a3e4d74377faba9330144576952e6da5

Sharing

Copy URL Twitter E-mail

General

Target

a3e4d74377faba9330144576952e6da5
Size

1.1MB
MD5

a3e4d74377faba9330144576952e6da5
SHA1

2ec95960fc310a93ee3a9224943bca8271c33d50
SHA256

547a9994e485dd5ac2339231c37fabd0208498c73b53dc483725592547173974
SHA512

c381c248be68090cc002a964b215fea7796bfc4e6ee3ce2fb76eea13a7d76fded3b4f81384c1bd7cf4e9df888e6e4d5d08dc91db9fe9193d7270eb2950e19113
SSDEEP

24576:unozQUBZhMXYaxjCjr/zQGhkR/Gl6VlnSP+aPEHXhYTa9RpmenCfRgz:lLh8Yaxob64kTS2aPEHXhYT6MeCfO

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/xzwert.exe	upx

Unsigned PE 27 IoCs

Checks for missing Authenticode signature.

resource
a3e4d74377faba9330144576952e6da5
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/X shmgrate.exe
unpack001/$PLUGINSDIR/Y gamemonitor.dll
unpack001/$PLUGINSDIR/Z shmgrate.exe
unpack001/$PLUGINSDIR/cmutil.dll
unpack001/$PLUGINSDIR/colbact.dll
unpack001/$PLUGINSDIR/msimn.exe
unpack001/$PLUGINSDIR/nsJSON.dll
unpack001/$PLUGINSDIR/shmgrate.exe
unpack001/$PLUGINSDIR/xzwert.exe
unpack002/out.upx
unpack001/$PLUGINSDIR/Копия (2) X shmgrate.exe
unpack001/$PLUGINSDIR/Копия (2) Y gamemonitor.dll
unpack001/$PLUGINSDIR/Копия (2) Z shmgrate.exe
unpack001/$PLUGINSDIR/Копия (2) cmutil.dll
unpack001/$PLUGINSDIR/Копия (2) colbact.dll
unpack001/$PLUGINSDIR/Копия (2) msimn.exe
unpack001/$PLUGINSDIR/Копия (2) shmgrate.exe
unpack001/$PLUGINSDIR/Копия X shmgrate.exe
unpack001/$PLUGINSDIR/Копия Y gamemonitor.dll
unpack001/$PLUGINSDIR/Копия Z shmgrate.exe
unpack001/$PLUGINSDIR/Копия cmutil.dll
unpack001/$PLUGINSDIR/Копия colbact.dll
unpack001/$PLUGINSDIR/Копия msimn.exe
unpack001/$PLUGINSDIR/Копия shmgrate.exe

Files

a3e4d74377faba9330144576952e6da5
.exe windows:4 windows

b34f154ec913d2d2c435cbd644e91687

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
GetShortPathNameW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW

user32

GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage

gdi32

SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW

advapi32

AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 408KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/INetC.dll
.dll windows:4 windows x86 arch:x86

735e27ae3d7df8c0487e4353d04f6f28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LocalFree
WideCharToMultiByte
TerminateThread
lstrcpyW
LoadLibraryA
CreateThread
WaitForSingleObject
LocalAlloc
lstrcpynW
SleepEx
MulDiv
GetModuleHandleW
ReadFile
GetLastError
CreateFileW
lstrcmpiW
CreateFileA
lstrcatW
GetFileSize
SetFilePointer
lstrcmpW
MultiByteToWideChar
lstrlenA
WriteFile
lstrlenW
CloseHandle
GlobalAlloc
GlobalFree
GetTickCount
DeleteFileW

user32

GetDlgItem
DestroyWindow
GetClientRect
MessageBoxW
wsprintfA
SystemParametersInfoW
GetWindowTextW
GetWindowLongW
FindWindowExW
IsWindow
CreateDialogParamW
GetParent
ShowWindow
KillTimer
DispatchMessageW
LoadIconW
PostMessageW
IsDialogMessageW
GetMessageW
SetWindowPos
SendDlgItemMessageW
SetWindowTextW
TranslateMessage
GetWindowRect
RedrawWindow
SetTimer
EnableWindow
UpdateWindow
SetWindowLongW
wsprintfW
SendMessageW
SetDlgItemTextW
IsWindowVisible

comctl32

ord17

wininet

InternetConnectW
HttpOpenRequestW
InternetQueryOptionW
InternetErrorDlg
HttpSendRequestExW
InternetWriteFile
HttpSendRequestW
InternetSetFilePointer
HttpAddRequestHeadersA
FtpCreateDirectoryW
InternetCrackUrlW
FtpOpenFileW
InternetSetOptionW
InternetOpenW
InternetGetLastResponseInfoW
HttpEndRequestW
InternetReadFile
HttpAddRequestHeadersW
InternetCloseHandle
HttpQueryInfoW

Exports

Exports

get
head
post
put

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 851B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/X shmgrate.exe
.exe windows:5 windows x86 arch:x86

6065885756bba943e8280c2e981263aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

shmgrate.pdb

Imports

msvcrt

wcscat
wcslen
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsncmp
_c_exit
_exit
_XcptFilter
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
swscanf

advapi32

RegSetValueExW
RegFlushKey
RegDeleteKeyW
RegSetValueW
RegOpenKeyExA
SetFileSecurityW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegSetKeySecurity
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW

kernel32

LoadLibraryExA
GetVersionExW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetSystemDefaultUILanguage
LoadLibraryExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
lstrcmpA
MultiByteToWideChar
LocalFree
LocalAlloc
lstrcpyW
lstrcmpW
lstrcmpiW
GlobalFree
GetLastError
GlobalAlloc
SetFileAttributesW
GetFileAttributesW
lstrcpynW
lstrlenW
ExpandEnvironmentStringsW
CreateDirectoryW
GetModuleHandleW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
ExitProcess
lstrcpynA
lstrcmpiA

user32

LoadStringW
wsprintfW
GetMenuItemInfoW
GetMenuItemCount
CreatePopupMenu
DestroyMenu

userenv

ord127
ord120
ord128

shlwapi

PathFindExtensionW
ord158
StrStrIW
SHDeleteKeyW
SHCopyKeyW
ord433
PathRemoveExtensionW
PathRemoveBlanksW
PathCombineW
wnsprintfW
StrCmpIW
StrToIntW
SHSetValueW
SHGetValueW
PathAddExtensionW
PathAppendW
ord437
StrCatBuffW
SHDeleteValueW

shell32

SHParseDisplayName
SHBindToParent
ord155
SHGetSpecialFolderLocation
SHChangeNotify
SHGetMalloc
SHSetLocalizedName
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Y gamemonitor.dll
.dll windows:10 windows x86 arch:x86

124f39e35406c6693b3ebc4b939d327f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

gamemonitor.pdb

Imports

msvcrt

_lock
_unlock
__dllonexit
malloc
free
_amsg_exit
_XcptFilter
??3@YAXPAX@Z
_initterm
_onexit
_except_handler4_common

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
InitializeCriticalSection
Sleep
DeleteCriticalSection
LeaveCriticalSection

rpcrt4

NdrClientCall4
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringFreeW

api-ms-win-core-errorhandling-l1-1-1

GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-base-l1-2-0

CreateWellKnownSid

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

Exports

Exports

EnableActiveGameMonitoring
ReportGameActivity
SetGameActivityCorrelationId

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Z shmgrate.exe
.exe windows:5 windows x86 arch:x86

