D:\Lenovo\source\repos\NoMoreCookies\Release\NoMoreCookies.pdb
Overview
overview
8Static
static
3Components...es.dll
windows11-21h2-x64
3Components...64.dll
windows11-21h2-x64
1Components...es.dll
windows11-21h2-x64
3Components...ce.exe
windows11-21h2-x64
1Components...64.exe
windows11-21h2-x64
1Components...64.dll
windows11-21h2-x64
1Components...es.dll
windows11-21h2-x64
3Components...64.dll
windows11-21h2-x64
1NoMoreCook...er.exe
windows11-21h2-x64
8Static task
static1
Behavioral task
behavioral1
Sample
Components/MiniNoMoreCookies.dll
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
Components/MiniNoMoreCookies_x64.dll
Resource
win11-20240508-en
Behavioral task
behavioral3
Sample
Components/NoMoreCookies.dll
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
Components/NoMoreCookiesService.exe
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
Components/NoMoreCookiesService_x64.exe
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
Components/NoMoreCookies_x64.dll
Resource
win11-20240426-en
Behavioral task
behavioral7
Sample
Components/XNoMoreCookies.dll
Resource
win11-20240426-en
Behavioral task
behavioral8
Sample
Components/XNoMoreCookies_x64.dll
Resource
win11-20240426-en
Behavioral task
behavioral9
Sample
NoMoreCookiesInstaller.exe
Resource
win11-20240426-en
General
-
Target
NoMoreCookies-2.3.zip
-
Size
560KB
-
MD5
d819b0e1978689952adf9f869f710ddd
-
SHA1
531a88a7706788df606bb7d08967f8435d70cb91
-
SHA256
398167bf3344b76b2b9dc3511a3a02345db06e82359f714d34554af15d537659
-
SHA512
06d1d1e6db1386f41f441a78d1bffd01e675bb455518dead9cc52a6f6d5c0400cd36ab9d4bb7676b032bdcc84fac687ca2fec8fe45467afe4ec047df2331fc4c
-
SSDEEP
12288:AOw8u/3jg5w7g0XybbOKCrkEM/5kD1DeulgFMRTTLfReNThANcCI:Xxu/T3g0XSb9d5kD7OaTTLfRetJN
Malware Config
Signatures
-
Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/Components/MiniNoMoreCookies.dll unpack001/Components/MiniNoMoreCookies_x64.dll unpack001/Components/NoMoreCookies.dll unpack001/Components/NoMoreCookiesService.exe unpack001/Components/NoMoreCookiesService_x64.exe unpack001/Components/NoMoreCookies_x64.dll unpack001/Components/XNoMoreCookies.dll unpack001/Components/XNoMoreCookies_x64.dll unpack001/NoMoreCookiesInstaller.exe
Files
-
NoMoreCookies-2.3.zip.zip
-
Components/MiniNoMoreCookies.dll.dll windows:6 windows x86 arch:x86
bbdc3afb4e127c7d399184b65a34af00
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetCurrentProcessId
K32GetProcessImageFileNameW
K32GetModuleInformation
CreateThread
GetCurrentThread
DisableThreadLibraryCalls
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
GetProcAddress
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
SetLastError
FreeLibrary
LoadLibraryExA
LoadLibraryExW
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
ReleaseMutex
WaitForSingleObject
CloseHandle
ReadFile
CreateFileW
GetCurrentProcess
GetLastError
QueryPerformanceCounter
GetModuleHandleW
GetModuleFileNameW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
K32GetModuleFileNameExW
CreateMutexW
LocalAlloc
SetThreadContext
LocalFree
UnhandledExceptionFilter
user32
LoadIconW
advapi32
GetSidSubAuthorityCount
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
OpenProcessToken
GetTokenInformation
GetUserNameW
OpenSCManagerW
GetSidSubAuthority
shell32
Shell_NotifyIconW
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
wintrust
WinVerifyTrust
crypt32
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CertGetNameStringW
vcruntime140
__current_exception
__current_exception_context
_except_handler4_common
memset
__std_type_info_destroy_list
memcpy
wcsstr
__std_exception_destroy
memmove
_CxxThrowException
__std_exception_copy
__CxxFrameHandler3
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
api-ms-win-crt-runtime-l1-1-0
terminate
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_cexit
_seh_filter_dll
_configure_narrow_argv
_crt_atexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_register_onexit_function
api-ms-win-crt-string-l1-1-0
wcsncpy_s
wcscpy_s
towlower
api-ms-win-crt-convert-l1-1-0
wcstombs_s
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Components/MiniNoMoreCookies_x64.dll.dll windows:6 windows x64 arch:x64
11072aabc272aac5bbf61d5a80dcf10f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
D:\Lenovo\source\repos\NoMoreCookies\x64\Release\NoMoreCookies.pdb
Imports
kernel32
GetCurrentProcessId
K32GetProcessImageFileNameW
ExitProcess
K32GetModuleInformation
CreateThread
GetCurrentThread
DisableThreadLibraryCalls
GetCurrentThreadId
SuspendThread
ResumeThread
GetModuleHandleW
