Unconfirmed 653923[.]crdownload

Sharing

Copy URL Twitter E-mail

General

Target

Unconfirmed 653923.crdownload
Size

7.4MB
MD5

96c2b91747f92674632fc7976ca5147e
SHA1

ef27780705f56fc0db5dd77b620bbcd674654439
SHA256

f3c216cadc7c0b2236922a1e439414f936ef7a96592c67d41714198c2e56e70a
SHA512

4c821f5f01183385239b7741a0c08e8a35b7dff6e4a9a4494b2d8e03e4c2b0abd229667bf18a030e6f45bd3001ad868f3ed43b8c8c0c60c5e9e01dcfd3c20ee7
SSDEEP

196608:FzAgmwkpgI6+BaICCSF2+vAvhfrABsAZutMI7C/v2:Fzh4x6ovqsxAsAZuqQwe

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Dark Screen Stealer V2/Dark Screen Stealer.exe
unpack001/Dark Screen Stealer V2/chromedriver.exe
unpack001/Dark Screen Stealer V2/node/CPFilters.dll
unpack001/Dark Screen Stealer V2/node/Ionic.Zip.dll
unpack001/Dark Screen Stealer V2/node/Launcher.exe
unpack001/Dark Screen Stealer V2/node/dst.exe
unpack001/Dark Screen Stealer V2/node/opengl32.dll
unpack001/Dark Screen Stealer V2/node/stub.exe

Files

Unconfirmed 653923.crdownload
.rar

Password: infected
Dark Screen Stealer V2/Dark Screen Stealer.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Dark Screen Stealer V2/chromedriver.exe
.exe windows x86

Password: infected

251f0d264461093c96696e473be023d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
CreateProcessAsUserW
EventRegister
EventUnregister
EventWrite
InitializeAcl
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryValueExW
SetSecurityDescriptorDacl
SystemFunction036

shell32

CommandLineToArgvW
SHGetFolderPathW
SHGetKnownFolderPath

user32

ActivateKeyboardLayout
AllowSetForegroundWindow
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
GetKeyboardLayoutList
GetKeyboardLayoutNameW
GetQueueStatus
GetWindowLongW
KillTimer
LoadKeyboardLayoutW
MapVirtualKeyW
MsgWaitForMultipleObjectsEx
PeekMessageW
PostMessageW
PostQuitMessage
RegisterClassExW
SetTimer
SetWindowLongW
ToUnicode
TranslateMessage
UnregisterClassW
VkKeyScanW

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

ws2_32

WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAGetOverlappedResult
WSAIoctl
WSARecvFrom
WSAResetEvent
WSASend
WSASendTo
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
htonl
ioctlsocket
listen
ntohs
recv
recvfrom
sendto
setsockopt
shutdown
socket

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AssignProcessToJobObject
CancelIo
ChangeTimerQueueTimer
CloseHandle
CompareStringW
ConnectNamedPipe
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateNamedPipeW
CreateProcessW
CreateThread
CreateTimerQueue
CreateTimerQueueTimer
DecodePointer
DeleteCriticalSection
DeleteFileW
DeleteTimerQueueTimer
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetCurrencyFormatEx
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatEx
GetDiskFreeSpaceExW
GetDriveTypeW
GetDynamicTimeZoneInformation
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetGeoInfoW
GetLastError
GetLocalTime
GetLocaleInfoEx
GetLocaleInfoW
GetLogicalProcessorInformation
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetNumaHighestNodeNumber
GetNumberFormatEx
GetOEMCP
GetProcAddress
GetProcessAffinityMask
GetProcessId
GetProcessTimes
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadId
GetThreadPriority
GetThreadTimes
GetTickCount
GetTimeFormatEx
GetTimeZoneInformation
GetUserDefaultLCID
GetUserGeoID
GetVersionExW
GetWindowsDirectoryW
GlobalFree
GlobalMemoryStatusEx
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InitializeSRWLock
InterlockedFlushSList
InterlockedPopEntrySList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
K32QueryWorkingSetEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OutputDebugStringA
PostQueuedCompletionStatus
QueryDepthSList
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
RegisterWaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryW
ReplaceFileW
ResetEvent
ResolveLocaleName
RtlCaptureStackBackTrace
RtlUnwind
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetStdHandle
SetThreadAffinityMask
SetThreadPriority
SetUnhandledExceptionFilter
SignalObjectAndWait
Sleep
SleepConditionVariableSRW
SwitchToThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
TryEnterCriticalSection
TzSpecificLocalTimeToSystemTime
UnhandledExceptionFilter
UnmapViewOfFile
UnregisterWait
UnregisterWaitEx
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile

iphlpapi

GetAdaptersAddresses

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

shlwapi

PathMatchSpecW

dbghelp

SymFromAddr
SymGetLineFromAddr64
SymGetSearchPathW
SymInitialize
SymSetOptions
SymSetSearchPathW

ole32

CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize
PropVariantClear

secur32

AcquireCredentialsHandleW
DeleteSecurityContext
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextW
QuerySecurityPackageInfoW

winhttp

WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpSetTimeouts

crypt32

CertAddEncodedCertificateToStore
CertCloseStore
CertCompareCertificateName
CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetIssuerCertificateFromStore
CertOpenStore
CertSetCertificateContextProperty
CertVerifyCertificateChainPolicy
CryptDecodeObjectEx
CryptInstallOIDFunctionAddress
CryptVerifyCertificateSignatureEx

Exports

Exports

GetHandleVerifier

Sections

.text
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 169B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.voltbl
Size: 1024B - Virtual size: 776B

CPADinfo
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

prot
Size: 512B - Virtual size: 193B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Dark Screen Stealer V2/designmode.css
Dark Screen Stealer V2/node/CPFilters.dll
.dll regsvr32 windows x64

Password: infected

7afea2ed1708d746b6cb468206853322

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_wtol
tolower
_CxxThrowException
wcschr
_amsg_exit
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
__CxxFrameHandler3
_onexit
_wcsnicmp
realloc
_XcptFilter
??1type_info@@UEAA@XZ
memcpy
memset
memcmp
_wcsicmp
memmove
sscanf_s
wcsncmp
isupper
wcsstr
swscanf
_beginthreadex
_endthread
swprintf_s
iswxdigit
swscanf_s
srand
wcsncpy_s
strnlen
strcat_s
wcstoul
wcscat_s
strncpy_s
wcsnlen
_time32
time
rand
??0exception@@QEAA@XZ
_vsnwprintf_s
_callnewh
malloc
free
__C_specific_handler
_vsnwprintf
memmove_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_purecall
memcpy_s
wcspbrk
wcscmp

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlGetPersistedStateLocation
RtlCaptureContext

advapi32

RegDeleteKeyW
CryptAcquireContextA
TraceMessage
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptGenRandom
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

crypt32

CertGetCertificateChain
CertFreeCertificateChain
CertGetNameStringW
CertVerifyCertificateChainPolicy

kernel32

DebugBreak
LocalAlloc
GlobalAlloc
GlobalFree
GetVersion
GetEnvironmentStringsW
GlobalMemoryStatusEx
GetProcessHeap
HeapAlloc
FreeEnvironmentStringsW
DeviceIoControl
GetDiskFreeSpaceW
HeapFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringA
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
QueryPerformanceCounter
GetSystemTime
GetGeoInfoA
IsDebuggerPresent
RaiseException
WriteFile
ReadFile
lstrlenW
SetFilePointer
GlobalLock
GetFileSize
GlobalUnlock
CompareStringW
lstrlenA
FreeEnvironmentStringsA
TerminateProcess
ExpandEnvironmentStringsW
WaitForMultipleObjects
WaitForSingleObject
LoadLibraryW
GetProcAddress
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DecodeSystemPointer
Sleep
OutputDebugStringW
EncodeSystemPointer
DeleteCriticalSection
GetCurrentProcessId
VirtualProtect
GetCurrentProcess
GetModuleFileNameW
ResumeThread
GetLastError
RaiseFailFastException
GetCurrentThread
CloseHandle
GetModuleHandleW
LoadLibraryExW
DisableThreadLibraryCalls
GetVersionExW
GetModuleFileNameA
MultiByteToWideChar
lstrcmpW
CreateEventW
ResetEvent
GetCurrentThreadId
SetEvent
CreateThread
GetTickCount
SetThreadPriority
lstrcmpiW
CompareFileTime
GetSystemTimeAsFileTime
WideCharToMultiByte
GetLocalTime
SystemTimeToFileTime
GetSystemFirmwareTable
LocalFree
GetTickCount64
GetModuleHandleExW
CreateFileW

ole32

CoFileTimeNow
PropVariantClear
CLSIDFromString
PropVariantCopy
CoTaskMemAlloc
CoUninitialize
CoFreeUnusedLibraries
CoInitializeEx
StringFromGUID2
CoCreateInstance
CoCreateGuid
CoTaskMemFree

oleaut32

SafeArrayGetUBound
SafeArrayDestroy
VariantCopy
VariantChangeType
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
VariantClear
VariantInit
SafeArrayCreate
SysStringByteLen

slc

SLGetWindowsInformationDWORD

winmm

timeGetTime

wintrust

CryptCATCatalogInfoFromContext
WinVerifyTrust
WTHelperProvDataFromStateData

mfplat

MFCreateCollection

ws2_32

htonl

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
UpdatePlayready

Sections

.text
Size: 637KB - Virtual size: 636KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Dark Screen Stealer V2/node/Ionic.Zip.dll
.dll windows x86

