA
BuildImpersonateExplicitAccessWithNameW
BuildImpersonateTrusteeA
BuildImpersonateTrusteeW
BuildSecurityDescriptorA
BuildSecurityDescriptorW
BuildTrusteeWithNameA
BuildTrusteeWithNameW
BuildTrusteeWithObjectsAndNameA
BuildTrusteeWithObjectsAndNameW
BuildTrusteeWithObjectsAndSidA
BuildTrusteeWithObjectsAndSidW
BuildTrusteeWithSidA
BuildTrusteeWithSidW
CancelOverlappedAccess
ChangeServiceConfig2A
ChangeServiceConfig2W
ChangeServiceConfigA
ChangeServiceConfigW
CheckForHiberboot
CheckTokenMembership
ClearEventLogA
ClearEventLogW
CloseCodeAuthzLevel
CloseEncryptedFileRaw
CloseEventLog
CloseServiceHandle
CloseThreadWaitChainSession
CloseTrace
CommandLineFromMsiDescriptor
ComputeAccessTokenFromCodeAuthzLevel
ControlService
ControlServiceExA
ControlServiceExW
ControlTraceA
ControlTraceW
ConvertAccessToSecurityDescriptorA
ConvertAccessToSecurityDescriptorW
ConvertSDToStringSDDomainW
ConvertSDToStringSDRootDomainA
ConvertSDToStringSDRootDomainW
ConvertSecurityDescriptorToAccessA
ConvertSecurityDescriptorToAccessNamedA
ConvertSecurityDescriptorToAccessNamedW
ConvertSecurityDescriptorToAccessW
ConvertSecurityDescriptorToStringSecurityDescriptorA
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertSidToStringSidA
ConvertSidToStringSidW
ConvertStringSDToSDDomainA
ConvertStringSDToSDDomainW
ConvertStringSDToSDRootDomainA
ConvertStringSDToSDRootDomainW
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidA
ConvertStringSidToSidW
ConvertToAutoInheritPrivateObjectSecurity
CopySid
CreateCodeAuthzLevel
CreatePrivateObjectSecurity
CreatePrivateObjectSecurityEx
CreatePrivateObjectSecurityWithMultipleInheritance
CreateProcessAsUserA
CreateProcessAsUserW
CreateProcessWithLogonW
CreateProcessWithTokenW
CreateRestrictedToken
CreateServiceA
CreateServiceW
CreateTraceInstanceId
CreateWellKnownSid
CredBackupCredentials
CredDeleteA
CredDeleteW
CredEncryptAndMarshalBinaryBlob
CredEnumerateA
CredEnumerateW
CredFindBestCredentialA
CredFindBestCredentialW
CredFree
CredGetSessionTypes
CredGetTargetInfoA
CredGetTargetInfoW
CredIsMarshaledCredentialA
CredIsMarshaledCredentialW
CredIsProtectedA
CredIsProtectedW
CredMarshalCredentialA
CredMarshalCredentialW
CredProfileLoaded
CredProfileLoadedEx
CredProfileUnloaded
CredProtectA
CredProtectW
CredReadA
CredReadByTokenHandle
CredReadDomainCredentialsA
CredReadDomainCredentialsW
CredReadW
CredRenameA
CredRenameW
CredRestoreCredentials
CredUnmarshalCredentialA
CredUnmarshalCredentialW
CredUnprotectA
CredUnprotectW
CredWriteA
CredWriteDomainCredentialsA
CredWriteDomainCredentialsW
CredWriteW
CredpConvertCredential
CredpConvertOneCredentialSize
CredpConvertTargetInfo
CredpDecodeCredential
CredpEncodeCredential
CredpEncodeSecret
CryptAcquireContextA
CryptAcquireContextW
CryptContextAddRef
CryptCreateHash
CryptDecrypt
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptDuplicateHash
CryptDuplicateKey
CryptEncrypt
CryptEnumProviderTypesA
CryptEnumProviderTypesW
CryptEnumProvidersA
CryptEnumProvidersW
CryptExportKey
CryptGenKey
CryptGenRandom
CryptGetDefaultProviderA
