Macrium_Reflect_Technician_8[.]0[.]6979_Portable_(x64)[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

Macrium_Reflect_Technician_8.0.6979_Portable_(x64).rar
Size

28.2MB
MD5

6568596bd57591d3891bb7c5f5f480e6
SHA1

d31db1c05d3ff21f1d410fafe355e866ca948331
SHA256

aca0ac1296bf4283683056ae670f33259759ba8428c226f0442f4f3719e22032
SHA512

7a7d0d2c9eeedef8d9588ac8ce99d1b90c4158a0838617e993a17e15a91adf856478b2cfa88acf4c7121d69fef7d3332a99e56d5cf4341676d081c87df8b1387
SSDEEP

786432:rD0uhKoejzY2P6f8y/y4goMghxcQsG2SEbQHw4Y2:r9h9ejzvP6f8y/ypoMWGQs9s

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/Macrium Reflect Technician 8.0.6979 Portable (x64)/Macrium Reflect.exe	autoit_exe

Files

Macrium_Reflect_Technician_8.0.6979_Portable_(x64).rar
.rar
Macrium Reflect Technician 8.0.6979 Portable (x64)/App/Win64/AESDll.dll
.dll windows x64

aea6784da3a3efd89019fc4b90a8c711

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31/12/2021, 14:10

Not After

10/02/2025, 13:32

Subject

SERIALNUMBER=02973414,CN=PARAMOUNT SOFTWARE UK LIMITED,O=PARAMOUNT SOFTWARE UK LIMITED,STREET=Unit 13 Lloyd Street North\, Manchester Science Park,L=Manchester,ST=Greater Manchester,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

97:21:4d:e1:8b:68:34:2c:61:34:8c:ab:82:06:85:95:44:a6:74:8b:ad:64:be:e1:5e:67:ad:32:04:c6:dc:f1
Signer

Actual PE Digest

97:21:4d:e1:8b:68:34:2c:61:34:8c:ab:82:06:85:95:44:a6:74:8b:ad:64:be:e1:5e:67:ad:32:04:c6:dc:f1

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=02973414,CN=PARAMOUNT SOFTWARE UK LIMITED,O=PARAMOUNT SOFTWARE UK LIMITED,STREET=Unit 13 Lloyd Street North\, Manchester Science Park,L=Manchester,ST=Greater Manchester,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

07/09/2022, 13:42
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW

Exports

Exports

aes_cbc_decrypt
aes_cbc_encrypt
aes_decrypt
aes_decrypt_buffer
aes_encrypt
aes_encrypt_buffer
aes_set_key
pbkdf2

Sections

.text
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Macrium Reflect Technician 8.0.6979 Portable (x64)/App/Win64/LE5.dll
.dll windows x64

cc69bf210df16c82a695432c521839e2

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31/12/2021, 14:10

Not After

10/02/2025, 13:32

Subject

SERIALNUMBER=02973414,CN=PARAMOUNT SOFTWARE UK LIMITED,O=PARAMOUNT SOFTWARE UK LIMITED,STREET=Unit 13 Lloyd Street North\, Manchester Science Park,L=Manchester,ST=Greater Manchester,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:22:e0:c8:aa:82:ef:f5:38:6c:05:ff:ce:cd:1d:75:1c:6a:a7:90:e5:cc:ba:ef:7a:4e:f2:88:af:56:b1:22
Signer

Actual PE Digest

47:22:e0:c8:aa:82:ef:f5:38:6c:05:ff:ce:cd:1d:75:1c:6a:a7:90:e5:cc:ba:ef:7a:4e:f2:88:af:56:b1:22

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=02973414,CN=PARAMOUNT SOFTWARE UK LIMITED,O=PARAMOUNT SOFTWARE UK LIMITED,STREET=Unit 13 Lloyd Street North\, Manchester Science Park,L=Manchester,ST=Greater Manchester,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

07/09/2022, 12:53
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
HeapAlloc
HeapFree
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Macrium Reflect Technician 8.0.6979 Portable (x64)/App/Win64/License.rtf
.rtf
Macrium Reflect Technician 8.0.6979 Portable (x64)/App/Win64/OleDlg.dll
.dll windows x64

bca8c6d0e8d303ef3dcc86e79a3ef223

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31/12/2021, 14:10

Not After

10/02/2025, 13:32

Subject

SERIALNUMBER=02973414,CN=PARAMOUNT SOFTWARE UK LIMITED,O=PARAMOUNT SOFTWARE UK LIMITED,STREET=Unit 13 Lloyd Street North\, Manchester Science Park,L=Manchester,ST=Greater Manchester,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c6:b9:08:12:9b:0c:e9:e0:93:05:5f:1d:b9:29:fe:72:ad:86:20:00:b7:1d:23:1f:e4:73:23:5b:ec:6c:f2:7a
Signer

Actual PE Digest

c6:b9:08:12:9b:0c:e9:e0:93:05:5f:1d:b9:29:fe:72:ad:86:20:00:b7:1d:23:1f:e4:73:23:5b:ec:6c:f2:7a

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=02973414,CN=PARAMOUNT SOFTWARE UK LIMITED,O=PARAMOUNT SOFTWARE UK LIMITED,STREET=Unit 13 Lloyd Street North\, Manchester Science Park,L=Manchester,ST=Greater Manchester,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

07/09/2022, 13:18
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
HeapAlloc
HeapFree
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW

Exports

Exports

??0COLEDlg@@QEAA@XZ
??4COLEDlg@@QEAAAEAV0@$$QEAV0@@Z
??4COLEDlg@@QEAAAEAV0@AEBV0@@Z
OleUIAddVerbMenuW
OleUIBusyW
OleUIChangeIconW
OleUIConvertW
OleUIEditLinksW
OleUIInsertObjectW
OleUIPasteSpecialW
OleUIUpdateLinksW

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Macrium Reflect Technician 8.0.6979 Portable (x64)/App/Win64/PrimoBurner64.dll
.dll windows x64

7b19fd7ac3a258b44714e00c7b42ef0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
EncodePointer
FlsGetValue
FlsFree
SetLastError
GetLastError
GetCurrentThread
FlsAlloc
HeapFree
Sleep
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
IsDebuggerPresent
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
FreeLibrary
LoadLibraryW
GetLocaleInfoW
WriteFile
GetModuleFileNameW
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapSize
HeapSetInformation
SetUnhandledExceptionFilter
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
InterlockedPushEntrySList
SetEnvironmentVariableA
UnhandledExceptionFilter
WriteConsoleW
GetDriveTypeW
InitializeCriticalSection
IsBadReadPtr
IsBadWritePtr
CreateThread
CloseHandle
DeviceIoControl
CreateFileA
GlobalMemoryStatus
GetSystemInfo
GetVersionExW
LocalFree
FormatMessageW
WaitForSingleObject
CreateEventW
SetEvent
SetThreadAffinityMask
QueryPerformanceFrequency
GetTempFileNameW
GetTempPathW
SystemTimeToFileTime
GetSystemTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetFileSizeEx
ReadFile
SetFilePointerEx
SetEndOfFile
CreateFileW
DeleteFileW
GetFileAttributesExW
RemoveDirectoryW
GetVolumeNameForVolumeMountPointW
GetLogicalDrives
QueryDosDeviceW
FlushInstructionCache
RaiseException
GetDriveTypeA
DuplicateHandle
GetProcessHeap
SetStdHandle
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
GetTimeZoneInformation
FindNextFileW
GetFullPathNameW
GetCurrentProcess
TerminateProcess
GetCommandLineA
FlsSetValue
CompareStringW
GetCurrentThreadId
FindFirstFileExW
FileTimeToSystemTime
RtlPcToFileHeader
GetDateFormatA
GetTimeFormatA
FindClose

