Taskmgr[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Taskmgr.exe
Size

1.0MB
MD5

1efe4166f542a92885ab524196b18c73
SHA1

8f61c52a763c64d55d02734c863f04187767de4a
SHA256

66a47f793b77b0ba356cc3bd564aac26bb565b7cdb51ffe088c8529ee83634a5
SHA512

e7f4c05818fdf5c6180b7bbe9e3a37958f2bc7069e13e0c9097d841d23f2cb5d9fa4ff883ab4c0091f6c4fd0d51e2f02d95b78b2b22ab3ba1f105c7470606910
SSDEEP

12288:L6Y/hWz1S7Y6eozdY+IASsZt+BAwTDeDA7w8sYII2oHYI4TBxE7q43kW32:quheo5BIASq+Wm7AnJob+Be7q43kW32

Score

1^/10

Malware Config

Signatures

Files

Taskmgr.exe
.exe windows x86

65a7b5c67424d195f99969f5a802cb65

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/06/2013, 21:43

Not After

17/09/2014, 21:43

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e1:7c:c5:9e:cc:33:03:61:26:28:05:aa:92:bc:30:d2:ed:e6:dd:0e:74:7f:65:2b:fb:17:ff:c5:04:bb:3a:4b
Signer

Actual PE Digest

e1:7c:c5:9e:cc:33:03:61:26:28:05:aa:92:bc:30:d2:ed:e6:dd:0e:74:7f:65:2b:fb:17:ff:c5:04:bb:3a:4b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

GetDeviceCaps
CreateDIBSection
DeleteObject
SelectObject
GetTextExtentPointW
CreatePen
MoveToEx
LineTo
Rectangle

user32

MsgWaitForMultipleObjectsEx
DispatchMessageW
PeekMessageW
IsWindowVisible
UnregisterDeviceNotification
RegisterDeviceNotificationW
EndDialog
EnableWindow
SetWindowTextW
GetMenuState
GetMenuItemInfoW
CreateDialogParamW
SetGestureConfig
GetGestureInfo
CloseGestureInfoHandle
CreateWindowExW
SendMessageW
PostMessageW
GetCursorPos
GetWindowRect
SetWindowPos
GetWindowLongW
IsIconic
IsZoomed
SetWindowLongW
MonitorFromPoint
ord2521
GhostWindowFromHungWindow
HungWindowFromGhostWindow
CreateWindowInBand
GetWindowBand
GetWindowCompositionAttribute
GetMonitorInfoW
GetClientRect
RedrawWindow
KillTimer
CheckMenuItem
EnableMenuItem
GetSubMenu
CheckMenuRadioItem
GetMenuItemCount
RemoveMenu
TrackPopupMenuEx
DestroyMenu
GetWindowTextLengthW
SetDlgItemTextW
SwitchToThisWindow
MessageBeep
GetDoubleClickTime
GetCurrentInputMessageSource
SetMenuDefaultItem
RegisterWindowMessageW
UnregisterClassW
ShowWindowAsync
SystemParametersInfoW
GetDC
ReleaseDC
GetKeyState
EqualRect
CopyRect
InternalGetWindowText
GetSystemMetrics
SetFocus
GetLastActivePopup
SetTimer
GetPropW
GetForegroundWindow
GetParent
DialogBoxParamW
LoadStringW
MessageBoxW
MapWindowPoints
PtInRect
GetClassNameW
GetClassLongW
CopyIcon
TrackPopupMenu
GetScrollPos
DeleteMenu
GetMessagePos
OpenClipboard
EmptyClipboard
SetClipboardData
AppendMenuW
CloseClipboard
GetFocus
InvalidateRect
CreatePopupMenu
PostQuitMessage
ShowWindow
DestroyIcon
IsWindowEnabled
LoadImageW
OpenIcon
CharUpperBuffW
IsWindow
DefWindowProcW
LoadIconW
UpdateWindow
GetWindow
LoadMenuW
IsHungAppWindow
GetWindowThreadProcessId
OpenDesktopW
SetMenu
GetMenu
GetThreadDesktop
SetThreadDesktop
EnumDesktopWindows
ChangeWindowMessageFilterEx
SetForegroundWindow
CloseDesktop
EnumDesktopsW
GetProcessWindowStation
RegisterClassExW
GetMenuItemID
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
SendMessageTimeoutW
AllowSetForegroundWindow
FindWindowW
GetGuiResources
CharLowerW
GetDlgItem
GetWindowTextW
DestroyWindow
TranslateMessage

