ProcessHacker[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

ProcessHacker.exe
Size

2.6MB
MD5

69650d659c32906d1626c277e98c1ef5
SHA1

2a1265a874400e8199711e0f6bfde5094ef57c41
SHA256

9a9b51ee953125d44cb2ba4b969e51fd6f426cc5a6af7c536587ef49629a0919
SHA512

3d839803f614e9502aefc9b8110c1f8f17d381757a9d9b76bcf82c85f9e9228358c243ed8365011df7f6c886f9701f8437abff686d5e585c279e6d5df823e79e
SSDEEP

49152:+UCGfV9VdMRKuFS/OjEwGtEsOUa43RuCzHhFp:+UplKp8tEHCzH

Score

N/A

Malware Config

Signatures

Files

ProcessHacker.exe
.exe windows x64

f213fd915afdcf1ad291111e3c1a1cb0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

InitCommonControlsEx
ord345
ImageList_CoCreateInstance
ord381
PropertySheetW
CreatePropertySheetPageW

ntdll

NtFreeVirtualMemory
RtlFreeSid
RtlSubAuthorityCountSid
NtSetInformationToken
NtPowerInformation
NtTestAlert
NtQueryKey
NtOpenThreadToken
RtlTimeToSecondsSince1980
RtlSecondsSince1980ToTime
NtIsProcessInJob
NtQuerySystemInformationEx
RtlRegisterWait
RtlDeregisterWaitEx
RtlQueryDepthSList
RtlCreateSecurityDescriptor
RtlCreateAcl
RtlAddAccessAllowedAce
NtAcceptConnectPort
NtReplyWaitReceivePort
NtCompleteConnectPort
RtlSetDaclSecurityDescriptor
RtlSubAuthoritySid
NtCreatePort
RtlInitializeSid
RtlLengthRequiredSid
RtlValidRelativeSecurityDescriptor
RtlSelfRelativeToAbsoluteSD2
RtlValidSid
NtConnectPort
NtRequestWaitReplyPort
RtlAbsoluteToSelfRelativeSD
RtlLengthSid
NtCreateSection
RtlQueryElevationFlags
NtDeleteKey
NtSuspendThread
NtQueryInformationProcess
NtRemoveProcessDebug
NtSetSystemPowerState
NtReleaseSemaphore
NtSetHighEventPair
NtQueryEvent
RtlQueryPerformanceFrequency
RtlNtStatusToDosErrorNoTeb
RtlGetFullPathName_U
NtCreateDirectoryObject
RtlGUIDFromString
NtDuplicateToken
RtlRandomEx
RtlTimeToTimeFields
RtlDosPathNameToNtPathName_U_WithStatus
RtlCreateProcessReflection
RtlFreeUnicodeString
LdrUnloadDll
LdrFindResource_U
LdrLoadDll
RtlDestroyProcessParameters
NtDelayExecution
RtlFindMessage
RtlStringFromGUID
RtlQueryPerformanceCounter
RtlCreateProcessParameters
RtlCreateUserProcess
RtlGetDaclSecurityDescriptor
NtTerminateProcess
RtlExpandEnvironmentStrings_U
LdrAccessResource
RtlUnicodeToMultiByteN
RtlUpcaseUnicodeChar
NtAllocateVirtualMemory
RtlReAllocateHeap
RtlUTF8ToUnicodeN
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlCreateUserThread
RtlUnicodeToMultiByteSize
RtlUnicodeToUTF8N
RtlInterlockedPopEntrySList
RtlGetVersion
RtlCreateTimerQueue
NtUnlockFile
NtSetInformationFile
NtLockFile
NtFlushBuffersFile
NtQueryInformationFile
NtGetContextThread
LdrGetProcedureAddress
NtQueryValueKey
NtOpenProcessToken
NtOpenThread
RtlQueueApcWow64Thread
NtOpenSymbolicLinkObject
NtEnumerateKey
NtUnloadDriver
