Taskmgr[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Taskmgr.exe
Size

1.2MB
MD5

367696323bcba24321144303633d97e6
SHA1

123a4b0640573fd42f23f8f0477554e73f12eb60
SHA256

e8677142afe0d19b74c0306a7fab2a8e6d4c0b5c4082f56d8553bc24e119c964
SHA512

aa8c6d1f5bfc4a99f73f7802366c8529f54cc3e2c9337560f39fe1fb2eb00cca48b77bf36a044f4e2c37df0c28c90684c6317f37fdf1795827254d8f15b39f60
SSDEEP

24576:FFQPelO+nVJKdCzH2XzwtMBHDOKtZyqXmCUakBe7q4DDITP:i0VsdCzHEeqHDOKTP2CUaye7q4Yb

Score

1^/10

Malware Config

Signatures

Files

Taskmgr.exe
.exe windows x86

57edbfa20778f8d786283db3b94342cf

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/07/2018, 20:45

Not After

26/07/2019, 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:ce:ae:1f:81:6e:be:87:65:9d:36:27:e3:4f:df:02:82:08:ed:75:c1:c6:93:4e:e4:2f:3e:bb:6e:6f:ba:6f
Signer

Actual PE Digest

b4:ce:ae:1f:81:6e:be:87:65:9d:36:27:e3:4f:df:02:82:08:ed:75:c1:c6:93:4e:e4:2f:3e:bb:6e:6f:ba:6f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

GetDeviceCaps
CreateDIBSection
DeleteObject
SelectObject
GetTextExtentPointW
CreatePen
MoveToEx
LineTo
Rectangle

user32

GetWindowLongW
IsIconic
IsZoomed
SetWindowLongW
MonitorFromPoint
GetMonitorInfoW
GetClientRect
RedrawWindow
GetMenuState
GetMenuItemInfoW
KillTimer
CreateDialogParamW
GetWindowTextLengthW
SetDlgItemTextW
CheckMenuItem
SetGestureConfig
GetGestureInfo
SwitchToThisWindow
MessageBeep
GetDoubleClickTime
GetCurrentInputMessageSource
SetMenuDefaultItem
RegisterWindowMessageW
UnregisterClassW
ShowWindowAsync
InternalGetWindowText
GetLastActivePopup
EnableMenuItem
GetSubMenu
CheckMenuRadioItem
GetMenuItemCount
GetPropW
GetClassLongW
GetClassNameW
CopyIcon
RemoveMenu
TrackPopupMenuEx
TrackPopupMenu
DestroyMenu
GetWindowRect
GetCursorPos
AppendMenuW
PostMessageW
SendMessageW
CreateWindowExW
CloseGestureInfoHandle
SetWindowPos
GetSysColor
PostQuitMessage
IsWindowEnabled
OpenIcon
IsWindow
DefWindowProcW
LoadIconW
UpdateWindow
SetMenu
CreatePopupMenu
GetMenu
ChangeWindowMessageFilterEx
SetForegroundWindow
InsertMenuW
SystemParametersInfoW
RegisterClassExW
GetDC
ReleaseDC
GetMenuItemID
TranslateAcceleratorW
GetKeyState
EqualRect
CopyRect
ord2521
GhostWindowFromHungWindow
HungWindowFromGhostWindow
CreateWindowInBand
GetWindowBand
ord2574
GetWindowCompositionAttribute
ord2573
ord2569
GetSystemMetrics
GetMessageW
LoadAcceleratorsW
SendMessageTimeoutW
SetFocus
AllowSetForegroundWindow
FindWindowW
DestroyWindow
LoadMenuW
SetTimer
GetForegroundWindow
GetParent
DispatchMessageW
DialogBoxParamW
LoadStringW
MessageBoxW
TranslateMessage
MapWindowPoints
PeekMessageW
PtInRect
GetScrollPos
MsgWaitForMultipleObjectsEx
UnregisterDeviceNotification
RegisterDeviceNotificationW
EndDialog
EnableWindow
SetWindowTextW
DeleteMenu
GetWindowTextW
GetMessagePos
OpenClipboard
GetDlgItem
CharLowerW
GetGuiResources
EmptyClipboard
SetClipboardData
GetProcessWindowStation
EnumDesktopsW
CloseClipboard
GetFocus
CloseDesktop
InvalidateRect
EnumDesktopWindows
SetThreadDesktop
GetThreadDesktop
OpenDesktopW
GetWindowThreadProcessId
ShowWindow
DestroyIcon
IsHungAppWindow
IsWindowVisible
GetWindow
LoadImageW
CharUpperBuffW