msvcrt

_ui64tow_s
wcstok_s
iswspace
_stricmp
_itow_s
_strnicmp
bsearch
_wtol
??_U@YAPAXI@Z
memmove
_XcptFilter
iswdigit
__p__commode
_amsg_exit
__wgetmainargs
memcpy_s
wcschr
iswalpha
__set_app_type
exit
_exit
_cexit
_wcsicmp
__p__fmode
__setusermatherr
_initterm
wcsstr
??1type_info@@UAE@XZ
__CxxFrameHandler3
_lock
wcsrchr
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
_controlfp
_except_handler4_common
swscanf_s
_wcsnicmp
_purecall
memcpy
memcmp
floor
ceil
_i64tow_s
_ftol2_sse
_wtoi
??2@YAPAXI@Z
_ftol2
_CIsqrt
_vsnwprintf
??3@YAXPAX@Z
??_V@YAXPAX@Z
_wcmdln
towupper
wcstod
memset

oleaut32

SysAllocStringLen
SysStringLen
SysFreeString
SysAllocString
VariantInit
SafeArrayCreateVector
SafeArrayDestroy
SafeArrayPutElement
VariantClear

api-ms-win-core-sysinfo-l1-2-1

GetSystemInfo
GetComputerNameExW
GetSystemFirmwareTable
GetSystemDirectoryW
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount
GetPhysicallyInstalledSystemMemory
GetTickCount64
GlobalMemoryStatusEx
GetSystemTime
GetVersionExW
GetLogicalProcessorInformationEx
GetNativeSystemInfo

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWrite
EventUnregister

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentProcess
OpenProcessToken
SetThreadPriority
GetCurrentThread
ProcessIdToSessionId
SetPriorityClass
GetPriorityClass
SetProcessShutdownParameters
IsProcessorFeaturePresent
GetCurrentThreadId
CreateThread
OpenProcess
GetStartupInfoW
GetProcessTimes
GetThreadPriority
GetExitCodeThread
CreateProcessW
TerminateProcess

api-ms-win-core-errorhandling-l1-1-1

SetLastError
GetLastError
UnhandledExceptionFilter
SetErrorMode
SetUnhandledExceptionFilter
GetErrorMode

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
FreeLibrary

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
OutputDebugStringW
DebugBreak

api-ms-win-core-heap-l1-2-0

HeapFree
HeapAlloc
GetProcessHeap
HeapSize
HeapSetInformation
HeapReAlloc

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyExW
RegGetValueW
RegEnumValueW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegNotifyChangeKeyValue

api-ms-win-core-localization-l1-2-1

GetThreadPreferredUILanguages
FormatMessageW
GetLocaleInfoEx
GetThreadUILanguage
GetLocaleInfoW

api-ms-win-security-base-l1-2-0

AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetLengthSid
CreateWellKnownSid
EqualSid
CopySid
GetTokenInformation
SetTokenInformation
IsWellKnownSid

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-synch-l1-2-0

InitializeCriticalSection
InitOnceExecuteOnce
OpenEventW
CreateMutexW
ReleaseMutex
WaitForSingleObject
SetEvent
CreateEventW
DeleteCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
ResetEvent
Sleep

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
CompareStringEx

api-ms-win-core-datetime-l1-1-1

GetDateFormatW
GetTimeFormatW
GetDateFormatEx

api-ms-win-core-io-l1-1-1

DeviceIoControl
CancelSynchronousIo

api-ms-win-core-processenvironment-l1-2-0

GetCurrentDirectoryW
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-core-memory-l1-1-2

VirtualUnlock
ReadProcessMemory

api-ms-win-core-file-l1-2-1

GetFileType
GetDriveTypeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
FindNextVolumeW
CreateFileW
FindFirstVolumeW
GetTempPathW
GetLogicalDriveStringsW
FindNextChangeNotification
GetLongPathNameW
FindNextFileW
FindFirstFileW
CompareFileTime
FindClose
FindFirstChangeNotificationW
GetFileAttributesExW
QueryDosDeviceW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-path-l1-1-0

PathCchCanonicalize
PathCchCombine
PathCchAppend

api-ms-win-devices-config-l1-1-1

CM_Open_Class_KeyW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

WaitForMultipleObjects
LoadLibraryA
MulDiv
LoadLibraryW
GetDurationFormatEx
GetComputerNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveExtensionW
PathRemoveBlanksW
PathRemoveBackslashW
PathIsRelativeW
PathIsPrefixW
SHExpandEnvironmentStringsW
PathFileExistsW
PathGetArgsW
PathStripPathW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-localization-obsolete-l1-2-0

GetNumberFormatW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRChrIW
SHLoadIndirectString
StrStrIW
StrStrW
StrTrimW
StrToIntExW
QISearch

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc
LocalFree

pcwum

PcwCreateQuery
PcwCollectData
PcwAddQueryItem

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-localization-l2-1-0

GetNumberFormatEx

comctl32

ImageList_CoCreateInstance

ntdll

NtSetInformationProcess
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
WinSqmAddToStream
WinSqmAddToStreamEx
WinSqmSetDWORD
NtQueryTimerResolution
RtlInitUnicodeString
NtQueryInformationThread
NtQuerySystemInformationEx
NtQueryInformationProcess
LdrQueryProcessModuleInformation
NtSetInformationFile
RtlTimeToElapsedTimeFields
NtQueryObject
NtQueryInformationFile
RtlSecondsSince1970ToTime
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtQueryInformationToken
NtOpenFile
RtlCheckPortableOperatingSystem
RtlNtStatusToDosError
NtQuerySystemInformation
RtlNumberOfSetBitsUlongPtr

uxtheme

CloseThemeData
EndPanningFeedback
BeginPanningFeedback
UpdatePanningFeedback
SetWindowTheme
GetThemeInt
GetThemeColor
OpenThemeData

shlwapi

ord618
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
ord176
ord16
PathRemoveArgsW
PathIsNetworkPathW
StrRetToBufW
ord437
ord199
ord548
ord278
AssocQueryStringW

shell32

ord4
ord2
SHGetKnownFolderIDList
SHGetSpecialFolderPathW
ord61
SHOpenFolderAndSelectItems
ord75
Shell_NotifyIconW
SHGetPropertyStoreForWindow
SHEvaluateSystemCommandTemplate
DuplicateIcon
ShellExecuteW
CommandLineToArgvW
ord727
Shell_GetCachedImageIndexW
ord155
SHBindToParent
SHParseDisplayName
ShellExecuteExW