CryptGetDefaultProviderW
CryptGetHashParam
CryptGetKeyParam
CryptGetProvParam
CryptGetUserKey
CryptHashData
CryptHashSessionKey
CryptImportKey
CryptReleaseContext
CryptSetHashParam
CryptSetKeyParam
CryptSetProvParam
CryptSetProviderA
CryptSetProviderExA
CryptSetProviderExW
CryptSetProviderW
CryptSignHashA
CryptSignHashW
CryptVerifySignatureA
CryptVerifySignatureW
DecryptFileA
DecryptFileW
DeleteAce
DeleteService
DeregisterEventSource
DestroyPrivateObjectSecurity
DuplicateEncryptionInfoFile
DuplicateToken
DuplicateTokenEx
ElfBackupEventLogFileA
ElfBackupEventLogFileW
ElfChangeNotify
ElfClearEventLogFileA
ElfClearEventLogFileW
ElfCloseEventLog
ElfDeregisterEventSource
ElfFlushEventLog
ElfNumberOfRecords
ElfOldestRecord
ElfOpenBackupEventLogA
ElfOpenBackupEventLogW
ElfOpenEventLogA
ElfOpenEventLogW
ElfReadEventLogA
ElfReadEventLogW
ElfRegisterEventSourceA
ElfRegisterEventSourceW
ElfReportEventA
ElfReportEventAndSourceW
ElfReportEventW
EnableTrace
EnableTraceEx
EnableTraceEx2
EncryptFileA
EncryptFileW
EncryptedFileKeyInfo
EncryptionDisable
EnumDependentServicesA
EnumDependentServicesW
EnumDynamicTimeZoneInformation
EnumServiceGroupW
EnumServicesStatusA
EnumServicesStatusExA
EnumServicesStatusExW
EnumServicesStatusW
EnumerateTraceGuids
EnumerateTraceGuidsEx
EqualDomainSid
EqualPrefixSid
EqualSid
EtwLogSysConfigExtension
EventAccessControl
EventAccessQuery
EventAccessRemove
EventActivityIdControl
EventEnabled
EventProviderEnabled
EventRegister
EventSetInformation
EventUnregister
EventWrite
EventWriteEndScenario
EventWriteEx
EventWriteStartScenario
EventWriteString
EventWriteTransfer
FileEncryptionStatusA
FileEncryptionStatusW
FindFirstFreeAce
FlushEfsCache
FlushTraceA
FlushTraceW
FreeEncryptedFileKeyInfo
FreeEncryptedFileMetadata
FreeEncryptionCertificateHashList
FreeInheritedFromArray
FreeSid
GetAccessPermissionsForObjectA
GetAccessPermissionsForObjectW
GetAce
GetAclInformation
GetAuditedPermissionsFromAclA
GetAuditedPermissionsFromAclW
GetCurrentHwProfileA
GetCurrentHwProfileW
GetDynamicTimeZoneInformationEffectiveYears
GetEffectiveRightsFromAclA
GetEffectiveRightsFromAclW
GetEncryptedFileMetadata
GetEventLogInformation
GetExplicitEntriesFromAclA
GetExplicitEntriesFromAclW
GetFileSecurityA
GetFileSecurityW
GetInformationCodeAuthzLevelW
GetInformationCodeAuthzPolicyW
GetInheritanceSourceA
GetInheritanceSourceW
GetKernelObjectSecurity
GetLengthSid
GetLocalManagedApplicationData
GetLocalManagedApplications
GetManagedApplicationCategories
GetManagedApplications
GetMultipleTrusteeA
GetMultipleTrusteeOperationA
GetMultipleTrusteeOperationW
GetMultipleTrusteeW
GetNamedSecurityInfoA
GetNamedSecurityInfoExA
GetNamedSecurityInfoExW
GetNamedSecurityInfoW
GetNumberOfEventLogRecords
GetOldestEventLogRecord
GetOverlappedAccessResults
GetPrivateObjectSecurity
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorLength
GetSecurityDescriptorOwner
GetSecurityDescriptorRMControl
GetSecurityDescriptorSacl
GetSecurityInfo
GetSecurityInfoExA
GetSecurityInfoExW
GetServiceDisplayNameA