NtEnumerateValueKey
NtQueueApcThread
NtOpenKey
RtlConvertSidToUnicodeString
NtQuerySymbolicLinkObject
NtOpenProcess
NtCreateNamedPipeFile
NtQueryInformationJobObject
NtSetSecurityObject
RtlQueryEnvironmentVariable_U
NtDeleteValueKey
NtQueryAttributesFile
RtlDetermineDosPathNameType_U
NtOpenDirectoryObject
RtlGetUnloadEventTraceEx
NtFsControlFile
NtQueryDirectoryObject
NtAdjustGroupsToken
NtLoadKeyEx
NtCreateKey
NtCreateFile
NtQueryDirectoryFile
NtOpenSection
NtQuerySecurityObject
NtSetValueKey
NtOpenFile
NtQueryFullAttributesFile
NtSetInformationObject
NtDeviceIoControlFile
NtReleaseKeyedEvent
NtWaitForKeyedEvent
NtCreateKeyedEvent
NtClearEvent
NtQueryObject
NtCreateSemaphore
RtlLengthSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlGetControlSecurityDescriptor
RtlMapGenericMask
RtlGetSaclSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlValidSecurityDescriptor
RtlSetControlSecurityDescriptor
RtlSetGroupSecurityDescriptor
NtSetTimer
NtAlertThread
NtCreateTimer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
NtQuerySemaphore
NtCancelTimer
NtPulseEvent
NtSetLowEventPair
NtQueryTimer
NtResetEvent
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlFirstEntrySList
NtQueryInformationToken
RtlInterlockedFlushSList
RtlInitializeSListHead
RtlInterlockedPushEntrySList
RtlSecondsSince1970ToTime
RtlCreateHeap
RtlFreeHeap
RtlAllocateHeap
RtlDestroyHeap
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlDestroyQueryDebugBuffer
NtProtectVirtualMemory
NtSetSystemInformation
NtWriteVirtualMemory
RtlEqualSid
NtCreateMutant
RtlSetCurrentDirectory_U
RtlSetUnhandledExceptionFilter
RtlExitUserProcess
NtAdjustPrivilegesToken
NtOpenMutant
NtSystemDebugControl
NtTerminateJobObject
NtAssignProcessToJobObject
NtQueryMutant
NtQueryVolumeInformationFile
NtMapViewOfSection
NtQuerySection
NtGetNextProcess
NtQueryVirtualMemory
RtlSetHeapInformation
RtlInitializeCriticalSection
NtQueryPerformanceCounter
RtlDeleteCriticalSection
RtlLeaveCriticalSection
RtlEnterCriticalSection
NtWaitForMultipleObjects
NtSetEvent
NtCreateEvent
NtAlpcQueryInformation
NtReadVirtualMemory
NtReadFile
NtWriteFile
NtQueryInformationThread
NtQuerySystemInformation
NtSuspendProcess
NtResumeThread
NtWaitForSingleObject
NtSetInformationDebugObject
NtUnmapViewOfSection
RtlRaiseStatus
NtSetInformationProcess
NtQuerySystemEnvironmentValueEx
NtSetSystemEnvironmentValueEx
NtShutdownSystem
NtDuplicateObject
NtInitiatePowerAction
NtClose
NtSetInformationThread
NtResumeProcess
NtTerminateThread

uxtheme

OpenThemeData
GetThemePartSize
GetBufferedPaintBits
EndBufferedPaint
BeginBufferedPaint
SetWindowTheme
DrawThemeBackground
IsThemePartDefined
IsThemeActive
CloseThemeData
GetThemeInt

