Taskmgr[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Taskmgr.exe
Size

1.1MB
MD5

66a5071c6c0727ef9c193cdd2b85c7dd
SHA1

9e8b056722c9e8ddef9d26d038ff63555f301263
SHA256

d9bee000b05708c70cbd6b66f2832a97f041710da14f881f771dafb9910cc613
SHA512

e48ddf62409f99746ec80ce508536f61360985cbc7045cfc7f9337dc9365d9c0739e5d98d2ea79b0cbe20e533845e001435f200a144ab9981a6ce55a94125274
SSDEEP

12288:Z3VLqwYO44x/LsQTGXO/w7wCKTYi3Vm2hvB2RWFYX0C3NAkd5bOOvBxE7q4lCy:nL99v5C+/w7wha2tBFc5bOOvBe7q4f

Score

1^/10

Malware Config

Signatures

Files

Taskmgr.exe
.exe windows x86

ebd01d8c0a6939e5627d8a8372037ea9

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:5e:d9:3f:9a:63:a9:53:72:f7:7b:87:a2:7c:4a:0b:4f:93:c4:98:b9:99:54:0c:f9:71:ad:bc:bc:6f:26:79
Signer

Actual PE Digest

77:5e:d9:3f:9a:63:a9:53:72:f7:7b:87:a2:7c:4a:0b:4f:93:c4:98:b9:99:54:0c:f9:71:ad:bc:bc:6f:26:79

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

Rectangle
LineTo
MoveToEx
CreatePen
GetTextExtentPointW
SelectObject
DeleteObject
CreateDIBSection
GetDeviceCaps

user32

GetWindow
GetMenuState
GetMenuItemInfoW
CreateDialogParamW
GetWindowTextLengthW
SetDlgItemTextW
SwitchToThisWindow
MessageBeep
GetDoubleClickTime
GetCurrentInputMessageSource
SetMenuDefaultItem
SetGestureConfig
GetGestureInfo
CloseGestureInfoHandle
CreateWindowExW
SendMessageW
PostMessageW
GetCursorPos
GetWindowRect
SetWindowPos
GetWindowLongW
IsIconic
IsZoomed
SetWindowLongW
MonitorFromPoint
GetMonitorInfoW
GetClientRect
RedrawWindow
RegisterWindowMessageW
UnregisterClassW
ShowWindowAsync
InternalGetWindowText
KillTimer
CheckMenuItem
GetLastActivePopup
EnableMenuItem
GetSubMenu
GetPropW
CheckMenuRadioItem
GetClassNameW
ord2521
GhostWindowFromHungWindow
HungWindowFromGhostWindow
CreateWindowInBand
GetWindowBand
ord2574
GetWindowCompositionAttribute
ord2573
ord2569
GetClassLongW
CopyIcon
TrackPopupMenu
AppendMenuW
CreatePopupMenu
PostQuitMessage
GetMenuItemCount
RemoveMenu
TrackPopupMenuEx
DestroyMenu
IsWindowEnabled
OpenIcon
SystemParametersInfoW
GetDC
ReleaseDC
IsWindow
DefWindowProcW
GetKeyState
LoadIconW
UpdateWindow
EqualRect
CopyRect
SetMenu
GetMenu
ChangeWindowMessageFilterEx
GetSystemMetrics
SetForegroundWindow
RegisterClassExW
GetMenuItemID
SetFocus
SetTimer
GetForegroundWindow
TranslateAcceleratorW
GetParent
GetMessageW
LoadAcceleratorsW
SendMessageTimeoutW
AllowSetForegroundWindow
FindWindowW
DestroyWindow
LoadMenuW
DispatchMessageW
DialogBoxParamW
LoadStringW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
UnregisterDeviceNotification
MessageBoxW
MapWindowPoints
RegisterDeviceNotificationW
EndDialog
PtInRect
EnableWindow
GetScrollPos
DeleteMenu
GetMessagePos
SetWindowTextW
OpenClipboard
GetWindowTextW
GetDlgItem
CharLowerW
GetGuiResources
GetProcessWindowStation
EmptyClipboard
SetClipboardData
CloseClipboard
EnumDesktopsW
GetFocus
InvalidateRect
CloseDesktop
EnumDesktopWindows
SetThreadDesktop
GetThreadDesktop
OpenDesktopW
ShowWindow
GetWindowThreadProcessId
DestroyIcon
IsHungAppWindow
IsWindowVisible
CharUpperBuffW
LoadImageW