GetServiceDisplayNameW
GetServiceKeyNameA
GetServiceKeyNameW
GetSidIdentifierAuthority
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetStringConditionFromBinary
GetThreadWaitChain
GetTokenInformation
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
GetTrusteeFormA
GetTrusteeFormW
GetTrusteeNameA
GetTrusteeNameW
GetTrusteeTypeA
GetTrusteeTypeW
GetUserNameA
GetUserNameW
GetWindowsAccountDomainSid
I_QueryTagInformation
I_ScGetCurrentGroupStateW
I_ScIsSecurityProcess
I_ScPnPGetServiceName
I_ScQueryServiceConfig
I_ScRegisterPreshutdownRestart
I_ScSendPnPMessage
I_ScSendTSMessage
I_ScSetServiceBitsA
I_ScSetServiceBitsW
I_ScValidatePnPService
IdentifyCodeAuthzLevelW
ImpersonateAnonymousToken
ImpersonateLoggedOnUser
ImpersonateNamedPipeClient
ImpersonateSelf
InitializeAcl
InitializeSecurityDescriptor
InitializeSid
InitiateShutdownA
InitiateShutdownW
InitiateSystemShutdownA
InitiateSystemShutdownExA
InitiateSystemShutdownExW
InitiateSystemShutdownW
InstallApplication
IsTextUnicode
IsTokenRestricted
IsTokenUntrusted
IsValidAcl
IsValidRelativeSecurityDescriptor
IsValidSecurityDescriptor
IsValidSid
IsWellKnownSid
LockServiceDatabase
LogonUserA
LogonUserExA
LogonUserExExW
LogonUserExW
LogonUserW
LookupAccountNameA
LookupAccountNameW
LookupAccountSidA
LookupAccountSidW
LookupPrivilegeDisplayNameA
LookupPrivilegeDisplayNameW
LookupPrivilegeNameA
LookupPrivilegeNameW
LookupPrivilegeValueA
LookupPrivilegeValueW
LookupSecurityDescriptorPartsA
LookupSecurityDescriptorPartsW
LsaAddAccountRights
LsaAddPrivilegesToAccount
LsaClearAuditLog
LsaClose
LsaCreateAccount
LsaCreateSecret
LsaCreateTrustedDomain
LsaCreateTrustedDomainEx
LsaDelete
LsaDeleteTrustedDomain
LsaEnumerateAccountRights
LsaEnumerateAccounts
LsaEnumerateAccountsWithUserRight
LsaEnumeratePrivileges
LsaEnumeratePrivilegesOfAccount
LsaEnumerateTrustedDomains
LsaEnumerateTrustedDomainsEx
LsaFreeMemory
LsaGetAppliedCAPIDs
LsaGetQuotasForAccount
LsaGetRemoteUserName
LsaGetSystemAccessAccount
LsaGetUserName
LsaICLookupNames
LsaICLookupNamesWithCreds
LsaICLookupSids
LsaICLookupSidsWithCreds
LsaInvokeTrustScanner
LsaLookupNames
LsaLookupNames2
LsaLookupPrivilegeDisplayName
LsaLookupPrivilegeName
LsaLookupPrivilegeValue
LsaLookupSids
LsaLookupSids2
LsaManageSidNameMapping
LsaNtStatusToWinError
LsaOpenAccount
LsaOpenPolicy
LsaOpenPolicySce
LsaOpenSecret
LsaOpenTrustedDomain
LsaOpenTrustedDomainByName
LsaQueryCAPs
LsaQueryDomainInformationPolicy
LsaQueryForestTrustInformation
LsaQueryForestTrustInformation2
LsaQueryInfoTrustedDomain
LsaQueryInformationPolicy
LsaQuerySecret
LsaQuerySecurityObject
LsaQueryTrustedDomainInfo
LsaQueryTrustedDomainInfoByName
LsaRemoveAccountRights
LsaRemovePrivilegesFromAccount
LsaRetrievePrivateData
LsaSetCAPs
LsaSetDomainInformationPolicy
LsaSetForestTrustInformation
LsaSetForestTrustInformation2
LsaSetInformationPolicy
LsaSetInformationTrustedDomain
LsaSetQuotasForAccount
LsaSetSecret
LsaSetSecurityObject
LsaSetSystemAccessAccount
LsaSetTrustedDomainInfoByName
LsaSetTrustedDomainInformation