kernel32

GetSystemInfo
VirtualProtect
VirtualQuery
GetModuleHandleW
GetProcAddress
LoadLibraryExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
ReadFile
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleOutputCP
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapFree
RaiseException
HeapAlloc
GetFileSizeEx
SetFilePointerEx
GetFileType
FlsAlloc
InitializeProcThreadAttributeList
GetLastError
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
LocalFree
SetConsoleCtrlHandler
FreeConsole
GetConsoleWindow
AllocConsole
SetProcessShutdownParameters
FreeLibrary
TlsSetValue
TlsAlloc
TlsGetValue
GetComputerNameW
SetLastError
SearchPathW
GetTimeFormatEx
GetLocaleInfoW
GetDateFormatEx
GetNumberFormatW
CreateProcessW
LoadLibraryExW
IsProcessorFeaturePresent
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LocalAlloc
GlobalSize
HeapSize
WriteConsoleW
CreateFileW
CloseHandle
FlushFileBuffers
GetProcessHeap
GetCommandLineW
GetCommandLineA
FindNextFileW
FindFirstFileExW
FindClose
WideCharToMultiByte
SetStdHandle
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
MultiByteToWideChar
GetCPInfo
FlsGetValue
GetStringTypeW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
FlsFree
FlsSetValue
SetEndOfFile

user32

GetMenuItemInfoW
SystemParametersInfoW
GetSysColorBrush
DrawTextW
GetSysColor
FillRect
MapWindowPoints
SetWindowPos
GetWindowRect
MapDialogRect
SetFocus
EnableMenuItem
BringWindowToTop
DeleteMenu
GetSystemMenu
ReleaseDC
PostQuitMessage
KillTimer
SetCursor
LoadCursorW
TranslateMessage
IsDialogMessageW
SetTimer
DispatchMessageW
GetDC
GetMessageW
CreateDialogParamW
TranslateAcceleratorW
IsChild
LoadAcceleratorsW
PostMessageW
SendMessageTimeoutW
UpdateWindow
CreateMenu
EndDeferWindowPos
DrawMenuBar
ChangeWindowMessageFilterEx
IntersectRect
SetMenu
MoveWindow
SetMenuInfo
BeginDeferWindowPos
IsWindow
GetWindowPlacement
RegisterClassExW
CreateWindowExW
GetWindow
ShowWindowAsync
DefWindowProcW
DeferWindowPos
CallWindowProcW
DrawIconEx
TrackMouseEvent
GetMonitorInfoW
IsHungAppWindow
SetActiveWindow
MonitorFromPoint
GetForegroundWindow
GetDoubleClickTime
CreateIconIndirect
LoadImageW
GetCursor
GetGuiResources
GetFocus
OpenWindowStationW
GetProcessWindowStation
OpenDesktopW
GetUserObjectInformationW
CloseDesktop
GetThreadDesktop
GetShellWindow
SetWindowTextW
CloseWindowStation
EnumDesktopsW
GetWindowTextW
GetDCEx
ReleaseCapture
PtInRect
SetCapture
FrameRect
GetCapture
GetAsyncKeyState
GetWindowTextLengthW
SetWindowPlacement
MonitorFromWindow
GetGUIThreadInfo
LoadMenuIndirectW
PeekMessageW
MsgWaitForMultipleObjects
MonitorFromRect
EndPaint
BeginPaint
DrawFrameControl
DrawEdge
GetScrollBarInfo
GetWindowDC
GetIconInfo
FindWindowExW
CreateDialogIndirectParamW
GetDesktopWindow
LookupIconIdFromDirectoryEx
SetClipboardData
EnumWindows
InternalGetWindowText
EmptyClipboard
CloseClipboard
GetWindowInfo
OpenClipboard
GetActiveWindow
CopyIcon
EnumChildWindows
GetPropW
CreateIconFromResourceEx
DestroyMenu
TrackPopupMenu
CreatePopupMenu
InsertMenuItemW
SetScrollPos
ShowCaret
EnableScrollBar
DestroyCaret
DragDetect
GetClipboardData
CreateCaret
SetCaretPos
GetScrollInfo
RegisterClipboardFormatW
SetScrollInfo
SetCursorPos
ScrollWindowEx
GetUpdateRect
GetMessageTime
DrawFocusRect
InvalidateRgn
WaitMessage
GetMessagePos
GetUpdateRgn
GetMenu
GetMenuItemCount
SetWindowLongPtrW
ScreenToClient
GetWindowLongPtrW
GetSubMenu
RedrawWindow
DestroyIcon
ClientToScreen
SetLayeredWindowAttributes
GetClientRect
InvalidateRect
GetCursorPos
GetWindowThreadProcessId
GetClassNameW
EndDialog
IsWindowEnabled
GetParent
DialogBoxParamW
EnableWindow
AllowSetForegroundWindow
IsWindowVisible
ExitWindowsEx
LockWorkStation
DestroyWindow
SendMessageW
ShowWindow
GetDlgItem
SetForegroundWindow
IsIconic
GetKeyState
GetSystemMetrics
FindWindowW