msvcrt

_controlfp
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
__CxxFrameHandler3
??1type_info@@UAE@XZ
_wcmdln
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_wtoi
_i64tow_s
_purecall
_wcsnicmp
swscanf_s
wcsrchr
_wcsicmp
iswalpha
wcschr
memcpy_s
iswdigit
memmove
_wtol
_itow_s
wcsstr
towupper
_ui64tow_s
wcstok_s
iswspace
_except_handler4_common
_vsnwprintf
_stricmp
_strnicmp
bsearch
wcstod
memcpy
memcmp
floor
ceil
_ftol2_sse
_ftol2
_CIsqrt
free
malloc
_callnewh
memset

oleaut32

SysAllocString
VariantInit
SafeArrayCreateVector
SafeArrayDestroy
SafeArrayPutElement
VariantClear
SysFreeString
SysAllocStringLen
SysStringLen

api-ms-win-core-sysinfo-l1-2-1

GetSystemTime
GetTickCount
GetLogicalProcessorInformationEx
GetLocalTime
GetPhysicallyInstalledSystemMemory
GetComputerNameExW
GlobalMemoryStatusEx
GetNativeSystemInfo
GetTickCount64
GetSystemFirmwareTable
GetVersionExW
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemDirectoryW

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventRegister
EventUnregister

api-ms-win-core-processthreads-l1-1-2

GetCurrentThread
SetThreadPriority
IsProcessorFeaturePresent
SetProcessShutdownParameters
CreateThread
GetProcessTimes
GetThreadPriority
SetPriorityClass
GetPriorityClass
OpenProcess
GetExitCodeThread
GetCurrentThreadId
CreateProcessW
GetCurrentProcess
TerminateProcess
OpenProcessToken
GetCurrentProcessId
GetStartupInfoW
ProcessIdToSessionId

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
RaiseException
SetErrorMode
UnhandledExceptionFilter
GetLastError
SetLastError
GetErrorMode

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
FreeLibrary
GetModuleHandleExW
LoadLibraryExW

api-ms-win-core-libraryloader-l1-2-2

LoadLibraryW
LoadLibraryA

api-ms-win-core-debug-l1-1-1

DebugBreak
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapSetInformation
HeapFree
HeapReAlloc
GetProcessHeap
HeapSize

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegEnumValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegEnumKeyExW
RegNotifyChangeKeyValue

api-ms-win-core-localization-l1-2-1

GetThreadUILanguage
GetLocaleInfoW
FormatMessageW
GetThreadPreferredUILanguages
GetLocaleInfoEx

api-ms-win-security-base-l1-2-0

GetTokenInformation
CopySid
EqualSid
CreateWellKnownSid
AllocateAndInitializeSid
IsWellKnownSid
CheckTokenMembership
FreeSid
AdjustTokenPrivileges
SetTokenInformation
GetLengthSid

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-synch-l1-2-0

OpenEventW
ReleaseMutex
CreateMutexW
EnterCriticalSection
SetEvent
InitOnceExecuteOnce
WaitForSingleObject
CreateEventW
InitializeCriticalSection
TryEnterCriticalSection
Sleep
ReleaseSemaphore
WaitForSingleObjectEx
OpenSemaphoreW
ResetEvent
DeleteCriticalSection
CreateMutexExW
CreateEventExW
CreateSemaphoreExW
LeaveCriticalSection

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-string-l1-1-0

CompareStringEx
MultiByteToWideChar
CompareStringOrdinal

api-ms-win-core-datetime-l1-1-1

GetDateFormatW
GetTimeFormatW
GetDateFormatEx

api-ms-win-core-io-l1-1-1

DeviceIoControl
CancelSynchronousIo

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsA
GetCurrentDirectoryW
ExpandEnvironmentStringsW

