Static task
static1
Behavioral task
behavioral1
Sample
3a16d320ba1bd57b5f77e9ea2353508f4020a059ab4bec860a57792058a89ca5.exe
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral2
Sample
3a16d320ba1bd57b5f77e9ea2353508f4020a059ab4bec860a57792058a89ca5.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
General
-
Target
3a16d320ba1bd57b5f77e9ea2353508f4020a059ab4bec860a57792058a89ca5
-
Size
5.1MB
-
MD5
05618440a2a03e160a0d692244e41f98
-
SHA1
480b5eba21830fd1caef60e7e5903195606fb828
-
SHA256
3a16d320ba1bd57b5f77e9ea2353508f4020a059ab4bec860a57792058a89ca5
-
SHA512
54acdfa7f380a8899c791b5fde581fb23e006f41e12d61396dcaa15015511418d9b29e97fb46b7ae9806944b42bdd5851bdee0f8290058a82d6519d4825f169d
-
SSDEEP
98304:9UlKhKsM0kSL+7w8LDjTRlUTRlhwD527BWG:u9sOU8/jTR+TRgVQBWG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a16d320ba1bd57b5f77e9ea2353508f4020a059ab4bec860a57792058a89ca5
Files
-
3a16d320ba1bd57b5f77e9ea2353508f4020a059ab4bec860a57792058a89ca5.exe windows:6 windows x86 arch:x86
c21f6f0290b94198686c6c700cbfce4c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
getsockopt
WSACleanup
__WSAFDIsSet
bind
closesocket
select
WSASetLastError
getaddrinfo
WSAStartup
getpeername
getsockname
socket
connect
ntohs
accept
listen
shutdown
WSARecvFrom
WSASendTo
WSAPoll
recv
htons
freeaddrinfo
ioctlsocket
setsockopt
WSAGetLastError
htonl
ntohl
WSASend
inet_addr
inet_ntoa
WSACreateEvent
WSAEventSelect
sendto
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSARecv
recvfrom
send
beacon_sdk
?set_common_param_getters@BeaconClient@@SAXABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@@std@@@2@@std@@@Z
?set_common_params@BeaconClient@@SAXABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@Z
?Report@BeaconClient@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@3@W4RequestPriority@Beacon@@@Z
?InitSDK@BeaconClient@@SAXABUBeaconConfig@@@Z
?UninitSDK@BeaconClient@@SAXXZ
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
LoadResource
FindResourceW
FindResourceExW
Sleep
VirtualProtect
IsBadWritePtr
VirtualQuery
LoadLibraryExW
TerminateProcess
GetCurrentThreadId
TerminateThread
GetCurrentThread
IsBadReadPtr
WriteProcessMemory
GetSystemDefaultLangID
GetSystemInfo
GetSystemDirectoryW
GetDriveTypeW
lstrcpynW
GetTempPathW
CreateMutexW
ReleaseMutex
LocalFree
GetPrivateProfileIntW
LoadLibraryA
FormatMessageW
WideCharToMultiByte
DeviceIoControl
GetDiskFreeSpaceExW
CreateFileW
GetLogicalDrives
GetModuleFileNameW
GetFileSize
ReadFile
FindFirstFileW
DeleteFileW
CopyFileW
FindNextFileW
FindClose
InitializeCriticalSectionEx
DeleteCriticalSection
GetCommandLineW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetFileAttributesW
GetLocaleInfoW
GetEnvironmentVariableW
LeaveCriticalSection
EnterCriticalSection
GetSystemTime
SystemTimeToFileTime
GetModuleFileNameA
GetLocalTime
RemoveDirectoryW
CreateToolhelp32Snapshot
GetTickCount
WriteFile
SetFilePointer
GetFileAttributesExW
MoveFileW
ReadProcessMemory
VirtualAllocEx
ResumeThread
VirtualAlloc
GetThreadContext
SetThreadContext
LockResource
SuspendThread
SetLastError
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemPowerStatus
OutputDebugStringW
InitializeCriticalSection
ExpandEnvironmentStringsA
SleepEx
FormatMessageA
CreateEventW
SetEvent
SearchPathW
GetCurrentProcessId
SetUnhandledExceptionFilter
Thread32First
Thread32Next
OpenThread
DuplicateHandle
Module32FirstW
Module32NextW
SetErrorMode
WaitForMultipleObjects
RaiseException
CreateFileA
FileTimeToLocalFileTime
GetDateFormatA
GetTimeFormatA
GetLocaleInfoA
IsDBCSLeadByte
GetNumberFormatA
GetCurrencyFormatA
GetCPInfo
SwitchToThread
OpenProcess
CopyFileA
lstrlenA
FlushFileBuffers
GetModuleHandleA
InterlockedExchange
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
K32GetModuleFileNameExA
GetFileInformationByHandle
GlobalFree
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
IsDebuggerPresent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetLongPathNameW
GetStdHandle
GetVersionExA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetExitCodeThread
HeapSize
HeapDestroy
MultiByteToWideChar
FreeLibrary
LoadLibraryW
GetCurrentProcess
GetVersionExW
CloseHandle
WaitForSingleObject
CreateProcessW
GlobalMemoryStatusEx
GetModuleHandleW
GetProcAddress
GetLastError
GetConsoleMode
GetModuleHandleExW
GetFileType
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
SetConsoleMode
ReadConsoleA
ReadConsoleW
FlushInstructionCache
GetTimeZoneInformation
user32
GetDesktopWindow
EnumDisplayDevicesW
GetMonitorInfoW
FindWindowW
GetSystemMetrics
wsprintfW
MessageBoxW
GetWindowTextW
SetWindowLongW
GetWindowLongW
EnableWindow
IsWindow
FindWindowExW
SetWindowTextW
SendMessageW
SetCursorPos
GetCursorPos
EnumDisplaySettingsW
DestroyWindow
ReleaseDC
GetDC
CreateWindowExA
RegisterClassExA
DefWindowProcW
GetProcessWindowStation
GetUserObjectInformationW
MonitorFromWindow
gdi32
SetPixelFormat
ChoosePixelFormat
GetDeviceCaps
advapi32
RegOpenKeyExW