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
SetLastError
FreeLibrary
LoadLibraryExA
LoadLibraryExW
GetConsoleMode
GetProcAddress
ReleaseMutex
WaitForSingleObject
CloseHandle
ReadFile
CreateFileW
GetCurrentProcess
GetConsoleOutputCP
WriteFile
FlushFileBuffers
HeapReAlloc
GetLastError
GetModuleFileNameW
K32GetModuleFileNameExW
CreateMutexW
LocalAlloc
GetThreadContext
LocalFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
GetModuleHandleExW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
WideCharToMultiByte
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
WriteConsoleW
user32
LoadIconW
advapi32
GetSidSubAuthorityCount
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
GetUserNameW
OpenSCManagerW
shell32
Shell_NotifyIconW
wintrust
WinVerifyTrust
crypt32
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CertFreeCertificateContext
CertCloseStore
CryptQueryObject
Sections
.text Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Components/NoMoreCookies.dll.dll windows:6 windows x86 arch:x86
04a256795681c977429ac05bd695d903
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
D:\Lenovo\source\repos\NoMoreCookies\Release\NoMoreCookies.pdb
Imports
kernel32
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
VirtualFreeEx
GetProcessIdOfThread
GetCurrentProcessId
GetProcessId
K32GetProcessImageFileNameW
ExitProcess
K32GetModuleInformation
Sleep
GetExitCodeThread
CreateThread
GetCurrentThread
DisableThreadLibraryCalls
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
GetProcAddress
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
SetLastError
FreeLibrary
LoadLibraryExA
LoadLibraryExW
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetModuleFileNameA
OpenProcess
ReleaseMutex
WaitForSingleObject
IsWow64Process
CloseHandle
ReadFile
CreateFileW
GetCurrentProcess
GetLastError
QueryPerformanceCounter
GetModuleHandleW
GetModuleFileNameW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
K32GetModuleFileNameExW
CreateMutexW
LocalAlloc
SetThreadContext
LocalFree
UnhandledExceptionFilter
user32
LoadIconW
advapi32
GetSidSubAuthorityCount
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
OpenProcessToken
GetTokenInformation
GetUserNameW
OpenSCManagerW
GetSidSubAuthority
shell32
Shell_NotifyIconW
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
wintrust
WinVerifyTrust
crypt32
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CertGetNameStringW
vcruntime140
__current_exception
__current_exception_context
_except_handler4_common
memset
__std_type_info_destroy_list
memcpy
wcsstr
__std_exception_destroy
memmove
_CxxThrowException
__std_exception_copy
__CxxFrameHandler3
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
api-ms-win-crt-runtime-l1-1-0
terminate
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_cexit
_seh_filter_dll
_configure_narrow_argv
_crt_atexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_register_onexit_function
api-ms-win-crt-string-l1-1-0
wcsncpy_s
wcscpy_s
towlower
api-ms-win-crt-convert-l1-1-0
wcstombs_s
api-ms-win-crt-math-l1-1-0
ceil
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Components/NoMoreCookiesService.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
D:\Lenovo\source\repos\NoMoreCookiesService\NoMoreCookiesService\obj\Debug\NoMoreCookiesService.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Components/NoMoreCookiesService_x64.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
D:\Lenovo\source\repos\NoMoreCookiesService\NoMoreCookiesService\obj\Debug\NoMoreCookiesService.pdb
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Components/NoMoreCookies_x64.dll.dll windows:6 windows x64 arch:x64
72747a97a06f242eaef581a4f8401a47
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
D:\Lenovo\source\repos\NoMoreCookies\x64\Release\NoMoreCookies.pdb
Imports
kernel32
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
VirtualFreeEx
GetProcessIdOfThread
GetCurrentProcessId
GetProcessId
K32GetProcessImageFileNameW
ExitProcess
K32GetModuleInformation
Sleep
GetExitCodeThread
CreateThread
GetCurrentThread
DisableThreadLibraryCalls
GetCurrentThreadId
SuspendThread
ResumeThread
GetModuleHandleW
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
SetLastError
FreeLibrary
LoadLibraryExA
LoadLibraryExW
GetConsoleMode
GetProcAddress
GetModuleFileNameA
OpenProcess
ReleaseMutex
WaitForSingleObject
IsWow64Process
CloseHandle
ReadFile
CreateFileW
GetCurrentProcess
GetConsoleOutputCP
WriteFile
FlushFileBuffers
HeapReAlloc
GetLastError
GetModuleFileNameW
K32GetModuleFileNameExW
CreateMutexW
LocalAlloc
GetThreadContext
LocalFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
GetModuleHandleExW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
WideCharToMultiByte
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
WriteConsoleW
user32
LoadIconW
advapi32
GetSidSubAuthorityCount
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
GetUserNameW
OpenSCManagerW
shell32
Shell_NotifyIconW
wintrust
WinVerifyTrust
crypt32
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CertFreeCertificateContext
CertCloseStore
CryptQueryObject
Sections
.text Size: 131KB - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Components/XNoMoreCookies.dll.dll windows:6 windows x86 arch:x86
04a256795681c977429ac05bd695d903
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
D:\Lenovo\source\repos\NoMoreCookies\Release\NoMoreCookies.pdb
Imports
kernel32
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
VirtualFreeEx
GetProcessIdOfThread
GetCurrentProcessId
GetProcessId
K32GetProcessImageFileNameW
ExitProcess
K32GetModuleInformation
Sleep
GetExitCodeThread
CreateThread
GetCurrentThread
DisableThreadLibraryCalls
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
GetProcAddress
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
SetLastError
FreeLibrary
LoadLibraryExA
LoadLibraryExW
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetModuleFileNameA
OpenProcess
ReleaseMutex
WaitForSingleObject
IsWow64Process
CloseHandle
ReadFile
CreateFileW
GetCurrentProcess
GetLastError
QueryPerformanceCounter
GetModuleHandleW
GetModuleFileNameW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
K32GetModuleFileNameExW
CreateMutexW
LocalAlloc
SetThreadContext
LocalFree
UnhandledExceptionFilter
user32
LoadIconW
advapi32
GetSidSubAuthorityCount
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
OpenProcessToken
GetTokenInformation
GetUserNameW
OpenSCManagerW
GetSidSubAuthority
shell32
Shell_NotifyIconW
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
wintrust
WinVerifyTrust
crypt32
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CertGetNameStringW
vcruntime140
__current_exception
__current_exception_context
_except_handler4_common
memset
__std_type_info_destroy_list
memcpy
wcsstr
__std_exception_destroy
memmove
_CxxThrowException
__std_exception_copy
__CxxFrameHandler3
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
api-ms-win-crt-runtime-l1-1-0
terminate
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_cexit
_seh_filter_dll
_configure_narrow_argv
_crt_atexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_register_onexit_function
api-ms-win-crt-string-l1-1-0
wcsncpy_s
wcscpy_s
towlower
api-ms-win-crt-convert-l1-1-0
wcstombs_s
api-ms-win-crt-math-l1-1-0
ceil
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Components/XNoMoreCookies_x64.dll.dll windows:6 windows x64 arch:x64
72747a97a06f242eaef581a4f8401a47
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
D:\Lenovo\source\repos\NoMoreCookies\x64\Release\NoMoreCookies.pdb
Imports
kernel32
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
VirtualFreeEx
GetProcessIdOfThread
GetCurrentProcessId
GetProcessId
K32GetProcessImageFileNameW
ExitProcess
K32GetModuleInformation
Sleep
GetExitCodeThread
CreateThread
GetCurrentThread
DisableThreadLibraryCalls
GetCurrentThreadId
SuspendThread
ResumeThread
GetModuleHandleW
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
SetLastError
FreeLibrary
LoadLibraryExA
LoadLibraryExW
GetConsoleMode
GetProcAddress
GetModuleFileNameA
OpenProcess
ReleaseMutex
WaitForSingleObject
IsWow64Process
CloseHandle
ReadFile
CreateFileW
GetCurrentProcess
GetConsoleOutputCP
WriteFile
FlushFileBuffers
HeapReAlloc
GetLastError
GetModuleFileNameW
K32GetModuleFileNameExW
CreateMutexW
LocalAlloc
GetThreadContext
LocalFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
GetModuleHandleExW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
WideCharToMultiByte
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
WriteConsoleW
user32
LoadIconW
advapi32
GetSidSubAuthorityCount
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
GetUserNameW
OpenSCManagerW
shell32
Shell_NotifyIconW
wintrust
WinVerifyTrust
crypt32
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CertFreeCertificateContext
CertCloseStore
CryptQueryObject
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
NoMoreCookiesInstaller.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
D:\Lenovo\source\repos\NoMoreCookiesInstaller\NoMoreCookiesInstaller\obj\Debug\NoMoreCookiesInstaller.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