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-core-memory-l1-1-2

ReadProcessMemory
VirtualUnlock

api-ms-win-core-file-l1-2-1

GetVolumePathNamesForVolumeNameW
FindVolumeClose
FindFirstFileW
CreateFileW
FindFirstVolumeW
FindClose
GetDriveTypeW
GetFileType
GetLongPathNameW
CompareFileTime
FindNextChangeNotification
GetTempPathW
GetLogicalDriveStringsW
QueryDosDeviceW
FindFirstChangeNotificationW
FindNextVolumeW
GetFileAttributesExW
FindNextFileW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-sysinfo-l1-2-3

GetProcessorSystemCycleTime

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-path-l1-1-0

PathCchCanonicalize
PathCchAppend
PathCchCombine

api-ms-win-devices-config-l1-1-1

CM_Open_Class_KeyW

api-ms-win-core-datetime-l1-1-2

GetDurationFormatEx

api-ms-win-core-localization-l2-1-0

GetNumberFormatEx

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

GetComputerNameW
MulDiv

api-ms-win-core-shlwapi-legacy-l1-1-0

PathStripPathW
PathRemoveBackslashW
PathIsRelativeW
PathRemoveExtensionW
PathIsPrefixW
PathGetArgsW
PathFileExistsW
SHExpandEnvironmentStringsW
PathRemoveBlanksW

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer
QueueUserWorkItem

api-ms-win-core-perfcounters-l1-1-0

PcwCreateQuery
PcwAddQueryItem
PcwCollectData

comctl32

ImageList_CoCreateInstance

ntdll

WinSqmSetDWORD
WinSqmAddToStream
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
NtSetInformationProcess
RtlNumberOfSetBitsUlongPtr
LdrQueryProcessModuleInformation
NtSetInformationFile
NtQueryObject
NtQueryInformationFile
RtlSecondsSince1970ToTime
NtQueryTimerResolution
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
NtQueryInformationToken
RtlFreeHeap
NtOpenFile
RtlCheckPortableOperatingSystem
RtlInitUnicodeString
NtQueryInformationThread
NtQuerySystemInformationEx
NtQueryInformationProcess
RtlTimeToElapsedTimeFields
RtlNtStatusToDosError
NtQuerySystemInformation
WinSqmAddToStreamEx

uxtheme

SetWindowTheme
GetThemeInt
GetThemeColor
OpenThemeData
UpdatePanningFeedback
CloseThemeData
EndPanningFeedback
BeginPanningFeedback

shlwapi

SHCreateStreamOnFileEx
ord184
SHCreateStreamOnFileW
StrToIntExW
ord176
ord16
AssocQueryStringW
ord278
ord548
ord199
ord219
ord618
ord437
StrRChrIW
StrRetToBufW
StrTrimW
PathIsNetworkPathW
StrStrW
StrStrIW
PathRemoveArgsW

shell32

ord2
SHGetKnownFolderIDList
SHGetSpecialFolderPathW
ord61
SHOpenFolderAndSelectItems
ord75
Shell_NotifyIconW
SHGetPropertyStoreForWindow
ord4
SHEvaluateSystemCommandTemplate
DuplicateIcon
ShellExecuteW
CommandLineToArgvW
ord727
Shell_GetCachedImageIndexW
ord155
SHBindToParent
SHParseDisplayName
ShellExecuteExW

