NEWRobloxAiO[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

NEWRobloxAiO.rar
Size

3.5MB
MD5

f5a8b456bb8f04b949eba7d2cd6c6ab3
SHA1

1b160f919741fe7041e7f928572d8242a54aae37
SHA256

3abe265fc99e248cc9861e19f7f62032ab89367378027ee24682c0edc81978cc
SHA512

f64a36a8c685aec23469de6aa2d24b9e65f1e888a93a343eeca8b6c98e1b01c3ae7f42cd8aae3091a054c795df7a0196c058b9d67e8aa188b2c4c5ffe23258ce
SSDEEP

98304:6InvdmKfF4keDw4iIqdyK//CbrsLw/dXmiY4krPhti8:VMU4ds4if1i/kw/d29J08

Score

3^/10

Malware Config

Signatures

Unsigned PE 16 IoCs

Checks for missing Authenticode signature.

resource
unpack001/AcLayers.dll
unpack001/AcSpecfc.dll
unpack001/ActionCenter.dll
unpack001/ActionCenterCPL.dll
unpack001/ActivationClient.dll
unpack001/ActivationManager.dll
unpack001/ActiveSyncProvider.dll
unpack001/Launcher.exe
unpack001/acledit.dll
unpack001/aclui.dll
unpack001/acppage.dll
unpack001/activeds.dll
unpack001/activeds.tlb
unpack001/settings/CallButtons.ProxyStub.dll
unpack001/settings/CallButtons.dll
unpack001/settings/CallHistoryClient.dll

Files

NEWRobloxAiO.rar
.rar

Password: 2024
AcLayers.dll
.dll windows:10 windows x86 arch:x86

Password: 2024

a144f9aff0f15fc04f9bba486ca5ad4c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AcLayers.pdb

Imports

apphelp

SE_COM_AddServer
SE_COM_HookObject
SE_COM_Lookup
SE_ShimDPF
SE_COM_AddHook
SE_GetShimId

msvcrt

memcpy
memcmp
_CxxThrowException
memmove
_wcsnicmp
__CxxFrameHandler3
_wcsicmp
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_vsnwprintf
memcpy_s
_vsnprintf_s
memmove_s
_purecall
_stricmp
atol
strtol
strstr
sprintf_s
vsprintf_s
sscanf_s
_vscwprintf
_vsnprintf
wcschr
memset
wcsncmp
_scwprintf
wcsrchr
wcstol
_wcstoui64
wcsspn
iswctype
towlower
wcscpy_s
wcscat_s
wcspbrk
_wcslwr
wcsstr
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
malloc
free
_amsg_exit
_XcptFilter
iswspace
_vscprintf

ntdll

RtlAllocateHeap
RtlFreeHeap
NtQueryKey
RtlNtStatusToDosError
RtlInitUnicodeString
RtlEqualUnicodeString
RtlImageNtHeader
NtClose
RtlReportException
NtTerminateProcess
RtlRaiseException
NtQueryInformationProcess
RtlUniform
RtlValidateHeap
RtlCaptureStackBackTrace
RtlCaptureContext
WinSqmAddToStream
NtOpenFile
NtQueryObject
LdrAccessResource
NtQuerySystemInformation
RtlLengthRequiredSid
RtlInitializeSid
NtQueryInformationToken
RtlSubAuthoritySid
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteSize
RtlUnicodeToMultiByteN
NtOpenKey
NtQueryValueKey
RtlGetOwnerSecurityDescriptor
RtlEqualSid
RtlAppendUnicodeToString
RtlFormatCurrentUserKeyPath
RtlGetLastNtStatus
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlReAllocateHeap
RtlDeleteCriticalSection
RtlEnterCriticalSection
RtlInitializeCriticalSection
RtlLeaveCriticalSection
EtwEventUnregister
EtwEventRegister
ZwClose
RtlAppendUnicodeStringToString
RtlInitUnicodeStringEx
ZwQueryValueKey
ZwOpenKey
RtlCreateServiceSid
RtlGetNtSystemRoot
RtlDosPathNameToNtPathName_U
NtQuerySecurityObject

api-ms-win-core-registry-l1-1-0

RegGetKeySecurity
RegDeleteKeyExW
RegOpenKeyExA
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW

api-ms-win-security-base-l1-1-0

CopySid
GetFileSecurityW
GetSecurityDescriptorDacl
GetAclInformation
GetAce
AllocateAndInitializeSid
CheckTokenMembership
GetTokenInformation
FreeSid

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

gdi32

OffsetRgn
OffsetClipRgn
SelectObject
CreateCompatibleBitmap
OffsetWindowOrgEx
CreateSolidBrush
DeleteDC
DeleteObject
GetDIBits
CreateDIBSection
CreateCompatibleDC
GetObjectType
GdiFlush

shlwapi

StrToIntW
StrCSpnW
StrStrIW
StrStrW
StrCmpNIW
StrCmpNW
StrRChrW
StrChrW
StrToIntA
StrCSpnA
StrChrIW
StrStrA
StrCmpNIA
StrCmpNA
StrRChrA
StrChrA
ord10
ord9
ord8
ord7
ord346
StrRetToBufW
StrRChrIA
StrRChrIW
StrRStrIA
StrRStrIW
PathFindFileNameW
StrChrIA
PathIsRelativeW
IntlStrEqWorkerW
IntlStrEqWorkerA
StrCSpnIW
StrStrIA
StrCSpnIA

kernel32

FreeLibrary
WideCharToMultiByte
ExpandEnvironmentStringsW
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
ResumeThread
ReleaseActCtx
QueryActCtxW
GetCurrentActCtx
LocalFree
LocalAlloc
ExitProcess
GetSystemFirmwareTable
CreateFileA
IsWow64Process
ProcessIdToSessionId
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DelayLoadFailureHook
ResolveDelayLoadedAPI
SearchPathW
CreateMutexW
OpenMutexW
CreateActCtxW
GetTempFileNameW
GetTempPath2W
GetTempFileNameA
GetTempPath2A
GetFileSize
SetFilePointer
CreateFileW
GetVolumeNameForVolumeMountPointW
GetSystemDirectoryW
GetModuleFileNameW
GetWindowsDirectoryW
GetDriveTypeW
GetLogicalDriveStringsW
QueryPerformanceFrequency
QueryPerformanceCounter
CreateThread
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
lstrcmpA
UnregisterApplicationRestart
GetCurrentDirectoryW
LoadLibraryExW
GetFileAttributesW
GetApplicationRestartSettings
ExpandEnvironmentStringsA
TlsAlloc
GetShortPathNameW
TlsSetValue
GetShortPathNameA
lstrcmpiA
TlsGetValue
GetVersionExW
CompareStringW
CompareStringA
FindClose
FindNextFileW
FindFirstFileW
CreateDirectoryW
GetTempPathW
DeleteFileW
CopyFileW
DeleteFileA
CopyFileA
IsBadReadPtr
CreateProcessW
WerRegisterMemoryBlock
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
SetNamedPipeHandleState
CreateEventW
InitializeCriticalSection
OutputDebugStringA
CancelIo
ReadFile
InitializeSRWLock
GetCurrentThread
QueryFullProcessImageNameW
Sleep
GetEnvironmentVariableA
SetEnvironmentVariableA
WriteFile
GetStartupInfoA
LoadLibraryA
GetCommandLineA
GetModuleHandleA
GetVersion
WaitForDebugEvent
ReadProcessMemory
WriteProcessMemory
GetCommandLineW
VirtualProtect
GetCurrentProcess
K32GetModuleInformation
LeaveCriticalSection
CreateSemaphoreExW
LoadLibraryW
CreateMutexExW
GetCurrentProcessId
CreateThreadpoolTimer
OpenSemaphoreW
LCIDToLocaleName
GetLocaleInfoEx
MultiByteToWideChar
HeapReAlloc
CompareStringEx
LCMapStringEx
FindNLSStringEx
IsNLSDefinedString
AddAtomW
GetFullPathNameW
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
WaitForSingleObjectEx
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
ReleaseMutex
ReleaseSemaphore
CloseHandle
SetLastError
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OutputDebugStringW
IsDebuggerPresent
GetLastError
GetProcAddress
GetModuleHandleW
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThreadId
FormatMessageW

rpcrt4

RpcAsyncCancelCall
RpcBindingFree
NdrAsyncClientCall
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
RpcAsyncCompleteCall
I_RpcExceptionFilter
RpcAsyncInitializeHandle
RpcBindingFromStringBindingW
RpcStringFreeW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

GetHookAPIs
NotifyShims

Sections

.text
Size: 368KB - Virtual size: 368KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AcSpecfc.dll
.dll windows:10 windows x86 arch:x86

Password: 2024

5c2cb84ce55107ef0b45615810d6bfe4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

AcSpecfc.pdb

Imports

apphelp

SE_CALLBACK_AddHook
SE_CALLBACK_Lookup
SE_COM_AddHook
SE_COM_AddServer
SE_COM_HookObject
SE_COM_Lookup
SE_COM_HookInterface
SE_ShimDPF
SE_GetShimId

msvcrt

__CxxFrameHandler3
_wcsicmp
_wcsnicmp
_stricmp
strncmp
_wtol
strstr
_strlwr
_vsnprintf
strrchr
_wtoi
memcpy
memcmp
wcsrchr
strcat_s
_strnicmp
strcpy_s
isalpha
wcsstr
wcstol
wcscat_s
_vsnwprintf
wcsspn
iswctype
towlower
towupper
wcsncmp
_CxxThrowException
memmove
_itow_s
wcschr
wcspbrk
_wcsupr
_wcslwr
_vscwprintf
_vscprintf
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wsplitpath_s
iswspace
memset

ntdll

RtlFreeHeap
LdrFindEntryForAddress
RtlInitUnicodeString
RtlGUIDFromString
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlGetDaclSecurityDescriptor
RtlGetNtSystemRoot
NtProtectVirtualMemory
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
NtQueryInformationThread
NtClose
LdrEnumerateLoadedModules
NtQueryInformationFile
NtQueryObject
RtlAllocateHeap
RtlFormatCurrentUserKeyPath
NtSetValueKey
NtCreateKey
NtDeleteKey
NtEnumerateKey
NtQueryValueKey
NtOpenKey

api-ms-win-core-registry-l1-1-0

RegOpenKeyExA
RegDeleteValueA
RegSetValueExA
RegQueryValueExW
RegGetValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExA
RegCreateKeyExA
RegEnumValueW

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
GetSecurityDescriptorDacl
AccessCheck
AllocateAndInitializeSid
CheckTokenMembership
SetTokenInformation
AdjustTokenPrivileges
FreeSid
InitializeSecurityDescriptor
GetTokenInformation

sspicli

GetUserNameExW

comctl32

ImageList_Destroy
ord332
ord336
ord334
ord335
ImageList_Replace
ImageList_Create
ord328
ord337
ord385
ImageList_Remove
ImageList_Add
ImageList_ReplaceIcon
ord386

mscms

GetCountColorProfileElements

shlwapi

StrStrW
StrCmpIW
PathFindFileNameW

user32

GetGUIThreadInfo
GetClassNameA
EndPaint
BeginPaint
ReleaseDC
GetDC
FillRect
GetClientRect
SetForegroundWindow
mouse_event
SendMessageW
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
DefWindowProcW
ValidateRect
SetWindowLongW
GetWindowThreadProcessId
EnumWindows
DestroyWindow
CreateWindowExA
InvalidateRect
GetWindowLongW
GetClassInfoA
GetWindowLongA
GetDesktopWindow
GetParent
SetCursorPos
GetWindowRect
FindWindowW
PeekMessageW
FindWindowExA
DispatchMessageW
GetClassLongA
GetUpdateRect
SendNotifyMessageW
MsgWaitForMultipleObjects
GetThreadDesktop
GetMonitorInfoW
TranslateMessage
SetCursor
GetUserObjectInformationW
PostQuitMessage
GetProcessWindowStation
GetAncestor
EnableWindow
ShowCursor
SetActiveWindow
AllowSetForegroundWindow
SendMessageTimeoutW
CallWindowProcA
SetWindowLongA
GetSystemMetrics
GetWindowInfo
IsZoomed
SetPropW
RemovePropW
GetPropW
LoadCursorW
CopyIcon
EnumChildWindows
DefWindowProcA
RegisterWindowMessageW
FindWindowA
GetCursorPos
DispatchMessageA
PostMessageA
ChangeDisplaySettingsA
GetClassNameW
RegisterClassA
GetWindowTextW
EnumDisplaySettingsW

kernel32

QueryDosDeviceW
VirtualAlloc
WideCharToMultiByte
GetVersion
ExpandEnvironmentStringsW
GetACP
SetEvent
GetModuleHandleA
OpenMutexW
SetFileAttributesW
lstrcmpW
GetVersionExW
GetLocalTime
lstrcmpA
ResetEvent
CreateEventW
ProcessIdToSessionId
GetSystemWindowsDirectoryW
GetWindowsDirectoryW
ReleaseMutex
K32GetModuleBaseNameW
K32GetModuleInformation
GetCurrentThread
SwitchToThread
TrySubmitThreadpoolCallback
lstrlenA
CompareStringOrdinal
QueryFullProcessImageNameW
GetSystemWindowsDirectoryA
lstrcmpiW
GlobalFree
GetCurrentDirectoryW
MoveFileExW
DeleteFileA
GetFileAttributesA
SetUnhandledExceptionFilter
CompareStringW
UnmapViewOfFile
OpenFileMappingA
FlushViewOfFile
MapViewOfFile
CreateFileMappingA
GetTempFileNameA
GetTempPathA
CreateFileW
SetLastError
GetShortPathNameW
GetLongPathNameW
GetFullPathNameW
GetLocaleInfoW
UnhandledExceptionFilter
TerminateProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
SetLocaleInfoA
GetOverlappedResultEx
GetWindowsDirectoryA
GetFileAttributesW
GetExitCodeProcess
SearchPathW
CreateThread
Sleep
K32EnumProcesses
K32GetProcessImageFileNameW
SetEnvironmentVariableW
GetEnvironmentVariableW
LocalAlloc
lstrlenW
DeleteCriticalSection
InitializeCriticalSection
HeapCreate
HeapReAlloc
GetModuleHandleExW
GetCurrentThreadId
SetThreadContext
GetCurrentProcessId
DeleteFileW
K32GetModuleFileNameExW
OpenProcess
MoveFileW
CompareStringA
GetComputerNameA
ExpandEnvironmentStringsA
LockResource
LoadResource
FindResourceW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetCurrentDirectoryW
GetModuleFileNameW
IsBadReadPtr
MultiByteToWideChar
CreateFileA
HeapFree
GetProcessHeap
GetCommandLineA
GetModuleFileNameA
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
ExitProcess
CreateProcessA
GetProcAddress
HeapAlloc
LoadLibraryW
GetSystemDirectoryW
GetCommandLineW
TlsFree
TlsAlloc
TlsSetValue
GetSystemDefaultUILanguage
TlsGetValue
IsBadStringPtrW
IsBadStringPtrA
GetModuleHandleW
VirtualProtect
GetCurrentProcess
IsWow64Process
LocalFree
CopyFileW
CreateDirectoryW
WaitForSingleObject
GetLastError
FindFirstFileW
FindNextFileW
FindClose
CreateProcessW
CloseHandle

gdi32

CreateCompatibleDC
GdiIsScreenDC
CreateDIBSection
SetSystemPaletteUse
CreateCompatibleBitmap
SetMapMode
CreatePalette
GetSystemPaletteEntries
DeleteDC
DeleteObject
GetStockObject
SetViewportExtEx
RealizePalette
SetWindowExtEx
BitBlt
SelectPalette
SelectObject

advapi32

RegEnumKeyW
RegOpenKeyA
GetNamedSecurityInfoW
EventWriteTransfer
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetNamedSecurityInfoW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenProcessToken
LookupPrivilegeValueW
StartServiceCtrlDispatcherA
CloseServiceHandle
OpenSCManagerW
StartServiceW
OpenServiceW
StartServiceCtrlDispatcherW
SetEntriesInAclW
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
QueryServiceStatus
RegDeleteKeyA

ole32

CoUninitialize
CoCreateInstance
CoTaskMemFree
StringFromCLSID
CoTaskMemAlloc
CoGetObjectContext
CoInitialize

shell32

CommandLineToArgvW
ord155
ord102
SHChangeNotify
SHGetFolderPathA
ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW

oleaut32

VariantInit

iphlpapi

GetAdaptersAddresses

ws2_32

WSASetLastError

userenv

GetUserProfileDirectoryW
GetAllUsersProfileDirectoryW

api-ms-win-mm-time-l1-1-0

timeGetTime

mpr

WNetGetConnectionW
WNetConnectionDialog

winmm

mciSendCommandA

ddraw

DirectDrawCreate

comdlg32

GetFileTitleA

imm32

ImmGetContext

rpcrt4

NdrAsyncClientCall
RpcBindingFree
RpcAsyncCancelCall
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcAsyncCompleteCall
RpcAsyncInitializeHandle
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter

dwmapi

DwmIsCompositionEnabled

msi

ord145

winspool.drv

ord202
OpenPrinterW
EnumFormsW
ord204

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

CleanupIS
GetHookAPIs
NotifyShims
StiCreateInstanceA

Sections

.text
Size: 407KB - Virtual size: 406KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.aomadmi
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ActionCenter.dll
.dll windows:10 windows x86 arch:x86

Password: 2024

186af1950ce0f04c1186b47ad1ba9894

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ActionCenter.pdb

Imports

msvcrt

memcpy
memcmp
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_vsnwprintf
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
_purecall
memcpy_s
_except_handler4_common
isdigit
memset

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
OpenProcessToken
OpenThreadToken
GetCurrentThread
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetModuleHandleExW
FreeLibrary
LoadLibraryExA
GetProcAddress
LoadStringW
DisableThreadLibraryCalls
GetModuleFileNameA

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak
OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

ReleaseMutex
CreateMutexExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
LeaveCriticalSection
WaitForSingleObject
OpenSemaphoreW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateSemaphoreExW
ReleaseSemaphore
ReleaseSRWLockShared
WaitForSingleObjectEx
AcquireSRWLockShared

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventSetInformation
EventActivityIdControl
EventUnregister

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegCreateKeyExW
RegGetValueW
RegSetValueExW

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoUninitialize
CoInitializeEx
CoGetMalloc

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceBeginInitialize
Sleep
InitOnceComplete

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolWork

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

ntdll

WinSqmAddToStreamEx
WinSqmAddToStream

user32

GetWindowLongW
DefWindowProcW
KillTimer
PostMessageW
SendMessageW
SetTimer

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 235KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ActionCenterCPL.dll
.dll regsvr32 windows:10 windows x86 arch:x86

Password: 2024

122010695e0dc9d063458b2dbc8c754f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ActionCenterCPL.pdb

Imports

msvcrt

_unlock
_onexit
_except_handler4_common
_lock
memcpy_s
_XcptFilter
_amsg_exit
free
malloc
__dllonexit
_initterm
__CxxFrameHandler3
_vsnwprintf
memset

shell32

ord155
ord18
SHGetStockIconInfo
SHBindToObject
SHParseDisplayName
ShellExecuteExW
ord25

shlwapi

ord460
StrCmpW
ord199
ord158
ord176
ord437
ord256
ord219
PathParseIconLocationW
ord174
ord204
ord156
ord618
ord24
ord514
SHStrDupW
ord168
ord538
ord172

uxtheme

IsThemeActive

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
LoadStringW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
OpenSemaphoreW
CreateMutexExW
ReleaseMutex
WaitForSingleObject
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateSemaphoreExW
WaitForSingleObjectEx
ReleaseSemaphore
InitializeCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventActivityIdControl
EventSetInformation
EventUnregister

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance

oleaut32

VariantClear
SysAllocString
SysFreeString

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

kernel32

ActivateActCtx
DeactivateActCtx
CreateActCtxW
ReleaseActCtx

ntdll

EtwLogTraceEvent
WinSqmIsOptedIn
WinSqmAddToStream
EtwEventWriteTransfer

dui70

?GetStringNull@Value@DirectUI@@SGPAV12@XZ
?Register@Element@DirectUI@@SGJXZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?Init@NavReference@DirectUI@@QAEXPAVElement@2@PAUtagRECT@@@Z
?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z
UnInitThread
UnInitProcessPriv
InitThread
InitProcessPriv
?CreateXBaby@XProvider@DirectUI@@UAEJPAVIXElementCP@2@PAUHWND__@@PAVElement@2@PAKPAPAUIXBaby@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UAGJ_N@Z
?SetRegisteredDefaultButton@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?ClickDefaultButton@XProvider@DirectUI@@UAGHXZ
?ForceThemeChange@XProvider@DirectUI@@UAGJIJ@Z
?GetHostedElementID@XProvider@DirectUI@@UAGJPAG@Z
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UAGHGH@Z
?CanSetFocus@XProvider@DirectUI@@UAGJPA_N@Z
?Navigate@XProvider@DirectUI@@UAGJHPA_N@Z
?SetFocus@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?IsDescendent@XProvider@DirectUI@@UAGJPAVElement@2@PA_N@Z
?GetDesiredSize@XProvider@DirectUI@@UAGJHHPAUtagSIZE@@@Z
?SetParameter@XProvider@DirectUI@@UAGJABU_GUID@@PAX@Z
?AddRef@XProvider@DirectUI@@UAGKXZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?SetDefaultButtonTracking@XProvider@DirectUI@@UAGJ_N@Z
?SetHandleEnterKey@XProvider@DirectUI@@IAEX_N@Z
?CreateDUI@XProvider@DirectUI@@UAGJPAVIXElementCP@2@PAPAUHWND__@@@Z
?GetRoot@XProvider@DirectUI@@IAEPAVElement@2@XZ
?Initialize@XProvider@DirectUI@@QAEJPAVElement@2@PAVIXProviderCP@2@@Z
?Create@XResourceProvider@DirectUI@@SGJPAUHINSTANCE__@@PBG11PAPAV12@@Z
?QueryInterface@XProvider@DirectUI@@UAGJABU_GUID@@PAPAX@Z
??1XProvider@DirectUI@@UAE@XZ
??0XProvider@DirectUI@@QAE@XZ
??0Expando@DirectUI@@QAE@XZ
??1Expando@DirectUI@@UAE@XZ
?Add@Expando@DirectUI@@UAEJPAPAVElement@2@I@Z
?OnEvent@Expando@DirectUI@@UAEXPAUEvent@2@@Z
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
??0Macro@DirectUI@@QAE@XZ
??0Repeater@DirectUI@@QAE@XZ
?OnPropertyChanged@Macro@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?Add@Macro@DirectUI@@UAEJPAPAVElement@2@I@Z
?GetClassInfoPtr@Macro@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@Repeater@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@Expando@DirectUI@@SGPAUIClassInfo@2@XZ
?Initialize@Expando@DirectUI@@QAEJPAVElement@2@PAK@Z
?_PostEvent@Element@DirectUI@@AAEXPAUEvent@2@H@Z
?GetClassInfoPtr@Bind@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@Macro@DirectUI@@SGJXZ
?Register@Repeater@DirectUI@@SGJXZ
?Register@Expando@DirectUI@@SGJXZ
?UpdateChildren@Expando@DirectUI@@IAEXPAVValue@2@@Z
?ExpandedProp@Expandable@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetActive@Element@DirectUI@@QAEJH@Z
?SetExpand@Macro@DirectUI@@QAEJPBG@Z
?GetExpand@Macro@DirectUI@@QAEPBGPAPAVValue@2@@Z
?Insert@Element@DirectUI@@QAEJPAV12@I@Z
?RemoveAll@Element@DirectUI@@QAEJXZ
?GetProperty@Bind@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetConnect@Bind@DirectUI@@QAEPBGPAPAVValue@2@@Z
?BuildElement@Macro@DirectUI@@MAEJXZ
?Initialize@Macro@DirectUI@@QAEJPAVElement@2@PAK@Z
?GetValue@Element@DirectUI@@QAEPAVValue@2@P6GPBUPropertyInfo@2@XZHPAUUpdateCache@2@@Z
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
??0IDataEngine@DirectUI@@QAE@XZ
??1IDataEngine@DirectUI@@UAE@XZ
??0IDataEntry@DirectUI@@QAE@XZ
??1IDataEntry@DirectUI@@UAE@XZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
??1ClassInfoBase@DirectUI@@UAE@XZ
??0ClassInfoBase@DirectUI@@QAE@XZ
??0Element@DirectUI@@QAE@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
??1CritSecLock@DirectUI@@QAE@XZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
?Destroy@Element@DirectUI@@QAEJ_N@Z
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetUnset@Value@DirectUI@@SGPAV12@XZ
?GetAtomZero@Value@DirectUI@@SGPAV12@XZ
?Remove@Element@DirectUI@@QAEJPAV12@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
StrToID
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?Release@Value@DirectUI@@QAEXXZ
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?SetSelected@Element@DirectUI@@QAEJ_N@Z
?StartDefer@Element@DirectUI@@QAEXPAK@Z
?EndDefer@Element@DirectUI@@QAEXK@Z
?GetExpanded@Expandable@DirectUI@@QAE_NXZ
?SetAnimation@Element@DirectUI@@QAEJH@Z
?SetClass@Element@DirectUI@@QAEJPBG@Z
?Click@Button@DirectUI@@SG?AVUID@@XZ
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetAccName@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?SetExpanded@Expandable@DirectUI@@QAEJ_N@Z
??1Element@DirectUI@@UAE@XZ
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z

gdi32

DeleteObject

user32

DestroyIcon
GetFocus
GetWindowLongW
SendMessageW
GetSystemMetrics
CallWindowProcW
SetWindowLongW
LoadImageW
SystemParametersInfoW
SetCursor
LoadCursorW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ActivationClient.dll
.dll windows:10 windows x86 arch:x86

Password: 2024

476241c5fe7ca081e135718db591fde5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ActivationClient.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__free_base
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
__current_exception
__current_exception_context
_except_handler4_common
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
__std_terminate
_CxxThrowException
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeSRWLock
ReleaseSemaphore
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
LeaveCriticalSection
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateErrorW
RoOriginateError

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
InitOnceExecuteOnce
WaitOnAddress

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsCreateString
WindowsCreateStringReference
WindowsIsStringEmpty
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsDuplicateString

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

msvcp_win

?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoSetProxyBlanket

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-ro-typeresolution-l1-1-1

RoCreatePropertySetSerializer

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureStackBackTrace

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

ntdll

RtlGetDeviceFamilyInfoEnum

combase

ord140

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ActivationManager.dll
.dll windows:10 windows x86 arch:x86

Password: 2024

55a8dfdc623d5de2c9926b3495ca0fb8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ActivationManager.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__ui64tow_s
_o__wcsicmp
memmove
_o_abort
_o_ceil
_o_free
_o_iswspace
_o_malloc
_o_realloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcstok_s
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
_o__cexit
_o__callnewh
_o__get_errno
wcsrchr
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
wcschr
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
__std_terminate
__CxxFrameHandler3
_o__execute_onexit_table
_o__errno
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
memmove_s
wcscspn

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleExA

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
AcquireSRWLockShared
DeleteCriticalSection
CreateMutexExW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
OpenEventW
ReleaseSRWLockShared
LeaveCriticalSection
ReleaseSemaphore
InitializeCriticalSectionEx
InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ResetEvent
CreateEventW
SetEvent
ReleaseMutex
CreateSemaphoreExW
EnterCriticalSection
CreateEventExW
InitializeSRWLock
WaitForSingleObject

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapReAlloc
HeapDestroy
HeapFree
HeapSize

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-winrt-error-l1-1-0

RoFailFastWithErrorContext
GetRestrictedErrorInfo
RoOriginateError
RoOriginateErrorW
RoTransformError
SetRestrictedErrorInfo

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWait

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetProcessId
CreateThread
OpenThreadToken
GetCurrentThreadId
SetThreadToken
GetCurrentThread
ProcessIdToSessionId
OpenProcessToken
OpenThread
SetThreadPriority
GetThreadId
CreateProcessAsUserW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
EventActivityIdControl

ntdll

RtlInitUnicodeString
RtlCapabilityCheck
RtlQueryTokenHostIdAsUlong64
RtlWakeAllConditionVariable
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlGetDeviceFamilyInfoEnum
RtlIsMultiSessionSku
NtOpenProcessTokenEx
NtQueryInformationProcess
RtlSleepConditionVariableSRW
NtTerminateProcess
NtOpenProcessToken
RtlLengthSid
NtClose
RtlCopySid
RtlAcquireSRWLockShared
RtlReleaseSRWLockShared
RtlFreeHeap
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
NtQueryInformationToken
RtlIsParentOfChildAppContainer
NtQueryWnfStateData
RtlNtStatusToDosError
RtlExpandEnvironmentStrings
RtlQueryPackageClaims
NtQuerySecurityAttributesToken

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-com-l1-1-0

CoGetStdMarshalEx
CoCancelCall
CoInitializeEx
CoCreateInstanceEx
CoDecrementMTAUsage
StringFromGUID2
CoReleaseServerProcess
CoAddRefServerProcess
CoRevokeClassObject
CoRegisterClassObject
CoResumeClassObjects
CoCreateFreeThreadedMarshaler
CoGetCallContext
CoCreateInstance
CoDisableCallCancellation
CoEnableCallCancellation
CoUninitialize
CoTaskMemFree
CoGetApartmentType
CoWaitForMultipleHandles
CLSIDFromString
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid
CoGetMalloc
CoRevertToSelf
CoIncrementMTAUsage
CoImpersonateClient
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
CoGetCallerTID

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsCompareStringOrdinal
WindowsConcatString
WindowsCreateStringReference
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsSubstringWithSpecifiedLength
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDeleteString

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetSystemDirectoryW
GetWindowsDirectoryW
GetTickCount

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

msvcp_win

?exceptions@ios_base@std@@QAEXH@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
??Bios_base@std@@QBE_NXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Xbad_alloc@std@@YAXXZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegOpenCurrentUser
RegEnumKeyExW
RegQueryValueExW
RegGetValueW
RegOpenKeyExW
RegDeleteTreeW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo

api-ms-win-core-com-private-l1-1-0

CoSetErrorInfo
CoRevokeRacActivationToken
CoRegisterRacActivationToken
CoGetErrorInfo

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-psm-key-l1-1-1

PsmCreateKeyWithDynamicId

api-ms-win-core-psm-key-l1-1-0

PsmGetKeyFromToken
PsmCreateKey

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-security-base-l1-1-0

FreeSid
CopySid
IsValidSid
DuplicateTokenEx
IsWellKnownSid
CreateWellKnownSid
GetLengthSid
GetAce
ImpersonateLoggedOnUser
RevertToSelf
GetTokenInformation

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-security-base-l1-2-0

CheckTokenMembershipEx

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpLogicalW
StrCmpIW

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabledForPackage

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsRelativeW
PathGetArgsW
PathFindFileNameW
PathIsPrefixW

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchRemoveFileSpec
PathCchFindExtension
PathCchAppend

api-ms-win-core-file-l1-1-0

GetFileAttributesW

api-ms-win-core-commandlinetoargv-l1-1-0

CommandLineToArgvW

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureStackBackTrace

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-wow64-l1-1-1

GetSystemWow64Directory2W

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
ExpandEnvironmentStringsW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

combase

ord147
ord79
ord159
ord140
ord148
ord65

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW

Exports

Exports

DisableAppXDebuggingForPackage
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
EnableAppXDebuggingForPackage
FreeAppXLaunchContext
GetPackageExecutionContextForAumid
GetPackageExecutionContextForAumidAndUser
GetPackageExecutionContextForPackageByFamilyNameAndUser
GetPackageExecutionContextForPackageByFullName
PostCreateProcessAppXActivation
PrepareAppXActivation
RegisterAppXPackageIfNecessary
RegisterAppXPackageIfNecessary2

Sections

.text
Size: 708KB - Virtual size: 708KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ActiveSyncProvider.dll
.dll windows:10 windows x86 arch:x86

Password: 2024

d24f46e4e993df45e19d24b535da1dcd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ActiveSyncProvider.pdb

Imports

msvcrt

_i64tow_s
iswspace
iswcntrl
_wcsdup
memmove_s
__CxxFrameHandler3
_errno
_wcstoi64
memmove
memcpy
memcmp
wcstol
memchr
_vsnprintf
strnlen
_wcsnicmp
_vsnprintf_s
_vscprintf
wcspbrk
_vswprintf_p_l
_vscwprintf_p_l
_vsprintf_p_l
_vscprintf_p_l
wcsnlen
_wcstoui64
wcsstr
iswdigit
malloc
wcstok_s
_vsnwprintf_s
_vscwprintf
wcschr
_snwprintf_s
wcsncmp
wcstod
_ltow_s
free
_strnicmp
_purecall
memcpy_s
swscanf_s
_wcsicmp
_ultow_s
wcstoul
_wtoi
_itow_s
_wtol
_callnewh
_vsnwprintf
_onexit
__dllonexit
_unlock
_XcptFilter
_amsg_exit
_initterm
_except_handler4_common
realloc
_lock
wcsrchr
swscanf
floor
memset

ntdll

RtlCaptureContext
RtlReportException

syncutil

GetSessionSyncStats
AggregateAccountSyncStats
GetAccountSyncStats
ord24
ord48
ord52
ord51
IsFirstSyncEver
GetCurrentSyncStats
ord21
ord453
DeviceNeedsProvisioning
ord89
CoCreateInstanceElevated
AcquireDataStoreLock
ord470
ord28
ord26
GetAuthCertTargetAndUser
CredVaultDelete
CredVaultWrite
CredVaultRead
ord702
IsMatchingClientCertificateEx
ord118
ord121
ord120
CreateAuthHandler
ord442
ord94
ord31
ord22
ord274
ord273
ord701
ord66
ord67
ord256
ord17
ord268
GetAADToken
ord502
ord500
AcquireDataStoreLockEx
ord501
ord505
ord109
ord87
ord269
IsValidAADAuthUri
GetGoldenPartnershipId
ord23
ord461
ord464
GetDefaultStoreDirty
SetDefaultStoreDirty
GetMsaCustomerId
InitializeMeContact
ord462
ord463
ord242
ord33
ord296
ord744
ord743
ord745
ReadPasswordForPartnership
ord747
ord746
ord69
ord68
ord257
GetCurrentSyncStatsForStore
SetOutgoingMessageSizeLimit
GetOutgoingMessageSizeLimit
ord35
ord34
ord18
ReleaseDataStoreLock
InitializeSyncStatus
SyncSqmUpdateStats
ord106
ord53
ord103
ord105
ord29
ord93
ord503
ord15
AggregateSessionSyncStats
ord739
ord56
ord111
ord410
ord452
ord440
InitializeMsaStore
VerifyDataStoreLockOwner
ord9
DeleteHttpTransport
GetSyncWorkOnBehalfTicket
SetSyncWorkOnBehalfTicket
ord10
ord86
ord88
ord287
ord285
ord27
ord471
ord30
ord44
ord451
ord275

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread
GetModuleHandleW
LoadStringW
GetProcAddress
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceComplete
Sleep
InitOnceBeginInitialize

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
AcquireSRWLockExclusive
CreateSemaphoreExW
CreateMutexExW
DeleteCriticalSection
ResetEvent
SetEvent
CreateEventW
InitializeCriticalSectionEx
WaitForSingleObjectEx
InitializeSRWLock
CreateEventExW
ReleaseSRWLockShared
InitializeCriticalSection
WaitForSingleObject
OpenSemaphoreW
ReleaseMutex
AcquireSRWLockShared
EnterCriticalSection
ReleaseSRWLockExclusive
LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapSize
HeapDestroy
HeapFree
HeapValidate
HeapCreate
HeapReAlloc
HeapCompact

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-com-l1-1-0

CoInitializeEx
CreateStreamOnHGlobal
CoCreateGuid
CoCreateInstance
CoGetMalloc
CoGetApartmentType
CoWaitForMultipleObjects
CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
StringFromGUID2
CoCreateFreeThreadedMarshaler

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventRegister
EventUnregister
EventWriteTransfer
EventSetInformation

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
CreateThread
TerminateProcess
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

IsValidCodePage
GetACP
GetLocaleInfoW
GetSystemDefaultLCID
FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VarBstrCat
SysAllocStringByteLen
SafeArrayGetElement
SystemTimeToVariantTime
SafeArrayLock
VariantTimeToSystemTime
SafeArrayCreateVector
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SysStringByteLen
SafeArrayDestroy
VariantChangeType
VariantCopyInd
SysAllocString
SafeArrayPutElement
SysAllocStringLen
SysStringLen
SafeArrayRedim
SafeArrayCreate
VariantInit
VariantCopy
VariantClear
SysFreeString
SafeArrayUnlock

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTime
GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
GetLocalTime

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegDeleteTreeW
RegQueryValueExW
RegDeleteValueW
RegCloseKey

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalAlloc
LocalFree

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
CompareFileTime

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsCreateString
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

accountaccessor

UnenrollAndMarkAccountForDeletion

cemapi

CreateMAPITableWalker
SetConversationId
IsMessageClassReadRequest
GetMAPIStorePropTags
MAPILogonEx
MAPIFreeBuffer
FreeProws
HrGetOneProp
MAPIUninitialize
HrSetOneProp
GetMsgClassEnum
GetNamedPropTag
MAPIInitialize
MAPIAllocateBuffer
GetMsgStoreFromMessage
USOIDfromCEENTRYID

userdatalanguageutil

InitializeLanguageUtil
UninitializeLanguageUtil
IsLocalePseudoLoc
ConvertToWideStream
GetWideSzAlloc
GetMultiLanguage2
GetNarrowSzCodepage

userdatatimeutil

AdjustForAllDayAppts
FileTimeToTzSpecificVariantTime
DaysBetweenFT
FileTimeAdjustUTCToTz
MinutesBetweenFT
GetCurrentLocalTime
FileTimeToVariantTime
FileTimeToLocalFileTimeEx
ConvertVariantTimeToFileTime
ConvertLocalVariantTimeToFileTime
AdjustGMTForAllDayAppts

userdatatypehelperutil

UsOidToTaskUdmId
EcUidToGlobalObjId
StreamFromStringW
FormatPoomIdToString
SplitString
GetStreamSize
EcGlobalObjIdToUid
UsOidToContactUdmId
BytesToDigits
CompressWhitespaceNW
StringToBytes
TrimWhiteSpaces
MapiIdToEmailUdmId
UsOidToCalendarUdmId
ReadStreamContent

networkhelper

SyncPdcReference_WatchdogReport
ReportSyncProgress
GetOrCreateNullPowerDependencyCoordinatorManager
CHttpTransport_CreateInstance
SyncWerReportGenerator
SyncPdcReference_WatchdogsEnabled
IsNetworkConnectionCostRestricted

pimstore

GetAppointmentUniqueId
GetBlankName
CreateOutlookApp

mccspal

ord31
ord30
ord32

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathMatchSpecW
PathFindExtensionW

Exports

Exports

CreateMassObject
CreateSyncServiceLayer
DllCanUnloadNow
DllGetClassObject
DownloadEmailAttachment
DownloadEmailBody
GetActiveSyncServerProbeInstance
GetConversationSyncEnabled
GetOutlookExtensionSupportForAccount
GetOutlookExtensionSupportFromAccessor
GetUserInfoForUnconfiguredAccount
HandleEasMeetingResponseForAppointment
HandleEasMeetingResponseForMeetingNotification
InitializeSyncStatus
IsEnabledForSync
IsErrorCatastrophic
IsValidOutlookExtensionVersion
MarkPeopleFolderForResync
OneStopFactory
SyncGetMAPISession
SyncGetMessageStore
SyncGetSpecialFolder
SyncMgrPurgeFolderProvider
SyncMgrPurgeProviderStore
SyncMgrRemovePolicy
SyncSqmUpdateStats
UpdateEasTrackingSchema
WriteStoreCapabilityProps
WriteStoreContentTypesProps

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Launcher.exe
.exe windows:6 windows x86 arch:x86

Password: 2024

5822c854edef0b68a31f6b397cb24414

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\umotf4ue\Body.pdb

Imports

advapi32

RegEnableReflectionKey

shell32

DragFinish

kernel32

CreateFileW
HeapSize
VirtualProtectEx
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LocalFree
GetLocaleInfoEx
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
GetProcessHeap
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetCurrentThread
HeapAlloc
HeapFree
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
SetConsoleCtrlHandler
GetTimeZoneInformation
OutputDebugStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW

Sections

.text
Size: 738KB - Virtual size: 737KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 363KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
acledit.dll
.dll windows:10 windows x86 arch:x86

73b56fcaa206b14596a4684588e01d6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

acledit.pdb

Imports

msvcrt

_except_handler4_common
_initterm
malloc
free
_amsg_exit
_XcptFilter
memset

user32

MessageBoxW
LoadStringW

kernel32

TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
DisableThreadLibraryCalls

Exports

Exports

DllMain
EditAuditInfo
EditOwnerInfo
EditPermissionInfo
FMExtensionProcW
SedDiscretionaryAclEditor
SedSystemAclEditor
SedTakeOwnership

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 678B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
aclui.dll
.dll windows:10 windows x86 arch:x86

47e13f4c1a32e38b5843b5f7999e9233

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

aclui.pdb

Imports

msvcrt

wcstok_s
_wcsnicmp
_wcstoui64
_CxxThrowException
_vsnwprintf
memcpy_s
??1exception@@UAE@XZ
__RTDynamicCast
_ftol2_sse
floor
_wcstoi64
memcpy
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_vsnprintf_s
free
wcsnlen
wcschr
memmove_s
_itow_s
wcsncmp
memcmp
??0exception@@QAE@ABQBD@Z
wcspbrk
wcsspn
wcscspn
iswspace
wcscpy_s
malloc
wcsrchr
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
_errno
__CxxFrameHandler3
realloc
_except_handler4_common
memmove
?what@exception@@UBEPBDXZ
memset

shell32

ord258
ord259
ord6

shlwapi

StrChrW
ord219
ord165
PathAppendW
ord12
ord628
StrRChrW

advapi32

GetSecurityDescriptorDacl
LsaFreeMemory
LsaQueryInformationPolicy
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
EventWrite
EqualPrefixSid
AllocateAndInitializeSid
SetThreadToken
AdjustTokenPrivileges
DuplicateTokenEx
OpenThreadToken
LsaGetAppliedCAPIDs
GetWindowsAccountDomainSid
LsaLookupSids
GetSidSubAuthority
IsValidAcl
IsValidSecurityDescriptor
IsWellKnownSid
LookupAccountSidW
DeleteAce
LookupAccountNameW
OpenProcessToken
GetSidSubAuthorityCount
LsaOpenPolicy
ConvertSecurityDescriptorToStringSecurityDescriptorW
AddConditionalAce
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
AddAccessAllowedAce
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
CopySid
EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
GetAce
IsValidSid
GetLengthSid
ConvertSidToStringSidW
EqualSid
LsaClose

gdi32

CreateDIBSection
DeleteObject
CreateFontIndirectW
SelectObject
GetDeviceCaps
SetTextColor
SetBkColor
SetBkMode
GetObjectW
GetTextExtentPoint32W

kernel32

LoadLibraryExW
CreateThread
FreeLibrary
FreeLibraryAndExitThread
HeapReAlloc
GetCurrentProcess
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
GlobalLock
GlobalUnlock
GetModuleFileNameW
MultiByteToWideChar
lstrlenW
lstrcmpiW
HeapSize
HeapDestroy
VirtualFree
VirtualAlloc
LoadLibraryExA
EncodePointer
DecodePointer
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
OutputDebugStringA
lstrcmpW
FindResourceW
GetCurrentThread
ActivateActCtx
DeactivateActCtx
CreateActCtxW
ReleaseActCtx
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
LocalAlloc
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
LocalFree
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
TlsGetValue
MulDiv
InitOnceExecuteOnce
EnterCriticalSection
LeaveCriticalSection
RaiseException
CompareStringW
CheckElevationEnabled
CreateThreadpoolWait
SetThreadpoolWait
AcquireSRWLockShared
ReleaseSRWLockShared
SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetThreadpoolTimer
CreateThreadpoolTimer
DeleteCriticalSection
InitializeCriticalSectionEx
InitOnceBeginInitialize
InitOnceComplete
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CompareStringEx
GetTickCount
SizeofResource
LockResource
LoadResource
FindResourceExW
DisableThreadLibraryCalls
InitializeCriticalSection
TlsAlloc
TlsFree
LocalReAlloc

ntdll

EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
RtlLengthSid
RtlCreateUnicodeString
RtlFreeUnicodeString
RtlIsPackageSid
RtlRunOnceExecuteOnce
EtwTraceMessage
RtlGetSaclSecurityDescriptor
RtlNtStatusToDosErrorNoTeb
RtlNtStatusToDosError
RtlEqualUnicodeString
RtlGetNtProductType
RtlInitUnicodeString
RtlAddScopedPolicyIDAce
RtlCreateAcl
WinSqmIsOptedIn
WinSqmEndSession
WinSqmSetString
WinSqmStartSession
WinSqmIsOptedInEx
WinSqmSetDWORD
WinSqmIncrementDWORD
WinSqmAddToStream
RtlIsCapabilitySid

ntdsapi

DsUnBindW
DsCrackNamesW
DsFreeNameResultW
DsBindWithSpnExW

ole32

CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree
CoGetMalloc
CoTaskMemRealloc
ReleaseStgMedium
CoCreateGuid

oleaut32

SysFreeString
SysAllocString
SysAllocStringLen
SysReAllocStringLen
SafeArrayAccessData
SafeArrayUnaccessData

user32

SystemParametersInfoW
MapDialogRect
UnregisterClassW
RegisterClassW
SetWindowPlacement
GetWindowPlacement
GetWindow
RegisterWindowMessageW
LoadImageW
GetAncestor
LoadIconW
GetWindowLongW
GetClientRect
GetSystemMetrics
RedrawWindow
DialogBoxParamW
GetDC
ReleaseDC
SetWindowTextW
DestroyIcon
GetActiveWindow
EndDialog
PostMessageW
SetWindowLongW
GetDlgItemTextW
GetDlgCtrlID
GetParent
EnableWindow
SetDlgItemTextW
SetWindowPos
MapWindowPoints
GetWindowRect
ShowWindow
GetDlgItem
LoadCursorW
SetCursor
UnregisterClassA
DrawTextW
IsWindowVisible
MessageBoxW
RegisterClipboardFormatW
IsWindowEnabled
DefWindowProcW
GetScrollInfo
SetScrollPos
ScrollWindow
ClientToScreen
KillTimer
SetTimer
keybd_event
GetFocus
CreateWindowExW
EnumDisplaySettingsW
InvalidateRect
DrawFocusRect
FrameRect
SetFocus
SetScrollInfo
CallWindowProcW
OffsetRect
MoveWindow
ShowScrollBar
GetSysColorBrush
GetSysColor
LoadStringW
DestroyWindow
SendMessageW
SendDlgItemMessageW
InflateRect

xmllite

CreateXmlReader

Exports

Exports

CreateSecurityPage
EditConditionalAceClaims
EditResourceCondition
EditSecurity
EditSecurityAdvanced
GetLocalizedStringForCondition
GetTlsIndexForClaimDictionary
IID_ISecurityInformation

Sections

.text
Size: 375KB - Virtual size: 375KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
acppage.dll
.dll windows:10 windows x86 arch:x86

810ccb6da9cb4f409c7e48aeb3acffc5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

acppage.pdb

Imports

msvcrt

wcsncmp
_wcslwr
_vsnwprintf
wcscat_s
sscanf_s
wcschr
memcmp
memcpy
memmove
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
wcscpy_s
_callnewh
malloc
free
_wcsnicmp
wcsstr
_wcsupr
_wcsicmp
memmove_s
_purecall
memcpy_s
wcsrchr
memset

ntdll

RtlGetNativeSystemInformation
RtlInitUnicodeStringEx
ZwQueryValueKey
ZwOpenKey
RtlUpcaseUnicodeChar
ZwQuerySystemInformation
ZwClose
ZwEnumerateKey
RtlReAllocateHeap
NtQuerySection
RtlNtStatusToDosError
NtCreateSection
RtlImageDirectoryEntryToData
RtlFreeHeap
RtlAllocateHeap
NtOpenThreadToken
NtClose
NtQueryInformationToken
NtOpenProcessToken
RtlIsPartialPlaceholder
RtlImageRvaToVa
RtlInitUnicodeString

kernel32

GetLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetFileTime
GetVersionExW
QueryActCtxW
ResolveDelayLoadedAPI
DelayLoadFailureHook
FreeLibrary
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
EnterCriticalSection
ReleaseSemaphore
GetModuleHandleExW
LeaveCriticalSection
InitializeCriticalSection
InitializeCriticalSectionEx
WaitForThreadpoolTimerCallbacks
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
ReleaseSRWLockExclusive
OutputDebugStringW
CloseThreadpoolTimer
DisableThreadLibraryCalls
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
SetThreadpoolTimer
ReleaseSRWLockShared
RaiseException
CreateThreadpoolTimer
HeapAlloc
GetProcAddress
AcquireSRWLockShared
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
FindFirstFileW
FindClose
lstrcmpiA
ReadFile
GetFileSizeEx
RegQueryValueExW
BasepGetExeArchType
ExpandEnvironmentStringsW
EncodePointer
RegOpenKeyExW
SetFilePointer
CreateFileW
GetSystemDirectoryW
UnmapViewOfFile
LoadLibraryW
DecodePointer
CheckElevationEnabled
LocalFree
CreateProcessW
RegCloseKey
CreateFileMappingW
MapViewOfFile
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
LoadLibraryExW
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
CreateMutexExW
ActivateActCtx

user32

EndDialog
SendMessageW
GetWindowLongW
SetWindowTextW
SetDlgItemTextW
SendDlgItemMessageW
SetThreadDpiAwarenessContext
GetSystemMetrics
IsWindowEnabled
GetDlgItem
GetParent
EnableWindow
LoadStringA
LoadStringW
InsertMenuW
DialogBoxParamW
SetWindowLongW

shlwapi

UrlEscapeW
StrCmpIW
PathFindFileNameW
ord176
PathFindExtensionW

advapi32

EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation

shell32

SHGetPathFromIDListW
ShellExecuteExW
SHParseDisplayName
ord155
ShellExecuteW
SHGetNameFromIDList
SHChangeNotify
SHGetItemFromDataObject

ole32

HWND_UserMarshal
CoTaskMemFree
HWND_UserFree
HWND_UserUnmarshal
HWND_UserSize
CoCreateInstance
CoGetObject
StringFromGUID2

rpcrt4

NdrOleAllocate
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrOleFree

sfc

SfcIsFileProtected

apphelp

SdbFindFirstTag
SdbQueryFlagMask
SdbTagRefToTagID
SdbGetStringTagPtr
SdbGetPathSystemSdb
SdbFindNextTag
SdbGetMatchingExe
SdbInitDatabase
SdbReleaseDatabase

Exports

Exports

DllCanUnloadNow
DllGetClassObject
GetExeFromLnk

Sections

.text
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
activeds.dll
.dll windows:10 windows x86 arch:x86

3ccda9d2ddacdc3a681911f40623bf61

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

activeds.pdb

Imports

msvcrt

memcpy
wcstok
_ftol2_sse
_except_handler4_common
?terminate@@YAXXZ
memset
_initterm
malloc
free
_amsg_exit
_XcptFilter
iswspace
_wcsnicmp
_snwprintf_s
memcpy_s
wcschr
wcscpy_s
swscanf_s
wcscat_s
swprintf_s
_wcsicmp
wcsncpy_s
__CxxFrameHandler3

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserDefaultLCID

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
OpenThreadToken
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
OpenProcessToken

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegQueryValueExW
RegSetValueExW
RegGetKeySecurity
RegCreateKeyExW
RegCloseKey
RegSetKeySecurity
RegOpenKeyExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

ntdll

RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

adsldpc

ADsSetLastError
AllocADsMem
ConvertU2TrusteeToSid
LdapCrackUserDNtoNTLMUser2
ConvertSidToString
ConvertSidToU2Trustee
GetServerAndPort
GetDomainDNSNameForDomain
ADsGetLastError
FreeADsMem
ReallocADsMem
AllocADsStr
FreeADsStr

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

ADsBuildEnumerator
ADsBuildVarArrayInt
ADsBuildVarArrayStr
ADsDecodeBinaryData
ADsEncodeBinaryData
ADsEnumerateNext
ADsFreeEnumerator
ADsGetLastError
ADsGetObject
ADsOpenObject
ADsSetLastError
AdsFreeAdsValues
AdsTypeToPropVariant
AdsTypeToPropVariant2
AllocADsMem
AllocADsStr
BinarySDToSecurityDescriptor
ConvertSecDescriptorToVariant
ConvertSecurityDescriptorToSecDes
ConvertTrusteeToSid
DllCanUnloadNow
DllGetClassObject
FreeADsMem
FreeADsStr
PropVariantToAdsType
PropVariantToAdsType2
ReallocADsMem
ReallocADsStr
SecurityDescriptorToBinarySD

Sections

.text
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
activeds.tlb
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
manual/Manual.txt
settings/CallButtons.ProxyStub.dll
.dll regsvr32 windows:10 windows x86 arch:x86

f20111e26b6d823bdc208ae00dd3bf18

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CallButtons.ProxyStub.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o___std_type_info_destroy_list
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
_except_handler4_common

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-winrt-string-l1-1-0

HSTRING_UserSize
HSTRING_UserMarshal
HSTRING_UserFree
HSTRING_UserUnmarshal

rpcrt4

NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllCanUnloadNow
NdrOleFree
NdrOleAllocate
NdrDllUnregisterProxy

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
settings/CallButtons.dll
.dll windows:10 windows x86 arch:x86

30f4b9416f7bd1455aec74d386099633

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CallButtons.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_atol
_o_free
_o_malloc
_o_memcpy_s
__CxxFrameHandler3
_except_handler4_common
_CxxThrowException
_o__cexit
_o___stdio_common_vswprintf
_o__callnewh
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-1-0

SetEvent
ReleaseSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObject
CreateEventW
WaitForMultipleObjectsEx
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
CreateSemaphoreExW
ReleaseSRWLockExclusive
ResetEvent
AcquireSRWLockShared

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoGetCallContext
CoTaskMemFree
CoTaskMemAlloc

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsCreateStringReference
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsConcatString

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
CreateThread
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister

ntdll

RtlPublishWnfStateData

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoGetActivationFactory

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

rpcrt4

RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
NdrClientCall4
RpcStringFreeW

api-ms-win-core-file-l1-1-0

ReadFile
WriteFile

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-io-l1-1-0

GetOverlappedResult

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-localization-l1-2-0

FormatMessageW

hid

HidP_GetSpecificValueCaps
HidP_GetLinkCollectionNodes
HidP_MaxUsageListLength
HidP_GetUsageValue
HidP_GetButtonCaps
HidP_SetUsageValue
HidP_UnsetUsages
HidP_SetUsages
HidP_GetValueCaps
HidD_GetPreparsedData
HidP_GetCaps
HidD_FreePreparsedData
HidP_SetUsageValueArray
HidP_GetUsageValueArray
HidP_GetUsages

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
settings/CallHistoryClient.dll
.dll windows:10 windows x86 arch:x86

7b4d2542ad08f7a801394976cc264d67

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CallHistoryClient.pdb

Imports

msvcrt

_unlock
_lock
_except_handler4_common
_initterm
__dllonexit
_onexit
__CxxFrameHandler3
_purecall
memcpy
_vsnwprintf
memcmp
wcstoul
_XcptFilter
_amsg_exit
memmove
_callnewh
malloc
free
_wcsicmp
memset

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoCreateInstance

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
SetEvent
CreateEventW
ResetEvent
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
InitializeCriticalSectionEx

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
GetModuleHandleW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-shcore-stream-winrt-l1-1-0

CreateStreamOverRandomAccessStream

rpcrt4

RpcExceptionFilter
RpcAsyncCompleteCall
RpcBindingCreateW
RpcBindingBind
RpcAsyncCancelCall
NdrAsyncClientCall2
RpcAsyncInitializeHandle
NdrClientCall4
RpcBindingFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId

api-ms-win-core-synch-l1-2-0

WakeConditionVariable
SleepConditionVariableSRW
Sleep
InitializeConditionVariable

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpool
CloseThreadpoolWork
CreateThreadpool
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
SetThreadpoolThreadMaximum
WaitForThreadpoolWaitCallbacks

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

userdataplatformhelperutil

GetUserTokenFromContext
IsCommsSystemService
GenerateUserModeServiceName
StartAndWaitForServiceForUser

userdatatypehelperutil

FormatPoomIdToString
ParsePoomIdFromString
DupString

phoneutil

ComparePhoneNumbers

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

ntdll

RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DoesCallHistoryItemMatchFilter
StringToUdmObjectId
UdmAreCallEventsEqual
UdmCancelAsyncTask
UdmCreateDataSession
UdmCreateDataSessionForUser
UdmCreateSyncCallbackHandler
UdmDebugModifyNotifyState
UdmFreeCallFavoriteItemSet
UdmFreeCallHistoryItemSet
UdmObjectIdToString

Sections

.text
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
settings/D3D12.dll
.dll windows:10 windows x86 arch:x86

2c3894ef069d4d5c63ff9aa873068b43

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:23:75:05:ff:aa:0c:dd:86:f4:d4:0e:80:72:80:7e:03:ed:c4:06:6f:58:c4:a1:65:db:44:a3:ab:cf:1c:a6
Signer

Actual PE Digest

1b:23:75:05:ff:aa:0c:dd:86:f4:d4:0e:80:72:80:7e:03:ed:c4:06:6f:58:c4:a1:65:db:44:a3:ab:cf:1c:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d3d12.pdb

Imports

msvcp_win

_Mtx_init_in_situ
_Mtx_trylock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
_Mtx_destroy_in_situ

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__stricmp
_o_atoi
_o_free
_o_malloc
_o_tolower
_except_handler4_common
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
memchr
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
GetModuleHandleExA
GetModuleFileNameW
FreeLibrary
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
InitializeCriticalSectionEx
InitializeCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
WaitForSingleObject
ReleaseSRWLockShared
LeaveCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSRWLockExclusive
ReleaseMutex
ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegEnumKeyExA
RegOpenKeyExA
RegGetValueW
RegQueryValueExA
RegCloseKey

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureStackBackTrace

api-ms-win-core-psapi-l1-1-0

K32GetModuleInformation

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-file-l1-1-0

CreateFileA
GetFileSize

Exports

Exports

D3D12CoreCreateLayeredDevice
D3D12CoreGetLayeredDeviceSize
D3D12CoreRegisterLayers
D3D12CreateDevice
D3D12CreateRootSignatureDeserializer
D3D12CreateVersionedRootSignatureDeserializer
D3D12DeviceRemovedExtendedData
D3D12EnableExperimentalFeatures
D3D12GetDebugInterface
D3D12GetInterface
D3D12PIXEventsReplaceBlock
D3D12PIXGetThreadInfo
D3D12PIXNotifyWakeFromFenceSignal
D3D12PIXReportCounter
D3D12SerializeRootSignature
D3D12SerializeVersionedRootSignature
GetBehaviorValue
SetAppCompatStringPointer

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
settings/D3D12Core.dll
.dll windows:10 windows x86 arch:x86

b8a40ee0b0eff0ab0de7fac27f91e86c

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a3:fd:66:be:c2:17:e0:ad:99:db:03:f0:3d:dd:73:4f:fb:64:8a:58:b4:85:ff:ad:bd:d9:de:6a:aa:a7:e8:3e
Signer

Actual PE Digest

a3:fd:66:be:c2:17:e0:ad:99:db:03:f0:3d:dd:73:4f:fb:64:8a:58:b4:85:ff:ad:bd:d9:de:6a:aa:a7:e8:3e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d3d12core.pdb

Imports

msvcp_win

?_Xout_of_range@std@@YAXPBD@Z
_Mtx_destroy_in_situ
_Mtx_trylock
?_Xbad_function_call@std@@YAXXZ
_Thrd_id
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?_Syserror_map@std@@YAPBDH@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?widen@?$ctype@G@std@@QBEGD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Throw_C_error@std@@YAXH@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_K@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Cnd_do_broadcast_at_thread_exit
_Cnd_signal
_Cnd_init_in_situ
_Cnd_wait
_Cnd_broadcast
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
_Cnd_destroy_in_situ
_Mtx_unlock
_Mtx_init_in_situ
_Mtx_lock
_Thrd_hardware_concurrency

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__fdclass
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__wcsicmp
_o_atoi
_o_ceil
_o_free
_o_isdigit
_o_log2
_o_malloc
_o_mbsrtowcs
_o_mbstowcs
_o_terminate
_o_tolower
_o_wcscpy_s
_except_handler4_common
__current_exception
__current_exception_context
_o__cexit
_o__beginthreadex
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler3
wcsrchr
__std_type_info_compare
wcsstr
_CxxThrowException
memchr
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

strnlen
memset
wcsnlen
wcsncmp

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameA

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree
UnmapViewOfFile
VirtualProtect
VirtualQuery
MapViewOfFile

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
CreateMutexExW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateSemaphoreExW
DeleteCriticalSection
ReleaseSRWLockExclusive
SetEvent
ReleaseSemaphore
CreateEventA
EnterCriticalSection
AcquireSRWLockShared
ResetEvent
ReleaseMutex
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseSRWLockShared
LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapReAlloc
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentProcessId
OpenProcessToken
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
SetThreadPriority
GetCurrentThread

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA
DebugBreak
OutputDebugStringW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer
EventSetInformation

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
GetProcessMitigationPolicy

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateThreadpoolWait
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemInfo
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureStackBackTrace

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-psapi-l1-1-0

K32GetModuleInformation

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-apiquery-l2-1-0

IsApiSetImplemented

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

ntdll

EtwEventWriteTransfer

api-ms-win-core-registry-l1-1-0

RegOpenKeyExA
RegOpenKeyExW
RegGetValueW
RegCloseKey
RegNotifyChangeKeyValue
RegEnumKeyExA
RegQueryValueExA

api-ms-win-core-com-l1-1-0

CLSIDFromString
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-security-base-l1-1-0

AllocateLocallyUniqueId
PrivilegeCheck

api-ms-win-core-memory-l1-1-1

GetWriteWatch

api-ms-win-core-windowserrorreporting-l1-1-1

WerUnregisterCustomMetadata
WerRegisterCustomMetadata

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-processthreads-l1-1-3

SetThreadDescription

api-ms-win-core-file-l1-1-0

CreateFileW
GetFileTime
CreateFileA
GetFileSize

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

D3D12GetInterface
D3D12SDKVersion

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text_hf
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.DDIData
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
settings/d3d10level9.dll
.dll windows:10 windows x86 arch:x86

c2d2ec5ab6862df1f0c12cc1f2ce3f16

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c8:7e:3a:32:58:58:5f:a2:61:e8:20:a7:3f:31:24:84:b9:b8:15:f2:31:02:57:ac:0b:49:39:f9:73:4a:48:0d
Signer

Actual PE Digest

c8:7e:3a:32:58:58:5f:a2:61:e8:20:a7:3f:31:24:84:b9:b8:15:f2:31:02:57:ac:0b:49:39:f9:73:4a:48:0d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D3D10Level9.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPBD@Z

api-ms-win-crt-string-l1-1-0

memset
memmove_s

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__cexit
_o__CIcos
_o__CIexp
_o__CIlog
_o__CIpow
_o__CIsin
_o__CIsqrt
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__seh_filter_dll
memmove
_o_floor
_o_free
_o_malloc
_o_memcpy_s
_o_modf
_o_terminate
_o_tolower
__current_exception
__current_exception_context
_except_handler4_common
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
__std_terminate
__CxxFrameHandler3
_CxxThrowException
memcmp
memcpy
_o__register_onexit_function

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleFileNameW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
OpenSemaphoreW
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObjectEx
ReleaseSRWLockShared
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockExclusive
CreateMutexExW

api-ms-win-ntuser-sysparams-l1-1-0

DisplayConfigGetDeviceInfo

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventWrite
EventSetInformation
EventRegister
EventUnregister

api-ms-win-ntuser-rectangle-l1-1-0

EqualRect
IntersectRect
SetRect

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

D3D10CheckLevel9Hardware
D3D10Level9DumpJournal
D3D11CreateDeviceExternalImplementation
D3DKMTAcquireKeyedMutex
D3DKMTAcquireKeyedMutex2
D3DKMTChangeVideoMemoryReservation
D3DKMTCheckMultiPlaneOverlaySupport
D3DKMTCheckMultiPlaneOverlaySupport2
D3DKMTCloseAdapter
D3DKMTConfigureSharedResource
D3DKMTCreateAllocation
D3DKMTCreateAllocation2
D3DKMTCreateContext
D3DKMTCreateContextVirtual
D3DKMTCreateDevice
D3DKMTCreateKeyedMutex
D3DKMTCreateKeyedMutex2
D3DKMTCreatePagingQueue
D3DKMTCreateSynchronizationObject
D3DKMTCreateSynchronizationObject2
D3DKMTDestroyAllocation
D3DKMTDestroyAllocation2
D3DKMTDestroyContext
D3DKMTDestroyDevice
D3DKMTDestroyKeyedMutex
D3DKMTDestroyPagingQueue
D3DKMTDestroySynchronizationObject
D3DKMTEscape
D3DKMTEvict
D3DKMTFlushHeapTransitions
D3DKMTFreeGpuVirtualAddress
D3DKMTGetAllocationPriority
D3DKMTGetContextInProcessSchedulingPriority
D3DKMTGetContextSchedulingPriority
D3DKMTGetDeviceSchedulingPriority
D3DKMTGetDeviceState
D3DKMTGetDisplayModeList
D3DKMTGetMultisampleMethodList
D3DKMTGetResourcePresentPrivateDriverData
D3DKMTGetRuntimeData
D3DKMTGetSharedPrimaryHandle
D3DKMTGetThunkVersion
D3DKMTInvalidateCache
D3DKMTLock
D3DKMTLock2
D3DKMTMakeResident
D3DKMTMapGpuVirtualAddress
D3DKMTMarkDeviceAsError
D3DKMTOfferAllocations
D3DKMTOpenAdapterFromDeviceName
D3DKMTOpenAdapterFromGdiDisplayName
D3DKMTOpenKeyedMutex
D3DKMTOpenKeyedMutex2
D3DKMTOpenNtHandleFromName
D3DKMTOpenResource
D3DKMTOpenResource2
D3DKMTOpenResourceFromNtHandle
D3DKMTOpenSyncObjectFromNtHandle
D3DKMTOpenSyncObjectFromNtHandle2
D3DKMTOpenSyncObjectNtHandleFromName
D3DKMTOpenSynchronizationObject
D3DKMTOutputDuplPresent
D3DKMTPinDirectFlipResources
D3DKMTPresent
D3DKMTPresentMultiPlaneOverlay
D3DKMTPresentMultiPlaneOverlay2
D3DKMTQueryAdapterInfo
D3DKMTQueryAllocationResidency
D3DKMTQueryClockCalibration
D3DKMTQueryResourceInfo
D3DKMTQueryResourceInfoFromNtHandle
D3DKMTQueryVideoMemoryInfo
D3DKMTReclaimAllocations
D3DKMTReclaimAllocations2
D3DKMTRegisterTrimNotification
D3DKMTReleaseKeyedMutex
D3DKMTReleaseKeyedMutex2
D3DKMTRender
D3DKMTReserveGpuVirtualAddress
D3DKMTSetAllocationPriority
D3DKMTSetContextInProcessSchedulingPriority
D3DKMTSetContextSchedulingPriority
D3DKMTSetDeviceSchedulingPriority
D3DKMTSetDisplayMode
D3DKMTSetDisplayPrivateDriverFormat
D3DKMTSetGammaRamp
D3DKMTSetQueuedLimit
D3DKMTSetStablePowerState
D3DKMTSetVidPnSourceOwner
D3DKMTSetVidPnSourceOwner1
D3DKMTShareObjects
D3DKMTSignalSynchronizationObject
D3DKMTSignalSynchronizationObject2
D3DKMTSignalSynchronizationObjectFromCpu
D3DKMTSignalSynchronizationObjectFromGpu
D3DKMTSignalSynchronizationObjectFromGpu2
D3DKMTSubmitCommand
D3DKMTUnlock
D3DKMTUnlock2
D3DKMTUnpinDirectFlipResources
D3DKMTUnregisterTrimNotification
D3DKMTUpdateAllocationProperty
D3DKMTUpdateGpuVirtualAddress
D3DKMTWaitForSynchronizationObject
D3DKMTWaitForSynchronizationObject2
D3DKMTWaitForSynchronizationObjectFromCpu
D3DKMTWaitForSynchronizationObjectFromGpu
D3DKMTWaitForVerticalBlankEvent
D3DKMTWaitForVerticalBlankEvent2
LogMarkerStringTable
OpenAdapter10
OpenAdapter10_2
RetrieveFilteredOpenAdapter

Sections

.text
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
settings/d3d11.dll
.dll windows:10 windows x86 arch:x86

3f81f61bf320c10683d3839b4a17731c

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:b3:ac:b4:60:1d:08:8d:16:22:57:11:c7:e2:de:7d:c8:dd:d7:a2:77:05:b3:f7:e4:19:2d:77:a7:dc:e5:e2
Signer

Actual PE Digest

3c:b3:ac:b4:60:1d:08:8d:16:22:57:11:c7:e2:de:7d:c8:dd:d7:a2:77:05:b3:f7:e4:19:2d:77:a7:dc:e5:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d3d11.pdb

Imports

msvcp_win

??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ
?_Xbad_function_call@std@@YAXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z
?_Throw_C_error@std@@YAXH@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
_Mtx_destroy_in_situ
_Mtx_lock
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Incref@facet@locale@std@@UAEXXZ
_Mtx_init_in_situ
?_Xlength_error@std@@YAXPBD@Z
_Mtx_unlock
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__wcsicmp
_o_ceil
_o_free
_o_isdigit
_o_malloc
_o_terminate
_o_tolower
__CxxFrameHandler3
__std_terminate
__std_type_info_compare
_except_handler4_common
__current_exception
__current_exception_context
_o__aligned_free
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
memcpy
_CxxThrowException
memcmp

ntdll

RtlCaptureStackBackTrace
EtwEventWriteTransfer
EtwEventWrite
RtlNumberOfSetBitsUlongPtr
RtlFindLeastSignificantBit
RtlDllShutdownInProgress
NtFlushProcessWriteBuffers
EtwEventRegister
EtwEventSetInformation
EtwEventUnregister
RtlSetLastWin32Error
NtQueryObject
RtlInitUnicodeString
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlUnsubscribeWnfStateChangeNotification

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority
GetCurrentProcess
GetCurrentThreadId
TerminateProcess
SwitchToThread
OpenProcessToken
GetProcessId
CreateThread
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemDirectoryW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA
DebugBreak

api-ms-win-core-psapi-l1-1-0

K32GetModuleInformation

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
DeleteCriticalSection
ReleaseSemaphore
InitializeCriticalSectionEx
WaitForSingleObject
InitializeCriticalSection
WaitForSingleObjectEx
ReleaseSRWLockShared
AcquireSRWLockShared
SetEvent
CreateEventA
TryEnterCriticalSection
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeSRWLock
InitializeCriticalSectionAndSpinCount
SetCriticalSectionSpinCount
ReleaseSRWLockExclusive
ReleaseMutex
OpenSemaphoreW
SleepEx
CreateMutexExW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
FreeLibrary
LoadLibraryExW
LoadLibraryExA
GetModuleFileNameW
GetModuleHandleA
DisableThreadLibraryCalls
GetModuleHandleExW
GetModuleHandleExA
GetProcAddress
GetModuleHandleW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy
IsProcessorFeaturePresent

api-ms-win-core-synch-l1-2-0

WakeConditionVariable
Sleep
InitOnceExecuteOnce
InitializeConditionVariable
SleepConditionVariableCS

api-ms-win-core-registry-l1-1-0

RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegGetValueW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

dxgi

CreateDXGIFactory2

kernelbase

BaseFormatObjectAttributes

win32u

NtBindCompositionSurface
NtUnBindCompositionSurface
NtNotifyPresentToCompositionSurface

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-file-l1-1-0

GetFileSize
CreateFileW
GetFileTime
CreateFileA

api-ms-win-eventing-provider-l1-1-0

EventWrite

api-ms-win-core-memory-l1-1-1

ResetWriteWatch
GetWriteWatch

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

CreateDirect3D11DeviceFromDXGIDevice
CreateDirect3D11SurfaceFromDXGISurface
D3D11CoreCreateDevice
D3D11CoreCreateLayeredDevice
D3D11CoreGetLayeredDeviceSize
D3D11CoreRegisterLayers
D3D11CreateDevice
D3D11CreateDeviceAndSwapChain
D3D11CreateDeviceForD3D12
D3D11On12CreateDevice
D3DKMTCloseAdapter
D3DKMTCreateAllocation
D3DKMTCreateContext
D3DKMTCreateDevice
D3DKMTCreateSynchronizationObject
D3DKMTDestroyAllocation
D3DKMTDestroyContext
D3DKMTDestroyDevice
D3DKMTDestroySynchronizationObject
D3DKMTEscape
D3DKMTGetContextSchedulingPriority
D3DKMTGetDeviceState
D3DKMTGetDisplayModeList
D3DKMTGetMultisampleMethodList
D3DKMTGetRuntimeData
D3DKMTGetSharedPrimaryHandle
D3DKMTLock
D3DKMTOpenAdapterFromHdc
D3DKMTOpenResource
D3DKMTPresent
D3DKMTQueryAdapterInfo
D3DKMTQueryAllocationResidency
D3DKMTQueryResourceInfo
D3DKMTRender
D3DKMTSetAllocationPriority
D3DKMTSetContextSchedulingPriority
D3DKMTSetDisplayMode
D3DKMTSetDisplayPrivateDriverFormat
D3DKMTSetGammaRamp
D3DKMTSetVidPnSourceOwner
D3DKMTSignalSynchronizationObject
D3DKMTUnlock
D3DKMTWaitForSynchronizationObject
D3DKMTWaitForVerticalBlankEvent
D3DPerformance_BeginEvent
D3DPerformance_EndEvent
D3DPerformance_GetStatus
D3DPerformance_SetMarker
EnableFeatureLevelUpgrade
OpenAdapter10
OpenAdapter10_2

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text_hf
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
settings/d3d11on12.dll
.dll windows:10 windows x86 arch:x86

dc13bd5080d746146bf568075633fcad

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:92:35:34:b2:34:34:58:58:66:cf:eb:5f:5d:88:4d:af:01:26:99:36:7a:93:37:c4:e1:ee:9c:ac:d3:a7:37
Signer

Actual PE Digest

77:92:35:34:b2:34:34:58:58:66:cf:eb:5f:5d:88:4d:af:01:26:99:36:7a:93:37:c4:e1:ee:9c:ac:d3:a7:37

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d3d11on12.pdb

Imports

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-synch-l1-1-0

SetEvent
EnterCriticalSection
ReleaseSRWLockExclusive
WaitForSingleObject
CreateEventA
ResetEvent
ReleaseSemaphore
DeleteCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSectionAndSpinCount

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA
LoadLibraryExA
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

d3d12

ord101
D3D12SerializeVersionedRootSignature

dxgi

CreateDXGIFactory2

api-ms-win-ntuser-rectangle-l1-1-0

UnionRect
IntersectRect

msvcp_win

_Mtx_destroy_in_situ
?_Xlength_error@std@@YAXPBD@Z
_Mtx_init_in_situ
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
_Mtx_lock
_Mtx_unlock

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o_ceil
_o_floor
_o_free
_o_malloc
_o_terminate
_o_tolower
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
__std_terminate
__CxxFrameHandler3
memcmp
memcpy
memmove

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolCleanupGroup
CreateThreadpool
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CreateThreadpoolCleanupGroup
CloseThreadpool
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolWork

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-ansi-l1-1-0

CreateSemaphoreA

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
ResumeThread
GetThreadId
TerminateProcess
GetCurrentProcess
CreateThread
GetCurrentThreadId

api-ms-win-security-base-l1-1-0

AllocateLocallyUniqueId

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

Exports

Exports

OpenAdapter_D3D11On12

Sections

.text
Size: 406KB - Virtual size: 406KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 2024

Password: 2024

a144f9aff0f15fc04f9bba486ca5ad4c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

apphelp

msvcrt

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-eventing-provider-l1-1-0

gdi32

shlwapi

kernel32

rpcrt4

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 368KB - Virtual size: 368KB

.data Size: 21KB - Virtual size: 2.2MB

.idata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 284B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 27KB - Virtual size: 26KB

Password: 2024

5c2cb84ce55107ef0b45615810d6bfe4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

apphelp

msvcrt

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

sspicli

comctl32

mscms

shlwapi

user32

kernel32

gdi32

advapi32

ole32

shell32

oleaut32

iphlpapi

ws2_32

userenv

api-ms-win-mm-time-l1-1-0

mpr

winmm

ddraw

comdlg32

imm32

rpcrt4

dwmapi

msi

winspool.drv

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 407KB - Virtual size: 406KB

.data Size: 4KB - Virtual size: 12KB

.idata Size: 12KB - Virtual size: 11KB

.aomadmi Size: 512B - Virtual size: 10B

.rsrc Size: 1024B - Virtual size: 976B

.reloc Size: 37KB - Virtual size: 36KB

Password: 2024

.text
Size: 368KB - Virtual size: 368KB

.data
Size: 21KB - Virtual size: 2.2MB

.idata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 284B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 27KB - Virtual size: 26KB

.text
Size: 407KB - Virtual size: 406KB

.data
Size: 4KB - Virtual size: 12KB

.idata
Size: 12KB - Virtual size: 11KB

.aomadmi
Size: 512B - Virtual size: 10B

.rsrc
Size: 1024B - Virtual size: 976B

.reloc
Size: 37KB - Virtual size: 36KB

.text
Size: 235KB - Virtual size: 234KB

.data
Size: 1KB - Virtual size: 3KB

.idata
Size: 5KB - Virtual size: 4KB

.didat
Size: 512B - Virtual size: 200B

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 12KB - Virtual size: 11KB