kernel32[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

kernel32.dll
Size

796KB
MD5

fc3391a5231682273c849d213abb05ea
SHA1

97a1c0ff324cfceca80e7942490ad00cfcc88b7f
SHA256

fe0202f40e2b3577304da016e78630ddc09bab7e5e0797d3a9289d454df765df
SHA512

eb95481a509c9871475de307e5f572a8d9af73c9392b5001bfb1112772c4ab8dc2bee78e797bf8edc134bf4b066484d13e9e8158694395df1968a5eb2ad6e6a4
SSDEEP

24576:+LkCksh+mqHymJS58D3gPCAp8+u2F/sSkE:+th+mqzCp8+uk/sSn

Score

1^/10

Malware Config

Signatures

Files

kernel32.dll
.dll windows:10 windows x64 arch:x64

Password: infected

9f44b19ce54fbcb3e12c77bd72b0ee39

Code Sign

33:00:00:04:5b:f6:31:bc:00:f4:fc:37:45:00:00:00:00:04:5b
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

14/09/2023, 18:20

Not After

04/09/2024, 18:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:cf:14:20:5f:e2:9c:32:f6:6b:53:38:8e:a6:e6:9a:ac:3a:64:66:60:54:84:1b:12:c3:c1:3c:c7:80:dc:5b
Signer

Actual PE Digest

28:cf:14:20:5f:e2:9c:32:f6:6b:53:38:8e:a6:e6:9a:ac:3a:64:66:60:54:84:1b:12:c3:c1:3c:c7:80:dc:5b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

kernel32.pdb

Imports

api-ms-win-core-rtlsupport-l1-1-0

RtlCompareMemory
RtlRaiseException
RtlDeleteFunctionTable
RtlUnwindEx
RtlInstallFunctionTableCallback
RtlCaptureContext
RtlAddFunctionTable
RtlVirtualUnwind
RtlPcToFileHeader
RtlUnwind
RtlRestoreContext
RtlLookupFunctionEntry

api-ms-win-core-rtlsupport-l1-2-2

RtlVirtualUnwind2

ntdll

RtlUnicodeStringToInteger
RtlGetUILanguageInfo
EtwEventEnabled
RtlpConvertLCIDsToCultureNames
NtEnumerateKey
RtlIntegerToUnicodeString
RtlTimeToTimeFields
RtlTimeFieldsToTime
RtlUnhandledExceptionFilter
NtTerminateProcess
TpSetPoolStackInformation
TpAllocWait
NtDeleteValueKey
NtSetValueKey
towlower
RtlLCIDToCultureName
RtlSizeHeap
RtlpConvertCultureNamesToLCIDs
NtQueryInstallUILanguage
EtwEventUnregister
EtwEventWrite
EtwEventRegister
RtlPublishWnfStateData
_wcslwr
NtQueryLicenseValue
_wtol
memmove_s
RtlGUIDFromString
sin
TpAllocTimer
TpAllocIoCompletion
TpAllocWork
wcsncmp
wcsncpy
LdrFindResourceEx_U
RtlReadThreadProfilingData
RtlQueryThreadProfiling
RtlEnableThreadProfiling
RtlDisableThreadProfiling
RtlNtStatusToDosErrorNoTeb
NtMapUserPhysicalPagesScatter
RtlDecodeSystemPointer
bsearch
RtlComputeImportTableHash
RtlFindActivationContextSectionGuid
RtlCreateActivationContext
NtMapViewOfSection
RtlDoesFileExists_U
NtUnmapViewOfSection
RtlReleaseActivationContext
LdrResFindResourceDirectory
RtlQueryInformationActivationContext
RtlSetThreadPreferredUILanguages
swprintf_s
RtlImageNtHeaderEx
RtlDetermineDosPathNameType_U
RtlQueryPackageClaims
RtlZombifyActivationContext
RtlSubAuthorityCountSid
RtlActivateActivationContext
RtlpEnsureBufferSize
RtlpApplyLengthFunction
RtlQueryActivationContextApplicationSettings
RtlGetActiveActivationContext
RtlDosPathNameToNtPathName_U_WithStatus
NtCreateSection
DbgPrintEx
RtlGetLengthWithoutLastFullDosOrNtPathElement
RtlGetFullPathName_U
RtlDeactivateActivationContext
TpCallbackMayRunLong
RtlAddRefActivationContext
isdigit
atol
tolower
toupper
RtlUnicodeStringToOemString
CsrAllocateCaptureBuffer
RtlCreateEnvironmentEx
wcsrchr
RtlCreateUnicodeString
RtlDestroyEnvironment
NtQueryVolumeInformationFile
RtlCreateEnvironment
CsrFreeCaptureBuffer
NtQueryEvent
RtlFreeOemString
NtRaiseHardError
RtlGetCurrentDirectory_U
CsrAllocateMessagePointer
RtlFreeAnsiString
RtlEqualUnicodeString
RtlUnicodeStringToAnsiString
RtlExitUserThread
RtlQueryProtectedPolicy
RtlAddIntegrityLabelToBoundaryDescriptor
NtReplacePartitionUnit
NtQueryValueKey
RtlEqualSid
NtOpenThreadToken
EtwEventWriteNoRegistration
RtlFormatCurrentUserKeyPath
RtlInitUnicodeStringEx
NtQueryInformationToken
RtlAcquireSRWLockExclusive
LdrLoadDll
NtSetInformationThread
RtlReleaseSRWLockExclusive
LdrUnloadDll
NtOpenKey
RtlAppendUnicodeToString
RtlSubAuthoritySid
RtlQueryPackageIdentity
RtlWow64LogMessageInEventLogger
RtlExitUserProcess
RtlAppendUnicodeStringToString
LdrGetProcedureAddress
RtlInitializeSid
NtOpenProcessToken
RtlQueryRegistryValuesEx
RtlCompareUnicodeString
RtlxAnsiStringToUnicodeSize
RtlInitAnsiStringEx
RtlAnsiStringToUnicodeString
RtlIsNameLegalDOS8Dot3
RtlGetCurrentProcessorNumberEx
NtWaitForSingleObject
NtCreateEvent
RtlSetSearchPathMode
LdrGetDllDirectory
RtlLockHeap
RtlUnlockHeap
RtlGetUserInfoHeap
_wcsnicmp
strncmp
_strnicmp
RtlCompactHeap
RtlDeregisterSecureMemoryCacheCallback
RtlRegisterSecureMemoryCacheCallback
NtOpenFile
NtFsControlFile
NtClose
LdrAddRefDll
NtQueryInformationFile
wcscpy_s
NtSetInformationFile
RtlGetActiveConsoleId
RtlNtStatusToDosError
RtlDeactivateActivationContextUnsafeFast
RtlActivateActivationContextUnsafeFast
RtlFreeUnicodeString
NtSetInformationDebugObject
DbgUiGetThreadDebugObject
RtlWow64GetThreadSelectorEntry
DbgUiIssueRemoteBreakin
NtSetSystemInformation
RtlGetCurrentTransaction
NtQueryInformationProcess
RtlSetCurrentTransaction
RtlSetLastWin32Error
TpAllocCleanupGroup
TpSimpleTryPost
TpQueryPoolStackInformation
TpSetPoolMinThreads
TpAllocPool
RtlMultiAppendUnicodeStringBuffer
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlGetPersistedStateLocation
CsrVerifyRegion
RtlCharToInteger
RtlInitAnsiString
RtlUpcaseUnicodeChar
RtlUnicodeToMultiByteSize
RtlDestroyAtomTable
NtFindAtom
NtQueryInformationAtom
RtlAddAtomToAtomTable
NtAddAtomEx
NtDeleteAtom
RtlCreateAtomTable
RtlDeleteAtomFromAtomTable
RtlLookupAtomInAtomTable
RtlQueryAtomInAtomTable
RtlDnsHostNameToComputerName
RtlPrefixString
NtFlushKey
_memicmp
RtlxUnicodeStringToAnsiSize
RtlEnterCriticalSection
wcschr
wcsstr
RtlLeaveCriticalSection
NtCreateKey
NtCreateFile
RtlCreateUnicodeStringFromAsciiz
wcsncpy_s
wcscspn
NtCreateJobSet
RtlReleasePrivilege
NtSetInformationJobObject
NtQueryInformationJobObject
NtCreateJobObject
RtlAcquirePrivilege
NtAssignProcessToJobObject
NtTerminateJobObject
NtOpenJobObject
RtlLengthSecurityDescriptor
NtSetEaFile
NtSetSecurityObject
NtQueryEaFile
NtQuerySecurityObject
LdrQueryImageFileKeyOption
LdrOpenImageFileOptionsKey
RtlQueryElevationFlags
NtSetInformationProcess
RtlRaiseStatus
NtQuerySection
NtFreeVirtualMemory
NtWriteFile
NtEnumerateValueKey
RtlEqualString
RtlUnicodeToMultiByteN
strncpy_s
NtUnlockFile
RtlDosPathNameToNtPathName_U
NtReadFile
NtLockFile
RtlCopyUnicodeString
CsrCaptureMessageString
RtlIsTextUnicode
NtAllocateVirtualMemory
RtlGetLongestNtPathLength
RtlPrefixUnicodeString
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlDosPathNameToRelativeNtPathName_U
RtlReleaseRelativeName
RtlSetIoCompletionCallback
RtlDeregisterWait
RtlRegisterWait
RtlImageDirectoryEntryToData
NtQueryVirtualMemory
RtlCreateBoundaryDescriptor
NtProtectVirtualMemory
RtlGetThreadErrorMode
NtCreateMailslotFile
RtlDestroyQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlCreateQueryDebugBuffer
NtQueryDirectoryFile
strcpy_s
RtlFindActivationContextSectionString
LdrSetDllDirectory
LdrFindResource_U
RtlSwitchedVVI
NtIsSystemResumeAutomatic
NtQueryWnfStateData
NtPowerInformation
NtInitiatePowerAction
NtGetDevicePowerState
NtSetThreadExecutionState
NtSetSystemEnvironmentValueEx
NtQuerySystemEnvironmentValueEx
RtlInitString
NtSetVolumeInformationFile
NtQuerySystemInformationEx
NtDeviceIoControlFile
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
strchr
RtlSetEnvironmentStrings
RtlOemStringToUnicodeString
wcscat_s
RtlAllocateAndInitializeSid
RtlQueryEnvironmentVariable_U
NtQueryAttributesFile
RtlFreeSid
strrchr
NtQueryFullAttributesFile
NtQueryInformationThread
TpCaptureCaller
_stricmp
NtSetTimerResolution
NtQueryTimerResolution
RtlGetAppContainerSidType
RtlConvertSidToUnicodeString
RtlSetEnvironmentVariable
RtlGetAppContainerParent
RtlQueryEnvironmentVariable
CsrCaptureMessageMultiUnicodeStringsInPlace
wcsnlen
strcat_s
strnlen
NlsMbCodePageTag
RtlRunOnceExecuteOnce
RtlInitializeCriticalSection
RtlGetThreadPreferredUILanguages
NtReadVirtualMemory
LdrResSearchResource
RtlTryAcquirePebLock
RtlReleasePebLock
RtlEncodeSystemPointer
RtlGetNtSystemRoot
NtWaitForMultipleObjects
NtClearEvent
RtlWerpReportException
DbgPrint
RtlGetDeviceFamilyInfoEnum
RtlHashUnicodeString
RtlReAllocateHeap
NtApphelpCacheControl
RtlGetFullPathName_UEx
ZwClose
ZwOpenFile
ZwOpenKey
ZwEnumerateKey
ZwQueryValueKey
ZwCreateFile
ZwQueryInformationFile
ZwCreateSection
ZwQueryDirectoryFile
RtlNtPathNameToDosPathName
RtlUpcaseUnicodeString
RtlGetNativeSystemInformation
ZwQuerySystemInformation
ZwUnmapViewOfSection
ZwMapViewOfSection
VerSetConditionMask
RtlVerifyVersionInfo
RtlGetVersion
ZwEnumerateValueKey
RtlGetCurrentServiceSessionId
CsrClientCallServer
RtlSetProtectedPolicy
RtlGetSuiteMask
RtlImageNtHeader
LdrDisableThreadCalloutsForDll
RtlInitUnicodeString
RtlSetThreadPoolStartFunc
LdrQueryImageFileExecutionOptions
_vsnwprintf
LdrSetDllManifestProber
RtlCreateSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlCreateAcl
RtlFreeHeap
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
NtQuerySystemInformation
RtlAllocateHeap
RtlSetOwnerSecurityDescriptor
_wcsicmp
__C_specific_handler
memmove
__chkstk
_local_unwind
cos
floor
memcmp
memcpy
memset
wcscmp

kernelbase

NlsIsUserDefaultLocale
BaseFormatObjectAttributes
GetVolumeNameForVolumeMountPointW
lstrcmpiW
lstrcmpW
GetRegistryExtensionFlags
KernelBaseGetGlobalData
GlobalFree
LoadStringBaseExW
CompareStringA
GetUnicodeStringToEightBitStringRoutine
GetUnicodeStringToEightBitSizeRoutine
GetNamedPipeAttribute
AppXReleaseAppXContext
ReleasePackagedDataForFile
AppXPostSuccessExtension
GetPackagedDataForFile
AppXPreCreationExtension
AreFileApisANSI
AppContainerLookupMoniker
AppContainerFreeMemory
PrivCopyFileExW
EnumLanguageGroupLocalesW
LocalLock
BasepNotifyTrackingService
MoveFileWithProgressTransactedW
lstrlenW
lstrcpynW
PackageIdFromFullName
GetPackageFullName
GetCurrentPackageFullName
CheckIsMSIXPackage
ClosePackageInfo
AppXGetOSMaxVersionTested
GetPackageTargetPlatformProperty
GetTargetPlatformContext
OpenPackageInfoByFullNameForUser
BasepAdjustObjectAttributesForPrivateNamespace
GetEightBitStringToUnicodeStringRoutine
GetStringTableEntry
CheckGroupPolicyEnabled
OpenRegKey
InternalLcidToName
GetSystemDefaultUILanguage
GetPtrCalDataArray
GetUserOverrideString
GetPtrCalData
Internal_EnumCalendarInfo
Internal_EnumLanguageGroupLocales
Internal_EnumSystemCodePages
Internal_EnumDateFormats
Internal_EnumUILanguages
Internal_EnumSystemLanguageGroups
NlsValidateLocale
Internal_EnumTimeFormats
GetNamedLocaleHashNode
GetUserOverrideWord
GetLocaleInfoHelper
GetCalendar
BaseDllFreeResourceId
BaseDllMapResourceIdW
LocalUnlock
GetStringTypeA
SetFileApisToANSI
BaseGetNamedObjectDirectory
CreateProcessAsUserA
LocalReAlloc
CreateProcessInternalA
lstrcpynA
SetFileApisToOEM
CheckAllowDecryptedRemoteDestinationPolicy
FatalAppExitW
GlobalAlloc
PulseEvent
NotifyMountMgr
FatalAppExitA
EnumSystemLocalesEx
EnumSystemLanguageGroupsW
Sleep
HeapSummary
GetProcAddressForCaller
LCIDToLocaleName
GetSystemDefaultLocaleName
MapViewOfFileExNuma
LocalAlloc
GetEraNameCountedString
lstrlenA
EnumUILanguagesW
GetUserDefaultUILanguage
CreateProcessAsUserW
CreateProcessInternalW
GetUserDefaultLocaleName

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetProcessIdOfThread
SetProcessShutdownParameters
GetProcessId
SetThreadPriority
GetProcessVersion
SuspendThread
SetPriorityClass
TlsSetValue
SetProcessAffinityUpdateMode
GetThreadPriorityBoost
UpdateProcThreadAttribute
CreateRemoteThreadEx
GetStartupInfoW
GetExitCodeProcess
InitializeProcThreadAttributeList
OpenProcessToken
CreateRemoteThread
GetCurrentProcessId
GetCurrentProcess
TerminateThread
ResumeThread
OpenThread
GetExitCodeThread
ProcessIdToSessionId
DeleteProcThreadAttributeList
TlsAlloc
GetThreadPriority
QueueUserAPC
SwitchToThread
SetThreadPriorityBoost
GetPriorityClass
GetThreadId
SetThreadStackGuarantee
GetProcessTimes
CreateProcessW
QueryProcessAffinityUpdateMode
TlsFree
CreateProcessA

api-ms-win-core-processthreads-l1-1-3

SetThreadIdealProcessor
GetProcessInformation
GetProcessShutdownParameters
SetProcessInformation

api-ms-win-core-processthreads-l1-1-2

GetThreadInformation
GetThreadIOPendingFlag
GetProcessPriorityBoost
GetSystemTimes
SetProcessPriorityBoost
SetThreadInformation

api-ms-win-core-processthreads-l1-1-1

GetThreadContext
SetThreadContext
GetProcessHandleCount
FlushInstructionCache
IsProcessorFeaturePresent
OpenProcess
GetProcessMitigationPolicy
SetProcessMitigationPolicy
GetThreadTimes
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx

api-ms-win-core-registry-l1-1-0

RegQueryValueExA
RegSaveKeyExA
RegGetValueA
RegQueryInfoKeyW
RegOpenCurrentUser
RegCreateKeyExA
RegFlushKey
RegCreateKeyExW
RegUnLoadKeyA
RegDeleteKeyExW
RegGetKeySecurity
RegDeleteKeyExA
RegEnumKeyExW
RegSetKeySecurity
RegSaveKeyExW
RegDeleteTreeW
RegLoadMUIStringW
RegSetValueExW
RegNotifyChangeKeyValue
RegDisablePredefinedCacheEx
RegDeleteTreeA
RegLoadAppKeyW
RegSetValueExA
RegCopyTreeW
RegLoadKeyA
RegUnLoadKeyW
RegQueryInfoKeyA
RegLoadKeyW
RegOpenKeyExA
RegRestoreKeyW
RegEnumValueA
RegDeleteValueW
RegRestoreKeyA
RegDeleteValueA
RegEnumValueW
RegQueryValueExW
RegEnumKeyExA
RegLoadMUIStringA
RegOpenKeyExW
RegGetValueW
RegOpenUserClassesRoot
RegCloseKey

api-ms-win-core-heap-l1-1-0

HeapCompact
HeapSetInformation
HeapReAlloc
HeapUnlock
HeapQueryInformation
GetProcessHeaps
HeapFree
HeapAlloc
GetProcessHeap
HeapCreate
HeapLock
HeapWalk
HeapValidate
HeapDestroy

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-memory-l1-1-1

CreateMemoryResourceNotification
GetLargePageMinimum
GetWriteWatch
SetSystemFileCacheSize
VirtualLock
VirtualUnlock
SetProcessWorkingSetSizeEx
CreateFileMappingNumaW
GetSystemFileCacheSize
GetProcessWorkingSetSizeEx
QueryMemoryResourceNotification
GetProcessWorkingSetSize
SetProcessWorkingSetSize
ResetWriteWatch

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
FlushViewOfFile
VirtualProtectEx
VirtualQuery
OpenFileMappingW
ReadProcessMemory
VirtualFreeEx
WriteProcessMemory
CreateFileMappingW
VirtualProtect
VirtualFree
VirtualAlloc
MapViewOfFile
MapViewOfFileEx
VirtualAllocEx
VirtualQueryEx

api-ms-win-core-memory-l1-1-2

GetMemoryErrorHandlingCapabilities
FreeUserPhysicalPages
AllocateUserPhysicalPages
RegisterBadMemoryNotification
VirtualAllocExNuma
AllocateUserPhysicalPagesNuma
MapUserPhysicalPages
UnregisterBadMemoryNotification

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle
GetHandleInformation
SetHandleInformation

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForMultipleObjectsEx
SleepEx
SetWaitableTimer
SetEvent
ResetEvent
ReleaseSemaphore
CancelWaitableTimer
CreateEventA
CreateEventExA
CreateEventExW
CreateEventW
CreateMutexA
CreateMutexExA
CreateMutexExW
CreateMutexW
CreateSemaphoreExW
ReleaseMutex
CreateWaitableTimerExW
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
OpenEventA
OpenEventW
OpenMutexW
OpenSemaphoreW
OpenWaitableTimerW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects
CreateSemaphoreW