credui

CredUIPromptForCredentialsW

duser

GetGadgetRect
SetGadgetStyle
ForwardGadgetMessage

dui70

?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
??1CritSecLock@DirectUI@@QAE@XZ
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?Register@HWNDElement@DirectUI@@SGJXZ
?SetAccDesc@Element@DirectUI@@QAEJPBG@Z
??0HWNDElement@DirectUI@@QAE@XZ
??1HWNDElement@DirectUI@@UAE@XZ
?Destroy@NativeHWNDHost@DirectUI@@QAEXXZ
?WndProc@HWNDElement@DirectUI@@UAEJPAUHWND__@@IIJ@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?GetRoot@Element@DirectUI@@QAEPAV12@XZ
StrToID
?GetHWND@HWNDElement@DirectUI@@UAEPAUHWND__@@XZ
?StartDefer@Element@DirectUI@@QAEXPAK@Z
?EndDefer@Element@DirectUI@@QAEXK@Z
?OnInput@HWNDElement@DirectUI@@UAEXPAUInputEvent@2@@Z
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?Release@Value@DirectUI@@QAEXXZ
?GetExtent@Element@DirectUI@@QAEPBUtagSIZE@@PAPAVValue@2@@Z
?Click@Button@DirectUI@@SG?AVUID@@XZ
?GetID@Element@DirectUI@@QAEGXZ
?KeyboardNavigate@Element@DirectUI@@SG?AVUID@@XZ
?OnEvent@HWNDElement@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@HWNDElement@DirectUI@@UAEXXZ
?Create@NativeHWNDHost@DirectUI@@SGJPBGPAUHWND__@@PAUHICON__@@HHHHHHIPAPAV12@@Z
?GetHWND@NativeHWNDHost@DirectUI@@QAEPAUHWND__@@XZ
?Initialize@HWNDElement@DirectUI@@QAEJPAUHWND__@@_NIPAVElement@2@PAK@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?SetAccRole@Element@DirectUI@@QAEJH@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?Host@NativeHWNDHost@DirectUI@@QAEXPAVElement@2@@Z
?ShowWindow@NativeHWNDHost@DirectUI@@QAEXH@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?UpdateSheets@DUIXmlParser@DirectUI@@QAEJPAVElement@2@@Z
?GetEnabled@Element@DirectUI@@QAE_NXZ
?GetDPI@Element@DirectUI@@QAEHXZ
??0ScrollViewer@DirectUI@@QAE@XZ
??1ScrollViewer@DirectUI@@UAE@XZ
?OnPropertyChanging@BaseScrollViewer@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@ScrollViewer@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnInput@BaseScrollViewer@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnEvent@BaseScrollViewer@DirectUI@@UAEXPAUEvent@2@@Z
?Add@BaseScrollViewer@DirectUI@@UAEJPAPAVElement@2@I@Z
?CreateScrollBars@ScrollViewer@DirectUI@@MAEJXZ
?AddChildren@ScrollViewer@DirectUI@@MAEJXZ
?OnListenerAttach@BaseScrollViewer@DirectUI@@UAEXPAVElement@2@@Z
?OnListenerDetach@BaseScrollViewer@DirectUI@@UAEXPAVElement@2@@Z
?OnListenedPropertyChanging@BaseScrollViewer@DirectUI@@UAE_NPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenedPropertyChanged@ScrollViewer@DirectUI@@UAEXPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenedInput@BaseScrollViewer@DirectUI@@UAEXPAVElement@2@PAUInputEvent@2@@Z
?OnListenedEvent@BaseScrollViewer@DirectUI@@UAEXPAVElement@2@PAUEvent@2@@Z
?GetClassInfoPtr@Expando@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@ScrollViewer@DirectUI@@SGPAUIClassInfo@2@XZ
?Initialize@BaseScrollViewer@DirectUI@@QAEJPAVElement@2@PAK@Z
?_PostEvent@Element@DirectUI@@AAEXPAUEvent@2@H@Z
?Register@ScrollViewer@DirectUI@@SGJXZ
?GetHScroll@ScrollViewer@DirectUI@@MAEPAVBaseScrollBar@2@XZ
?GetVScroll@ScrollViewer@DirectUI@@MAEPAVBaseScrollBar@2@XZ
?SetPadding@Element@DirectUI@@QAEJHHHH@Z
?SetXOffset@BaseScrollViewer@DirectUI@@QAEJH@Z
?XOffsetProp@BaseScrollViewer@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetHeight@Element@DirectUI@@QAEJH@Z
?GetDesiredSize@Element@DirectUI@@QAEPBUtagSIZE@@XZ
??1DCSurface@DirectUI@@UAE@XZ
??0DCSurface@DirectUI@@QAE@PAUHDC__@@@Z
?RemoveListener@Element@DirectUI@@QAEXPAUIElementListener@2@@Z
?Init@NavReference@DirectUI@@QAEXPAVElement@2@PAUtagRECT@@@Z
?Remove@Element@DirectUI@@QAEJPAV12@@Z
?ExpandCollapse_ExpandCollapseState_Property@Schema@DirectUI@@2HA
?GetIndex@Element@DirectUI@@QAEHXZ
??0IProvider@DirectUI@@QAE@XZ
?AdviseEventRemoved@ElementProvider@DirectUI@@UAGJHPAUtagSAFEARRAY@@@Z
?AdviseEventAdded@ElementProvider@DirectUI@@UAGJHPAUtagSAFEARRAY@@@Z
?get_FragmentRoot@ElementProvider@DirectUI@@UAGJPAPAUIRawElementProviderFragmentRoot@@@Z
?SetFocus@ElementProvider@DirectUI@@UAGJXZ
?GetEmbeddedFragmentRoots@ElementProvider@DirectUI@@UAGJPAPAUtagSAFEARRAY@@@Z
?get_BoundingRectangle@ElementProvider@DirectUI@@UAGJPAUUiaRect@@@Z
?GetRuntimeId@ElementProvider@DirectUI@@UAGJPAPAUtagSAFEARRAY@@@Z
?Navigate@ElementProvider@DirectUI@@UAGJW4NavigateDirection@@PAPAUIRawElementProviderFragment@@@Z
?get_HostRawElementProvider@ElementProvider@DirectUI@@UAGJPAPAUIRawElementProviderSimple@@@Z
?GetPropertyValue@ElementProvider@DirectUI@@UAGJHPAUtagVARIANT@@@Z
?get_ProviderOptions@ElementProvider@DirectUI@@UAGJPAW4ProviderOptions@@@Z
?TossElement@ElementProvider@DirectUI@@UAEXXZ
?QueryInterface@ElementProvider@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?Create@ElementProvider@DirectUI@@SGJPAVElement@2@PAVInvokeHelper@2@PAPAV12@@Z
?Create@HWNDElementProvider@DirectUI@@SGJPAVHWNDElement@2@PAVInvokeHelper@2@PAPAV12@@Z
?Find@ElementProviderManager@DirectUI@@SGPAVElementProvider@2@PAVElement@2@@Z
??0ElementProxy@DirectUI@@QAE@XZ
??0ProviderProxy@DirectUI@@IAE@XZ
??1ElementProvider@DirectUI@@UAE@XZ
??0RefcountBase@DirectUI@@QAE@XZ
??0ElementProvider@DirectUI@@QAE@XZ
?GetInvokeHelper@InvokeManager@DirectUI@@SGJPAPAVInvokeHelper@2@@Z
?IsPatternSupported@ElementProxy@DirectUI@@IAEJW4Pattern@Schema@2@PA_N@Z
?CreatePatternProvider@Schema@DirectUI@@SGJW4Pattern@12@PAVElementProvider@2@PAPAUIUnknown@@@Z
?Init@ProviderProxy@DirectUI@@MAEXPAVElement@2@@Z
??1AutoLock@DirectUI@@QAE@XZ
??0AutoLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?DoInvoke@ElementProvider@DirectUI@@IAAJHZZ
?PatternFromPatternId@Schema@DirectUI@@SG?AW4Pattern@12@H@Z
?Init@ElementProvider@DirectUI@@MAEJPAVElement@2@PAVInvokeHelper@2@@Z
?Release@ElementProvider@DirectUI@@UAGKXZ
?GetProperty@ElementProxy@DirectUI@@IAEJPAUtagVARIANT@@H@Z
?DoMethod@ElementProxy@DirectUI@@UAEJHPAD@Z
?Init@ElementProxy@DirectUI@@MAEXPAVElement@2@@Z
?DoInvokeArgs@ElementProvider@DirectUI@@QAEJHP6GPAVProviderProxy@2@PAVElement@2@@ZPAD@Z
?GetElement@ElementProvider@DirectUI@@UAEPDVElement@2@XZ
?TossPatternProvider@ElementProvider@DirectUI@@QAEXW4Pattern@Schema@2@@Z
??1RefcountBase@DirectUI@@UAE@XZ
?AddRef@ElementProvider@DirectUI@@UAGKXZ
?Release@RefcountBase@DirectUI@@QAEJXZ
?AddRef@RefcountBase@DirectUI@@QAEJXZ
?DataGridControlType@Schema@DirectUI@@2HA
?SelectionPattern@Schema@DirectUI@@2HA
?TablePattern@Schema@DirectUI@@2HA
?InvokePattern@Schema@DirectUI@@2HA
?TableItemPattern@Schema@DirectUI@@2HA
?IsControlElementProperty@Schema@DirectUI@@2HA
?IsContentElementProperty@Schema@DirectUI@@2HA
?TreeItemControlType@Schema@DirectUI@@2HA
?ListItemControlType@Schema@DirectUI@@2HA
?ControlTypeProperty@Schema@DirectUI@@2HA
?GridPattern@Schema@DirectUI@@2HA
?SelectionItemPattern@Schema@DirectUI@@2HA
?ExpandCollapsePattern@Schema@DirectUI@@2HA
?GridItemPattern@Schema@DirectUI@@2HA
?GetExpanded@Expandable@DirectUI@@QAE_NXZ
?UiaRaiseAutomationPropertyChangedEvent@Schema@DirectUI@@2P6GJPAUIRawElementProviderSimple@@HUtagVARIANT@@1@ZA
?GetAccessible@Element@DirectUI@@QAE_NXZ
?WantPropertyEvent@EventManager@DirectUI@@SG_NH@Z
?FWantAnyEvent@EventManager@DirectUI@@SG_NPAVElement@2@@Z
?OnReceivedDialogFocus@Button@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?OnLostDialogFocus@Button@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?DefaultAction@Button@DirectUI@@UAEJXZ
?OnInput@Button@DirectUI@@UAEXPAUInputEvent@2@@Z
??1Button@DirectUI@@UAE@XZ
??0Button@DirectUI@@QAE@XZ
?GetClassInfoPtr@Button@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@Button@DirectUI@@SGJXZ
?Register@Element@DirectUI@@SGJXZ
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?KeyFocusedProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?OnPropertyChanged@Button@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetVisible@Element@DirectUI@@QAE_NXZ
?GetBackgroundColor@Element@DirectUI@@QAEPBUFill@2@PAPAVValue@2@@Z
?Initialize@Button@DirectUI@@QAEJIPAVElement@2@PAK@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetClass@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetSelected@Element@DirectUI@@QAE_NXZ
?GetBool@Value@DirectUI@@QAE_NXZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z
?SetValue@Element@DirectUI@@QAEJPBUPropertyInfo@2@HPAVValue@2@@Z
?SetExpanded@Expandable@DirectUI@@QAEJ_N@Z
?SetPressed@Button@DirectUI@@QAEJ_N@Z
?GetBoolFalse@Value@DirectUI@@SGPAV12@XZ
?SetBackgroundColor@Element@DirectUI@@QAEJK@Z
?SetBorderThickness@Element@DirectUI@@QAEJHHHH@Z
?SetAccValue@Element@DirectUI@@QAEJPBG@Z
?SetAccItemStatus@Element@DirectUI@@QAEJPBG@Z
?CreateBool@Value@DirectUI@@SGPAV12@_N@Z
?SetAnimation@Element@DirectUI@@QAEJH@Z
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?HeightProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SortChildren@Element@DirectUI@@QAEJP6AHPBX0@Z@Z
?LayoutPosProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?RemoveLocalValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZ@Z
?CreateInt@Value@DirectUI@@SGPAV12@HW4DynamicScaleValue@@@Z
?HasPadding@Element@DirectUI@@QAE_NXZ
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
??1Element@DirectUI@@UAE@XZ
??0Element@DirectUI@@QAE@XZ
?SetBorderColor@Element@DirectUI@@QAEJK@Z
?HasBorder@Element@DirectUI@@QAE_NXZ
?GetInt@Value@DirectUI@@QAEHXZ
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?GetType@Value@DirectUI@@QBEHXZ
?CustomProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@P6GPBUPropertyInfo@2@XZHPAUUpdateCache@2@@Z
?KeyWithinProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?MouseWithinProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?SetActive@Element@DirectUI@@QAEJH@Z
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?Create@GridLayout@DirectUI@@SGJHHPAPAVLayout@2@@Z
?HasChildren@Element@DirectUI@@QAE_NXZ
?SetClass@Element@DirectUI@@QAEJPBG@Z
?GetKeyWithin@Element@DirectUI@@QAE_NXZ
?GetMouseWithin@Element@DirectUI@@QAE_NXZ
?Insert@Element@DirectUI@@QAEJPAV12@I@Z
?SetID@Element@DirectUI@@QAEJPBG@Z
?SetMinSize@Element@DirectUI@@QAEJHH@Z
?IsDescendent@Element@DirectUI@@QAE_NPAV12@@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?SetTooltip@Element@DirectUI@@QAEJ_N@Z
?SetSelected@Element@DirectUI@@QAEJ_N@Z
?SetXScrollable@BaseScrollViewer@DirectUI@@QAEJ_N@Z
?GetWidth@Element@DirectUI@@QAEHXZ
?SetWidth@Element@DirectUI@@QAEJH@Z
?GetSize@Value@DirectUI@@QAEPBUtagSIZE@@XZ
?ExtentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetKeyFocusedElement@HWNDElement@DirectUI@@SGPAVElement@2@XZ
UnInitProcessPriv
UnInitThread
InitThread
InitProcessPriv
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?IsDestroyed@Element@DirectUI@@QAE_NXZ
?GetLocation@Element@DirectUI@@QAEPBUtagPOINT@@PAPAVValue@2@@Z
?GetParent@Element@DirectUI@@QAEPAV12@XZ
?SetX@Element@DirectUI@@QAEJH@Z
?GetPadding@Element@DirectUI@@QAEPBUtagRECT@@PAPAVValue@2@@Z
?GetBorderThickness@Element@DirectUI@@QAEPBUtagRECT@@PAPAVValue@2@@Z
?SetContentAlign@Element@DirectUI@@QAEJH@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z