credui

CredUIPromptForCredentialsW

duser

GetGadgetRect
SetGadgetStyle
ForwardGadgetMessage

dui70

?Host@NativeHWNDHost@DirectUI@@QAEXPAVElement@2@@Z
?ShowWindow@NativeHWNDHost@DirectUI@@QAEXH@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
DisableAnimations
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?StartNavigate@Browser@DirectUI@@SG?AVUID@@XZ
?FireEvent@Element@DirectUI@@QAEXPAUEvent@2@_N1@Z
EnableAnimations
?GetLayoutPos@Element@DirectUI@@QAEHXZ
?OnThemeChanged@HWNDElement@DirectUI@@UAEXPAUThemeChangedEvent@2@@Z
??0HWNDElement@DirectUI@@QAE@XZ
??1HWNDElement@DirectUI@@UAE@XZ
?Destroy@NativeHWNDHost@DirectUI@@QAEXXZ
?WndProc@HWNDElement@DirectUI@@UAEJPAUHWND__@@IIJ@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?GetRoot@Element@DirectUI@@QAEPAV12@XZ
StrToID
?GetHWND@HWNDElement@DirectUI@@UAEPAUHWND__@@XZ
?StartDefer@Element@DirectUI@@QAEXPAK@Z
?EndDefer@Element@DirectUI@@QAEXK@Z
?OnInput@HWNDElement@DirectUI@@UAEXPAUInputEvent@2@@Z
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?Release@Value@DirectUI@@QAEXXZ
?GetExtent@Element@DirectUI@@QAEPBUtagSIZE@@PAPAVValue@2@@Z
?Click@Button@DirectUI@@SG?AVUID@@XZ
?UpdateSheets@DUIXmlParser@DirectUI@@QAEJPAVElement@2@@Z
?GetEnabled@Element@DirectUI@@QAE_NXZ
?GetDPI@Element@DirectUI@@QAEHXZ
??0ScrollViewer@DirectUI@@QAE@XZ
??1ScrollViewer@DirectUI@@UAE@XZ
?OnPropertyChanging@BaseScrollViewer@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@ScrollViewer@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnInput@BaseScrollViewer@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnEvent@BaseScrollViewer@DirectUI@@UAEXPAUEvent@2@@Z
?Add@BaseScrollViewer@DirectUI@@UAEJPAPAVElement@2@I@Z
?CreateScrollBars@ScrollViewer@DirectUI@@MAEJXZ
?AddChildren@ScrollViewer@DirectUI@@MAEJXZ
?OnListenerAttach@BaseScrollViewer@DirectUI@@UAEXPAVElement@2@@Z
?OnListenerDetach@BaseScrollViewer@DirectUI@@UAEXPAVElement@2@@Z
?OnListenedPropertyChanging@BaseScrollViewer@DirectUI@@UAE_NPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenedPropertyChanged@ScrollViewer@DirectUI@@UAEXPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenedInput@BaseScrollViewer@DirectUI@@UAEXPAVElement@2@PAUInputEvent@2@@Z
?OnListenedEvent@BaseScrollViewer@DirectUI@@UAEXPAVElement@2@PAUEvent@2@@Z
?GetClassInfoPtr@Expando@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@ScrollViewer@DirectUI@@SGPAUIClassInfo@2@XZ
?Initialize@BaseScrollViewer@DirectUI@@QAEJPAVElement@2@PAK@Z
?_PostEvent@Element@DirectUI@@AAEXPAUEvent@2@H@Z
?Register@ScrollViewer@DirectUI@@SGJXZ
?GetHScroll@ScrollViewer@DirectUI@@MAEPAVBaseScrollBar@2@XZ
?GetVScroll@ScrollViewer@DirectUI@@MAEPAVBaseScrollBar@2@XZ
?SetPadding@Element@DirectUI@@QAEJHHHH@Z
?SetXOffset@BaseScrollViewer@DirectUI@@QAEJH@Z
?XOffsetProp@BaseScrollViewer@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetHeight@Element@DirectUI@@QAEJH@Z
?GetDesiredSize@Element@DirectUI@@QAEPBUtagSIZE@@XZ
??1DCSurface@DirectUI@@UAE@XZ
??0DCSurface@DirectUI@@QAE@PAUHDC__@@@Z
?RemoveListener@Element@DirectUI@@QAEXPAUIElementListener@2@@Z
?Init@NavReference@DirectUI@@QAEXPAVElement@2@PAUtagRECT@@@Z
?Remove@Element@DirectUI@@QAEJPAV12@@Z
?ExpandCollapse_ExpandCollapseState_Property@Schema@DirectUI@@2HA
?GetIndex@Element@DirectUI@@QAEHXZ
??0IProvider@DirectUI@@QAE@XZ
?AdviseEventRemoved@ElementProvider@DirectUI@@UAGJHPAUtagSAFEARRAY@@@Z
?AdviseEventAdded@ElementProvider@DirectUI@@UAGJHPAUtagSAFEARRAY@@@Z
?get_FragmentRoot@ElementProvider@DirectUI@@UAGJPAPAUIRawElementProviderFragmentRoot@@@Z
?SetFocus@ElementProvider@DirectUI@@UAGJXZ
?GetEmbeddedFragmentRoots@ElementProvider@DirectUI@@UAGJPAPAUtagSAFEARRAY@@@Z
