explorer[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

explorer.exe
Size

2.6MB
MD5

ed6b4c95e2a6d67480b9dbb8a8e7d9b4
SHA1

b642e9fcfac93f219d07bb6d530eb1de9efeb511
SHA256

d2faf086a07a6a72461d62aa9ccd4b18e4c6b4de253236efba339b5920844fae
SHA512

6361b904352ad47110a8a7e73ce4f149e2eb65e6c75c7acbea221b8708e5bafa88eaeb8c09931d9ab4761a6194402056e3e2e687497c109326cde7ad25d42742
SSDEEP

49152:dlKuD+CrRB6EZ5XRpoyQ5HeoBtvYYYYYYYYYYYRYYYYYYYYYYE3iA7/eFULAF:KuCWofvYYYYYYYYYYYRYYYYYYYYYYE3M

Score

1^/10

Malware Config

Signatures

Files

explorer.exe
.exe windows:6 windows x64 arch:x64

4d77b054e9e665fa7b2db07a3b75602e

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-08-2015 17:15

Not After

18-11-2016 17:15

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ee:63:af:da:26:ac:91:5d:32:07:e4:da:8e:28:be:b8:b1:f6:10:3d:bc:df:56:a8:09:1b:62:a3:77:51:59:53
Signer

Actual PE Digest

ee:63:af:da:26:ac:91:5d:32:07:e4:da:8e:28:be:b8:b1:f6:10:3d:bc:df:56:a8:09:1b:62:a3:77:51:59:53

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

explorer.pdb

Imports

msvcrt

wcschr
_set_errno
_get_errno
malloc
_CxxThrowException
strchr
ceil
wcsrchr
cosf
floorf
_wtoi
_wcsicmp
__CxxFrameHandler3
_onexit
__dllonexit
memset
_lock
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_snwprintf_s
_vsnwprintf_s
bsearch
memcpy_s
wcsncpy_s
_cexit
_exit
sqrt
memcpy
exit
__set_app_type
??1type_info@@UEAA@XZ
memcmp
memmove
_vsnwprintf
_errno
__wgetmainargs
_unlock
_amsg_exit
_XcptFilter
realloc
wcsstr
free
wcscmp

oleaut32

SysAllocStringByteLen
VarUI4FromStr
SafeArrayGetDim
VariantClear
SysFreeString
SysAllocString
VariantInit
SysAllocStringLen

api-ms-win-core-com-l1-1-1

CoDisableCallCancellation
CoWaitForMultipleHandles
CoInitializeEx
CoEnableCallCancellation
PropVariantClear
CoGetApartmentType
CoSetProxyBlanket
CoCancelCall
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemRealloc
CLSIDFromString
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
RoGetAgileReference
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoFreeUnusedLibraries
CoUninitialize
CoGetMalloc
CoGetInterfaceAndReleaseStream
CreateStreamOnHGlobal
CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegEnumValueW
RegOpenCurrentUser
RegGetValueW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW

api-ms-win-eventing-provider-l1-1-0

EventEnabled
EventRegister
EventWriteTransfer
EventWrite
EventUnregister
EventSetInformation

api-ms-win-core-processthreads-l1-1-2

TlsSetValue
OpenThreadToken
GetStartupInfoW
SetThreadPriorityBoost
GetProcessId
QueueUserAPC
ResumeThread
TlsAlloc
GetThreadPriority
SetPriorityClass
CreateThread
FlushInstructionCache
OpenProcess
GetCurrentThread
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
SetThreadPriority
SetProcessShutdownParameters
GetCurrentProcessId
OpenThread
CreateProcessW
ExitProcess
OpenProcessToken
TlsFree
GetExitCodeProcess
TlsGetValue
TerminateThread
GetPriorityClass

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetErrorMode
SetLastError
RaiseException

api-ms-win-core-synch-l1-2-0

OpenSemaphoreW
OpenMutexW
CreateEventExW
AcquireSRWLockExclusive
SleepEx
DeleteCriticalSection
ReleaseSRWLockExclusive
ReleaseSemaphore
ReleaseMutex
WaitForMultipleObjectsEx
InitializeCriticalSectionEx
CreateEventW
SetEvent
InitOnceExecuteOnce
ResetEvent
Sleep
OpenEventW
InitializeSRWLock
CreateMutexW
InitializeCriticalSection
AcquireSRWLockShared
WaitForSingleObjectEx
WaitForSingleObject
LeaveCriticalSection
ReleaseSRWLockShared
EnterCriticalSection

api-ms-win-core-string-l2-1-0

CharPrevW
CharNextW
IsCharAlphaNumericW
CharLowerW
CharUpperW

api-ms-win-core-heap-l1-2-0

HeapDestroy
HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer

api-ms-win-core-libraryloader-l1-2-0

SizeofResource
FreeLibrary
FindResourceExW
LoadResource
LockResource
LoadLibraryExW
FreeLibraryAndExitThread
GetModuleFileNameW
GetProcAddress
GetModuleHandleA
GetModuleHandleW
LoadStringW
LoadLibraryExA
GetModuleHandleExW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CallbackMayRunLong
SetThreadpoolWait
CreateThreadpoolWait
SetThreadpoolTimer
TrySubmitThreadpoolCallback
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
SubmitThreadpoolWork
CreateThreadpoolWork

api-ms-win-core-sysinfo-l1-2-1

GetWindowsDirectoryW
GetOsSafeBootMode
GetProductInfo
GetTickCount
GetTickCount64
GetSystemTimeAsFileTime
GetVersionExW
GetSystemDirectoryW
GetLocalTime
GetSystemTime

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-core-processenvironment-l1-2-0

SearchPathW
ExpandEnvironmentStringsW
GetCommandLineW
GetCurrentDirectoryW

api-ms-win-security-base-l1-2-0

GetLengthSid
GetTokenInformation
IsValidSid
CreateWellKnownSid
CopySid
CheckTokenMembership

api-ms-win-power-base-l1-1-0

CallNtPowerInformation
GetPwrCapabilities
PowerDeterminePlatformRoleEx

userenv

GetProfileType

api-ms-win-core-path-l1-1-0

PathCchAppend
PathCchAddExtension
PathCchCombine

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
GetDynamicTimeZoneInformation
GetTimeZoneInformation

api-ms-win-core-file-l1-2-1

CreateFileW
FindFirstFileExW
WriteFile
GetFileAttributesW
FindFirstFileW
CreateDirectoryW
RemoveDirectoryW
FindNextFileW
GetLongPathNameW
DeleteFileW
SetFileTime
FindClose
CompareFileTime

api-ms-win-core-datetime-l1-1-1

GetDateFormatEx
GetTimeFormatEx
GetDateFormatW

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-memory-l1-1-2

CreateFileMappingW
VirtualFree
MapViewOfFile
UnmapViewOfFile
VirtualAlloc

api-ms-win-core-interlocked-l1-2-0

InterlockedPopEntrySList
InterlockedPushEntrySList

api-ms-win-core-rtlsupport-l1-2-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

NtQueryInformationProcess
NtQueryWnfStateData
NtOpenProcessToken
NtClose
NtOpenThreadToken
NtQueryInformationToken
RtlNtStatusToDosError
RtlFlushHeaps
WinSqmEventEnabled
WinSqmAddToStreamEx
WinSqmAddToStream
NtSetSystemInformation
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
WinSqmSetString
WinSqmSetDWORD
WinSqmIsOptedIn
NtSetInformationProcess

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpCW
StrRStrIW
StrRChrW
StrStrIW
StrCmpNICW
StrCmpNW
QISearch
SHLoadIndirectString
StrToIntW
StrCmpW
StrChrIW
StrCmpICA
StrChrW
StrCmpICW
StrCmpNIW
StrCmpIW

api-ms-win-core-heap-obsolete-l1-1-0

LocalReAlloc
GlobalLock
LocalFree
GlobalAlloc
LocalAlloc
GlobalUnlock
GlobalFree

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrlenW

api-ms-win-core-job-l2-1-0

AssignProcessToJobObject
SetInformationJobObject
CreateJobObjectW
QueryInformationJobObject

api-ms-win-core-registryuserspecific-l1-1-0

SHRegGetUSValueW
SHRegGetBoolUSValueW

api-ms-win-core-com-private-l1-1-0

CoRegisterMessageFilter
CoRegisterInitializeSpy
CoRevokeInitializeSpy

api-ms-win-core-shlwapi-legacy-l1-1-0

PathParseIconLocationW
PathQuoteSpacesW
PathFileExistsW
PathGetDriveNumberW
PathRemoveFileSpecW
PathFindExtensionW
SHExpandEnvironmentStringsW
PathIsFileSpecW
PathStripPathW
PathGetArgsW
PathRemoveBlanksW
PathFindFileNameW
PathAppendW
PathCommonPrefixW
PathRemoveExtensionW
PathCombineW

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer
UnregisterWaitEx
CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-core-kernel32-legacy-l1-1-1

CopyFileW
RaiseFailFastException
MulDiv
LoadLibraryW
PowerCreateRequest
PowerSetRequest
CreateSemaphoreW
RegisterWaitForSingleObject
MoveFileW

api-ms-win-core-registry-l2-1-0

RegCreateKeyW
RegDeleteKeyW

kernel32

SetThreadExecutionState
RegisterApplicationRestart
SetTermsrvAppInstallMode

user32

UnionRect
GetLayeredWindowAttributes
GetUpdateRect
RegisterClipboardFormatW
CreateIconIndirect
FindWindowExW
ord2005
SetMenuDefaultItem
RemoveMenu
DrawIconEx
SetGestureConfig
GetCapture
GetMessageExtraInfo
CalculatePopupWindowPosition
AdjustWindowRect
DrawTextW
ReleaseCapture
SetCapture
CallWindowProcW
CheckDlgButton
IsWindowEnabled
IsDlgButtonChecked
SetDlgItemInt
GetDlgItemInt
EnableWindow
GetDlgItem
LoadImageW
GetWindowLongPtrW
SetWindowLongPtrW
RegisterClassExW
MsgWaitForMultipleObjects
CopyIcon
AdjustWindowRectEx
DrawFocusRect
GetSysColor
ValidateRect
NotifyWinEvent
SetWindowTextW
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
GetAncestor
GetCurrentInputMessageSource
ScreenToClient
LockWorkStation
GetActiveWindow
TileWindows
CascadeWindows
GetWindowThreadProcessId
HungWindowFromGhostWindow
IsHungAppWindow
GetWindowRgn
WindowFromPoint
ModifyMenuW
GetCaretBlinkTime
DeleteMenu
IsIconic
DestroyIcon
LoadIconW
GetKeyState
ExitWindowsEx
GetFocus
EnableMenuItem
GetSystemMenu
EndPaint
DrawEdge
FillRect
BeginPaint
TrackMouseEvent
GetDoubleClickTime
ClientToScreen
GetMessagePos
SetCursorPos
ChildWindowFromPoint
GetAsyncKeyState
GetDesktopWindow
EndDialog
SendDlgItemMessageW
MonitorFromWindow
RegisterHotKey
UnregisterHotKey
GetLastActivePopup
SwitchToThisWindow
SetFocus
RemovePropW
ReplyMessage
SetCoalescableTimer
GetLastInputInfo
SetForegroundWindow
GetWindowPlacement
KillTimer
GetWindowRgnBox
SetWindowRgn
SendMessageTimeoutW
SendNotifyMessageW
OffsetRect
InvalidateRect
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetCursorPos
RedrawWindow
SetWindowsHookExW
CreateWindowInBand
MapWindowPoints
GetClientRect
GetWindowTextW
UpdateWindow
TranslateAcceleratorW
CheckMenuItem
EnumDisplayDevicesW
GetScrollInfo
SetMenuItemInfoW
SetScrollInfo
IsZoomed
GetMenuState
IsTopLevelWindow
OpenInputDesktop
EndTask
IsWindow
GetParent
EnumWindows
IsWindowVisible
IntersectRect
SetWindowCompositionAttribute
ChangeWindowMessageFilterEx
LoadAcceleratorsW
SetTimer
ShowWindow
GetMenuStringW
SetThreadDesktop
GetWindowInfo
InternalGetWindowText
InflateRect
EnumDisplayMonitors
SetRectEmpty
GetProcessWindowStation
DrawTextExW
IsRectEmpty
SetMenuInfo
GhostWindowFromHungWindow
GetShellWindow
GetIconInfo
GetClassLongPtrW
GetClassWord
BringWindowToTop
ShowWindowAsync
WindowFromPhysicalPoint
GetPhysicalCursorPos
GetCursorInfo
InSendMessage
AllowSetForegroundWindow
WaitMessage
AppendMenuW
FrameRect
UnregisterClassW
GetWindowDC
WindowFromDC
SendMessageCallbackW
InsertMenuW
SetLayeredWindowAttributes
ChildWindowFromPointEx
MoveWindow
GetNextDlgTabItem
GetDlgCtrlID
GetNextDlgGroupItem
GetGUIThreadInfo
GetPropW
SetActiveWindow
SetClassLongW
IsProcessDPIAware
GetSysColorBrush
IsChild
SetWindowPlacement
GetClassNameW
GetClassLongW
IsWindowUnicode
DefWindowProcA
GetMenuItemInfoW
GetMenuItemCount
GetSubMenu
CopyRect
LoadMenuW
GetClassInfoExW
GetClassInfoW
DialogBoxParamW
CreateWindowExW
SetRect
GetWindowBand
GetForegroundWindow
SetPropW
MonitorFromRect
MonitorFromPoint
GetMonitorInfoW
TrackPopupMenuEx
RegisterWindowMessageW
SetWindowPos
EqualRect
PostQuitMessage
SetCursor
LoadCursorW
UnhookWinEvent
SetWinEventHook
EnableMouseInPointer
RegisterClassW
DefWindowProcW
DestroyWindow
CloseDesktop
UnhookWindowsHookEx
CallNextHookEx
UpdateLayeredWindow
ord2522
GetUserObjectInformationW
GetThreadDesktop
FindWindowW
SystemParametersInfoW
DestroyMenu
GetMenuDefaultItem
CreatePopupMenu
PeekMessageW
MsgWaitForMultipleObjectsEx
ReleaseDC
GetDC
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
PostThreadMessageW
GetWindow
PtInRect
GetWindowRect
GetSystemMetrics
SendMessageW
EnumChildWindows
GetWindowLongW
SetWindowLongW
UnregisterClassA
SetScrollPos
SubtractRect

gdi32

GetClipRgn
GetRgnBox
GetViewportOrgEx
SelectClipRgn
SetLayout
GetLayout
LPtoDP
SetViewportOrgEx
OffsetViewportOrgEx
GdiFlush
CreateSolidBrush
GetBkColor
GetCurrentDpiInfo
GetCurrentObject
IntersectClipRect
StretchDIBits
GdiAlphaBlend
CreatePen
Polyline
GetRegionData
ExtCreateRegion
GetTextColor
Rectangle
ExcludeClipRect
GetTextExtentPoint32W
GetDIBits
GetObjectW
GetStockObject
ExtTextOutW
GetTextMetricsW
SetTextAlign
PatBlt
CreateBitmap
SetBkMode
BitBlt
SetTextColor
SetBkColor
DeleteDC
OffsetWindowOrgEx
SelectObject
CreateCompatibleBitmap
CreateDIBSection
CreateCompatibleDC
GetTextExtentPointW
CreateFontIndirectW
DeleteObject
CombineRgn
OffsetRgn
SetRectRgn
CreateRectRgn
GetClipBox
CreateRectRgnIndirect
GetDeviceCaps

shcore

ord141
ord213
ord120
SHQueryInfoKeyW
SHCreateStreamOnFileW
SHStrDupA
ord162
ord126
ord145
ord130
SHAnsiToUnicode
IStream_Size
SHCreateMemStream
ord244
SHQueryValueExW
ord193
SHUnicodeToAnsi
ord143
SHCreateStreamOnFileEx
SHDeleteKeyW
IStream_Write
IStream_Read
ord170
IStream_Reset
SHOpenRegStream2W
ord121
ord123
ord245
ord122
ord191
SetCurrentProcessExplicitAppUserModelID
SHCreateThread
SHDeleteValueW
SHSetValueW
SHGetValueW
ord190
SHRegGetValueW
IUnknown_SetSite
SHSetThreadRef
SHCreateThreadRef
SetProcessReference
SHGetThreadRef
ord187
ord186
ord184
ord200
IUnknown_QueryService
IUnknown_Set
SHStrDupW
ord142
ord246
ord243
GetDpiForMonitor
ord183
IsOS
SHEnumKeyExW

shlwapi

ord433
ord548
ord413
ord478
ord204
ord165
ord197
ord292
PathIsDirectoryW
ord479
ord388
ord279
ord163
ord635
PathRemoveArgsW
ord172
ord164
AssocCreate
ord236
ord278
ord24
ord193
ChrCmpIW
AssocQueryKeyW
ord509
ord467
AssocQueryStringW
ord225
ord571
ord484
ord178
ord177

shell32

SHChangeNotify
ord727
ord747
ord764
SHGetKnownFolderItem
SHCreateShellItemArrayFromShellItem
ord850
ord95
SHBindToFolderIDListParentEx
SHBindToFolderIDListParent
SHCreateItemWithParent
ord152
ord23
ord28
SHGetSpecialFolderLocation
SHBindToParent
ord22
ord134
DragQueryFileW
SHGetKnownFolderPath
ord680
SHCreateItemFromParsingName
SHEvaluateSystemCommandTemplate
ord165
ord885
SHCreateDataObject
SHGetLocalizedName
ord154
Shell_GetCachedImageIndexW
ord895
ord74
ord787
ord790
ord193
SHCreateShellItem
ord88
SHOpenWithDialog
ord792
SHCreateAssociationRegistration
ord906
ord181
SHGetPropertyStoreForWindow
ord894
ord162
SHAppBarMessage
SHGetStockIconInfo
ord840
ord100
ord85
ord18
SHParseDisplayName
ord155
ord190
SHGetFolderLocation
ord723
SHGetSpecialFolderPathW
SHBindToObject
ord89
ord245
ord200
ord68
ShellExecuteExW
ord899
ord188
ord904
ord201
ord206
SHCreateItemInKnownFolder
SHGetIDListFromObject
ord67
SHChangeNotifyRegisterThread
ord19
ord16
ord17
ord25
ord21
ord733
ord753
ord644
ord645
SHGetNameFromIDList
SHGetPathFromIDListW
ord731
ord4
ord711
ord244
SHFileOperationW
SHGetFolderPathEx
SHGetKnownFolderIDList
ord2
SHUpdateRecycleBinIcon
ord60
ord896
ord64
ord61
SHEnableServiceObject
ord54
ord254
ShellExecuteW
ord91
ord132
SHCreateItemFromIDList
ord892
ord893
SHAddToRecentDocs
Shell_NotifyIconW
Shell_NotifyIconGetRect
ExtractIconExW
ord137
ord905
ord526

uxtheme

DrawThemeBackground
CloseThemeData
GetThemeMetric
GetThemeColor
EndBufferedPaint
GetThemeFont
ord104
ord121
GetThemeMargins
OpenThemeData
ord106
ord120
ord118
ord98
IsCompositionActive
GetThemeRect
IsThemePartDefined
IsAppThemed
ord86
IsThemeActive
GetThemeAnimationProperty
GetThemeAnimationTransform
GetThemeTimingFunction
GetBufferedPaintBits
BeginBufferedPaint
GetThemeTextExtent
SetWindowTheme
DrawThemeText
GetThemePartSize
BufferedPaintUnInit
BufferedPaintInit
GetThemeBackgroundExtent
GetThemeBackgroundContentRect
GetWindowTheme
DrawThemeParentBackground
ord122
BufferedPaintClear
GetCurrentThemeName
GetThemeBackgroundRegion
GetThemeBool
DrawThemeTextEx

dwmapi

ord138
ord141
ord140
ord139
ord113
DwmEnableBlurBehindWindow
DwmSetWindowAttribute
DwmIsCompositionEnabled
ord124
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
ord114
ord127
DwmRegisterThumbnail
DwmQueryThumbnailSourceSize

duser

AddLayeredRef

dui70

?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?EndDefer@Element@DirectUI@@QEAAXK@Z
SkipDLLUnloadInitChecks
RegisterPVLBehaviorFactory
InitProcessPriv
UnInitProcessPriv
InitThread
UnInitThread
?Create@BorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?Destroy@Layout@DirectUI@@QEAAXXZ
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetBackgroundColor@Element@DirectUI@@QEAAJK@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?SetFocus@HWNDElement@DirectUI@@QEAAX_N@Z
?SetWidth@Element@DirectUI@@QEAAJH@Z
?SetHeight@Element@DirectUI@@QEAAJH@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
??0TouchHWNDElement@DirectUI@@QEAA@XZ
??1TouchHWNDElement@DirectUI@@UEAA@XZ
?Initialize@TouchHWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z
StrToID
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?SetOverrideScaleFactor@DUIXmlParser@DirectUI@@QEAAXM@Z
?SetDynamicScaling@DUIXmlParser@DirectUI@@QEAAXW4DynamicScaleParsing@2@@Z
?GetSheet@DUIXmlParser@DirectUI@@QEAAJPEBGPEAPEAVValue@2@@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z
?SetXMLFromResourceWithTheme@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@00@Z
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?GetRootRelativeBounds@Element@DirectUI@@QEAAJPEAUtagRECT@@@Z
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
?FireRightClickEvent@TouchButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z
?FireClickEvent@TouchButton@DirectUI@@UEAAXIIW4ClickDevice@12@PEAUtagPOINT@@@Z
?GetForegroundColorRef@TouchButton@DirectUI@@UEAAJPEAK@Z
?DefaultAction@TouchButton@DirectUI@@UEAAJXZ
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z
?OnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?GetContentSize@RichText@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@RichText@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnEvent@TouchButton@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@Element@DirectUI@@UEAAXXZ
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnInput@TouchButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?GetClassInfoPtr@TouchButton@DirectUI@@SAPEAUIClassInfo@2@XZ
?Initialize@TouchButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
?Register@TouchButton@DirectUI@@SAJXZ
?OnPropertyChanged@TouchButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?DirectionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?PressedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ
?MouseWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetPressed@TouchButton@DirectUI@@QEAA_NXZ
?RemoveLocalValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@@Z
?BackgroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetFontColorRuns@RichText@DirectUI@@QEAAJPEBG@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?SetOverhang@Element@DirectUI@@QEAAJ_N@Z
?SetPadding@Element@DirectUI@@QEAAJHHHH@Z
GetScaleFactor
?SetFont@Element@DirectUI@@QEAAJPEBG@Z
?SetDisableAccTextExtend@RichText@DirectUI@@QEAAJ_N@Z
??1TouchButton@DirectUI@@UEAA@XZ
??0TouchButton@DirectUI@@QEAA@XZ
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?Create@TouchHWNDElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z
?RightClick@TouchButton@DirectUI@@SA?AVUID@@XZ
?MultipleClick@TouchButton@DirectUI@@SA?AVUID@@XZ
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ
?GetHeight@Element@DirectUI@@QEAAHXZ
?GetWidth@Element@DirectUI@@QEAAHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?WndProc@TouchHWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?_OnUIStateChanged@TouchHWNDElement@DirectUI@@MEAAXGG@Z
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z
?IsMSAAEnabled@TouchHWNDElement@DirectUI@@UEAA_NXZ
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?RemoveTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?ActivateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z
?UpdateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?MessageCallback@TouchHWNDElement@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnEvent@TouchHWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@TouchHWNDElement@DirectUI@@UEAAXXZ
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnKeyFocusMoved@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@0@Z
?OnInput@TouchHWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@TouchHWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?Create@ElementProvider@DirectUI@@SAJPEAVElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z
?Create@HWNDElementProvider@DirectUI@@SAJPEAVHWNDElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?Find@ElementProviderManager@DirectUI@@SAPEAVElementProvider@2@PEAVElement@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
??1ClassInfoBase@DirectUI@@UEAA@XZ
??0ClassInfoBase@DirectUI@@QEAA@XZ
?GetClassInfoPtr@TouchHWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?GetInvokeHelper@InvokeManager@DirectUI@@SAJPEAPEAVInvokeHelper@2@@Z
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
??1CritSecLock@DirectUI@@QEAA@XZ
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
?Register@TouchHWNDElement@DirectUI@@SAJXZ
?Init@Schema@DirectUI@@SAJXZ
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ
?UiaReturnRawElementProvider@Schema@DirectUI@@2P6A_JPEAUHWND__@@_K_JPEAUIRawElementProviderSimple@@@ZEA
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z

twinapi

ord9

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

d3d11

D3D11CreateDevice

dcomp

ord1017
DCompositionCreateDevice

api-ms-win-core-localization-l1-2-1

GetUserPreferredUILanguages
GetThreadUILanguage
GetLocaleInfoW
FormatMessageW
IsValidLocaleName

sspicli

GetUserNameExW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-io-l1-1-1

CreateIoCompletionPort
GetQueuedCompletionStatus

api-ms-win-eventing-controller-l1-1-0

StartTraceW
EnableTraceEx2
StopTraceW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError

api-ms-win-service-management-l2-1-0

NotifyServiceStatusChangeW
QueryServiceConfigW

api-ms-win-core-debug-l1-1-1

OutputDebugStringA

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx
DeactivateActCtx
CreateActCtxW
ActivateActCtx

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

propsys

PropVariantToUInt32
PSCreateMemoryPropertyStore
PropVariantToBoolean
PropVariantToStringAlloc
PSPropertyBag_WriteDWORD
InitVariantFromResource
PropVariantToString

rpcrt4

RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcStringFreeW
I_RpcExceptionFilter
NdrClientCall3

slc

SLUnregisterWindowsEvent
SLRegisterWindowsEvent

profapi

ord104

api-ms-win-security-lsalookup-l1-1-1

GetIdentityProviderInfoByGUID
ReleaseIdentityProviderEnumContext
EnumerateIdentityProviders
GetDefaultIdentityProvider

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 821KB - Virtual size: 820KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4d77b054e9e665fa7b2db07a3b75602e

Code Sign

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bcCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

ee:63:af:da:26:ac:91:5d:32:07:e4:da:8e:28:be:b8:b1:f6:10:3d:bc:df:56:a8:09:1b:62:a3:77:51:59:53Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-com-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-security-base-l1-2-0

api-ms-win-power-base-l1-1-0

userenv

api-ms-win-core-path-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-profile-l1-1-0

ntdll

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-job-l2-1-0

api-ms-win-core-registryuserspecific-l1-1-0

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-registry-l2-1-0

kernel32

user32

gdi32

shcore

shlwapi

shell32

uxtheme

dwmapi

duser

dui70

twinapi

api-ms-win-core-winrt-l1-1-0

d3d11

dcomp

api-ms-win-core-localization-l1-2-1

sspicli

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

33:00:00:00:bc:e1:20:fd:d2:7c:c8:ee:93:00:00:00:00:00:bc
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

ee:63:af:da:26:ac:91:5d:32:07:e4:da:8e:28:be:b8:b1:f6:10:3d:bc:df:56:a8:09:1b:62:a3:77:51:59:53
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.imrsiv
Size: - Virtual size: 4B

.data
Size: 11KB - Virtual size: 13KB

.pdata
Size: 80KB - Virtual size: 79KB

.idata
Size: 47KB - Virtual size: 46KB

.didat
Size: 1024B - Virtual size: 616B

.rsrc
Size: 821KB - Virtual size: 820KB

.reloc
Size: 14KB - Virtual size: 13KB