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitializeSynchronizationBarrier
DeleteSynchronizationBarrier
SignalObjectAndWait
EnterSynchronizationBarrier

api-ms-win-core-file-l1-1-0

GetFullPathNameA
GetFinalPathNameByHandleW
GetFinalPathNameByHandleA
GetFileType
GetFileTime
GetFileSizeEx
FlushFileBuffers
GetFileSize
FindNextVolumeW
GetFileInformationByHandle
GetFileAttributesW
GetFileAttributesExW
GetFileAttributesExA
FindNextFileW
FindNextFileA
FindNextChangeNotification
FindFirstVolumeW
FindFirstFileW
FindFirstFileExW
FindFirstFileExA
FindFirstFileA
FindFirstChangeNotificationW
FindFirstChangeNotificationA
FindCloseChangeNotification
FindClose
FileTimeToLocalFileTime
DeleteVolumeMountPointW
DeleteFileW
DeleteFileA
GetLogicalDriveStringsW
CreateFileW
CreateFileA
CreateDirectoryW
CreateDirectoryA
CompareFileTime
GetVolumePathNameW
LocalFileTimeToFileTime
LockFile
LockFileEx
QueryDosDeviceW
ReadFile
ReadFileEx
ReadFileScatter
RemoveDirectoryA
RemoveDirectoryW
SetEndOfFile
SetFileAttributesA
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetFileValidData
UnlockFile
UnlockFileEx
WriteFile
WriteFileEx
WriteFileGather
GetFileAttributesA
GetFullPathNameW
GetTempFileNameW
GetVolumeInformationByHandleW
DefineDosDeviceW
GetVolumeInformationW
GetDriveTypeW
GetDriveTypeA
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
GetDiskFreeSpaceExA
FindVolumeClose
GetDiskFreeSpaceA

api-ms-win-core-file-l1-2-0

GetTempPathW
GetVolumePathNamesForVolumeNameW
CreateFile2

api-ms-win-core-file-l1-2-2

FindNextFileNameW
GetTempFileNameA
GetVolumeInformationA
FindFirstStreamW
FindFirstFileNameW
GetTempPathA

api-ms-win-core-file-l1-2-4

GetTempPath2A
GetTempPath2W

api-ms-win-core-file-l1-2-1

SetFileIoOverlappedRange
GetCompressedFileSizeA
GetCompressedFileSizeW

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-io-l1-1-0

CancelIoEx
GetQueuedCompletionStatusEx
GetOverlappedResult
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
DeviceIoControl

api-ms-win-core-io-l1-1-1

CancelIo
CancelSynchronousIo

api-ms-win-core-job-l1-1-0

IsProcessInJob

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
UnregisterWaitEx
ChangeTimerQueueTimer
DeleteTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueEx
QueueUserWorkItem
CreateTimerQueue

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-libraryloader-l1-2-3

EnumResourceNamesA

api-ms-win-core-libraryloader-l1-2-2

EnumResourceNamesW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA
LockResource
GetModuleHandleW
EnumResourceLanguagesExA
FreeLibraryAndExitThread
GetModuleHandleExW
FindStringOrdinal
GetModuleHandleA
GetModuleFileNameA
EnumResourceTypesExA
LoadLibraryExW
GetProcAddress
FreeLibrary
EnumResourceLanguagesExW
SizeofResource
FreeResource
GetModuleHandleExA
EnumResourceTypesExW
EnumResourceNamesExA
EnumResourceNamesExW
LoadResource
GetModuleFileNameW
DisableThreadLibraryCalls
FindResourceExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW
LoadLibraryA

api-ms-win-core-libraryloader-l2-1-0

LoadPackagedLibrary

api-ms-win-core-namedpipe-l1-2-2

CallNamedPipeW

api-ms-win-core-namedpipe-l1-1-0

ConnectNamedPipe
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
DisconnectNamedPipe
PeekNamedPipe
GetNamedPipeClientComputerNameW
CreatePipe

api-ms-win-core-namedpipe-l1-2-1

GetNamedPipeHandleStateW

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx
GetDateFormatEx

api-ms-win-core-datetime-l1-1-0

GetTimeFormatA
GetDateFormatW
GetTimeFormatW
GetDateFormatA

api-ms-win-core-datetime-l1-1-2

GetDurationFormatEx

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo
GetSystemTimePreciseAsFileTime
EnumSystemFirmwareTables
SetSystemTime
GetSystemFirmwareTable
GetNativeSystemInfo
SetComputerNameExW

api-ms-win-core-sysinfo-l1-2-1

SetComputerNameEx2W
GetPhysicallyInstalledSystemMemory
DnsHostnameToComputerNameExW

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryA
GetLocalTime
GetWindowsDirectoryW
GetVersionExA
GetSystemTimeAsFileTime
GetComputerNameExA
GetLogicalProcessorInformation
GetSystemTime
GetVersion
GetComputerNameExW
GetVersionExW
GetSystemTimeAdjustment
GetLogicalProcessorInformationEx
GetTickCount
SetLocalTime
GetSystemInfo
GlobalMemoryStatusEx

api-ms-win-core-sysinfo-l1-2-3

SetComputerNameW
SetComputerNameExA
SetComputerNameA

api-ms-win-core-timezone-l1-1-0

TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
SetDynamicTimeZoneInformation
SetTimeZoneInformation
GetTimeZoneInformationForYear
GetDynamicTimeZoneInformation
FileTimeToSystemTime

api-ms-win-core-localization-l1-2-0

IdnToUnicode
GetFileMUIInfo
SetThreadPreferredUILanguages
FormatMessageA
LocaleNameToLCID
IsValidLanguageGroup
IsValidLocale
IsValidLocaleName
GetCalendarInfoEx
GetCalendarInfoW
GetCPInfoExW
IsValidNLSVersion
GetNLSVersion
SetThreadLocale
GetSystemDefaultLCID
IsDBCSLeadByteEx
FindNLSString
GetCPInfo
LCMapStringA
GetUserDefaultLangID
GetThreadLocale
SetThreadUILanguage
GetLocaleInfoEx
GetThreadPreferredUILanguages
GetFileMUIPath
IdnToAscii
GetLocaleInfoW
IsNLSDefinedString
GetUserPreferredUILanguages
GetSystemPreferredUILanguages
GetUILanguageInfo
GetLocaleInfoA
GetSystemDefaultLangID
GetACP
GetOEMCP
IsValidCodePage
EnumSystemLocalesA
ResolveLocaleName
FormatMessageW
LCMapStringEx
SetCalendarInfoW
ConvertDefaultLocale
GetThreadUILanguage
VerLanguageNameA
GetUserDefaultLCID
VerLanguageNameW
SetProcessPreferredUILanguages
FindNLSStringEx
IsDBCSLeadByte
EnumSystemLocalesW
GetNLSVersionEx
GetProcessPreferredUILanguages
SetLocaleInfoW
LCMapStringW

api-ms-win-core-processsnapshot-l1-1-0

PssQuerySnapshot
PssCaptureSnapshot
PssWalkSnapshot
PssWalkMarkerCreate
PssWalkMarkerSeekToBeginning
PssFreeSnapshot
PssWalkMarkerGetPosition
PssWalkMarkerFree
PssWalkMarkerSetPosition
PssDuplicateSnapshot

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
SetEnvironmentStringsW
SetCurrentDirectoryA
GetCommandLineA
SetStdHandle
FreeEnvironmentStringsW
SetCurrentDirectoryW
GetCurrentDirectoryA
GetEnvironmentStrings
GetEnvironmentVariableW
SearchPathW
FreeEnvironmentStringsA
GetCommandLineW
GetStdHandle
ExpandEnvironmentStringsW
SetEnvironmentVariableW
ExpandEnvironmentStringsA
GetEnvironmentVariableA
SetStdHandleEx
GetEnvironmentStringsW
SetEnvironmentVariableA

api-ms-win-core-processenvironment-l1-2-0

SearchPathA
NeedCurrentDirectoryForExePathA
NeedCurrentDirectoryForExePathW

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
CompareStringEx
MultiByteToWideChar
FoldStringW
CompareStringW
CompareStringOrdinal
GetStringTypeExW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-debug-l1-1-1

DebugActiveProcessStop
ContinueDebugEvent
DebugActiveProcess
CheckRemoteDebuggerPresent
WaitForDebugEvent

api-ms-win-core-errorhandling-l1-1-0

SetErrorMode
SetLastError
SetUnhandledExceptionFilter
RaiseException
GetLastError
GetErrorMode
UnhandledExceptionFilter

api-ms-win-core-errorhandling-l1-1-3

GetThreadErrorMode
SetThreadErrorMode

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsAlloc
FlsSetValue
FlsGetValue

api-ms-win-core-util-l1-1-0

Beep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-security-base-l1-1-0

DuplicateToken
CreateWellKnownSid
FreeSid
EqualSid
GetSidSubAuthorityCount
GetSidSubAuthority
InitializeSid
GetTokenInformation
AllocateAndInitializeSid
AccessCheck

api-ms-win-security-base-l1-2-0

SetCachedSigningLevel
CheckTokenMembershipEx
GetCachedSigningLevel
CheckTokenCapability
GetAppContainerAce
AddResourceAttributeAce
AddScopedPolicyIDAce

api-ms-win-security-appcontainer-l1-1-0

GetAppContainerNamedObjectPath

api-ms-win-core-comm-l1-1-0

ClearCommError
SetCommTimeouts
GetCommConfig
GetCommMask
SetCommMask
GetCommProperties
GetCommState
GetCommTimeouts
PurgeComm
SetCommBreak
ClearCommBreak
GetCommModemStatus
SetCommState
SetupComm
TransmitCommChar
WaitCommEvent
EscapeCommFunction
SetCommConfig

api-ms-win-core-realtime-l1-1-0

QueryIdleProcessorCycleTime
QueryIdleProcessorCycleTimeEx
QueryThreadCycleTime
QueryUnbiasedInterruptTime
QueryProcessCycleTime

api-ms-win-core-wow64-l1-1-1

GetSystemWow64Directory2W
IsWow64Process2
GetSystemWow64DirectoryW
GetSystemWow64DirectoryA

api-ms-win-core-wow64-l1-1-0

IsWow64Process
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
Wow64EnableWow64FsRedirection

api-ms-win-core-wow64-l1-1-3

Wow64SuspendThread
Wow64GetThreadContext
Wow64SetThreadContext

api-ms-win-core-systemtopology-l1-1-1

GetNumaProximityNodeEx

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx

api-ms-win-core-processtopology-l1-1-0

GetThreadGroupAffinity
SetThreadGroupAffinity
GetProcessGroupAffinity

api-ms-win-core-namespace-l1-1-0

CreatePrivateNamespaceW
OpenPrivateNamespaceW
CreateBoundaryDescriptorW
ClosePrivateNamespace
AddSIDToBoundaryDescriptor
DeleteBoundaryDescriptor

api-ms-win-core-file-l2-1-2

CopyFileW
CreateHardLinkA

api-ms-win-core-file-l2-1-0

MoveFileExW
ReplaceFileW
MoveFileWithProgressW
CreateHardLinkW
CopyFile2
CreateSymbolicLinkW
CopyFileExW
GetFileInformationByHandleEx
CreateDirectoryExW
ReadDirectoryChangesW
ReOpenFile

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-file-l2-1-3

ReadDirectoryChangesExW

api-ms-win-core-xstate-l2-1-0

GetXStateFeaturesMask
InitializeContext
SetXStateFeaturesMask
GetEnabledXStateFeatures
LocateXStateFeature
CopyContext

api-ms-win-core-xstate-l2-1-1

InitializeContext2

api-ms-win-core-xstate-l2-1-2

EnableProcessOptionalXStateFeatures
GetThreadEnabledXStateFeatures

api-ms-win-core-localization-l2-1-0

GetNumberFormatEx
EnumDateFormatsW
EnumSystemCodePagesW
GetCurrencyFormatEx
EnumTimeFormatsW
EnumTimeFormatsEx
EnumCalendarInfoExEx
EnumCalendarInfoW
EnumDateFormatsExW
EnumDateFormatsExEx
EnumCalendarInfoExW

api-ms-win-core-normalization-l1-1-0

GetStringScripts
VerifyScripts
IdnToNameprepUnicode
NormalizeString
IsNormalizedString

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock
GlobalHandle
GlobalFlags
GlobalSize
LocalSize
LocalFlags
GlobalReAlloc

api-ms-win-core-fibers-l2-1-0

ConvertThreadToFiber
SwitchToFiber
CreateFiber
DeleteFiber
ConvertFiberToThread

api-ms-win-core-fibers-l2-1-1

ConvertThreadToFiberEx
CreateFiberEx

api-ms-win-core-localization-private-l1-1-0

NlsUpdateSystemLocale
NlsCheckPolicy
NlsUpdateLocale
NlsGetCacheUpdateCount

api-ms-win-core-sidebyside-l1-1-0

AddRefActCtx
ZombifyActCtx
GetCurrentActCtx
ReleaseActCtx
CreateActCtxW
ActivateActCtx
FindActCtxSectionGuid
FindActCtxSectionStringW
DeactivateActCtx
QueryActCtxW
QueryActCtxSettingsW

api-ms-win-core-appcompat-l1-1-0

BaseCleanupAppcompatCacheSupport
BaseCheckAppcompatCacheEx
BaseInitAppcompatCacheSupport
BaseCheckAppcompatCache
BaseFlushAppcompatCache
BaseDumpAppcompatCache
BaseUpdateAppcompatCache

api-ms-win-core-windowserrorreporting-l1-1-1

WerUnregisterExcludedMemoryBlock
WerUnregisterAdditionalProcess
WerRegisterExcludedMemoryBlock
WerUnregisterCustomMetadata
WerRegisterCustomMetadata
WerRegisterAdditionalProcess

api-ms-win-core-windowserrorreporting-l1-1-2

WerUnregisterAppLocalDump
WerRegisterAppLocalDump

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterRuntimeExceptionModule
GetApplicationRestartSettings
WerUnregisterRuntimeExceptionModule
WerRegisterFile
WerUnregisterMemoryBlock
WerRegisterMemoryBlock
WerUnregisterFile
GetApplicationRecoveryCallback

api-ms-win-core-windowserrorreporting-l1-1-3

UnregisterApplicationRestart
RegisterApplicationRestart

api-ms-win-core-console-l1-1-0

AllocConsole
WriteConsoleW
SetConsoleMode
SetConsoleCtrlHandler
ReadConsoleW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetNumberOfConsoleInputEvents
ReadConsoleInputW
WriteConsoleA
ReadConsoleA
ReadConsoleInputA

api-ms-win-core-console-l1-2-0

AttachConsole
FreeConsole
PeekConsoleInputA
PeekConsoleInputW

api-ms-win-core-console-l1-2-1

ResizePseudoConsole
ClosePseudoConsole
CreatePseudoConsole

api-ms-win-core-console-l2-1-0

CreateConsoleScreenBuffer
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FillConsoleOutputCharacterW
FlushConsoleInputBuffer
GenerateConsoleCtrlEvent
GetConsoleCursorInfo
WriteConsoleOutputAttribute
WriteConsoleOutputCharacterA
GetConsoleScreenBufferInfo
GetConsoleScreenBufferInfoEx
WriteConsoleOutputCharacterW
WriteConsoleOutputW
GetLargestConsoleWindowSize
ReadConsoleOutputA
ReadConsoleOutputAttribute
ReadConsoleOutputCharacterA
ReadConsoleOutputW
ScrollConsoleScreenBufferA
ScrollConsoleScreenBufferW
SetConsoleActiveScreenBuffer
SetConsoleCP
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleOutputCP
ReadConsoleOutputCharacterW
WriteConsoleOutputA
WriteConsoleInputW
WriteConsoleInputA
SetConsoleWindowInfo
SetConsoleTextAttribute
SetConsoleScreenBufferSize
SetConsoleScreenBufferInfoEx

api-ms-win-core-console-l2-2-0

GetConsoleTitleA
GetConsoleOriginalTitleW
GetConsoleOriginalTitleA
SetConsoleTitleW
SetConsoleTitleA
GetConsoleTitleW

api-ms-win-core-console-l3-2-0

GetConsoleCommandHistoryLengthW
GetConsoleCommandHistoryLengthA
GetConsoleCommandHistoryA
GetConsoleAliasesW
GetConsoleAliasesLengthW
GetConsoleAliasesLengthA
GetConsoleAliasesA
GetConsoleAliasW
GetConsoleAliasExesW
GetConsoleAliasExesLengthW
GetConsoleAliasExesLengthA
GetConsoleCommandHistoryW
GetConsoleAliasA
ExpungeConsoleCommandHistoryW
ExpungeConsoleCommandHistoryA
AddConsoleAliasW
GetCurrentConsoleFontEx
GetNumberOfConsoleMouseButtons
SetConsoleDisplayMode
GetConsoleDisplayMode
GetConsoleFontSize
SetConsoleHistoryInfo
SetConsoleNumberOfCommandsA
SetConsoleNumberOfCommandsW
SetCurrentConsoleFontEx
GetConsoleHistoryInfo
GetConsoleProcessList
GetConsoleSelectionInfo
GetConsoleWindow
GetConsoleAliasExesA
GetCurrentConsoleFont
AddConsoleAliasA

api-ms-win-core-psapi-l1-1-0

K32QueryWorkingSet
K32InitializeProcessForWsWatch
K32EnumProcesses
K32GetMappedFileNameW
QueryFullProcessImageNameW
K32GetProcessMemoryInfo
K32GetModuleInformation
K32EnumProcessModulesEx
K32GetModuleBaseNameW
K32GetDeviceDriverBaseNameW
K32EnumProcessModules
K32GetPerformanceInfo
K32EnumDeviceDrivers
K32GetDeviceDriverFileNameW
K32GetModuleFileNameExW
K32GetWsChangesEx
K32EnumPageFilesW
K32EmptyWorkingSet
K32GetProcessImageFileNameW
K32QueryWorkingSetEx
K32GetWsChanges

api-ms-win-core-psapi-ansi-l1-1-0

K32GetDeviceDriverBaseNameA
K32GetDeviceDriverFileNameA
K32GetMappedFileNameA
K32GetModuleFileNameExA
QueryFullProcessImageNameA
K32GetModuleBaseNameA
K32GetProcessImageFileNameA
K32EnumPageFilesA

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-appcompat-l1-1-1

BaseReadAppCompatDataForProcess
BaseFreeAppCompatDataForProcess

Exports

Exports

AcquireSRWLockExclusive
AcquireSRWLockShared
ActivateActCtx
ActivateActCtxWorker
ActivatePackageVirtualizationContext
AddAtomA
AddAtomW
AddConsoleAliasA
AddConsoleAliasW
AddDllDirectory
AddIntegrityLabelToBoundaryDescriptor
AddLocalAlternateComputerNameA
AddLocalAlternateComputerNameW
AddRefActCtx
AddRefActCtxWorker
AddResourceAttributeAce
AddSIDToBoundaryDescriptor
AddScopedPolicyIDAce
AddSecureMemoryCacheCallback
AddVectoredContinueHandler
AddVectoredExceptionHandler
AdjustCalendarDate
AllocConsole
AllocateUserPhysicalPages
AllocateUserPhysicalPagesNuma
AppPolicyGetClrCompat
AppPolicyGetCreateFileAccess
AppPolicyGetLifecycleManagement
AppPolicyGetMediaFoundationCodecLoading
AppPolicyGetProcessTerminationMethod
AppPolicyGetShowDeveloperDiagnostic
AppPolicyGetThreadInitializationType
AppPolicyGetWindowingModel
AppXGetOSMaxVersionTested
ApplicationRecoveryFinished
ApplicationRecoveryInProgress
AreFileApisANSI
AreShortNamesEnabled
AssignProcessToJobObject
AttachConsole
BackupRead
BackupSeek
BackupWrite
BaseCheckAppcompatCache
BaseCheckAppcompatCacheEx
BaseCheckAppcompatCacheExWorker
BaseCheckAppcompatCacheWorker
BaseCheckElevation
BaseCleanupAppcompatCacheSupport
BaseCleanupAppcompatCacheSupportWorker
BaseDestroyVDMEnvironment
BaseDllReadWriteIniFile
BaseDumpAppcompatCache
BaseDumpAppcompatCacheWorker
BaseElevationPostProcessing
BaseFlushAppcompatCache
BaseFlushAppcompatCacheWorker
BaseFormatObjectAttributes
BaseFormatTimeOut
BaseFreeAppCompatDataForProcessWorker
BaseGenerateAppCompatData
BaseGetNamedObjectDirectory
BaseInitAppcompatCacheSupport
BaseInitAppcompatCacheSupportWorker
BaseIsAppcompatInfrastructureDisabled
BaseIsAppcompatInfrastructureDisabledWorker
BaseIsDosApplication
BaseQueryModuleData
BaseReadAppCompatDataForProcessWorker
BaseSetLastNTError
BaseThreadInitThunk
BaseUpdateAppcompatCache
BaseUpdateAppcompatCacheWorker
BaseUpdateVDMEntry
BaseVerifyUnicodeString
BaseWriteErrorElevationRequiredEvent
Basep8BitStringToDynamicUnicodeString
BasepAllocateActivationContextActivationBlock
BasepAnsiStringToDynamicUnicodeString
BasepAppContainerEnvironmentExtension
BasepAppXExtension
BasepCheckAppCompat
BasepCheckWebBladeHashes
BasepCheckWinSaferRestrictions
BasepConstructSxsCreateProcessMessage
BasepCopyEncryption
BasepFinishPackageActivation
BasepFinishPackageActivationForSxS
BasepFreeActivationContextActivationBlock
BasepFreeAppCompatData
BasepGetAppCompatData
BasepGetComputerNameFromNtPath
BasepGetExeArchType
BasepGetPackageActivationTokenForFilePath
BasepGetPackageActivationTokenForSxS
BasepGetPackagedAppInfoForFile
BasepInitAppCompatData
BasepIsProcessAllowed
BasepMapModuleHandle
BasepNotifyLoadStringResource
BasepPostSuccessAppXExtension
BasepProcessInvalidImage
BasepQueryAppCompat
BasepQueryModuleChpeSettings
BasepReleaseAppXContext
BasepReleasePackagedAppInfo
BasepReleaseSxsCreateProcessUtilityStruct
BasepReportFault
BasepSetFileEncryptionCompression
Beep
BeginUpdateResourceA
BeginUpdateResourceW
BindIoCompletionCallback
BuildCommDCBA
BuildCommDCBAndTimeoutsA
BuildCommDCBAndTimeoutsW
BuildCommDCBW
BuildIoRingCancelRequest
BuildIoRingFlushFile
BuildIoRingReadFile
BuildIoRingRegisterBuffers
BuildIoRingRegisterFileHandles
BuildIoRingWriteFile
CallNamedPipeA
CallNamedPipeW
CallbackMayRunLong
CancelDeviceWakeupRequest
CancelIo
CancelIoEx
CancelSynchronousIo
CancelThreadpoolIo
CancelTimerQueueTimer
CancelWaitableTimer
CeipIsOptedIn
ChangeTimerQueueTimer
CheckAllowDecryptedRemoteDestinationPolicy
CheckElevation
CheckElevationEnabled
CheckForReadOnlyResource
CheckForReadOnlyResourceFilter
CheckNameLegalDOS8Dot3A
CheckNameLegalDOS8Dot3W
CheckRemoteDebuggerPresent
CheckTokenCapability
CheckTokenMembershipEx
ClearCommBreak
ClearCommError
CloseConsoleHandle
CloseHandle
CloseIoRing
ClosePackageInfo
ClosePrivateNamespace
CloseProfileUserMapping
ClosePseudoConsole
CloseState
CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolIo
CloseThreadpoolTimer
CloseThreadpoolWait
CloseThreadpoolWork
CmdBatNotification
CommConfigDialogA
CommConfigDialogW
CompareCalendarDates
CompareFileTime
CompareStringA
CompareStringEx
CompareStringOrdinal
CompareStringW
ConnectNamedPipe
ConsoleMenuControl
ContinueDebugEvent
ConvertCalDateTimeToSystemTime
ConvertDefaultLocale
ConvertFiberToThread
ConvertNLSDayOfWeekToWin32DayOfWeek
ConvertSystemTimeToCalDateTime
ConvertThreadToFiber
ConvertThreadToFiberEx
CopyContext
CopyFile2
CopyFileA
CopyFileExA
CopyFileExW
CopyFileTransactedA
CopyFileTransactedW
CopyFileW
CopyLZFile
CreateActCtxA
CreateActCtxW
CreateActCtxWWorker
CreateBoundaryDescriptorA
CreateBoundaryDescriptorW
CreateConsoleScreenBuffer
CreateDirectoryA
CreateDirectoryExA
CreateDirectoryExW
CreateDirectoryTransactedA
CreateDirectoryTransactedW
CreateDirectoryW
CreateEnclave
CreateEventA
CreateEventExA
CreateEventExW
CreateEventW
CreateFiber
CreateFiberEx
CreateFile2
CreateFileA
CreateFileMappingA
CreateFileMappingFromApp
CreateFileMappingNumaA
CreateFileMappingNumaW
CreateFileMappingW
CreateFileTransactedA
CreateFileTransactedW
CreateFileW
CreateHardLinkA
CreateHardLinkTransactedA
CreateHardLinkTransactedW
CreateHardLinkW
CreateIoCompletionPort
CreateIoRing
CreateJobObjectA
CreateJobObjectW
CreateJobSet
CreateMailslotA
CreateMailslotW
CreateMemoryResourceNotification
CreateMutexA
CreateMutexExA
CreateMutexExW
CreateMutexW
CreateNamedPipeA
CreateNamedPipeW
CreatePackageVirtualizationContext
CreatePipe
CreatePrivateNamespaceA
CreatePrivateNamespaceW
CreateProcessA
CreateProcessAsUserA
CreateProcessAsUserW
CreateProcessInternalA
CreateProcessInternalW
CreateProcessW
CreatePseudoConsole
CreateRemoteThread
CreateRemoteThreadEx
CreateSemaphoreA
CreateSemaphoreExA
CreateSemaphoreExW
CreateSemaphoreW
CreateSymbolicLinkA
CreateSymbolicLinkTransactedA
CreateSymbolicLinkTransactedW
CreateSymbolicLinkW
CreateTapePartition
CreateThread
CreateThreadpool
CreateThreadpoolCleanupGroup
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
CreateTimerQueue
CreateTimerQueueTimer
CreateToolhelp32Snapshot
CreateUmsCompletionList
CreateUmsThreadContext
CreateWaitableTimerA
CreateWaitableTimerExA
CreateWaitableTimerExW
CreateWaitableTimerW
CtrlRoutine
DeactivateActCtx
DeactivateActCtxWorker
DeactivatePackageVirtualizationContext
DebugActiveProcess
DebugActiveProcessStop
DebugBreak
DebugBreakProcess
DebugSetProcessKillOnExit
DecodePointer
DecodeSystemPointer
DefineDosDeviceA
DefineDosDeviceW
DelayLoadFailureHook
DeleteAtom
DeleteBoundaryDescriptor
DeleteCriticalSection
DeleteFiber
DeleteFileA
DeleteFileTransactedA
DeleteFileTransactedW
DeleteFileW
DeleteProcThreadAttributeList
DeleteSynchronizationBarrier
DeleteTimerQueue
DeleteTimerQueueEx
DeleteTimerQueueTimer
DeleteUmsCompletionList
DeleteUmsThreadContext
DeleteVolumeMountPointA
DeleteVolumeMountPointW
DequeueUmsCompletionListItems
DeviceIoControl
DisableThreadLibraryCalls
DisableThreadProfiling
DisassociateCurrentThreadFromCallback
DiscardVirtualMemory
DisconnectNamedPipe
DnsHostnameToComputerNameA
DnsHostnameToComputerNameExW
DnsHostnameToComputerNameW
DosDateTimeToFileTime
DosPathToSessionPathA
DosPathToSessionPathW
DuplicateConsoleHandle
DuplicateEncryptionInfoFileExt
DuplicateHandle
DuplicatePackageVirtualizationContext
EnableProcessOptionalXStateFeatures
EnableThreadProfiling
EncodePointer
EncodeSystemPointer
EndUpdateResourceA
EndUpdateResourceW
EnterCriticalSection
EnterSynchronizationBarrier
EnterUmsSchedulingMode
EnumCalendarInfoA
EnumCalendarInfoExA
EnumCalendarInfoExEx
EnumCalendarInfoExW
EnumCalendarInfoW
EnumDateFormatsA
EnumDateFormatsExA
EnumDateFormatsExEx
EnumDateFormatsExW
EnumDateFormatsW
EnumLanguageGroupLocalesA
EnumLanguageGroupLocalesW
EnumResourceLanguagesA
EnumResourceLanguagesExA
EnumResourceLanguagesExW
EnumResourceLanguagesW
EnumResourceNamesA
EnumResourceNamesExA
EnumResourceNamesExW
EnumResourceNamesW
EnumResourceTypesA
EnumResourceTypesExA
EnumResourceTypesExW
EnumResourceTypesW
EnumSystemCodePagesA
EnumSystemCodePagesW
EnumSystemFirmwareTables
EnumSystemGeoID
EnumSystemGeoNames
EnumSystemLanguageGroupsA
EnumSystemLanguageGroupsW
EnumSystemLocalesA
EnumSystemLocalesEx
EnumSystemLocalesW
EnumTimeFormatsA
EnumTimeFormatsEx
EnumTimeFormatsW
EnumUILanguagesA
EnumUILanguagesW
EnumerateLocalComputerNamesA
EnumerateLocalComputerNamesW
EraseTape
EscapeCommFunction
ExecuteUmsThread
ExitProcess
ExitThread
ExitVDM
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
ExpungeConsoleCommandHistoryA
ExpungeConsoleCommandHistoryW
FatalAppExitA
FatalAppExitW
FatalExit
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FillConsoleOutputCharacterW
FindActCtxSectionGuid
FindActCtxSectionGuidWorker
FindActCtxSectionStringA
FindActCtxSectionStringW
FindActCtxSectionStringWWorker
FindAtomA
FindAtomW
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileExA
FindFirstFileExW
FindFirstFileNameTransactedW
FindFirstFileNameW
FindFirstFileTransactedA
FindFirstFileTransactedW
FindFirstFileW
FindFirstStreamTransactedW
FindFirstStreamW
FindFirstVolumeA
FindFirstVolumeMountPointA
FindFirstVolumeMountPointW
FindFirstVolumeW
FindNLSString
FindNLSStringEx
FindNextChangeNotification
FindNextFileA
FindNextFileNameW
FindNextFileW
FindNextStreamW
FindNextVolumeA
FindNextVolumeMountPointA
FindNextVolumeMountPointW
FindNextVolumeW
FindPackagesByPackageFamily
FindResourceA
FindResourceExA
FindResourceExW
FindResourceW
FindStringOrdinal
FindVolumeClose
FindVolumeMountPointClose
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushConsoleInputBuffer
FlushFileBuffers
FlushInstructionCache
FlushProcessWriteBuffers
FlushViewOfFile
FoldStringA
FoldStringW
FormatApplicationUserModelId
FormatMessageA
FormatMessageW
FreeConsole
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
FreeLibraryWhenCallbackReturns
FreeMemoryJobObject
FreeResource
FreeUserPhysicalPages
GenerateConsoleCtrlEvent
GetACP
GetActiveProcessorCount
GetActiveProcessorGroupCount
GetAppContainerAce
GetAppContainerNamedObjectPath
GetApplicationRecoveryCallback
GetApplicationRecoveryCallbackWorker
GetApplicationRestartSettings
GetApplicationRestartSettingsWorker
GetApplicationUserModelId
GetAtomNameA
GetAtomNameW
GetBinaryType
GetBinaryTypeA
GetBinaryTypeW
GetCPInfo
GetCPInfoExA
GetCPInfoExW
GetCachedSigningLevel
GetCalendarDateFormat
GetCalendarDateFormatEx
GetCalendarDaysInMonth
GetCalendarDifferenceInDays
GetCalendarInfoA
GetCalendarInfoEx
GetCalendarInfoW
GetCalendarMonthsInYear
GetCalendarSupportedDateRange
GetCalendarWeekNumber
GetComPlusPackageInstallStatus
GetCommConfig
GetCommMask
GetCommModemStatus
GetCommProperties
GetCommState
GetCommTimeouts
GetCommandLineA
GetCommandLineW
GetCompressedFileSizeA
GetCompressedFileSizeTransactedA

Sections

.text
Size: 516KB - Virtual size: 513KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 220KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

9f44b19ce54fbcb3e12c77bd72b0ee39

Code Sign

33:00:00:04:5b:f6:31:bc:00:f4:fc:37:45:00:00:00:00:04:5bCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

28:cf:14:20:5f:e2:9c:32:f6:6b:53:38:8e:a6:e6:9a:ac:3a:64:66:60:54:84:1b:12:c3:c1:3c:c7:80:dc:5bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-rtlsupport-l1-2-2

ntdll

kernelbase

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-3

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-memory-l1-1-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l1-2-4

api-ms-win-core-file-l1-2-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-job-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-libraryloader-l1-2-3

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-libraryloader-l2-1-0

api-ms-win-core-namedpipe-l1-2-2

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-namedpipe-l1-2-1

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-datetime-l1-1-2

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-3

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processsnapshot-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-security-appcontainer-l1-1-0

api-ms-win-core-comm-l1-1-0

33:00:00:04:5b:f6:31:bc:00:f4:fc:37:45:00:00:00:00:04:5b
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

28:cf:14:20:5f:e2:9c:32:f6:6b:53:38:8e:a6:e6:9a:ac:3a:64:66:60:54:84:1b:12:c3:c1:3c:c7:80:dc:5b
Signer

.text
Size: 516KB - Virtual size: 513KB

.rdata
Size: 220KB - Virtual size: 216KB

.data
Size: 4KB - Virtual size: 4KB

.pdata
Size: 24KB - Virtual size: 21KB

.didat
Size: 4KB - Virtual size: 168B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 948B