Password: infected

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Dark Screen Stealer V2/node/LICENCE.dat
.zip
Dark Screen Stealer V2/node/Launcher.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Dark Screen Stealer V2/node/dst.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 399KB - Virtual size: 398KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 231B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 350KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Dark Screen Stealer V2/node/opengl32.dll
.dll windows x64

Password: infected

deac43293469a2560a8e6db37b559d90

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

qsort
wcsspn
strncmp
toupper
wcsncmp
wcsrchr
wcsstr
_wcslwr
wcscat_s
wcscpy_s
_wcsicmp
swscanf_s
swprintf_s
_wcsnicmp
memmove_s
wcschr
_purecall
??3@YAXPEAX@Z
_wtoi
memcpy_s
_vsnwprintf
malloc
free
memmove
memcpy
_initterm
_lock
memcmp
floor
cos
ceil
atan2
_unlock
__dllonexit
_onexit
sin
__C_specific_handler
memset
_amsg_exit
_XcptFilter
wcstol
pow
sqrt

kernel32

GetLongPathNameW
GetCurrentPackageFamilyName
CreateThreadpoolTimer
SetThreadpoolTimer
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
InitOnceComplete
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
FormatMessageW
OpenProcess
GetApplicationUserModelId
ReleaseMutex
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
K32GetModuleFileNameExW
GetModuleFileNameW
GetPackageFamilyName
GetCurrentApplicationUserModelId
GetModuleHandleExW
ReleaseSemaphore
CreateSemaphoreExW
InitOnceBeginInitialize
GetModuleFileNameA
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
CreateThread
DebugBreak
OpenThread
Sleep
CloseHandle
TerminateThread
WaitForSingleObject
GetModuleHandleW
AcquireSRWLockShared
ReleaseSRWLockShared
MulDiv
FreeLibrary
LoadLibraryW
GetLastError
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
SetLastError
HeapReAlloc
TlsFree
TlsGetValue
VerifyVersionInfoW
GetProcessHeap
VerSetConditionMask
DeleteCriticalSection
GetProcAddress
CreateMutexExW
TlsAlloc
GetModuleHandleA
GetVersionExW
SetErrorMode
InitializeCriticalSection
VirtualAlloc
VirtualFree
HeapFree
TlsSetValue
GetDriveTypeW
ExpandEnvironmentStringsW
LoadLibraryExW
HeapAlloc
DelayLoadFailureHook
ResolveDelayLoadedAPI
FindClose
FindNextFileW
FindFirstFileW
FreeEnvironmentStringsW
GetEnvironmentStringsW

advapi32

RegCloseKey
EventWriteTransfer
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
EventRegister
EventSetInformation
EventUnregister

user32

GetClientRect
FillRect
DefWindowProcW
GetSystemMetrics
WindowFromDC
DisplayConfigGetDeviceInfo
EnumDisplayDevicesA
GetDisplayConfigBufferSizes
QueryDisplayConfig
GetMonitorInfoW
GetWindowLongPtrW
SetWindowLongPtrW
PostMessageW
GetDC
ReleaseDC
GetWindowThreadProcessId
CreateWindowExW
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
RegisterClassW
CallWindowProcW
ClientToScreen
InvalidateRect
IsWindow

ntdll

ZwQueryValueKey
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlFormatCurrentUserKeyPath
ZwCreateFile
ZwQueryInformationFile
ZwCreateSection
ZwQueryInformationProcess
ZwSetInformationProcess
RtlGUIDFromString
RtlInitString
RtlxAnsiStringToUnicodeSize
RtlAnsiStringToUnicodeString
RtlUpcaseUnicodeString
RtlUnicodeStringToAnsiString
ZwQueryDirectoryFile
RtlpEnsureBufferSize
RtlNtPathNameToDosPathName
ZwUnmapViewOfSection
ZwMapViewOfSection
LdrResSearchResource
RtlVerifyVersionInfo
RtlImageDirectoryEntryToData
RtlGetVersion
RtlInitUnicodeStringEx
NtClose
RtlRunOnceExecuteOnce
ZwQueryKey
ZwEnumerateValueKey
RtlUnicodeStringToInteger
RtlCopyUnicodeString
RtlFreeUnicodeString
ZwOpenFile
RtlDosPathNameToNtPathName_U_WithStatus
ZwQuerySystemInformation
RtlGetNativeSystemInformation
RtlUpcaseUnicodeChar
RtlInitUnicodeString
NtQueryValueKey
ZwClose
RtlFreeHeap
ZwEnumerateKey
RtlReAllocateHeap
RtlAllocateHeap
NtQueryWnfStateData
NtQueryInformationProcess
DbgPrint
ZwOpenKey

gdi32

SelectObject
GetPixelFormat
SwapBuffers
DescribePixelFormat
SetROP2
SetDIBitsToDevice
PolyPolyline
CreatePen
GetSystemPaletteEntries
CreateSolidBrush
GetPixel
SetBitmapBits
GdiFlush
BitBlt
GetBitmapBits
SetPixel
RealizePalette
GetNearestPaletteIndex
CreatePalette
CreateDIBSection
SetDIBColorTable
GetPaletteEntries
GetDIBColorTable
GetGlyphOutlineA
SelectPalette
GdiSetPixelFormat
GdiDescribePixelFormat
GdiSwapBuffers
D3DKMTPresent
D3DKMTSubmitPresentToHwQueue
D3DKMTSetVidPnSourceOwner1
ExtTextOutA
CreateCompatibleDC
GetLayout
GetCharABCWidthsA
GetDIBits
SetTextColor
GetOutlineTextMetricsW
GetCharABCWidthsW
SetBkColor
GetTextMetricsA
SetMapMode
CreateBitmap
SetTextAlign
GetCharWidthA
ExtTextOutW
GetCharWidthW
CreateCompatibleBitmap
D3DKMTCloseAdapter
GetObjectW
GetGlyphOutlineW
DeleteObject
CreateFontIndirectW
GetCurrentObject
D3DKMTGetCachedHybridQueryValue
D3DKMTCacheHybridQueryValue
GetStockObject
SetBkMode
D3DKMTOpenAdapterFromLuid
GetDeviceCaps
DeleteDC
ExtEscape
CreateDCA
D3DKMTQueryAdapterInfo
GetObjectType
ModifyWorldTransform
GetWindowExtEx
GetWorldTransform
GetClipRgn
GetWindowOrgEx
CreateRectRgn
GetViewportExtEx
GetMapMode
GetViewportOrgEx

glu32

gluTessCallback
gluDeleteTess
gluTessNormal
gluTessProperty
gluNewTess
gluTessBeginContour
gluTessBeginPolygon
gluTessEndContour
gluTessVertex
gluTessEndPolygon