6065885756bba943e8280c2e981263aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

shmgrate.pdb

Imports

msvcrt

wcscat
wcslen
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsncmp
_c_exit
_exit
_XcptFilter
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
swscanf

advapi32

RegSetValueExW
RegFlushKey
RegDeleteKeyW
RegSetValueW
RegOpenKeyExA
SetFileSecurityW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegSetKeySecurity
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW

kernel32

LoadLibraryExA
GetVersionExW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetSystemDefaultUILanguage
LoadLibraryExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
lstrcmpA
MultiByteToWideChar
LocalFree
LocalAlloc
lstrcpyW
lstrcmpW
lstrcmpiW
GlobalFree
GetLastError
GlobalAlloc
SetFileAttributesW
GetFileAttributesW
lstrcpynW
lstrlenW
ExpandEnvironmentStringsW
CreateDirectoryW
GetModuleHandleW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
ExitProcess
lstrcpynA
lstrcmpiA

user32

LoadStringW
wsprintfW
GetMenuItemInfoW
GetMenuItemCount
CreatePopupMenu
DestroyMenu

userenv

ord127
ord120
ord128

shlwapi

PathFindExtensionW
ord158
StrStrIW
SHDeleteKeyW
SHCopyKeyW
ord433
PathRemoveExtensionW
PathRemoveBlanksW
PathCombineW
wnsprintfW
StrCmpIW
StrToIntW
SHSetValueW
SHGetValueW
PathAddExtensionW
PathAppendW
ord437
StrCatBuffW
SHDeleteValueW

shell32

SHParseDisplayName
SHBindToParent
ord155
SHGetSpecialFolderLocation
SHChangeNotify
SHGetMalloc
SHSetLocalizedName
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/cmutil.dll
.dll windows:10 windows x86 arch:x86

b6eb0fc3e1eb90686e00f2c890ade2b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cmutil.pdb

Imports

msvcrt

_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnwprintf
_vsnprintf
memset

advapi32

RegQueryValueExA
RegQueryValueExW
RegCloseKey
RegCreateKeyExA
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
GetTokenInformation
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegDeleteValueW

gdi32

CreateFontIndirectW
DeleteObject
GetObjectA

kernel32

Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetVersionExW
GetTickCount
lstrlenA
GetLastError
CreateFileA
CloseHandle
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringW
lstrlenW
GetPrivateProfileIntW
CreateFileW
GetPrivateProfileStringW
CreateDirectoryW
HeapFree
WriteFile
ExpandEnvironmentStringsW
SetFilePointer
SetEndOfFile
GetTempPathW
GetFileAttributesW
TlsGetValue
GetSystemDirectoryW
HeapAlloc
GetFileSize
GetProcessHeap
WideCharToMultiByte
lstrcmpiW
lstrcmpW
FlushFileBuffers
GetCurrentProcess
GetProcAddress
GetTimeFormatW
FreeLibrary
GetDateFormatW
LoadLibraryExW
DisableThreadLibraryCalls
TlsAlloc
TlsFree
HeapReAlloc
CompareStringW
TlsSetValue
SetLastError
GetStringTypeExW
MultiByteToWideChar
CompareStringA
GetStringTypeExA
IsDBCSLeadByte

user32

CharNextA
LoadImageW
GetSystemMetrics
LoadImageA
LoadStringW
LoadStringA
CharUpperW
SendMessageW
CharPrevW
CharNextW

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Exports

Exports

??0CIniA@@QAE@PAUHINSTANCE__@@PBD111@Z
??0CIniW@@QAE@PAUHINSTANCE__@@PBG111@Z
??0CRandom@@QAE@I@Z
??0CRandom@@QAE@XZ
??0CmLogFile@@QAE@XZ
??1CIniA@@QAE@XZ
??1CIniW@@QAE@XZ
??1CmLogFile@@QAE@XZ
??4CIniA@@QAEAAV0@ABV0@@Z
??4CIniW@@QAEAAV0@ABV0@@Z
??4CRandom@@QAEAAV0@$$QAV0@@Z
??4CRandom@@QAEAAV0@ABV0@@Z
??4CmLogFile@@QAEAAV0@ABV0@@Z
??_FCIniA@@QAEXXZ
??_FCIniW@@QAEXXZ
?Banner@CmLogFile@@QAEXXZ
?CIniA_DeleteEntryFromReg@CIniA@@IBEHPAUHKEY__@@PBD1@Z
?CIniA_GetEntryFromReg@CIniA@@IBEPAEPAUHKEY__@@PBD1KK@Z
?CIniA_WriteEntryToReg@CIniA@@IBEHPAUHKEY__@@PBD1PBEKK@Z
?CIniW_DeleteEntryFromReg@CIniW@@IBEHPAUHKEY__@@PBG1@Z
?CIniW_GetEntryFromReg@CIniW@@IBEPAEPAUHKEY__@@PBG1KK@Z
?CIniW_WriteEntryToReg@CIniW@@IBEHPAUHKEY__@@PBG1PBEKK@Z
?CIni_SetFile@CIniA@@KGXPAPADPBD@Z
?CIni_SetFile@CIniW@@KGXPAPAGPBG@Z
?Clear@CIniA@@QAEXXZ
?Clear@CIniW@@QAEXXZ
?Clear@CmLogFile@@QAEXH@Z
?CloseFile@CmLogFile@@AAEJXZ
?DeInit@CmLogFile@@QAEJXZ
?FormatWrite@CmLogFile@@AAEXW4_CMLOG_ITEM@@PAG@Z
?GPPB@CIniA@@QBEHPBD0H@Z
?GPPB@CIniW@@QBEHPBG0H@Z
?GPPI@CIniA@@QBEKPBD0K@Z
?GPPI@CIniW@@QBEKPBG0K@Z
?GPPS@CIniA@@QBEPADPBD00@Z
?GPPS@CIniW@@QBEPAGPBG00@Z
?Generate@CRandom@@QAEHXZ
?GetFile@CIniA@@QBEPBDXZ
?GetFile@CIniW@@QBEPBGXZ
?GetHInst@CIniA@@QBEPAUHINSTANCE__@@XZ
?GetHInst@CIniW@@QBEPAUHINSTANCE__@@XZ
?GetLogFilePath@CmLogFile@@QAEPBGXZ
?GetPrimaryFile@CIniA@@QBEPBDXZ
?GetPrimaryFile@CIniW@@QBEPBGXZ
?GetPrimaryRegPath@CIniA@@QBEPBDXZ
?GetPrimaryRegPath@CIniW@@QBEPBGXZ
?GetRegPath@CIniA@@QBEPBDXZ
?GetRegPath@CIniW@@QBEPBGXZ
?GetSection@CIniA@@QBEPBDXZ
?GetSection@CIniW@@QBEPBGXZ
?Init@CRandom@@QAEXK@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBD@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBG@Z
?IsEnabled@CmLogFile@@QAEHXZ
?LoadEntry@CIniA@@IBEPADPBD@Z
?LoadEntry@CIniW@@IBEPAGPBG@Z
?LoadSection@CIniA@@QBEPADPBD@Z
?LoadSection@CIniW@@QBEPAGPBG@Z
?Log@CmLogFile@@QAAXW4_CMLOG_ITEM@@ZZ
?OpenFile@CmLogFile@@AAEJXZ
?SetEntry@CIniA@@QAEXPBD@Z
?SetEntry@CIniW@@QAEXPBG@Z
?SetEntryFromIdx@CIniA@@QAEXK@Z
?SetEntryFromIdx@CIniW@@QAEXK@Z
?SetFile@CIniA@@QAEXPBD@Z
?SetFile@CIniW@@QAEXPBG@Z
?SetHInst@CIniA@@QAEXPAUHINSTANCE__@@@Z
?SetHInst@CIniW@@QAEXPAUHINSTANCE__@@@Z
?SetICSDataPath@CIniA@@QAEXPBD@Z
?SetICSDataPath@CIniW@@QAEXPBG@Z
?SetParams@CmLogFile@@QAEJHKPBD@Z
?SetParams@CmLogFile@@QAEJHKPBG@Z
?SetPrimaryFile@CIniA@@QAEXPBD@Z
?SetPrimaryFile@CIniW@@QAEXPBG@Z
?SetPrimaryRegPath@CIniA@@QAEXPBD@Z
?SetPrimaryRegPath@CIniW@@QAEXPBG@Z
?SetReadICSData@CIniA@@QAEXH@Z
?SetReadICSData@CIniW@@QAEXH@Z
?SetRegPath@CIniA@@QAEXPBD@Z
?SetRegPath@CIniW@@QAEXPBG@Z
?SetSection@CIniA@@QAEXPBD@Z
?SetSection@CIniW@@QAEXPBG@Z
?SetWriteICSData@CIniA@@QAEXH@Z
?SetWriteICSData@CIniW@@QAEXH@Z
?Start@CmLogFile@@QAEJH@Z
?Stop@CmLogFile@@QAEJXZ
?WPPB@CIniA@@QAEXPBD0H@Z
?WPPB@CIniW@@QAEXPBG0H@Z
?WPPI@CIniA@@QAEXPBD0K@Z
?WPPI@CIniW@@QAEXPBG0K@Z
?WPPS@CIniA@@QAEXPBD00@Z
?WPPS@CIniW@@QAEXPBG00@Z
?Write@CmLogFile@@AAEJPAG@Z
?kMaxValueLength@CIniW@@2KB
CmAtolA
CmAtolW
CmBuildFullPathFromRelativeA
CmBuildFullPathFromRelativeW
CmCompareStringA
CmCompareStringW
CmConvertRelativePathW
CmConvertStrToIPv6AddrA
CmConvertStrToIPv6AddrW
CmEndOfStrW
CmFmtMsgA
CmFmtMsgW
CmFree
CmIsDigitW
CmIsIPv6AddressA
CmIsIPv6AddressW
CmIsSpaceW
CmLoadIconA
CmLoadIconW
CmLoadImageW
CmLoadSmallIconA
CmLoadSmallIconW
CmLoadStringW
CmMalloc
CmMoveMemory
CmParsePathW
CmRealloc
CmStrCatAllocA
CmStrCatAllocW
CmStrCharCountA
CmStrCharCountW
CmStrCharStuffingA
CmStrCharStuffingW
CmStrCpyAllocA
CmStrCpyAllocW
CmStrStrA
CmStrStrW
CmStrTrimW
CmStrchrA
CmStrchrW
CmStripFileNameW
CmStripPathAndExtW
CmStrrchrA
CmStrrchrW
CmStrtokA
CmStrtokW
GetOSBuildNumber
GetOSMajorVersion
GetOSMinorVersion
GetOSVersion
IsFarEastNonOSR2Win95
IsLogonAsSystem
MakeBold
ReleaseBold
SzToWz
SzToWzWithAlloc
WzToSz
WzToSzWithAlloc