?get_BoundingRectangle@ElementProvider@DirectUI@@UAGJPAUUiaRect@@@Z
?GetRuntimeId@ElementProvider@DirectUI@@UAGJPAPAUtagSAFEARRAY@@@Z
?Navigate@ElementProvider@DirectUI@@UAGJW4NavigateDirection@@PAPAUIRawElementProviderFragment@@@Z
?ShowContextMenu@ElementProvider@DirectUI@@UAGJXZ
?get_HostRawElementProvider@ElementProvider@DirectUI@@UAGJPAPAUIRawElementProviderSimple@@@Z
?GetPropertyValue@ElementProvider@DirectUI@@UAGJHPAUtagVARIANT@@@Z
?get_ProviderOptions@ElementProvider@DirectUI@@UAGJPAW4ProviderOptions@@@Z
?TossElement@ElementProvider@DirectUI@@UAEXXZ
?QueryInterface@ElementProvider@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?Create@ElementProvider@DirectUI@@SGJPAVElement@2@PAVInvokeHelper@2@PAPAV12@@Z
?Create@HWNDElementProvider@DirectUI@@SGJPAVHWNDElement@2@PAVInvokeHelper@2@PAPAV12@@Z
?Find@ElementProviderManager@DirectUI@@SGPAVElementProvider@2@PAVElement@2@@Z
??1ElementProvider@DirectUI@@UAE@XZ
??0RefcountBase@DirectUI@@QAE@XZ
??0ElementProvider@DirectUI@@QAE@XZ
??0ProviderProxy@DirectUI@@IAE@XZ
??0ElementProxy@DirectUI@@IAE@XZ
?GetInvokeHelper@InvokeManager@DirectUI@@SGJPAPAVInvokeHelper@2@@Z
?Init@ProviderProxy@DirectUI@@MAEXPAVElement@2@@Z
?CreatePatternProvider@Schema@DirectUI@@SGJW4Pattern@12@PAVElementProvider@2@PAPAUIUnknown@@@Z
?IsPatternSupported@ElementProxy@DirectUI@@IAEJW4Pattern@Schema@2@PA_N@Z
?AddRef@RefcountBase@DirectUI@@QAEJXZ
?Release@RefcountBase@DirectUI@@QAEJXZ
?AddRef@ElementProvider@DirectUI@@UAGKXZ
?TossPatternProvider@ElementProvider@DirectUI@@QAEXW4Pattern@Schema@2@@Z
??1RefcountBase@DirectUI@@UAE@XZ
?DoInvokeArgs@ElementProvider@DirectUI@@QAEJHP6GPAVProviderProxy@2@PAVElement@2@@ZPAD@Z
?GetElement@ElementProvider@DirectUI@@UAEPDVElement@2@XZ
?Init@ElementProxy@DirectUI@@MAEXPAVElement@2@@Z
?DoMethod@ElementProxy@DirectUI@@UAEJHPAD@Z
?GetProperty@ElementProxy@DirectUI@@IAEJPAUtagVARIANT@@H@Z
?Release@ElementProvider@DirectUI@@UAGKXZ
?Init@ElementProvider@DirectUI@@MAEJPAVElement@2@PAVInvokeHelper@2@@Z
??1AutoLock@DirectUI@@QAE@XZ
??0AutoLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?DoInvoke@ElementProvider@DirectUI@@IAAJHZZ
?PatternFromPatternId@Schema@DirectUI@@SG?AW4Pattern@12@H@Z
?DataGridControlType@Schema@DirectUI@@2HA
?SelectionPattern@Schema@DirectUI@@2HA
?TablePattern@Schema@DirectUI@@2HA
?InvokePattern@Schema@DirectUI@@2HA
?TableItemPattern@Schema@DirectUI@@2HA
?IsControlElementProperty@Schema@DirectUI@@2HA
?IsContentElementProperty@Schema@DirectUI@@2HA
?TreeItemControlType@Schema@DirectUI@@2HA
?ListItemControlType@Schema@DirectUI@@2HA
?ControlTypeProperty@Schema@DirectUI@@2HA
?GridPattern@Schema@DirectUI@@2HA
?SelectionItemPattern@Schema@DirectUI@@2HA
?ExpandCollapsePattern@Schema@DirectUI@@2HA
?GridItemPattern@Schema@DirectUI@@2HA
?GetExpanded@Expandable@DirectUI@@QAE_NXZ
?UiaRaiseAutomationPropertyChangedEvent@Schema@DirectUI@@2P6GJPAUIRawElementProviderSimple@@HUtagVARIANT@@1@ZA
?GetAccessible@Element@DirectUI@@QAE_NXZ
?WantPropertyEvent@EventManager@DirectUI@@SG_NH@Z
?FWantAnyEvent@EventManager@DirectUI@@SG_NPAVElement@2@@Z
?OnReceivedDialogFocus@Button@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?OnLostDialogFocus@Button@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?DefaultAction@Button@DirectUI@@UAEJXZ
?OnInput@Button@DirectUI@@UAEXPAUInputEvent@2@@Z
??1Button@DirectUI@@UAE@XZ
??0Button@DirectUI@@QAE@XZ
?GetClassInfoPtr@Button@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@Button@DirectUI@@SGJXZ
?Register@Element@DirectUI@@SGJXZ
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?KeyFocusedProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?OnPropertyChanged@Button@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetVisible@Element@DirectUI@@QAE_NXZ
?GetBackgroundColor@Element@DirectUI@@QAEPBUFill@2@PAPAVValue@2@@Z
?Initialize@Button@DirectUI@@QAEJIPAVElement@2@PAK@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetClass@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetSelected@Element@DirectUI@@QAE_NXZ
?GetBool@Value@DirectUI@@QAE_NXZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z
?SetValue@Element@DirectUI@@QAEJPBUPropertyInfo@2@HPAVValue@2@@Z
?SetExpanded@Expandable@DirectUI@@QAEJ_N@Z
?SetPressed@Button@DirectUI@@QAEJ_N@Z
?GetBoolFalse@Value@DirectUI@@SGPAV12@XZ
?SetBackgroundColor@Element@DirectUI@@QAEJK@Z
?SetBorderThickness@Element@DirectUI@@QAEJHHHH@Z
?SetAccValue@Element@DirectUI@@QAEJPBG@Z
?SetAccItemStatus@Element@DirectUI@@QAEJPBG@Z
?CreateBool@Value@DirectUI@@SGPAV12@_N@Z
?SetAnimation@Element@DirectUI@@QAEJH@Z
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?HeightProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SortChildren@Element@DirectUI@@QAEJP6AHPBX0@Z@Z
?LayoutPosProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?RemoveLocalValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZ@Z
?CreateInt@Value@DirectUI@@SGPAV12@HW4DynamicScaleValue@@@Z
?HasPadding@Element@DirectUI@@QAE_NXZ
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
??1Element@DirectUI@@UAE@XZ
??0Element@DirectUI@@QAE@XZ
?SetBorderColor@Element@DirectUI@@QAEJK@Z
?HasBorder@Element@DirectUI@@QAE_NXZ
?GetInt@Value@DirectUI@@QAEHXZ
?GetType@Value@DirectUI@@QBEHXZ
?CustomProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@P6GPBUPropertyInfo@2@XZHPAUUpdateCache@2@@Z
?KeyWithinProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?MouseWithinProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?GetID@Element@DirectUI@@QAEGXZ
?SetActive@Element@DirectUI@@QAEJH@Z
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?Create@GridLayout@DirectUI@@SGJHHPAPAVLayout@2@@Z
?HasChildren@Element@DirectUI@@QAE_NXZ
?SetClass@Element@DirectUI@@QAEJPBG@Z
?GetKeyWithin@Element@DirectUI@@QAE_NXZ
?GetMouseWithin@Element@DirectUI@@QAE_NXZ
?Insert@Element@DirectUI@@QAEJPAV12@I@Z
?SetID@Element@DirectUI@@QAEJPBG@Z
?SetMinSize@Element@DirectUI@@QAEJHH@Z
?IsDescendent@Element@DirectUI@@QAE_NPAV12@@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?SetAccDesc@Element@DirectUI@@QAEJPBG@Z
?SetTooltip@Element@DirectUI@@QAEJ_N@Z
?SetSelected@Element@DirectUI@@QAEJ_N@Z
?SetXScrollable@BaseScrollViewer@DirectUI@@QAEJ_N@Z
?GetWidth@Element@DirectUI@@QAEHXZ
?SetWidth@Element@DirectUI@@QAEJH@Z
?GetSize@Value@DirectUI@@QAEPBUtagSIZE@@XZ
?ExtentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetKeyFocusedElement@HWNDElement@DirectUI@@SGPAVElement@2@XZ
UnInitProcessPriv
UnInitThread
InitThread
InitProcessPriv
?Register@HWNDElement@DirectUI@@SGJXZ
?IsDestroyed@Element@DirectUI@@QAE_NXZ
?GetLocation@Element@DirectUI@@QAEPBUtagPOINT@@PAPAVValue@2@@Z
?GetParent@Element@DirectUI@@QAEPAV12@XZ
?SetX@Element@DirectUI@@QAEJH@Z
?GetPadding@Element@DirectUI@@QAEPBUtagRECT@@PAPAVValue@2@@Z
?GetBorderThickness@Element@DirectUI@@QAEPBUtagRECT@@PAPAVValue@2@@Z
?SetContentAlign@Element@DirectUI@@QAEJH@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z
?OnNotify@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnPropertyChanged@HWNDHost@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetClassInfoPtr@HWNDHost@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@HWNDHost@DirectUI@@SGJXZ
?OnInput@HWNDHost@DirectUI@@UAEXPAUInputEvent@2@@Z
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?KeyboardNavigate@Element@DirectUI@@SG?AVUID@@XZ
?Release@Element@DirectUI@@QAGKXZ
?Initialize@HWNDHost@DirectUI@@QAEJIIPAVElement@2@PAK@Z
??1HWNDHost@DirectUI@@UAE@XZ
?OnEvent@HWNDElement@DirectUI@@UAEXPAUEvent@2@@Z
??0HWNDHost@DirectUI@@QAE@XZ
??1CCListView@DirectUI@@UAE@XZ
?PostCreate@CCBase@DirectUI@@MAEXPAUHWND__@@@Z
?OnReceivedDialogFocus@CCBase@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?OnLostDialogFocus@CCBase@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?OnCustomDraw@CCBase@DirectUI@@UAE_NPAUtagNMCUSTOMDRAWINFO@@PAJ@Z
?EraseBkgnd@HWNDHost@DirectUI@@MAE_NPAUHDC__@@PAJ@Z
?SetWindowDirection@HWNDHost@DirectUI@@UAEXPAUHWND__@@@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UAEXIPBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSysChar@HWNDHost@DirectUI@@UAE_NG@Z
?DefaultAction@CCBase@DirectUI@@UAEJXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UAE_NXZ
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?OnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?MessageCallback@HWNDHost@DirectUI@@UAEIPAUtagGMSG@@@Z
?GetContentSize@CCListView@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@HWNDHost@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UAEXXZ
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@CCBase@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetClassInfoPtr@CCListView@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@CCListView@DirectUI@@SGJXZ
?OnInput@CCBase@DirectUI@@UAEXPAUInputEvent@2@@Z
?GetDisplayNode@Element@DirectUI@@QAEPAUHGADGET__@@XZ
?SetKeyFocus@HWNDHost@DirectUI@@UAEXXZ
?OnNotify@CCBase@DirectUI@@UAE_NIIJPAJ@Z
?OnMessage@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?GetRootRelativeBounds@Element@DirectUI@@QAEJPAUtagRECT@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UAEHHHI@Z
?GetHWND@HWNDHost@DirectUI@@UAEPAUHWND__@@XZ
?SetWinStyle@CCBase@DirectUI@@QAEJH@Z
?Initialize@CCListView@DirectUI@@QAEJIPAVElement@2@PAK@Z
?CreateHWND@CCBase@DirectUI@@UAEPAUHWND__@@PAU3@@Z
??0CCListView@DirectUI@@QAE@XZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?_OnUIStateChanged@HWNDElement@DirectUI@@MAEXGG@Z
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UAEXPAPBGPAI@Z
?IsMSAAEnabled@HWNDElement@DirectUI@@UAE_NXZ
?CanSetFocus@HWNDElement@DirectUI@@UAE_NXZ
?OnCompositionChanged@HWNDElement@DirectUI@@UAEXXZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UAEXPAUtagMSG@@PAJ@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UAEXPAUKeyboardEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UAEXXZ
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UAEJPAPAUIAccessible@@@Z
?OnDestroy@HWNDElement@DirectUI@@UAEXXZ
?Create@NativeHWNDHost@DirectUI@@SGJPBGPAUHWND__@@PAUHICON__@@HHHHHHIPAPAV12@@Z
?GetHWND@NativeHWNDHost@DirectUI@@QAEPAUHWND__@@XZ
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?RemoveTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@K@Z
?UpdateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?Initialize@HWNDElement@DirectUI@@QAEJPAUHWND__@@_NIPAVElement@2@PAK@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnGroupChanged@HWNDElement@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@HWNDElement@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?IsRTL@Element@DirectUI@@QAE_NXZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
??1ClassInfoBase@DirectUI@@UAE@XZ
??0ClassInfoBase@DirectUI@@QAE@XZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
??1CritSecLock@DirectUI@@QAE@XZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?SetAccRole@Element@DirectUI@@QAEJH@Z