msvcrt

_wtoi
wcsstr
wcstok_s
wcstoul
iswdigit
memmove_s
realloc
towupper
_ui64tow_s
free
iswspace
_stricmp
_strnicmp
bsearch
wcstod
wprintf_s
wcschr
_purecall
_i64tow_s
_XcptFilter
__p__commode
_amsg_exit
__wgetmainargs
memcpy_s
__set_app_type
exit
_exit
_cexit
__p__fmode
__setusermatherr
_set_errno
_initterm
_wcmdln
_lock
_unlock
__dllonexit
_onexit
_wcsnicmp
iswalpha
malloc
_except_handler4_common
??1type_info@@UAE@XZ
__CxxFrameHandler3
toupper
_wcsicmp
wcsrchr
_callnewh
swscanf_s
_vsnwprintf
memset
?terminate@@YAXXZ
_controlfp
_get_errno
_CIsqrt
_ftol2
_ftol2_sse
ceil
floor
memcmp
memcpy
memmove
_wtol

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleHandleA
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
FreeLibrary
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection
TryEnterCriticalSection
SetEvent
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSemaphore
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateEventW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
ResetEvent
CreateEventExW
CreateMutexW
OpenEventW
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapSize
GetProcessHeap
HeapSetInformation
HeapReAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetErrorMode
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException
GetErrorMode

api-ms-win-core-processthreads-l1-1-0

GetPriorityClass
GetCurrentProcessId
GetExitCodeThread
CreateProcessW
GetThreadPriority
GetCurrentThreadId
SetProcessShutdownParameters
ProcessIdToSessionId
OpenProcessToken
GetCurrentProcess
SetThreadPriority
GetCurrentThread
CreateThread
SetPriorityClass
TerminateProcess
GetProcessTimes
GetStartupInfoW

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
GetThreadPreferredUILanguages
FormatMessageW
GetThreadUILanguage
GetLocaleInfoW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

oleaut32

SafeArrayPutElement
SysStringLen
SysAllocStringLen
VariantClear
SafeArrayDestroy
SysFreeString
SysAllocString
VariantInit
SafeArrayCreateVector

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
EventProviderEnabled

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
GetComputerNameExW
GlobalMemoryStatusEx
GetSystemDirectoryW
GetVersionExW
GetLogicalProcessorInformationEx
GetLocalTime
GetTickCount64

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep
InitOnceBeginInitialize
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceComplete

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumValueW
RegSetValueExW
RegCloseKey
RegNotifyChangeKeyValue
RegDeleteValueW
RegOpenKeyExW
RegGetValueW

api-ms-win-security-base-l1-1-0

GetLengthSid
AdjustTokenPrivileges
FreeSid
CopySid
AllocateAndInitializeSid
EqualSid
CreateWellKnownSid
GetTokenInformation
CheckTokenMembership
SetTokenInformation
IsWellKnownSid

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo
GetSystemFirmwareTable

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringEx
CompareStringOrdinal

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-io-l1-1-1

CancelSynchronousIo

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
GetCurrentDirectoryW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-core-memory-l1-1-0

ReadProcessMemory

api-ms-win-core-file-l1-1-0

GetFileType
GetFileAttributesExW
FindVolumeClose
CompareFileTime
CreateFileW
FindFirstVolumeW
FindFirstChangeNotificationW
GetDriveTypeW
GetLogicalDriveStringsW
FindNextChangeNotification
QueryDosDeviceW
FindClose
FindFirstFileW
GetLongPathNameW
FindNextFileW
FindNextVolumeW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-sysinfo-l1-2-2

GetProcessorSystemCycleTime

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-2-0

GetTempPathW
GetVolumePathNamesForVolumeNameW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-sysinfo-l1-2-1