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/colbact.dll
.dll regsvr32 windows:10 windows x86 arch:x86

a1f69021c0c05a73763b1375489b45a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

colbact.pdb

Imports

msvcrt

_CIfmod
_ftol2
_local_unwind4
floor
memcpy
time
rand
srand
_wstrtime
wcsrchr
_waccess
_vsnwprintf
_wstrdate
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wcsicmp
memset

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey

api-ms-win-core-com-l1-1-1

CLSIDFromString
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
CoGetObjectContext

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
LoadStringW
GetModuleHandleW
LockResource
DisableThreadLibraryCalls
FindResourceExW
LoadResource

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
SetEvent
ReleaseMutex
OpenMutexW
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
ReleaseSemaphore

rpcrt4

RpcStringFreeW
UuidToStringW
RpcImpersonateClient
RpcRevertToSelf

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
SetThreadStackGuarantee
CreateThread
TlsFree
GetCurrentThread
TlsGetValue
TerminateProcess
GetCurrentProcess
SetThreadToken
GetCurrentThreadId
TlsAlloc
CreateProcessW
OpenProcessToken
GetExitCodeProcess
TlsSetValue
GetThreadContext
OpenThreadToken

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent
DebugBreak
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-2-1

GetLocalTime
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-security-base-l1-2-0

GetTokenInformation
EqualSid
GetLengthSid
DuplicateToken
FreeSid
InitializeSid
CopySid
IsValidSid
GetSidLengthRequired
AllocateAndInitializeSid

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

RtlImageNtHeader
RtlAllocateHeap
RtlFreeHeap

api-ms-win-core-file-l1-2-1

FindClose
SetFileAttributesW
CreateDirectoryW
CompareFileTime
FindNextFileW
FindFirstFileW
DeleteFileW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-memory-l1-1-2

VirtualQuery
OpenFileMappingW
MapViewOfFile
VirtualProtect
VirtualAlloc

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetClassInfoForCurrentUser
GetDefaultPartitionForCurrentUser
GetDefaultPartitionForSid
PartitionAccessCheck

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/msimn.exe
.exe windows:5 windows x86 arch:x86

4dcec2841207709ba9c35c9a84029300

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

msimn.pdb

Imports

msvcrt

_vsnprintf

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

kernel32

GetVersionExA
UnhandledExceptionFilter
CloseHandle
ReleaseMutex
GetFileAttributesA
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
lstrlenW
WaitForSingleObject
CreateMutexA
ExitProcess
GetModuleHandleA
GetStartupInfoA
SetErrorMode
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
lstrcpynA
SetUnhandledExceptionFilter
lstrlenA
GetEnvironmentVariableA
GetModuleFileNameA

user32

GetWindowThreadProcessId
SetForegroundWindow
SendMessageTimeoutA
LoadStringA
MessageBoxA

shlwapi

SHGetValueA
StrCmpIW
ord67
SHSetValueA
StrStrIA
PathRemoveFileSpecA
ord157

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsJSON.dll
.dll windows:6 windows x86 arch:x86

674631b5b86309caa1d0df66c91a50f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

HttpQueryInfoW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetSetOptionW
InternetQueryDataAvailable
InternetReadFile
InternetConnectW
InternetCloseHandle
InternetOpenW
InternetCrackUrlW

kernel32

lstrcpyW
GetModuleHandleA
CreateProcessW
CreateThread
GetExitCodeProcess
WaitForSingleObject
CreatePipe
SetHandleInformation
lstrcpynW
lstrcatW
FormatMessageW
CreateFileW
GetFileSize
ReadFile
WriteFile
CloseHandle
GetLastError
SetLastError
GlobalAlloc
GlobalReAlloc
GlobalFree
lstrcmpW
lstrcmpiW
WideCharToMultiByte
lstrlenA
lstrlenW
MultiByteToWideChar
LocalFree

user32

wsprintfW
IsCharAlphaNumericW
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
MsgWaitForMultipleObjectsEx

Exports

Exports

Delete
Get
Quote
Serialize
Set
Sort
Wait

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/shmgrate.exe
.exe windows:5 windows x86 arch:x86

6065885756bba943e8280c2e981263aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

shmgrate.pdb

Imports

msvcrt

wcscat
wcslen
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsncmp
_c_exit
_exit
_XcptFilter
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
swscanf

advapi32

RegSetValueExW
RegFlushKey
RegDeleteKeyW
RegSetValueW
RegOpenKeyExA
SetFileSecurityW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegSetKeySecurity
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW

kernel32

LoadLibraryExA
GetVersionExW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetSystemDefaultUILanguage
LoadLibraryExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
lstrcmpA
MultiByteToWideChar
LocalFree
LocalAlloc
lstrcpyW
lstrcmpW
lstrcmpiW
GlobalFree
GetLastError
GlobalAlloc
SetFileAttributesW
GetFileAttributesW
lstrcpynW
lstrlenW
ExpandEnvironmentStringsW
CreateDirectoryW
GetModuleHandleW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
ExitProcess
lstrcpynA
lstrcmpiA

user32

LoadStringW
wsprintfW
GetMenuItemInfoW
GetMenuItemCount
CreatePopupMenu
DestroyMenu

userenv

ord127
ord120
ord128

shlwapi

PathFindExtensionW
ord158
StrStrIW
SHDeleteKeyW
SHCopyKeyW
ord433
PathRemoveExtensionW
PathRemoveBlanksW
PathCombineW
wnsprintfW
StrCmpIW
StrToIntW
SHSetValueW
SHGetValueW
PathAddExtensionW
PathAppendW
ord437
StrCatBuffW
SHDeleteValueW

shell32

SHParseDisplayName
SHBindToParent
ord155
SHGetSpecialFolderLocation
SHChangeNotify
SHGetMalloc
SHSetLocalizedName
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/xzwert.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 936KB - Virtual size: 936KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 199KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 582KB - Virtual size: 582KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/Копия (2) X shmgrate.exe
.exe windows:5 windows x86 arch:x86