gdi32

CreateFontIndirectW
CreateSolidBrush
DeleteObject
SetBkMode
SetTextColor
DeleteDC
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
GetObjectW
GetTextExtentPoint32W
SetBkColor
CreateFontW
GetTextColor
GetCharWidthW
SetDCPenColor
SetDCBrushColor
Polyline
GetStockObject
CreateDIBSection
ExcludeClipRect
PatBlt
CombineRgn
CreateRectRgn
GdiAlphaBlend
RectVisible
GetDeviceCaps
GetDIBits
Rectangle
TextOutW
SetBoundsRect
IntersectClipRect
RestoreDC
SaveDC
GetClipRgn
GetTextMetricsW
SelectClipRgn

advapi32

StartServiceW
LsaSetSecurityObject
GetEffectiveRightsFromAclW
SetSecurityInfo
BuildTrusteeWithSidW
GetSecurityInfo
GetInheritanceSourceW
LsaLookupSids
LsaFreeMemory
LsaLookupPrivilegeValue
LsaLookupPrivilegeDisplayName
LsaLookupNames2
LsaOpenPolicy
LsaLookupPrivilegeName
EnumServicesStatusExW
QueryServiceConfigW
SetServiceObjectSecurity
CreateProcessWithLogonW
LogonUserW
CreateProcessAsUserW
NotifyServiceStatusChangeW
QueryServiceConfig2W
OpenServiceW
RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW
QueryServiceStatusEx
CreateServiceW
ChangeServiceConfig2W
ChangeServiceConfigW
LsaAddAccountRights
LsaClose
OpenSCManagerW
InitiateShutdownW
CloseServiceHandle
DeleteService
ControlService
LsaQuerySecurityObject

ole32

CoInitializeEx
CoTaskMemFree
CoUninitialize

Exports

Exports

PhAddComboBoxStrings
PhAddElementAvlTree
PhAddEntryHashtable
PhAddEntryHashtableEx
PhAddItemArray
PhAddItemList
PhAddItemPointerList
PhAddItemSimpleHashtable
PhAddItemsArray
PhAddItemsList
PhAddJsonArrayObject
PhAddJsonObject
PhAddJsonObject2
PhAddJsonObjectInt64
PhAddJsonObjectUInt64
PhAddJsonObjectValue
PhAddLayoutItem
PhAddLayoutItemEx
PhAddListViewColumn
PhAddListViewGroup
PhAddListViewGroupItem
PhAddListViewItem
PhAddProcessPropPage
PhAddProcessPropPage2
PhAddPropPageLayoutItem
PhAddSetting
PhAddSettings
PhAddTabControlTab
PhAddTreeNewFilter
PhAdjustRectangleToBounds
PhAdjustRectangleToWorkingArea
PhAllocate
PhAllocateExSafe
PhAllocateFromFreeList
PhAllocatePage
PhAllocateSafe
PhAppResolverGetAppIdForWindow
PhAppendBytesBuilder
PhAppendBytesBuilder2
PhAppendBytesBuilderEx
PhAppendCharStringBuilder
PhAppendCharStringBuilder2
PhAppendFormatStringBuilder
PhAppendFormatStringBuilder_V
PhAppendStringBuilder
PhAppendStringBuilder2
PhAppendStringBuilderEx
PhApplicationFont
PhApplyTreeNewFilters
PhApplyTreeNewFiltersToNode
PhAutoDereferenceObject
PhBoostProvider
PhBufferToHexString
PhBufferToHexStringEx
PhCenterRectangle
PhCenterWindow
PhClearArray
PhClearCacheDirectory
PhClearCircularBuffer_FLOAT
PhClearCircularBuffer_PVOID
PhClearCircularBuffer_ULONG
PhClearCircularBuffer_ULONG64
PhClearHashtable
PhClearIgnoredSettings
PhClearList
PhCmLoadSettings
PhCmSaveSettings
PhCompareStringRef
PhCompareStringZNatural
PhCompareUnicodeStringZIgnoreMenuPrefix
PhConcatStringRef2
PhConcatStringRef3
PhConcatStrings
PhConcatStrings2
PhConcatStrings_V
PhConnectPipe
PhConvertIgnoredSettings
PhConvertMultiByteToUtf16
PhConvertMultiByteToUtf16Ex
PhConvertUtf16ToAsciiEx
PhConvertUtf16ToMultiByte
PhConvertUtf16ToMultiByteEx
PhConvertUtf16ToUtf8
PhConvertUtf16ToUtf8Buffer
PhConvertUtf16ToUtf8Ex
PhConvertUtf16ToUtf8Size
PhConvertUtf8ToUtf16
PhConvertUtf8ToUtf16Buffer
PhConvertUtf8ToUtf16Ex
PhConvertUtf8ToUtf16Size
PhCopyBytesZ
PhCopyCircularBuffer_FLOAT
PhCopyCircularBuffer_PVOID
PhCopyCircularBuffer_ULONG
PhCopyCircularBuffer_ULONG64
PhCopyListView
PhCopyListViewInfoTip
PhCopyStringZ
PhCopyStringZFromBytes
PhCopyStringZFromMultiByte
PhCountStringZ
PhCreateAlloc
PhCreateBytes
PhCreateBytesEx
PhCreateCacheFile
PhCreateDialog
PhCreateDirectory
PhCreateEMenu
PhCreateEMenuItem
PhCreateFile
PhCreateFileStream
PhCreateFileStream2
PhCreateFileWin32
PhCreateFileWin32Ex
PhCreateHashtable
PhCreateJsonArray
PhCreateJsonObject
PhCreateJsonParser
PhCreateJsonParserEx
PhCreateKey
PhCreateList
PhCreateNamedPipe
PhCreateObject
PhCreateObjectType
PhCreateObjectTypeEx
PhCreateOpenFileDialog
PhCreatePipe
PhCreatePointerList
PhCreateProcess
PhCreateProcessAsUser
PhCreateProcessPropContext
PhCreateProcessPropPageContext
PhCreateProcessPropPageContextEx
PhCreateProcessWin32
PhCreateProcessWin32Ex
PhCreateSaveFileDialog
PhCreateSearchControl
PhCreateSecurityPage
PhCreateServiceListControl
PhCreateSimpleHashtable
PhCreateString
PhCreateStringEx
PhCreateSymbolProvider
PhCreateThread
PhCreateThread2
PhCreateThreadEx
PhCreateXmlNode
PhCreateXmlOpaqueNode
PhDecodeUnicodeDecoder
PhDelayExecution
PhDeleteArray
PhDeleteAutoPool
PhDeleteBytesBuilder
PhDeleteCacheFile
PhDeleteCallback
PhDeleteCircularBuffer_FLOAT
PhDeleteCircularBuffer_PVOID
PhDeleteCircularBuffer_ULONG
PhDeleteCircularBuffer_ULONG64
PhDeleteDirectory
PhDeleteFastLock
PhDeleteFileWin32
PhDeleteFreeList
PhDeleteGraphState
PhDeleteImageVersionInfo
PhDeleteLayoutManager
PhDeleteMemoryItemList
PhDeleteProviderThread
PhDeleteStringBuilder
PhDeleteTreeNewColumnMenu
PhDeleteTreeNewFilterSupport
PhDeleteValueKey
PhDeleteWorkQueue
PhDereferenceObject
PhDereferenceObjectDeferDelete
PhDereferenceObjectEx
PhDereferenceObjects
PhDereferenceProcessRecord
PhDeselectAllProcessNodes
PhDeselectAllServiceNodes
PhDestroyEMenu
PhDestroyEMenuItem
PhDetermineDosPathNameType
PhDisconnectNamedPipe
PhDivideSinglesBySingle
PhDnsFree
PhDnsQuery
PhDnsQuery2
PhDoPropPageLayout
PhDoesFileExists
PhDoesFileExistsWin32
PhDosErrorToNtStatus
PhDrainAutoPool
PhDrawGraphDirect
PhDrawTrayIconText
PhDuplicateBytesZ
PhDuplicateBytesZSafe
PhDuplicateProcessNodeList
PhDuplicateStringZ
PhEditSecurity
PhEllipsisString
PhEllipsisStringPath
PhEncodeUnicode
PhEnumAvlTree
PhEnumChildWindows
PhEnumDirectoryFile
PhEnumDirectoryObjects
PhEnumFileStreams
PhEnumGenericModules
PhEnumHandles
PhEnumHandlesEx
PhEnumHandlesEx2
PhEnumHashtable
PhEnumKernelModules
PhEnumObjectTypes
PhEnumPagefiles
PhEnumPointerListEx
PhEnumProcessEnvironmentVariables
PhEnumProcessItems
PhEnumProcessModules
PhEnumProcessModules32
PhEnumProcessModules32Ex
PhEnumProcessModulesEx
PhEnumProcesses
PhEnumProcessesEx
PhEnumProcessesForSession
PhEnumServices
PhEnumWindows
PhEnumerateKey
PhEnumeratePlugins
PhEnumerateValueKey
PhEqualStringRef
PhEscapeCommandLinePart
PhEscapeStringForMenuPrefix
PhExecuteRunAsCommand2
PhExecuteRunAsCommand3
PhExpandAllProcessNodes
PhExpandEnvironmentStrings
PhExponentiate
PhExponentiate64
PhExtractIcon
PhExtractIconEx
PhFillMemoryUlong
PhFinalArrayItems
PhFinalBytesBuilderBytes
PhFinalHash
PhFinalStringBuilderString
PhFindCharInStringRef
PhFindEMenuItem
PhFindElementAvlTree
PhFindEntryHashtable
PhFindIntegerSiKeyValuePairs
PhFindItemList
PhFindItemPointerList
PhFindItemSimpleHashtable
PhFindLastCharInStringRef
PhFindListViewItemByFlags
PhFindListViewItemByParam
PhFindLoaderEntry
PhFindNetworkNode
PhFindPlugin
PhFindProcessInformation
PhFindProcessInformationByImageName
PhFindProcessNode
PhFindProcessRecord
PhFindServiceNode
PhFindStringInStringRef
PhFindStringSiKeyValuePairs
PhFindXmlObject
PhFlushFileStream
PhFormat
PhFormatBytes
PhFormatBytes_V
PhFormatDate
PhFormatDateTime
PhFormatDecimal
PhFormatGuid
PhFormatImageVersionInfo
PhFormatLogEntry
PhFormatNativeKeyName
PhFormatSize
PhFormatString