GetPhysicallyInstalledSystemMemory

api-ms-win-core-path-l1-1-0

PathCchCombine
PathCchAppend
PathCchCanonicalize

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW
GetFileVersionInfoSizeW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoTransformError

api-ms-win-core-datetime-l1-1-2

GetDurationFormatEx

api-ms-win-core-localization-l2-1-0

GetNumberFormatEx

api-ms-win-core-memory-l1-1-1

VirtualUnlock

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
MulDiv

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveBackslashW
PathIsRelativeW
PathStripPathW
PathRemoveExtensionW
PathIsPrefixW
SHExpandEnvironmentStringsW
PathGetArgsW
PathFileExistsW
PathRemoveFileSpecW
PathRemoveBlanksW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem
DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-core-pcw-l1-1-0

PcwAddQueryItem
PcwCollectData
PcwCreateQuery

nsi

NsiGetParameter

comctl32

ImageList_CoCreateInstance

ntdll

NtQuerySystemInformationEx
ZwQueryWnfStateData
NtQueryInformationThread
RtlInitUnicodeString
NtQueryTimerResolution
NtQueryInformationProcess
RtlFreeHeap
RtlNumberOfSetBitsUlongPtr
NtPowerInformation
NtQuerySystemInformation
RtlNtStatusToDosError
NtSetInformationProcess
RtlSecondsSince1970ToTime
NtQueryInformationFile
NtQueryObject
NtSetInformationFile
LdrQueryProcessModuleInformation
EtwCheckCoverage
RtlIpv6AddressToStringExW
RtlIpv4AddressToStringExW
RtlImageNtHeader
RtlTimeToElapsedTimeFields
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
NtQueryInformationToken
NtOpenFile
RtlCheckPortableOperatingSystem
RtlAllocateHeap

uxtheme

CloseThemeData
EndPanningFeedback
BeginPanningFeedback
SetWindowTheme
UpdatePanningFeedback
OpenThemeData
GetCurrentThemeName
GetThemeInt
GetThemeColor

shlwapi

ord16
AssocQueryStringW
ord278
ord548
ord199
ord219
ord176
ord437
PathRemoveArgsW
StrRChrIW
SHCreateStreamOnFileW
StrRetToBufW
SHCreateStreamOnFileEx
ord618
StrToIntExW
StrTrimW
PathIsNetworkPathW
StrStrW
StrStrIW

shell32

SHGetKnownFolderItem
SHGetSpecialFolderPathW
ord61
SHOpenFolderAndSelectItems
ord75
Shell_NotifyIconW
SHGetPropertyStoreForWindow
ord4
DuplicateIcon
ShellExecuteW
CommandLineToArgvW
ord727
Shell_GetCachedImageIndexW
ord155
SHBindToParent
SHParseDisplayName
ShellExecuteExW
ord2
SHEvaluateSystemCommandTemplate
SHGetKnownFolderIDList

credui

CredUIPromptForCredentialsW

duser

ForwardGadgetMessage
SetGadgetStyle
GetGadgetRect

dui70

??0HWNDElement@DirectUI@@QAE@XZ
??1HWNDElement@DirectUI@@UAE@XZ
?Destroy@NativeHWNDHost@DirectUI@@QAEXXZ
?WndProc@HWNDElement@DirectUI@@UAEJPAUHWND__@@IIJ@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?GetRoot@Element@DirectUI@@QAEPAV12@XZ
StrToID
?GetHWND@HWNDElement@DirectUI@@UAEPAUHWND__@@XZ
?StartDefer@Element@DirectUI@@QAEXPAK@Z
?EndDefer@Element@DirectUI@@QAEXK@Z
?OnInput@HWNDElement@DirectUI@@UAEXPAUInputEvent@2@@Z
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?Release@Value@DirectUI@@QAEXXZ
?GetExtent@Element@DirectUI@@QAEPBUtagSIZE@@PAPAVValue@2@@Z
?Click@Button@DirectUI@@SG?AVUID@@XZ
?GetID@Element@DirectUI@@QAEGXZ
?KeyboardNavigate@Element@DirectUI@@SG?AVUID@@XZ
?OnEvent@HWNDElement@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@HWNDElement@DirectUI@@UAEXXZ
?Create@NativeHWNDHost@DirectUI@@SGJPBGPAUHWND__@@PAUHICON__@@HHHHHHIPAPAV12@@Z
?GetHWND@NativeHWNDHost@DirectUI@@QAEPAUHWND__@@XZ
?Initialize@HWNDElement@DirectUI@@QAEJPAUHWND__@@_NIPAVElement@2@PAK@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?SetAccRole@Element@DirectUI@@QAEJH@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?Host@NativeHWNDHost@DirectUI@@QAEXPAVElement@2@@Z
?ShowWindow@NativeHWNDHost@DirectUI@@QAEXH@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
DisableAnimations
?StartNavigate@Browser@DirectUI@@SG?AVUID@@XZ
?FireEvent@Element@DirectUI@@QAEXPAUEvent@2@_N1@Z
?UpdateSheets@DUIXmlParser@DirectUI@@QAEJPAVElement@2@@Z
?GetEnabled@Element@DirectUI@@QAE_NXZ
?GetDPI@Element@DirectUI@@QAEHXZ
??0ScrollViewer@DirectUI@@QAE@XZ
??1ScrollViewer@DirectUI@@UAE@XZ
?OnPropertyChanging@BaseScrollViewer@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@ScrollViewer@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnInput@BaseScrollViewer@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnEvent@BaseScrollViewer@DirectUI@@UAEXPAUEvent@2@@Z
?Add@BaseScrollViewer@DirectUI@@UAEJPAPAVElement@2@I@Z
?CreateScrollBars@ScrollViewer@DirectUI@@MAEJXZ
?AddChildren@ScrollViewer@DirectUI@@MAEJXZ
?OnListenerAttach@BaseScrollViewer@DirectUI@@UAEXPAVElement@2@@Z
?OnListenerDetach@BaseScrollViewer@DirectUI@@UAEXPAVElement@2@@Z
?OnListenedPropertyChanging@BaseScrollViewer@DirectUI@@UAE_NPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenedPropertyChanged@ScrollViewer@DirectUI@@UAEXPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenedInput@BaseScrollViewer@DirectUI@@UAEXPAVElement@2@PAUInputEvent@2@@Z
?OnListenedEvent@BaseScrollViewer@DirectUI@@UAEXPAVElement@2@PAUEvent@2@@Z
?GetClassInfoPtr@Expando@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@ScrollViewer@DirectUI@@SGPAUIClassInfo@2@XZ
?Initialize@BaseScrollViewer@DirectUI@@QAEJPAVElement@2@PAK@Z
?_PostEvent@Element@DirectUI@@AAEXPAUEvent@2@H@Z
?Register@ScrollViewer@DirectUI@@SGJXZ
?GetHScroll@ScrollViewer@DirectUI@@MAEPAVBaseScrollBar@2@XZ
?GetVScroll@ScrollViewer@DirectUI@@MAEPAVBaseScrollBar@2@XZ
?SetPadding@Element@DirectUI@@QAEJHHHH@Z
?SetXOffset@BaseScrollViewer@DirectUI@@QAEJH@Z
?XOffsetProp@BaseScrollViewer@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetHeight@Element@DirectUI@@QAEJH@Z
?GetDesiredSize@Element@DirectUI@@QAEPBUtagSIZE@@XZ
??1DCSurface@DirectUI@@UAE@XZ
??0DCSurface@DirectUI@@QAE@PAUHDC__@@@Z
?RemoveListener@Element@DirectUI@@QAEXPAUIElementListener@2@@Z
?Init@NavReference@DirectUI@@QAEXPAVElement@2@PAUtagRECT@@@Z
?Remove@Element@DirectUI@@QAEJPAV12@@Z
?ExpandCollapse_ExpandCollapseState_Property@Schema@DirectUI@@2HA
?GetIndex@Element@DirectUI@@QAEHXZ
??0IProvider@DirectUI@@QAE@XZ
