Nord VPN Free 2024.rar
- SHA256 9c9a8a1890ec960178742ce7e3315119fef065447621db66eb4531d09ad19478
Overview
overview
10Static
static
3Nord VPN F...24.rar
windows7-x64
3Nord VPN F...24.rar
windows10-2004-x64
7NL7Lexicons0404.dll
windows7-x64
1NL7Lexicons0404.dll
windows10-2004-x64
1Nord VPN F...24.exe
windows7-x64
10Nord VPN F...24.exe
windows10-2004-x64
10README.txt
windows7-x64
1README.txt
windows10-2004-x64
1eappcfg.dll
windows7-x64
1eappcfg.dll
windows10-2004-x64
1filemgmt.dll
windows7-x64
1filemgmt.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nord VPN Free 2024.rar
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Nord VPN Free 2024.rar
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
NL7Lexicons0404.dll
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
NL7Lexicons0404.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Nord VPN Free 2024.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral6
Sample
Nord VPN Free 2024.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral7
Sample
README.txt
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
README.txt
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
eappcfg.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
eappcfg.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
filemgmt.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
filemgmt.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Nord VPN Free 2024.rar
- Size 12.7MB
- Sample240403-vnpmcagb23
- SHA256 9c9a8a1890ec960178742ce7e3315119fef065447621db66eb4531d09ad19478
- MD5 918ff1c81c4b5b4685488dbf76c2f407
- SHA1 ff6efa254ebde16abfec775dd93c9506074a5213
- SHA512 850a1e17bf48fc1651189b47dfe99ed19e1698f3f9855628828205da661c679039e48c4e72485117ebd6991b3022770095b6bd4b9c7ea7bc763236a74ac2e4fd
- SSDEEP 196608:cJS2Pc+4WG4CXkjYdYhCoPhsLBscXaf7LaBm19GD5zug2Fd1gQniHe7oEEE44:cJLcRWG4C0jyhghcKfaBHD5iriH7T94
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/NL7Lexicons0404.dll unpack001/Nord VPN Free 2024.exe unpack001/eappcfg.dll unpack001/filemgmt.dll
File Explorer
-
Nord VPN Free 2024.rar.rar 12.7MB
-
NL7Lexicons0404.dll.dll 352KB
-
Nord VPN Free 2024.exe.exe 12.6MB
-
README.txt20B
-
eappcfg.dll.dll 327KB
-
filemgmt.dll.dll 552KB
NL7Lexicons0404.dll
- SHA256 f919165ad0b215cf8b7d114fc0a87740fdaaa4600c529330297261e7b79eaf31
- MD5 8c9d1116b62e81500cd9da9a82d79a3e
- SHA1 ee0c693d4cfce798d12d7d8089265001ffc6dd98
- SHA512 b3bf19e91c089f0772ba94edb5b58bc15fdbbced7bb1d91f620780bd8bf706ff54fbc8872b768a6697d46feb1e3113d1848516967c95aedce2919cd980892c8e
- SSDEEP 6144:0LKMxWurJ9mN4JRNMDsjafhXiOR2qo8nvHTkJRf3T84S0cKdGNoMD1Xee5:pUJ9y46AkhBB/nvHTU1ZIoMD1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
351KB
Virtual Size
351KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=65501,
count=1, id=204, version=65501,
Nord VPN Free 2024.exe
- IMPHASH 90a754824211c648b161e0e146d30cbf
- SHA256 28fd7c5f8ab145889653beee671957a07696794f4b0ac7343d5c25e43f66042b
- MD5 9cf1d0469c0f1f4d320a9ca7f0e1cc60
- SHA1 0dfb9cbecc894900df50ea91d6abc8064f7b3f4f
- SHA512 dee7e42a3e35759cdfa5b7ee4b76fab187b526478a4d47b41562a60e4970f755499faea1a33038ffe65d9ad5d916287ba7a54911a0fbf6ae3d0b47738329abdf
- SSDEEP 196608:/nmvZD+tHWdKFyGL1fCQfV1ZvD+z/hcc1ICaivxj2RMvV+TfiwFrxuakIdxG:/na1+tHjN9fVL7+z63ivxjhUzX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15465555
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ole32
CoGetObjectContext
kernel32
SetEndOfFile
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
Name
.text
Size
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.cSs
Size
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.cHM
Size
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.f</
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.J`F
Size
12.6MB
Virtual Size
12.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
README.txt
- SHA256 8df26b1f550c80646f01d25b8aafcabb1342bbb2be1cd335cdb8d254be8c4090
- MD5 229bfb07694f123e2cb4986f47100a62
- SHA1 c07256227a3878a9fcb029dfa2794b2003787cd5
- SHA512 e5d153f6a3de43124ba343fd95c01baa550ad485ae2078487e8669988fa034fccbc4420695d9006b6ce19340a9f43ede7eb6509437fb32d679beb571f2981b69
- MD5 SHA1 SHA512
eappcfg.dll
- IMPHASH 82dbfbea36f16764cf8570838f21e15a
- SHA256 0e40b1399d5804aa26eca975abbf0e687801c8183c803f23792676eb0ed05aed
- MD5 5c8ee485ef4aea9bcecd36a46599e5c9
- SHA1 c2432d282ae4e2506f593a5f425b2977a706a6c2
- SHA512 9f3de35bbdca1419b8ed2ce04d7559f9493abc173a92aee8202121a896707b90aaba6ceb1aaa697d60f62bca8d9c2a4cc0763683b2bfc9fa3658e6062740ae00
- SSDEEP 6144:SsP0O5O7BveJG+g5sT9GBGDhHn2Wg9t48/a6MCzwe:MOxg6TQB5WBH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
48036
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
eappcfg.pdb
msvcrt
wcsrchr
_purecall
??0exception@@QEAA@AEBQEBDH@Z
memmove
__RTDynamicCast
floorf
memcmp
realloc
_errno
_onexit
_vsnwprintf
_vsnprintf
__dllonexit
_snwprintf_s
_lock
??1type_info@@UEAA@XZ
_initterm
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
__C_specific_handler
memset
_wcsicmp
swprintf_s
_wcsnicmp
_wtol
_beginthreadex
wcscpy_s
??0exception@@QEAA@XZ
wcscat_s
memmove_s
??0exception@@QEAA@AEBQEBD@Z
_unlock
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
malloc
free
wcsncpy_s
_endthreadex
memcpy
ntdll
DbgPrint
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmAddToStream
RtlInitString
RtlNtStatusToDosError
EtwEventEnabled
EtwEventWrite
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwEventUnregister
EtwRegisterTraceGuidsW
EtwEventRegister
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
api-ms-win-core-synch-l1-2-0
WaitForSingleObject
EnterCriticalSection
WaitForMultipleObjectsEx
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
InitializeCriticalSectionAndSpinCount
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
LoadStringW
DisableThreadLibraryCalls
GetModuleFileNameW
FindResourceExW
FreeLibrary
LoadResource
LoadLibraryExW
GetModuleHandleExW
GetProcAddress
SizeofResource
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadMUIStringW
RegCreateKeyExW
RegDeleteValueW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-errorhandling-l1-1-1
GetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
api-ms-win-core-localization-l1-2-1
FormatMessageW
SetThreadLocale
GetThreadLocale
api-ms-win-core-string-l2-1-0
CharNextW
api-ms-win-core-processthreads-l1-1-2
GetCurrentThreadId
GetCurrentProcess
CreateThread
TerminateProcess
GetCurrentProcessId
api-ms-win-core-sysinfo-l1-2-1
GetSystemInfo
GetVersionExW
GetSystemDirectoryW
GetComputerNameExW
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-security-credentials-l1-1-0
CredIsProtectedW
CredProtectW
CredUnprotectW
api-ms-win-core-processenvironment-l1-2-0
ExpandEnvironmentStringsW
api-ms-win-core-debug-l1-1-1
OutputDebugStringA
IsDebuggerPresent
DebugBreak
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-kernel32-legacy-l1-1-1
LoadLibraryW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
api-ms-win-core-heap-l1-2-0
HeapSize
HeapFree
HeapAlloc
GetProcessHeap
api-ms-win-core-file-l1-2-1
CreateFileW
api-ms-win-core-memory-l1-1-2
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
api-ms-win-core-threadpool-legacy-l1-1-0
DeleteTimerQueueEx
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EapHostPeerConfigBlob2Xml
EapHostPeerConfigXml2Blob
EapHostPeerCreateMethodConfiguration
EapHostPeerCredentialsXml2Blob
EapHostPeerFreeErrorMemory
EapHostPeerFreeMemory
EapHostPeerGetMethodProperties
EapHostPeerGetMethods
EapHostPeerInvokeConfigUI
EapHostPeerInvokeIdentityUI
EapHostPeerInvokeInteractiveUI
EapHostPeerQueryCredentialInputFields
EapHostPeerQueryInteractiveUIInputFields
EapHostPeerQueryUIBlobFromInteractiveUIInputFields
EapHostPeerQueryUserBlobFromCredentialInputFields
Name
.text
Size
291KB
Virtual Size
291KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=205, version=65501,
count=271, id=1, productName=Unmarked objects,
count=11, id=203, version=65501,
count=8, id=207, version=65501,
count=19, id=206, version=65501,
count=1, id=202, version=65501,
count=50, id=216, version=65501,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
filemgmt.dll
- IMPHASH 143e831df3a27a66b8a87d012844721e
- SHA256 bcec0ecd295639e81044611f32e28a2b3129cce499b0cd44ba46514c01b0d84e
- MD5 d7c3007dca0312785bf75fe212506431
- SHA1 bc305aae544478cf70d90b5691e289db2dbad289
- SHA512 352495531c3f9f8a93bda697837a6ec1ac49c9b3f829519c9730107660955f7c17f214fe59a13e5da4222f4763de00605d835ef8891f51f4f518a12e350a332c
- SSDEEP 6144:P5QVNAaO89oYCiv15cKs8h6w6T0l/dwygqLGEt8BP9pW4+Lq2ZZZ1ZZZFZZZi92t:PhaO89oYCiv16ihhl/NNtI9pWwLIi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
4720
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
filemgmt.pdb
mfc42u
ord665
ord832
ord2586
ord4741
ord3743
ord822
ord3774
ord867
ord3892
ord1033
ord2329
ord6614
ord6418
ord2661
ord4131
ord1498
ord6351
ord2781
ord2393
ord4860
ord2593
ord4747
ord3501
ord3806
ord912
ord4795
ord4894
ord4846
ord852
ord1035
ord4257
ord4262
ord6395
ord6385
ord2906
ord3396
ord3894
ord337
ord2326
ord4557
ord5245
ord1286
ord3761
ord1067
ord4721
ord4612
ord1043
ord3754
ord629
ord599
ord6734
ord3182
ord2801
ord1264
ord5694
ord2666
ord1787
ord3177
ord2377
ord6632
ord2324
ord4344
ord1781
ord2665
ord2379
ord2316
ord4521
ord4127
ord4601
ord3003
ord1657
ord2474
ord1082
ord288
ord812
ord1544
ord1586
ord1555
ord1583
ord1585
ord355
ord1477
ord1553
ord1416
ord1491
ord1577
ord3751
ord3535
ord5229
ord5712
ord4743
ord1778
ord6440
ord2589
ord4542
ord2023
ord2422
ord1906
ord1566
ord1499
ord1442
ord2975
ord625
ord6216
ord5585
ord5583
ord5304
ord5114
ord5352
ord4699
ord5687
ord4722
ord5246
ord5406
ord2517
ord6437
ord4365
ord1777
ord4752
ord5663
ord2399
ord5586
ord6812
ord4694
ord5709
ord4017
ord5227
ord4789
ord2670
ord2060
ord6814
ord3933
ord5484
ord1736
ord5683
ord2457
ord2140
ord5699
ord4988
ord4771
ord3868
ord4548
ord6328
ord6147
ord5584
ord6767
ord5077
ord2764
ord2328
ord2311
ord2384
ord5382
ord999
ord549
ord4582
ord2629
ord6708
ord6705
ord2371
ord6813
ord4836
ord2559
ord2515
ord6071
ord4191
ord1388
ord5615
ord2412
ord3468
ord5722
ord5724
ord4368
ord5065
ord5730
ord5711
ord6053
ord3049
ord3243
ord3362
ord4815
ord3231
ord3366
ord3052
ord3166
ord3046
ord3534
ord4082
ord4083
ord4077
ord3164
ord4371
ord4983
ord4770
ord3916
ord622
ord1426
ord2752
ord4214
ord1063
ord659
ord1562
ord1647
ord1441
ord1124
ord2856
ord6050
ord621
ord4436
ord4523
ord2676
ord1677
ord1463
ord3790
ord3830
ord286
ord1574
ord2427
ord3740
ord1284
ord5887
ord2979
ord1287
ord2846
ord4473
ord5719
ord2408
ord287
ord620
ord1122
ord3873
ord568
ord1483
ord6880
ord5950
ord1355
ord626
ord5935
ord6886
ord1126
ord1040
ord624
ord1006
ord5702
ord6887
msvcrt
__RTDynamicCast
memcpy
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
??0exception@@QEAA@AEBQEBDH@Z
__CxxFrameHandler3
_vsnwprintf
_wtoi64
_wcsnicmp
wcschr
calloc
iswspace
wcsstr
wcsncmp
memmove
??0exception@@QEAA@XZ
memmove_s
memcpy_s
?what@exception@@UEBAPEBDXZ
_wcsicmp
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
_purecall
malloc
free
??1exception@@UEAA@XZ
memset
atl
ord21
ord22
ord32
ord16
ord15
ord18
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlVirtualUnwind
advapi32
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
GetLengthSid
CopySid
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeAcl
AddAccessAllowedAce
EnumServicesStatusW
RegDeleteValueW
GetUserNameW
RegConnectRegistryW
IsWellKnownSid
RevertToSelf
MapGenericMask
AllocateAndInitializeSid
MakeSelfRelativeSD
FreeSid
GetSecurityDescriptorLength
GetSecurityDescriptorControl
LsaFreeMemory
LsaClose
LsaSetSystemAccessAccount
LsaGetSystemAccessAccount
LsaCreateAccount
LsaOpenAccount
GetSidSubAuthority
GetSidSubAuthorityCount
LsaLookupNames
LsaOpenPolicy
user32
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
FindWindowExW
GetWindowThreadProcessId
GetDlgCtrlID
GetSystemMetrics
GetWindowRect
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
EnumThreadWindows
IsWindowVisible
GetDesktopWindow
GetFocus
GetWindowLongW
SetActiveWindow
SetWindowTextW
GetClientRect
ShowWindow
MessageBoxW
PostMessageW
GetParent
LoadImageW
LoadIconW
GetActiveWindow
LoadBitmapW
WinHelpW
EnableWindow
SetDlgItemTextW
EndDialog
GetWindowLongPtrW
GetDlgItemTextW
IsDlgButtonChecked
SetFocus
SetWindowLongPtrW
GetDlgItem
SendMessageW
RegisterClipboardFormatW
LoadStringW
DialogBoxParamW
gdi32
DeleteObject
cfgmgr32
CM_Connect_MachineW
CM_Disconnect_Machine
CM_Get_HW_Prof_Flags_ExW
CM_Set_HW_Prof_Flags_ExW
kernel32
SetLastError
GetProcAddress
lstrcmpiW
GetModuleHandleW
GetLastError
GetModuleFileNameW
GetCurrentThreadId
DeactivateActCtx
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
ActivateActCtx
FindActCtxSectionStringW
CreateActCtxW
GetModuleHandleExW
QueryActCtxW
OutputDebugStringA
GetCurrentProcess
LoadLibraryW
CloseHandle
lstrlenW
DelayLoadFailureHook
ResolveDelayLoadedAPI
CreateThread
Sleep
GetCurrentThread
InitializeCriticalSection
DeleteCriticalSection
FormatMessageW
LocalFree
GetSystemWindowsDirectoryW
GlobalLock
GlobalUnlock
ResumeThread
LocalAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
ReleaseActCtx
CreateProcessW
GetExitCodeProcess
GetComputerNameExW
GlobalFree
GlobalAlloc
LoadLibraryExW
GetCommandLineW
FreeLibrary
CompareStringW
GetComputerNameW
WideCharToMultiByte
SetEvent
lstrcmpW
CreateEventW
DuplicateHandle
WaitForSingleObject
CacheSettingsDlg
CacheSettingsDlg2
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
324KB
Virtual Size
323KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
172KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=205, version=65501,
count=19, id=203, version=65501,
count=569, id=1, productName=Unmarked objects,
count=7, id=207, version=65501,
count=18, id=206, version=65501,
count=1, id=202, version=65501,
count=58, id=216, version=65501,
count=1, id=201, version=65501,
count=1, id=204, version=65501,