Sections

.text
Size: 595KB - Virtual size: 594KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/DATA PROTECTION/combase.dll
.dll windows x64

ba8646d28f2e7b54e7bcd331d13af3a6

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:29

Not After

02/12/2021, 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c
Signer

Actual PE Digest

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

06/10/2022, 18:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__dllonexit
_unlock
_lock
__C_specific_handler
_onexit
_initterm
_amsg_exit
_XcptFilter
_itoa_s
memcpy_s
??_V@YAXPEAX@Z
memset
memcpy
memcmp
_local_unwind
wcsnlen
wcsncpy_s
??_U@YAPEAX_K@Z
_wcsnicmp
wcsrchr
_vsnprintf
wcsstr
_wcslwr
_wtol
wcstok
wcschr
qsort
realloc
memmove_s
free
malloc
rand_s
wcsncmp
memmove
_wtoi
_resetstkoflw
_purecall
_wcsicmp
_vsnwprintf
__CxxFrameHandler3
swprintf_s
wcscmp

api-ms-win-core-heap-l1-2-0

HeapSize
HeapValidate
HeapAlloc
HeapFree
GetProcessHeap
HeapCreate
HeapDestroy
HeapReAlloc
HeapCompact

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

GetProcessMitigationPolicy
GetCurrentThreadId
TerminateProcess
GetCurrentThread
SetThreadStackGuarantee
SwitchToThread
OpenProcess
ProcessIdToSessionId
GetCurrentProcess
SetThreadToken
OpenThreadToken
OpenProcessToken
CreateThread
GetProcessId
GetCurrentProcessId

api-ms-win-core-registry-l1-1-0

RegGetValueA
RegDeleteKeyExA
RegCloseKey
RegOpenCurrentUser
RegOpenKeyExW
RegOpenUserClassesRoot
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyExW
RegEnumKeyExW
RegCreateKeyExA
RegSetValueExW
RegGetValueW
RegEnumValueW
RegCreateKeyExW

api-ms-win-core-synch-l1-2-0

SleepEx
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
SetWaitableTimerEx
LeaveCriticalSection
Sleep
WaitForSingleObject
ReleaseSRWLockExclusive
InitializeSRWLock
CreateWaitableTimerExW
ResetEvent
CreateEventW
DeleteCriticalSection
OpenEventW
SetEvent
WaitForMultipleObjectsEx
CreateEventA
InitOnceExecuteOnce
ReleaseSRWLockShared
AcquireSRWLockShared
WaitForSingleObjectEx
AcquireSRWLockExclusive
OpenEventA

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

rpcrt4

RpcServerUseProtseqEpW
RpcBindingVectorFree
NdrConvert2
RpcServerUseProtseqExW
RpcServerUseProtseqEpExW
RpcBindingFromStringBindingW
RpcServerUseProtseqW
RpcBindingCreateW
RpcBindingBind
SimpleTypeBufferSize
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeEncode2
RpcAsyncCompleteCall
NdrClientCall2
RpcErrorAddRecord
RpcMgmtSetComTimeout
RpcMgmtInqComTimeout
I_RpcServerSubscribeForDisconnectNotification
I_RpcServerGetAssociationID
I_RpcMgmtEnableDedicatedThreadPool
NdrCorrelationInitialize
NdrFullPointerXlatInit
SimpleTypeMemorySize
NdrFullPointerXlatFree
NdrClearOutParameters
I_RpcBCacheFree
NdrCorrelationFree
I_RpcExceptionFilter
NdrGetTypeFlags
MesEncodeFixedBufferHandleCreate
MesHandleFree
SimpleTypeAlignment
I_RpcBCacheAllocate
MesBufferHandleReset
MesDecodeBufferHandleCreate
I_RpcFixTransferSyntax
I_RpcSendReceive
RpcRaiseException
RpcErrorEndEnumeration
RpcErrorGetNextRecord
RpcErrorStartEnumeration
NdrClientInitializeNew
I_RpcReceive
I_RpcAsyncSetHandle
NdrServerInitialize
I_RpcGetBuffer
I_RpcAllocate
I_RpcFree
I_RpcGetBufferWithObject
UuidCreate
I_RpcRequestMutex
NdrStubCall2
I_RpcNegotiateTransferSyntax
I_RpcClearMutex
I_RpcMgmtQueryDedicatedThreadPool
RpcBindingFree
RpcBindingSetOption
NdrAsyncServerCall
NdrServerCall2
RpcBindingUnbind
RpcBindingCopy
NdrMesTypeDecode3
I_RpcSend
I_RpcAsyncAbortCall
RpcServerUnregisterIf
RpcServerRegisterIf3
RpcImpersonateClient2
RpcServerRegisterAuthInfoW
RpcCertGeneratePrincipalNameW
I_RpcOpenClientProcess
RpcBindingInqAuthClientW
NdrMesTypeEncode3
I_RpcSetDCOMAppId
I_RpcBindingInqCurrentModifiedId
RpcBindingInqObject
I_RpcBindingInqLocalClientPID
RpcBindingServerFromClient
RpcRevertToSelfEx
RpcImpersonateClient
RpcStringBindingParseW
RpcBindingToStringBindingW
I_RpcBindingInqTransportType
RpcServerInqCallAttributesW
I_RpcBindingSetPrivateOption
RpcBindingSetAuthInfoExW
RpcSmDestroyClientContext
NdrClientCall3
NdrStubCall3
RpcStringFreeW
RpcBindingInqAuthInfoExW
RpcCancelThreadEx
RpcMgmtSetCancelTimeout
NdrOleAllocate
NdrOleFree
NdrDllGetClassObject
RpcAsyncCancelCall
RpcServerInqBindings
RpcServerTestCancel
NdrGetUserMarshalInfo
I_RpcFreeBuffer
RpcAsyncInitializeHandle
RpcAsyncGetCallStatus

