Taskmgr[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Taskmgr.exe
Size

1.2MB
MD5

dad789c1c1b03311dc7fcfeb5d1520e4
SHA1

3f63e9f09fe59f5a2d3740214e8d199c0ca4b3f9
SHA256

ccd091f425bb9b09da3e293e33385786f1c9157dcde60cf774fc55530760f537
SHA512

63e98889d90c34319e5d3ed044ac1fc5c90df99d9db6f9bb17531b45f2b8d7ed31b9e00dc4cd9d94cc7343fd9b3fac843aabf60c92f38fb0daaed01037698cf8
SSDEEP

24576:X1ogdgpbK3CdxOryqVYv1aAZYzOnZiFMZ/3I7fBe7q4HU:FoxpzxAySYv1anzOnF/Q5e7q4HU

Score

1^/10

Malware Config

Signatures

Files

Taskmgr.exe
.exe windows x64

c96a2755c8b3b31e42365df77c11c290

Code Sign

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/07/2014, 20:32

Not After

01/10/2015, 20:32

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:aa:b4:a4:2b:f4:4a:84:d9:d2:9b:eb:5b:87:d0:dc:ea:0b:89:15:b4:72:b8:15:c0:07:86:29:85:a4:ed:0c
Signer

Actual PE Digest

32:aa:b4:a4:2b:f4:4a:84:d9:d2:9b:eb:5b:87:d0:dc:ea:0b:89:15:b4:72:b8:15:c0:07:86:29:85:a4:ed:0c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gdi32

CreateDIBSection
GetDeviceCaps
DeleteObject
MoveToEx
LineTo
Rectangle
GetTextExtentPointW
SelectObject
CreatePen

user32

GetDoubleClickTime
MessageBeep
SwitchToThisWindow
SetDlgItemTextW
GetWindowTextLengthW
CreateDialogParamW
GetMenuItemInfoW
GetMenuState
SetWindowPos
GetWindowRect
GetCursorPos
GetWindowLongPtrW
IsIconic
IsZoomed
SetWindowLongPtrW
MonitorFromPoint
GetMonitorInfoW
GetClientRect
RedrawWindow
KillTimer
CheckMenuItem
EnableMenuItem
SetGestureConfig
GetGestureInfo
GetSubMenu
CheckMenuRadioItem
GetMenuItemCount
RemoveMenu
TrackPopupMenuEx
DestroyMenu
GetCurrentInputMessageSource
SetMenuDefaultItem
RegisterWindowMessageW
ord2521
GhostWindowFromHungWindow
HungWindowFromGhostWindow
CreateWindowInBand
GetWindowBand
GetWindowCompositionAttribute
CloseGestureInfoHandle
SystemParametersInfoW
GetDC
ReleaseDC
CreateWindowExW
SendMessageW
PostMessageW
GetKeyState
EqualRect
CopyRect
GetSystemMetrics
SetFocus
SetTimer
GetForegroundWindow
GetParent
DialogBoxParamW
LoadStringW
MessageBoxW
MapWindowPoints
PtInRect
GetScrollPos
DeleteMenu
GetMessagePos
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetFocus
InvalidateRect
ShowWindow
DestroyIcon
GetWindowLongW
LoadImageW
CharUpperBuffW
GetWindow
IsWindowVisible
IsHungAppWindow
GetWindowThreadProcessId
OpenDesktopW
GetThreadDesktop
SetThreadDesktop
EnumDesktopWindows
CloseDesktop
EnumDesktopsW
GetProcessWindowStation
GetGuiResources
GetDlgItem
GetWindowTextW
SetWindowTextW
EnableWindow
EndDialog
CharLowerW
RegisterDeviceNotificationW
UnregisterDeviceNotification
MsgWaitForMultipleObjectsEx
UnregisterClassW
PeekMessageW
TranslateMessage
DispatchMessageW
LoadMenuW
DestroyWindow
FindWindowW
AllowSetForegroundWindow
ShowWindowAsync
SendMessageTimeoutW
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
GetMenuItemID
RegisterClassExW
SetForegroundWindow
ChangeWindowMessageFilterEx
GetMenu
SetMenu
UpdateWindow
LoadIconW
DefWindowProcW
IsWindow
OpenIcon
IsWindowEnabled
InternalGetWindowText
PostQuitMessage
CreatePopupMenu
AppendMenuW
TrackPopupMenu
CopyIcon
GetClassLongPtrW
GetClassNameW
GetPropW
GetLastActivePopup

msvcrt

??2@YAPEAX_K@Z
_wtoi
_i64tow_s
_purecall
??_V@YAXPEAX@Z
_wcsnicmp
_commode
_wcsicmp
iswalpha
wcschr
memcpy_s
iswdigit
memmove
_wtol
_fmode
??1type_info@@UEAA@XZ
wcsstr
towupper
??3@YAXPEAX@Z
wcstok_s
iswspace
_stricmp
_strnicmp
bsearch
wcsrchr
??_U@YAPEAX_K@Z
__CxxFrameHandler3
wcstod
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_wcmdln
_cexit
__setusermatherr
_ui64tow_s
_vsnwprintf
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
_initterm
wcscmp
__C_specific_handler
swscanf_s
ceil
floor
floorf
memcmp
memcpy
memset
sqrtf
strcmp
_itow_s

oleaut32

SysAllocStringLen
SysStringLen
SysFreeString
SysAllocString
VariantInit
SafeArrayCreateVector
SafeArrayDestroy
SafeArrayPutElement
VariantClear

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemDirectoryW
GetLocalTime
GetSystemInfo
GetLogicalProcessorInformationEx
GetTickCount64
GetSystemTime
GlobalMemoryStatusEx
GetVersionExW
GetPhysicallyInstalledSystemMemory
GetComputerNameExW
GetSystemFirmwareTable
GetNativeSystemInfo
GetSystemTimeAsFileTime

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWrite

api-ms-win-core-processthreads-l1-1-2

OpenProcess
GetProcessTimes
ProcessIdToSessionId
CreateProcessW
GetThreadPriority
TerminateProcess
SetProcessShutdownParameters
OpenProcessToken
GetExitCodeThread
GetCurrentProcess
SetPriorityClass
GetCurrentThreadId
GetStartupInfoW
CreateThread
SetThreadPriority
GetCurrentThread
IsProcessorFeaturePresent
GetPriorityClass
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetErrorMode
GetErrorMode
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
DebugBreak
OutputDebugStringA

api-ms-win-core-heap-l1-2-0

HeapSize
HeapSetInformation
HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegGetValueW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegNotifyChangeKeyValue
RegCloseKey
RegOpenKeyExW
RegEnumValueW

api-ms-win-core-localization-l1-2-1

GetLocaleInfoEx
GetThreadUILanguage
GetLocaleInfoW
GetThreadPreferredUILanguages
FormatMessageW

api-ms-win-security-base-l1-2-0

IsWellKnownSid
SetTokenInformation
CheckTokenMembership
FreeSid
CreateWellKnownSid
EqualSid
AllocateAndInitializeSid
AdjustTokenPrivileges
GetLengthSid
GetTokenInformation
CopySid

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-synch-l1-2-0

SetEvent
EnterCriticalSection
InitializeCriticalSection
Sleep
OpenEventW
WaitForSingleObject
CreateMutexW
ReleaseMutex
LeaveCriticalSection
InitOnceExecuteOnce
TryEnterCriticalSection
DeleteCriticalSection
ResetEvent
CreateEventW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringEx

api-ms-win-core-datetime-l1-1-1

GetTimeFormatW
GetDateFormatEx
GetDateFormatW

api-ms-win-core-io-l1-1-1

DeviceIoControl
CancelSynchronousIo

api-ms-win-core-processenvironment-l1-2-0

GetCurrentDirectoryW
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-core-memory-l1-1-2

ReadProcessMemory
VirtualUnlock

api-ms-win-core-file-l1-2-1

FindNextVolumeW
GetFileAttributesExW
GetFileType
FindNextChangeNotification
GetLogicalDriveStringsW
QueryDosDeviceW
GetLongPathNameW
CompareFileTime
FindClose
FindFirstFileW
GetTempPathW
GetDriveTypeW
FindNextFileW
FindFirstVolumeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
FindFirstChangeNotificationW
CreateFileW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-path-l1-1-0

PathCchCanonicalize
PathCchCombine
PathCchAppend

api-ms-win-devices-config-l1-1-1

CM_Open_Class_KeyW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification
PowerSettingRegisterNotification

api-ms-win-core-rtlsupport-l1-2-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

LoadLibraryW
MulDiv
WaitForMultipleObjects
GetComputerNameW
GetDurationFormatEx

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveExtensionW
PathRemoveBlanksW
PathStripPathW
PathIsPrefixW
SHExpandEnvironmentStringsW
PathFileExistsW
PathGetArgsW
PathRemoveBackslashW
PathIsRelativeW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-localization-obsolete-l1-2-0

GetNumberFormatW

api-ms-win-core-shlwapi-obsolete-l1-1-0

SHLoadIndirectString
QISearch
StrToIntExW
StrRChrIW
StrTrimW
StrStrW
StrStrIW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

api-ms-win-core-sidebyside-l1-1-0

QueryActCtxW
CreateActCtxW
DeactivateActCtx
FindActCtxSectionStringW
ActivateActCtx

pcwum

PcwAddQueryItem
PcwCreateQuery
PcwCollectData

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-localization-l2-1-0

GetNumberFormatEx

comctl32

ImageList_CoCreateInstance

ntdll

NtQueryInformationToken
RtlSecondsSince1970ToTime
NtQueryObject
NtQuerySystemInformation
RtlNtStatusToDosError
RtlTimeToElapsedTimeFields
NtQueryInformationProcess
NtQuerySystemInformationEx
NtQueryInformationThread
RtlInitUnicodeString
NtQueryTimerResolution
RtlNumberOfSetBitsUlongPtr
NtSetInformationProcess
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtQueryInformationFile
NtOpenFile
RtlCheckPortableOperatingSystem
WinSqmAddToStream
WinSqmAddToStreamEx
WinSqmSetDWORD
LdrQueryProcessModuleInformation
NtSetInformationFile

uxtheme

OpenThemeData
EndPanningFeedback
BeginPanningFeedback
UpdatePanningFeedback
GetThemeColor
GetThemeInt
SetWindowTheme
CloseThemeData

shlwapi

PathIsNetworkPathW
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
ord176
ord16
AssocQueryStringW
ord278
ord548
ord199
ord618
ord437
StrRetToBufW
PathRemoveArgsW

shell32

ord4
ord2
SHGetKnownFolderIDList
SHGetSpecialFolderPathW
ord61
SHOpenFolderAndSelectItems
ord75
Shell_NotifyIconW
SHGetPropertyStoreForWindow
SHEvaluateSystemCommandTemplate
DuplicateIcon
ShellExecuteW
CommandLineToArgvW
ord727
Shell_GetCachedImageIndexW
ord155
SHBindToParent
SHParseDisplayName
ShellExecuteExW

credui

CredUIPromptForCredentialsW

duser

GetGadgetRect
ForwardGadgetMessage
SetGadgetStyle

dui70

??0HWNDElement@DirectUI@@QEAA@XZ
??1HWNDElement@DirectUI@@UEAA@XZ
?Destroy@NativeHWNDHost@DirectUI@@QEAAXXZ
?WndProc@HWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
StrToID
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?EndDefer@Element@DirectUI@@QEAAXK@Z
?OnInput@HWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?Release@Value@DirectUI@@QEAAXXZ
?GetExtent@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z
?Click@Button@DirectUI@@SA?AVUID@@XZ
?GetID@Element@DirectUI@@QEAAGXZ
?KeyboardNavigate@Element@DirectUI@@SA?AVUID@@XZ
?OnEvent@HWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@HWNDElement@DirectUI@@UEAAXXZ
?Create@NativeHWNDHost@DirectUI@@SAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHIPEAPEAV12@@Z
?GetHWND@NativeHWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ
?Initialize@HWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
?SetAccRole@Element@DirectUI@@QEAAJH@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z
?ShowWindow@NativeHWNDHost@DirectUI@@QEAAXH@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
DisableAnimations
?StartNavigate@Browser@DirectUI@@SA?AVUID@@XZ
?UpdateSheets@DUIXmlParser@DirectUI@@QEAAJPEAVElement@2@@Z
?GetEnabled@Element@DirectUI@@QEAA_NXZ
?GetDPI@Element@DirectUI@@QEAAHXZ
??0ScrollViewer@DirectUI@@QEAA@XZ
??1ScrollViewer@DirectUI@@UEAA@XZ
?OnPropertyChanging@BaseScrollViewer@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@ScrollViewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnInput@BaseScrollViewer@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnEvent@BaseScrollViewer@DirectUI@@UEAAXPEAUEvent@2@@Z
?Add@BaseScrollViewer@DirectUI@@UEAAJPEAPEAVElement@2@I@Z
?CreateScrollBars@ScrollViewer@DirectUI@@MEAAJXZ
?AddChildren@ScrollViewer@DirectUI@@MEAAJXZ
?OnListenerAttach@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@@Z
?OnListenerDetach@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@@Z
?OnListenedPropertyChanging@BaseScrollViewer@DirectUI@@UEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
?OnListenedPropertyChanged@ScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
?OnListenedInput@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEAUInputEvent@2@@Z
?OnListenedEvent@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEAUEvent@2@@Z
?GetClassInfoPtr@Expando@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@ScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ
?Initialize@BaseScrollViewer@DirectUI@@QEAAJPEAVElement@2@PEAK@Z
?_PostEvent@Element@DirectUI@@AEAAXPEAUEvent@2@H@Z
?Register@ScrollViewer@DirectUI@@SAJXZ
?GetHScroll@ScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ
?GetVScroll@ScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ
?SetPadding@Element@DirectUI@@QEAAJHHHH@Z
?SetXOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z
?XOffsetProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetHeight@Element@DirectUI@@QEAAJH@Z
?GetDesiredSize@Element@DirectUI@@QEAAPEBUtagSIZE@@XZ
??1DCSurface@DirectUI@@UEAA@XZ
??0DCSurface@DirectUI@@QEAA@PEAUHDC__@@@Z
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z
?Init@NavReference@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z
?Remove@Element@DirectUI@@QEAAJPEAV12@@Z
?ExpandCollapse_ExpandCollapseState_Property@Schema@DirectUI@@2HA
?GetIndex@Element@DirectUI@@QEAAHXZ
??0IProvider@DirectUI@@QEAA@XZ
?AdviseEventRemoved@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z
?AdviseEventAdded@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z
?get_FragmentRoot@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z
?SetFocus@ElementProvider@DirectUI@@UEAAJXZ
?GetEmbeddedFragmentRoots@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z
?get_BoundingRectangle@ElementProvider@DirectUI@@UEAAJPEAUUiaRect@@@Z
?GetRuntimeId@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z
?Navigate@ElementProvider@DirectUI@@UEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z
?get_HostRawElementProvider@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z
?GetPropertyValue@ElementProvider@DirectUI@@UEAAJHPEAUtagVARIANT@@@Z
?get_ProviderOptions@ElementProvider@DirectUI@@UEAAJPEAW4ProviderOptions@@@Z
?TossElement@ElementProvider@DirectUI@@UEAAXXZ
?QueryInterface@ElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?Create@ElementProvider@DirectUI@@SAJPEAVElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z
?Create@HWNDElementProvider@DirectUI@@SAJPEAVHWNDElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z
?Find@ElementProviderManager@DirectUI@@SAPEAVElementProvider@2@PEAVElement@2@@Z
??0ElementProxy@DirectUI@@QEAA@XZ
??0ProviderProxy@DirectUI@@IEAA@XZ
??1ElementProvider@DirectUI@@UEAA@XZ
??0RefcountBase@DirectUI@@QEAA@XZ
??0ElementProvider@DirectUI@@QEAA@XZ
?GetInvokeHelper@InvokeManager@DirectUI@@SAJPEAPEAVInvokeHelper@2@@Z
?IsPatternSupported@ElementProxy@DirectUI@@IEAAJW4Pattern@Schema@2@PEA_N@Z
?CreatePatternProvider@Schema@DirectUI@@SAJW4Pattern@12@PEAVElementProvider@2@PEAPEAUIUnknown@@@Z
?Init@ProviderProxy@DirectUI@@MEAAXPEAVElement@2@@Z
??1AutoLock@DirectUI@@QEAA@XZ
??0AutoLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
?DoInvoke@ElementProvider@DirectUI@@IEAAJHZZ
?PatternFromPatternId@Schema@DirectUI@@SA?AW4Pattern@12@H@Z
?Init@ElementProvider@DirectUI@@MEAAJPEAVElement@2@PEAVInvokeHelper@2@@Z
?Release@ElementProvider@DirectUI@@UEAAKXZ
?GetProperty@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@H@Z
?DoMethod@ElementProxy@DirectUI@@UEAAJHPEAD@Z
?Init@ElementProxy@DirectUI@@MEAAXPEAVElement@2@@Z
?DoInvokeArgs@ElementProvider@DirectUI@@QEAAJHP6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z
?GetElement@ElementProvider@DirectUI@@UEAAPEDVElement@2@XZ
?TossPatternProvider@ElementProvider@DirectUI@@QEAAXW4Pattern@Schema@2@@Z
??1RefcountBase@DirectUI@@UEAA@XZ
?AddRef@ElementProvider@DirectUI@@UEAAKXZ
?Release@RefcountBase@DirectUI@@QEAAJXZ
?AddRef@RefcountBase@DirectUI@@QEAAJXZ
?DataGridControlType@Schema@DirectUI@@2HA
?SelectionPattern@Schema@DirectUI@@2HA
?TablePattern@Schema@DirectUI@@2HA
?InvokePattern@Schema@DirectUI@@2HA
?TableItemPattern@Schema@DirectUI@@2HA
?IsControlElementProperty@Schema@DirectUI@@2HA
?IsContentElementProperty@Schema@DirectUI@@2HA
?TreeItemControlType@Schema@DirectUI@@2HA
?ListItemControlType@Schema@DirectUI@@2HA
?ControlTypeProperty@Schema@DirectUI@@2HA
?GridPattern@Schema@DirectUI@@2HA
?SelectionItemPattern@Schema@DirectUI@@2HA
?ExpandCollapsePattern@Schema@DirectUI@@2HA
?GridItemPattern@Schema@DirectUI@@2HA
?GetExpanded@Expandable@DirectUI@@QEAA_NXZ
?UiaRaiseAutomationPropertyChangedEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@HUtagVARIANT@@1@ZEA
?GetAccessible@Element@DirectUI@@QEAA_NXZ
?WantPropertyEvent@EventManager@DirectUI@@SA_NH@Z
?FWantAnyEvent@EventManager@DirectUI@@SA_NPEAVElement@2@@Z
?OnReceivedDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
?OnLostDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
?DefaultAction@Button@DirectUI@@UEAAJXZ
?OnInput@Button@DirectUI@@UEAAXPEAUInputEvent@2@@Z
??1Button@DirectUI@@UEAA@XZ
??0Button@DirectUI@@QEAA@XZ
?GetClassInfoPtr@Button@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@Button@DirectUI@@SAJXZ
?Register@Element@DirectUI@@SAJXZ
?OnDestroy@Element@DirectUI@@UEAAXXZ
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?KeyFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?OnPropertyChanged@Button@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetVisible@Element@DirectUI@@QEAA_NXZ
?GetBackgroundColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z
?Initialize@Button@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetClass@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?GetSelected@Element@DirectUI@@QEAA_NXZ
?GetBool@Value@DirectUI@@QEAA_NXZ
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z
?SetValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@HPEAVValue@2@@Z
?SetExpanded@Expandable@DirectUI@@QEAAJ_N@Z
?SetPressed@Button@DirectUI@@QEAAJ_N@Z
?GetBoolFalse@Value@DirectUI@@SAPEAV12@XZ
?SetBackgroundColor@Element@DirectUI@@QEAAJK@Z
?SetBorderThickness@Element@DirectUI@@QEAAJHHHH@Z
?SetAccValue@Element@DirectUI@@QEAAJPEBG@Z
?SetAccItemStatus@Element@DirectUI@@QEAAJPEBG@Z
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z
?SetAnimation@Element@DirectUI@@QEAAJH@Z
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?HeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SortChildren@Element@DirectUI@@QEAAJP6AHPEBX0@Z@Z
?LayoutPosProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z
?CreateInt@Value@DirectUI@@SAPEAV12@HW4DynamicScaleValue@@@Z
?HasPadding@Element@DirectUI@@QEAA_NXZ
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z
??1Element@DirectUI@@UEAA@XZ
??0Element@DirectUI@@QEAA@XZ
?SetBorderColor@Element@DirectUI@@QEAAJK@Z
?HasBorder@Element@DirectUI@@QEAA_NXZ
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z
?GetInt@Value@DirectUI@@QEAAHXZ
?GetType@Value@DirectUI@@QEBAHXZ
?CustomProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z
?KeyWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?MouseWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?SetActive@Element@DirectUI@@QEAAJH@Z
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?Create@GridLayout@DirectUI@@SAJHHPEAPEAVLayout@2@@Z
?HasChildren@Element@DirectUI@@QEAA_NXZ
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
?GetKeyWithin@Element@DirectUI@@QEAA_NXZ
?GetMouseWithin@Element@DirectUI@@QEAA_NXZ
?Insert@Element@DirectUI@@QEAAJPEAV12@I@Z
?SetID@Element@DirectUI@@QEAAJPEBG@Z
?SetMinSize@Element@DirectUI@@QEAAJHH@Z
?IsDescendent@Element@DirectUI@@QEAA_NPEAV12@@Z
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z
?SetTooltip@Element@DirectUI@@QEAAJ_N@Z
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
?SetXScrollable@BaseScrollViewer@DirectUI@@QEAAJ_N@Z
?GetWidth@Element@DirectUI@@QEAAHXZ
?SetWidth@Element@DirectUI@@QEAAJH@Z
?GetSize@Value@DirectUI@@QEAAPEBUtagSIZE@@XZ
?ExtentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetKeyFocusedElement@HWNDElement@DirectUI@@SAPEAVElement@2@XZ
UnInitProcessPriv
UnInitThread
InitThread
InitProcessPriv
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?IsDestroyed@Element@DirectUI@@QEAA_NXZ
?GetLocation@Element@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z
?GetParent@Element@DirectUI@@QEAAPEAV12@XZ
?SetX@Element@DirectUI@@QEAAJH@Z
?GetPadding@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z
?GetBorderThickness@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z
?SetContentAlign@Element@DirectUI@@QEAAJH@Z
EnableAnimations
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?GetLayoutPos@Element@DirectUI@@QEAAHXZ
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z
?OnNotify@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnPropertyChanged@HWNDHost@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetClassInfoPtr@HWNDHost@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@HWNDHost@DirectUI@@SAJXZ
?OnInput@HWNDHost@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?Release@Element@DirectUI@@QEAAKXZ
?Initialize@HWNDHost@DirectUI@@QEAAJIIPEAVElement@2@PEAK@Z
??1HWNDHost@DirectUI@@UEAA@XZ
??0HWNDHost@DirectUI@@QEAA@XZ
??1CCListView@DirectUI@@UEAA@XZ
?PostCreate@CCBase@DirectUI@@MEAAXPEAUHWND__@@@Z
?OnReceivedDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
?OnLostDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z
?OnCustomDraw@CCBase@DirectUI@@UEAA_NPEAUtagNMCUSTOMDRAWINFO@@PEA_J@Z
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z
?DefaultAction@CCBase@DirectUI@@UEAAJXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?GetContentSize@CCListView@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@CCBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetClassInfoPtr@CCListView@DirectUI@@SAPEAUIClassInfo@2@XZ
?Register@CCListView@DirectUI@@SAJXZ
?OnInput@CCBase@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?GetDisplayNode@Element@DirectUI@@QEAAPEAUHGADGET__@@XZ
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ
?OnNotify@CCBase@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?GetRootRelativeBounds@Element@DirectUI@@QEAAJPEAUtagRECT@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
?SetWinStyle@CCBase@DirectUI@@QEAAJH@Z
?Initialize@CCListView@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
?CreateHWND@CCBase@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z
??0CCListView@DirectUI@@QEAA@XZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?_OnUIStateChanged@HWNDElement@DirectUI@@MEAAXGG@Z
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z
?Register@HWNDElement@DirectUI@@SAJXZ
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
?IsMSAAEnabled@HWNDElement@DirectUI@@UEAA_NXZ
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?RemoveTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z
?UpdateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
??1CritSecLock@DirectUI@@QEAA@XZ
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@HWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?IsRTL@Element@DirectUI@@QEAA_NXZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
??0ClassInfoBase@DirectUI@@QEAA@XZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z

api-ms-win-core-appcompat-l1-1-1

BaseFreeAppCompatDataForProcess
BaseReadAppCompatDataForProcess

kernel32

GetPackageFullName
CreateTimerQueueTimer
DeleteTimerQueueTimer
RaiseException
PackageFamilyNameFromFullName
RegisterApplicationRestart
GetProcessorSystemCycleTime
GetActiveProcessorGroupCount
SetProcessWorkingSetSize

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

Sections

.text
Size: 737KB - Virtual size: 736KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 29KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 342KB - Virtual size: 341KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c96a2755c8b3b31e42365df77c11c290

Code Sign

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4eCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

32:aa:b4:a4:2b:f4:4a:84:d9:d2:9b:eb:5b:87:d0:dc:ea:0b:89:15:b4:72:b8:15:c0:07:86:29:85:a4:ed:0cSigner

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

msvcrt

oleaut32

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-io-l1-1-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-file-l1-2-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

pcwum

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-localization-l2-1-0

comctl32

ntdll

uxtheme

shlwapi

shell32

credui

duser

dui70

api-ms-win-core-appcompat-l1-1-1

kernel32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 737KB - Virtual size: 736KB

.imrsiv Size: - Virtual size: 4B

.data Size: 29KB - Virtual size: 56KB

.pdata Size: 31KB - Virtual size: 30KB

.idata Size: 44KB - Virtual size: 43KB

.didat Size: 1024B - Virtual size: 896B

.rsrc Size: 342KB - Virtual size: 341KB

.reloc Size: 6KB - Virtual size: 5KB

33:00:00:00:4e:a1:d8:07:70:a9:bb:e9:44:00:00:00:00:00:4e
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

32:aa:b4:a4:2b:f4:4a:84:d9:d2:9b:eb:5b:87:d0:dc:ea:0b:89:15:b4:72:b8:15:c0:07:86:29:85:a4:ed:0c
Signer

.text
Size: 737KB - Virtual size: 736KB

.imrsiv
Size: - Virtual size: 4B

.data
Size: 29KB - Virtual size: 56KB

.pdata
Size: 31KB - Virtual size: 30KB

.idata
Size: 44KB - Virtual size: 43KB

.didat
Size: 1024B - Virtual size: 896B

.rsrc
Size: 342KB - Virtual size: 341KB

.reloc
Size: 6KB - Virtual size: 5KB