imm32

ImmDisableIME

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

shlwapi

PathRemoveFileSpecW

user32

GetWindowLongPtrW
DefWindowProcW
RegisterClassExW
LoadCursorW
GetClassInfoExW
UnregisterDeviceNotification
CallWindowProcW
DestroyWindow
GetWindowThreadProcessId
PostThreadMessageW
GetSystemMetrics
GetDesktopWindow
MessageBoxW
SetWindowLongPtrW
PostQuitMessage
DispatchMessageW
GetMessageW
RegisterDeviceNotificationW
CreateWindowExW
UnregisterClassA

Exports

Exports

?CreateAudioCD@Library@burner@primo@@SAPEAVIAudioCD@23@XZ
?CreateAudioFile@Library@burner@primo@@SAPEAVIAudioInput@23@XZ
?CreateAudioFormat@Library@burner@primo@@SAPEAVIAudioFormat@23@XZ
?CreateAudioInput@Library@burner@primo@@SAPEAVIAudioInput@23@XZ
?CreateAudioOutput@Library@burner@primo@@SAPEAVIAudioOutput@23@XZ
?CreateAudioPluginInfo@Library@burner@primo@@SAPEAVIAudioPluginInfo@23@XZ
?CreateBlockDevice@Library@burner@primo@@SAPEAVIBlockDevice@23@XZ
?CreateCDMode@Library@burner@primo@@SAPEAVICDMode@23@XZ
?CreateCDSector@Library@burner@primo@@SAPEAVICDSector@23@XZ
?CreateCDSession@Library@burner@primo@@SAPEAVICDSession@23@XZ
?CreateCDText@Library@burner@primo@@SAPEAVICDText@23@XZ
?CreateCDTrack@Library@burner@primo@@SAPEAVICDTrack@23@XZ
?CreateCDTrackMode@Library@burner@primo@@SAPEAVICDMode@23@XZ
?CreateCprmDevice@Library@burner@primo@@SAPEAVICprmDevice@23@XZ
?CreateDataDisc@Library@burner@primo@@SAPEAVIDataDisc@23@XZ
?CreateDataFile@Library@burner@primo@@SAPEAVIDataFile@23@XZ
?CreateDiscCopy@Library@burner@primo@@SAPEAVIDiscCopy@23@XZ
?CreateEngine@Library@burner@primo@@SAPEAVIEngine@23@XZ
?CreateUdfExtent@Library@burner@primo@@SAPEAVIUdfExtent@23@XZ
?CreateVideoDVD@Library@burner@primo@@SAPEAVIVideoDVD@23@XZ
?DisableTraceLog@Library@burner@primo@@SAXXZ
?EnableTraceLog@Library@burner@primo@@SAHPEBGH@Z
?EnableTraceLog@Library@burner@primo@@SAHPEB_WH@Z
?FromBlocks@MSF@burner@primo@@SA?AU123@H@Z
?FromLba@LBA@burner@primo@@SA?AU123@H@Z
?GetCDROMIndexFromLetter@Library@burner@primo@@SAHD@Z
?GetCDROMLetterFromIndex@Library@burner@primo@@SADH@Z
?GetPrimoPlatformGlobalLogger@@YAPEAVLogger@diagnostics@primo@@XZ
?IsAudio@RAWTOCTRACK@burner@primo@@QEAAHXZ
?IsAudio@READTRACKINFO@burner@primo@@QEAAHXZ
?IsAudio@READTRACKINFOEX@burner@primo@@QEAAHXZ
?IsAudio@TOCTRACK@burner@primo@@QEAAHXZ
?IsData@RAWTOCTRACK@burner@primo@@QEAAHXZ
?IsData@READTRACKINFO@burner@primo@@QEAAHXZ
?IsData@READTRACKINFOEX@burner@primo@@QEAAHXZ
?IsData@TOCTRACK@burner@primo@@QEAAHXZ
?IsLeadOut@TOCTRACK@burner@primo@@QEAAHXZ
?ToBlocks@MSF@burner@primo@@SAHHHH@Z
?ToLba@LBA@burner@primo@@SAHHHH@Z

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 513KB - Virtual size: 512KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 95KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Macrium Reflect Technician 8.0.6979 Portable (x64)/App/Win64/ReflectBin.exe
.exe windows x64

cf3a6e60355278b3b16a3efec18a57b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

mpr

WNetGetUserW
WNetGetConnectionW
WNetGetLastErrorW
WNetCancelConnection2W
WNetAddConnection3W
WNetAddConnection2W
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
WNetGetUniversalNameW

netapi32

NetUserGetLocalGroups
NetUserSetInfo
NetShareGetInfo
NetServerGetInfo
NetUserGetGroups
NetUserEnum
NetShareEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

aesdll

aes_decrypt_buffer
aes_cbc_decrypt
aes_cbc_encrypt
aes_encrypt_buffer
aes_encrypt
aes_set_key

uxtheme

DrawThemeBackground
GetThemeInt
IsAppThemed
GetThemeSysColor
GetWindowTheme
CloseThemeData
GetThemeColor
DrawThemeText
OpenThemeData
IsThemeBackgroundPartiallyTransparent
GetThemePartSize
SetWindowTheme
IsThemeActive
GetCurrentThemeName
DrawThemeParentBackground

activeds

ord15
ord7
ord3
ord9
ord29

esent

JetSetIndexRange
JetGetTableColumnInfo
JetGetTableIndexInfo
JetCloseTable
JetRetrieveColumn
JetRetrieveColumns
JetGetRecordPosition
JetGotoPosition
JetGetBookmark
JetGotoBookmark
JetRegisterCallback
JetSeek
JetCreateInstance
JetTerm
JetSetSystemParameter
JetBeginSession
JetEndSession
JetAttachDatabase
JetDetachDatabase
JetGetDatabaseFileInfo
JetOpenDatabase
JetCloseDatabase
JetOpenTable
JetMove
JetMakeKey
JetInit
JetSetCurrentIndex

reflecttheme

ord8
ord7
ord13
ord9
ord6
ord3
ord2
ord11
ord12
ord5
ord10
ord1

primoburner64

?CreateEngine@Library@burner@primo@@SAPEAVIEngine@23@XZ
?EnableTraceLog@Library@burner@primo@@SAHPEB_WH@Z
?CreateBlockDevice@Library@burner@primo@@SAPEAVIBlockDevice@23@XZ
?CreateDataDisc@Library@burner@primo@@SAPEAVIDataDisc@23@XZ
?CreateDataFile@Library@burner@primo@@SAPEAVIDataFile@23@XZ

winhttp

WinHttpGetIEProxyConfigForCurrentUser

wldap32

ord50
ord41
ord22
ord26
ord60
ord200
ord32
ord30
ord79
ord35
ord45
ord211
ord46
ord217
ord143
ord301
ord27
ord33