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
GetTickCount64
GetComputerNameExW
GetSystemInfo
GetSystemWindowsDirectoryW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
OutputDebugStringA
DebugBreak
IsDebuggerPresent

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
SetEventWhenCallbackReturns
WaitForThreadpoolWaitCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-fibers-l1-1-1

FlsAlloc
FlsSetValue
FlsFree
IsThreadAFiber

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetModuleHandleW
LoadLibraryExA
GetProcAddress
LoadStringW
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
CompareStringOrdinal
CompareStringW
MultiByteToWideChar

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
SearchPathW
FreeEnvironmentStringsW
GetEnvironmentStringsW

api-ms-win-security-base-l1-2-0

CreateWellKnownSid
AccessCheck
CheckTokenMembership
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeSid
GetSidLengthRequired
GetAppContainerAce
InitializeAcl
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
GetAce
MapGenericMask
GetSidSubAuthorityCount
GetKernelObjectSecurity
GetSidSubAuthority
DuplicateToken
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
MakeSelfRelativeSD
IsValidSecurityDescriptor
GetTokenInformation
RevertToSelf
ImpersonateAnonymousToken
AccessCheckByType
GetSecurityDescriptorDacl
GetLengthSid
IsValidSid
GetSecurityDescriptorLength
PrivilegeCheck
CopySid
EqualSid

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-memory-l1-1-2

UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
VirtualProtect
VirtualAlloc
VirtualQuery
MapViewOfFile

api-ms-win-core-localization-l1-2-1

FormatMessageW
LCMapStringW

api-ms-win-core-file-l1-2-1

CreateFileW

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventRegister
EventWriteEx
EventUnregister

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled
QuirkIsEnabledForProcess

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

RaiseFailFastException

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpiA
lstrcmpiW
lstrlenA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize
LocalAlloc
GlobalFree
LocalFree
GlobalUnlock
GlobalReAlloc
GlobalAlloc
GlobalLock

api-ms-win-core-privateprofile-l1-1-1

GetProfileStringW

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx
FindActCtxSectionGuid
FindActCtxSectionStringW
ActivateActCtx
AddRefActCtx
DeactivateActCtx
GetCurrentActCtx
CreateActCtxW

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

ntdll

RtlCopySid
NtQueryInformationToken
RtlLengthSid
NtQueryObject
LdrStandardizeSystemPath
RtlFreeSid
RtlDelete
RtlApplicationVerifierStop
RtlCheckForOrphanedCriticalSections
NtQueryInformationThread
RtlFreeHeap
RtlGetAppContainerNamedObjectPath
NtTerminateProcess
RtlReportException
RtlInitializeCriticalSectionAndSpinCount
NtQueryTimerResolution
RtlLoadString
RtlInitializeConditionVariable
ord1
EvtIntReportEventAndSourceAsync
RtlSplay
RtlDeleteNoSplay
RtlInitUnicodeString
NtOpenKey
RtlEqualUnicodeString
WinSqmSetDWORD
RtlInitializeCriticalSection
RtlImageNtHeader
RtlIsCriticalSectionLockedByThread
RtlDllShutdownInProgress
DbgPrint
EtwEventUnregister
RtlAllocateHeap
NtQueryValueKey
RtlQueryPackageIdentity
ZwQuerySecurityAttributesToken
RtlSidDominates
RtlGetAppContainerSidType
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwGetTraceLoggerHandle
NtQuerySystemInformation
RtlSleepConditionVariableCS
RtlDeleteCriticalSection
RtlWakeAllConditionVariable
NtQueryInformationProcess
NtApphelpCacheControl
RtlInitUnicodeStringEx
RtlValidRelativeSecurityDescriptor
NtClose
NtDuplicateObject
NtCreateKey
RtlRealPredecessor
EtwEventRegister
EtwTraceMessage
EtwEventWrite
RtlNtStatusToDosError
NtQueryKey