6065885756bba943e8280c2e981263aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

shmgrate.pdb

Imports

msvcrt

wcscat
wcslen
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsncmp
_c_exit
_exit
_XcptFilter
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
swscanf

advapi32

RegSetValueExW
RegFlushKey
RegDeleteKeyW
RegSetValueW
RegOpenKeyExA
SetFileSecurityW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegSetKeySecurity
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW

kernel32

LoadLibraryExA
GetVersionExW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetSystemDefaultUILanguage
LoadLibraryExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
lstrcmpA
MultiByteToWideChar
LocalFree
LocalAlloc
lstrcpyW
lstrcmpW
lstrcmpiW
GlobalFree
GetLastError
GlobalAlloc
SetFileAttributesW
GetFileAttributesW
lstrcpynW
lstrlenW
ExpandEnvironmentStringsW
CreateDirectoryW
GetModuleHandleW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
ExitProcess
lstrcpynA
lstrcmpiA

user32

LoadStringW
wsprintfW
GetMenuItemInfoW
GetMenuItemCount
CreatePopupMenu
DestroyMenu

userenv

ord127
ord120
ord128

shlwapi

PathFindExtensionW
ord158
StrStrIW
SHDeleteKeyW
SHCopyKeyW
ord433
PathRemoveExtensionW
PathRemoveBlanksW
PathCombineW
wnsprintfW
StrCmpIW
StrToIntW
SHSetValueW
SHGetValueW
PathAddExtensionW
PathAppendW
ord437
StrCatBuffW
SHDeleteValueW

shell32

SHParseDisplayName
SHBindToParent
ord155
SHGetSpecialFolderLocation
SHChangeNotify
SHGetMalloc
SHSetLocalizedName
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Копия (2) Y gamemonitor.dll
.dll windows:10 windows x86 arch:x86

124f39e35406c6693b3ebc4b939d327f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

gamemonitor.pdb

Imports

msvcrt

_lock
_unlock
__dllonexit
malloc
free
_amsg_exit
_XcptFilter
??3@YAXPAX@Z
_initterm
_onexit
_except_handler4_common

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
InitializeCriticalSection
Sleep
DeleteCriticalSection
LeaveCriticalSection

rpcrt4

NdrClientCall4
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringFreeW

api-ms-win-core-errorhandling-l1-1-1

GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-base-l1-2-0

CreateWellKnownSid

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

Exports

Exports

EnableActiveGameMonitoring
ReportGameActivity
SetGameActivityCorrelationId

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Копия (2) Z shmgrate.exe
.exe windows:5 windows x86 arch:x86

6065885756bba943e8280c2e981263aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

shmgrate.pdb

Imports

msvcrt

wcscat
wcslen
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsncmp
_c_exit
_exit
_XcptFilter
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
swscanf

advapi32

RegSetValueExW
RegFlushKey
RegDeleteKeyW
RegSetValueW
RegOpenKeyExA
SetFileSecurityW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegSetKeySecurity
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW

kernel32

LoadLibraryExA
GetVersionExW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetSystemDefaultUILanguage
LoadLibraryExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
lstrcmpA
MultiByteToWideChar
LocalFree
LocalAlloc
lstrcpyW
lstrcmpW
lstrcmpiW
GlobalFree
GetLastError
GlobalAlloc
SetFileAttributesW
GetFileAttributesW
lstrcpynW
lstrlenW
ExpandEnvironmentStringsW
CreateDirectoryW
GetModuleHandleW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
ExitProcess
lstrcpynA
lstrcmpiA

user32

LoadStringW
wsprintfW
GetMenuItemInfoW
GetMenuItemCount
CreatePopupMenu
DestroyMenu

userenv

ord127
ord120
ord128

shlwapi

PathFindExtensionW
ord158
StrStrIW
SHDeleteKeyW
SHCopyKeyW
ord433
PathRemoveExtensionW
PathRemoveBlanksW
PathCombineW
wnsprintfW
StrCmpIW
StrToIntW
SHSetValueW
SHGetValueW
PathAddExtensionW
PathAppendW
ord437
StrCatBuffW
SHDeleteValueW

shell32

SHParseDisplayName
SHBindToParent
ord155
SHGetSpecialFolderLocation
SHChangeNotify
SHGetMalloc
SHSetLocalizedName
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Копия (2) cmutil.dll
.dll windows:10 windows x86 arch:x86

b6eb0fc3e1eb90686e00f2c890ade2b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cmutil.pdb

Imports

msvcrt

_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnwprintf
_vsnprintf
memset

advapi32

RegQueryValueExA
RegQueryValueExW
RegCloseKey
RegCreateKeyExA
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
GetTokenInformation
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegDeleteValueW

gdi32

CreateFontIndirectW
DeleteObject
GetObjectA

kernel32

Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetVersionExW
GetTickCount
lstrlenA
GetLastError
CreateFileA
CloseHandle
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringW
lstrlenW
GetPrivateProfileIntW
CreateFileW
GetPrivateProfileStringW
CreateDirectoryW
HeapFree
WriteFile
ExpandEnvironmentStringsW
SetFilePointer
SetEndOfFile
GetTempPathW
GetFileAttributesW
TlsGetValue
GetSystemDirectoryW
HeapAlloc
GetFileSize
GetProcessHeap
WideCharToMultiByte
lstrcmpiW
lstrcmpW
FlushFileBuffers
GetCurrentProcess
GetProcAddress
GetTimeFormatW
FreeLibrary
GetDateFormatW
LoadLibraryExW
DisableThreadLibraryCalls
TlsAlloc
TlsFree
HeapReAlloc
CompareStringW
TlsSetValue
SetLastError
GetStringTypeExW
MultiByteToWideChar
CompareStringA
GetStringTypeExA
IsDBCSLeadByte

user32

CharNextA
LoadImageW
GetSystemMetrics
LoadImageA
LoadStringW
LoadStringA
CharUpperW
SendMessageW
CharPrevW
CharNextW