ws2_32

getsockname
getsockopt
getaddrinfo
__WSAFDIsSet
listen
accept
ntohs
getpeername
gethostname
closesocket
htons
inet_addr
inet_ntoa
sendto
setsockopt
socket
WSAStartup
WSACleanup
WSAAddressToStringW
WSAStringToAddressW
getnameinfo
bind
connect
ntohl
htonl
WSAIoctl
recvfrom
freeaddrinfo
select
ioctlsocket
recv
send
WSAGetLastError
WSASetLastError

iphlpapi

GetIpAddrTable
GetAdaptersInfo
GetTcpTable
GetIfEntry
GetAdaptersAddresses
GetBestInterfaceEx
GetPerAdapterInfo

dnsapi

DnsFree
DnsQuery_W

kernel32

CreateFileA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemTimeAsFileTime
FormatMessageA
FindResourceExW
GetPrivateProfileStringW
SleepEx
GetSystemDirectoryA
GetModuleHandleA
VerifyVersionInfoA
MoveFileExA
GetEnvironmentVariableA
GetStdHandle
SetHandleInformation
CreateEventA
WaitNamedPipeA
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
TlsFree
RtlVirtualUnwind
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetFileInformationByHandle
FileTimeToDosDateTime
GetTempFileNameA
TransactNamedPipe
WaitNamedPipeW
SetNamedPipeHandleState
ExitProcess
WritePrivateProfileStringW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
EncodePointer
GlobalDeleteAtom
lstrcmpW
CompareStringW
lstrcmpA
VirtualProtect
GetShortPathNameW
GetStringTypeExW
GlobalGetAtomNameW
GetAtomNameW
ReplaceFileW
CompareStringA
GlobalFlags
GlobalHandle
LocalReAlloc
GetSystemDefaultUILanguage
LocalLock
LocalUnlock
SetErrorMode
SearchPathW
GetProfileIntW
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
WaitForMultipleObjectsEx
GetFileAttributesA
GetDiskFreeSpaceA
FindNextVolumeMountPointW
FindFirstVolumeMountPointW
OpenProcess
GetProcessTimes
UnregisterWaitEx
RegisterWaitForSingleObject
CancelWaitableTimer
TlsSetValue
TlsGetValue
TlsAlloc
OpenThread
GetLocaleInfoA
GlobalAddAtomW
GetTempFileNameW
DuplicateHandle
GetACP
ExpandEnvironmentStringsW
GetUserDefaultUILanguage
SetThreadLocale
GetThreadLocale
EnumDateFormatsExW
DnsHostnameToComputerNameW
GetComputerNameExW
GetFileAttributesExW
GetFileType
SetVolumeLabelW
ExpandEnvironmentStringsA
LoadLibraryA
SuspendThread
lstrcmpiW
LoadLibraryExW
WinExec
GetVolumeInformationA
PeekNamedPipe
CreatePipe
FlushFileBuffers
SetThreadPriority
GetFirmwareEnvironmentVariableA
FindCloseChangeNotification
FindNextChangeNotification
FindFirstChangeNotificationW
DosDateTimeToFileTime
CancelIo
GetNativeSystemInfo
GetSystemInfo
GetOverlappedResult
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
RaiseException
DecodePointer
ReleaseMutex
SetLocaleInfoW
SetTimeZoneInformation
SetLocalTime
GetLocalTime
FileTimeToLocalFileTime
GetExitCodeThread
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
DefineDosDeviceW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetTempPathA
SetFilePointer
SetFileAttributesW
SetConsoleOutputCP
AttachConsole
GetPrivateProfileIntW
SetWaitableTimer
CreateWaitableTimerW
SystemTimeToFileTime
GetSystemTime
GetCurrentThread
SetUnhandledExceptionFilter
TerminateProcess
ProcessIdToSessionId
SetPriorityClass
GetModuleHandleExW
GetModuleFileNameW
LoadLibraryW
lstrcatW
lstrcpyW
GetProcessId
GetCurrentThreadId
FreeLibrary
RtlCaptureStackBackTrace
GetCurrentProcessId
TryEnterCriticalSection
GetVersion
FormatMessageW
LocalFileTimeToFileTime
GetFileSize
HeapSize
HeapReAlloc
LocalAlloc
GetSystemDirectoryW
GlobalFindAtomW
GetLogicalDriveStringsW
GetTempPathW
SetThreadExecutionState
GenerateConsoleCtrlEvent
ReadDirectoryChangesW
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
GetThreadPriority
LocalFree
GetTimeZoneInformation
FreeResource
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateProcessW
GetExitCodeProcess
QueryDosDeviceW
RemoveDirectoryW
CreateDirectoryW
HeapDestroy
HeapCreate
QueryPerformanceFrequency
QueryPerformanceCounter
VirtualFree
VirtualAlloc
OutputDebugStringW
GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW
DeleteVolumeMountPointW
SetVolumeMountPointW
GetCurrentProcess
GetVersionExW
GetDateFormatW
CopyFileW
CompareFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GlobalUnlock
GlobalLock
WideCharToMultiByte
GetLocaleInfoW
lstrcpynW
HeapValidate
GetProcessHeap
HeapFree
HeapAlloc
OutputDebugStringA
GlobalSize
GlobalReAlloc
MoveFileW
GetUserDefaultLCID
GetSystemDefaultLCID
GetTimeFormatW
GetModuleHandleW
GetProcAddress
lstrlenW
MulDiv
GetWindowsDirectoryW
DeviceIoControl
MoveFileExW
MultiByteToWideChar
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
OpenEventW
CreateMutexW
WaitForMultipleObjects
CreateThread
InitializeCriticalSection
GlobalFree
GlobalAlloc
GetDriveTypeW
CreateEventW
GetLogicalDrives
WaitForSingleObject
ResetEvent
SetEvent
ResumeThread
TerminateThread
GetVolumeInformationW
Sleep
FindNextFileW
FindFirstFileW
DeleteFileW
GetFileAttributesW
CreateFileW
FindResourceW
OpenMutexW
GetTickCount
CloseHandle
SetFileTime
GetFileTime
FindClose
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
GetFileSizeEx
SizeofResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
LockResource
FlushViewOfFile
FindVolumeMountPointClose
GetFullPathNameA
LockFile
GetFullPathNameW
AreFileApisANSI
PulseEvent
CreateSemaphoreW
QueryDepthSList
GetSystemWindowsDirectoryW
ReleaseSemaphore
GetStringTypeW
SwitchToThread
GetCPInfo
LCMapStringW
EnumResourceNamesW
EnumResourceTypesW
EnumResourceLanguagesW
GetUserDefaultLangID
FlushInstructionCache
VirtualQuery
GetModuleFileNameA
lstrcpynA
GetPrivateProfileSectionNamesW
LocalSize
GetPrivateProfileSectionW
CreateDirectoryExW
LCMapStringA
GetStringTypeExA
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
RtlUnwind
ExitThread
FreeLibraryAndExitThread
SetStdHandle
SetEnvironmentVariableA
SetEnvironmentVariableW
SetProcessAffinityMask
SetCurrentDirectoryA
GetCurrentDirectoryA
WriteConsoleW
SetConsoleCtrlHandler
GetCommandLineA
GetCommandLineW
HeapQueryInformation
GetConsoleCP
IsValidLocale
EnumSystemLocalesW
IsValidCodePage
GetOEMCP
FindFirstFileExA
FindFirstFileExW
FindNextFileA
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateTimerQueue
SignalObjectAndWait
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
UnregisterWait
GetThreadTimes
UnlockFileEx

user32

BeginDeferWindowPos
RegisterDeviceNotificationW
DrawIconEx
LoadBitmapW
CreateMenu
ValidateRect
SystemParametersInfoW
SetScrollInfo
EndPaint
BeginPaint
UpdateWindow
GetAsyncKeyState
GetDlgCtrlID
CreateWindowExW
RegisterClassExW
GetMessagePos
AppendMenuW
CreatePopupMenu
EnumChildWindows
SetParent
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetForegroundWindow
GetForegroundWindow
SetWindowLongPtrW
GetWindowLongPtrW
CallWindowProcW
DrawFrameControl
SetPropW
GetIconInfo
CreateIconIndirect
DestroyCursor
GetWindowLongW
DrawFocusRect
WindowFromPoint
DrawStateW
TrackPopupMenuEx
GetSubMenu
DestroyMenu
LoadMenuW
GetActiveWindow
SetActiveWindow
FrameRect
GetWindowDC
GetKeyState
GetFocus
GetNextDlgTabItem
GetClassInfoW
DefWindowProcW
DrawEdge
LoadImageW
DestroyIcon
LoadIconW
CopyRect
GetDialogBaseUnits
DrawIcon
MonitorFromWindow
SetFocus
GetCapture
SetCapture
ReleaseCapture
EnableMenuItem
DeleteMenu
GetMonitorInfoW
LoadKeyboardLayoutW
UnloadKeyboardLayout
GetKeyboardLayoutNameW
SetWindowLongW
wsprintfW
RegisterWindowMessageW
ShowWindow
IsIconic
BringWindowToTop
IsZoomed
DrawMenuBar
AllowSetForegroundWindow
SetClassLongPtrW
FindWindowW
EnumThreadWindows
GetTopWindow
IntersectRect
MapWindowPoints
ClientToScreen
RedrawWindow
SetWindowPos
TrackMouseEvent
DrawTextW
LoadCursorW
PtInRect
EqualRect
IsRectEmpty
OffsetRect
InflateRect
SetRectEmpty
SetRect
ScreenToClient
GetCursorPos
SetCursor
GetClientRect
SetScrollRange
SetScrollPos
GetSystemMetrics
KillTimer
SetTimer
PeekMessageW
DispatchMessageW
TranslateMessage
GetWindowThreadProcessId
GetClassNameW
GetParent
MessageBeep
MonitorFromRect
GetMenuState
GetMenuItemID
GetMenuItemCount
ModifyMenuW
OpenDesktopW
CloseDesktop
OpenWindowStationW
CloseWindowStation
SetProcessWindowStation
SetUserObjectSecurity
GetUserObjectSecurity
DestroyWindow
GetComboBoxInfo
ChildWindowFromPoint
SetWindowRgn
IsWindowEnabled
LoadStringW
CopyIcon
EnumDisplayMonitors
ChangeDisplaySettingsW
EnumDisplaySettingsW
DrawTextExW
GrayStringW
EndDeferWindowPos
GetScrollPos
TabbedTextOutW
SendMessageTimeoutW
GetDlgItem
HideCaret
AdjustWindowRect
SetCursorPos
UnregisterClassW
TrackPopupMenu
RemoveMenu
GetMenuItemInfoW
GetScrollInfo
GetWindowTextW
GetWindowTextLengthW
GetUpdateRect
GetScrollRange
ShowScrollBar
SendMessageW
PostMessageW
EnableScrollBar
GetPropW
RemovePropW
WindowFromDC
InvalidateRect
GetWindowRgn
IsWindow
IsWindowVisible
EnableWindow
GetDC
ReleaseDC
GetWindowRect
GetSysColor
GetSysColorBrush
CharToOemBuffA
GetCursor
GetClipboardData
OemToCharBuffA
MsgWaitForMultipleObjectsEx
SetMenuItemInfoW
MonitorFromPoint
IsClipboardFormatAvailable
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
SendMessageA
FindWindowA
GetCaretPos
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
GetMenuStringW
InsertMenuW
LoadStringA
GetTabbedTextExtentA
GetClipboardFormatNameW
SetCaretPos
CreateCaret
SetClassLongW
GetClassLongW
DestroyCaret
SetWindowLongPtrA
GetWindowLongPtrA
IsWindowUnicode
LookupIconIdFromDirectoryEx
LoadMenuIndirectW
EnumWindows
DrawAnimatedRects
mouse_event
VkKeyScanExW
GetKeyboardLayoutList
ShowCaret
CreateIconFromResourceEx
OpenInputDesktop
GetKeyNameTextW
MapVirtualKeyW
CheckMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetMessageTime
RegisterClassW
GetClassInfoExW
IsMenu
IsChild
GetWindowPlacement
SetWindowPlacement
GetMenu
SetMenu
ScrollWindow
AdjustWindowRectEx
GetClassLongPtrW
WinHelpW
MoveWindow
SetDlgItemInt
GetDlgItemInt
SetDlgItemTextW
GetDlgItemTextW
CheckDlgButton
CheckRadioButton
IsDlgButtonChecked
SendDlgItemMessageW
ScrollWindowEx
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageA
CreateDialogIndirectParamW
EndDialog
MapDialogRect
CharUpperW
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
GetMenuBarInfo
UnpackDDElParam
ReuseDDElParam
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
NotifyWinEvent
CharNextW
GetMenuDefaultItem
ShowOwnedPopups
WaitMessage
RealChildWindowFromPoint
CopyImage
GetTabbedTextExtentW
UnionRect
GetSystemMenu
CopyAcceleratorTableW
InvalidateRgn
SetWindowContextHelpId
SetLayeredWindowAttributes
PostThreadMessageW
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
RegisterClipboardFormatW
LockWindowUpdate
InSendMessage
GetNextDlgGroupItem
InvertRect
GetDCEx
CharUpperBuffW
UpdateLayeredWindow
DeferWindowPos
GetMessageW
IsCharAlphaW
ExitWindowsEx
PostQuitMessage
GetLastActivePopup
SetMenuDefaultItem
GetWindow
IsCharLowerW
MapVirtualKeyExW
SubtractRect
SendNotifyMessageW
GetDoubleClickTime
FillRect

gdi32

GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetWindowOrgEx
GetTextFaceW
GetNearestPaletteIndex
GetPaletteEntries
Polyline
CloseMetaFile
CreateMetaFileW
DeleteMetaFile
ExtFloodFill
SetPaletteEntries
GetBoundsRect
PtInRegion
SetPixelV
SetTextAlign
SetTextCharacterExtra
SetROP2
GetLayout
GetBkMode
SetMapMode
SetGraphicsMode
SetMapperFlags
ExtSelectClipRgn
SaveDC
RestoreDC
PlayMetaFile
OffsetClipRgn
GetObjectType
CreateDIBitmap
GetRgnBox
EnumFontFamiliesExW
GetCurrentPositionEx
GetClipRgn
GetClipBox
CreateHatchBrush
CreateDIBPatternBrushPt
CopyMetaFileW
UnrealizeObject
SetBrushOrgEx
SetWindowOrgEx
GetROP2
SetDIBColorTable
GetTextCharsetInfo
SetLayout
GetViewportOrgEx
IntersectClipRect
CreatePatternBrush
CreatePolygonRgn
SelectClipRgn
OffsetRgn
FrameRgn
FillRgn
CreateRoundRectRgn
CreateRectRgn
SetTextJustification
SetViewportExtEx
CreateDCW
GetCharWidthW
CreateFontW
LPtoDP
DPtoLP
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetMapMode
Escape
GetBkColor
ExcludeClipRect
MoveToEx
LineTo
SetStretchBltMode
GetCurrentObject
Rectangle
CreateBrushIndirect
SetViewportOrgEx
CreateDIBSection
RemoveFontMemResourceEx
GetTextColor
CreateSolidBrush
SetPixel
GetPixel
DeleteDC
CreateBitmap
GetTextMetricsW
AddFontMemResourceEx
CreateRectRgnIndirect
CombineRgn
StretchBlt
PatBlt
SelectPalette
RealizePalette
GetSystemPaletteEntries
GetDIBits
CreatePalette
Polygon
ExtTextOutW
GetObjectW
EnumFontFamiliesW
SetAbortProc
AbortDoc
EndPage
StartPage
EndDoc
StretchDIBits
Ellipse
CreateEllipticRgn
SetRectRgn
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowExtEx
PlayMetaFileRecord
PolyBezierTo
ExtCreatePen
SetArcDirection
SelectClipPath
PolyDraw
ArcTo
StartDocW
SetColorAdjustment
ModifyWorldTransform
SetWorldTransform
PlayEnhMetaFile
EnumMetaFile
SetPolyFillMode
SetBkColor
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
ExtCreateRegion
GetBitmapBits
BeginPath
EndPath
StrokePath
CreatePenIndirect
GetBitmapDimensionEx
GetObjectA
GetTextExtentExPointW
GetTextExtentPoint32A
CloseFigure
FillPath
StrokeAndFillPath
CreateCompatibleDC
GetStockObject
GetTextExtentPoint32W
SelectObject
SetBkMode
SetTextColor
CreateFontIndirectW
CreatePen
PolylineTo
RoundRect
DeleteObject

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW
GetJobW

advapi32

GetUserNameW
RegCloseKey
RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyW
ChangeServiceConfig2W
CloseServiceHandle
CreateServiceW
CryptDestroyHash
OpenSCManagerW
OpenServiceW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegLoadKeyW
RegUnLoadKeyW
IsTextUnicode
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetTokenInformation
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegQueryValueW
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
DeleteService
EqualSid
ControlService
QueryServiceStatusEx
StartServiceW
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
FreeSid
AllocateLocallyUniqueId
LogonUserW
CheckTokenMembership
LsaNtStatusToWinError
OpenThreadToken
GetLengthSid
SetFileSecurityW
GetFileSecurityW
RegEnumKeyW
CreateProcessAsUserW
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
IsValidSid
RegFlushKey
ImpersonateAnonymousToken
ImpersonateLoggedOnUser
SetThreadToken
RevertToSelf
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegQueryValueExA
RegOpenKeyExA
ConvertStringSidToSidW
LookupAccountNameW
LookupAccountSidW
CryptAcquireContextW
RegQueryInfoKeyW
RegSetValueW
CryptGenRandom
InitiateSystemShutdownExW
ConvertSecurityDescriptorToStringSecurityDescriptorW
QueryServiceStatus
QueryServiceConfigW
ChangeServiceConfigW
DeleteAce
RegNotifyChangeKeyValue
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
ConvertSidToStringSidW
GetSecurityDescriptorDacl
AddAccessAllowedAce
GetAce
AddAce
GetAclInformation
InitializeAcl
CopySid

shell32

Shell_NotifyIconW
ShellExecuteW
SHGetMalloc
SHGetPathFromIDListW
SHGetFolderLocation
SHBrowseForFolderW
ShellExecuteExW
ord727
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHFileOperationW
DragQueryFileW
DragAcceptFiles
SHChangeNotify
SHCreateDirectoryExW
SHGetFolderPathW
SHParseDisplayName
ExtractIconExW
DragFinish
ExtractIconW
SHAddToRecentDocs
SHAppBarMessage

comctl32

ImageList_Create
ImageList_GetImageCount
ImageList_SetOverlayImage
ImageList_DrawEx
ImageList_GetIconSize
ImageList_Duplicate
ord340
ord336
ord334
ImageList_Draw
ImageList_GetImageInfo
ImageList_SetBkColor
ImageList_Destroy
_TrackMouseEvent
ImageList_AddMasked
FlatSB_GetScrollProp
ImageList_DrawIndirect
ImageList_Add
ImageList_GetBkColor
ord338
ord332
ord329
ord328
ord17
ImageList_DragMove
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ord236
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Remove

shlwapi

StrRetToStrW
PathFileExistsW
PathMatchSpecW
PathIsDirectoryW
StrFormatByteSizeW
PathCompactPathExW
PathRenameExtensionW
StrStrIW
PathAppendW
PathAddExtensionW
PathFindExtensionW
PathFindFileNameW
PathIsDirectoryEmptyW
PathIsRootW
PathIsUNCServerShareW
PathIsNetworkPathW
StrCmpW
PathStripPathW
PathRemoveExtensionW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
UrlUnescapeW
StrFormatKBSizeW
PathFindFileNameA
PathCombineW
SHCreateStreamOnFileEx

ole32

CoCreateInstance
CoWaitForMultipleHandles
PropVariantClear
OleQueryCreateFromData
OleQueryLinkFromData
CoRegisterMessageFilter
CoRevokeClassObject
CoRegisterClassObject
RevokeDragDrop
OleGetIconOfClass
OleSetContainedObject
OleSave
OleLoad
OleCreateFromFile
OleCreateLinkToFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleCreate
GetHGlobalFromILockBytes
CoGetMalloc
OleIsRunning
GetRunningObjectTable
CoLockObjectExternal
CreateOleAdviseHolder
OleSaveToStream
CreateItemMoniker
CreateGenericComposite
CreateDataAdviseHolder
WriteClassStm
CreateFileMoniker
StgIsStorageFile
StgOpenStorage
StgCreateDocfile
OleLockRunning
OleSetMenuDescriptor
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleRegEnumVerbs
OleRegGetMiscStatus
GetClassFile
OleRun
CLSIDFromProgID
CreateILockBytesOnHGlobal
CoUninitialize
CoInitializeEx
StringFromGUID2
CoCreateGuid
CLSIDFromString
CoTaskMemFree
CoInitialize
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
PropVariantCopy
OleDraw
CoDisconnectObject
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
CreateBindCtx
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemAlloc
StringFromCLSID
CoSetProxyBlanket
CoInitializeSecurity
CreateStreamOnHGlobal
RegisterDragDrop