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

CLSIDFromOle1Class
CLSIDFromProgID
CLSIDFromString
CleanupOleStateInAllTls
CleanupTlsOleState
ClearCleanupFlag
CoAddRefServerProcess
CoAllowUnmarshalerCLSID
CoCancelCall
CoCopyProxy
CoCreateErrorInfo
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoCreateInstanceEx
CoCreateInstanceFromApp
CoCreateObjectInContext
CoDeactivateObject
CoDecodeProxy
CoDecrementMTAUsage
CoDisableCallCancellation
CoDisconnectContext
CoDisconnectObject
CoEnableCallCancellation
CoFreeUnusedLibraries
CoFreeUnusedLibrariesEx
CoGetActivationState
CoGetApartmentID
CoGetApartmentType
CoGetCallContext
CoGetCallState
CoGetCallerTID
CoGetCancelObject
CoGetClassObject
CoGetClassVersion
CoGetContextToken
CoGetCurrentLogicalThreadId
CoGetCurrentProcess
CoGetDefaultContext
CoGetErrorInfo
CoGetInstanceFromFile
CoGetInstanceFromIStorage
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoGetMarshalSizeMax
CoGetModuleType
CoGetObjectContext
CoGetPSClsid
CoGetProcessIdentifier
CoGetStandardMarshal
CoGetStdMarshalEx
CoGetSystemSecurityPermissions
CoGetTreatAsClass
CoImpersonateClient
CoIncrementMTAUsage
CoInitializeEx
CoInitializeSecurity
CoInitializeWOW
CoInvalidateRemoteMachineBindings
CoIsHandlerConnected
CoLockObjectExternal
CoMarshalHresult
CoMarshalInterThreadInterfaceInStream
CoMarshalInterface
CoPopServiceDomain
CoPushServiceDomain
CoQueryAuthenticationServices
CoQueryClientBlanket
CoQueryProxyBlanket
CoReactivateObject
CoRegisterActivationFilter
CoRegisterClassObject
CoRegisterInitializeSpy
CoRegisterMallocSpy
CoRegisterMessageFilter
CoRegisterPSClsid
CoRegisterSurrogate
CoRegisterSurrogateEx
CoReleaseMarshalData
CoReleaseServerProcess
CoResumeClassObjects
CoRetireServer
CoRevertToSelf
CoRevokeClassObject
CoRevokeInitializeSpy
CoRevokeMallocSpy
CoSetCancelObject
CoSetErrorInfo
CoSetProxyBlanket
CoSuspendClassObjects
CoSwitchCallContext
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoTestCancel
CoUninitialize
CoUnloadingWOW
CoUnmarshalHresult
CoUnmarshalInterface
CoVrfCheckThreadState
CoVrfGetThreadState
CoVrfReleaseThreadState
CoWaitForMultipleHandles
CoWaitForMultipleObjects
CreateErrorInfo
CreateStreamOnHGlobal
DcomChannelSetHResult
DllDebugObjectRPCHook
DllGetActivationFactory
DllGetClassObject
EnableHookObject
FreePropVariantArray
FreePropVariantArrayWorker
GetCatalogHelper
GetErrorInfo
GetFuncDescs
GetHGlobalFromStream
GetHookInterface
GetRestrictedErrorInfo
HSTRING_UserFree
HSTRING_UserFree64
HSTRING_UserMarshal
HSTRING_UserMarshal64
HSTRING_UserSize
HSTRING_UserSize64
HSTRING_UserUnmarshal
HSTRING_UserUnmarshal64
HkOleRegisterObject
IIDFromString
InternalAppInvokeExceptionFilter
InternalCCFreeUnused
InternalCCGetClassInformationForDde
InternalCCGetClassInformationFromKey
InternalCCSetDdeServerWindow
InternalCMLSendReceive
InternalCallAsProxyExceptionFilter
InternalCallFrameExceptionFilter
InternalCallerIsAppContainer
InternalCanMakeOutCall
InternalCoIsSurrogateProcess
InternalCoRegisterDisconnectCallback
InternalCoRegisterSurrogatedObject
InternalCoStdMarshalObject
InternalCoUnregisterDisconnectCallback
InternalCompleteObjRef
InternalCreateCAggId
InternalCreateIdentityHandler
InternalDoATClassCreate
InternalFillLocalOXIDInfo
InternalFreeObjRef
InternalGetWindowPropInterface
InternalIrotEnumRunning
InternalIrotEnumRunning2
InternalIrotGetObject
InternalIrotGetObject2
InternalIrotGetObject3
InternalIrotGetTimeOfLastChange
InternalIrotGetTimeOfLastChange2
InternalIrotIsRunning
InternalIrotIsRunning2
InternalIrotNoteChangeTime
InternalIrotRegister
InternalIrotRevoke
InternalIsApartmentInitialized
InternalIsProcessInitialized
InternalMarshalObjRef
InternalNotifyDDStartOrStop
InternalOleModalLoopBlockFn
InternalRegisterWindowPropInterface
InternalReleaseMarshalObjRef
InternalSTAInvoke
InternalServerExceptionFilter
InternalSetAptCallCtrlOnTlsIfRequired
InternalSetOleThunkWowPtr
InternalStubInvoke
InternalTlsAllocData
InternalUnmarshalObjRef
IsErrorPropagationEnabled
NdrExtStubInitialize
NdrOleDllGetClassObject
NdrOleInitializeExtension
NdrProxyForwardingFunction10
NdrProxyForwardingFunction11
NdrProxyForwardingFunction12
NdrProxyForwardingFunction13
NdrProxyForwardingFunction14
NdrProxyForwardingFunction15
NdrProxyForwardingFunction16
NdrProxyForwardingFunction17
NdrProxyForwardingFunction18
NdrProxyForwardingFunction19
NdrProxyForwardingFunction20
NdrProxyForwardingFunction21
NdrProxyForwardingFunction22
NdrProxyForwardingFunction23
NdrProxyForwardingFunction24
NdrProxyForwardingFunction25
NdrProxyForwardingFunction26
NdrProxyForwardingFunction27
NdrProxyForwardingFunction28
NdrProxyForwardingFunction29
NdrProxyForwardingFunction3
NdrProxyForwardingFunction30
NdrProxyForwardingFunction31
NdrProxyForwardingFunction32
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
NdrProxyForwardingFunction6
NdrProxyForwardingFunction7
NdrProxyForwardingFunction8
NdrProxyForwardingFunction9
NdrpFindInterface
ObjectStublessClient10
ObjectStublessClient11
ObjectStublessClient12
ObjectStublessClient13
ObjectStublessClient14
ObjectStublessClient15
ObjectStublessClient16
ObjectStublessClient17
ObjectStublessClient18
ObjectStublessClient19
ObjectStublessClient20
ObjectStublessClient21
ObjectStublessClient22
ObjectStublessClient23
ObjectStublessClient24
ObjectStublessClient25
ObjectStublessClient26
ObjectStublessClient27
ObjectStublessClient28
ObjectStublessClient29
ObjectStublessClient3
ObjectStublessClient30
ObjectStublessClient31
ObjectStublessClient32
ObjectStublessClient4
ObjectStublessClient5
ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient8
ObjectStublessClient9
ProgIDFromCLSID
PropVariantClear
PropVariantCopy
ReleaseFuncDescs
RoActivateInstance
RoCaptureErrorContext
RoClearError
RoFailFastWithErrorContext
RoFailFastWithErrorContextInternal
RoFailFastWithErrorContextInternal2
RoFreeParameterizedTypeExtra
RoGetActivatableClassRegistration
RoGetActivationFactory
RoGetAgileReference
RoGetApartmentIdentifier
RoGetErrorReportingFlags
RoGetMatchingRestrictedErrorInfo
RoGetParameterizedTypeInstanceIID
RoGetServerActivatableClasses
RoInitialize
RoInspectCapturedStackBackTrace
RoInspectThreadErrorInfo
RoOriginateError
RoOriginateErrorW
RoOriginateLanguageException
RoParameterizedTypeExtraGetTypeSignature
RoRegisterActivationFactories
RoRegisterForApartmentShutdown
RoReportCapabilityCheckFailure
RoReportFailedDelegate
RoReportUnhandledError
RoResolveRestrictedErrorInfoReference
RoRevokeActivationFactories
RoSetErrorReportingFlags
RoTransformError
RoTransformErrorW
RoUninitialize
RoUnregisterForApartmentShutdown
SetCleanupFlag
SetErrorInfo
SetRestrictedErrorInfo
StringFromCLSID
StringFromGUID2
StringFromIID
UpdateDCOMSettings
UpdateProcessTracing
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserMarshal64
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserSize64
WdtpInterfacePointer_UserUnmarshal
WdtpInterfacePointer_UserUnmarshal64
WindowsCompareStringOrdinal
WindowsConcatString
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsDeleteStringBuffer
WindowsDuplicateString
WindowsGetStringLen
WindowsGetStringRawBuffer
WindowsInspectString
WindowsIsStringEmpty
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsReplaceString
WindowsStringHasEmbeddedNull
WindowsSubstring
WindowsSubstringWithSpecifiedLength
WindowsTrimStringEnd
WindowsTrimStringStart

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ndr64
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/LCC/LCC.pimx
resources/LCC/LCC.sig
.xml
resources/Notifications/Notifications.pimx
resources/Notifications/Notifications.sig
.xml
resources/Runtime/Runtime.pima
.zip
resources/Runtime/Runtime.pimx
resources/Runtime/Runtime.sig
.xml
resources/SignInApp/SignInApp.pima
.zip
resources/SignInApp/SignInApp.pimx
resources/SignInApp/SignInApp.sig
.xml
resources/TCC/TCC.pimx
resources/TCC/TCC.sig
.xml
Film11-main/LICENSE

Sharing

General

Malware Config

Signatures

Files

ba8646d28f2e7b54e7bcd331d13af3a6

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3cSigner

Signature Validations

Verification

06/10/2022, 18:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-handle-l1-1-0

rpcrt4

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-fibers-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-privateprofile-l1-1-1

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

ntdll

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.orpc Size: 88KB - Virtual size: 87KB

.ndr64 Size: 9KB - Virtual size: 9KB

.data Size: 26KB - Virtual size: 27KB

.pdata Size: 158KB - Virtual size: 158KB

.idata Size: 17KB - Virtual size: 17KB

.didat Size: 1KB - Virtual size: 1KB

.rsrc Size: 64KB - Virtual size: 64KB

.reloc Size: 35KB - Virtual size: 34KB

Headers

DLL Characteristics

File Characteristics

Sections

text Size: 2KB - Virtual size: 2KB

rdata Size: 524B - Virtual size: 523B

data Size: 82B - Virtual size: 125B

pdata Size: 100B - Virtual size: 98B

CONST Size: 2B - Virtual size:

ext Size: 52B - Virtual size: 50B

ata Size: 130B - Virtual size: 129B

rsrc Size: 4B - Virtual size: 3B

reloc Size: 22B - Virtual size: 20B

Headers

DLL Characteristics

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c
Signer

06/10/2022, 18:34
Valid: false

.text
Size: 1.7MB - Virtual size: 1.7MB

.orpc
Size: 88KB - Virtual size: 87KB

.ndr64
Size: 9KB - Virtual size: 9KB

.data
Size: 26KB - Virtual size: 27KB

.pdata
Size: 158KB - Virtual size: 158KB

.idata
Size: 17KB - Virtual size: 17KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 64KB - Virtual size: 64KB

.reloc
Size: 35KB - Virtual size: 34KB

text
Size: 2KB - Virtual size: 2KB

rdata
Size: 524B - Virtual size: 523B

data
Size: 82B - Virtual size: 125B

pdata
Size: 100B - Virtual size: 98B

CONST
Size: 2B - Virtual size:

ext
Size: 52B - Virtual size: 50B

ata
Size: 130B - Virtual size: 129B

rsrc
Size: 4B - Virtual size: 3B

reloc
Size: 22B - Virtual size: 20B

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 3.1MB - Virtual size: 3.1MB

.data
Size: 354KB - Virtual size: 527KB

.pdata
Size: 244KB - Virtual size: 243KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 42KB - Virtual size: 41KB

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

35:71:3a:ed:36:6c:0f:91:c7:97:71:46:7d:89:eb:e2:d5:18:ad:17:62:cf:4f:58:50:46:12:28:d5:7c:7a:8d
Signer

06/10/2022, 18:34
Valid: false

.text
Size: 595KB - Virtual size: 594KB

.data
Size: 14KB - Virtual size: 16KB

.pdata
Size: 24KB - Virtual size: 24KB

.idata
Size: 24KB - Virtual size: 24KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c
Signer

06/10/2022, 18:34
Valid: false