PhFormatString_V
PhFormatTime
PhFormatTimeSpan
PhFormatTimeSpanRelative
PhFormatToBuffer
PhFormatUInt64
PhFree
PhFreeFileDialog
PhFreeJsonObject
PhFreeLibraryAsImageResource
PhFreePage
PhFreeToFreeList
PhFreeXmlObject
PhGenerateGuid
PhGenerateGuidFromName
PhGenerateRandomAlphaString
PhGetAccessEntries
PhGetAccessString
PhGetApplicationDirectory
PhGetApplicationFileName
PhGetApplicationIcon
PhGetBaseDirectory
PhGetBaseName
PhGetClassObject
PhGetClientIdName
PhGetClientIdNameEx
PhGetComboBoxString
PhGetDialogItemValue
PhGetDllFileName
PhGetDllHandle
PhGetDrawInfoGraphBuffers
PhGetEnabledProvider
PhGetEtwPublisherName
PhGetFileDialogFileName
PhGetFileDialogFilterIndex
PhGetFileDialogOptions
PhGetFileName
PhGetFilePosition
PhGetFileShellIcon
PhGetFileSize
PhGetFileVersionFixedInfo
PhGetFileVersionInfo
PhGetFileVersionInfoLangCodePage
PhGetFileVersionInfoString
PhGetFileVersionInfoString2
PhGetFilterSupportNetworkTreeList
PhGetFilterSupportProcessTreeList
PhGetFilterSupportServiceTreeList
PhGetFullPath
PhGetGeneralCallback
PhGetGenericTreeNewLines
PhGetGlobalTimerQueue
PhGetGlobalWorkQueue
PhGetHandleInformation
PhGetHandleInformationEx
PhGetImageListIcon
PhGetIntegerPairSetting
PhGetIntegerSetting
PhGetJobProcessIdList
PhGetJsonArrayIndexObject
PhGetJsonArrayLength
PhGetJsonArrayLong64
PhGetJsonArrayString
PhGetJsonObject
PhGetJsonObjectAsArrayList
PhGetJsonObjectBool
PhGetJsonObjectLength
PhGetJsonObjectType
PhGetJsonValueAsInt64
PhGetJsonValueAsString
PhGetJsonValueAsUInt64
PhGetKernelFileName
PhGetKnownLocation
PhGetLineFromAddress
PhGetListBoxString
PhGetListViewContextMenuPoint
PhGetListViewItemImageIndex
PhGetListViewItemParam
PhGetListViewItemText
PhGetMainWindowHandle
PhGetMappedImageCfg
PhGetMappedImageCfgEntry
PhGetMappedImageExportFunction
PhGetMappedImageExports
PhGetMappedImageLoadConfig32
PhGetMappedImageLoadConfig64
PhGetMessage
PhGetModuleFromAddress
PhGetModuleProcAddress
PhGetNamedPipeClientComputerName
PhGetNamedPipeClientProcessId
PhGetNamedPipeServerProcessId
PhGetNtMessage
PhGetObjectSecurity
PhGetObjectType
PhGetObjectTypeInformation
PhGetOwnTokenAttributes
PhGetPhVersion
PhGetPhVersionHash
PhGetPhVersionNumbers
PhGetPluginCallback
PhGetPluginFileName
PhGetPluginInformation
PhGetPluginName
PhGetPositionFileStream
PhGetPrimeNumber
PhGetProcedureAddress
PhGetProcedureAddressRemote
PhGetProcessCommandLine
PhGetProcessDepStatus
PhGetProcessDeviceMap
PhGetProcessEnvironment
PhGetProcessImageFileName
PhGetProcessImageFileNameByProcessId
PhGetProcessImageFileNameWin32
PhGetProcessIsDotNet
PhGetProcessIsDotNetEx
PhGetProcessIsSuspended
PhGetProcessKnownType
PhGetProcessKnownTypeEx
PhGetProcessMappedFileName
PhGetProcessPackageFullName
PhGetProcessPebString
PhGetProcessPriorityClassString
PhGetProcessSmallImageList
PhGetProcessUnloadedDlls
PhGetProcessWindowTitle
PhGetProcessWorkingSetInformation
PhGetProcessWsCounters
PhGetProtocolTypeName
PhGetScalableIntegerPairSetting
PhGetSeObjectSecurity
PhGetSelectedListViewItemParam
PhGetSelectedListViewItemParams
PhGetSelectedProcessItem
PhGetSelectedProcessItems
PhGetSelectedServiceItem
PhGetSelectedServiceItems
PhGetServiceChange
PhGetServiceConfig
PhGetServiceDelayedAutoStart
PhGetServiceDescription
PhGetServiceDllParameter
PhGetServiceErrorControlInteger
PhGetServiceErrorControlString
PhGetServiceNameFromTag
PhGetServiceStartTypeInteger
PhGetServiceStartTypeString
PhGetServiceStateString
PhGetServiceTypeInteger
PhGetServiceTypeString
PhGetSidFullName
PhGetStatisticsTime
PhGetStatisticsTimeString
PhGetStatusMessage
PhGetStockApplicationIcon
PhGetStringSetting
PhGetSymbolFromAddress
PhGetSymbolFromName
PhGetSystemDirectory
PhGetSystemRoot
PhGetTcpStateName
PhGetThreadServiceTag
PhGetTokenGroups
PhGetTokenIntegrityLevel
PhGetTokenIntegrityLevelRID
PhGetTokenOwner
PhGetTokenPrimaryGroup
PhGetTokenPrivileges
PhGetTokenUser
PhGetTreeNewText
PhGetWin32Message
PhGetWindowContext
PhGetWindowText
PhGetWindowTextEx
PhGetWindowsVersion
PhGetXmlInterface
PhGetXmlNodeAttributeByIndex
PhGetXmlNodeAttributeCount
PhGetXmlNodeAttributeText
PhGetXmlNodeElementText
PhGetXmlNodeFirstChild
PhGetXmlNodeNextChild
PhGetXmlNodeOpaqueText
PhGetXmlObject
PhGlobalDpi
PhGraphStateGetDrawInfo
PhHandleCopyCellEMenuItem
PhHandleCopyListViewEMenuItem
PhHandleListViewNotifyBehaviors
PhHandleListViewNotifyForCopy
PhHandleTreeNewColumnMenu
PhHashBytes
PhHashStringRef
PhHashStringRefEx
PhHexStringToBuffer
PhHexStringToBufferEx
PhHttpDnsQuery
PhHttpSocketAddRequestHeaders
PhHttpSocketBeginRequest
PhHttpSocketClose
PhHttpSocketConnect
PhHttpSocketCreate
PhHttpSocketDestroy
PhHttpSocketDownloadString
PhHttpSocketEndRequest
PhHttpSocketGetErrorMessage
PhHttpSocketParseUrl
PhHttpSocketQueryHeaderString
PhHttpSocketQueryHeaderUlong
PhHttpSocketQueryHeaders
PhHttpSocketQueryOptionString
PhHttpSocketReadData
PhHttpSocketReadDataToBuffer
PhHttpSocketSendRequest
PhHttpSocketSetCredentials
PhHttpSocketSetFeature
PhHttpSocketSetSecurity

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 594KB - Virtual size: 593KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f213fd915afdcf1ad291111e3c1a1cb0

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

ntdll

uxtheme

kernel32

user32

gdi32

advapi32

ole32

Exports

Exports

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 594KB - Virtual size: 593KB

.data Size: 35KB - Virtual size: 63KB

.pdata Size: 64KB - Virtual size: 64KB

.didat Size: 512B - Virtual size: 448B

_RDATA Size: 512B - Virtual size: 512B

.rsrc Size: 189KB - Virtual size: 189KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 594KB - Virtual size: 593KB

.data
Size: 35KB - Virtual size: 63KB

.pdata
Size: 64KB - Virtual size: 64KB

.didat
Size: 512B - Virtual size: 448B

_RDATA
Size: 512B - Virtual size: 512B

.rsrc
Size: 189KB - Virtual size: 189KB

.reloc
Size: 7KB - Virtual size: 6KB