oleaut32

SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayAllocData
SafeArrayAllocDescriptor
SysReAllocStringLen
OleCreateFontIndirect
SafeArrayRedim
SafeArrayCopy
SafeArrayGetVartype
SafeArrayPutElement
VarCmp
SetErrorInfo
VariantChangeType
GetErrorInfo
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SafeArrayGetDim
VarDateFromStr
OleLoadPicture
VariantCopyInd
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SafeArrayCreate
SysAllocStringLen
SysAllocString
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
VariantCopy
VariantClear
VariantInit
VarBstrFromDate
SysFreeString
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeTypeEx
SafeArrayGetElemsize
SafeArrayPtrOfIndex
VarCyFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
SafeArrayCreateVector
OleLoadPicturePath
VarUdateFromDate
CreateErrorInfo

oledlg

OleUIEditLinksW
OleUIPasteSpecialW
OleUIInsertObjectW
OleUIAddVerbMenuW
OleUIChangeIconW
OleUIConvertW
OleUIBusyW
OleUIUpdateLinksW

credui

CredUIPromptForCredentialsW
CredUIParseUserNameW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wsock32

gethostbyname
shutdown
WSAAsyncSelect

gdiplus

GdipGetImageGraphicsContext
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromScan0
GdipCreatePath
GdipSetStringFormatTrimming
GdipBitmapLockBits
GdipDeletePath
GdipAddPathEllipseI
GdipCreateLineBrush
GdipCreateLineBrushI
GdipSetLineBlend
GdipCreatePathGradientFromPath
GdipSetPathGradientCenterColor
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterPointI
GdipGetPathGradientPointCount
GdipSetPathGradientBlend
GdipSetSmoothingMode
GdipFillRectangleI
GdipFillPieI
GdipCreateImageAttributes
GdipBitmapUnlockBits
GdipDrawImageI
GdipSetStringFormatLineAlign
GdipDeleteStringFormat
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipDisposeImageAttributes
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipSetCompositingMode
GdipSetCompositingQuality
GdipCreateFontFromDC
GdipCreateStringFormat
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHWNDICM
GdipCreateFromHWND
GdipFillRectangle

ntdll

RtlInitUnicodeString
NtCreateFile
NtClose
RtlEnumerateGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl

secur32

LsaDeregisterLogonProcess
LsaConnectUntrusted
LsaLogonUser
LsaFreeReturnBuffer
GetUserNameExW

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

wintrust

CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminCalcHashFromFileHandle
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext

odbc32

ord43
ord136
ord24
ord9
ord13
ord4
ord31
ord75
ord210
ord141
ord135
ord111
ord61

psapi

EnumProcesses
GetProcessImageFileNameW

cabinet

ord20
ord21
ord22
ord23
ord10
ord11
ord13
ord14

dbghelp

MiniDumpWriteDump
ImageDirectoryEntryToData

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

wininet

HttpAddRequestHeadersW
HttpOpenRequestW
GopherGetAttributeW
GopherOpenFileW
GopherFindFirstFileW
HttpEndRequestW
HttpQueryInfoW
FtpGetCurrentDirectoryW
FtpSetCurrentDirectoryW
FtpRemoveDirectoryW
FtpCreateDirectoryW
FtpOpenFileW
FtpRenameFileW
FtpDeleteFileW
HttpSendRequestW
FtpGetFileW
FtpFindFirstFileW
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetSetOptionW
InternetQueryOptionW
InternetSetCookieW
InternetGetCookieW
InternetErrorDlg
InternetFindNextFileW
InternetQueryDataAvailable
InternetWriteFile
InternetReadFile
InternetOpenUrlW
InternetConnectW
FtpPutFileW
InternetSetFilePointer
HttpSendRequestExW
InternetCloseHandle
InternetOpenW
InternetCanonicalizeUrlW
FtpCommandW
GopherCreateLocatorW
InternetCrackUrlW

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW
timeGetTime

crypt32

CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptHashCertificate
CertGetNameStringW
CryptQueryObject
CertOpenStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CryptMsgClose
CertEnumCertificatesInStore

fltlib

FilterAttach
FilterLoad
FilterDetach

setupapi

SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
CM_Get_Parent
CM_Get_Device_IDW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiGetDeviceInstanceIdW
CM_Get_DevNode_Status

powrprof

SetSuspendState

Sections

.text
Size: 22.5MB - Virtual size: 22.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.5MB - Virtual size: 7.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 241KB - Virtual size: 842KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 86.0MB - Virtual size: 86.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 314KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Macrium Reflect Technician 8.0.6979 Portable (x64)/App/Win64/ReflectTheme.dll
.dll windows x64

817045000793e7922d046697e5edd2cc

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31/12/2021, 14:10

Not After

10/02/2025, 13:32

Subject

SERIALNUMBER=02973414,CN=PARAMOUNT SOFTWARE UK LIMITED,O=PARAMOUNT SOFTWARE UK LIMITED,STREET=Unit 13 Lloyd Street North\, Manchester Science Park,L=Manchester,ST=Greater Manchester,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ea:3f:31:3b:ad:e6:65:2c:2a:3f:77:fb:86:63:fb:35:90:92:0f:84:9a:c4:9e:a6:24:1b:a7:98:60:85:20:f3
Signer

Actual PE Digest

ea:3f:31:3b:ad:e6:65:2c:2a:3f:77:fb:86:63:fb:35:90:92:0f:84:9a:c4:9e:a6:24:1b:a7:98:60:85:20:f3

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=02973414,CN=PARAMOUNT SOFTWARE UK LIMITED,O=PARAMOUNT SOFTWARE UK LIMITED,STREET=Unit 13 Lloyd Street North\, Manchester Science Park,L=Manchester,ST=Greater Manchester,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

07/09/2022, 13:42
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

EnterCriticalSection
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
CreateEventW
OutputDebugStringW
SetEvent
DisableThreadLibraryCalls
LoadLibraryW
CreateThread
ResetEvent
HeapAlloc
SetFilePointerEx
VerSetConditionMask
GetProcessHeap
VerifyVersionInfoW
WriteConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetStdHandle
GetStringTypeW
LCMapStringW
FreeEnvironmentStringsW
LoadLibraryExW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeLibrary
GetModuleHandleW
GetProcAddress
SizeofResource
VirtualQuery
FlushInstructionCache
GetCurrentThreadId
VirtualAlloc
GetCurrentProcess
VirtualFree
VirtualProtect
HeapFree
ExitProcess
GetLastError
WaitForSingleObject
TerminateProcess
SetLastError
MulDiv
MoveFileExW
GetWindowsDirectoryW
FindResourceW
LoadResource
CloseHandle
DeleteFileW
LockResource
FreeResource
CreateFileW
WriteFile
GetEnvironmentStringsW

user32

GetSysColorBrush
DrawEdge
DrawFrameControl
InflateRect
GetSysColor
FillRect
GrayStringW
SetRect
DrawTextW
GetWindowTextW
EndPaint
BeginPaint
ReleaseDC
InvalidateRect
FrameRect
DrawStateW
GetParent
GetMenuItemInfoW
PostMessageW
GetMenu
SetWindowPos
MonitorFromWindow
GetMenuItemCount
SetWindowRgn
GetSystemMetrics
GetActiveWindow
OffsetRect
CopyRect
TrackMouseEvent
GetWindowDC
DrawIconEx
PtInRect
GetDCEx
SystemParametersInfoW
GetWindowLongW
GetWindowRect
GetDC
GetPropW
EnumChildWindows
ScreenToClient
SendMessageW
CallNextHookEx
RealGetWindowClassW
GetClassLongPtrW
RedrawWindow
GetDlgCtrlID
WindowFromDC
UnhookWindowsHookEx
IsRectEmpty
SetPropW
EnumDesktopWindows
GetClassNameW
SetWindowsHookExW
SetWindowLongW
GetClientRect
GetDlgItem

gdi32

CreateBitmap
GetTextExtentPoint32W
CreateSolidBrush
CreateRectRgnIndirect
SelectClipRgn
GetDeviceCaps
ExcludeClipRect
BitBlt
AddFontMemResourceEx
AddFontResourceExW
SelectObject
CreateDIBSection
CreateCompatibleDC
PatBlt
DeleteDC
SetTextColor
SetBkMode
GetObjectW
SetStretchBltMode
CreateFontIndirectW
DeleteObject
SetBkColor
ExtTextOutW
GetStockObject

advapi32

RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegNotifyChangeKeyValue
RegOpenKeyExW

shlwapi

PathAppendW

ntdll

RtlInitializeGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

comctl32

ord334
ord328
ord412
ImageList_LoadImageW
ImageList_Remove
ord410
ord336
ord413
ImageList_Add
ImageList_Draw
ImageList_Create
ImageList_Destroy
ord411
ImageList_GetIcon

gdiplus

GdipSaveImageToFile
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0

msimg32

AlphaBlend

Exports

Exports

BlendAwesomeIconBitmap
CreateAwesomeIcon
CreateAwesomeIcon2
CreateAwesomeIconBitmap
CreateAwesomeIconImageFile
CreateCheckBoxImageList
DrawAwesomeIconBitmap
EnableReflectTheme
GetMacriumBrush
GetMacriumColor
SetListViewCheckBoxImages
SetThemeTopWindow
ThemedFrame_SubclassWindow

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Macrium Reflect Technician 8.0.6979 Portable (x64)/App/Win64/VSSSvr.dll
.dll windows x64

3220e4c638725d286f1e547672134321

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

31/12/2021, 14:10

Not After

10/02/2025, 13:32

Subject

SERIALNUMBER=02973414,CN=PARAMOUNT SOFTWARE UK LIMITED,O=PARAMOUNT SOFTWARE UK LIMITED,STREET=Unit 13 Lloyd Street North\, Manchester Science Park,L=Manchester,ST=Greater Manchester,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c3:d5:90:dc:ca:cf:18:d3:85:db:f0:8e:5b:08:ac:52:25:df:47:78:88:4e:5d:89:f4:d1:4b:14:4f:bf:78:21
Signer

Actual PE Digest

c3:d5:90:dc:ca:cf:18:d3:85:db:f0:8e:5b:08:ac:52:25:df:47:78:88:4e:5d:89:f4:d1:4b:14:4f:bf:78:21

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=02973414,CN=PARAMOUNT SOFTWARE UK LIMITED,O=PARAMOUNT SOFTWARE UK LIMITED,STREET=Unit 13 Lloyd Street North\, Manchester Science Park,L=Manchester,ST=Greater Manchester,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

07/09/2022, 13:09
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

vssapi

?CreateVssBackupComponents@@YAJPEAPEAVIVssBackupComponents@@@Z
ord6

kernel32

HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetVolumePathNamesForVolumeNameW
LockResource
LoadResource
SizeofResource
FileTimeToLocalFileTime
FileTimeToSystemTime
DecodePointer
FindResourceExW
GetTimeFormatW
GetDateFormatW
GetThreadLocale
LocalFree
FormatMessageW
GetModuleFileNameW
CreateDirectoryW
GetFileAttributesW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
ExpandEnvironmentStringsW
GetComputerNameW
SetEndOfFile
CreateFileW
WriteConsoleW
FindResourceW
GetProcAddress
ReadConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
SetLastError
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
RtlUnwind
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
FindClose
FindFirstFileExA

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

shell32

SHGetFolderPathW

ole32

CoUninitialize
CoInitialize
CLSIDFromString

oleaut32

SysAllocString
SysFreeString

netapi32

NetShareEnum
NetApiBufferFree

Exports

Exports

?CreateShadowCopy@@YAHAEAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@PEAPEAV?$vector@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@std@@@2@1AEAJHHPEAPEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?CreateShadowCopyWithWriters2@@YAHAEAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@00AEAV?$vector@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@std@@@2@1AEAJHHPEAPEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
AddNewFilePath
CompleteBackup
CompleteBackupWithResult
CreateShadowCopyWithWriters
GetWriterMetaData
InitialiseForRestore
PostRestore
PreRestore
RenameComponent
SelectComponentsToRestore
SelectSubcomponentForRestore
SetComponentRestoreOptions

Sections

.text
Size: 396KB - Virtual size: 395KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 266KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Macrium Reflect Technician 8.0.6979 Portable (x64)/App/Win64/psmounterex.sys
.exe windows x64

a9db39c4efc090afa23bc17ffdb6fdc3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/03/2016, 00:00

Not After

16/03/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7c:4b:a2:69:a7:9b:fc:ba:77:f2:89:aa
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

16/02/2017, 09:47

Not After

24/03/2020, 14:06

Subject

CN=Paramount Software UK Ltd,O=Paramount Software UK Ltd,L=Manchester,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/09/2018, 19:45

Not After

20/09/2019, 19:45

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

92:f9:34:13:04:bf:b7:71:58:d2:93:97:d1:b9:69:5d:ee:0d:00:1a:b5:f1:19:a8:b4:9f:49:fa:15:e0:cd:98
Signer

Actual PE Digest

92:f9:34:13:04:bf:b7:71:58:d2:93:97:d1:b9:69:5d:ee:0d:00:1a:b5:f1:19:a8:b4:9f:49:fa:15:e0:cd:98

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

15/12/2022, 13:51
Valid: false

9e:80:ef:26:b4:32:c6:49:50:e6:f4:65:f5:46:93:07:d0:b7:13:59
Signer

Actual PE Digest

9e:80:ef:26:b4:32:c6:49:50:e6:f4:65:f5:46:93:07:d0:b7:13:59

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Paramount Software UK Ltd,O=Paramount Software UK Ltd,L=Manchester,ST=Greater Manchester,C=GB