?AdviseEventRemoved@ElementProvider@DirectUI@@UAGJHPAUtagSAFEARRAY@@@Z
?AdviseEventAdded@ElementProvider@DirectUI@@UAGJHPAUtagSAFEARRAY@@@Z
?get_FragmentRoot@ElementProvider@DirectUI@@UAGJPAPAUIRawElementProviderFragmentRoot@@@Z
?SetFocus@ElementProvider@DirectUI@@UAGJXZ
?GetEmbeddedFragmentRoots@ElementProvider@DirectUI@@UAGJPAPAUtagSAFEARRAY@@@Z
?get_BoundingRectangle@ElementProvider@DirectUI@@UAGJPAUUiaRect@@@Z
?GetRuntimeId@ElementProvider@DirectUI@@UAGJPAPAUtagSAFEARRAY@@@Z
?Navigate@ElementProvider@DirectUI@@UAGJW4NavigateDirection@@PAPAUIRawElementProviderFragment@@@Z
?ShowContextMenu@ElementProvider@DirectUI@@UAGJXZ
?get_HostRawElementProvider@ElementProvider@DirectUI@@UAGJPAPAUIRawElementProviderSimple@@@Z
?GetPropertyValue@ElementProvider@DirectUI@@UAGJHPAUtagVARIANT@@@Z
?get_ProviderOptions@ElementProvider@DirectUI@@UAGJPAW4ProviderOptions@@@Z
?TossElement@ElementProvider@DirectUI@@UAEXXZ
?QueryInterface@ElementProvider@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?Create@ElementProvider@DirectUI@@SGJPAVElement@2@PAVInvokeHelper@2@PAPAV12@@Z
?Create@HWNDElementProvider@DirectUI@@SGJPAVHWNDElement@2@PAVInvokeHelper@2@PAPAV12@@Z
?Find@ElementProviderManager@DirectUI@@SGPAVElementProvider@2@PAVElement@2@@Z
??1ElementProvider@DirectUI@@UAE@XZ
??0RefcountBase@DirectUI@@QAE@XZ
??0ElementProvider@DirectUI@@QAE@XZ
??0ProviderProxy@DirectUI@@IAE@XZ
??0ElementProxy@DirectUI@@IAE@XZ
?GetInvokeHelper@InvokeManager@DirectUI@@SGJPAPAVInvokeHelper@2@@Z
?Init@ProviderProxy@DirectUI@@MAEXPAVElement@2@@Z
?CreatePatternProvider@Schema@DirectUI@@SGJW4Pattern@12@PAVElementProvider@2@PAPAUIUnknown@@@Z
?IsPatternSupported@ElementProxy@DirectUI@@IAEJW4Pattern@Schema@2@PA_N@Z
?AddRef@RefcountBase@DirectUI@@QAEJXZ
?Release@RefcountBase@DirectUI@@QAEJXZ
?AddRef@ElementProvider@DirectUI@@UAGKXZ
?TossPatternProvider@ElementProvider@DirectUI@@QAEXW4Pattern@Schema@2@@Z
??1RefcountBase@DirectUI@@UAE@XZ
?DoInvokeArgs@ElementProvider@DirectUI@@QAEJHP6GPAVProviderProxy@2@PAVElement@2@@ZPAD@Z
?GetElement@ElementProvider@DirectUI@@UAEPDVElement@2@XZ
?Init@ElementProxy@DirectUI@@MAEXPAVElement@2@@Z
?DoMethod@ElementProxy@DirectUI@@UAEJHPAD@Z
?GetProperty@ElementProxy@DirectUI@@IAEJPAUtagVARIANT@@H@Z
?Release@ElementProvider@DirectUI@@UAGKXZ
?Init@ElementProvider@DirectUI@@MAEJPAVElement@2@PAVInvokeHelper@2@@Z
??1AutoLock@DirectUI@@QAE@XZ
??0AutoLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?DoInvoke@ElementProvider@DirectUI@@IAAJHZZ
?PatternFromPatternId@Schema@DirectUI@@SG?AW4Pattern@12@H@Z
?DataGridControlType@Schema@DirectUI@@2HA
?SelectionPattern@Schema@DirectUI@@2HA
?TablePattern@Schema@DirectUI@@2HA
?InvokePattern@Schema@DirectUI@@2HA
?TableItemPattern@Schema@DirectUI@@2HA
?IsControlElementProperty@Schema@DirectUI@@2HA
?IsContentElementProperty@Schema@DirectUI@@2HA
?TreeItemControlType@Schema@DirectUI@@2HA
?ListItemControlType@Schema@DirectUI@@2HA
?ControlTypeProperty@Schema@DirectUI@@2HA
?GridPattern@Schema@DirectUI@@2HA
?SelectionItemPattern@Schema@DirectUI@@2HA
?ExpandCollapsePattern@Schema@DirectUI@@2HA
?GridItemPattern@Schema@DirectUI@@2HA
?GetExpanded@Expandable@DirectUI@@QAE_NXZ
?UiaRaiseAutomationPropertyChangedEvent@Schema@DirectUI@@2P6GJPAUIRawElementProviderSimple@@HUtagVARIANT@@1@ZA
?GetAccessible@Element@DirectUI@@QAE_NXZ
?WantPropertyEvent@EventManager@DirectUI@@SG_NH@Z
?FWantAnyEvent@EventManager@DirectUI@@SG_NPAVElement@2@@Z
?OnReceivedDialogFocus@Button@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?OnLostDialogFocus@Button@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?DefaultAction@Button@DirectUI@@UAEJXZ
?OnInput@Button@DirectUI@@UAEXPAUInputEvent@2@@Z
??1Button@DirectUI@@UAE@XZ
??0Button@DirectUI@@QAE@XZ