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
RegQueryValueExA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
shell32
SHCreateDirectoryExW
SHGetSpecialFolderPathW
CommandLineToArgvW
ole32
CoCreateGuid
msvcp140
?classic@locale@std@@SAABV12@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?exceptions@ios_base@std@@QAEXH@Z
?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Winerror_message@std@@YAKKPADK@Z
??_D?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?uncaught_exception@std@@YA_NXZ
?_BADOFF@std@@3_JB
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Xbad_function_call@std@@YAXXZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Incref@facet@locale@std@@UAEXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
_Thrd_hardware_concurrency
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Mtx_unlock
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Xtime_get_ticks
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAHH@Z
_Stat
??1facet@locale@std@@MAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
??0facet@locale@std@@IAE@I@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?is@?$ctype@_W@std@@QBE_NF_W@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$collate@_W@std@@2V0locale@2@A
_Wcsxfrm
_Wcscoll
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z
_To_wide
_To_byte
_Thrd_detach
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_counter
_Query_perf_frequency
_Cnd_wait
_Cnd_do_broadcast_at_thread_exit
_Thrd_start
_Mtx_destroy
_Cnd_destroy
_Cnd_signal
_Mtx_init
_Cnd_init
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
shlwapi
PathFileExistsA
PathAppendA
StrFromTimeIntervalA
StrFormatKBSizeA
StrFormatByteSize64A
StrFormatByteSizeA
SHGetValueW
PathAppendW
StrFormatByteSizeW
PathFindFileNameW
PathAddBackslashW
PathRemoveFileSpecA
PathFileExistsW
PathRemoveFileSpecW
PathCombineW
opengl32
wglGetProcAddress
wglDeleteContext
glGetString
wglMakeCurrent
wglCreateContext
netapi32
NetWkstaGetInfo
NetApiBufferFree
iphlpapi
IcmpSendEcho
IcmpCreateFile
IcmpCloseHandle
psapi
GetProcessMemoryInfo
GetPerformanceInfo
d3d9
Direct3DCreate9
wininet
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetReadFile
InternetCloseHandle
winhttp
WinHttpWriteData
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpReceiveResponse
WinHttpQueryHeaders
vcruntime140
__RTtypeid
__RTDynamicCast
_except_handler4_common
__vcrt_InitializeCriticalSectionEx
__std_type_info_name
__std_terminate
memmove
__std_exception_destroy
__std_exception_copy
_purecall
strchr
wcsstr
memchr
strstr
__std_type_info_compare
wcsrchr
wcschr
strrchr
_set_purecall_handler
_CxxThrowException
__CxxFrameHandler3
memcpy
memset
api-ms-win-crt-runtime-l1-1-0
strerror_s
_set_invalid_parameter_handler
_beginthreadex
raise
signal
_errno
_invalid_parameter_noinfo_noreturn
__sys_nerr
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
strerror
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_invalid_parameter_noinfo
_controlfp_s
api-ms-win-crt-stdio-l1-1-0
fread
__p__commode
feof
putchar
putwchar
_set_fmode
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vsnprintf_s
__stdio_common_vswprintf
_fileno
ferror
fputs
_setmode
__stdio_common_vswprintf_s
fopen
__acrt_iob_func
_wfopen
fgets
fclose
ftell
__stdio_common_vsprintf
__stdio_common_vfprintf
fgetc
fseek
__stdio_common_vswscanf
fputc
__stdio_common_vsnwprintf_s
ungetc
fflush
setvbuf
fsetpos
_fseeki64
fgetpos
fwrite
_get_stream_buffer_pointers
api-ms-win-crt-string-l1-1-0
isalpha
_wcsupr_s
_wcslwr
toupper
wcsncmp
wcsncpy
strncpy
wcscat_s
wcsnlen
isxdigit
_wcslwr_s
wcsspn
wcscspn
strnlen
strcpy_s
wmemcpy_s
tolower
wcscpy_s
_wcsdup
strncmp
strncat_s
iswdigit
isalnum
strtok_s
strpbrk
_wcsicmp
_strnicmp
_strdup
isspace
_stricmp
strspn
isdigit
strcspn
strcmp
_wcsnicmp
wcsncat_s
wcsncpy_s
api-ms-win-crt-heap-l1-1-0
calloc
malloc
realloc
free
_recalloc
_callnewh
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtod
_strtoi64
_wtoi
atoi
wcstol
wcstoul
strtoul
atol
_itow_s
strtoll
strtoull
_wtol
strtol
api-ms-win-crt-math-l1-1-0
floor
_copysign
_except1
_finite
_isnan
__setusermatherr
_dsign
_dtest
ceil
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-filesystem-l1-1-0
_stat64
_lock_file
_wsplitpath_s
_unlock_file
_stat32
api-ms-win-crt-time-l1-1-0
_time32
_gmtime64
_mktime64
_time64
_localtime64_s
strftime
_localtime64
_gmtime32_s
api-ms-win-crt-utility-l1-1-0
srand
rand
qsort
api-ms-win-crt-environment-l1-1-0
getenv
crypt32
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertCloseStore
bcrypt
BCryptGenRandom
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 789KB - Virtual size: 788KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 21B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 804KB - Virtual size: 804KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 756KB - Virtual size: 760KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE