Resident_Evil_5_[010018100CD46800][v131072] nsp[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Resident_Evil_5_[010018100CD46800][v131072] nsp.zip
Size

33.8MB
MD5

81ffe0777da7b794ab1ac74def976ac0
SHA1

2b6bc4d4693d0dc9914768be479188cda88e48aa
SHA256

5795df6ff0a52e17e810be4af7ea5fed165e12d7e8616984ba1bf1350a0d0d86
SHA512

759801eb1445a06dbbc8f8d28e5652597da16777808a58aab6025e71d68387f424ec7cf1a963763150bbf834c71059ed07270b4ebe6e98a5dba4260c4f591227
SSDEEP

786432:Py1I2g9yMU2emiTiS/wLYRDkBa0lYROElgg+sHxQlTrtmL1md:61Zn8emiTxROa0mRhlGFlTTd

Score

3^/10

Malware Config

Signatures

Unsigned PE 18 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1.jpg
unpack004/SettingMonitor/SessEnv.dll
unpack004/SettingMonitor/SettingMonitor.dll
unpack004/SettingMonitor/pnrpsvc.dll
unpack004/SettingMonitor/uudf.dll
unpack004/SettingSync/SettingSync.dll
unpack004/SettingSync/rasmontr.dll
unpack004/SettingSync/schannel.dll
unpack004/SettingSync/sppcommdlg.dll
unpack004/dab/dab.dll
unpack004/dab/diagperf.dll
unpack004/dab/fcon.dll
unpack004/provcore/networkhelper.dll
unpack004/provcore/provcore.dll
unpack004/vmrdvcore/mssph.dll
unpack004/vmrdvcore/perfctrs.dll
unpack004/vmrdvcore/tapisrv.dll
unpack004/vmrdvcore/vmrdvcore.dll

Files

Resident_Evil_5_[010018100CD46800][v131072] nsp.zip
.zip

Password: 3724
1.jpg
.exe windows:4 windows x86 arch:x86

Password: 3724

28bc134ea5d519f49501ac974b6a747e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

VariantCopy
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantClear

user32

CharUpperW

advapi32

OpenProcessToken
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
realloc
_ftol
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
_iob
free
malloc
memcmp
_purecall
memcpy
_CxxThrowException
__CxxFrameHandler
_isatty
_fileno

kernel32

SetThreadAffinityMask
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
WaitForSingleObject
RemoveDirectoryW
InterlockedIncrement
GetVersion
VirtualFree
VirtualAlloc
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
GetSystemTimeAsFileTime
FileTimeToDosDateTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetModuleHandleW
GetCurrentProcess
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
SetEndOfFile
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
WriteFile
MoveFileW
CreateHardLinkW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
GetStdHandle
FindClose
FindFirstFileW
FindNextFileW
GetProcAddress
GetModuleHandleA
GetFileAttributesW
GetLogicalDriveStringsW
GetFileSize
SetFilePointer
DeviceIoControl
ReadFile
ResumeThread

Sections

.text
Size: 481KB - Virtual size: 481KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Readme.jpg
.jpg

Password: 3724
image.7z
.7z

Password: 3724
SettingMonitor/SessEnv.dll
.dll windows:10 windows x64 arch:x64

Password: 3724

c252150e2ab272715077e6f59b74980d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

SessEnv.pdb

Imports

msvcrt

memset
_CxxThrowException
?what@exception@@UEBAPEBDXZ
strcmp
_onexit
memcpy
memmove
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
wcscat_s
??1exception@@UEAA@XZ
wcschr
??_V@YAXPEAX@Z
memmove_s
_wtol
??0exception@@QEAA@AEBV0@@Z
_wcsicmp
swprintf_s
memcpy_s
_vsnprintf
_vsnwprintf
memcmp
toupper
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
__dllonexit
_unlock
_wcsnicmp
wcsrchr
wcsncmp
iswalpha
_lock
__CxxFrameHandler3
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
??3@YAXPEAX@Z
wcscpy_s
wcscmp

ntdll

NtQueryInformationProcess
NtDuplicateToken
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
RtlCaptureContext
WinSqmSetDWORD
WinSqmStartSession
WinSqmAddToStream
WinSqmEndSession
WinSqmIsOptedIn
RtlGetActiveConsoleId
EtwEventWriteFull
EtwEventRegister
EtwEventUnregister
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlInsertElementGenericTable
RtlLookupElementGenericTable
RtlQueryEnvironmentVariable_U
RtlInitUnicodeStringEx
RtlInitializeGenericTable
RtlDeleteElementGenericTable
RtlEnumerateGenericTable
RtlAllocateAndInitializeSid
RtlAcquireResourceExclusive
RtlReleaseResource
RtlAcquireResourceShared
DbgPrint
RtlEqualSid
VerSetConditionMask
RtlFreeSid
RtlLookupFunctionEntry
RtlInitializeResource
RtlVerifyVersionInfo
RtlCaptureStackBackTrace
RtlDeleteResource
NtQuerySystemInformation
RtlVirtualUnwind
RtlLengthSid

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadStringW
GetModuleHandleExW
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetModuleFileNameA

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSection
ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSemaphore
EnterCriticalSection
CreateEventW
SetEvent
CreateSemaphoreExW
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
WaitForSingleObject
OpenSemaphoreW
CreateMutexExW
WaitForMultipleObjectsEx
WaitForSingleObjectEx
ResetEvent
ReleaseMutex

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCloseKey
RegSetValueExW
RegEnumKeyExW
RegNotifyChangeKeyValue
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegUnLoadKeyW
RegCreateKeyExW
RegLoadKeyW
RegDeleteTreeW
RegQueryValueExW
RegOpenKeyExW
RegOpenCurrentUser

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventActivityIdControl
EventSetInformation
EventUnregister
EventProviderEnabled

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-processthreads-l1-1-0

CreateProcessAsUserW
GetThreadId
TerminateThread
ProcessIdToSessionId
GetCurrentThreadId
CreateThread
GetCurrentThread
OpenProcessToken
OpenThreadToken
GetCurrentProcess
TerminateProcess
CreateProcessW
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount
GetComputerNameExW
GetVersionExW
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer
UnregisterWaitEx
DeleteTimerQueueTimer

sysntfy

SysNotifyStartServer
SysNotifyStopServer

dismapi

DismDisableFeature
DismOpenSession
DismEnableFeature
DismShutdown
DismInitialize

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
EnableTraceEx2
StartTraceW

api-ms-win-core-com-l1-1-0

CoUninitialize
CoCreateInstanceEx
CoTaskMemAlloc
StringFromCLSID
CoCreateInstance
CoCreateGuid
CoInitializeEx
CoWaitForMultipleHandles
CoSetProxyBlanket
CoTaskMemFree

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA

api-ms-win-security-base-l1-1-0

GetFileSecurityW
CopySid
GetAce
EqualSid
CheckTokenMembership
GetAclInformation
FreeSid
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
DuplicateToken
GetSecurityDescriptorLength
SetSecurityDescriptorControl
InitializeSecurityDescriptor
IsValidSid
DeleteAce
GetSecurityDescriptorControl
CreateWellKnownSid
AllocateAndInitializeSid
GetLengthSid
RevertToSelf
GetTokenInformation
ImpersonateLoggedOnUser
SetTokenInformation
SetFileSecurityW
AdjustTokenPrivileges
DuplicateTokenEx
MakeAbsoluteSD

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

api-ms-win-core-localization-l1-2-0

FormatMessageW

rpcrt4

RpcBindingCopy
RpcBindingUnbind
Ndr64AsyncClientCall
UuidCreate
I_RpcBindingInqLocalClientPID
I_RpcExceptionFilter
UuidToStringW
RpcStringFreeW
NdrServerCall2
NdrServerCallAll
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcAsyncCompleteCall
RpcBindingBind
RpcBindingCreateW
UuidFromStringW
RpcAsyncInitializeHandle
RpcBindingVectorFree
RpcEpRegisterW
RpcServerInqBindings
RpcServerUseProtseqExW
RpcBindingFree
RpcBindingInqAuthClientW
RpcBindingServerFromClient
RpcServerUnregisterIfEx
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcServerInqCallAttributesW
RpcGetAuthorizationContextForClient
RpcFreeAuthorizationContext
RpcImpersonateClient
RpcRevertToSelf

api-ms-win-core-file-l1-1-0

GetFileAttributesW
GetFileSizeEx
ReadFile
SetFileAttributesW
DeleteVolumeMountPointW
CreateFileW
FindNextVolumeW
GetFileTime
WriteFile
FindClose
FindFirstVolumeW
RemoveDirectoryW
DeleteFileW
FindFirstFileW
FindNextFileW
FileTimeToLocalFileTime
SetFilePointer
CompareFileTime
CreateDirectoryW
FindVolumeClose

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l2-1-0

MoveFileWithProgressW
GetFileInformationByHandleEx
CopyFileExW
CreateSymbolicLinkW

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy
OpenProcess

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

samcli

NetLocalGroupDelMembers
NetLocalGroupAddMembers
NetUserGetInfo

api-ms-win-core-file-l1-2-0

GetTempPathW
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-security-credentials-l1-1-0

CredUnprotectW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrToIntExW

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId
MoveFileW
GetComputerNameW

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW
SetVolumeMountPointW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegEnumKeyW

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

scecli

SceSetupSystemByInfName

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-security-lsapolicy-l1-1-0

LsaFreeMemory

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
ReportEventW
RegisterEventSourceW

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 362KB - Virtual size: 361KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SettingMonitor/SettingMonitor.dll
.dll windows:10 windows x64 arch:x64

Password: 3724

4d80d07630c7e6d5d9d8f47c9eb385d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

SettingMonitor.pdb

Imports

msvcrt

memcpy
_CxxThrowException
memcmp
__CxxFrameHandler3
__dllonexit
_unlock
_onexit
_initterm
malloc
_amsg_exit
_XcptFilter
free
memmove_s
__C_specific_handler
iswalnum
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
_callnewh
??1type_info@@UEAA@XZ
_lock
_vsnwprintf
_purecall
memcpy_s
memmove
memset

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask

api-ms-win-shcore-sysinfo-l1-1-0

IsOS

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-shcore-registry-l1-1-0

SHGetValueW
SHDeleteValueW
SHSetValueW

policymanager

PolicyManager_GetPolicyInt

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
DisableThreadLibraryCalls
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
LeaveCriticalSection
ReleaseSemaphore
WaitForSingleObject
InitializeCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
ReleaseMutex
CreateEventW
ReleaseSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
OpenEventW
CreateMutexExW
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
OpenThreadToken
GetCurrentThread
OpenProcessToken
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
PropVariantClear
CoEnableCallCancellation
CoTaskMemFree
CoDisableCallCancellation
CoGetMalloc
CoCancelCall
CoInitializeEx
IIDFromString
CLSIDFromString
CoRevokeClassObject
CoRegisterClassObject
CoUninitialize

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteTransfer

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegCreateKeyExW
RegGetValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegSetValueExW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
RegisterTraceGuidsW
TraceMessage
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep

api-ms-win-core-file-l1-1-0

CompareFileTime

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWork
CreateThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolTimer
CloseThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWaitCallbacks

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetOsSafeBootMode

api-ms-win-core-sidebyside-l1-1-0

CreateActCtxW
FindActCtxSectionStringW
ActivateActCtx
DeactivateActCtx
QueryActCtxW

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

ntdll

NtQueryInformationToken
NtPowerInformation

user32

DefWindowProcW
UnregisterPowerSettingNotification
DestroyWindow
SetWindowLongPtrW
SetCoalescableTimer
KillTimer
RegisterPowerSettingNotification
GetWindowLongPtrW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SettingMonitor/pnrpsvc.dll
.dll windows:10 windows x64 arch:x64

Password: 3724

37f774d87f855a0f404a69308f3151da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

pnrpsvc.pdb

Imports

msvcrt

_lock
wcsncmp
swscanf_s
_wcsnicmp
_unlock
wcschr
_onexit
strcmp
_purecall
memmove
_initterm
memcmp
iswdigit
__dllonexit
_stricmp
free
_vsnwprintf
iswalpha
towlower
printf
_wcsicmp
qsort_s
?terminate@@YAXXZ
memset
_vsnprintf
__C_specific_handler
wcscat_s
memcpy
malloc
_amsg_exit
_XcptFilter
__CxxFrameHandler3
wcscmp

ntdll

RtlIpv4AddressToStringExW
RtlFreeUnicodeString
EtwTraceMessage
RtlStringFromGUID
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwUnregisterTraceGuids
EtwGetTraceEnableFlags
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwRegisterTraceGuidsW
RtlIpv6AddressToStringExW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
GetProcAddress
LoadLibraryExW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
OpenThreadToken
SetThreadToken
OpenProcessToken
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

kernel32

DuplicateHandle
SwitchToThread
GetFileAttributesW
CreateDirectoryW
DebugBreak
DeleteTimerQueueTimer
CreateTimerQueueTimer
DeviceIoControl
CreateThread
WaitForMultipleObjectsEx
SystemTimeToFileTime
FileTimeToSystemTime
ExitProcess
GetVersionExW
LocalFree
GetCurrentThread
SetLastError
CopyFileExW
DeleteFileW
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
ResetEvent
UnregisterWaitEx
SetEvent
RegisterWaitForSingleObjectEx
CreateEventW
CompareStringA
CompareFileTime
WriteFile
CloseHandle
ReadFile
GetFileSize
CreateFileW
GetLastError
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapFree
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue
RegSetValueExW
RegEnumValueW
RegDeleteKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExW

rpcrt4

RpcServerUseProtseqW
I_RpcBindingInqTransportType
UuidCreate
NdrServerCallAll
NdrServerCall2
RpcBindingVectorFree
RpcServerRegisterAuthInfoW
RpcBindingInqAuthClientW
RpcStringFreeW
RpcStringBindingParseW
I_RpcExceptionFilter
RpcImpersonateClient
RpcServerRegisterIfEx
RpcBindingToStringBindingW
RpcEpRegisterW
RpcServerUnregisterIfEx
RpcStringBindingComposeW
RpcSsContextLockExclusive
NdrClientCall3
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcErrorStartEnumeration
RpcRevertToSelf
RpcErrorGetNextRecord
RpcRaiseException
RpcErrorEndEnumeration
RpcServerInqBindings
UuidToStringW

api-ms-win-security-base-l1-1-0

CopySid
GetTokenInformation
EqualSid
GetWindowsAccountDomainSid
CheckTokenMembership
CreateWellKnownSid
RevertToSelf

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-heap-l2-1-0

LocalAlloc

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-security-grouppolicy-l1-1-0

UnregisterGPNotificationInternal
RegisterGPNotificationInternal

api-ms-win-service-management-l1-1-0

OpenServiceW
StartServiceW
CloseServiceHandle
OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

Exports

Exports

IMServiceMain
SVCServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 285KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SettingMonitor/uudf.dll
.dll windows:10 windows x64 arch:x64

Password: 3724

b38628cfe74c2369b1284d127e70c2cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

uudf.pdb

Imports

msvcrt

memset
memcmp
memcpy
memmove
_initterm
malloc
free
_amsg_exit
_XcptFilter
_vsnprintf
_vsnwprintf
__C_specific_handler

ntdll

RtlFreeHeap
RtlNumberGenericTableElementsAvl
NtQuerySystemTime
RtlSystemTimeToLocalTime
RtlTimeToTimeFields
DbgPrint
RtlRaiseStatus
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlAllocateHeap

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableFlags
TraceMessage
UnregisterTraceGuids

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
SetErrorMode
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetTickCount

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ulib

??1MESSAGE@@UEAA@XZ
??0MESSAGE@@QEAA@XZ
?DisplayMsg@MESSAGE@@QEAAEKW4MESSAGE_TYPE@@K@Z
?MakeFileToken@MESSAGE@@SA_KPEBD@Z
?DisplayMsg@MESSAGE@@QEAAEKW4MESSAGE_TYPE@@KPEBDZZ
?Initialize@WSTRING@@QEAAEPEBV1@KK@Z
?Stricmp@WSTRING@@QEBAJPEBV1@@Z
?Initialize@WSTRING@@QEAAEPEBGK@Z
?QueryString@WSTRING@@QEBAPEAV1@KK@Z
?Display@MESSAGE@@QEAAEPEBDZZ
?DisplayMsg@MESSAGE@@QEAAEK@Z
?Initialize@HMEM@@QEAAEXZ
??1HMEM@@UEAA@XZ
??0HMEM@@QEAA@XZ
??0LIST@@QEAA@XZ
?Initialize@FSTRING@@QEAAPEAVWSTRING@@PEAGK@Z
??0FSTRING@@QEAA@XZ
??1DSTRING@@UEAA@XZ
??0DSTRING@@QEAA@XZ
?DisplayMsg@MESSAGE@@QEAAEKPEBDZZ
?DebugDump@OBJECT@@UEBAXE@Z
?Compare@OBJECT@@UEBAJPEBV1@@Z
UlibRealloc
??1OBJECT@@UEAA@XZ
??0OBJECT@@IEAA@XZ
??1ITERATOR@@UEAA@XZ
??1LIST@@UEAA@XZ
?Initialize@LIST@@QEAAEXZ
?QueryIterator@LIST@@UEBAPEAVITERATOR@@XZ
?DeleteAllMembers@SEQUENTIAL_CONTAINER@@UEAAEXZ
??0MEM_ALLOCATOR@@QEAA@XZ
??1MEM_ALLOCATOR@@UEAA@XZ
?Initialize@MEM_ALLOCATOR@@QEAAE_KK@Z
?Allocate@MEM_ALLOCATOR@@QEAAPEAXK@Z
??0ITERATOR@@IEAA@XZ
?FindNext@ITERATOR@@UEAAPEAVOBJECT@@PEBV2@@Z
??1FSTRING@@UEAA@XZ

ifsutil

?Initialize@SUPERAREA@@IEAAEPEAVMEM@@PEAVLOG_IO_DP_DRIVE@@KPEAVMESSAGE@@@Z
?Recover@VOL_LIODPDRV@@QEAAEPEBVWSTRING@@PEAVMESSAGE@@@Z
?DismountVolume@IFS_SYSTEM@@SAEPEBVWSTRING@@@Z
?QueryUdfMediaNeedsVat@DP_DRIVE@@QEAAEXZ
?QueryUdfMediaNeedsSparing@DP_DRIVE@@QEAAEXZ
?Format@VOL_LIODPDRV@@QEAA?AW4FORMAT_ERROR_CODE@@PEBVWSTRING@@PEAVMESSAGE@@KKK@Z
?QueryUdfMediaNeedsLowLevelFormat@DP_DRIVE@@QEAAEXZ
?Initialize@DP_DRIVE@@QEAAEPEBVWSTRING@@PEAVMESSAGE@@EE@Z
??0DP_DRIVE@@QEAA@XZ
?QueryUdfMediaType@DP_DRIVE@@QEAAKXZ
?QueryRewritableMOSupport@DP_DRIVE@@QEAAEXZ
?DismountAndLock@IO_DP_DRIVE@@QEAAEXZ
?DosDriveNameToNtDriveName@IFS_SYSTEM@@SAEPEBVWSTRING@@PEAV2@@Z
?ChkDsk@VOL_LIODPDRV@@QEAAEW4FIX_LEVEL@@PEAVMESSAGE@@KKGPEAKPEBVWSTRING@@@Z
?Lock@IO_DP_DRIVE@@QEAAEXZ
?PowForceAllocation@IO_DP_DRIVE@@QEAAEKKPEAKW4NwaType@DP_DRIVE@@@Z
?EliminateCycles@DIGRAPH@@QEAAEPEAVCONTAINER@@PEAE@Z
?RemoveEdge@DIGRAPH@@QEAAEKK@Z
?QueryParents@DIGRAPH@@QEBAEKPEAVNUMBER_SET@@@Z
?Remove@NUMBER_SET@@QEAAEPEBV1@@Z
?QueryParentsWithChildren@DIGRAPH@@QEBAEPEAVNUMBER_SET@@K@Z
?QueryNumParents@DIGRAPH@@QEBAKK@Z
?QueryNumber@NUMBER_SET@@QEBA?AVBIG_INT@@V2@@Z
?QueryChildren@DIGRAPH@@QEBAEKPEAVNUMBER_SET@@@Z
?SetFileSystemName@VOL_LIODPDRV@@QEAAEPEBG@Z
?Write@SECRUN@@UEAAEXZ
?Initialize@SECRUN@@QEAAEPEAVMEM@@PEAVIO_DP_DRIVE@@VBIG_INT@@K@Z
??1SECRUN@@UEAA@XZ
??0SECRUN@@QEAA@XZ
?Read@IO_DP_DRIVE@@QEAAEVBIG_INT@@KPEAX@Z
??1NUMBER_SET@@UEAA@XZ
?Add@NUMBER_SET@@QEAAEVBIG_INT@@@Z
?CheckAndRemove@NUMBER_SET@@QEAAEVBIG_INT@@PEAE@Z
?QueryEccBlockSizeInSectors@DP_DRIVE@@QEAAGXZ
?AddEdge@DIGRAPH@@QEAAEKK@Z
?QueryDisjointRange@NUMBER_SET@@QEBAXKPEAVBIG_INT@@0@Z
?Initialize@NUMBER_SET@@QEAAEXZ
??0NUMBER_SET@@QEAA@XZ
?Add@NUMBER_SET@@QEAAEVBIG_INT@@0@Z
?Remove@NUMBER_SET@@QEAAEVBIG_INT@@0@Z
?DoesIntersectSet@NUMBER_SET@@QEBAEVBIG_INT@@0@Z
?QueryUdfMediaHasPow@DP_DRIVE@@QEAAEXZ
?QueryUdfMediaSupportsBackgroundFormat@DP_DRIVE@@QEAAEXZ
?QueryDiscStatus@DP_DRIVE@@QEAAEPEAK0@Z
?ReinitiateBackgroundFormat@DP_DRIVE@@QEAAEXZ
?QueryUdfMediaSupportsQuickGrow@DP_DRIVE@@QEAAEXZ
?ReadFormattableCapacity@DP_DRIVE@@QEAAEEPEAKPEAE0@Z
?QueryVolumeBounds@DP_DRIVE@@QEAAEPEAK0@Z
?QueryNextWritableAddress@DP_DRIVE@@QEAAEPEAKW4NwaType@1@@Z
?QueryFreeBlocksInLastTrack@DP_DRIVE@@QEAAEPEAK@Z
?SendPowLowLevelFormat@DP_DRIVE@@QEAAEPEAVMESSAGE@@@Z
?WriteEntireDrive@VOL_LIODPDRV@@UEAA?AW4FORMAT_ERROR_CODE@@PEAVMESSAGE@@PEAXKII@Z
?QueryPartitionInfo@DP_DRIVE@@UEAAEPEAU_PARTITION_INFORMATION_EX@@@Z
?QueryTierCount@DP_DRIVE@@UEAAJPEAK@Z
?QueryReadCacheSize@DP_DRIVE@@UEAAJPEA_K@Z
?QueryDataRedundancyCount@DP_DRIVE@@UEAAJPEAK0@Z
?QuerySectors@DP_DRIVE@@UEBA?AVBIG_INT@@XZ
?QueryWriteBlockSize@DP_DRIVE@@UEBAKXZ
?QuerySectorSize@DP_DRIVE@@UEBAKXZ
?Initialize@VOL_LIODPDRV@@IEAA?AW4FORMAT_ERROR_CODE@@PEBVWSTRING@@PEAVSUPERAREA@@PEAVMESSAGE@@EEW4_MEDIA_TYPE@@GEIE@Z
??1VOL_LIODPDRV@@UEAA@XZ
??0VOL_LIODPDRV@@IEAA@XZ
?VerifyRead@SECRUN@@UEAAEPEAE@Z
?Read@SECRUN@@UEAAEXZ
?IsUdfMediaWritable@DP_DRIVE@@QEAAEXZ
?Write@IO_DP_DRIVE@@QEAAEVBIG_INT@@KPEAX@Z
?WaitForUnit@DP_DRIVE@@QEAAEPEAVMESSAGE@@@Z
??1SUPERAREA@@UEAA@XZ
??0SUPERAREA@@IEAA@XZ
?Initialize@DIGRAPH@@QEAAEK@Z
??1DIGRAPH@@UEAA@XZ
??0DIGRAPH@@QEAA@XZ
?FormatScaleTotalFreeClusters@IFS_SYSTEM@@SAE_K0PEAK1PEA_K2@Z
?WaitForWriteCompletion@DP_DRIVE@@QEAAEPEAVMESSAGE@@@Z
?FlushCache@IO_DP_DRIVE@@QEAAEXZ
?Initialize@READ_WRITE_CACHE@@QEAAEPEAVIO_DP_DRIVE@@KE@Z
??0READ_WRITE_CACHE@@QEAA@XZ
?Initialize@READ_MODIFY_WRITE_CACHE@@QEAAEPEAVIO_DP_DRIVE@@KKEE@Z
??0READ_MODIFY_WRITE_CACHE@@QEAA@XZ
?Initialize@POW_CACHE@@QEAAEKKKKK@Z
?Initialize@POW_CACHE@@QEAAEPEAVIO_DP_DRIVE@@@Z
??0POW_CACHE@@QEAA@XZ
?SetCache@IO_DP_DRIVE@@QEAAXPEAVDRIVE_CACHE@@@Z
?Initialize@WRITE_ONCE_CACHE@@QEAAEPEAVIO_DP_DRIVE@@KKK@Z
??0WRITE_ONCE_CACHE@@QEAA@XZ
?SetSectors@DP_DRIVE@@QEAAXVBIG_INT@@@Z
?QueryHighestTrackAddress@DP_DRIVE@@QEAAEPEAK@Z
?QueryLastWritableAddress@DP_DRIVE@@QEAAEPEAKW4NwaType@1@@Z
?SetPowTrackConfiguration@DP_DRIVE@@QEAAEE@Z

Exports

Exports

??0METADATA_PARTITION@@QEAA@XZ
??0UDF_LVOL@@QEAA@XZ
??0UDF_SA@@QEAA@XZ
??0UDF_VOL@@QEAA@XZ
??1METADATA_PARTITION@@UEAA@XZ
??1UDF_LVOL@@UEAA@XZ
??1UDF_SA@@UEAA@XZ
??1UDF_VOL@@UEAA@XZ
?CreateOnDisk@UDF_LVOL@@QEAAEPEAVUDF_SA@@PEAVMESSAGE@@PEAVVDS@@PEAUEXTENTAD@@K3@Z
?Initialize@UDF_SA@@QEAAEPEAVLOG_IO_DP_DRIVE@@PEAVMESSAGE@@G@Z
?Initialize@UDF_VOL@@QEAA?AW4FORMAT_ERROR_CODE@@PEBVWSTRING@@PEAVMESSAGE@@EGEEE@Z
?ReadFromDisk@UDF_LVOL@@QEAAEPEAVUDF_SA@@PEAVMESSAGE@@PEAVVDS@@@Z
Chkdsk
ChkdskEx
Format
FormatEx
GetFilesystemInformation
Recover

Sections

.text
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SettingSync/SettingSync.dll
.dll windows:10 windows x64 arch:x64

Password: 3724

7b47ecf8ca02907cd93bfb196ed60609

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

SettingSync.pdb

Imports

msvcrt

??0exception@@QEAA@AEBQEBDH@Z
_amsg_exit
_initterm
_XcptFilter
__dllonexit
_onexit
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
memset
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBD@Z
memcmp
??8type_info@@QEBAHAEBV0@@Z
_callnewh
_CxxThrowException
memcpy
_unlock
_lock
wcsncmp
wcsstr
_get_errno
_set_errno
wcschr
__C_specific_handler
sprintf
_vsnprintf
memmove_s
realloc
malloc
free
_purecall
_vsnprintf_s
__CxxFrameHandler3
??0exception@@QEAA@AEBV0@@Z
iswalnum
swscanf_s
wcstok
wcstoul
wcscpy_s
_wcsicmp
swscanf
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
memmove
sqrt

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask

api-ms-win-shcore-sysinfo-l1-1-0

IsOS

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

WaitForMultipleObjectsEx
InitializeCriticalSection
CreateMutexExW
LeaveCriticalSection
OpenSemaphoreW
InitializeCriticalSectionEx
WaitForSingleObject
OpenEventW
InitializeSRWLock
SetEvent
DeleteCriticalSection
CreateEventExW
ReleaseSemaphore
WaitForSingleObjectEx
ReleaseMutex
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateSemaphoreExW
AcquireSRWLockShared
ReleaseSRWLockShared
EnterCriticalSection

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
RaiseException
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
OpenThreadToken
GetCurrentThread
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
CreateProcessW

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW
GetUserDefaultLocaleName
SetLocaleInfoW
GetLocaleInfoEx
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegGetValueW
RegQueryInfoKeyW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegOpenCurrentUser

api-ms-win-core-file-l1-1-0

CompareFileTime
GetFileAttributesExW
DeleteFileW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventUnregister
EventActivityIdControl
EventWriteTransfer

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceExecuteOnce
Sleep

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTimeAsFileTime
GetVersionExW
GetTickCount

api-ms-win-core-path-l1-1-0

PathCchCombine
PathCchAppend

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
StopTraceW
StartTraceW

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-sidebyside-l1-1-0

ActivateActCtx
FindActCtxSectionStringW
QueryActCtxW
DeactivateActCtx
CreateActCtxW

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-shlwapi-legacy-l1-1-0

SHExpandEnvironmentStringsW
PathFileExistsW
PathFindNextComponentW
PathRelativePathToW

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch
StrCmpICW

api-ms-win-shlwapi-winrt-storage-l1-1-1

IUnknown_GetWindow
ord635
ord187

api-ms-win-rtcore-ntuser-window-l1-1-0

FindWindowW
PostMessageW
PeekMessageW
PostQuitMessage
TranslateMessage
DispatchMessageW
FindWindowExW
SendNotifyMessageW
GetClassNameW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics
SystemParametersInfoW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

coremessaging

CoreUICreate

ntdll

RtlGetSuiteMask
NtQueryInformationToken
NtQueryInformationProcess
RtlGetDeviceFamilyInfoEnum

coreuicomponents

CoreUIFactoryCreate

slc

SLIsWindowsGenuineLocal

wevtapi

EvtOpenChannelConfig
EvtSetChannelConfigProperty
EvtSaveChannelConfig
EvtClose

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-localization-private-l1-1-0

LoadStringByReference

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 461KB - Virtual size: 461KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SettingSync/rasmontr.dll
.dll windows:10 windows x64 arch:x64

18970be6d7b652fcb1413c038f894c24

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

rasmontr.pdb

Imports

msvcrt

_wcsicmp
_CxxThrowException
memcmp
memcpy
memset
_onexit
__dllonexit
_unlock
_lock
_initterm
_amsg_exit
_XcptFilter
wcstoul
wcstol
wcstok
wcspbrk
_itow
wcstombs
_wtoi
strchr
_wctime
time
free
malloc
atoi
wcsrchr
_vsnwprintf
strncmp
__C_specific_handler
__CxxFrameHandler3
wcsncat_s
wcscpy_s
_strcmpi
_callnewh
??1type_info@@UEAA@XZ
wcscmp

ntdll

EtwTraceMessage
RtlInitUnicodeString
NtQuerySystemInformation
VerSetConditionMask
RtlIpv4AddressToStringW
RtlNtStatusToDosError
RtlSecondsSince1970ToTime
RtlGUIDFromString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv6AddressToStringW
RtlIpv6StringToAddressW

advapi32

ReadEventLogW
TraceMessage
RegEnumKeyExW
RegQueryInfoKeyW
RegConnectRegistryW
LsaStorePrivateData
RegDeleteKeyExW
RegEnumKeyW
RegEnumValueW
EnableTraceEx2
ControlTraceW
EnableTrace
StartTraceW
RegCreateKeyExW
RegQueryValueExW
LsaClose
LsaFreeMemory
LsaSetInformationPolicy
LsaQueryInformationPolicy
LsaOpenPolicy
CloseEventLog
ClearEventLogW
OpenEventLogW
RegSetValueExW
EnumServicesStatusExW
OpenProcessToken
OpenThreadToken
RegCloseKey
RegOpenKeyExW

mprapi

MprAdminUserSetInfo
MprConfigServerSetInfoEx
MprAdminServerGetInfoEx
MprAdminServerSetInfoEx
MprAdminConnectionGetInfo
MprAdminBufferFree
MprAdminServerConnect
MprAdminConnectionEnum
MprAdminServerDisconnect
MprAdminInterfaceDisconnect
MprAdminConnectionClearStats
MprDomainQueryRasServer
MprDomainRegisterRasServer
MprAdminServerSetCredentials
MprAdminServerGetCredentials
MprAdminServerGetInfo
MprAdminPortGetInfo
MprAdminPortClearStats
MprAdminPortEnum
MprConfigServerConnect
MprConfigInterfaceGetInfo
MprConfigInterfaceTransportGetHandle
MprConfigInterfaceGetHandle
MprConfigServerGetInfoEx
MprConfigServerDisconnect
MprConfigBufferFree
MprAdminUserServerConnect
MprAdminUserServerDisconnect
MprAdminUserGetInfo
MprAdminUserOpen
MprAdminUserRead
MprAdminUserWrite
MprAdminUserClose

netsh.exe

PrintMessageFromModule
RegisterHelper
PrintMessage
MakeQuotedString
RegisterContext
MakeString
PrintError
MatchToken
MatchEnumTag
FreeString

rasapi32

RasEnumDevicesW

user32

LoadStringW
GetWindowThreadProcessId
GetWindow
GetWindowLongW
GetWindowTextW
FindWindowExW
OpenDesktopW
GetThreadDesktop
SetThreadDesktop
EnumWindows
CloseDesktop
OpenWindowStationW
GetProcessWindowStation
SetProcessWindowStation
EnumDesktopsW
CloseWindowStation
EnumWindowStationsW

fwpuclnt

IkeextSetConfigParameters0
IkeextGetConfigParameters0

ws2_32

WSAIoctl
htonl
ntohl
FreeAddrInfoW
WSAAddressToStringW
GetAddrInfoW
WSACleanup
closesocket
WSACloseEvent
GetNameInfoW
WSAResetEvent
WSAWaitForMultipleEvents
WSAEventSelect
WSACreateEvent
inet_addr
bind
htons
WSAGetLastError
WSASocketW
WSAStartup
setsockopt

rasman

RasGetDeviceConfigInfo
RasGetCalledIdInfo
RasRpcDisconnectServer
RasSetCalledIdInfo
RasSetDeviceConfigInfo
RasRpcConnectServer

kernel32

CreateProcessW
GetFullPathNameW
GetModuleHandleExW
GetModuleFileNameW
GetProcessMitigationPolicy
WideCharToMultiByte
WaitForSingleObject
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetComputerNameExW
RegOpenKeyExA
RegQueryValueExA
RegGetValueW
RegDeleteValueW
VirtualProtect
LoadLibraryExA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
RaiseException
VirtualQuery
SetEvent
CreateEventW
SetConsoleCtrlHandler
HeapAlloc
GetProcessHeap
GetExitCodeProcess
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryExW
GetFileAttributesW
CopyFileW
GetSystemWindowsDirectoryW
GetComputerNameW
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetVersionExW
GetSystemInfo
GetFileType
lstrcmpiW
GetTempFileNameW
GetTempPathW
GetPrivateProfileStringW
ExpandEnvironmentStringsW
CloseHandle
ReadFile
GetFileSize
CreateFileW
LocalFree
FormatMessageW
lstrlenA
MultiByteToWideChar
lstrlenW
GetLastError
WriteFile
DeleteFileW
LocalAlloc
GetCurrentThread
HeapFree
DisableThreadLibraryCalls
FindClose
FindNextFileW
SetLastError
GetCurrentProcess
SystemTimeToFileTime
CompareFileTime
GetCurrentThreadId
GetFileAttributesExW
FileTimeToLocalFileTime
FileTimeToSystemTime
DuplicateHandle
TerminateProcess
SetFilePointer
SetEndOfFile
VirtualAlloc
VirtualFree
VerifyVersionInfoW
Sleep
FindFirstFileW

mfc42u

ord2408
ord3830
ord6832
ord5815
ord2876
ord6821
ord5804
ord2121

iphlpapi

NhGetInterfaceNameFromGuid

Exports

Exports

GetDiagnosticFunctions
InitHelperDll
RutlAlloc
RutlAssignmentFromTokenAndDword
RutlAssignmentFromTokens
RutlCloseDumpFile
RutlCreateDumpFile
RutlDwordDup
RutlFree
RutlGetOsVersion
RutlGetTagToken
RutlIsHelpToken
RutlParse
RutlStrDup

Sections

.text
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SettingSync/schannel.dll
.dll windows:10 windows x64 arch:x64

f9a7e6d2b3de9b36a6c1af314faffb97

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

schannel.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__stricmp
memmove
_o__wcsicmp
_o__wcsnicmp
_o__wsplitpath_s
_o_free
_o_malloc
_o_memcpy_s
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o__execute_onexit_table
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
wcschr
__C_specific_handler
memcmp
memcpy
__CxxFrameHandler3
__std_terminate
wcsrchr
wcsstr

api-ms-win-crt-string-l1-1-0

memset
strcmp
wcscmp
wcsncmp
wcsnlen
memmove_s

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
GetTokenInformation
EqualSid
GetLengthSid
RevertToSelf
AllocateLocallyUniqueId

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegFlushKey
RegSetValueExW
RegNotifyChangeKeyValue
RegOpenKeyExA

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-memory-l1-1-0

MapViewOfFileEx
CreateFileMappingW
VirtualFree
VirtualAlloc
VirtualQuery
VirtualProtect
UnmapViewOfFile
OpenFileMappingW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryW

api-ms-win-core-synch-l1-1-0

TryAcquireSRWLockExclusive
CreateMutexExW
CreateEventW
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
LeaveCriticalSection
CreateSemaphoreExW
ReleaseSRWLockShared
ReleaseSemaphore
ReleaseMutex
EnterCriticalSection
InitializeCriticalSectionEx
SetEvent
ReleaseSRWLockExclusive
InitializeSRWLock
ResetEvent
CreateEventA
WaitForSingleObjectEx
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
AcquireSRWLockShared
OpenSemaphoreW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCompareMemory

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
OpenThreadToken
SetThreadStackGuarantee
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime
GetSystemInfo
GetWindowsDirectoryW
GetComputerNameExW
GetTickCount
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedPopEntrySList
InterlockedFlushSList
InitializeSListHead

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
SetCurrentDirectoryW
GetCurrentDirectoryW

api-ms-win-core-file-l1-1-0

CompareFileTime
CreateDirectoryW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer
UnregisterWaitEx
ChangeTimerQueueTimer

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

ntdll

NtQuerySystemTime
NtQuerySystemInformation
NtOpenEvent
NtCreateEvent
NtSetEvent
RtlDuplicateUnicodeString
NtWaitForSingleObject
RtlValidSid
RtlSubAuthorityCountSid
RtlImageNtHeader
RtlDeregisterWait
RtlEnterCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
EtwUnregisterTraceGuids
RtlFreeHeap
NtOpenKey
RtlInitializeResource
RtlEqualUnicodeString
RtlGetNtProductType
RtlCopySid
RtlLengthSid
RtlSubAuthoritySid
RtlInitializeSid
RtlInitString
RtlAcquireResourceExclusive
EtwEventWrite
EtwEventUnregister
EtwEventRegister
RtlReleaseResource
RtlAcquireResourceShared
RtlNtStatusToDosErrorNoTeb
NtClose
NtDuplicateObject
RtlNtStatusToDosError
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
EtwEventWriteTransfer
EtwTraceMessage
RtlAppendUnicodeToString
RtlAllocateHeap
NtEnumerateKey
RtlCompareUnicodeString
RtlConvertSharedToExclusive
NtQueryValueKey
RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
NtSetInformationThread
NtAllocateVirtualMemory
NtFreeVirtualMemory
RtlDeleteResource
RtlInitAnsiString
RtlLeaveCriticalSection
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlPublishWnfStateData
WinSqmSetDWORD
RtlRegisterWait
RtlFreeUnicodeString

api-ms-win-crt-time-l1-1-0

_time32

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

AcceptSecurityContext
AcquireCredentialsHandleA
AcquireCredentialsHandleW
ApplyControlToken
CompleteAuthToken
DeleteSecurityContext
EnumerateSecurityPackagesA
EnumerateSecurityPackagesW
FreeContextBuffer
FreeCredentialsHandle
ImpersonateSecurityContext
InitSecurityInterfaceA
InitSecurityInterfaceW
InitializeSecurityContextA
InitializeSecurityContextW
MakeSignature
QueryContextAttributesA
QueryContextAttributesW
QuerySecurityPackageInfoA
QuerySecurityPackageInfoW
RevertSecurityContext
SealMessage
SpLsaModeInitialize
SpUserModeInitialize
SslCrackCertificate
SslEmptyCacheA
SslEmptyCacheW
SslFreeCertificate
SslFreeCustomBuffer
SslGenerateRandomBits
SslGetExtensions
SslGetMaximumKeySize
SslGetServerIdentity
SslLoadCertificate
UnsealMessage
VerifySignature

Sections

.text
Size: 469KB - Virtual size: 468KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SettingSync/sppcommdlg.dll
.dll windows:10 windows x64 arch:x64

9e7a74f359a4f7d11d4fce9a42612bae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

sppcommdlg.pdb

Imports

msvcrt

memcpy
memmove
_onexit
__dllonexit
wcschr
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
_wtoi
_vsnwprintf
_wcsicmp
memset

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
LockResource
LoadResource
FindResourceExW
GetModuleFileNameW
GetProcAddress
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
FreeLibraryAndExitThread
LoadStringW
FreeLibrary

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentThread
GetCurrentProcess
TerminateProcess
GetThreadPriority
SetThreadPriority
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-memory-l1-1-0

VirtualQuery

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-string-l2-1-0

CharUpperW

oleaut32

SysAllocString
VariantTimeToSystemTime
SysStringLen
SysFreeString
VariantClear
VariantInit

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoCreateInstance
CoUninitialize

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetVersionExW
GetSystemTime

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects
CreateSemaphoreW

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
ReleaseSemaphore
AcquireSRWLockExclusive
SetEvent
WaitForSingleObject

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
Sleep
WakeAllConditionVariable

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

comctl32

CreatePropertySheetPageW
ord344
PropertySheetW
ord345

gdi32

GetDeviceCaps
DeleteObject
CreateFontIndirectW
GetObjectW

imm32

ImmAssociateContext

kernel32

GlobalLock
GetProcessAffinityMask
MulDiv
GlobalUnlock

shell32

ShellExecuteExW

shlwapi

StrTrimW
StrStrIW

user32

OpenClipboard
IsClipboardFormatAvailable
MessageBeep
ReleaseDC
GetDC
NotifyWinEvent
SetForegroundWindow
DestroyIcon
FindWindowW
LoadIconW
GetSystemMenu
ShowWindow
SetWindowTextW
GetWindowLongPtrW
EnableMenuItem
SetWindowLongPtrW
DrawMenuBar
GetKeyState
GetClipboardData
SetFocus
GetWindowTextLengthW
GetDlgCtrlID
SetWindowPos
MapWindowPoints
GetWindowLongW
IsWindow
GetDlgItem
MessageBoxW
KillTimer
LoadCursorW
CallWindowProcW
DefWindowProcW
SetCursor
GetParent
PostMessageW
SetTimer
SendMessageW
GetWindowTextW
ShowCursor
CloseClipboard
LoadImageW
GetWindow
GetWindowRect
EnableWindow
SystemParametersInfoW
GetClientRect

sppc

SLClose
SLOpen
SLpIsCurrentInstalledProductKeyDefaultKey

Exports

Exports

SLUXActivationWizard

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dab/dab.dll
.dll windows:10 windows x64 arch:x64

9aec5c4aa0eee59fdd831e6d45f17768

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

dab.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcpy
_o__wcsicmp
_o_free
_o_rand_s
__C_specific_handler
_o___std_type_info_destroy_list
_o__configure_narrow_argv
_o__cexit
memcmp

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
TerminateProcess
ResumeThread
GetCurrentProcess
OpenThreadToken
CreateThread

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
CopySid
CheckTokenMembership
EqualSid
GetTokenInformation
FreeSid
GetLengthSid

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-1-0

CompareFileTime

rpcrt4

NdrServerCallAll
RpcImpersonateClient
RpcServerRegisterIfEx
UuidToStringW
UuidEqual
RpcRevertToSelf
UuidIsNil
RpcServerUnregisterIfEx
RpcServerUseProtseqEpW
RpcServerInqCallAttributesW
NdrServerCall2
RpcBindingVectorFree
RpcStringFreeW
UuidFromStringW

api-ms-win-core-synch-l1-2-0

InitializeConditionVariable
SleepConditionVariableSRW
WakeConditionVariable
InitOnceExecuteOnce

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolThreadMaximum
CallbackMayRunLong
SetThreadpoolThreadMinimum
CreateThreadpool
SetThreadpoolTimer
CloseThreadpool
CloseThreadpoolWork
CreateThreadpoolTimer
CloseThreadpoolCleanupGroup
CreateThreadpoolWork
CloseThreadpoolCleanupGroupMembers
CreateThreadpoolCleanupGroup
SubmitThreadpoolWork

api-ms-win-core-timezone-l1-1-0

TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime

api-ms-win-core-synch-l1-1-0

WaitForMultipleObjectsEx
CreateEventW
CreateWaitableTimerExW
SetWaitableTimerEx
CancelWaitableTimer
SetWaitableTimer
WaitForSingleObject
SetEvent

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCloseKey
RegDeleteKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteTreeW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

ntdll

RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlSubscribeWnfStateChangeNotification
RtlInitializeSRWLock
RtlReleaseSRWLockShared
RtlPublishWnfStateData
NtQueryWnfStateData
RtlCreateSecurityDescriptor
RtlCreateAcl
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
NtPowerInformation
RtlIsMultiSessionSku
RtlUnsubscribeWnfNotificationWaitForCompletion
NtSetThreadExecutionState
RtlNtStatusToDosError
EtwTraceMessage
RtlTryAcquireSRWLockShared
RtlSetDaclSecurityDescriptor
NtCreateWnfStateName
NtDeleteWnfStateName
RtlSetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
RtlCopySid
RtlAcquireSRWLockExclusive
RtlTestAndPublishWnfStateData
RtlWaitForWnfMetaNotification
EtwRegisterTraceGuidsW
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
RtlLengthSid

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
ControlTraceW
StartTraceW

api-ms-win-eventing-consumer-l1-1-0

OpenTraceW
CloseTrace
ProcessTrace

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

Exports

Exports

DabInitialize
DabPowerStateChanged
DabSessionStateChanged
DabTerminate

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dab/diagperf.dll
.dll regsvr32 windows:10 windows x64 arch:x64

b306282d5919c33c601b0599c6b8ce39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

diagperf.pdb

Imports

msvcrt

wcscspn
calloc
memcpy
memmove
_lock
_unlock
wcsspn
__CxxFrameHandler3
_XcptFilter
_amsg_exit
_initterm
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UEAA@XZ
memset
memcmp
_wcslwr_s
wcsrchr
wcschr
_mktime64
_localtime64_s
_CxxThrowException
_callnewh
fprintf
fwprintf
vswprintf_s
_vscwprintf
realloc
wcstok_s
wcsncmp
_i64tow_s
??0exception@@QEAA@AEBQEBDH@Z
malloc
ldiv
??0exception@@QEAA@AEBQEBD@Z
?what@exception@@UEBAPEBDXZ
_wcsicmp
memmove_s
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
_vsnprintf_s
_vsnwprintf
memcpy_s
_wcsdup
free
__C_specific_handler
_purecall
__iob_func
_itow_s
_wcsnicmp
wcsstr
_wcslwr
sqrt

ntdll

NtQuerySystemInformation
NtSetInformationFile
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmAddToStream
EtwEventWriteEndScenario
EtwEventWriteStartScenario
EtwEventActivityIdControl
WinSqmSetDWORD
WinSqmSetString
WinSqmEndSession
WinSqmStartSession
WinSqmIsOptedIn
EtwEventWrite
EtwEventEnabled
EtwEventUnregister
EtwEventRegister
WinSqmIncrementDWORD

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-core-file-l1-1-0

ReadFile
CompareFileTime
FileTimeToLocalFileTime
LockFileEx
SetFilePointer
GetFileSize
CreateFileW
SetEndOfFile
UnlockFile
WriteFile

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapDestroy
GetProcessHeap
HeapAlloc
HeapSize
HeapFree
HeapReAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
GetModuleHandleW
FindResourceExW
LoadResource
LockResource
SizeofResource
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
FreeLibrary

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
CreateThread
SetThreadPriority
TlsAlloc
TlsFree
TlsGetValue
GetCurrentThreadId
GetCurrentProcessId
TlsSetValue
GetCurrentThread
GetThreadPriority

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
InitializeCriticalSectionEx
WaitForSingleObject
SetEvent
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
CreateEventW
AcquireSRWLockShared

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-security-base-l1-1-0

GetLengthSid
CopySid
IsValidSid
AllocateAndInitializeSid
FreeSid
GetTokenInformation
AddAccessAllowedAceEx
InitializeAcl

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

kernel32

ResolveDelayLoadedAPI
GlobalMemoryStatusEx
GetFileAttributesExW
GetSystemInfo
DeleteFileW
CreateDirectoryW
ExpandEnvironmentStringsW
FindFirstVolumeW
GetVolumePathNamesForVolumeNameW
QueryDosDeviceW
FindNextVolumeW
FindVolumeClose
QueryActCtxW
CreateActCtxW
FindActCtxSectionStringW
ActivateActCtx
DeactivateActCtx
CreateTimerQueueTimer
DeleteTimerQueueTimer
DeleteTimerQueueEx
CreateTimerQueue
LocalFree
FileTimeToSystemTime
FormatMessageW
DelayLoadFailureHook

rpcrt4

RpcBindingFree
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
NdrClientCall3
RpcBindingFromStringBindingW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
WdiDiagnosticModuleMain
WdiGetDiagnosticModuleInterfaceVersion
WdiHandleInstance

Sections

.text
Size: 888KB - Virtual size: 887KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 289KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dab/fcon.dll
.dll windows:10 windows x64 arch:x64

e49a29f9efd90448f49e5fd8823a3bef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

fcon.pdb

Imports

msvcp_win

??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@I@Z
?_Xbad_function_call@std@@YAXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_N@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@G@std@@2V0locale@2@A
?widen@?$ctype@G@std@@QEBAGD@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsdup
_o__wcsicmp
_o_free
_o_malloc
_o_qsort
_o_terminate
_o_wcscpy_s
_o_wcstoul
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o__execute_onexit_table
_o__configure_narrow_argv
_o__errno
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o__cexit
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__callnewh
memcmp
__std_terminate
__CxxFrameHandler4
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
FreeLibraryAndExitThread
FreeLibrary
GetProcAddress
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
EnterCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
CreateSemaphoreExW
ResetEvent
LeaveCriticalSection
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
SetEvent
DeleteCriticalSection
CreateEventW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
CreateThread
OpenProcessToken
TerminateProcess
GetCurrentProcessId
ResumeThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsCreateString
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsDeleteString

api-ms-win-core-com-l1-1-0

CoGetCallContext
CoCreateGuid
CoCreateFreeThreadedMarshaler
StringFromGUID2
CoGetClassObject
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

ntdll

RtlSetSystemBootStatus
RtlQueryFeatureUsageNotificationSubscriptions
RtlSetFeatureConfigurations
RtlSubscribeForFeatureUsageNotification
RtlQueryAllFeatureConfigurations
RtlQueryFeatureConfigurationChangeStamp
RtlUnsubscribeFromFeatureUsageNotifications
RtlIsStateSeparationEnabled
RtlAllocateHeap
RtlGetSystemBootStatus
RtlEqualUnicodeString
RtlIntegerToUnicodeString
ZwQueryKey
ZwOpenKeyEx
ZwEnumerateValueKey
ZwEnumerateKey
ZwClose
RtlFreeHeap
RtlPublishWnfStateData

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-registry-l1-1-0

RegDeleteTreeW
RegEnumValueW
RegFlushKey
RegCloseKey
RegDeleteValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegCreateKeyExW

api-ms-win-core-path-l1-1-0

PathAllocCombine

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-registry-l2-1-0

RegEnumKeyW
RegDeleteKeyW
RegOpenKeyW

rpcrt4

RpcStringFreeW
RpcBindingFromStringBindingW
RpcBindingFree
RpcExceptionFilter
NdrClientCall3
RpcStringBindingComposeW

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
GetCtacPropertyAlloc
ModifyStagingControls

Sections

.text
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dab/hal.dll
.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:03:8d:b0:bf:e1:b0:ca:33:b3:d4:00:00:00:00:03:8d
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/05/2022, 19:23

Not After

04/05/2023, 19:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

34:25:a5:72:46:7c:d8:53:12:38:0c:aa:83:2f:60:81:92:2f:e8:86:7d:b7:1d:3d:3d:0e:35:b6:ec:9b:c2:8d
Signer

Actual PE Digest

34:25:a5:72:46:7c:d8:53:12:38:0c:aa:83:2f:60:81:92:2f:e8:86:7d:b7:1d:3d:3d:0e:35:b6:ec:9b:c2:8d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

hal.pdb

Exports

Exports

HalAcpiGetTableEx
HalAcquireDisplayOwnership
HalAdjustResourceList
HalAllProcessorsStarted
HalAllocateAdapterChannel
HalAllocateCommonBuffer
HalAllocateCrashDumpRegisters
HalAllocateHardwareCounters
HalAssignSlotResources
HalBugCheckSystem
HalCalibratePerformanceCounter
HalClearSoftwareInterrupt
HalConvertDeviceIdtToIrql
HalDisableInterrupt
HalDisplayString
HalDmaAllocateCrashDumpRegistersEx
HalDmaFreeCrashDumpRegistersEx
HalEnableInterrupt
HalEnumerateEnvironmentVariablesEx
HalEnumerateProcessors
HalFlushCommonBuffer
HalFreeCommonBuffer
HalFreeHardwareCounters
HalGetAdapter
HalGetBusData
HalGetBusDataByOffset
HalGetEnvironmentVariable
HalGetEnvironmentVariableEx
HalGetInterruptTargetInformation
HalGetInterruptVector
HalGetMemoryCachingRequirements
HalGetMessageRoutingInfo
HalGetProcessorIdByNtNumber
HalGetVectorInput
HalHandleMcheck
HalHandleNMI
HalInitSystem
HalInitializeBios
HalInitializeOnResume
HalInitializeProcessor
HalIsHyperThreadingEnabled
HalMakeBeep
HalPerformEndOfInterrupt
HalProcessorIdle
HalQueryDisplayParameters
HalQueryEnvironmentVariableInfoEx
HalQueryMaximumProcessorCount
HalQueryRealTimeClock
HalReadDmaCounter
HalRegisterDynamicProcessor
HalRegisterErrataCallbacks
HalReportResourceUsage
HalRequestClockInterrupt
HalRequestDeferredRecoveryServiceInterrupt
HalRequestIpi
HalRequestIpiSpecifyVector
HalRequestSoftwareInterrupt
HalReturnToFirmware
HalSendNMI
HalSendSoftwareInterrupt
HalSetBusData
HalSetBusDataByOffset
HalSetDisplayParameters
HalSetEnvironmentVariable
HalSetEnvironmentVariableEx
HalSetProfileInterval
HalSetRealTimeClock
HalStartDynamicProcessor
HalStartNextProcessor
HalStartProfileInterrupt
HalStopProfileInterrupt
HalSystemVectorDispatchEntry
HalTranslateBusAddress
HalWheaUpdateCmciPolicy
IoFlushAdapterBuffers
IoFreeAdapterChannel
IoFreeMapRegisters
IoMapTransfer
IoReadPartitionTable
IoSetPartitionInformation
IoWritePartitionTable
KdComPortInUse
KdHvComPortInUse
KeFlushWriteBuffer
KeQueryPerformanceCounter
KeStallExecutionProcessor
x86BiosAllocateBuffer
x86BiosCall
x86BiosFreeBuffer
x86BiosReadMemory
x86BiosWriteMemory

Sections

.rdata
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
hash.bin
provcore/ReAgent.dll
.dll windows:10 windows x64 arch:x64

69b8547cc70479063e783239d816f920

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:29

Not After

02/12/2021, 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8b:26:d3:ce:fc:97:3c:60:a9:d3:0a:be:0a:8c:9f:6e:ee:61:3b:f8:19:97:05:91:79:61:b2:e9:75:25:2b:96
Signer

Actual PE Digest

8b:26:d3:ce:fc:97:3c:60:a9:d3:0a:be:0a:8c:9f:6e:ee:61:3b:f8:19:97:05:91:79:61:b2:e9:75:25:2b:96

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ReAgent.pdb

Imports

msvcrt

wcschr
??1type_info@@UEAA@XZ
_purecall
?terminate@@YAXXZ
_CxxThrowException
_wcsnicmp
atol
_atoi64
_vsnprintf
wcsrchr
__CxxFrameHandler3
??0exception@@QEAA@AEBV0@@Z
memcmp
memcpy
memmove
?what@exception@@UEBAPEBDXZ
strcmp
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
_wtoi64
_wcsicmp
_vsnwprintf
free
_onexit
__dllonexit
_unlock
_lock
swscanf_s
wcsncmp
wcsnlen
wcsstr
memcpy_s
_wcslwr
qsort
towupper
strcpy_s
_wcsupr
wcstoul
memmove_s
iswspace
wcscpy_s
wcscat_s
swprintf_s
_ultow_s
_vsnwprintf_s
_snwscanf_s
strncmp
wprintf
_vscwprintf
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
memset
wcscmp

ntdll

ZwOpenMutant
ZwClose
RtlAppendUnicodeToString
ZwQueryAttributesFile
RtlLengthSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetDaclSecurityDescriptor
ZwCreateKey
ZwLoadKey
RtlAddAccessAllowedAceEx
RtlAllocateAndInitializeSid
RtlLengthSid
ZwDeleteValueKey
RtlFreeSid
ZwDeleteKey
ZwEnumerateKey
ZwQueryValueKey
RtlCreateAcl
ZwSetSecurityObject
ZwUnloadKey
RtlCreateSecurityDescriptor
ZwSetValueKey
ZwOpenKey
ZwAllocateUuids
LdrGetProcedureAddress
LdrGetDllHandle
ZwQueryInformationProcess
RtlInitAnsiString
ZwQueryInformationFile
ZwOpenProcess
ZwQuerySymbolicLinkObject
ZwDeviceIoControlFile
ZwQueryDirectoryObject
ZwOpenSymbolicLinkObject
ZwOpenDirectoryObject
ZwOpenFile
NtOpenProcessTokenEx
NtSetInformationThread
NtOpenThreadTokenEx
NtOpenSymbolicLinkObject
NtOpenKey
NtQuerySymbolicLinkObject
NtDeviceIoControlFile
NtQueryValueKey
NtQueryBootEntryOrder
NtQueryBootOptions
NtTranslateFilePath
NtOpenDirectoryObject
NtQueryDirectoryObject
NtEnumerateBootEntries
RtlCompareMemory
NtYieldExecution
ZwQueryKey
ZwWaitForSingleObject
RtlStringFromGUID
RtlFreeUnicodeString
ZwQuerySystemInformation
NtQuerySystemInformation
NtAdjustPrivilegesToken
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlNtStatusToDosError
RtlGUIDFromString
RtlRaiseStatus
NtClose
RtlInitUnicodeString
RtlAdjustPrivilege
RtlFreeHeap
RtlGetLastNtStatus
RtlSetControlSecurityDescriptor
RtlFindAceByType
RtlReAllocateHeap
DbgPrintEx
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceShared
RtlAcquireResourceExclusive
RtlInitializeResource
RtlImpersonateSelf
NtSetEaFile
NtCreateFile
NtSetInformationFile
NtQueryInformationProcess
NtQueryVolumeInformationFile
NtQueryInformationFile
RtlAllocateHeap
NtOpenFile
RtlDosPathNameToNtPathName_U
NtSetSecurityObject
ZwReleaseMutant

kernel32

GetFileInformationByHandleEx
ExpandEnvironmentStringsW
GetCurrentDirectoryW
GetLongPathNameW
IsDebuggerPresent
DebugBreak
AcquireSRWLockShared
CreateMutexExW
CreateThreadpoolTimer
ReleaseSRWLockShared
SetThreadpoolTimer
GetLastError
SetLastError
GetProcessHeap
HeapFree
TlsGetValue
HeapAlloc
GetSystemDirectoryW
CreateFileW
CloseHandle
GetFileAttributesExW
GetVolumeNameForVolumeMountPointW
DeviceIoControl
FindFirstVolumeW
GetDriveTypeW
GetDiskFreeSpaceExW
FindNextVolumeW
FindVolumeClose
GetFileAttributesW
GetFullPathNameW
GetVolumePathNameW
MultiByteToWideChar
GetFileSize
ReadFile
SetEndOfFile
WriteFile
FlushFileBuffers
MoveFileExW
SetFileAttributesW
DeleteFileW
OpenSemaphoreW
CopyFileW
GetVersionExW
CopyFileExW
GetSystemWindowsDirectoryW
GetWindowsDirectoryW
GetTempPathW
CreateDirectoryW
GetFileSizeEx
GetModuleHandleW
GetProcAddress
GetTickCount64
CompareStringW
FindFirstFileW
FindNextFileW
FindClose
GetVolumePathNamesForVolumeNameW
WaitForSingleObject
WritePrivateProfileStringW
GetPrivateProfileStringW
GetFileInformationByHandle
SetFirmwareEnvironmentVariableW
LoadLibraryExW
FreeLibrary
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleExW
GetHandleInformation
SetFilePointerEx
GetEnvironmentVariableW
GetOverlappedResult
EnterCriticalSection
SleepConditionVariableSRW
LocalFree
DeleteCriticalSection
RaiseException
SetThreadIdealProcessor
GetCurrentThread
SetFilePointer
InitializeCriticalSection
HeapReAlloc
SetFileInformationByHandle
GetVolumeInformationW
GetFinalPathNameByHandleW
CreateEventW
InitializeCriticalSectionAndSpinCount
LockFileEx
UnlockFileEx
LocalAlloc
GetModuleFileNameW
FormatMessageW
ReleaseMutex
WideCharToMultiByte
OpenProcess
DuplicateHandle
GetPrivateProfileSectionW
WaitForMultipleObjects
ReleaseSemaphore
SetEvent
CreateSemaphoreW
CreateThread
GetVolumeInformationByHandleW
GlobalMemoryStatusEx
WaitForMultipleObjectsEx
ResetEvent
CreateSemaphoreExW
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
LoadLibraryW
CreateProcessW
GetExitCodeProcess
SetVolumeMountPointW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
VirtualProtect
GetFirmwareEnvironmentVariableW
LoadLibraryExA
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
TlsFree
TlsSetValue
TlsAlloc
VirtualQuery
GetSystemInfo
WakeAllConditionVariable
LeaveCriticalSection
VirtualFree
RemoveDirectoryW
VirtualAlloc

bcrypt

BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty
BCryptOpenAlgorithmProvider

cabinet

ord20
ord22
ord23

advapi32

OpenThreadToken
GetAclInformation
GetSecurityDescriptorLength
GetSecurityDescriptorControl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
RegEnumValueW
EventWriteTransfer
EventUnregister
EventRegister
ConvertStringSecurityDescriptorToSecurityDescriptorW
FreeSid
SetNamedSecurityInfoW
AddAccessAllowedAceEx
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteKeyW
RegCreateKeyExW
InitiateSystemShutdownExW
RegUnLoadKeyW
RegLoadKeyW
RegSetValueExW
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegGetValueW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
DuplicateTokenEx
RegDeleteTreeW
TraceMessage
SetThreadToken
EventWrite
RegDeleteKeyExW
RevertToSelf
CloseEncryptedFileRaw
WriteEncryptedFileRaw
OpenEncryptedFileRawW

user32

CharUpperW
LoadStringW

imagehlp

ImageNtHeader

ole32

CoCreateInstance
CoUninitialize
StringFromCLSID
CoInitializeEx
CoCreateGuid
CoInitialize
CoTaskMemFree
CLSIDFromString

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

rpcrt4

UuidCompare
UuidToStringW
RpcStringFreeW
UuidCreate

Exports

Exports

WinRECheckGuid
WinREUseNewPBRImage
WinRE_Generalize
WinRE_Specialize
WinRE_Specialize_Offline
WinReAddTrustedBootApp
WinReClearBootApp
WinReClearError
WinReClearOemImagePath
WinReConfigureTask
WinReCopyDiagnosticFiles
WinReCopyLogFilesToRamdisk
WinReCreateLogInstance
WinReCreateLogInstanceEx
WinReDeleteLogFiles
WinReGetConfig
WinReGetCustomization
WinReGetError
WinReGetLogDirPath
WinReGetTrustedBootApps
WinReGetWIMInfo
WinReHashBootApp
WinReHashWimFile
WinReInitiateOfflineScanning
WinReInstall
WinReInstallOnTargetOS
WinReIsInstalledOnSystemPartition
WinReIsWimBootEnabled
WinReIsWinPE
WinReOobeInstall
WinReOpenLogInstance
WinRePostBCDRepair
WinReQueueRecoveryBoot
WinReReinstall
WinReRemoveTrustedBootApp
WinReRepair
WinReRestoreConfigAfterPBR
WinReRestoreLogFiles
WinReSetBootApp
WinReSetConfig
WinReSetCustomization
WinReSetError
WinReSetNarratorScheduled
WinReSetRecoveryAction
WinReSetTriggerFile
WinReSetupBackupWinRE
WinReSetupCheckWinRE
WinReSetupInstall
WinReSetupMigrateData
WinReSetupRemoveWinRE
WinReSetupRestoreWinREEx
WinReSetupSetImage
WinReUnInstall
WinReUpdateLogInstance
WinReValidateRecoveryWim
WinReValidateWimFile
winreFindInstallMedia
winreGetBinaryArch

Sections

.text
Size: 752KB - Virtual size: 751KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 296KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
provcore/msasn1.dll
.dll windows:10 windows x64 arch:x64

f79599ca729d557e0381ec0a41471a27

Code Sign

33:00:00:03:81:a4:c7:63:e7:ad:c5:b4:ee:00:00:00:00:03:81
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2022, 19:24

Not After

08/03/2023, 19:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

58:95:54:63:71:84:a6:6a:b4:bb:a4:6b:2a:94:4f:50:94:46:7d:05:48:25:79:58:2f:70:29:eb:41:8a:6f:7d
Signer

Actual PE Digest

58:95:54:63:71:84:a6:6a:b4:bb:a4:6b:2a:94:4f:50:94:46:7d:05:48:25:79:58:2f:70:29:eb:41:8a:6f:7d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

msasn1.pdb

Imports

ntdll

_ultoa
RtlLookupFunctionEntry
isdigit
_atoi64
_ui64toa
strchr
RtlVirtualUnwind
memmove
_vsnprintf
RtlCaptureContext
memchr
memcmp
memcpy
memset

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
LocalReAlloc

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpA
lstrlenA

Exports

Exports

ASN1BERDecBitString
ASN1BERDecBitString2
ASN1BERDecBool
ASN1BERDecChar16String
ASN1BERDecChar32String
ASN1BERDecCharString
ASN1BERDecCheck
ASN1BERDecDouble
ASN1BERDecEndOfContents
ASN1BERDecEoid
ASN1BERDecExplicitTag
ASN1BERDecFlush
ASN1BERDecGeneralizedTime
ASN1BERDecLength
ASN1BERDecMultibyteString
ASN1BERDecNotEndOfContents
ASN1BERDecNull
ASN1BERDecObjectIdentifier
ASN1BERDecObjectIdentifier2
ASN1BERDecOctetString
ASN1BERDecOctetString2
ASN1BERDecOpenType
ASN1BERDecOpenType2
ASN1BERDecPeekTag
ASN1BERDecS16Val
ASN1BERDecS32Val
ASN1BERDecS8Val
ASN1BERDecSXVal
ASN1BERDecSkip
ASN1BERDecTag
ASN1BERDecU16Val
ASN1BERDecU32Val
ASN1BERDecU8Val
ASN1BERDecUTCTime
ASN1BERDecUTF8String
ASN1BERDecZeroChar16String
ASN1BERDecZeroChar32String
ASN1BERDecZeroCharString
ASN1BERDecZeroMultibyteString
ASN1BERDotVal2Eoid
ASN1BEREncBitString
ASN1BEREncBool
ASN1BEREncChar16String
ASN1BEREncChar32String
ASN1BEREncCharString
ASN1BEREncCheck
ASN1BEREncDouble
ASN1BEREncEndOfContents
ASN1BEREncEoid
ASN1BEREncExplicitTag
ASN1BEREncFlush
ASN1BEREncGeneralizedTime
ASN1BEREncLength
ASN1BEREncMultibyteString
ASN1BEREncNull
ASN1BEREncObjectIdentifier
ASN1BEREncObjectIdentifier2
ASN1BEREncOctetString
ASN1BEREncOpenType
ASN1BEREncRemoveZeroBits
ASN1BEREncRemoveZeroBits2
ASN1BEREncS32
ASN1BEREncSX
ASN1BEREncTag
ASN1BEREncU32
ASN1BEREncUTCTime
ASN1BEREncUTF8String
ASN1BEREncZeroMultibyteString
ASN1BEREoid2DotVal
ASN1BEREoid_free
ASN1CEREncBeginBlk
ASN1CEREncBitString
ASN1CEREncChar16String
ASN1CEREncChar32String
ASN1CEREncCharString
ASN1CEREncEndBlk
ASN1CEREncFlushBlkElement
ASN1CEREncGeneralizedTime
ASN1CEREncMultibyteString
ASN1CEREncNewBlkElement
ASN1CEREncOctetString
ASN1CEREncUTCTime
ASN1CEREncZeroMultibyteString
ASN1DEREncBeginBlk
ASN1DEREncBitString
ASN1DEREncChar16String
ASN1DEREncChar32String
ASN1DEREncCharString
ASN1DEREncEndBlk
ASN1DEREncFlushBlkElement
ASN1DEREncGeneralizedTime
ASN1DEREncMultibyteString
ASN1DEREncNewBlkElement
ASN1DEREncOctetString
ASN1DEREncUTCTime
ASN1DEREncUTF8String
ASN1DEREncZeroMultibyteString
ASN1DecAlloc
ASN1DecRealloc
ASN1DecSetError
ASN1EncSetError
ASN1Free
ASN1_CloseDecoder
ASN1_CloseEncoder
ASN1_CloseEncoder2
ASN1_CloseModule
ASN1_CreateDecoder
ASN1_CreateDecoderEx
ASN1_CreateEncoder
ASN1_CreateModule
ASN1_Decode
ASN1_Encode
ASN1_FreeDecoded
ASN1_FreeEncoded
ASN1_GetDecoderOption
ASN1_GetEncoderOption
ASN1_SetDecoderOption
ASN1_SetEncoderOption
ASN1bitstring_cmp
ASN1bitstring_free
ASN1char16string_cmp
ASN1char16string_free
ASN1char32string_cmp
ASN1char32string_free
ASN1charstring_cmp
ASN1charstring_free
ASN1generalizedtime_cmp
ASN1intx2int32
ASN1intx2uint32
ASN1intx_add
ASN1intx_cmp
ASN1intx_free
ASN1intx_setuint32
ASN1intx_sub
ASN1intx_uoctets
ASN1intxisuint32
ASN1objectidentifier2_cmp
ASN1objectidentifier_cmp
ASN1objectidentifier_free
ASN1octetstring_cmp
ASN1octetstring_free
ASN1open_cmp
ASN1open_free
ASN1uint32_uoctets
ASN1utctime_cmp
ASN1utf8string_free
ASN1ztchar16string_cmp
ASN1ztchar16string_free
ASN1ztchar32string_cmp
ASN1ztchar32string_free
ASN1ztcharstring_cmp
ASN1ztcharstring_free

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
provcore/networkhelper.dll
.dll windows:10 windows x64 arch:x64

a27bcbd490e1101d8155e000cd94272f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

NetworkHelper.pdb

Imports

msvcrt

memmove
realloc
_onexit
__dllonexit
_unlock
memcpy
_purecall
_wsplitpath_s
swprintf_s
wcsncpy_s
_vsnwprintf
memcpy_s
__CxxFrameHandler3
_lock
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
memcmp
_strnicmp
__C_specific_handler
memset

ntdll

NtQuerySystemInformation
RtlReportException
RtlFreeHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlLengthSid
RtlAllocateHeap

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoUninitialize
CoCreateInstance

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
WaitForSingleObject
WaitForSingleObjectEx
ResetEvent
ReleaseSRWLockShared
DeleteCriticalSection
InitializeCriticalSection
AcquireSRWLockShared
ReleaseSemaphore
SetEvent
CreateEventW
EnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
CreateSemaphoreExW
ReleaseSRWLockExclusive
CreateMutexExW
AcquireSRWLockExclusive
ReleaseMutex

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
RaiseException
GetLastError

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcess
OpenProcessToken
GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetTickCount
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExW
RegQueryValueExW
RegGetValueW
RegOpenKeyExW
RegSetValueExW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
FreeLibrary
GetModuleHandleW

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

umpdc

Pdcv2ActivationClientDeactivate
Pdcv2ActivationClientActivate
Pdcv2ActivationClientRegister
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientRenewActivation

syncutil

ord9

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

Exports

Exports

CHttpTransport_CreateInstance
CheckPdcRenewal
CreateControlChannelTriggerConnectionManager
GetOrCreateNullPowerDependencyCoordinatorManager
GetSerializedAppMetadata
InitializePowerDependencyCoordinatorManager
IsNetworkConnectionCostRestricted
ProgressStatus
ReleasePowerDependencyCoordinatorManager
ReportSyncProgress
SyncPdcReference_WatchdogReport
SyncPdcReference_WatchdogsEnabled
SyncWerReportComponentName
SyncWerReportGenerator

Sections

.text
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
provcore/provcore.dll
.dll windows:10 windows x64 arch:x64

81a888cb3ce408320e5ea1e6d2c40d06

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

provcore.pdb

Imports

msvcp_win

??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@G@std@@2V0locale@2@A
?id@?$ctype@G@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
_Wcsxfrm
_Wcscoll
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o___stdio_common_vswprintf
memmove
_o__wcsicmp
_o__wtoi
_o_free
_o_malloc
_o_memcpy_s
_o_realloc
_o_wcscpy_s
_o_wcstod
_o_wcstoul
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
_o__beginthreadex
_o__crt_atexit
strchr
__std_type_info_compare
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
wcschr
_o__configure_narrow_argv
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleFileNameW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
LoadLibraryExW
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
CreateEventExW
WaitForSingleObjectEx
WaitForMultipleObjectsEx
InitializeSRWLock
SetEvent
ResetEvent
CreateEventW
CreateSemaphoreExW
OpenSemaphoreW
CreateMutexExW
ReleaseSRWLockExclusive
CreateMutexW
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
AcquireSRWLockShared
AcquireSRWLockExclusive
EnterCriticalSection
ReleaseSRWLockShared

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetProcessId
GetCurrentProcess
TerminateProcess
GetExitCodeThread
OpenThreadToken
GetCurrentProcessId
SetThreadPriority
GetCurrentThread
OpenProcessToken
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW
LocaleNameToLCID

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

ntdll

RtlFreeHeap
NtQueryInformationToken
RtlInitUnicodeString
RtlEqualSid
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
RtlCompareUnicodeString
NtQueryKey
EtwEventWriteTransfer
EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwEventRegister
EtwEventSetInformation
EtwEventUnregister
RtlLoadString
EtwEventActivityIdControl
RtlGetPersistedStateLocation

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64

api-ms-win-core-namespace-l1-1-0

CreatePrivateNamespaceW
AddSIDToBoundaryDescriptor
CreateBoundaryDescriptorW
ClosePrivateNamespace
OpenPrivateNamespaceW
DeleteBoundaryDescriptor

api-ms-win-security-base-l1-1-0

InitializeAcl
AddAccessAllowedAce
CopySid
SetSecurityDescriptorDacl
AllocateAndInitializeSid
GetLengthSid
CreateWellKnownSid
FreeSid
CheckTokenMembership
InitializeSecurityDescriptor
GetTokenInformation

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalAlloc
LocalFree
GlobalFree

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

rpcrt4

RpcBindingCreateW
RpcBindingFree
RpcBindingBind
RpcExceptionFilter
RpcServerInqCallAttributesW
NdrClientCall3

api-ms-win-core-file-l1-1-0

GetTempFileNameW
CreateFileW
WriteFile
DeleteFileW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-registry-l1-1-0

RegOpenCurrentUser
RegSetValueExW
RegGetValueW
RegEnumKeyExW
RegDeleteTreeW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
FreeLibraryWhenCallbackReturns
CallbackMayRunLong
TrySubmitThreadpoolCallback
CloseThreadpoolTimer

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
CompareStringEx

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

mobilenetworking

GetPersistentRegPath

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-devices-query-l1-1-0

DevGetObjectProperties
DevFreeObjectProperties

api-ms-win-core-sidebyside-l1-1-0

CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 486KB - Virtual size: 485KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
setup.msi
.msi
vmrdvcore/mssph.dll
.dll regsvr32 windows:10 windows x64 arch:x64

5dfbf61ae94045240f766cbfaff03ede

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

mssph.pdb

Imports

msvcrt

__CxxFrameHandler3
??1type_info@@UEAA@XZ
realloc
_errno
memset
_initterm
toupper
_wcsnicmp
wcsncmp
?terminate@@YAXXZ
_wcsicmp
towupper
iswspace
_onexit
_wtol
_lock
memmove_s
_amsg_exit
wcsncpy_s
__dllonexit
_unlock
wcschr
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
_XcptFilter
memcpy
malloc
free
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
wcscat_s
wcscpy_s
memcpy_s
_vsnwprintf
__C_specific_handler
memcmp
memmove
wcscmp

oleaut32

VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadLibraryExW
GetModuleFileNameA
GetProcAddress
SizeofResource
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleExW
LoadResource
FindResourceExW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
Sleep
InitOnceComplete
WakeAllConditionVariable
InitOnceExecuteOnce
SleepConditionVariableSRW

api-ms-win-core-synch-l1-1-0

OpenMutexW
DeleteCriticalSection
InitializeCriticalSectionEx
WaitForSingleObjectEx
ReleaseMutex
CreateEventW
SetEvent
CreateSemaphoreExW
AcquireSRWLockShared
ReleaseSRWLockShared
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSection
CreateMutexExW
WaitForSingleObject
ReleaseSRWLockExclusive
OpenSemaphoreW
AcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-com-l1-1-0

CoCreateInstance
PropVariantCopy
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUnmarshalInterface
StringFromGUID2

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegGetValueW
RegCloseKey
RegQueryInfoKeyW

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte
CompareStringW
MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetSystemDefaultLCID
LCMapStringW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak
OutputDebugStringW
IsDebuggerPresent

ntdll

RtlIsCloudFilesPlaceholder
RtlIsNonEmptyDirectoryReparsePointAllowed
RtlInitUnicodeString
EtwEventEnabled
ZwQueryInformationFile
NtCreateFile
RtlNtStatusToDosError
RtlIsStateSeparationEnabled
RtlGetPersistedStateLocation
EtwEventRegister
EtwEventUnregister
EtwEventWriteTransfer
EtwEventSetInformation
RtlIsPartialPlaceholder

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

GetDriveTypeW
SetFilePointer
LockFile
DeleteFileW
ReadFile
SetEndOfFile
WriteFile
SetFileTime
UnlockFile
GetFileAttributesW
CreateFileW
CompareFileTime
GetFileSize
GetFileTime
FlushFileBuffers

api-ms-win-security-base-l1-1-0

IsValidSid
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
SetSecurityDescriptorOwner
MakeSelfRelativeSD
MakeAbsoluteSD
SetSecurityDescriptorGroup
GetLengthSid
InitializeAcl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorGroup
IsValidSecurityDescriptor

api-ms-win-core-sysinfo-l1-1-0

GetVersionExA
GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-shcore-registry-l1-1-0

SHEnumKeyExW
SHEnumValueW

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
VirtualFree
VirtualAlloc

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventProviderEnabled
EventRegister

shcore

ord190
SHCreateMemStream

api-ms-win-core-shlwapi-legacy-l1-1-0

PathStripToRootW
PathFindExtensionW
PathGetDriveNumberW
PathFileExistsW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vmrdvcore/perfctrs.dll
.dll windows:10 windows x64 arch:x64

2405ad06873b3990210b1b04a23682fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

perfctrs.pdb

Imports

msvcrt

__C_specific_handler
isprint
_initterm
malloc
free
_amsg_exit
_XcptFilter
wcsnlen
memmove

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
NtWaitForSingleObject
NtCreateFile
RtlInitString
RtlFreeUnicodeString
RtlVirtualUnwind
NtOpenFile
RtlIntegerToUnicodeString
RtlNtStatusToDosError
NtClose
NtDeviceIoControlFile
RtlReAllocateHeap
RtlCopyUnicodeString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
HeapReAlloc

api-ms-win-core-registry-l1-1-0

RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegCloseKey

iphlpapi

GetIcmpStatisticsEx
GetTcpStatisticsEx
GetUdpStatisticsEx
FreeMibTable
GetIpStatisticsEx
GetIfTable2
GetNumberOfInterfaces

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameA

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW
DeregisterEventSource
ReportEventW
ReportEventA

nsi

NsiGetAllParameters

Exports

Exports

CloseDhcpPerformanceData
CloseIPXPerformanceData
CloseNWNBPerformanceData
CloseNbfPerformanceData
CloseSPXPerformanceData
CloseTcpIpPerformanceData
CollectDhcpPerformanceData
CollectIPXPerformanceData
CollectNWNBPerformanceData
CollectNbfPerformanceData
CollectSPXPerformanceData
CollectTcpIpPerformanceData
OpenDhcpPerformanceData
OpenIPXPerformanceData
OpenNWNBPerformanceData
OpenNbfPerformanceData
OpenSPXPerformanceData
OpenTcpIpPerformanceData

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vmrdvcore/tapisrv.dll
.dll windows:10 windows x64 arch:x64

6aba8903eb7e4be23e07d9607806e424

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

tapisrv.pdb

Imports

msvcrt

free
_initterm
_vsnprintf
memmove
_amsg_exit
malloc
_XcptFilter
_itow
_wcsnicmp
wcsncmp
_wtol
wcsstr
wcschr
_wcsupr
_wcsicmp
_vsnwprintf
__C_specific_handler
memcpy
memset

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryValueExA
RegOpenKeyExA
RegNotifyChangeKeyValue
RegDeleteValueW
RegEnumValueW
RegCloseKey
RegDeleteKeyExW
RegOpenCurrentUser
RegQueryInfoKeyW

rpcrt4

RpcServerUseProtseqEpW
RpcServerInqDefaultPrincNameW
RpcBindingFromStringBindingW
RpcMgmtSetCancelTimeout
RpcRevertToSelf
RpcBindingSetAuthInfoW
RpcServerUnregisterIf
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcStringFreeW
NdrServerCall2
NdrServerCallAll
NdrClientCall3
RpcCancelThread
RpcServerInqCallAttributesW
RpcBindingFree
RpcServerRegisterAuthInfoW
RpcServerListen
RpcServerRegisterIfEx
RpcImpersonateClient

api-ms-win-service-core-l1-1-0

SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenSCManagerW
OpenServiceW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW

kernel32

GetSystemTime
DelayLoadFailureHook
ResolveDelayLoadedAPI
GetWindowsDirectoryW
GlobalFree
DeleteFileW
GlobalAlloc
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetLocalTime
lstrlenA
OutputDebugStringA
GetSystemTimeAsFileTime
LocalFree
K32EnumProcesses
FileTimeToSystemTime
GetSystemWindowsDirectoryW
MapViewOfFile
CreateFileMappingW
WritePrivateProfileSectionW
GetFileSize
GetCurrentDirectoryW
IsDBCSLeadByte
GetFileAttributesExW
GetPrivateProfileStringW
UnmapViewOfFile
GetSystemDirectoryW
FindClose
GetPrivateProfileSectionW
FindNextFileW
FindFirstFileW
lstrcmpiW
GetProcessHeap
GetComputerNameW
DeleteCriticalSection
GetProcAddress
HeapDestroy
HeapCompact
HeapAlloc
ResetEvent
CreateThread
GetSystemInfo
GetCurrentThread
DisableThreadLibraryCalls
CreateEventW
OpenProcess
ExitThread
GetComputerNameExW
GetPrivateProfileSectionNamesW
OpenEventW
CreateFileW
InitializeCriticalSectionAndSpinCount
SetThreadPriority
WaitForMultipleObjects
GetPrivateProfileIntW
UnregisterWait
WriteFile
GetCurrentProcess
EnterCriticalSection
lstrlenW
LeaveCriticalSection
CreateMutexW
WaitForSingleObject
LocalAlloc
GetCurrentThreadId
ReleaseMutex
DuplicateHandle
MultiByteToWideChar
Sleep
GetLastError
SetEvent
CloseHandle
LoadLibraryW
FreeLibrary
HeapFree
GetTickCount
HeapCreate
WritePrivateProfileStringW
CompareStringW

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoCreateInstance

Exports

Exports

ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 239KB - Virtual size: 238KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vmrdvcore/vmrdvcore.dll
.dll windows:10 windows x64 arch:x64

055a22c998dd9328accc6de5710f416b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

vmrdvcore.pdb

Imports

msvcrt

_callnewh
??0exception@@QEAA@AEBQEBD@Z
swprintf_s
_purecall
_wcsicmp
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
??_V@YAXPEAX@Z
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_vsnwprintf
_XcptFilter
wcscspn
??3@YAXPEAX@Z
_vsnwprintf_s
wcsrchr
wcsncmp
_wcsnicmp
_wtol
wcschr
memmove
__CxxFrameHandler3
iswalpha
memcmp
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
memcpy
memset

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
Sleep
WakeAllConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
CreateThread
GetExitCodeProcess
GetCurrentProcess
OpenThreadToken
GetExitCodeThread
GetCurrentThread
CreateProcessW
SuspendThread
OpenProcessToken
TerminateProcess
GetCurrentThreadId
ResumeThread

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetVersionExW
GetTickCount
GetSystemTimeAsFileTime
GetLocalTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
GetLastError
UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

OpenEventW
SetEvent
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObject
AcquireSRWLockExclusive
CreateEventW
ReleaseSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-threadpool-l1-2-0

CallbackMayRunLong
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CreateThreadpoolWork
CloseThreadpoolWork

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoSetProxyBlanket
CLSIDFromString
CoUninitialize
CoInitializeEx
CoCreateGuid
CoCreateInstanceEx
StringFromGUID2
CoCreateInstance
CoTaskMemFree

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-security-lsapolicy-l1-1-0

LsaClose
LsaOpenPolicy
LsaFreeMemory
LsaQueryInformationPolicy

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
OpenServiceW
StartServiceW

netutils

NetApiBufferFree

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegUnLoadKeyW
RegLoadKeyW
RegDeleteTreeW
RegCreateKeyExW
RegGetValueW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegEnumKeyExW

api-ms-win-core-file-l1-1-0

FindNextFileW
FindFirstFileW
FindClose
CreateFileW
WriteFile
RemoveDirectoryW
GetLongPathNameW
GetShortPathNameW
GetFileAttributesW
CreateDirectoryW
SetFileAttributesW
FindFirstVolumeW
DeleteFileW
FindNextVolumeW
FindVolumeClose
ReadFile
DeleteVolumeMountPointW

api-ms-win-shcore-registry-l1-1-0

SHGetValueW

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
MoveFileW

oleaut32

VariantClear
VariantInit
SysAllocString
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayCreate
SafeArrayRedim
SafeArrayLock
VarBstrCmp
VariantTimeToSystemTime
SysStringByteLen
SysStringLen
SysFreeString

userenv

DeleteProfileW
GetUserProfileDirectoryW
GetProfilesDirectoryW
RefreshPolicyEx

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupPrivilegeValueW

iphlpapi

GetAdaptersAddresses

ws2_32

InetNtopW
WSAGetLastError

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW

samcli

NetLocalGroupDelMembers
NetLocalGroupAddMembers

api-ms-win-security-base-l1-1-0

GetFileSecurityW
GetAce
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
CreateWellKnownSid
GetLengthSid
DeleteAce
EqualSid
AdjustTokenPrivileges
IsValidSid
SetFileSecurityW
GetAclInformation
MakeAbsoluteSD

api-ms-win-core-string-l1-1-0

CompareStringEx

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-service-management-l2-1-0

NotifyServiceStatusChangeW

xmllite

CreateXmlReader

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

rpcrt4

UuidToStringW
RpcServerUseProtseqEpW
RpcServerInqBindings
RpcEpRegisterW
RpcServerRegisterAuthInfoW
RpcServerRegisterIfEx
RpcBindingVectorFree
RpcBindingInqAuthClientW
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcEpUnregister
UuidCompare
RpcBindingFree
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingFromStringBindingW
RpcEpResolveBinding
RpcServerUnregisterIf
RpcRaiseException
NdrServerCallAll
NdrServerCall2
RpcAsyncInitializeHandle
RpcAsyncCompleteCall
RpcAsyncCancelCall
Ndr64AsyncClientCall
UuidCreate

api-ms-win-core-kernel32-legacy-l1-1-1

SetVolumeMountPointW
VerifyVersionInfoW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx
MoveFileWithProgressW
CopyFileExW
CreateSymbolicLinkW

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

srvcli

NetShareGetInfo

api-ms-win-core-namedpipe-l1-1-0

CreateNamedPipeW
SetNamedPipeHandleState
ConnectNamedPipe
DisconnectNamedPipe

api-ms-win-core-io-l1-1-1

CancelIo

advapi32

LsaNtStatusToWinError

netapi32

I_NetLogonControl2

virtdisk

OpenVirtualDisk
DetachVirtualDisk
GetVirtualDiskPhysicalPath
AttachVirtualDisk

wtsapi32

WTSSendMessageW

api-ms-win-core-shutdown-l1-1-1

InitiateShutdownW

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-timezone-l1-1-0

TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

VmRdvCore_CreateInstance
VmRdvCore_GetInstance
VmRdvCore_TerminateInstance

Sections

.text
Size: 305KB - Virtual size: 305KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
unpack.bat

Sharing

General

Malware Config

Signatures

Files

Password: 3724

Password: 3724

28bc134ea5d519f49501ac974b6a747e

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

user32

advapi32

msvcrt

kernel32

Sections

.text Size: 481KB - Virtual size: 481KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 1KB - Virtual size: 46KB

.sxdata Size: 512B - Virtual size: 4B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 22KB - Virtual size: 22KB

Password: 3724

Password: 3724

Password: 3724

c252150e2ab272715077e6f59b74980d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

sysntfy

dismapi

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-localization-l1-2-0

rpcrt4

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-shutdown-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

samcli

api-ms-win-core-file-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-security-credentials-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-security-lsalookup-l1-1-0

.text
Size: 481KB - Virtual size: 481KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 1KB - Virtual size: 46KB

.sxdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 22KB - Virtual size: 22KB

.text
Size: 362KB - Virtual size: 361KB

.rdata
Size: 144KB - Virtual size: 144KB

.data
Size: 2KB - Virtual size: 17KB

.pdata
Size: 14KB - Virtual size: 13KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 115KB - Virtual size: 115KB

.rdata
Size: 33KB - Virtual size: 33KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 8KB - Virtual size: 8KB