15/02/2019, 11:20
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

DbgPrint
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwCreateFile
ZwWriteFile
ZwClose
KdDebuggerEnabled
RtlInitAnsiString
RtlWriteRegistryValue
RtlCreateRegistryKey
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
RtlInitUnicodeString
ZwQueryInformationFile
ZwReadFile
KeInitializeEvent
KeSetEvent
RtlCompareMemory
ExInterlockedInsertTailList
IofCompleteRequest
SeTokenType
SeCreateClientSecurity
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
RtlClearAllBits
RtlSetAllBits
RtlSetBits
RtlFindFirstRunClear
RtlAreBitsSet
RtlFindNextForwardRunClear
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExInterlockedInsertHeadList
__C_specific_handler
ExAllocatePool
_wcsicmp
_wcsnicmp
RtlQueryRegistryValues
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlxAnsiStringToUnicodeSize
KeSetPriorityThread
KeWaitForMultipleObjects
KeWaitForSingleObject
ExInterlockedRemoveHeadList
ExInitializeResourceLite
ExDeleteResourceLite
MmQuerySystemSize
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
PsCreateSystemThread
PsTerminateSystemThread
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ZwCreateDirectoryObject
ZwMakeTemporaryObject
ZwOpenKey
RtlInitializeGenericTable
ExUuidCreate
SeImpersonateClient
PsRevertToSelf
_vsnprintf
_vsnwprintf
NlsMbOemCodePageTag
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
RtlInsertElementGenericTable
RtlDeleteElementGenericTable
_local_unwind
ZwQueryDirectoryFile
swprintf
ZwOpenProcessToken
ZwAdjustPrivilegesToken
RtlInitializeBitMap
PsGetVersion
ZwQueryValueKey
MmGetSystemRoutineAddress
IoCreateDevice
ObOpenObjectByPointer
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwCreateKey
ZwSetValueKey
KeBugCheckEx

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Macrium Reflect Technician 8.0.6979 Portable (x64)/Data/Macrium Reflect.ico
Macrium Reflect Technician 8.0.6979 Portable (x64)/Data/Macrium Reflect.ini
Macrium Reflect Technician 8.0.6979 Portable (x64)/Macrium Reflect.exe
.exe windows x64

77d45b1ee20c3b020c48ab42d23ce5ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

wsock32

WSACleanup
socket
inet_ntoa
setsockopt
ntohs
recvfrom
ioctlsocket
htons
WSAStartup
__WSAFDIsSet
select
accept
listen
bind
closesocket
WSAGetLastError
recv
sendto
send
inet_addr
gethostbyname
gethostname
connect

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

winmm

timeGetTime
waveOutSetVolume
mciSendStringW

comctl32

ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create

mpr

WNetUseConnectionW
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W

wininet

InternetQueryDataAvailable
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetConnectW

psapi

GetProcessMemoryInfo

iphlpapi

IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho

userenv

DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileW

uxtheme

IsThemeActive

kernel32

WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetShortPathNameW
CloseHandle
FindNextFileW
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
FindResourceW
LoadResource
LockResource
SizeofResource
EnumResourceNamesW
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
GetLocalTime
CompareStringW
CreateThread
LeaveCriticalSection
GetStdHandle
CreatePipe
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
LoadLibraryW
VirtualAlloc
GetFullPathNameW
SetCurrentDirectoryW
IsDebuggerPresent
GetCurrentDirectoryW
lstrcmpiW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
DuplicateHandle
GetCurrentProcess
EnterCriticalSection
GetCurrentThread
ExitProcess
GetModuleHandleExW
ExitThread
GetSystemTimeAsFileTime
ResumeThread
GetCommandLineW
IsProcessorFeaturePresent
RtlPcToFileHeader
RtlUnwindEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStringTypeW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
DeleteFileW
SetEnvironmentVariableA

user32

RegisterHotKey
ClientToScreen
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
GetWindowLongW
MonitorFromPoint
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongPtrW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
SetWindowLongPtrW
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
UnregisterHotKey
CharLowerBuffW
MonitorFromRect
LoadImageW
CreateIconFromResourceEx
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
GetCursorInfo
GetCursorPos
DeleteMenu
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
TranslateMessage
SystemParametersInfoW
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongPtrW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
SetProcessWindowStation
GetProcessWindowStation
SetWindowPos
CopyImage
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
GetMessageW
LockWindowUpdate
TrackPopupMenuEx
DispatchMessageW
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
FindWindowW
PeekMessageW
ScreenToClient

gdi32

StrokePath
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
GetDeviceCaps
EndPath
SetPixel
CloseFigure
LineTo
AngleArc
MoveToEx
CreateCompatibleBitmap
CreateCompatibleDC
Ellipse
PolyDraw
BeginPath
Rectangle
SetViewportOrgEx
SelectObject
StretchBlt
GetDIBits
DeleteDC
GetPixel
CreateDCW
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
StrokeAndFillPath

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
RegCreateKeyExW
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
GetAclInformation
AddAce
SetSecurityDescriptorDacl
GetUserNameW
InitiateSystemShutdownExW

shell32

DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
DragFinish

ole32

CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket

oleaut32

UnRegisterTypeLi
UnRegisterTypeLibForUser
RegisterTypeLibForUser
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayUnaccessData
CreateDispTypeInfo
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SafeArrayCreateVector
SysAllocString
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
OleLoadPicture
QueryPathOfRegTypeLi
VariantCopy
VariantClear
CreateStdDispatch
DispCallFunc
VariantChangeType
SysStringLen
SafeArrayAccessData
VariantInit

Sections

.text
Size: 673KB - Virtual size: 672KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aea6784da3a3efd89019fc4b90a8c711

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

97:21:4d:e1:8b:68:34:2c:61:34:8c:ab:82:06:85:95:44:a6:74:8b:ad:64:be:e1:5e:67:ad:32:04:c6:dc:f1Signer

Signature Validations

Verification

07/09/2022, 13:42 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 52KB

.rdata Size: 35KB - Virtual size: 34KB

.data Size: 2KB - Virtual size: 19KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

cc69bf210df16c82a695432c521839e2

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

47:22:e0:c8:aa:82:ef:f5:38:6c:05:ff:ce:cd:1d:75:1c:6a:a7:90:e5:cc:ba:ef:7a:4e:f2:88:af:56:b1:22Signer

Signature Validations

Verification

07/09/2022, 12:53 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 34KB - Virtual size: 34KB

.data Size: 2KB - Virtual size: 6KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 228KB - Virtual size: 227KB

.reloc Size: 2KB - Virtual size: 1KB

bca8c6d0e8d303ef3dcc86e79a3ef223

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

97:21:4d:e1:8b:68:34:2c:61:34:8c:ab:82:06:85:95:44:a6:74:8b:ad:64:be:e1:5e:67:ad:32:04:c6:dc:f1
Signer

07/09/2022, 13:42
Valid: false

.text
Size: 53KB - Virtual size: 52KB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 2KB - Virtual size: 19KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

47:22:e0:c8:aa:82:ef:f5:38:6c:05:ff:ce:cd:1d:75:1c:6a:a7:90:e5:cc:ba:ef:7a:4e:f2:88:af:56:b1:22
Signer

07/09/2022, 12:53
Valid: false

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 34KB - Virtual size: 34KB

.data
Size: 2KB - Virtual size: 6KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 228KB - Virtual size: 227KB

.reloc
Size: 2KB - Virtual size: 1KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

0e:a3:9d:c6:65:3a:dd:c1:6f:d0:a7:39
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

c6:b9:08:12:9b:0c:e9:e0:93:05:5f:1d:b9:29:fe:72:ad:86:20:00:b7:1d:23:1f:e4:73:23:5b:ec:6c:f2:7a
Signer

07/09/2022, 13:18
Valid: false

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 34KB - Virtual size: 34KB

.data
Size: 2KB - Virtual size: 6KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 513KB - Virtual size: 512KB

.data
Size: 95KB - Virtual size: 110KB

.pdata
Size: 61KB - Virtual size: 61KB

text
Size: 5KB - Virtual size: 4KB

data
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 15KB