[SpotiGen] Spotify Account Generator By Tim Hortons[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

[SpotiGen] Spotify Account Generator By Tim Hortons.rar
Size

22.1MB
MD5

670417946b8a86f6e4ec013a6bad170c
SHA1

106d6119052396544512a8085202d80a120b5b7a
SHA256

88086cf074b74c37e096229c1e019d517cd31db6734f5b46cf81c735aaf6e399
SHA512

5d1c250cf0ca233dbb50f790b894f89cb9d717b3cc26b9d1a34e8b537fc6bb99d80eb7adc528315dadd1845b820ce25422b11abcce8286becbe5986c70fdc60e
SSDEEP

393216:mM5Z3nP/8+u2zyc9qWo7jmNkysQCYnefI0SUpO2WD/ZskxvdP2Yl3U:tTcB2zbqZG69g0STt/Zpx1Po

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/[SpotiGen] Spotify Account Generator By Tim Hortons/CefSharp.cfg	pyinstaller

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/[SpotiGen] Spotify Account Generator By Tim Hortons/CefSharp.cfg
unpack001/[SpotiGen] Spotify Account Generator By Tim Hortons/NcaSvc.dll
unpack001/[SpotiGen] Spotify Account Generator By Tim Hortons/SpotiGen.exe
unpack001/[SpotiGen] Spotify Account Generator By Tim Hortons/bin32.cfg
unpack001/[SpotiGen] Spotify Account Generator By Tim Hortons/libcef.lib
unpack001/[SpotiGen] Spotify Account Generator By Tim Hortons/msi.dll
unpack001/[SpotiGen] Spotify Account Generator By Tim Hortons/urlmon.dll

Files

[SpotiGen] Spotify Account Generator By Tim Hortons.rar
.rar
[SpotiGen] Spotify Account Generator By Tim Hortons/CefSharp.cfg
.exe windows:5 windows x64 arch:x64

e1e8417f4591da7741a300229f9e8e8b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
SetDllDirectoryW
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
CreateDirectoryW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetLastError
SetEndOfFile
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
RaiseException

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW

ws2_32

ntohl

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
main2.pyc
[SpotiGen] Spotify Account Generator By Tim Hortons/NcaSvc.dll
.dll windows:10 windows x64 arch:x64

be040105def20e0c8f67a8a06bf21b12

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

NcaSvc.pdb

Imports

msvcrt

malloc
memset
_wcsnicmp
free
_amsg_exit
_XcptFilter
_vsnprintf_s
wcschr
_wcsicmp
_vsnwprintf
strchr
__C_specific_handler
memcpy
_initterm
wcscmp

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
UnregisterTraceGuids
GetTraceLoggerHandle
RegisterTraceGuidsW
TraceMessage
GetTraceEnableFlags

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
SetEvent
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
WaitForSingleObjectEx
CreateEventW
ReleaseSRWLockShared
SetWaitableTimer
DeleteCriticalSection
WaitForSingleObject
ResetEvent
InitializeSRWLock

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects
CreateWaitableTimerW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork
SubmitThreadpoolWork
LeaveCriticalSectionWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CloseThreadpoolWork
CloseThreadpoolTimer

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

CreateProcessAsUserW
QueueUserAPC
CreateProcessW
TerminateProcess
GetCurrentProcessId
ResumeThread
GetCurrentProcess
GetCurrentThreadId
SetThreadToken
OpenProcessToken
GetCurrentThread
OpenThreadToken
CreateThread

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
LoadStringW

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CoCreateInstance

ws2_32

GetAddrInfoW
WSACleanup
InetPtonW
WSAStartup
FreeAddrInfoW

iphlpapi

IcmpCloseHandle
Icmp6SendEcho2
NotifyIpInterfaceChange
Icmp6CreateFile
FreeMibTable
CreateSortedAddressPairs
CancelMibChangeNotify2
GetAdaptersAddresses
NotifyUnicastIpAddressChange
NotifyRouteChange2

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
GetLengthSid
RevertToSelf
EqualSid
GetTokenInformation
CopySid
CheckTokenMembership
AccessCheck

rpcrt4

RpcServerInqBindings
RpcServerRegisterIfEx
RpcEpUnregister
RpcStringFreeW
RpcServerRegisterAuthInfoW
RpcServerInqDefaultPrincNameW
Ndr64AsyncServerCallAll
NdrServerCallAll
NdrAsyncServerCall
NdrServerCall2
RpcBindingVectorFree
RpcServerUnregisterIfEx
I_RpcBindingIsClientLocal
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcBindingInqAuthClientW
UuidEqual
RpcEpRegisterW
RpcServerUseProtseqW
RpcAsyncCompleteCall
RpcAsyncAbortCall
RpcImpersonateClient
RpcRevertToSelf

api-ms-win-core-file-l1-1-0

WriteFile
ReadFile
CreateFileW
GetTempFileNameW
GetLongPathNameW
SetFilePointer

api-ms-win-core-file-l1-2-0

GetTempPathW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
RegisterGPNotification
UnregisterGPNotification

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
OpenServiceW

api-ms-win-service-management-l2-1-0

NotifyServiceStatusChangeW

api-ms-win-core-synch-l1-2-0

InitializeConditionVariable
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
SleepConditionVariableCS

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlCompareMemory

winhttp

WinHttpCrackUrl
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpCloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetComputerNameExW
GetTickCount64
GetSystemTime

dnsapi

DnsFreePolicyConfig
DnsGetPolicyTableInfo

sspicli

FreeContextBuffer
GetUserNameExW
DeleteSecurityContext
InitializeSecurityContextW
QuerySecurityPackageInfoW
FreeCredentialsHandle
AcquireCredentialsHandleW
RevertSecurityContext
ImpersonateSecurityContext
AcceptSecurityContext

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCreateKeyExW
RegEnumValueW
RegCloseKey
RegNotifyChangeKeyValue
RegDeleteValueW
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

bcrypt

BCryptGetFipsAlgorithmMode

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-shlwapi-legacy-l1-1-0

PathCanonicalizeW

ntdll

EtwTraceMessage
RtlIpv6AddressToStringW
WinSqmIsOptedIn
WinSqmSetDWORD

umpdc

PdcNotificationClientUnregister
PdcNotificationClientRegister

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

httpprxp

ProxyHelperProviderConnectToServer
ProxyHelperProviderRegisterForEventNotification
ProxyHelperProviderUnregisterEventNotification
ProxyHelperProviderDisconnectFromServer

kernel32

GetComputerNameW
CreateJobObjectW
RegisterWaitForSingleObject
UnregisterWaitEx
TerminateJobObject
UnregisterWait
AssignProcessToJobObject

fwpuclnt

FwpmNetEventSubscribe4
FwpmNetEventUnsubscribe0
FwpmEngineClose0
FwpmEngineOpen0

firewallapi

FWChangeNotificationDestroy
FWChangeNotificationCreate

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 596B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
[SpotiGen] Spotify Account Generator By Tim Hortons/SpotiGen.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11.9MB - Virtual size: 11.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
[SpotiGen] Spotify Account Generator By Tim Hortons/bin32.cfg
.exe windows:6 windows x86 arch:x86

0392634acac147c03d108c2d046e7996

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryExW
CreateFileW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
GetStringTypeW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
HeapReAlloc
HeapFree
HeapAlloc
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
SetFilePointerEx
HeapSize
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CloseHandle
WriteConsoleW

Sections

.text
Size: 182KB - Virtual size: 181KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
[SpotiGen] Spotify Account Generator By Tim Hortons/libcef.lib
.exe windows:6 windows x86 arch:x86

b66f87cf58494faf62e606c7906acafe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
MultiByteToWideChar
CreateFileW
GetCurrentThreadId
WideCharToMultiByte
LCMapStringEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
CloseHandle
QueryPerformanceCounter
GetStringTypeW
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
GetFileType
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
WriteConsoleW

winhttp

WinHttpReceiveResponse

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
[SpotiGen] Spotify Account Generator By Tim Hortons/msi.dll
.dll regsvr32 windows:10 windows x64 arch:x64

0ac916d33b90051b9b85935d197891d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

msi.pdb

Imports

msvcrt

free
malloc
_initterm
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
strcmp
memset
memcpy_s
memcpy
memcmp
_ui64tow_s
qsort
_wcstoui64
_amsg_exit
_wcsnicmp
_purecall
_wtoi
_wcsicmp
_vsnprintf
_itoa_s
_CxxThrowException
isdigit
strtol
_itow_s
_ui64tow
wcsstr
wcstol
_wtoi64
_i64tow_s
_vsnwprintf
_XcptFilter
_itow
rand
time
wcschr
srand
iswdigit
wcstoul
towlower
memmove
bsearch
wcsncmp
__C_specific_handler
wcscmp

ntdll

RtlRandom
RtlDestroyEnvironment
EtwTraceMessage
RtlCreateEnvironment
RtlCreateEnvironmentEx
RtlExpandEnvironmentStrings
RtlQueryEnvironmentVariable
RtlSetEnvironmentVar
RtlGetFullPathName_U
RtlGetCurrentServiceSessionId
NtOpenKey
NtClose
NtQueryValueKey
RtlRandomEx
NtQuerySystemInformation
NtSetSecurityObject
NtSetInformationFile
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtUnmapViewOfSection
NtMapViewOfSection
RtlNtStatusToDosErrorNoTeb

advapi32

GetAce
DuplicateToken
SetEntriesInAclW
BuildTrusteeWithSidW
GetSidLengthRequired
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyW
RegEnableReflectionKey
RegDisableReflectionKey
RegSetKeySecurity
RegQueryReflectionKey
SetServiceObjectSecurity
ChangeServiceConfigW
CreateServiceW
EnumDependentServicesW
StartServiceW
DeleteService
QueryServiceConfigW
QueryServiceObjectSecurity
QueryServiceStatus
ControlService
GetServiceDisplayNameW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
GetFileSecurityW
RegEnumKeyW
RegGetKeySecurity
EqualSid
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
ConvertSidToStringSidW
CopySid
IsValidSecurityDescriptor
PrivilegeCheck
SetFileSecurityW
GetUserNameW
CreateProcessAsUserW
SetTokenInformation
GetTokenInformation
SetThreadToken
DuplicateTokenEx
RegCreateKeyExW
RegSetValueExA
RegEnumKeyExA
RegEnumValueA
RegQueryValueExA
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegConnectRegistryW
DeregisterEventSource
ReportEventW
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
AllocateAndInitializeSid
GetLengthSid
FreeSid
InitializeAcl
AddAccessAllowedAce
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetSecurityDescriptorLength
MakeSelfRelativeSD
RegSetValueExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegisterEventSourceW

kernel32

CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
EnumResourceLanguagesW
SizeofResource
EnumResourceNamesW
SetFileTime
QueryDosDeviceW
GetNumberFormatW
GlobalUnlock
FileTimeToDosDateTime
GlobalReAlloc
IsValidCodePage
DosDateTimeToFileTime
ResetEvent
GetSystemTimeAsFileTime
GetFinalPathNameByHandleW
GetLongPathNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetEndOfFile
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetDriveTypeW
MoveFileW
HeapFree
HeapReAlloc
GlobalLock
GetProcessHeap
SearchPathW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
Wow64DisableWow64FsRedirection
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
LeaveCriticalSection
GetTickCount
DeleteFileW
GetExitCodeThread
GetCurrentThreadId
GetCurrentThread
GetLastError
GetCurrentProcess
Sleep
GetSystemInfo
GetVersionExW
lstrlenW
GetModuleFileNameW
DisableThreadLibraryCalls
GetEnvironmentVariableW
EnterCriticalSection
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
GlobalFree
GlobalAlloc
GetSystemDefaultLangID
OutputDebugStringW
CompareStringW
lstrcmpiW
CreateFileW
FormatMessageW
LocalFree
CreateDirectoryW
QueryPerformanceFrequency
TlsFree
SetLastError
DeactivateActCtx
LoadLibraryExW
ActivateActCtx
LoadLibraryW
FindActCtxSectionStringW
CreateActCtxW
GetModuleHandleExW
QueryActCtxW
OutputDebugStringA
FreeLibrary
FileTimeToSystemTime
ExpandEnvironmentStringsW
GetFileAttributesW
GetFileType
GetFileSize
SetEnvironmentVariableW
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
GetProcAddress
SetErrorMode
lstrcmpiA
FindResourceExW
LoadResource
LockResource
GetLocalTime
GetModuleFileNameA
CompareStringA
SetEvent
WaitForSingleObject
OpenEventW
CreateEventW
CreateThread
LocalAlloc
IsDebuggerPresent
GetCurrentProcessId
ResumeThread
GetSystemDirectoryW
TlsSetValue
TlsGetValue
TlsAlloc
CompareFileTime
TerminateProcess
GetNativeSystemInfo
GetUserDefaultLangID
GetComputerNameW
MulDiv
GetLocaleInfoW
GetProfileStringW
GetPrivateProfileStringW
WriteProfileStringW
WritePrivateProfileStringW
ReadFile
SetFilePointer
PowerCreateRequest
PowerSetRequest
PowerClearRequest
ExitThread
GetModuleHandleW
GetDateFormatW
GetTimeFormatW
ExitProcess
GetTempFileNameW
OpenProcess
GetACP
lstrcmpW
OpenThread
WaitForMultipleObjects
FreeLibraryAndExitThread
TerminateThread
HeapAlloc
Wow64RevertWow64FsRedirection
WriteFile
GetOverlappedResult
VirtualFree
VirtualAlloc
ReleaseMutex
FlushFileBuffers
GetTempPathW
DebugBreak
GetExitCodeProcess
QueryPerformanceCounter
MoveFileExW
VirtualQuery
GetCurrentDirectoryW
FindFirstFileW
SetFileAttributesW
FindNextFileW
FindClose
RemoveDirectoryW
GetFileTime
CreateMutexW
OpenMutexW
GetShortPathNameW

user32

EnableWindow
IsCharLowerW
LoadStringW
CharNextA
CharNextW
CharUpperW
MessageBoxW
GetActiveWindow
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
PostQuitMessage
ExitWindowsEx
GetSystemMetrics
GetDC
ReleaseDC
PostMessageW
SystemParametersInfoW
IsWindowEnabled
IsDialogMessageW
DefWindowProcW
RegisterClassW
CreateWindowExW
DestroyWindow
UnregisterClassW
GetDlgItem
SetWindowTextW
ShowWindow
SetForegroundWindow
SendMessageW
InvalidateRect
IsWindowVisible
GetUserObjectInformationW
LoadCursorW
GetWindowRect
GetWindowLongW
SetWindowLongW
SendDlgItemMessageW
SetDlgItemTextW
CreateDialogParamW
MoveWindow
SetFocus
LoadIconW
SetWindowPos
GetDlgItemTextW
EndDialog
GetWindowTextLengthW
GetWindowTextW
DialogBoxParamW
GetSystemMenu
RemoveMenu
CopyRect
DrawTextW
MapWindowPoints
GetClientRect
RegisterWindowMessageW
SetWindowLongPtrW
GetWindowLongPtrW
GetFocus
GetSysColor
CharUpperBuffW
SendMessageTimeoutW
CharPrevW
EnableMenuItem
SetUserObjectSecurity
EnumWindows
GetWindow
GetWindowThreadProcessId
SetCursor
GetProcessWindowStation
CharLowerW

shell32

CommandLineToArgvW

gdi32

CreateSolidBrush
SetBkColor
SetTextColor
EnumFontFamiliesExW
CreateFontW
GetTextExtentPoint32W
RemoveFontResourceW
AddFontResourceW
DeleteObject
GetTextMetricsW
GetTextFaceW
SelectObject
CreateFontIndirectW
GetDeviceCaps

rpcrt4

RpcAsyncCompleteCall
I_RpcExceptionFilter
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
CStdStubBuffer_DebugServerQueryInterface
NdrOleFree
RpcAsyncInitializeHandle
RpcBindingFree
Ndr64AsyncClientCall
RpcBindingSetAuthInfoExW
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrClientCall3
CStdStubBuffer_Connect
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
RpcAsyncCancelCall

ole32

HWND_UserUnmarshal
HWND_UserFree
HWND_UserFree64
HWND_UserSize64
HWND_UserSize
HWND_UserMarshal
HWND_UserMarshal64
HWND_UserUnmarshal64
IIDFromString
CoTaskMemAlloc
CoTaskMemFree
PropVariantClear
CoCreateGuid

bcrypt

BCryptFinishHash
BCryptGetProperty
BCryptHashData
BCryptCreateHash
BCryptDestroyHash

api-ms-win-security-base-l1-1-0

RevertToSelf
CreateWellKnownSid
ImpersonateLoggedOnUser

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetVersion
DllRegisterServer
DllUnregisterServer
Migrate10CachedPackagesA
Migrate10CachedPackagesW
MsiAdvertiseProductA
MsiAdvertiseProductExA
MsiAdvertiseProductExW
MsiAdvertiseProductW
MsiAdvertiseScriptA
MsiAdvertiseScriptW
MsiApplyMultiplePatchesA
MsiApplyMultiplePatchesW
MsiApplyPatchA
MsiApplyPatchW
MsiBeginTransactionA
MsiBeginTransactionW
MsiCloseAllHandles
MsiCloseHandle
MsiCollectUserInfoA
MsiCollectUserInfoW
MsiConfigureFeatureA
MsiConfigureFeatureFromDescriptorA
MsiConfigureFeatureFromDescriptorW
MsiConfigureFeatureW
MsiConfigureProductA
MsiConfigureProductExA
MsiConfigureProductExW
MsiConfigureProductW
MsiCreateAndVerifyInstallerDirectory
MsiCreateRecord
MsiCreateTransformSummaryInfoA
MsiCreateTransformSummaryInfoW
MsiDatabaseApplyTransformA
MsiDatabaseApplyTransformW
MsiDatabaseCommit
MsiDatabaseExportA
MsiDatabaseExportW
MsiDatabaseGenerateTransformA
MsiDatabaseGenerateTransformW
MsiDatabaseGetPrimaryKeysA
MsiDatabaseGetPrimaryKeysW
MsiDatabaseImportA
MsiDatabaseImportW
MsiDatabaseIsTablePersistentA
MsiDatabaseIsTablePersistentW
MsiDatabaseMergeA
MsiDatabaseMergeW
MsiDatabaseOpenViewA
MsiDatabaseOpenViewW
MsiDecomposeDescriptorA
MsiDecomposeDescriptorW
MsiDeleteUserDataA
MsiDeleteUserDataW
MsiDetermineApplicablePatchesA
MsiDetermineApplicablePatchesW
MsiDeterminePatchSequenceA
MsiDeterminePatchSequenceW
MsiDoActionA
MsiDoActionW
MsiEnableLogA
MsiEnableLogW
MsiEnableUIPreview
MsiEndTransaction
MsiEnumClientsA
MsiEnumClientsExA
MsiEnumClientsExW
MsiEnumClientsW
MsiEnumComponentCostsA
MsiEnumComponentCostsW
MsiEnumComponentQualifiersA
MsiEnumComponentQualifiersW
MsiEnumComponentsA
MsiEnumComponentsExA
MsiEnumComponentsExW
MsiEnumComponentsW
MsiEnumFeaturesA
MsiEnumFeaturesW
MsiEnumPatchesA
MsiEnumPatchesExA
MsiEnumPatchesExW
MsiEnumPatchesW
MsiEnumProductsA
MsiEnumProductsExA
MsiEnumProductsExW
MsiEnumProductsW
MsiEnumRelatedProductsA
MsiEnumRelatedProductsW
MsiEvaluateConditionA
MsiEvaluateConditionW
MsiExtractPatchXMLDataA
MsiExtractPatchXMLDataW
MsiFormatRecordA
MsiFormatRecordW
MsiGetActiveDatabase
MsiGetComponentPathA
MsiGetComponentPathExA
MsiGetComponentPathExW
MsiGetComponentPathW
MsiGetComponentStateA
MsiGetComponentStateW
MsiGetDatabaseState
MsiGetFeatureCostA
MsiGetFeatureCostW
MsiGetFeatureInfoA
MsiGetFeatureInfoW
MsiGetFeatureStateA
MsiGetFeatureStateW
MsiGetFeatureUsageA
MsiGetFeatureUsageW
MsiGetFeatureValidStatesA
MsiGetFeatureValidStatesW
MsiGetFileHashA
MsiGetFileHashW
MsiGetFileSignatureInformationA
MsiGetFileSignatureInformationW
MsiGetFileVersionA
MsiGetFileVersionW
MsiGetLanguage
MsiGetLastErrorRecord
MsiGetMode
MsiGetPatchFileListA
MsiGetPatchFileListW
MsiGetPatchInfoA
MsiGetPatchInfoExA
MsiGetPatchInfoExW
MsiGetPatchInfoW
MsiGetProductCodeA
MsiGetProductCodeFromPackageCodeA
MsiGetProductCodeFromPackageCodeW
MsiGetProductCodeW
MsiGetProductInfoA
MsiGetProductInfoExA
MsiGetProductInfoExW
MsiGetProductInfoFromScriptA
MsiGetProductInfoFromScriptW
MsiGetProductInfoW
MsiGetProductPropertyA
MsiGetProductPropertyW
MsiGetPropertyA
MsiGetPropertyW
MsiGetShortcutTargetA
MsiGetShortcutTargetW
MsiGetSourcePathA
MsiGetSourcePathW
MsiGetSummaryInformationA
MsiGetSummaryInformationW
MsiGetTargetPathA
MsiGetTargetPathW
MsiGetUserInfoA
MsiGetUserInfoW
MsiInstallMissingComponentA
MsiInstallMissingComponentW
MsiInstallMissingFileA
MsiInstallMissingFileW
MsiInstallProductA
MsiInstallProductW
MsiInvalidateFeatureCache
MsiIsProductElevatedA
MsiIsProductElevatedW
MsiJoinTransaction
MsiLoadStringA
MsiLoadStringW
MsiLocateComponentA
MsiLocateComponentW
MsiMessageBoxA
MsiMessageBoxExA
MsiMessageBoxExW
MsiMessageBoxW
MsiNotifySidChangeA
MsiNotifySidChangeW
MsiOpenDatabaseA
MsiOpenDatabaseW
MsiOpenPackageA
MsiOpenPackageExA
MsiOpenPackageExW
MsiOpenPackageW
MsiOpenProductA
MsiOpenProductW
MsiPreviewBillboardA
MsiPreviewBillboardW
MsiPreviewDialogA
MsiPreviewDialogW
MsiProcessAdvertiseScriptA
MsiProcessAdvertiseScriptW
MsiProcessMessage
MsiProvideAssemblyA
MsiProvideAssemblyW
MsiProvideComponentA
MsiProvideComponentFromDescriptorA
MsiProvideComponentFromDescriptorW
MsiProvideComponentW
MsiProvideQualifiedComponentA
MsiProvideQualifiedComponentExA
MsiProvideQualifiedComponentExW
MsiProvideQualifiedComponentW
MsiQueryComponentStateA
MsiQueryComponentStateW
MsiQueryFeatureStateA
MsiQueryFeatureStateExA
MsiQueryFeatureStateExW
MsiQueryFeatureStateFromDescriptorA
MsiQueryFeatureStateFromDescriptorW
MsiQueryFeatureStateW
MsiQueryProductStateA
MsiQueryProductStateW
MsiRecordClearData
MsiRecordDataSize
MsiRecordGetFieldCount
MsiRecordGetInteger
MsiRecordGetStringA
MsiRecordGetStringW
MsiRecordIsNull
MsiRecordReadStream
MsiRecordSetInteger
MsiRecordSetStreamA
MsiRecordSetStreamW
MsiRecordSetStringA
MsiRecordSetStringW
MsiReinstallFeatureA
MsiReinstallFeatureFromDescriptorA
MsiReinstallFeatureFromDescriptorW
MsiReinstallFeatureW
MsiReinstallProductA
MsiReinstallProductW
MsiRemovePatchesA
MsiRemovePatchesW
MsiSequenceA
MsiSequenceW
MsiSetComponentStateA
MsiSetComponentStateW
MsiSetExternalUIA
MsiSetExternalUIRecord
MsiSetExternalUIW
MsiSetFeatureAttributesA
MsiSetFeatureAttributesW
MsiSetFeatureStateA
MsiSetFeatureStateW
MsiSetInstallLevel
MsiSetInternalUI
MsiSetMode
MsiSetOfflineContextW
MsiSetPropertyA
MsiSetPropertyW
MsiSetTargetPathA
MsiSetTargetPathW
MsiSourceListAddMediaDiskA
MsiSourceListAddMediaDiskW
MsiSourceListAddSourceA
MsiSourceListAddSourceExA
MsiSourceListAddSourceExW
MsiSourceListAddSourceW
MsiSourceListClearAllA
MsiSourceListClearAllExA
MsiSourceListClearAllExW
MsiSourceListClearAllW
MsiSourceListClearMediaDiskA
MsiSourceListClearMediaDiskW
MsiSourceListClearSourceA
MsiSourceListClearSourceW
MsiSourceListEnumMediaDisksA
MsiSourceListEnumMediaDisksW
MsiSourceListEnumSourcesA
MsiSourceListEnumSourcesW
MsiSourceListForceResolutionA
MsiSourceListForceResolutionExA
MsiSourceListForceResolutionExW
MsiSourceListForceResolutionW
MsiSourceListGetInfoA
MsiSourceListGetInfoW
MsiSourceListSetInfoA
MsiSourceListSetInfoW
MsiSummaryInfoGetPropertyA
MsiSummaryInfoGetPropertyCount
MsiSummaryInfoGetPropertyW
MsiSummaryInfoPersist
MsiSummaryInfoSetPropertyA
MsiSummaryInfoSetPropertyW
MsiUseFeatureA
MsiUseFeatureExA
MsiUseFeatureExW
MsiUseFeatureW
MsiVerifyDiskSpace
MsiVerifyPackageA
MsiVerifyPackageW
MsiViewClose
MsiViewExecute
MsiViewFetch
MsiViewGetColumnInfo
MsiViewGetErrorA
MsiViewGetErrorW
MsiViewModify
QueryInstanceCount

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 658KB - Virtual size: 657KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
[SpotiGen] Spotify Account Generator By Tim Hortons/urlmon.dll
.dll regsvr32 windows:10 windows x64 arch:x64

b61aa4d90cb120f22a553ac804b77315

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

urlmon.pdb

Imports

msvcrt

toupper
wcstol
strstr
strncmp
wcsnlen
_wcslwr_s
towlower
__CxxFrameHandler3
strchr
_snwprintf_s
_scwprintf
_errno
strnlen
realloc
bsearch
_wtol
memmove_s
_i64tow_s
memset
_wtoi
_ui64tow_s
swprintf_s
_ultow_s
isalpha
wcsncmp
swscanf_s
_wcsicmp
_purecall
wcsrchr
_itow_s
rand_s
wcstok_s
_wfopen
wcstoul
strcmp
_onexit
wcschr
wcsstr
__dllonexit
_unlock
_lock
_snwscanf_s
wcscat_s
wcscpy_s
_vsnwprintf
memcmp
memmove
memcpy
__C_specific_handler
_initterm
malloc
fgets
_wcsnicmp
free
_amsg_exit
_XcptFilter
_vsnprintf
memcpy_s
fclose
wcscmp

iertutil

CreateUri
CreateUriFromMultiByteString
GetPropertyFromName
GetPropertyName
IntlPercentEncodeNormalize
IsDWORDProperty
CreateIUriBuilder
IsStringProperty
ord701
ord25
ord901
CreateUriPriv
CreateUriWithFragment
GetIUriPriv
ord791
GetIUriPriv2
GetPortFromUrlScheme
ord656
ord675
ord665
ord651
ord655
ord657
ord667
ord650
ord670
ord664
ord398
ord50
ord793
ord681
ord700
ord795
ord854
ord466
ord134
ord282
ord281
ord820
ord71
ord68
ord64
ord61
ord88
ord706
ord796
ord683
ord86
ord76
ord81
ord74
ord79
ord85
ord690
ord916
ord58
ord209
ord32
ord200
ord201
ord54
ord150
ord158
ord159
ord151
UriFromHostAndScheme
ord56
ord49
ord903
ord902
GetIDNSettingsForIE
PrivateCoInternetCanonicalizeIUri
PrivateCoInternetParseIUri
PrivateCoInternetCombineIUri
FastMimeLookupKnownType
FastMimeSetIsMimeFilterEnabled
ord70
ord63
ord20
FastMimeGetIsMimeFilterEnabled
CreateStringHashN
ord230
ord16
ord45
ord205
ord42
ord43
ord44
ord143
ord135
ord140
ord141
ord142
ord913
ord810
ord172
IUriBuilderInternalCreateDomain
ord166
ord855
ord35
ord870
ord682
ord89
ord57
ord702
ord17
ord325
ord173
ord62
ord72
ord594
ord597
ord654
ord652
ord658
ord672

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
OpenSemaphoreW
EnterCriticalSection
DeleteCriticalSection
CreateEventW
InitializeCriticalSection
WaitForSingleObjectEx
CreateSemaphoreExW
CreateMutexExW
ReleaseMutex
SetEvent
LeaveCriticalSection
WaitForSingleObject
ReleaseSRWLockShared
CreateMutexW
CreateMutexA
AcquireSRWLockExclusive
InitializeCriticalSectionEx
AcquireSRWLockShared
InitializeSRWLock
OpenMutexW
TryEnterCriticalSection
ReleaseSRWLockExclusive
CreateEventExW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsRelativeW
PathFindExtensionA
PathRemoveExtensionW
PathUnquoteSpacesW
PathIsUNCServerShareW
PathIsUNCW
PathIsPrefixA
PathRemoveFileSpecW
PathIsPrefixW
PathFileExistsW
PathIsUNCServerW
PathFindFileNameW
PathFindExtensionW
PathIsRootW
PathFileExistsA
PathGetDriveNumberW
PathStripToRootW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRChrW
StrChrW
StrCmpNIA
QISearch
StrCmpNIW
StrCmpNICA
StrCmpCA
StrStrIW
StrDupW
StrCmpCW
StrChrNW
StrToIntExW
StrToIntA
StrStrIA
StrChrIW
StrToIntW
StrDupA
StrCmpIW
StrCmpNA
StrCmpICW
StrStrA
StrCmpNW
StrChrA
StrCmpNICW
StrStrW
StrToInt64ExW
StrCmpICA
StrCmpNCW
StrCmpW
StrCmpNCA
StrTrimW

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
LoadLibraryExW
FindResourceExW
FindStringOrdinal
GetProcAddress
LoadLibraryExA
LoadResource
LockResource
GetModuleFileNameA
GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleA
FreeLibrary
SizeofResource
LoadStringA
GetModuleHandleW

api-ms-win-core-com-l1-1-0

CoSetProxyBlanket
CoFreeUnusedLibraries
CoCreateInstance
StringFromGUID2
CoUnmarshalInterface
CoTaskMemRealloc
CLSIDFromString
PropVariantClear
CoCreateGuid
FreePropVariantArray
CLSIDFromProgID
CoUninitialize
StringFromCLSID
CoTaskMemAlloc
CoMarshalInterface
CoGetMarshalSizeMax
CoSwitchCallContext
CoTaskMemFree
CoGetClassObject
CoCreateFreeThreadedMarshaler
CoGetTreatAsClass
CoWaitForMultipleHandles
CoInitializeEx

api-ms-win-eventing-provider-l1-1-0

EventWriteEx
EventProviderEnabled
EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-core-registry-l1-1-0

RegEnumValueA
RegGetValueA
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExW
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyA
RegGetValueW
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyExA
RegSetValueExA

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpA
lstrcmpW

api-ms-win-core-processthreads-l1-1-0

GetExitCodeThread
GetCurrentThread
GetCurrentProcessId
TerminateThread
ExitThread
OpenThreadToken
OpenProcessToken
GetCurrentThreadId
TlsFree
TlsAlloc
TerminateProcess
TlsSetValue
TlsGetValue
CreateProcessA
GetExitCodeProcess
GetCurrentProcess
CreateThread

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-stringansi-l1-1-0

CharUpperBuffA
CharLowerA
CharPrevA
CharNextA

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceComplete
InitOnceExecuteOnce
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExA
GetSystemTime
GetWindowsDirectoryA
GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryA
GetTickCount64
GetLocalTime

api-ms-win-core-localization-l1-2-0

GetUserGeoID
GetThreadLocale
GetLocaleInfoA
IdnToAscii
IsValidCodePage
IsDBCSLeadByte
FormatMessageW
GetACP
GetCPInfo
IdnToUnicode
FormatMessageA
GetSystemDefaultLCID
GetUserDefaultLCID

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-path-l1-1-0

PathCchCanonicalize
PathCchAddBackslash
PathCchRemoveFileSpec
PathCchRemoveBackslash

api-ms-win-shcore-stream-l1-1-0

SHOpenRegStream2W
SHCreateMemStream
IStream_Read
IStream_ReadStr
IStream_Write
IStream_WriteStr
SHCreateStreamOnFileW

api-ms-win-core-string-l2-1-0

CharPrevW
CharLowerBuffW
CharNextW
CharLowerW

api-ms-win-core-heap-l2-1-0

GlobalAlloc
GlobalFree
LocalFree
LocalAlloc

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-file-l1-1-0

ReadFile
SetFileAttributesA
CreateFileA
WriteFile
FileTimeToLocalFileTime
GetLongPathNameW
SetFilePointer
LocalFileTimeToFileTime
GetFileSize
GetFullPathNameW
CreateDirectoryW
GetDriveTypeA
RemoveDirectoryA
FindNextFileA
SetFileTime
DeleteFileA
GetTempFileNameW
CreateDirectoryA
GetDriveTypeW
GetFileAttributesA
QueryDosDeviceW
GetFileInformationByHandle
GetShortPathNameW
CompareFileTime
FindClose
FindFirstFileA
GetFullPathNameA
GetFileTime
GetLongPathNameA
FindFirstFileW
GetFileSizeEx
CreateFileW
GetFileAttributesW
GetFileAttributesExW
DeleteFileW

api-ms-win-core-file-l1-2-2

GetTempPathA

api-ms-win-core-kernel32-legacy-l1-1-0

GetShortPathNameA
CopyFileA
DosDateTimeToFileTime

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

api-ms-win-core-registryuserspecific-l1-1-0

SHRegQueryInfoUSKeyW
SHRegEnumUSValueW
SHRegWriteUSValueW
SHRegDeleteEmptyUSKeyW
SHRegGetUSValueW
SHRegGetBoolUSValueA
SHRegOpenUSKeyW
SHRegQueryUSValueW
SHRegEnumUSKeyW
SHRegGetUSValueA
SHRegCloseUSKey
SHRegDeleteUSValueW
SHRegCreateUSKeyW

api-ms-win-core-registry-l2-1-0

RegQueryValueW
RegQueryValueA

api-ms-win-core-atoms-l1-1-0

DeleteAtom
AddAtomA
FindAtomA
AddAtomW
FindAtomW

api-ms-win-core-url-l1-1-0

UrlGetLocationW
UrlEscapeW
UrlCompareW
PathCreateFromUrlA
UrlGetPartW
UrlCanonicalizeW
ParseURLW
UrlCreateFromPathW
UrlIsW
ParseURLA
UrlCombineW
UrlUnescapeW
PathCreateFromUrlW

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileStringW
GetPrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileSectionW
GetPrivateProfileIntW
WritePrivateProfileStringW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-shell-changenotify-l1-1-0

SHChangeNotify

api-ms-win-security-base-l1-1-0

CheckTokenMembership
CreateWellKnownSid
GetTokenInformation
DuplicateToken

api-ms-win-core-processenvironment-l1-2-0

SearchPathA

api-ms-win-http-time-l1-1-0

InternetTimeToSystemTimeA
InternetTimeFromSystemTimeW
InternetTimeFromSystemTimeA

api-ms-win-core-file-l1-2-0

GetTempPathW
CreateFile2

ntdll

RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
RtlMoveMemory
RtlGetSuiteMask

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CreateThreadpoolWork
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
SubmitThreadpoolWork

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-shlwapi-winrt-storage-l1-1-1

ord220

api-ms-win-shcore-registry-l1-1-0

SHSetValueA
SHRegGetValueW
SHDeleteKeyW

api-ms-win-core-processthreads-l1-1-2

QueryProtectedPolicy

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-shcore-comhelpers-l1-1-0

IUnknown_QueryService

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsA

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW
GetTimeFormatA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock
GlobalSize

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-shcore-unicodeansi-l1-1-0

SHAnsiToUnicode

api-ms-win-core-memory-l1-1-0

MapViewOfFile
OpenFileMappingW
VirtualProtect
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-security-lsapolicy-l1-1-0

LsaOpenPolicy
LsaFreeMemory
LsaQueryInformationPolicy
LsaClose

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-localization-obsolete-l1-2-0

CompareStringA

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-sidebyside-l1-1-0

CreateActCtxW
DeactivateActCtx
ReleaseActCtx
ActivateActCtx

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-isolatedcontainer-l1-1-0

IsProcessInIsolatedContainer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-io-l1-1-0

DeviceIoControl

Exports

Exports

AsyncGetClassBits
AsyncInstallDistributionUnit
BindAsyncMoniker
CAuthenticateHostUI_CreateInstance
CDLGetLongPathNameA
CDLGetLongPathNameW
CORPolicyProvider
CoGetClassObjectFromURL
CoInstall
CoInternetCanonicalizeIUri
CoInternetCombineIUri
CoInternetCombineUrl
CoInternetCombineUrlEx
CoInternetCompareUrl
CoInternetCreateSecurityManager
CoInternetCreateZoneManager
CoInternetFeatureSettingsChanged
CoInternetGetMobileBrowserAppCompatMode
CoInternetGetMobileBrowserForceDesktopMode
CoInternetGetProtocolFlags
CoInternetGetSecurityUrl
CoInternetGetSecurityUrlEx
CoInternetGetSession
CoInternetIsFeatureEnabled
CoInternetIsFeatureEnabledForIUri
CoInternetIsFeatureEnabledForUrl
CoInternetIsFeatureZoneElevationEnabled
CoInternetParseIUri
CoInternetParseUrl
CoInternetQueryInfo
CoInternetSetFeatureEnabled
CoInternetSetMobileBrowserAppCompatMode
CoInternetSetMobileBrowserForceDesktopMode
CompareSecurityIds
CompatFlagsFromClsid
CopyBindInfo
CopyStgMedium
CreateAsyncBindCtx
CreateAsyncBindCtxEx
CreateFormatEnumerator
CreateIUriBuilder
CreateURLMoniker
CreateURLMonikerEx
CreateURLMonikerEx2
CreateUri
CreateUriFromMultiByteString
CreateUriPriv
CreateUriWithFragment
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllRegisterServerEx
DllUnregisterServer
Extract
FaultInIEFeature
FileBearsMarkOfTheWeb
FindMediaType
FindMediaTypeClass
FindMimeFromData
GetAddSitesFileUrl
GetClassFileOrMime
GetClassURL
GetComponentIDFromCLSSPEC
GetIDNFlagsForUri
GetIUriPriv
GetIUriPriv2
GetLabelsFromNamedHost
GetMarkOfTheWeb
GetPortFromUrlScheme
GetPropertyFromName
GetPropertyName
GetSoftwareUpdateInfo
GetUrlmonThreadNotificationHwnd
GetZoneFromAlternateDataStreamEx
HlinkGoBack
HlinkGoForward
HlinkNavigateMoniker
HlinkNavigateString
HlinkSimpleNavigateToMoniker
HlinkSimpleNavigateToString
IECompatLogCSSFix
IEGetUserPrivateNamespaceName
IEInstallScope
IntlPercentEncodeNormalize
IsAsyncMoniker
IsDWORDProperty
IsIntranetAvailable
IsJITInProgress
IsLoggingEnabledA
IsLoggingEnabledW
IsStringProperty
IsValidURL
MkParseDisplayNameEx
ObtainUserAgentString
PrivateCoInstall
QueryAssociations
QueryClsidAssociation
RegisterBindStatusCallback
RegisterFormatEnumerator
RegisterMediaTypeClass
RegisterMediaTypes
RegisterWebPlatformPermanentSecurityManager
ReleaseBindInfo
RestrictHTTP2
RevokeBindStatusCallback
RevokeFormatEnumerator
SetAccessForIEAppContainer
SetSoftwareUpdateAdvertisementState
ShouldDisplayPunycodeForUri
ShouldShowIntranetWarningSecband
ShowTrustAlertDialog
URLDownloadA
URLDownloadToCacheFileA
URLDownloadToCacheFileW
URLDownloadToFileA
URLDownloadToFileW
URLDownloadW
URLOpenBlockingStreamA
URLOpenBlockingStreamW
URLOpenPullStreamA
URLOpenPullStreamW
URLOpenStreamA
URLOpenStreamW
UnregisterWebPlatformPermanentSecurityManager
UrlMkBuildVersion
UrlMkGetSessionOption
UrlMkSetSessionOption
UrlmonCleanupCurrentThread
WriteHitLogging
ZonesReInit

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.isoapis
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 324KB - Virtual size: 324KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1e8417f4591da7741a300229f9e8e8b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ws2_32

Sections

.text Size: 131KB - Virtual size: 131KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 3KB - Virtual size: 44KB

.pdata Size: 7KB - Virtual size: 7KB

.gfids Size: 512B - Virtual size: 172B

.rsrc Size: 75KB - Virtual size: 75KB

.reloc Size: 2KB - Virtual size: 1KB

be040105def20e0c8f67a8a06bf21b12

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

oleaut32

api-ms-win-core-com-l1-1-0

ws2_32

iphlpapi

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

rpcrt4

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

userenv

api-ms-win-core-string-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

winhttp

api-ms-win-core-sysinfo-l1-1-0

dnsapi

sspicli

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

bcrypt

api-ms-win-core-profile-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

ntdll

umpdc

api-ms-win-security-lsalookup-l1-1-0

httpprxp

kernel32

fwpuclnt

firewallapi

Exports

Exports

Sections

.text Size: 113KB - Virtual size: 113KB

.rdata Size: 34KB - Virtual size: 34KB

.data Size: 1KB - Virtual size: 6KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 10KB - Virtual size: 9KB

.text
Size: 131KB - Virtual size: 131KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 3KB - Virtual size: 44KB

.pdata
Size: 7KB - Virtual size: 7KB

.gfids
Size: 512B - Virtual size: 172B

.rsrc
Size: 75KB - Virtual size: 75KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 113KB - Virtual size: 113KB

.rdata
Size: 34KB - Virtual size: 34KB

.data
Size: 1KB - Virtual size: 6KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 10KB - Virtual size: 9KB

.reloc
Size: 1024B - Virtual size: 596B

.text
Size: 11.9MB - Virtual size: 11.9MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 182KB - Virtual size: 181KB

.rdata
Size: 50KB - Virtual size: 50KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: 160KB - Virtual size: 160KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: 3.6MB - Virtual size: 3.6MB

.rdata
Size: 658KB - Virtual size: 657KB

.data
Size: 12KB - Virtual size: 27KB

.pdata
Size: 50KB - Virtual size: 50KB

.rsrc
Size: 69KB - Virtual size: 68KB

.reloc
Size: 12KB - Virtual size: 12KB