vdmdbg

VDMTerminateTaskWOW
VDMEnumProcessWOW
VDMEnumTaskWOWEx

api-ms-win-core-appcompat-l1-1-1

BaseReadAppCompatDataForProcess
BaseFreeAppCompatDataForProcess

kernel32

SetProcessWorkingSetSize
GetNumberFormatW
GetActiveProcessorGroupCount
RegisterApplicationRestart
PackageFamilyNameFromFullName
GetPackageFullName

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Sections

.text
Size: 620KB - Virtual size: 620KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 32KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 342KB - Virtual size: 341KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ebd01d8c0a6939e5627d8a8372037ea9

Code Sign

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

77:5e:d9:3f:9a:63:a9:53:72:f7:7b:87:a2:7c:4a:0b:4f:93:c4:98:b9:99:54:0c:f9:71:ad:bc:bc:6f:26:79Signer

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

msvcrt

oleaut32

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-debug-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-io-l1-1-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-file-l1-2-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-sysinfo-l1-2-3

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-datetime-l1-1-2

api-ms-win-core-localization-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-string-l2-1-1

api-ms-win-power-setting-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-perfcounters-l1-1-0

comctl32

ntdll

uxtheme

shlwapi

shell32

credui

duser

dui70

vdmdbg

api-ms-win-core-appcompat-l1-1-1

kernel32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 620KB - Virtual size: 620KB

.imrsiv Size: - Virtual size: 4B

.data Size: 32KB - Virtual size: 50KB

.idata Size: 37KB - Virtual size: 36KB

.didat Size: 512B - Virtual size: 488B

.rsrc Size: 342KB - Virtual size: 341KB

.reloc Size: 43KB - Virtual size: 43KB

33:00:00:02:66:bd:15:80:ef:a7:5c:d6:d3:00:00:00:00:02:66
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

77:5e:d9:3f:9a:63:a9:53:72:f7:7b:87:a2:7c:4a:0b:4f:93:c4:98:b9:99:54:0c:f9:71:ad:bc:bc:6f:26:79
Signer

.text
Size: 620KB - Virtual size: 620KB

.imrsiv
Size: - Virtual size: 4B

.data
Size: 32KB - Virtual size: 50KB

.idata
Size: 37KB - Virtual size: 36KB

.didat
Size: 512B - Virtual size: 488B

.rsrc
Size: 342KB - Virtual size: 341KB

.reloc
Size: 43KB - Virtual size: 43KB