api-ms-win-core-com-l1-1-0

CoTaskMemFree

Exports

Exports

GlmfBeginGlsBlock
GlmfCloseMetaFile
GlmfEndGlsBlock
GlmfEndPlayback
GlmfInitPlayback
GlmfPlayGlsRecord
glAccum
glAlphaFunc
glAreTexturesResident
glArrayElement
glBegin
glBindTexture
glBitmap
glBlendFunc
glCallList
glCallLists
glClear
glClearAccum
glClearColor
glClearDepth
glClearIndex
glClearStencil
glClipPlane
glColor3b
glColor3bv
glColor3d
glColor3dv
glColor3f
glColor3fv
glColor3i
glColor3iv
glColor3s
glColor3sv
glColor3ub
glColor3ubv
glColor3ui
glColor3uiv
glColor3us
glColor3usv
glColor4b
glColor4bv
glColor4d
glColor4dv
glColor4f
glColor4fv
glColor4i
glColor4iv
glColor4s
glColor4sv
glColor4ub
glColor4ubv
glColor4ui
glColor4uiv
glColor4us
glColor4usv
glColorMask
glColorMaterial
glColorPointer
glCopyPixels
glCopyTexImage1D
glCopyTexImage2D
glCopyTexSubImage1D
glCopyTexSubImage2D
glCullFace
glDebugEntry
glDeleteLists
glDeleteTextures
glDepthFunc
glDepthMask
glDepthRange
glDisable
glDisableClientState
glDrawArrays
glDrawBuffer
glDrawElements
glDrawPixels
glEdgeFlag
glEdgeFlagPointer
glEdgeFlagv
glEnable
glEnableClientState
glEnd
glEndList
glEvalCoord1d
glEvalCoord1dv
glEvalCoord1f
glEvalCoord1fv
glEvalCoord2d
glEvalCoord2dv
glEvalCoord2f
glEvalCoord2fv
glEvalMesh1
glEvalMesh2
glEvalPoint1
glEvalPoint2
glFeedbackBuffer
glFinish
glFlush
glFogf
glFogfv
glFogi
glFogiv
glFrontFace
glFrustum
glGenLists
glGenTextures
glGetBooleanv
glGetClipPlane
glGetDoublev
glGetError
glGetFloatv
glGetIntegerv
glGetLightfv
glGetLightiv
glGetMapdv
glGetMapfv
glGetMapiv
glGetMaterialfv
glGetMaterialiv
glGetPixelMapfv
glGetPixelMapuiv
glGetPixelMapusv
glGetPointerv
glGetPolygonStipple
glGetString
glGetTexEnvfv
glGetTexEnviv
glGetTexGendv
glGetTexGenfv
glGetTexGeniv
glGetTexImage
glGetTexLevelParameterfv
glGetTexLevelParameteriv
glGetTexParameterfv
glGetTexParameteriv
glHint
glIndexMask
glIndexPointer
glIndexd
glIndexdv
glIndexf
glIndexfv
glIndexi
glIndexiv
glIndexs
glIndexsv
glIndexub
glIndexubv
glInitNames
glInterleavedArrays
glIsEnabled
glIsList
glIsTexture
glLightModelf
glLightModelfv
glLightModeli
glLightModeliv
glLightf
glLightfv
glLighti
glLightiv
glLineStipple
glLineWidth
glListBase
glLoadIdentity
glLoadMatrixd
glLoadMatrixf
glLoadName
glLogicOp
glMap1d
glMap1f
glMap2d
glMap2f
glMapGrid1d
glMapGrid1f
glMapGrid2d
glMapGrid2f
glMaterialf
glMaterialfv
glMateriali
glMaterialiv
glMatrixMode
glMultMatrixd
glMultMatrixf
glNewList
glNormal3b
glNormal3bv
glNormal3d
glNormal3dv
glNormal3f
glNormal3fv
glNormal3i
glNormal3iv
glNormal3s
glNormal3sv
glNormalPointer
glOrtho
glPassThrough
glPixelMapfv
glPixelMapuiv
glPixelMapusv
glPixelStoref
glPixelStorei
glPixelTransferf
glPixelTransferi
glPixelZoom
glPointSize
glPolygonMode
glPolygonOffset
glPolygonStipple
glPopAttrib
glPopClientAttrib
glPopMatrix
glPopName
glPrioritizeTextures
glPushAttrib
glPushClientAttrib
glPushMatrix
glPushName
glRasterPos2d
glRasterPos2dv
glRasterPos2f
glRasterPos2fv
glRasterPos2i
glRasterPos2iv
glRasterPos2s
glRasterPos2sv
glRasterPos3d
glRasterPos3dv
glRasterPos3f
glRasterPos3fv
glRasterPos3i
glRasterPos3iv
glRasterPos3s
glRasterPos3sv
glRasterPos4d
glRasterPos4dv
glRasterPos4f
glRasterPos4fv
glRasterPos4i
glRasterPos4iv
glRasterPos4s
glRasterPos4sv
glReadBuffer
glReadPixels
glRectd
glRectdv
glRectf
glRectfv
glRecti
glRectiv
glRects
glRectsv
glRenderMode
glRotated
glRotatef
glScaled
glScalef
glScissor
glSelectBuffer
glShadeModel
glStencilFunc
glStencilMask
glStencilOp
glTexCoord1d
glTexCoord1dv
glTexCoord1f
glTexCoord1fv
glTexCoord1i
glTexCoord1iv
glTexCoord1s
glTexCoord1sv
glTexCoord2d
glTexCoord2dv
glTexCoord2f
glTexCoord2fv
glTexCoord2i
glTexCoord2iv
glTexCoord2s
glTexCoord2sv
glTexCoord3d
glTexCoord3dv
glTexCoord3f
glTexCoord3fv
glTexCoord3i
glTexCoord3iv
glTexCoord3s
glTexCoord3sv
glTexCoord4d
glTexCoord4dv
glTexCoord4f
glTexCoord4fv
glTexCoord4i
glTexCoord4iv
glTexCoord4s
glTexCoord4sv
glTexCoordPointer
glTexEnvf
glTexEnvfv
glTexEnvi
glTexEnviv
glTexGend
glTexGendv
glTexGenf
glTexGenfv
glTexGeni
glTexGeniv
glTexImage1D
glTexImage2D
glTexParameterf
glTexParameterfv
glTexParameteri
glTexParameteriv
glTexSubImage1D
glTexSubImage2D
glTranslated
glTranslatef
glVertex2d
glVertex2dv
glVertex2f
glVertex2fv
glVertex2i
glVertex2iv
glVertex2s
glVertex2sv
glVertex3d
glVertex3dv
glVertex3f
glVertex3fv
glVertex3i
glVertex3iv
glVertex3s
glVertex3sv
glVertex4d
glVertex4dv
glVertex4f
glVertex4fv
glVertex4i
glVertex4iv
glVertex4s
glVertex4sv
glVertexPointer
glViewport
wglChoosePixelFormat
wglCopyContext
wglCreateContext
wglCreateLayerContext
wglDeleteContext
wglDescribeLayerPlane
wglDescribePixelFormat
wglGetCurrentContext
wglGetCurrentDC
wglGetDefaultProcAddress
wglGetLayerPaletteEntries
wglGetPixelFormat
wglGetProcAddress
wglMakeCurrent
wglRealizeLayerPalette
wglSetLayerPaletteEntries
wglSetPixelFormat
wglShareLists
wglSwapBuffers
wglSwapLayerBuffers
wglSwapMultipleBuffers
wglUseFontBitmapsA
wglUseFontBitmapsW
wglUseFontOutlinesA
wglUseFontOutlinesW

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Dark Screen Stealer V2/node/stub.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 369KB - Virtual size: 368KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 350KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Dark Screen Stealer V2/shell32.dll
.dll regsvr32 windows x64

f97ab8ac730f427e1f34cef66fb42a94

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:85:26:e2:39:ed:75:06:05:72:ce:b8:95:25:e7:b4:14:16:04:09:5d:2a:ad:b1:3c:76:78:d2:a0:ac:b7:81
Signer

Actual PE Digest

af:85:26:e2:39:ed:75:06:05:72:ce:b8:95:25:e7:b4:14:16:04:09:5d:2a:ad:b1:3c:76:78:d2:a0:ac:b7:81

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-string-l1-1-0

wcsspn
memset
wcscmp
wcsncmp
wcscspn
wcspbrk

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o_sqrt
_o_srand
_o_strncpy_s
_o_toupper
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
_o_wcstol
_o_wcstoul
strchr
wcsrchr
__std_terminate
__CxxFrameHandler3
_o__ui64tow_s
_o_realloc
_o_rand
_o_qsort
_o_pow
_o_malloc
_o__strnicmp
_o_log
memmove
_o_iswalpha
_o__set_errno
_o__seh_filter_dll
_o__resetstkoflw
_o__register_onexit_function
_o_isdigit
_o_isalpha
_o__purecall
_o_free
_o_floor
_o_exp
_o_ceil
_o_calloc
_o_bsearch
_o__wtoi
_o__wcsupr
_o__wcstoui64
_o__wcsnicmp
_o__wcsicmp
_o__itow
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__get_errno
_o__execute_onexit_table
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
wcschr
wcsstr
__C_specific_handler
memcmp
memcpy

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalFree
LocalFree
GlobalAlloc
LocalReAlloc

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegNotifyChangeKeyValue
RegQueryValueExA
RegOpenKeyExA
RegOpenCurrentUser
RegQueryInfoKeyA
RegDeleteTreeW
RegOpenKeyExW
RegGetKeySecurity
RegQueryInfoKeyW
RegGetValueW
RegQueryValueExW
RegEnumKeyExW
RegDeleteKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegEnumValueW

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
EnumResourceNamesExW
LoadResource
LoadLibraryExA
GetModuleFileNameA
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
LoadStringW
DisableThreadLibraryCalls
FindResourceExW
FreeResource
LockResource
LoadLibraryExW
SizeofResource
LoadStringA
FindStringOrdinal
GetModuleHandleExW

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetTickCount64
GetSystemTime
GlobalMemoryStatusEx
GetSystemDirectoryW
GetSystemInfo
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetTickCount
GetVersionExW
GetLocalTime

api-ms-win-core-memory-l1-1-0

MapViewOfFile
WriteProcessMemory
UnmapViewOfFile
VirtualQuery
VirtualAlloc
VirtualProtect
ReadProcessMemory
OpenFileMappingW
CreateFileMappingW
VirtualFree

api-ms-win-core-file-l1-1-0

QueryDosDeviceW
GetFileAttributesExW
GetFileInformationByHandle
CompareFileTime
DefineDosDeviceW
GetFileAttributesW
GetFileSizeEx
LocalFileTimeToFileTime
RemoveDirectoryW
FindFirstFileExW
FileTimeToLocalFileTime
WriteFile
GetFullPathNameW
GetShortPathNameW
SetFilePointer
GetLongPathNameW
FindFirstVolumeW
DeleteFileW
GetFileSize
ReadFile
GetTempFileNameW
FindNextVolumeW
GetDiskFreeSpaceW
FindClose
FindNextFileW
CreateFileW
FindVolumeClose
GetDiskFreeSpaceExW
SetFileTime
FindFirstFileW
GetVolumePathNameW
GetVolumeInformationW
SetEndOfFile
CreateDirectoryW
GetLogicalDrives
SetFileInformationByHandle
FlushFileBuffers
SetFilePointerEx
SetFileAttributesW
GetDriveTypeW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-libraryloader-l1-2-1