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Exports

Exports

??0CIniA@@QAE@PAUHINSTANCE__@@PBD111@Z
??0CIniW@@QAE@PAUHINSTANCE__@@PBG111@Z
??0CRandom@@QAE@I@Z
??0CRandom@@QAE@XZ
??0CmLogFile@@QAE@XZ
??1CIniA@@QAE@XZ
??1CIniW@@QAE@XZ
??1CmLogFile@@QAE@XZ
??4CIniA@@QAEAAV0@ABV0@@Z
??4CIniW@@QAEAAV0@ABV0@@Z
??4CRandom@@QAEAAV0@$$QAV0@@Z
??4CRandom@@QAEAAV0@ABV0@@Z
??4CmLogFile@@QAEAAV0@ABV0@@Z
??_FCIniA@@QAEXXZ
??_FCIniW@@QAEXXZ
?Banner@CmLogFile@@QAEXXZ
?CIniA_DeleteEntryFromReg@CIniA@@IBEHPAUHKEY__@@PBD1@Z
?CIniA_GetEntryFromReg@CIniA@@IBEPAEPAUHKEY__@@PBD1KK@Z
?CIniA_WriteEntryToReg@CIniA@@IBEHPAUHKEY__@@PBD1PBEKK@Z
?CIniW_DeleteEntryFromReg@CIniW@@IBEHPAUHKEY__@@PBG1@Z
?CIniW_GetEntryFromReg@CIniW@@IBEPAEPAUHKEY__@@PBG1KK@Z
?CIniW_WriteEntryToReg@CIniW@@IBEHPAUHKEY__@@PBG1PBEKK@Z
?CIni_SetFile@CIniA@@KGXPAPADPBD@Z
?CIni_SetFile@CIniW@@KGXPAPAGPBG@Z
?Clear@CIniA@@QAEXXZ
?Clear@CIniW@@QAEXXZ
?Clear@CmLogFile@@QAEXH@Z
?CloseFile@CmLogFile@@AAEJXZ
?DeInit@CmLogFile@@QAEJXZ
?FormatWrite@CmLogFile@@AAEXW4_CMLOG_ITEM@@PAG@Z
?GPPB@CIniA@@QBEHPBD0H@Z
?GPPB@CIniW@@QBEHPBG0H@Z
?GPPI@CIniA@@QBEKPBD0K@Z
?GPPI@CIniW@@QBEKPBG0K@Z
?GPPS@CIniA@@QBEPADPBD00@Z
?GPPS@CIniW@@QBEPAGPBG00@Z
?Generate@CRandom@@QAEHXZ
?GetFile@CIniA@@QBEPBDXZ
?GetFile@CIniW@@QBEPBGXZ
?GetHInst@CIniA@@QBEPAUHINSTANCE__@@XZ
?GetHInst@CIniW@@QBEPAUHINSTANCE__@@XZ
?GetLogFilePath@CmLogFile@@QAEPBGXZ
?GetPrimaryFile@CIniA@@QBEPBDXZ
?GetPrimaryFile@CIniW@@QBEPBGXZ
?GetPrimaryRegPath@CIniA@@QBEPBDXZ
?GetPrimaryRegPath@CIniW@@QBEPBGXZ
?GetRegPath@CIniA@@QBEPBDXZ
?GetRegPath@CIniW@@QBEPBGXZ
?GetSection@CIniA@@QBEPBDXZ
?GetSection@CIniW@@QBEPBGXZ
?Init@CRandom@@QAEXK@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBD@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBG@Z
?IsEnabled@CmLogFile@@QAEHXZ
?LoadEntry@CIniA@@IBEPADPBD@Z
?LoadEntry@CIniW@@IBEPAGPBG@Z
?LoadSection@CIniA@@QBEPADPBD@Z
?LoadSection@CIniW@@QBEPAGPBG@Z
?Log@CmLogFile@@QAAXW4_CMLOG_ITEM@@ZZ
?OpenFile@CmLogFile@@AAEJXZ
?SetEntry@CIniA@@QAEXPBD@Z
?SetEntry@CIniW@@QAEXPBG@Z
?SetEntryFromIdx@CIniA@@QAEXK@Z
?SetEntryFromIdx@CIniW@@QAEXK@Z
?SetFile@CIniA@@QAEXPBD@Z
?SetFile@CIniW@@QAEXPBG@Z
?SetHInst@CIniA@@QAEXPAUHINSTANCE__@@@Z
?SetHInst@CIniW@@QAEXPAUHINSTANCE__@@@Z
?SetICSDataPath@CIniA@@QAEXPBD@Z
?SetICSDataPath@CIniW@@QAEXPBG@Z
?SetParams@CmLogFile@@QAEJHKPBD@Z
?SetParams@CmLogFile@@QAEJHKPBG@Z
?SetPrimaryFile@CIniA@@QAEXPBD@Z
?SetPrimaryFile@CIniW@@QAEXPBG@Z
?SetPrimaryRegPath@CIniA@@QAEXPBD@Z
?SetPrimaryRegPath@CIniW@@QAEXPBG@Z
?SetReadICSData@CIniA@@QAEXH@Z
?SetReadICSData@CIniW@@QAEXH@Z
?SetRegPath@CIniA@@QAEXPBD@Z
?SetRegPath@CIniW@@QAEXPBG@Z
?SetSection@CIniA@@QAEXPBD@Z
?SetSection@CIniW@@QAEXPBG@Z
?SetWriteICSData@CIniA@@QAEXH@Z
?SetWriteICSData@CIniW@@QAEXH@Z
?Start@CmLogFile@@QAEJH@Z
?Stop@CmLogFile@@QAEJXZ
?WPPB@CIniA@@QAEXPBD0H@Z
?WPPB@CIniW@@QAEXPBG0H@Z
?WPPI@CIniA@@QAEXPBD0K@Z
?WPPI@CIniW@@QAEXPBG0K@Z
?WPPS@CIniA@@QAEXPBD00@Z
?WPPS@CIniW@@QAEXPBG00@Z
?Write@CmLogFile@@AAEJPAG@Z
?kMaxValueLength@CIniW@@2KB
CmAtolA
CmAtolW
CmBuildFullPathFromRelativeA
CmBuildFullPathFromRelativeW
CmCompareStringA
CmCompareStringW
CmConvertRelativePathW
CmConvertStrToIPv6AddrA
CmConvertStrToIPv6AddrW
CmEndOfStrW
CmFmtMsgA
CmFmtMsgW
CmFree
CmIsDigitW
CmIsIPv6AddressA
CmIsIPv6AddressW
CmIsSpaceW
CmLoadIconA
CmLoadIconW
CmLoadImageW
CmLoadSmallIconA
CmLoadSmallIconW
CmLoadStringW
CmMalloc
CmMoveMemory
CmParsePathW
CmRealloc
CmStrCatAllocA
CmStrCatAllocW
CmStrCharCountA
CmStrCharCountW
CmStrCharStuffingA
CmStrCharStuffingW
CmStrCpyAllocA
CmStrCpyAllocW
CmStrStrA
CmStrStrW
CmStrTrimW
CmStrchrA
CmStrchrW
CmStripFileNameW
CmStripPathAndExtW
CmStrrchrA
CmStrrchrW
CmStrtokA
CmStrtokW
GetOSBuildNumber
GetOSMajorVersion
GetOSMinorVersion
GetOSVersion
IsFarEastNonOSR2Win95
IsLogonAsSystem
MakeBold
ReleaseBold
SzToWz
SzToWzWithAlloc
WzToSz
WzToSzWithAlloc

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Копия (2) colbact.dll
.dll regsvr32 windows:10 windows x86 arch:x86

a1f69021c0c05a73763b1375489b45a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

colbact.pdb

Imports

msvcrt

_CIfmod
_ftol2
_local_unwind4
floor
memcpy
time
rand
srand
_wstrtime
wcsrchr
_waccess
_vsnwprintf
_wstrdate
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wcsicmp
memset

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey

api-ms-win-core-com-l1-1-1

CLSIDFromString
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
CoGetObjectContext

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
LoadStringW
GetModuleHandleW
LockResource
DisableThreadLibraryCalls
FindResourceExW
LoadResource

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
SetEvent
ReleaseMutex
OpenMutexW
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
ReleaseSemaphore

rpcrt4

RpcStringFreeW
UuidToStringW
RpcImpersonateClient
RpcRevertToSelf

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
SetThreadStackGuarantee
CreateThread
TlsFree
GetCurrentThread
TlsGetValue
TerminateProcess
GetCurrentProcess
SetThreadToken
GetCurrentThreadId
TlsAlloc
CreateProcessW
OpenProcessToken
GetExitCodeProcess
TlsSetValue
GetThreadContext
OpenThreadToken

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent
DebugBreak
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-2-1

GetLocalTime
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-security-base-l1-2-0

GetTokenInformation
EqualSid
GetLengthSid
DuplicateToken
FreeSid
InitializeSid
CopySid
IsValidSid
GetSidLengthRequired
AllocateAndInitializeSid

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

RtlImageNtHeader
RtlAllocateHeap
RtlFreeHeap

api-ms-win-core-file-l1-2-1

FindClose
SetFileAttributesW
CreateDirectoryW
CompareFileTime
FindNextFileW
FindFirstFileW
DeleteFileW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-memory-l1-1-2

VirtualQuery
OpenFileMappingW
MapViewOfFile
VirtualProtect
VirtualAlloc

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetClassInfoForCurrentUser
GetDefaultPartitionForCurrentUser
GetDefaultPartitionForSid
PartitionAccessCheck

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Копия (2) msimn.exe
.exe windows:5 windows x86 arch:x86

4dcec2841207709ba9c35c9a84029300

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

msimn.pdb

Imports

msvcrt

_vsnprintf

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

kernel32

GetVersionExA
UnhandledExceptionFilter
CloseHandle
ReleaseMutex
GetFileAttributesA
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
lstrlenW
WaitForSingleObject
CreateMutexA
ExitProcess
GetModuleHandleA
GetStartupInfoA
SetErrorMode
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
lstrcpynA
SetUnhandledExceptionFilter
lstrlenA
GetEnvironmentVariableA
GetModuleFileNameA

user32

GetWindowThreadProcessId
SetForegroundWindow
SendMessageTimeoutA
LoadStringA
MessageBoxA

shlwapi

SHGetValueA
StrCmpIW
ord67
SHSetValueA
StrStrIA
PathRemoveFileSpecA
ord157

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Копия (2) shmgrate.exe
.exe windows:5 windows x86 arch:x86

6065885756bba943e8280c2e981263aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

shmgrate.pdb

Imports

msvcrt

wcscat
wcslen
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsncmp
_c_exit
_exit
_XcptFilter
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
swscanf

advapi32

RegSetValueExW
RegFlushKey
RegDeleteKeyW
RegSetValueW
RegOpenKeyExA
SetFileSecurityW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegSetKeySecurity
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW

kernel32

LoadLibraryExA
GetVersionExW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetSystemDefaultUILanguage
LoadLibraryExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
lstrcmpA
MultiByteToWideChar
LocalFree
LocalAlloc
lstrcpyW
lstrcmpW
lstrcmpiW
GlobalFree
GetLastError
GlobalAlloc
SetFileAttributesW
GetFileAttributesW
lstrcpynW
lstrlenW
ExpandEnvironmentStringsW
CreateDirectoryW
GetModuleHandleW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
ExitProcess
lstrcpynA
lstrcmpiA

user32

LoadStringW
wsprintfW
GetMenuItemInfoW
GetMenuItemCount
CreatePopupMenu
DestroyMenu

userenv

ord127
ord120
ord128

shlwapi

PathFindExtensionW
ord158
StrStrIW
SHDeleteKeyW
SHCopyKeyW
ord433
PathRemoveExtensionW
PathRemoveBlanksW
PathCombineW
wnsprintfW
StrCmpIW
StrToIntW
SHSetValueW
SHGetValueW
PathAddExtensionW
PathAppendW
ord437
StrCatBuffW
SHDeleteValueW

shell32

SHParseDisplayName
SHBindToParent
ord155
SHGetSpecialFolderLocation
SHChangeNotify
SHGetMalloc
SHSetLocalizedName
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Копия X shmgrate.exe
.exe windows:5 windows x86 arch:x86

6065885756bba943e8280c2e981263aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

shmgrate.pdb

Imports

msvcrt

wcscat
wcslen
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsncmp
_c_exit
_exit
_XcptFilter
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
swscanf

advapi32

RegSetValueExW
RegFlushKey
RegDeleteKeyW
RegSetValueW
RegOpenKeyExA
SetFileSecurityW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegSetKeySecurity
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW

kernel32

LoadLibraryExA
GetVersionExW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetSystemDefaultUILanguage
LoadLibraryExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
lstrcmpA
MultiByteToWideChar
LocalFree
LocalAlloc
lstrcpyW
lstrcmpW
lstrcmpiW
GlobalFree
GetLastError
GlobalAlloc
SetFileAttributesW
GetFileAttributesW
lstrcpynW
lstrlenW
ExpandEnvironmentStringsW
CreateDirectoryW
GetModuleHandleW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
ExitProcess
lstrcpynA
lstrcmpiA

user32

LoadStringW
wsprintfW
GetMenuItemInfoW
GetMenuItemCount
CreatePopupMenu
DestroyMenu

userenv

ord127
ord120
ord128

shlwapi

PathFindExtensionW
ord158
StrStrIW
SHDeleteKeyW
SHCopyKeyW
ord433
PathRemoveExtensionW
PathRemoveBlanksW
PathCombineW
wnsprintfW
StrCmpIW
StrToIntW
SHSetValueW
SHGetValueW
PathAddExtensionW
PathAppendW
ord437
StrCatBuffW
SHDeleteValueW

shell32

SHParseDisplayName
SHBindToParent
ord155
SHGetSpecialFolderLocation
SHChangeNotify
SHGetMalloc
SHSetLocalizedName
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Копия Y gamemonitor.dll
.dll windows:10 windows x86 arch:x86

124f39e35406c6693b3ebc4b939d327f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

gamemonitor.pdb

Imports

msvcrt

_lock
_unlock
__dllonexit
malloc
free
_amsg_exit
_XcptFilter
??3@YAXPAX@Z
_initterm
_onexit
_except_handler4_common

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

EnterCriticalSection
InitializeCriticalSection
Sleep
DeleteCriticalSection
LeaveCriticalSection

rpcrt4

NdrClientCall4
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringFreeW

api-ms-win-core-errorhandling-l1-1-1

GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-base-l1-2-0

CreateWellKnownSid

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

Exports

Exports

EnableActiveGameMonitoring
ReportGameActivity
SetGameActivityCorrelationId

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Копия Z shmgrate.exe
.exe windows:5 windows x86 arch:x86

6065885756bba943e8280c2e981263aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

shmgrate.pdb

Imports

msvcrt

wcscat
wcslen
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsncmp
_c_exit
_exit
_XcptFilter
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
swscanf

advapi32

RegSetValueExW
RegFlushKey
RegDeleteKeyW
RegSetValueW
RegOpenKeyExA
SetFileSecurityW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegSetKeySecurity
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW

kernel32

LoadLibraryExA
GetVersionExW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetSystemDefaultUILanguage
LoadLibraryExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
lstrcmpA
MultiByteToWideChar
LocalFree
LocalAlloc
lstrcpyW
lstrcmpW
lstrcmpiW
GlobalFree
GetLastError
GlobalAlloc
SetFileAttributesW
GetFileAttributesW
lstrcpynW
lstrlenW
ExpandEnvironmentStringsW
CreateDirectoryW
GetModuleHandleW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
ExitProcess
lstrcpynA
lstrcmpiA

user32

LoadStringW
wsprintfW
GetMenuItemInfoW
GetMenuItemCount
CreatePopupMenu
DestroyMenu

userenv

ord127
ord120
ord128

shlwapi

PathFindExtensionW
ord158
StrStrIW
SHDeleteKeyW
SHCopyKeyW
ord433
PathRemoveExtensionW
PathRemoveBlanksW
PathCombineW
wnsprintfW
StrCmpIW
StrToIntW
SHSetValueW
SHGetValueW
PathAddExtensionW
PathAppendW
ord437
StrCatBuffW
SHDeleteValueW

shell32

SHParseDisplayName
SHBindToParent
ord155
SHGetSpecialFolderLocation
SHChangeNotify
SHGetMalloc
SHSetLocalizedName
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Копия cmutil.dll
.dll windows:10 windows x86 arch:x86

b6eb0fc3e1eb90686e00f2c890ade2b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

cmutil.pdb

Imports

msvcrt

_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnwprintf
_vsnprintf
memset

advapi32

RegQueryValueExA
RegQueryValueExW
RegCloseKey
RegCreateKeyExA
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
GetTokenInformation
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegDeleteValueW

gdi32

CreateFontIndirectW
DeleteObject
GetObjectA

kernel32

Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetVersionExW
GetTickCount
lstrlenA
GetLastError
CreateFileA
CloseHandle
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringW
lstrlenW
GetPrivateProfileIntW
CreateFileW
GetPrivateProfileStringW
CreateDirectoryW
HeapFree
WriteFile
ExpandEnvironmentStringsW
SetFilePointer
SetEndOfFile
GetTempPathW
GetFileAttributesW
TlsGetValue
GetSystemDirectoryW
HeapAlloc
GetFileSize
GetProcessHeap
WideCharToMultiByte
lstrcmpiW
lstrcmpW
FlushFileBuffers
GetCurrentProcess
GetProcAddress
GetTimeFormatW
FreeLibrary
GetDateFormatW
LoadLibraryExW
DisableThreadLibraryCalls
TlsAlloc
TlsFree
HeapReAlloc
CompareStringW
TlsSetValue
SetLastError
GetStringTypeExW
MultiByteToWideChar
CompareStringA
GetStringTypeExA
IsDBCSLeadByte

user32

CharNextA
LoadImageW
GetSystemMetrics
LoadImageA
LoadStringW
LoadStringA
CharUpperW
SendMessageW
CharPrevW
CharNextW

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Exports

Exports

??0CIniA@@QAE@PAUHINSTANCE__@@PBD111@Z
??0CIniW@@QAE@PAUHINSTANCE__@@PBG111@Z
??0CRandom@@QAE@I@Z
??0CRandom@@QAE@XZ
??0CmLogFile@@QAE@XZ
??1CIniA@@QAE@XZ
??1CIniW@@QAE@XZ
??1CmLogFile@@QAE@XZ
??4CIniA@@QAEAAV0@ABV0@@Z
??4CIniW@@QAEAAV0@ABV0@@Z
??4CRandom@@QAEAAV0@$$QAV0@@Z
??4CRandom@@QAEAAV0@ABV0@@Z
??4CmLogFile@@QAEAAV0@ABV0@@Z
??_FCIniA@@QAEXXZ
??_FCIniW@@QAEXXZ
?Banner@CmLogFile@@QAEXXZ
?CIniA_DeleteEntryFromReg@CIniA@@IBEHPAUHKEY__@@PBD1@Z
?CIniA_GetEntryFromReg@CIniA@@IBEPAEPAUHKEY__@@PBD1KK@Z
?CIniA_WriteEntryToReg@CIniA@@IBEHPAUHKEY__@@PBD1PBEKK@Z
?CIniW_DeleteEntryFromReg@CIniW@@IBEHPAUHKEY__@@PBG1@Z
?CIniW_GetEntryFromReg@CIniW@@IBEPAEPAUHKEY__@@PBG1KK@Z
?CIniW_WriteEntryToReg@CIniW@@IBEHPAUHKEY__@@PBG1PBEKK@Z
?CIni_SetFile@CIniA@@KGXPAPADPBD@Z
?CIni_SetFile@CIniW@@KGXPAPAGPBG@Z
?Clear@CIniA@@QAEXXZ
?Clear@CIniW@@QAEXXZ
?Clear@CmLogFile@@QAEXH@Z
?CloseFile@CmLogFile@@AAEJXZ
?DeInit@CmLogFile@@QAEJXZ
?FormatWrite@CmLogFile@@AAEXW4_CMLOG_ITEM@@PAG@Z
?GPPB@CIniA@@QBEHPBD0H@Z
?GPPB@CIniW@@QBEHPBG0H@Z
?GPPI@CIniA@@QBEKPBD0K@Z
?GPPI@CIniW@@QBEKPBG0K@Z
?GPPS@CIniA@@QBEPADPBD00@Z
?GPPS@CIniW@@QBEPAGPBG00@Z
?Generate@CRandom@@QAEHXZ
?GetFile@CIniA@@QBEPBDXZ
?GetFile@CIniW@@QBEPBGXZ
?GetHInst@CIniA@@QBEPAUHINSTANCE__@@XZ
?GetHInst@CIniW@@QBEPAUHINSTANCE__@@XZ
?GetLogFilePath@CmLogFile@@QAEPBGXZ
?GetPrimaryFile@CIniA@@QBEPBDXZ
?GetPrimaryFile@CIniW@@QBEPBGXZ
?GetPrimaryRegPath@CIniA@@QBEPBDXZ
?GetPrimaryRegPath@CIniW@@QBEPBGXZ
?GetRegPath@CIniA@@QBEPBDXZ
?GetRegPath@CIniW@@QBEPBGXZ
?GetSection@CIniA@@QBEPBDXZ
?GetSection@CIniW@@QBEPBGXZ
?Init@CRandom@@QAEXK@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBD@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBG@Z
?IsEnabled@CmLogFile@@QAEHXZ
?LoadEntry@CIniA@@IBEPADPBD@Z
?LoadEntry@CIniW@@IBEPAGPBG@Z
?LoadSection@CIniA@@QBEPADPBD@Z
?LoadSection@CIniW@@QBEPAGPBG@Z
?Log@CmLogFile@@QAAXW4_CMLOG_ITEM@@ZZ
?OpenFile@CmLogFile@@AAEJXZ
?SetEntry@CIniA@@QAEXPBD@Z
?SetEntry@CIniW@@QAEXPBG@Z
?SetEntryFromIdx@CIniA@@QAEXK@Z
?SetEntryFromIdx@CIniW@@QAEXK@Z
?SetFile@CIniA@@QAEXPBD@Z
?SetFile@CIniW@@QAEXPBG@Z
?SetHInst@CIniA@@QAEXPAUHINSTANCE__@@@Z
?SetHInst@CIniW@@QAEXPAUHINSTANCE__@@@Z
?SetICSDataPath@CIniA@@QAEXPBD@Z
?SetICSDataPath@CIniW@@QAEXPBG@Z
?SetParams@CmLogFile@@QAEJHKPBD@Z
?SetParams@CmLogFile@@QAEJHKPBG@Z
?SetPrimaryFile@CIniA@@QAEXPBD@Z
?SetPrimaryFile@CIniW@@QAEXPBG@Z
?SetPrimaryRegPath@CIniA@@QAEXPBD@Z
?SetPrimaryRegPath@CIniW@@QAEXPBG@Z
?SetReadICSData@CIniA@@QAEXH@Z
?SetReadICSData@CIniW@@QAEXH@Z
?SetRegPath@CIniA@@QAEXPBD@Z
?SetRegPath@CIniW@@QAEXPBG@Z
?SetSection@CIniA@@QAEXPBD@Z
?SetSection@CIniW@@QAEXPBG@Z
?SetWriteICSData@CIniA@@QAEXH@Z
?SetWriteICSData@CIniW@@QAEXH@Z
?Start@CmLogFile@@QAEJH@Z
?Stop@CmLogFile@@QAEJXZ
?WPPB@CIniA@@QAEXPBD0H@Z
?WPPB@CIniW@@QAEXPBG0H@Z
?WPPI@CIniA@@QAEXPBD0K@Z
?WPPI@CIniW@@QAEXPBG0K@Z
?WPPS@CIniA@@QAEXPBD00@Z
?WPPS@CIniW@@QAEXPBG00@Z
?Write@CmLogFile@@AAEJPAG@Z
?kMaxValueLength@CIniW@@2KB
CmAtolA
CmAtolW
CmBuildFullPathFromRelativeA
CmBuildFullPathFromRelativeW
CmCompareStringA
CmCompareStringW
CmConvertRelativePathW
CmConvertStrToIPv6AddrA
CmConvertStrToIPv6AddrW
CmEndOfStrW
CmFmtMsgA
CmFmtMsgW
CmFree
CmIsDigitW
CmIsIPv6AddressA
CmIsIPv6AddressW
CmIsSpaceW
CmLoadIconA
CmLoadIconW
CmLoadImageW
CmLoadSmallIconA
CmLoadSmallIconW
CmLoadStringW
CmMalloc
CmMoveMemory
CmParsePathW
CmRealloc
CmStrCatAllocA
CmStrCatAllocW
CmStrCharCountA
CmStrCharCountW
CmStrCharStuffingA
CmStrCharStuffingW
CmStrCpyAllocA
CmStrCpyAllocW
CmStrStrA
CmStrStrW
CmStrTrimW
CmStrchrA
CmStrchrW
CmStripFileNameW
CmStripPathAndExtW
CmStrrchrA
CmStrrchrW
CmStrtokA
CmStrtokW
GetOSBuildNumber
GetOSMajorVersion
GetOSMinorVersion
GetOSVersion
IsFarEastNonOSR2Win95
IsLogonAsSystem
MakeBold
ReleaseBold
SzToWz
SzToWzWithAlloc
WzToSz
WzToSzWithAlloc

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Копия colbact.dll
.dll regsvr32 windows:10 windows x86 arch:x86

a1f69021c0c05a73763b1375489b45a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

colbact.pdb

Imports

msvcrt

_CIfmod
_ftol2
_local_unwind4
floor
memcpy
time
rand
srand
_wstrtime
wcsrchr
_waccess
_vsnwprintf
_wstrdate
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wcsicmp
memset

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey

api-ms-win-core-com-l1-1-1

CLSIDFromString
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
CoGetObjectContext

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
LoadStringW
GetModuleHandleW
LockResource
DisableThreadLibraryCalls
FindResourceExW
LoadResource

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
SetEvent
ReleaseMutex
OpenMutexW
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
ReleaseSemaphore

rpcrt4

RpcStringFreeW
UuidToStringW
RpcImpersonateClient
RpcRevertToSelf

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
SetThreadStackGuarantee
CreateThread
TlsFree
GetCurrentThread
TlsGetValue
TerminateProcess
GetCurrentProcess
SetThreadToken
GetCurrentThreadId
TlsAlloc
CreateProcessW
OpenProcessToken
GetExitCodeProcess
TlsSetValue
GetThreadContext
OpenThreadToken

api-ms-win-core-debug-l1-1-1

IsDebuggerPresent
DebugBreak
OutputDebugStringA
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-2-1

GetLocalTime
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-security-base-l1-2-0

GetTokenInformation
EqualSid
GetLengthSid
DuplicateToken
FreeSid
InitializeSid
CopySid
IsValidSid
GetSidLengthRequired
AllocateAndInitializeSid

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

RtlImageNtHeader
RtlAllocateHeap
RtlFreeHeap

api-ms-win-core-file-l1-2-1

FindClose
SetFileAttributesW
CreateDirectoryW
CompareFileTime
FindNextFileW
FindFirstFileW
DeleteFileW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-memory-l1-1-2

VirtualQuery
OpenFileMappingW
MapViewOfFile
VirtualProtect
VirtualAlloc

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetClassInfoForCurrentUser
GetDefaultPartitionForCurrentUser
GetDefaultPartitionForSid
PartitionAccessCheck

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Копия msimn.exe
.exe windows:5 windows x86 arch:x86

4dcec2841207709ba9c35c9a84029300

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

msimn.pdb

Imports

msvcrt

_vsnprintf

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

kernel32

GetVersionExA
UnhandledExceptionFilter
CloseHandle
ReleaseMutex
GetFileAttributesA
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
lstrlenW
WaitForSingleObject
CreateMutexA
ExitProcess
GetModuleHandleA
GetStartupInfoA
SetErrorMode
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
lstrcpynA
SetUnhandledExceptionFilter
lstrlenA
GetEnvironmentVariableA
GetModuleFileNameA

user32

GetWindowThreadProcessId
SetForegroundWindow
SendMessageTimeoutA
LoadStringA
MessageBoxA

shlwapi

SHGetValueA
StrCmpIW
ord67
SHSetValueA
StrStrIA
PathRemoveFileSpecA
ord157

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Копия shmgrate.exe
.exe windows:5 windows x86 arch:x86

6065885756bba943e8280c2e981263aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

shmgrate.pdb

Imports

msvcrt

wcscat
wcslen
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsncmp
_c_exit
_exit
_XcptFilter
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
swscanf

advapi32

RegSetValueExW
RegFlushKey
RegDeleteKeyW
RegSetValueW
RegOpenKeyExA
SetFileSecurityW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegSetKeySecurity
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW

kernel32

LoadLibraryExA
GetVersionExW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetSystemDefaultUILanguage
LoadLibraryExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
lstrcmpA
MultiByteToWideChar
LocalFree
LocalAlloc
lstrcpyW
lstrcmpW
lstrcmpiW
GlobalFree
GetLastError
GlobalAlloc
SetFileAttributesW
GetFileAttributesW
lstrcpynW
lstrlenW
ExpandEnvironmentStringsW
CreateDirectoryW
GetModuleHandleW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
ExitProcess
lstrcpynA
lstrcmpiA

user32

LoadStringW
wsprintfW
GetMenuItemInfoW
GetMenuItemCount
CreatePopupMenu
DestroyMenu

userenv

ord127
ord120
ord128

shlwapi

PathFindExtensionW
ord158
StrStrIW
SHDeleteKeyW
SHCopyKeyW
ord433
PathRemoveExtensionW
PathRemoveBlanksW
PathCombineW
wnsprintfW
StrCmpIW
StrToIntW
SHSetValueW
SHGetValueW
PathAddExtensionW
PathAppendW
ord437
StrCatBuffW
SHDeleteValueW

shell32

SHParseDisplayName
SHBindToParent
ord155
SHGetSpecialFolderLocation
SHChangeNotify
SHGetMalloc
SHSetLocalizedName
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b34f154ec913d2d2c435cbd644e91687

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 408KB

.ndata Size: - Virtual size: 2.0MB

.rsrc Size: 12KB - Virtual size: 12KB

735e27ae3d7df8c0487e4353d04f6f28

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

comctl32

wininet

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 15KB

.data Size: 3KB - Virtual size: 21KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 1KB

fc0224e99e736751432961db63a41b76

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 851B

.data Size: 512B - Virtual size: 120B

.reloc Size: 1024B - Virtual size: 608B

6065885756bba943e8280c2e981263aa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

user32

userenv

shlwapi

shell32

ole32

Sections

.text Size: 37KB - Virtual size: 36KB

.data Size: 4KB - Virtual size: 18KB

.rsrc Size: 1KB - Virtual size: 1KB

124f39e35406c6693b3ebc4b939d327f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 408KB

.ndata
Size: - Virtual size: 2.0MB

.rsrc
Size: 12KB - Virtual size: 12KB

.text
Size: 15KB - Virtual size: 15KB

.data
Size: 3KB - Virtual size: 21KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 851B

.data
Size: 512B - Virtual size: 120B

.reloc
Size: 1024B - Virtual size: 608B

.text
Size: 37KB - Virtual size: 36KB

.data
Size: 4KB - Virtual size: 18KB

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 964B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 496B

.text
Size: 37KB - Virtual size: 36KB

.data
Size: 4KB - Virtual size: 18KB

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: 37KB - Virtual size: 36KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB