DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RFX_CreateGFXService
RFX_CreatePluginFactory
General
-
Target
ValoPy v1.0 - Valorant Checker.rar
-
Size
13.0MB
-
MD5
555cf28826ecb75a0b6e06e873c3e099
-
SHA1
c1fa1e1e9c49ece09cb9cd38c7734f21fba88141
-
SHA256
3a5d6106f849f976636d37ef50554df0de4d74a69e73557383aa4f31d7d14819
-
SHA512
fe60deb01bcb3e4221f434f3c441c09e0361ab6d53fa01e2e6d19c91e5f119659c53a524459f9341435b8b0c315eb94e0fedad343c1e116d7641e87c1d3a7c55
-
SSDEEP
393216:ea4+EnkbzeTd4WaXWsgNXiqcUJilqEd1J5:ea4I+6WvSdIidd1J5
Score
3/10
Malware Config
Signatures
-
Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/ValoPy v1.0 - Valorant Checker/utils/mfc100cht.exe pyinstaller
Files
-
ValoPy v1.0 - Valorant Checker.rar.rar
-
ValoPy v1.0 - Valorant Checker/ValoPy v1.0.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 214KB - Virtual size: 213KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
ValoPy v1.0 - Valorant Checker/comm.jar.zip .js
-
ValoPy v1.0 - Valorant Checker/config.json
-
ValoPy v1.0 - Valorant Checker/rdpcorets.dll.dll regsvr32 windows x64
a18681cf7fc4526bce25b48ecb511ef1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcrt
fclose
_wcsnicmp
floorf
log
wcsncmp
swprintf_s
wprintf
vswprintf_s
wcscpy_s
_CxxThrowException
_vsnwprintf
isalpha
swscanf
_amsg_exit
_aligned_free
_wcsicmp
fwrite
fprintf
malloc
free
wcscat_s
wcsnlen
_callnewh
_purecall
printf
ceilf
_wfopen
_strnicmp
calloc
?terminate@@YAXXZ
memcmp
memcpy
_lock
_XcptFilter
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
??0exception@@QEAA@XZ
strncpy_s
strnlen
sprintf_s
qsort
??1type_info@@UEAA@XZ
_initterm
__CxxFrameHandler3
wcschr
wcsncpy_s
memcpy_s
wcsrchr
memmove_s
_stricmp
_unlock
__dllonexit
memmove
memset
_wtoi
__C_specific_handler
_onexit
sqrt
_wfopen_s
_errno
pow
sqrtf
vsprintf_s
realloc
_aligned_malloc
wcscmp
oleaut32
UnRegisterTypeLi
LoadTypeLi
SysStringLen
SysFreeString
RegisterTypeLi
VarUI4FromStr
VariantCopy
VariantClear
SysAllocStringByteLen
VariantInit
SysAllocString
SysStringByteLen
api-ms-win-core-synch-l1-1-0
CreateEventW
EnterCriticalSection
SetEvent
WaitForMultipleObjectsEx
ReleaseSemaphore
InitializeSRWLock
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
ReleaseMutex
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
ResetEvent
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
api-ms-win-core-errorhandling-l1-1-0
SetErrorMode
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException
api-ms-win-core-processthreads-l1-1-0
SuspendThread
GetExitCodeThread
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
ResumeThread
GetCurrentProcess
api-ms-win-core-synch-l1-2-0
SleepConditionVariableCS
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
InitializeConditionVariable
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadResource
GetModuleHandleExW
GetModuleHandleExA
DisableThreadLibraryCalls
FindResourceExW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA
GetModuleFileNameW
SizeofResource
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegCreateKeyExW
RegEnumKeyExW
RegFlushKey
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegGetValueW
RegNotifyChangeKeyValue
RegCloseKey
RegQueryValueExW
api-ms-win-core-com-l1-1-0
CLSIDFromString
PropVariantClear
CoCreateGuid
CoCreateInstance
CoTaskMemRealloc
StringFromGUID2
IIDFromString
PropVariantCopy
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
api-ms-win-core-kernel32-legacy-l1-1-1
VerifyVersionInfoW
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW
api-ms-win-service-management-l1-1-0
StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventWrite
EventUnregister
EventRegister
EventActivityIdControl
ws2_32
closesocket
iphlpapi
GetAdapterIndex
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-file-l1-1-0
FindClose
GetFileAttributesW
FindNextFileW
FindFirstFileW
ReadFile
CreateDirectoryW
WriteFile
SetFilePointerEx
ReadFileEx
DeleteFileW
WriteFileEx
GetTempFileNameW
GetFileInformationByHandle
CreateFileW
api-ms-win-core-kernel32-legacy-l1-1-0
RegisterWaitForSingleObject
WTSGetActiveConsoleSessionId
MoveFileW
BindIoCompletionCallback
ntdll
RtlNtStatusToDosError
RtlInitializeGenericTable
RtlEnumerateGenericTable
RtlDeleteElementGenericTable
WinSqmAddToStream
WinSqmSetDWORD
WinSqmEndSession
WinSqmStartSession
WinSqmIsOptedIn
RtlIpv4StringToAddressW
RtlInitUnicodeString
NtCreateFile
RtlLookupElementGenericTable
RtlInsertElementGenericTable
NtQuerySystemInformation
RtlIpv6StringToAddressW
api-ms-win-core-io-l1-1-0
GetOverlappedResult
CancelIoEx
DeviceIoControl
api-ms-win-core-threadpool-legacy-l1-1-0
ChangeTimerQueueTimer
DeleteTimerQueueTimer
UnregisterWaitEx
CreateTimerQueueTimer
api-ms-win-core-heap-l2-1-0
LocalFree
GlobalFree
LocalAlloc
GlobalAlloc
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-security-trustee-l1-1-0
BuildTrusteeWithSidW
BuildSecurityDescriptorW
api-ms-win-security-base-l1-1-0
AllocateAndInitializeSid
EqualSid
CreateWellKnownSid
FreeSid
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
AccessCheckAndAuditAlarmW
InitializeSecurityDescriptor
MakeSelfRelativeSD
ImpersonateLoggedOnUser
RevertToSelf
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetCPInfo
IsDBCSLeadByte
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCompareMemory
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemTime
GetTickCount64
api-ms-win-security-isolatedcontainer-l1-1-1
IsProcessInWDAGContainer
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
crypt32
CryptProtectMemory
CryptUnprotectMemory
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-stringansi-l1-1-0
CharNextA
CharPrevA
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
pdh
PdhCollectQueryData
PdhAddCounterW
PdhOpenQueryW
PdhCloseQuery
PdhGetRawCounterValue
user32
UnionRect
LoadCursorW
DispatchMessageW
GetWindowThreadProcessId
GetMessageW
UnregisterDeviceNotification
IsClipboardFormatAvailable
UnregisterClassW
RegisterDeviceNotificationW
UnregisterClassA
CreateWindowExW
RegisterClassW
CopyRect
SetRect
GetClipboardFormatNameW
PostMessageW
SetWindowLongPtrW
RegisterClipboardFormatW
SendMessageW
GetWindowLongPtrW
DefWindowProcW
DestroyWindow
regapi
RegWinstationQuerySecurityConfig_Merged
rfxvmt
RfxVmtCloseChannel
RfxVmtWriteChannel
RfxVmtReadChannel
RfxVmtCreateChannel
RfxVmtGetDataAvailableEvent
rdpbase
RDPBASE_CreateInstance
?RdpPerfLoggerStaticTerminate@@YAXXZ
RDPServerStackDiagnostics_Unregister
?RdpPerfLoggerStaticInitialize@@YAXXZ
RDPServerStackDiagnostics_Register
RdpX_Threading_CreateCriticalSection
PAL_System_Sleep
RdpX_AtomicDecrement32
RdpX_AtomicIncrement32
PAL_System_AtomicCompareAndExchangePointer
RDPServerStackDiagnostics_LogDisconnect
RDPServerStackDiagnostics_LogFailure
RDPServerStackDiagnostics_LogCheckpoint
RDPWSStreamConnector_CreateInstance
PAL_System_CritSecInit
RDPENCORE_AddGlobalObject
PAL_System_SwitchToThread
RDPAPI_GetGlobalObject
PAL_System_AtomicCompareAndExchange
TSCreateCoreEvents
RDPENCHLPREG_ReadValueDWORD
PAL_System_CritSecLeave
PAL_System_CritSecEnter
PAL_System_AtomicIncrement
PAL_System_AtomicDecrement
PAL_System_CritSecTerminate
TSAlloc
TSFree
PAL_System_CritSecIsLockedByCurrentThread
TRC_TraceBufferW
MemCopyAligned_SSE
MemMoveReverseAligned_SSE
GetSupportedSSELevel_SSE
PAL_System_GetNumberOfProcessors
?NSRunLengthDecode@@YAKPEBEKPEAEK@Z
PAL_System_MemFree
RdpX_GetActivityIdPrefix
RgnlibBA_CreateInstance
RDPAPI_GetGenericCounter
CRDPCaps_CreateInstance
PAL_System_CritSecTryEnter
RDPAPI_GetLongCounter
PAL_System_ThreadGetId
PAL_System_MemAlloc
rdpserverbase
?GetGfxPipeSettingBOOL@@YAJPEAGHPEAH@Z
?LogRDPGraphicsFirstNonBlackFramePostLogon@RDPGraphicsTraceLogging@@YAXI@Z
RDPSERVERBASE_CreateInstance
?LogRDPGraphicsFirstNonBlackFrame@RDPGraphicsTraceLogging@@YAX_K@Z
?LogRDPGraphicsError@RDPGraphicsTraceLogging@@YAXU_GUID@@IIJ@Z
?LogRDPGraphicsSubsampleFailure@RDPGraphicsTraceLogging@@YAXJI@Z
?GetGraphicsSourceContext@RdpSurface@@QEAAJPEAPEAUIRdpGFXSourceUpdateContext@@@Z
RDPEncryptionTraceLogging_Register
?RDPGraphicsTraceLogging_Unregister@RDPGraphicsTraceLogging@@YAXXZ
RDPEncryptionTraceLogging_Unregister
?LogRDPGraphicsVOBRHint@RDPGraphicsTraceLogging@@YAXI_KII@Z
?LogRDPGraphicsSubsampleAdapter@RDPGraphicsTraceLogging@@YAXPEBGII@Z
?GetEncodingPixelMap@RdpSurface@@QEAAJPEAPEAVPixelMap@@@Z
?RDPGraphicsTraceLogging_Register@RDPGraphicsTraceLogging@@YAJXZ
?GetGfxPipeSettingUINT@@YAJPEAGIPEAI@Z
api-ms-win-security-provider-l1-1-0
GetSecurityInfo
SetEntriesInAclW
rpcrt4
RpcBindingSetOption
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingSetAuthInfoExW
UuidCreate
I_RpcExceptionFilter
UuidToStringW
NdrClientCall3
api-ms-win-core-namedpipe-l1-1-0
CreateNamedPipeW
ConnectNamedPipe
WaitNamedPipeW
PeekNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState
api-ms-win-core-shlwapi-legacy-l1-1-0
PathUnquoteSpacesW
PathGetDriveNumberW
PathQuoteSpacesW
PathSkipRootW
PathIsUNCW
PathFindExtensionW
api-ms-win-core-url-l1-1-0
UrlIsW
userenv
ExpandEnvironmentStringsForUserW
api-ms-win-core-perfcounters-l1-1-0
PerfDeleteInstance
PerfIncrementULongCounterValue
PerfSetCounterSetInfo
PerfCreateInstance
PerfStartProviderEx
PerfStopProvider
PerfSetULongCounterValue
api-ms-win-eventing-controller-l1-1-0
EnableTraceEx2
ControlTraceW
StartTraceW
api-ms-win-core-comm-l1-1-0
SetCommTimeouts
api-ms-win-core-io-l1-1-1
CancelIo
api-ms-win-core-memory-l1-1-0
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
gdi32
GetObjectW
DeleteObject
CreatePalette
GetMetaFileBitsEx
GetStockObject
GetPaletteEntries
SetMetaFileBitsEx
CreateMetaFileW
PlayMetaFile
CloseMetaFile
DeleteMetaFile
d3d11
D3D11CreateDevice
tlscsp
ord1
ord3
ord4
ord7
ord2
api-ms-win-core-heap-obsolete-l1-1-0
GlobalUnlock
GlobalSize
GlobalLock
api-ms-win-core-psapi-l1-1-0
K32GetModuleFileNameExW
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateStringReference
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-path-l1-1-0
PathCchCanonicalize
Exports
Exports
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
ValoPy v1.0 - Valorant Checker/utils/Ionic.Zip.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 478KB - Virtual size: 477KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
ValoPy v1.0 - Valorant Checker/utils/LICENCE.dat.zip
-
ValoPy v1.0 - Valorant Checker/utils/Launcher.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
ValoPy v1.0 - Valorant Checker/utils/config.json
-
ValoPy v1.0 - Valorant Checker/utils/mfc100cht.exe.exe windows x64
d170e2e5adcfc4c271f2eb78a565305e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
GetStartupInfoW
FreeLibrary
LoadLibraryExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
CreateProcessW
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RaiseException
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Sections
.text Size: 141KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