?GetClassInfoPtr@Button@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@Button@DirectUI@@SGJXZ
?Register@Element@DirectUI@@SGJXZ
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?KeyFocusedProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?OnPropertyChanged@Button@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetBackgroundColor@Element@DirectUI@@QAEPBUFill@2@PAPAVValue@2@@Z
?Initialize@Button@DirectUI@@QAEJIPAVElement@2@PAK@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetClass@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?SetForegroundColor@Element@DirectUI@@QAEJK@Z
?SetFontStyle@Element@DirectUI@@QAEJH@Z
?SetFontWeight@Element@DirectUI@@QAEJH@Z
?GetSelected@Element@DirectUI@@QAE_NXZ
?GetFontStyle@Element@DirectUI@@QAEHXZ
?GetVisible@Element@DirectUI@@QAE_NXZ
?SetAccValue@Element@DirectUI@@QAEJPBG@Z
?GetBool@Value@DirectUI@@QAE_NXZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z
?SetValue@Element@DirectUI@@QAEJPBUPropertyInfo@2@HPAVValue@2@@Z
?SetExpanded@Expandable@DirectUI@@QAEJ_N@Z
?SetPressed@Button@DirectUI@@QAEJ_N@Z
?GetBoolFalse@Value@DirectUI@@SGPAV12@XZ
?SetBackgroundColor@Element@DirectUI@@QAEJK@Z
?SetBorderThickness@Element@DirectUI@@QAEJHHHH@Z
?CreateBool@Value@DirectUI@@SGPAV12@_N@Z
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?SetAnimation@Element@DirectUI@@QAEJH@Z
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?HeightProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SortChildren@Element@DirectUI@@QAEJP6AHPBX0@Z@Z
?LayoutPosProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?RemoveLocalValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZ@Z
?HasPadding@Element@DirectUI@@QAE_NXZ
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
??1Element@DirectUI@@UAE@XZ
??0Element@DirectUI@@QAE@XZ
?SetBorderColor@Element@DirectUI@@QAEJK@Z
?HasBorder@Element@DirectUI@@QAE_NXZ
?GetInt@Value@DirectUI@@QAEHXZ
?GetType@Value@DirectUI@@QBEHXZ
?CustomProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@P6GPBUPropertyInfo@2@XZHPAUUpdateCache@2@@Z
?CreateInt@Value@DirectUI@@SGPAV12@HW4DynamicScaleValue@@@Z
?KeyWithinProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?MouseWithinProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?SetActive@Element@DirectUI@@QAEJH@Z
?Destroy@Layout@DirectUI@@QAEXXZ
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?Create@GridLayout@DirectUI@@SGJHHPAPAVLayout@2@@Z
?HasChildren@Element@DirectUI@@QAE_NXZ
?SetClass@Element@DirectUI@@QAEJPBG@Z
?GetKeyWithin@Element@DirectUI@@QAE_NXZ
?GetMouseWithin@Element@DirectUI@@QAE_NXZ
?Insert@Element@DirectUI@@QAEJPAV12@I@Z
?SetID@Element@DirectUI@@QAEJPBG@Z
?SetMinSize@Element@DirectUI@@QAEJHH@Z
?IsDescendent@Element@DirectUI@@QAE_NPAV12@@Z
EnableAnimations
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?SetAccDesc@Element@DirectUI@@QAEJPBG@Z
?SetTooltip@Element@DirectUI@@QAEJ_N@Z
?SetSelected@Element@DirectUI@@QAEJ_N@Z
?SetXScrollable@BaseScrollViewer@DirectUI@@QAEJ_N@Z
?GetWidth@Element@DirectUI@@QAEHXZ
?SetWidth@Element@DirectUI@@QAEJH@Z
?GetSize@Value@DirectUI@@QAEPBUtagSIZE@@XZ
?ExtentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetKeyFocusedElement@HWNDElement@DirectUI@@SGPAVElement@2@XZ
UnInitProcessPriv
UnInitThread
InitThread
InitProcessPriv
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?IsDestroyed@Element@DirectUI@@QAE_NXZ
?GetLocation@Element@DirectUI@@QAEPBUtagPOINT@@PAPAVValue@2@@Z
?GetParent@Element@DirectUI@@QAEPAV12@XZ
?SetX@Element@DirectUI@@QAEJH@Z
?GetPadding@Element@DirectUI@@QAEPBUtagRECT@@PAPAVValue@2@@Z
?GetBorderThickness@Element@DirectUI@@QAEPBUtagRECT@@PAPAVValue@2@@Z
?SetContentAlign@Element@DirectUI@@QAEJH@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z
?OnNotify@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnPropertyChanged@HWNDHost@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetClassInfoPtr@HWNDHost@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@HWNDHost@DirectUI@@SGJXZ
?OnInput@HWNDHost@DirectUI@@UAEXPAUInputEvent@2@@Z
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?Release@Element@DirectUI@@QAGKXZ
?Initialize@HWNDHost@DirectUI@@QAEJIIPAVElement@2@PAK@Z
??1HWNDHost@DirectUI@@UAE@XZ
??0HWNDHost@DirectUI@@QAE@XZ
??1CCListView@DirectUI@@UAE@XZ
?PostCreate@CCBase@DirectUI@@MAEXPAUHWND__@@@Z
?OnReceivedDialogFocus@CCBase@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?OnLostDialogFocus@CCBase@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?OnCustomDraw@CCBase@DirectUI@@UAE_NPAUtagNMCUSTOMDRAWINFO@@PAJ@Z
?EraseBkgnd@HWNDHost@DirectUI@@MAE_NPAUHDC__@@PAJ@Z
?SetWindowDirection@HWNDHost@DirectUI@@UAEXPAUHWND__@@@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UAEXIPBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSysChar@HWNDHost@DirectUI@@UAE_NG@Z
?DefaultAction@CCBase@DirectUI@@UAEJXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UAE_NXZ
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?OnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?MessageCallback@HWNDHost@DirectUI@@UAEIPAUtagGMSG@@@Z
?GetContentSize@CCListView@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@HWNDHost@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UAEXXZ
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?GetLayoutPos@Element@DirectUI@@QAEHXZ
?OnPropertyChanged@CCBase@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetClassInfoPtr@CCListView@DirectUI@@SGPAUIClassInfo@2@XZ
?OnThemeChanged@HWNDElement@DirectUI@@UAEXPAUThemeChangedEvent@2@@Z
?Register@CCListView@DirectUI@@SGJXZ
?OnInput@CCBase@DirectUI@@UAEXPAUInputEvent@2@@Z
?GetDisplayNode@Element@DirectUI@@QAEPAUHGADGET__@@XZ
?SetKeyFocus@HWNDHost@DirectUI@@UAEXXZ
?OnNotify@CCBase@DirectUI@@UAE_NIIJPAJ@Z
?OnMessage@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?GetRootRelativeBounds@Element@DirectUI@@QAEJPAUtagRECT@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UAEHHHI@Z
?GetHWND@HWNDHost@DirectUI@@UAEPAUHWND__@@XZ
?SetWinStyle@CCBase@DirectUI@@QAEJH@Z
?Initialize@CCListView@DirectUI@@QAEJIPAVElement@2@PAK@Z
?CreateHWND@CCBase@DirectUI@@UAEPAUHWND__@@PAU3@@Z
??0CCListView@DirectUI@@QAE@XZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?_OnUIStateChanged@HWNDElement@DirectUI@@MAEXGG@Z
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UAEXPAPBGPAI@Z
?IsMSAAEnabled@HWNDElement@DirectUI@@UAE_NXZ
?CanSetFocus@HWNDElement@DirectUI@@UAE_NXZ
?OnCompositionChanged@HWNDElement@DirectUI@@UAEXXZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UAEXPAUtagMSG@@PAJ@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UAEXPAUKeyboardEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UAEXXZ
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?RemoveTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@K@Z
?UpdateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?Register@HWNDElement@DirectUI@@SGJXZ
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
?OnGroupChanged@HWNDElement@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@HWNDElement@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
??1CritSecLock@DirectUI@@QAE@XZ
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?IsRTL@Element@DirectUI@@QAE_NXZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
??1ClassInfoBase@DirectUI@@UAE@XZ
??0ClassInfoBase@DirectUI@@QAE@XZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z