?OnNotify@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?OnPropertyChanged@HWNDHost@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetClassInfoPtr@HWNDHost@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@HWNDHost@DirectUI@@SGJXZ
?OnInput@HWNDHost@DirectUI@@UAEXPAUInputEvent@2@@Z
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?Release@Element@DirectUI@@QAGKXZ
?Initialize@HWNDHost@DirectUI@@QAEJIIPAVElement@2@PAK@Z
??1HWNDHost@DirectUI@@UAE@XZ
??0HWNDHost@DirectUI@@QAE@XZ
??1CCListView@DirectUI@@UAE@XZ
?PostCreate@CCBase@DirectUI@@MAEXPAUHWND__@@@Z
?OnReceivedDialogFocus@CCBase@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?OnLostDialogFocus@CCBase@DirectUI@@UAE_NPAUIDialogElement@2@@Z
?OnCustomDraw@CCBase@DirectUI@@UAE_NPAUtagNMCUSTOMDRAWINFO@@PAJ@Z
?EraseBkgnd@HWNDHost@DirectUI@@MAE_NPAUHDC__@@PAJ@Z
?SetWindowDirection@HWNDHost@DirectUI@@UAEXPAUHWND__@@@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UAEXIPBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSysChar@HWNDHost@DirectUI@@UAE_NG@Z
?DefaultAction@CCBase@DirectUI@@UAEJXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UAE_NXZ
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?OnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?MessageCallback@HWNDHost@DirectUI@@UAEIPAUtagGMSG@@@Z
?GetContentSize@CCListView@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@HWNDHost@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UAEXXZ
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@CCBase@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetClassInfoPtr@CCListView@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@CCListView@DirectUI@@SGJXZ
?OnInput@CCBase@DirectUI@@UAEXPAUInputEvent@2@@Z
?GetDisplayNode@Element@DirectUI@@QAEPAUHGADGET__@@XZ
?SetKeyFocus@HWNDHost@DirectUI@@UAEXXZ
?OnNotify@CCBase@DirectUI@@UAE_NIIJPAJ@Z
?OnMessage@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?GetRootRelativeBounds@Element@DirectUI@@QAEJPAUtagRECT@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UAEHHHI@Z
?GetHWND@HWNDHost@DirectUI@@UAEPAUHWND__@@XZ
?SetWinStyle@CCBase@DirectUI@@QAEJH@Z
?Initialize@CCListView@DirectUI@@QAEJIPAVElement@2@PAK@Z
?CreateHWND@CCBase@DirectUI@@UAEPAUHWND__@@PAU3@@Z
??0CCListView@DirectUI@@QAE@XZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?_OnUIStateChanged@HWNDElement@DirectUI@@MAEXGG@Z
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UAEXPAPBGPAI@Z
?IsMSAAEnabled@HWNDElement@DirectUI@@UAE_NXZ
?CanSetFocus@HWNDElement@DirectUI@@UAE_NXZ
?OnCompositionChanged@HWNDElement@DirectUI@@UAEXXZ
DisableAnimations
?StartNavigate@Browser@DirectUI@@SG?AVUID@@XZ
?FireEvent@Element@DirectUI@@QAEXPAUEvent@2@_N1@Z
?OnWmSettingChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UAEXPAUtagMSG@@PAJ@Z
EnableAnimations
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UAEXPAUKeyboardEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UAEXXZ
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?RemoveTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@K@Z
?UpdateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?GetLayoutPos@Element@DirectUI@@QAEHXZ
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnGroupChanged@HWNDElement@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@HWNDElement@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?IsRTL@Element@DirectUI@@QAE_NXZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
??1ClassInfoBase@DirectUI@@UAE@XZ
??0ClassInfoBase@DirectUI@@QAE@XZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?OnThemeChanged@HWNDElement@DirectUI@@UAEXPAUThemeChangedEvent@2@@Z

vdmdbg

VDMTerminateTaskWOW
VDMEnumProcessWOW
VDMEnumTaskWOWEx

api-ms-win-core-appcompat-l1-1-1

BaseReadAppCompatDataForProcess
BaseFreeAppCompatDataForProcess

kernel32

GetProcessorSystemCycleTime
RegisterApplicationRestart
PackageFamilyNameFromFullName
GetPackageFullName
GetActiveProcessorGroupCount
CreateTimerQueueTimer
DeleteTimerQueueTimer
RaiseException
SetProcessWorkingSetSize

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Sections

.text
Size: 563KB - Virtual size: 562KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 41KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 342KB - Virtual size: 341KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65a7b5c67424d195f99969f5a802cb65

Code Sign

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

e1:7c:c5:9e:cc:33:03:61:26:28:05:aa:92:bc:30:d2:ed:e6:dd:0e:74:7f:65:2b:fb:17:ff:c5:04:bb:3a:4bSigner

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

msvcrt

oleaut32

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-io-l1-1-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-file-l1-2-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

pcwum

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-localization-l2-1-0

comctl32

ntdll

uxtheme

shlwapi

shell32

credui

duser

dui70

vdmdbg

api-ms-win-core-appcompat-l1-1-1

kernel32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 563KB - Virtual size: 562KB

.imrsiv Size: - Virtual size: 4B

.data Size: 41KB - Virtual size: 44KB

.idata Size: 36KB - Virtual size: 36KB

.rsrc Size: 342KB - Virtual size: 341KB

.reloc Size: 38KB - Virtual size: 37KB

33:00:00:00:24:18:fc:0b:68:9e:73:99:d0:00:00:00:00:00:24
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

e1:7c:c5:9e:cc:33:03:61:26:28:05:aa:92:bc:30:d2:ed:e6:dd:0e:74:7f:65:2b:fb:17:ff:c5:04:bb:3a:4b
Signer

.text
Size: 563KB - Virtual size: 562KB

.imrsiv
Size: - Virtual size: 4B

.data
Size: 41KB - Virtual size: 44KB

.idata
Size: 36KB - Virtual size: 36KB

.rsrc
Size: 342KB - Virtual size: 341KB

.reloc
Size: 38KB - Virtual size: 37KB