FindResourceW
LoadLibraryW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
GetStringTypeW
CompareStringW
MultiByteToWideChar
CompareStringEx
GetStringTypeExW
WideCharToMultiByte

api-ms-win-core-synch-l1-1-0

ResetEvent
SetEvent
CreateSemaphoreExW
CreateEventW
EnterCriticalSection
OpenEventW
AcquireSRWLockShared
ReleaseSemaphore
CreateMutexExW
ReleaseSRWLockShared
ReleaseMutex
SetWaitableTimer
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
CreateMutexW
CreateEventExW
InitializeSRWLock
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjectsEx
TryAcquireSRWLockShared
TryEnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
LeaveCriticalSection
InitializeCriticalSection
OpenMutexW
TryAcquireSRWLockExclusive
CreateWaitableTimerExW
WaitForSingleObject
AcquireSRWLockExclusive
DeleteCriticalSection

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
SetErrorMode
GetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
TlsGetValue
TlsSetValue
SetThreadToken
GetCurrentProcess
SetThreadPriority
GetThreadPriority
OpenThread
GetThreadId
GetExitCodeThread
TlsAlloc
GetProcessId
ExitProcess
GetExitCodeProcess
ProcessIdToSessionId
CreateProcessAsUserW
GetCurrentThread
OpenThreadToken
ResumeThread
SetPriorityClass
TlsFree
CreateThread
CreateProcessW

api-ms-win-core-string-l2-1-0

CharPrevW
CharLowerW
CharUpperW
CharLowerBuffW
CharUpperBuffW
CharNextW
IsCharAlphaW

api-ms-win-core-file-l2-1-0

MoveFileExW
ReadDirectoryChangesW
ReplaceFileW
CreateHardLinkW
GetFileInformationByHandleEx
CopyFile2

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
ExpandEnvironmentStringsA
SetEnvironmentVariableW
SearchPathW
SetCurrentDirectoryW
GetEnvironmentVariableW
GetCurrentDirectoryW
ExpandEnvironmentStringsW

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
AccessCheck
DeleteAce
DuplicateTokenEx
GetSecurityDescriptorOwner
ImpersonateSelf
RevertToSelf
IsWellKnownSid
GetSidIdentifierAuthority
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSidSubAuthorityCount
InitializeAcl
InitializeSid
GetSidSubAuthority
GetFileSecurityW
CheckTokenMembership
CreateWellKnownSid
EqualSid
GetTokenInformation
GetSecurityDescriptorControl
DuplicateToken
SetFileSecurityW
AddAccessAllowedAceEx
AddAccessDeniedAceEx
AddAce
GetAce
SetSecurityDescriptorOwner
GetAclInformation
SetTokenInformation
CopySid
GetLengthSid
IsValidSid
GetSidLengthRequired
AdjustTokenPrivileges
FreeSid

api-ms-win-core-heap-l1-1-0

HeapDestroy
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
LCMapStringEx
GetUserDefaultLangID
GetThreadLocale
VerLanguageNameW
FindNLSStringEx
LocaleNameToLCID
GetThreadUILanguage
GetSystemPreferredUILanguages
IsValidLocaleName
GetACP
ResolveLocaleName
GetSystemDefaultLCID
LCMapStringW
IsDBCSLeadByte
GetSystemDefaultLangID
GetUserDefaultLCID
GetUserPreferredUILanguages
FindNLSString
GetCPInfo
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformationForYear
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWait
CloseThreadpoolWork
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
SetThreadpoolWait

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess
FlushInstructionCache

api-ms-win-core-psapi-l1-1-0

K32GetProcessImageFileNameW
QueryFullProcessImageNameW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
Sleep
InitOnceExecuteOnce

api-ms-win-core-path-l1-1-0

PathCchCanonicalize
PathCchRemoveExtension
PathCchStripPrefix
PathCchRemoveFileSpec
PathAllocCanonicalize
PathCchAppend
PathCchAppendEx
PathCchRemoveBackslash
PathCchSkipRoot
PathCchAddExtension
PathCchAddBackslash
PathAllocCombine
PathCchRenameExtension
PathIsUNCEx
PathCchAddBackslashEx
PathCchCombineEx
PathCchCombine
PathCchStripToRoot

api-ms-win-core-file-l1-2-0

GetTempPathW
GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-core-io-l1-1-0

GetOverlappedResult
GetQueuedCompletionStatus
CancelIoEx
DeviceIoControl
CreateIoCompletionPort

api-ms-win-core-datetime-l1-1-0

GetDateFormatW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-file-l1-2-1

GetCompressedFileSizeW

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW
IsWow64Process2
Wow64SetThreadDefaultGuestMachine

api-ms-win-core-wow64-l1-1-0

Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-localization-l2-1-0

GetNumberFormatEx

api-ms-win-devices-config-l1-1-1

CM_Get_Device_Interface_PropertyW
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Get_Device_IDW
CM_Locate_DevNodeW

api-ms-win-core-io-l1-1-1

CancelSynchronousIo

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-core-sysinfo-l1-2-3

GetIntegratedDisplaySize

api-ms-win-core-memory-l1-1-1

PrefetchVirtualMemory

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister
EventActivityIdControl
EventProviderEnabled

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceLoggerHandle

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InitializeSListHead
InterlockedPopEntrySList

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNIW
StrCmpNIA
StrCmpNA
StrChrW
StrChrIW
StrChrIA
StrChrA
StrRChrA
StrRChrIA
StrPBrkW
StrCpyNXW
StrRChrIW
StrRChrW
StrSpnW
StrToIntA
StrCmpNW
StrCSpnW
StrRStrIA
StrRStrIW
StrStrA
StrCmpLogicalW
StrStrIA
StrStrIW
StrCmpNICW
StrCmpW
StrDupA
StrStrW
StrCmpICW
StrTrimW
StrDupW
StrToIntExW
StrCmpICA
StrCmpIW
StrToIntW
QISearch
StrCmpNCW
StrCmpCW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrlenA
lstrcmpiW
lstrlenW
lstrcmpA
lstrcmpiA

api-ms-win-core-stringansi-l1-1-0

CharNextA
CharPrevA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalFlags
LocalSize
GlobalLock
GlobalSize
GlobalReAlloc

api-ms-win-core-localization-obsolete-l1-2-0

EnumUILanguagesW
GetNumberFormatW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileStringW
GetPrivateProfileSectionW
GetProfileSectionW
WritePrivateProfileStringW

api-ms-win-core-atoms-l1-1-0

FindAtomW
GlobalAddAtomW
GlobalGetAtomNameW
GlobalDeleteAtom
GetAtomNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathQuoteSpacesW
PathFindFileNameW
SHExpandEnvironmentStringsA
PathIsUNCW
PathAppendW
SHExpandEnvironmentStringsW
PathCommonPrefixW
PathIsSameRootW
PathGetDriveNumberW
PathFindExtensionW
IsCharSpaceW
PathAppendA
PathIsRootA
PathRemoveFileSpecA
PathRemoveBackslashW
PathIsUNCServerW
PathGetCharTypeW
PathIsFileSpecW
PathIsValidCharW
PathStripPathW
PathGetArgsW
PathRemoveBlanksW
PathMatchSpecExW
PathIsUNCServerShareW
PathUnquoteSpacesW
PathUnExpandEnvStringsW
PathParseIconLocationW
PathFindNextComponentW
PathIsRelativeW
PathIsRootW
PathStripToRootW
PathMatchSpecW
PathRemoveFileSpecW
PathFileExistsW
PathIsPrefixW
PathSkipRootW
PathCombineW
PathAddBackslashW
PathRemoveExtensionW

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
GetShortPathNameA
GetSystemPowerStatus
MulDiv
WTSGetActiveConsoleSessionId
SetVolumeLabelW
RegisterWaitForSingleObject
UnregisterWait

api-ms-win-core-kernel32-legacy-l1-1-1

PowerCreateRequest
PowerSetRequest
PowerClearRequest

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
QueueUserWorkItem

api-ms-win-core-kernel32-legacy-l1-1-2

GetBinaryTypeW

api-ms-win-core-url-l1-1-0

UrlApplySchemeW
PathIsURLW
UrlIsW
PathCreateFromUrlW
UrlEscapeW
UrlUnescapeW
UrlUnescapeA
PathCreateFromUrlAlloc
UrlCreateFromPathW
UrlCanonicalizeW
ParseURLW
HashData
UrlCompareW
UrlFixupW
UrlGetPartW

api-ms-win-core-registryuserspecific-l1-1-0

SHRegCloseUSKey
SHRegEnumUSKeyW
SHRegGetUSValueW
SHRegGetBoolUSValueW
SHRegOpenUSKeyW
SHRegQueryUSValueW
SHRegOpenUSKeyA

api-ms-win-core-kernel32-private-l1-1-0

CheckElevationEnabled
CheckElevation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-sidebyside-l1-1-0

DeactivateActCtx
ActivateActCtx
QueryActCtxW
ReleaseActCtx
CreateActCtxW

api-ms-win-shcore-path-l1-1-0

ord172
ord170

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext

api-ms-win-storage-exports-internal-l1-1-0

CFSFolder_CreateFolder
SHGetKnownFolderIDList
SHGetFolderPathEx
CMruLongList_CreateInstance
IsLibraryCreatedByPolicy
IsLibraryPolicyEnabled
SendNotificationsForLibraryItem
CShellItemArrayWithCommonParent_CreateInstance
CShellItemArrayAsVirtualizedObjectArray_CreateInstance
CPrivateProfileCache_Save
CTaskAddDoc_Create
StateRepoVerbsCache_GetContextMenuVerbs
GetRegDataDrivenCommandWithAssociation
Global_WindowsStorage_lProcessClassCount
StateRepoVerbsCache_RebuildCacheAsync
Global_WindowsStorage_Untyped_FileClassSRWLock
Global_WindowsStorage_Untyped_pFileHanderMap
SHGetSpecialFolderLocation
CreateExtrinsicPropertyStore
GetInfoForFileInUse
DataAccessCaches_InvalidateForLibrary
CRegFolder_CreateAndInit
_CleanRecentDocs
CreateLocalizationDesktopIni
CCachedShellItem_CreateInstance
CFSFolder_AdjustForSlowColumn
HideExtension
SHCreateItemWithParentAndChildId
_PredictReasonableImpact
RegistryVerbs_GetHandlerMultiSelectModel
IsNameListedUnderKey
CopyDefaultLibrariesFromGroupPolicy
SHGetKnownFolderIDList_Internal
CreateItemArrayFromItemStore
GetFileUndoText
Global_WindowsStorage_ulNextID
Global_WindowsStorage_tlsChangeClientProxy
Global_WindowsStorage_hwndSCN
Global_WindowsStorage_csSCN
CShellItemArray_CreateInstance
Global_WindowsStorage_Untyped_MountPoint
Global_WindowsStorage_fIconCacheHasBeenSuccessfullyCreated
Global_WindowsStorage_fNeedsInitBroadcast
Global_WindowsStorage_iLastSysIcon
Global_WindowsStorage_lrFlags
Global_WindowsStorage_csIconCache
Global_WindowsStorage_iLastSystemColorDepth
Global_WindowsStorage_MaxIcons
Global_WindowsStorage_afNotRedirected
Global_WindowsStorage_fIconCacheIsValid
Global_WindowsStorage_ccIcon
Global_WindowsStorage_fEndInitialized
Global_WindowsStorage_dwThreadInitializing
GetRegDataDrivenCommand
GetSelectionStateFromItemArray
SetThreadFlags
SHResolveLibrary
SHSetFolderPathW
SHSetFolderPathA
SHGetFolderPathAndSubDirA
SHKnownFolderFromCSIDL
SHPrepareKnownFoldersCommon
SHPrepareKnownFoldersUser
CustomStatePropertyDescription_CreateWithItemPropertyStore
CDesktopFolder_CreateInstanceWithBindContext
Global_WindowsStorage_dwThreadBindCtx
CShellItem_CreateInstance
CFileOperationRecorder_CreateInstance
Global_WindowsStorage_iUseLinkPrefix
Global_WindowsStorage_Untyped_rgshil
CShellItemArrayAsCollection_CreateInstance
GetThreadFlags
Global_WindowsStorage_tlsIconCache
GetFindDataForPath
SHGetKnownFolderItem
CViewSettings_CreateInstance
Global_WindowsStorage_Untyped_pFileClassCacheTable
EnumShellItemsFromEnumFullIdList
SHFileOperationWithAdditionalFlags
CreateSortColumnArray
CreateItemArrayFromObjectArray
Global_WindowsStorage_esServerMode
GetCommandProviderForFolderType
CCollectionFactory_CreateInstance
DetermineFolderDestinationParentAppID

api-ms-win-storage-exports-external-l1-1-0

STORAGE_MakeDestinationItem
STORAGE_ClearDestinationsForAllApps
STORAGE_AddNewFolderToFrequentPlaces
STORAGE_SHAddToRecentDocsEx
STORAGE_SHAddToRecentDocs
STORAGE_AddItemToRecentDocs
STORAGE_CEnumFiles_CreateInstance
STORAGE_SHPathPrepareForWriteA
STORAGE_SHPathPrepareForWriteW
STORAGE_SHValidateMSUri
STORAGE_SHGetPathFromMsUri
STORAGE_GetSystemPersistedStorageItemList
STORAGE_CreateStorageItemFromPath_FullTrustCaller_ForPackage
STORAGE_CreateStorageItemFromPath_PartialTrustCaller
STORAGE_GetShellItemFromStorageItem
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_UseImplicitFlagsAndPackage
STORAGE_CreateSortColumnArrayFromListDesc
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage_WithProcessHandle
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage
STORAGE_CreateStorageItemFromShellItem_FullTrustCaller
STORAGE_CreateStorageItemFromPath_FullTrustCaller
STORAGE_CStorageItem_GetValidatedStorageItemObject
STORAGE_CStorageItem_GetValidatedStorageItem
STORAGE_SHFreeNameMappings
STORAGE_SHFileOperation
STORAGE_SHFileOperationA
STORAGE_SHCreateDirectoryExA
STORAGE_SHCreateDirectory
STORAGE_SHConfirmOperation
STORAGE_SHCreateShellItemArrayFromShellItem
STORAGE_SHCreateShellItemArrayFromIDLists
STORAGE_SHCreateShellItemArrayFromDataObject
STORAGE_SHCreateShellItemArray
STORAGE_SHGetDesktopFolderWorker

api-ms-win-shell-shellcom-l1-1-0

SHCoCreateInstance

api-ms-win-shell-shellfolders-l1-1-0

SHSetKnownFolderPath
SHGetFolderPathAndSubDirW
SHGetFolderLocation
SHGetFolderPathW
SHGetFolderPathA
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
SHGetKnownFolderPath

kernelbase

GetPackagesByPackageFamily
GetCurrentPackageInfo
ClosePackageInfo
OpenState
OpenStateExplicit
GetStateFolder
CloseState
ExtensionProgIdExists
GetExtensionProgIds
GetEffectivePackageStatusForUser
PackageNameAndPublisherIdFromFamilyName
NotifyRedirectedStringChange
GetStagedPackagePathByFullName
OpenPackageInfoByFullName
GetPackageInfo
GetPackageFullName
GetSystemAppDataKey