vdmdbg

VDMEnumProcessWOW
VDMTerminateTaskWOW
VDMEnumTaskWOWEx

api-ms-win-core-appcompat-l1-1-1

BaseFreeAppCompatDataForProcess
BaseReadAppCompatDataForProcess

pdh

PdhAddCounterW
PdhCloseQuery
PdhCollectQueryData
PdhGetRawCounterArrayW
PdhGetFormattedCounterArrayW
PdhOpenQueryW

dxgi

DXGIDeclareAdapterRemovalSupport
CreateDXGIFactory1

setupapi

SetupDiGetClassDevsW
SetupDiGetDevicePropertyW
SetupDiEnumDeviceInfo

d3d11

D3D11CreateDevice

d3d12

ord101

kernel32

ParseApplicationUserModelId
PackageFamilyNameFromFullName
GetPackageFullName
SetProcessWorkingSetSize
GetNumberFormatW
GetActiveProcessorGroupCount
RegisterApplicationRestart

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 738KB - Virtual size: 738KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 353KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57edbfa20778f8d786283db3b94342cf

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

b4:ce:ae:1f:81:6e:be:87:65:9d:36:27:e3:4f:df:02:82:08:ed:75:c1:c6:93:4e:e4:2f:3e:bb:6e:6f:ba:6fSigner

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-sysinfo-l1-2-2

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-path-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-datetime-l1-1-2

api-ms-win-core-localization-l2-1-0

api-ms-win-core-memory-l1-1-1

api-ms-win-core-string-l2-1-1

api-ms-win-core-datetime-l1-1-1

api-ms-win-power-setting-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-pcw-l1-1-0

nsi

comctl32

ntdll

uxtheme

shlwapi

shell32

credui

duser

dui70

vdmdbg

api-ms-win-core-appcompat-l1-1-1

pdh

dxgi

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

b4:ce:ae:1f:81:6e:be:87:65:9d:36:27:e3:4f:df:02:82:08:ed:75:c1:c6:93:4e:e4:2f:3e:bb:6e:6f:ba:6f
Signer

.text
Size: 738KB - Virtual size: 738KB

.imrsiv
Size: - Virtual size: 4B

.data
Size: 42KB - Virtual size: 61KB

.idata
Size: 39KB - Virtual size: 39KB

.didat
Size: 1024B - Virtual size: 516B

.rsrc
Size: 353KB - Virtual size: 353KB

.reloc
Size: 54KB - Virtual size: 53KB