user32

GetMenuState
CountClipboardFormats
IsHungAppWindow
GetClipboardOwner
ExitWindowsEx
LoadImageW
SetRect
CopyRect
GetMonitorInfoW
MonitorFromPoint
GetUserObjectInformationW
GetThreadDesktop
GetProcessWindowStation
ChangeWindowMessageFilterEx
RegisterWindowMessageW
GetMessagePos
GetKeyboardLayout
OffsetRect
SetClipboardViewer
TranslateAcceleratorW
CreateMenu
InsertMenuW
EndMenu
DestroyAcceleratorTable
PtInRect
GetMessageExtraInfo
SetGestureConfig
CloseGestureInfoHandle
GetGestureInfo
ChangeClipboardChain
MapWindowPoints
GetMenuItemID
EnableMenuItem
InsertMenuItemW
GetFocus
CheckMenuItem
CheckMenuRadioItem
AppendMenuW
GetDoubleClickTime
MessageBeep
TrackPopupMenu
SetMessageExtraInfo
SetMenuDefaultItem
SetMenuItemInfoW
LoadAcceleratorsW
GetMenuStringW
GetDesktopWindow
GetForegroundWindow
ReleaseDC
GetDC
NotifyWinEvent
SendNotifyMessageW
SystemParametersInfoW
GetMenuItemInfoW
GetMenuItemCount
EnumWindows
IsWindow
WaitForInputIdle
GetWindowThreadProcessId
GetMenuDefaultItem
GetLastActivePopup
SwitchToThisWindow
GetCursorPos
RegisterClipboardFormatW
GetWindow
FindWindowW
GetClassNameW
GetAncestor
EnableWindow
MsgWaitForMultipleObjectsEx
PeekMessageW
PostQuitMessage
SetForegroundWindow
ShutdownBlockReasonDestroy
ShutdownBlockReasonCreate
LoadMenuW
GetSubMenu
RemoveMenu
GetParent
IsDlgButtonChecked
CheckDlgButton
DeleteMenu
DestroyMenu
CreatePopupMenu
PostMessageW
SetProcessDPIAware
DispatchMessageW
TranslateMessage
GetMessageW
SetFocus
IsWindowVisible
DrawEdge
GetSysColorBrush
FillRect
EndPaint
BeginPaint
GetUpdateRect
TrackMouseEvent
UpdateWindow
GetWindowRect
DefWindowProcW
RegisterClassW
KillTimer
SetTimer
GetKeyState
InflateRect
AdjustWindowRectEx
DestroyWindow
SetWindowLongW
GetWindowLongW
DrawFocusRect
DrawIcon
GetSysColor
EndDialog
GetWindowLongPtrW
SetWindowLongPtrW
GetWindowTextW
SetWindowPos
GetClientRect
ShowWindow
SetWindowTextW
GetDlgItem
InvalidateRect
LoadCursorW
SetCursor
SetDlgItemTextW
GetDlgItemTextW
SendDlgItemMessageW
ScreenToClient
SendMessageW
LookupIconIdFromDirectory
CreateIconIndirect
GetIconInfo
DestroyIcon
PrivateExtractIconsW
LoadIconW
GetSystemMetrics
ModifyMenuW
IsMenu
DrawTextW
SetPropW
RemovePropW
GetPropW
CopyIcon
IsIconic
SendMessageTimeoutW
GetScrollInfo
RegisterClassExW
SetWindowCompositionAttribute
EnumDisplayDevicesW
UnionRect
IsChild
UpdateLayeredWindow
ord2521
SetCapture
IsDialogMessageW
SetDialogDpiChangeBehavior
PostThreadMessageW
GetSystemMenu
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
WindowFromPoint
SetParent
IsRectEmpty
ClientToScreen
SetDlgItemInt
GetDlgItemInt
CheckRadioButton
LoadBitmapW
GetMessageTime
CreateAcceleratorTableW
EnumDisplayMonitors
SetShellWindowEx
GetClassLongPtrW
EnumDisplaySettingsW
ord2707
LockWindowUpdate
WaitMessage
DdeQueryConvInfo
DdeGetData
DdeGetLastError
DdeCreateDataHandle
DdeCreateStringHandleW
DdeFreeStringHandle
DdeQueryStringW
DdeDisconnect
DdeNameService
DdeUninitialize
DdeInitializeW
UnpackDDElParam
wsprintfW
SetSysColors
DisplayConfigGetDeviceInfo
SystemParametersInfoForDpi
SetShellWindow
SetWinEventHook
UnhookWinEvent
IsWinEventHookInstalled
GetMenuInfo
EmptyClipboard
GetCapture
GetWindowBand
SetActiveWindow
MapDialogRect
CopyImage
GetWindowTextLengthW
GetClassInfoW
GetTaskmanWindow
SetTaskmanWindow
DeregisterShellHookWindow
RegisterShellHookWindow
IsWindowUnicode
DefWindowProcA
AttachThreadInput
MoveWindow
CopyAcceleratorTableW
DeferWindowPos
MessageBoxW
SendMessageCallbackW
UnregisterDeviceNotification
RegisterDeviceNotificationW
MsgWaitForMultipleObjects
GetShellWindow
GetShellChangeNotifyWindow
SetShellChangeNotifyWindow
SetDlgItemTextA
GetDlgCtrlID
AdjustWindowRect
BeginDeferWindowPos
EndDeferWindowPos
GetSystemMetricsForDpi
GetDpiForSystem
CreateWindowInBand
OpenInputDesktop
CloseDesktop
RedrawWindow
EnumPropsExW
OpenClipboard
GetClipboardData
SetClipboardData
CloseClipboard
EnumChildWindows
SetThreadDpiAwarenessContext
GetWindowPlacement
BroadcastSystemMessageW
GetDpiForWindow
DialogBoxParamW
SetRectEmpty
GetPointerDevices
GetWindowDC
SetLayeredWindowAttributes
CreateWindowIndirect
SubtractRect
AdjustWindowRectExForDpi
ActivateKeyboardLayout
DrawTextExW
RegisterWindowMessageA
FindWindowExW
CreateWindowExW
WinHelpW
SystemParametersInfoA
GetLastInputInfo
GetDialogBaseUnits
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowRgn
SetScrollInfo
ShowScrollBar
ord2705
SetScrollPos
CallWindowProcW
CallNextHookEx
SetCoalescableTimer
SetMenuInfo
GetClassInfoExW
GetAsyncKeyState
TrackPopupMenuEx
MonitorFromRect
AreDpiAwarenessContextsEqual
GetWindowDpiAwarenessContext
GetCurrentInputMessageSource
GetClassLongW
QueryDisplayConfig
GetDisplayConfigBufferSizes
CreateDialogParamW
ChildWindowFromPoint
SetMenu
LockSetForegroundWindow
ShowCaret
HideCaret
GetCursor
AnimateWindow
MonitorFromWindow
IntersectRect
EqualRect
IsSETEnabled
AllowSetForegroundWindow
GetProcessDefaultLayout
IsProcessDPIAware
DrawIconEx
IsWindowEnabled
ReleaseCapture

ntdll

RtlFlushHeaps
RtlAreLongPathsEnabled
RtlQueryResourcePolicy
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
NtOpenThreadToken
EtwLogTraceEvent
NtPowerInformation
NtQueryInformationProcess
NtQueryAttributesFile
RtlDosPathNameToRelativeNtPathName_U
NtOpenProcessToken
NtQueryInformationToken
RtlDllShutdownInProgress
RtlGetDeviceFamilyInfoEnum
WinSqmAddToStreamEx
NtSetCachedSigningLevel
NtCompareSigningLevels
RtlInitializeResource
RtlAcquireResourceExclusive
RtlReleaseResource
RtlDeleteResource
NtGetCachedSigningLevel
RtlMapGenericMask
WinSqmSetDWORD
WinSqmIncrementDWORD
WinSqmAddToStream
EtwTraceMessage
EtwEventWrite
EtwEventEnabled
EtwEventActivityIdControl
EtwEventSetInformation
EtwEventRegister
EtwEventUnregister
RtlDestroyEnvironment
RtlSetCurrentEnvironment
RtlCreateEnvironment
RtlExpandEnvironmentStrings_U
RtlSetEnvironmentVariable
RtlQueryEnvironmentVariable_U
RtlInitUnicodeStringEx
RtlGetLastNtStatus
RtlFreeUnicodeString
RtlReleaseRelativeName
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtQueryVolumeInformationFile
RtlFreeHeap
RtlDosPathNameToNtPathName_U_WithStatus
NtOpenFile
NtSetInformationFile
RtlUnicodeStringToOemString
NtFsControlFile
NtClose
NtCreateFile
RtlNtStatusToDosError
NtQueryInformationFile
RtlPrefixString
RtlInitUnicodeString
EtwEventWriteTransfer
NtQuerySystemInformationEx
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
NtSetInformationToken
RtlQueryWnfStateData
RtlGetNtSystemRoot
RtlQueryRegistryValuesEx
RtlCheckRegistryKey
NtQuerySystemInformation
NtQueryObject
NtQueryKey
RtlIsPartialPlaceholder
NtSetSecurityObject
NtQuerySecurityObject
RtlDosPathNameToNtPathName_U
ShipAssert
NtQueryInformationThread
RtlIsNonEmptyDirectoryReparsePointAllowed
ZwQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlRandomEx
RtlCreateUnicodeString
RtlPublishWnfStateData
NtQueryWnfStateData
RtlCreateServiceSid
RtlLengthRequiredSid
RtlGetNtProductType
EtwGetTraceEnableLevel
EtwUnregisterTraceGuids

gdi32

CreateDIBSection
TextOutA
GetTextExtentPoint32A
CreateFontW
GetPixel
ExcludeClipRect
GetDIBColorTable
SetDIBits
ExtTextOutW
GetObjectType
GetWindowOrgEx
GetRegionData
GetRgnBox
CombineRgn
SaveDC
RestoreDC
CreateRectRgnIndirect
SetDCBrushColor
PlgBlt
ExtSelectClipRgn
GetViewportOrgEx
DeleteMetaFile
PlayMetaFile
SetMetaFileBitsEx
LPtoDP
SelectClipRgn
IntersectClipRect
GetClipRgn
CreateRectRgn
GetClipBox
StretchDIBits
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetMapMode
GetTextAlign
CreatePolygonRgn
LineTo
MoveToEx
PatBlt
SetStretchBltMode
SetTextAlign
GetTextExtentPoint32W
GetTextMetricsW
Rectangle
CreatePen
CreateFontIndirectW
GetCurrentObject
GetTextColor
GdiTransparentBlt
StretchBlt
GetDIBits
CreateBitmap
CreateCompatibleBitmap
BitBlt
GdiAlphaBlend
CreateDCW
DeleteDC
CreateCompatibleDC
GetTextExtentPointW
GetObjectW
SetWindowOrgEx
OffsetWindowOrgEx
CreateSolidBrush
GetDeviceCaps
SetTextColor
SelectObject
SetBkMode
GetStockObject
SetLayout
GetLayout
SetBkColor
DeleteObject

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-security-capability-l1-1-0

CapabilityCheck

api-ms-win-core-job-l2-1-0

SetInformationJobObject
CreateJobObjectW
AssignProcessToJobObject

api-ms-win-security-cryptoapi-l1-1-0

CryptGenRandom

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-crt-math-l1-1-0

ceilf
expf
floorf
sqrtf

Exports

Exports

AppCompat_RunDLLW
AssocCreateForClasses
AssocGetDetailsOfPropKey
CDefFolderMenu_Create2
CIDLData_CreateFromIDArray
CStorageItem_GetValidatedStorageItemObject
CheckEscapesW
CommandLineToArgvW
Control_RunDLL
Control_RunDLLA
Control_RunDLLAsUserW
Control_RunDLLW
CreateStorageItemFromPath_FullTrustCaller
CreateStorageItemFromPath_FullTrustCaller_ForPackage
CreateStorageItemFromPath_PartialTrustCaller
CreateStorageItemFromShellItem_FullTrustCaller
CreateStorageItemFromShellItem_FullTrustCaller_ForPackage
CreateStorageItemFromShellItem_FullTrustCaller_ForPackage_WithProcessHandle
CreateStorageItemFromShellItem_FullTrustCaller_UseImplicitFlagsAndPackage
DAD_AutoScroll
DAD_DragEnterEx
DAD_DragEnterEx2
DAD_DragLeave
DAD_DragMove
DAD_SetDragImage
DAD_ShowDragImage
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllGetVersion
DllInstall
DllRegisterServer
DllUnregisterServer
DoEnvironmentSubstA
DoEnvironmentSubstW
DragAcceptFiles
DragFinish
DragQueryFile
DragQueryFileA
DragQueryFileAorW
DragQueryFileW
DragQueryPoint
DriveType
DuplicateIcon
ExtractAssociatedIconA
ExtractAssociatedIconExA
ExtractAssociatedIconExW
ExtractAssociatedIconW
ExtractIconA
ExtractIconEx
ExtractIconExA
ExtractIconExW
ExtractIconW
FindExecutableA
FindExecutableW
FreeIconList
GetCurrentProcessExplicitAppUserModelID
GetFileNameFromBrowse
GetSystemPersistedStorageItemList
ILAppendID
ILClone
ILCloneFirst
ILCombine
ILCreateFromPath
ILCreateFromPathA
ILCreateFromPathW
ILFindChild
ILFindLastID
ILFree
ILGetNext
ILGetSize
ILIsEqual
ILIsParent
ILLoadFromStreamEx
ILRemoveLastID
ILSaveToStream
InitNetworkAddressControl
InternalExtractIconListA
InternalExtractIconListW
IsDesktopExplorerProcess
IsLFNDrive
IsLFNDriveA
IsLFNDriveW
IsNetDrive
IsProcessAnExplorer
IsUserAnAdmin
LaunchMSHelp_RunDLLW
OpenAs_RunDLL
OpenAs_RunDLLA
OpenAs_RunDLLW
OpenRegStream
Options_RunDLL
Options_RunDLLA
Options_RunDLLW
PathCleanupSpec
PathGetShortPath
PathIsExe
PathIsSlowA
PathIsSlowW
PathMakeUniqueName
PathQualify
PathResolve
PathYetAnotherMakeUniqueName
PickIconDlg
PifMgr_CloseProperties
PifMgr_GetProperties
PifMgr_OpenProperties
PifMgr_SetProperties
PrepareDiscForBurnRunDllW
PrintersGetCommand_RunDLL
PrintersGetCommand_RunDLLA
PrintersGetCommand_RunDLLW
ReadCabinetState
RealDriveType
RealShellExecuteA
RealShellExecuteExA
RealShellExecuteExW
RealShellExecuteW
RegenerateUserEnvironment
RestartDialog
RestartDialogEx
RunAsNewUser_RunDLLW
SHAddDefaultPropertiesByExt
SHAddFromPropSheetExtArray
SHAddToRecentDocs
SHAlloc
SHAppBarMessage
SHAssocEnumHandlers
SHAssocEnumHandlersForProtocolByApplication
SHBindToFolderIDListParent
SHBindToFolderIDListParentEx
SHBindToObject
SHBindToParent
SHBrowseForFolder
SHBrowseForFolderA
SHBrowseForFolderW
SHCLSIDFromString
SHChangeNotification_Lock
SHChangeNotification_Unlock
SHChangeNotify
SHChangeNotifyDeregister
SHChangeNotifyRegister
SHChangeNotifyRegisterThread
SHChangeNotifySuspendResume
SHCloneSpecialIDList
SHCoCreateInstance
SHCoCreateInstanceWorker
SHCreateAssociationRegistration
SHCreateCategoryEnum
SHCreateDataObject
SHCreateDefaultContextMenu
SHCreateDefaultExtractIcon
SHCreateDefaultPropertiesOp
SHCreateDirectory
SHCreateDirectoryExA
SHCreateDirectoryExW
SHCreateDrvExtIcon
SHCreateFileExtractIconW
SHCreateItemFromIDList
SHCreateItemFromParsingName
SHCreateItemFromRelativeName
SHCreateItemInKnownFolder
SHCreateItemWithParent
SHCreateLocalServerRunDll
SHCreateProcessAsUserW
SHCreatePropSheetExtArray
SHCreateQueryCancelAutoPlayMoniker
SHCreateShellFolderView
SHCreateShellFolderViewEx
SHCreateShellItem
SHCreateShellItemArray
SHCreateShellItemArrayFromDataObject
SHCreateShellItemArrayFromIDLists
SHCreateShellItemArrayFromShellItem
SHCreateStdEnumFmtEtc
SHDefExtractIconA
SHDefExtractIconW
SHDestroyPropSheetExtArray
SHDoDragDrop
SHELL32_AddToBackIconTable
SHELL32_AddToFrontIconTable
SHELL32_AreAllItemsAvailable
SHELL32_BindToFilePlaceholderHandler
SHELL32_CCommonPlacesFolder_CreateInstance
SHELL32_CDBurn_CloseSession
SHELL32_CDBurn_DriveSupportedForDataBurn
SHELL32_CDBurn_Erase
SHELL32_CDBurn_GetCDInfo
SHELL32_CDBurn_GetLiveFSDiscInfo
SHELL32_CDBurn_GetStagingPathOrNormalPath
SHELL32_CDBurn_GetTaskInfo
SHELL32_CDBurn_IsBlankDisc
SHELL32_CDBurn_IsBlankDisc2
SHELL32_CDBurn_IsLiveFS
SHELL32_CDBurn_OnDeviceChange
SHELL32_CDBurn_OnEject
SHELL32_CDBurn_OnMediaChange
SHELL32_CDefFolderMenu_Create2
SHELL32_CDefFolderMenu_Create2Ex
SHELL32_CDefFolderMenu_MergeMenu
SHELL32_CDrivesContextMenu_Create
SHELL32_CDrivesDropTarget_Create
SHELL32_CDrives_CreateSFVCB
SHELL32_CFSDropTarget_CreateInstance
SHELL32_CFSFolderCallback_Create
SHELL32_CFillPropertiesTask_CreateInstance
SHELL32_CLibraryDropTarget_CreateInstance
SHELL32_CLocationContextMenu_Create
SHELL32_CLocationFolderUI_CreateInstance
SHELL32_CMountPoint_DoAutorun
SHELL32_CMountPoint_DoAutorunPrompt
SHELL32_CMountPoint_IsAutoRunDriveAndEnabledByPolicy
SHELL32_CMountPoint_ProcessAutoRunFile
SHELL32_CMountPoint_WantAutorunUI
SHELL32_CMountPoint_WantAutorunUIGetReady
SHELL32_CNetFolderUI_CreateInstance
SHELL32_CPL_CategoryIdArrayFromVariant
SHELL32_CPL_IsLegacyCanonicalNameListedUnderKey
SHELL32_CPL_ModifyWowDisplayName
SHELL32_CRecentDocsContextMenu_CreateInstance
SHELL32_CSyncRootManager_CreateInstance
SHELL32_CTransferConfirmation_CreateInstance
SHELL32_CallFileCopyHooks
SHELL32_CanDisplayWin8CopyDialog
SHELL32_CloseAutoplayPrompt
SHELL32_CommandLineFromMsiDescriptor
SHELL32_CopyFilePlaceholderToNewFile
SHELL32_CopySecondaryTiles
SHELL32_CreateConfirmationInterrupt
SHELL32_CreateConflictInterrupt
SHELL32_CreateDefaultOperationDataProvider
SHELL32_CreateFileFolderContextMenu
SHELL32_CreateLinkInfoW
SHELL32_CreatePlaceholderFile
SHELL32_CreateQosRecorder
SHELL32_CreateSharePointView
SHELL32_Create_IEnumUICommand
SHELL32_DestroyLinkInfo
SHELL32_EncryptDirectory
SHELL32_EncryptedFileKeyInfo
SHELL32_EnumCommonTasks
SHELL32_FilePlaceholder_BindToPrimaryStream
SHELL32_FilePlaceholder_CreateInstance
SHELL32_FreeEncryptedFileKeyInfo
SHELL32_GenerateAppID
SHELL32_GetAppIDRoot
SHELL32_GetCommandProviderForFolderType
SHELL32_GetDPIAdjustedLogicalSize
SHELL32_GetDiskCleanupPath
SHELL32_GetFileNameFromBrowse
SHELL32_GetIconOverlayManager
SHELL32_GetLinkInfoData
SHELL32_GetPlaceholderStatesFromFileAttributesAndReparsePointTag
SHELL32_GetRatingBucket
SHELL32_GetSkyDriveNetworkStates
SHELL32_GetSqmableFileName
SHELL32_GetThumbnailAdornerFromFactory
SHELL32_GetThumbnailAdornerFromFactory2
SHELL32_HandleUnrecognizedFileSystem
SHELL32_IconCacheCreate
SHELL32_IconCacheDestroy
SHELL32_IconCacheHandleAssociationChanged
SHELL32_IconCacheRestore
SHELL32_IconCache_AboutToExtractIcons
SHELL32_IconCache_DoneExtractingIcons
SHELL32_IconCache_ExpandEnvAndSearchPath
SHELL32_IconCache_RememberRecentlyExtractedIconsW
SHELL32_IconOverlayManagerInit
SHELL32_IsGetKeyboardLayoutPresent
SHELL32_IsSystemUpgradeInProgress
SHELL32_IsValidLinkInfo
SHELL32_LegacyEnumSpecialTasksByType
SHELL32_LegacyEnumTasks
SHELL32_LookupBackIconIndex
SHELL32_LookupFrontIconIndex
SHELL32_NormalizeRating
SHELL32_NotifyLinkTrackingServiceOfMove
SHELL32_PifMgr_CloseProperties
SHELL32_PifMgr_GetProperties
SHELL32_PifMgr_OpenProperties
SHELL32_PifMgr_SetProperties
SHELL32_Printers_CreateBindInfo
SHELL32_Printjob_GetPidl
SHELL32_PurgeSystemIcon
SHELL32_RefreshOverlayImages
SHELL32_ResolveLinkInfoW
SHELL32_SHAddSparseIcon
SHELL32_SHCreateByValueOperationInterrupt
SHELL32_SHCreateDefaultContextMenu
SHELL32_SHCreateLocalServer
SHELL32_SHCreateShellFolderView
SHELL32_SHDuplicateEncryptionInfoFile
SHELL32_SHEncryptFile
SHELL32_SHFormatDriveAsync
SHELL32_SHGetThreadUndoManager
SHELL32_SHGetUserNameW
SHELL32_SHIsVirtualDevice
SHELL32_SHLaunchPropSheet
SHELL32_SHLogILFromFSIL
SHELL32_SHOpenWithDialog
SHELL32_SHStartNetConnectionDialogW
SHELL32_SHUICommandFromGUID
SHELL32_SendToMenu_InvokeTargetedCommand
SHELL32_SendToMenu_VerifyTargetedCommand
SHELL32_SetPlaceholderReparsePointAttribute
SHELL32_SetPlaceholderReparsePointAttribute2
SHELL32_ShowHideIconOnlyOnDesktop
SHELL32_SimpleRatingToFilterCondition
SHELL32_StampIconForFile
SHELL32_SuspendUndo
SHELL32_TryVirtualDiscImageDriveEject
SHELL32_UpdateFilePlaceholderStates
SHELL32_VerifySaferTrust
SHEmptyRecycleBinA
SHEmptyRecycleBinW
SHEnableServiceObject
SHEnumerateUnreadMailAccountsW
SHEvaluateSystemCommandTemplate
SHExtractIconsW
SHFileOperation
SHFileOperationA
SHFileOperationW
SHFindFiles
SHFind_InitMenuPopup
SHFlushSFCache
SHFormatDrive
SHFree
SHFreeNameMappings
SHGetAttributesFromDataObject
SHGetDataFromIDListA
SHGetDataFromIDListW
SHGetDesktopFolder
SHGetDiskFreeSpaceA
SHGetDiskFreeSpaceExA
SHGetDiskFreeSpaceExW
SHGetDriveMedia
SHGetFileInfo
SHGetFileInfoA
SHGetFileInfoW
SHGetFolderLocation
SHGetFolderPathA
SHGetFolderPathAndSubDirA
SHGetFolderPathAndSubDirW
SHGetFolderPathEx
SHGetFolderPathW
SHGetIDListFromObject
SHGetIconOverlayIndexA
SHGetIconOverlayIndexW
SHGetImageList
SHGetInstanceExplorer
SHGetItemFromDataObject
SHGetItemFromObject
SHGetKnownFolderIDList
SHGetKnownFolderItem
SHGetKnownFolderPath
SHGetLocalizedName
SHGetMalloc
SHGetNameFromIDList
SHGetNewLinkInfo
SHGetNewLinkInfoA
SHGetNewLinkInfoW
SHGetPathFromIDList
SHGetPathFromIDListA
SHGetPathFromIDListEx
SHGetPathFromIDListW
SHGetPropertyStoreForWindow
SHGetPropertyStoreFromIDList
SHGetPropertyStoreFromParsingName
SHGetRealIDL
SHGetSetFolderCustomSettings
SHGetSetSettings
SHGetSettings
SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
SHGetStockIconInfo
SHGetTemporaryPropertyForItem
SHGetUnreadMailCountW
SHHandleUpdateImage
SHHelpShortcuts_RunDLL
SHHelpShortcuts_RunDLLA
SHHelpShortcuts_RunDLLW
SHILCreateFromPath
SHInvokePrinterCommandA
SHInvokePrinterCommandW
SHIsFileAvailableOffline
SHLimitInputEdit
SHLoadInProc
SHLoadNonloadedIconOverlayIdentifiers
SHMapPIDLToSystemImageListIndex
SHMultiFileProperties
SHObjectProperties
SHOpenFolderAndSelectItems
SHOpenPropSheetW
SHOpenWithDialog
SHParseDisplayName
SHPathPrepareForWriteA
SHPathPrepareForWriteW
SHPropStgCreate
SHPropStgReadMultiple
SHPropStgWriteMultiple
SHQueryRecycleBinA
SHQueryRecycleBinW
SHQueryUserNotificationState
SHRemoveLocalizedName
SHReplaceFromPropSheetExtArray
SHResolveLibrary
SHRestricted
SHSetDefaultProperties
SHSetFolderPathA
SHSetFolderPathW
SHSetInstanceExplorer
SHSetKnownFolderPath
SHSetLocalizedName
SHSetTemporaryPropertyForItem
SHSetUnreadMailCountW
SHShellFolderView_Message
SHShowManageLibraryUI
SHSimpleIDListFromPath
SHStartNetConnectionDialogW
SHTestTokenMembership
SHUpdateImageA
SHUpdateImageW
SHUpdateRecycleBinIcon
SHValidateUNC
SetCurrentProcessExplicitAppUserModelID
SheChangeDirA
SheChangeDirExW
SheGetDirA
SheSetCurDrive
ShellAboutA
ShellAboutW
ShellExec_RunDLL
ShellExec_RunDLLA
ShellExec_RunDLLW
ShellExecuteA
ShellExecuteEx
ShellExecuteExA
ShellExecuteExW
ShellExecuteW
ShellHookProc
ShellMessageBoxA
ShellMessageBoxW
Shell_GetCachedImageIndex
Shell_GetCachedImageIndexA
Shell_GetCachedImageIndexW
Shell_GetImageLists
Shell_MergeMenus
Shell_NotifyIcon
Shell_NotifyIconA
Shell_NotifyIconGetRect
Shell_NotifyIconW
SignalFileOpen
StateRepoNewMenuCache_RebuildCacheAsync
StgMakeUniqueName
StrChrA
StrChrIA
StrChrIW
StrChrW
StrCmpNA
StrCmpNIA
StrCmpNIW
StrCmpNW
StrNCmpA
StrNCmpIA
StrNCmpIW
StrNCmpW
StrRChrA
StrRChrIA
StrRChrIW
StrRChrW
StrRStrA
StrRStrIA
StrRStrIW
StrRStrW
StrStrA
StrStrIA
StrStrIW
StrStrW
UsersLibrariesFolderUI_CreateInstance
WOWShellExecute
WaitForExplorerRestartW
Win32DeleteFile
WriteCabinetState

Sections

.text
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 274KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 11KB - Virtual size: 10KB

.rsrc Size: 177KB - Virtual size: 177KB

.reloc Size: 512B - Virtual size: 12B

Password: infected

251f0d264461093c96696e473be023d9

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

user32

winmm

ws2_32

kernel32

iphlpapi

userenv

shlwapi

dbghelp

ole32

secur32

winhttp

crypt32

Exports

Exports

Sections

.text Size: 5.6MB - Virtual size: 5.6MB

.rdata Size: 2.4MB - Virtual size: 2.4MB

.data Size: 29KB - Virtual size: 58KB

.00cfg Size: 512B - Virtual size: 4B

.tls Size: 512B - Virtual size: 169B

.voltbl Size: 1024B - Virtual size: 776B

CPADinfo Size: 512B - Virtual size: 40B

prot Size: 512B - Virtual size: 193B

.rsrc Size: 51KB - Virtual size: 50KB

.reloc Size: 193KB - Virtual size: 192KB

Password: infected

7afea2ed1708d746b6cb468206853322

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

advapi32

crypt32

kernel32

ole32

oleaut32

slc

winmm

wintrust

mfplat

ws2_32

Exports

Exports

Sections

.text Size: 637KB - Virtual size: 636KB

.rdata Size: 186KB - Virtual size: 185KB

.data Size: 5KB - Virtual size: 8KB

.pdata Size: 25KB - Virtual size: 25KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

Password: infected

dae02f32a21e03ce65412f6e56942daa

Headers

.text
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 177KB - Virtual size: 177KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 5.6MB - Virtual size: 5.6MB

.rdata
Size: 2.4MB - Virtual size: 2.4MB

.data
Size: 29KB - Virtual size: 58KB

.00cfg
Size: 512B - Virtual size: 4B

.tls
Size: 512B - Virtual size: 169B

.voltbl
Size: 1024B - Virtual size: 776B

CPADinfo
Size: 512B - Virtual size: 40B

prot
Size: 512B - Virtual size: 193B

.rsrc
Size: 51KB - Virtual size: 50KB

.reloc
Size: 193KB - Virtual size: 192KB

.text
Size: 637KB - Virtual size: 636KB

.rdata
Size: 186KB - Virtual size: 185KB

.data
Size: 5KB - Virtual size: 8KB

.pdata
Size: 25KB - Virtual size: 25KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 478KB - Virtual size: 477KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 50KB - Virtual size: 50KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 399KB - Virtual size: 398KB

.sdata
Size: 512B - Virtual size: 231B

.rsrc
Size: 350KB - Virtual size: 350KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 126KB - Virtual size: 125KB

.data
Size: 14KB - Virtual size: 130KB

.pdata
Size: 43KB - Virtual size: 42KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 369KB - Virtual size: 368KB

.sdata
Size: 512B - Virtual size: 216B

.rsrc
Size: 350KB - Virtual size: 350KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate