wmpnssui.pdb
Static task
static1
Behavioral task
behavioral1
Sample
LoaderV6/loaderV6.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
LoaderV6/loaderV6.exe
Resource
win10v2004-20240709-en
General
-
Target
LoaderV6.zip
-
Size
15.2MB
-
MD5
273e74c7c8e4fefcafca7ab2c634fef7
-
SHA1
9a01e91e93cef5c77de8c70b8ae80da15a540fff
-
SHA256
18b7e51b0f80744208e78cdbdc707e5b8467991af8bdea3c47f3ee25ad864277
-
SHA512
d3f788e51d165b72ebf9c46a3463dd594df308bc199a8f70db25945450ab0c5da3cb1aeffeb6cf9f46f323150bd4d5d660fefd054fed956a5b491dd21e228277
-
SSDEEP
393216:wjdAJ/kHfMO2/w1kBY8l5aFEYF/pAYfxXaI+vQkXLLcDlE610Cgr:wjKsHfMO2/wBFFF/pAYfR0vQk8DlN0Nr
Malware Config
Signatures
-
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/LoaderV6/Additions/wmpnetwk.dll unpack001/LoaderV6/Additions/wmpnssci.dll unpack001/LoaderV6/Additions/wmpnssui.dll unpack001/LoaderV6/WMPNSSUI.dll unpack001/LoaderV6/mpvis.DLL unpack001/LoaderV6/wmpnssci.dll
Files
-
LoaderV6.zip.zip
-
LoaderV6/Additions/wmpnetwk.dll.dll windows:10 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.rdata Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 31KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
LoaderV6/Additions/wmpnssci.dll.dll windows:10 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.rdata Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
LoaderV6/Additions/wmpnssui.dll.dll windows:10 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.rdata Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
LoaderV6/WMPNSSUI.dll.dll regsvr32 windows:10 windows x64 arch:x64
7c921fb42cad0a9d69ae2005e213c272
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
memset
kernel32
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentThreadId
DisableThreadLibraryCalls
Sleep
GetLastError
oleaut32
SysFreeString
VariantClear
ole32
CoCreateInstance
shell32
ord16
ord155
SHGetIDListFromObject
SHCreateShellItemArrayFromDataObject
user32
SetMenuDefaultItem
InsertMenuW
LoadStringW
shlwapi
ord219
SHGetValueW
StrChrW
advapi32
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
EventWriteTransfer
EventUnregister
EventRegister
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
LoaderV6/loaderV6.exe.exe windows:6 windows x64 arch:x64
07361a3a7f515bf56ca93120b2aca73b
Code Sign
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate
IssuerCN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before25-05-2021 00:00Not After31-12-2028 23:59SubjectCN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate
IssuerCN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GBNot Before22-03-2021 00:00Not After21-03-2036 23:59SubjectCN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
12:1c:77:48:63:e3:ba:8e:7b:8b:f7:55:97:87:47:aeCertificate
IssuerCN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GBNot Before06-09-2022 00:00Not After05-09-2025 23:59SubjectCN=BLACKBIRD SECURE BROWSING LTD,O=BLACKBIRD SECURE BROWSING LTD,ST=London,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03-05-2023 00:00Not After02-08-2034 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
52:94:76:66:05:26:e4:d4:a3:14:86:23:a7:f3:21:f8:8b:05:5e:5e:0b:67:c2:ea:c7:d1:b0:41:7a:24:77:6cSigner
Actual PE Digest52:94:76:66:05:26:e4:d4:a3:14:86:23:a7:f3:21:f8:8b:05:5e:5e:0b:67:c2:ea:c7:d1:b0:41:7a:24:77:6cDigest Algorithmsha256PE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetThreadPriority
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateWaitableTimerA
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Sections
.text Size: 22.3MB - Virtual size: 22.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27.6MB - Virtual size: 27.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.6MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 620KB - Virtual size: 619KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 364KB - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
LoaderV6/mpvis.DLL.dll regsvr32 windows:10 windows x64 arch:x64
f3f615ca71f6738391d50074e8501505
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
mpvis.pdb
Imports
msvcrt
_finite
wcschr
wcspbrk
memcpy_s
_vsnwprintf
__CxxFrameHandler3
_onexit
sqrt
sinf
sin
memset
memcmp
memcpy
__dllonexit
_unlock
cosf
cos
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
rand
_wcsicmp
time
srand
wcscpy_s
realloc
wcscat_s
malloc
free
__C_specific_handler
acosf
atan2
atan2f
sqrtf
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
kernel32
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
DisableThreadLibraryCalls
HeapDestroy
lstrcpyW
LoadLibraryW
SetEvent
WaitForSingleObject
CloseHandle
VirtualFree
QueryPerformanceFrequency
QueryPerformanceCounter
HeapFree
GetCurrentProcess
LoadLibraryExA
EncodePointer
HeapAlloc
DecodePointer
GetProcessHeap
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
lstrlenW
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualProtect
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
DeleteCriticalSection
RaiseException
IsProcessorFeaturePresent
lstrlenA
GetVersionExW
LockResource
FindResourceW
GetModuleHandleA
LoadLibraryA
OutputDebugStringA
MultiByteToWideChar
lstrcpynW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
TraceMessage
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExA
RegQueryValueExA
ole32
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
oleaut32
LoadRegTypeLi
LoadTypeLi
SysStringLen
RegisterTypeLi
VarUI4FromStr
SysAllocString
SysFreeString
SysAllocStringLen
user32
DefWindowProcW
SetCursor
CallNextHookEx
RegisterClassW
IsWindowUnicode
ShowWindow
UpdateWindow
PostMessageW
SetWindowsHookExW
DestroyWindow
UnhookWindowsHookEx
CallWindowProcW
SetWindowLongPtrW
GetWindowLongPtrW
LoadCursorW
GetSysColor
CharNextW
CharPrevW
GetWindowRect
GetClientRect
GetDC
ReleaseDC
GetAsyncKeyState
IsWindow
GetSystemMetrics
MonitorFromWindow
IsRectEmpty
FillRect
SetRectEmpty
CopyRect
CreateWindowExW
gdi32
StretchBlt
TextOutW
SetTextAlign
SetTextColor
SetStretchBltMode
GetStockObject
DeleteObject
SetBkColor
gdiplus
GdipDrawRectangleI
GdipDrawLineI
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetPathGradientCenterPointI
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipFillRectangleI
GdipCreatePathGradientFromPath
GdipAddPathEllipseI
GdipStartPathFigure
GdipDeletePath
GdipCreatePath
GdipDeletePen
GdipCreatePen2
GdipCreatePen1
GdipCreateLineBrushFromRectI
GdipCreateSolidFill
GdipCloneBrush
GdipDeleteBrush
GdipFree
GdipSetPathGradientCenterColor
GdipSetPathGradientFocusScales
GdipAlloc
winmm
timeBeginPeriod
timeGetTime
timeEndPeriod
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
LoaderV6/wmpnssci.dll.dll regsvr32 windows:10 windows x64 arch:x64
e0e3379116ca05dddb5fa91e126bbb12
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
wmpnssci.pdb
Imports
msvcrt
_purecall
calloc
memmove_s
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
__CxxFrameHandler3
_CxxThrowException
memcmp
memcpy
memset
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
?terminate@@YAXXZ
_initterm
_amsg_exit
towupper
wcschr
iswdigit
iswalpha
wcsncmp
_wcsnicmp
_wcslwr_s
wcstol
_XcptFilter
__C_specific_handler
_callnewh
wcscmp
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtDeleteKey
NtQueryKey
api-ms-win-core-registry-l1-1-0
RegGetKeySecurity
RegDeleteKeyExW
RegSetKeySecurity
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegEnumValueW
user32
DrawTextW
DrawFocusRect
FillRect
CharUpperBuffW
GetWindowTextW
GetDlgCtrlID
GetWindowTextLengthW
GetClassNameW
IsWindowEnabled
GetFocus
UnregisterClassA
GetCapture
ScreenToClient
GetCursorPos
UpdateWindow
SetFocus
SetCapture
ReleaseCapture
CreateWindowExW
ShowWindow
GetActiveWindow
GetIconInfo
SendDlgItemMessageW
GetWindowLongW
SetWindowLongW
SetWindowPos
GetClientRect
OffsetRect
SetRectEmpty
PtInRect
SetCursor
CallWindowProcW
DefWindowProcW
SetWindowTextW
EnableWindow
GetDlgItem
GetParent
SendMessageW
LoadCursorW
ReleaseDC
GetDC
EndPaint
BeginPaint
GetWindowLongPtrW
DestroyWindow
SetWindowLongPtrW
IsWindow
TrackMouseEvent
wvsprintfW
CharNextW
GetSysColor
InvalidateRect
sspicli
GetUserNameExW
ws2_32
InetPtonW
gdi32
SelectObject
SetBkMode
SetTextColor
GetDeviceCaps
GetTextExtentPoint32W
GetObjectW
DeleteObject
CreateFontIndirectW
GetStockObject
gdiplus
GdipGetImageGraphicsContext
GdipDisposeImage
GdipSetImageAttributesWrapMode
GdipSetInterpolationMode
GdipCreateImageAttributes
GdipAlloc
GdipFree
GdipDrawImageRectRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHICON
GdiplusShutdown
GdipCreateHBITMAPFromBitmap
GdipDeleteGraphics
GdiplusStartup
GdipDisposeImageAttributes
kernel32
GetModuleFileNameW
FindResourceExW
LoadResource
GetProcAddress
IsWow64Process
OpenEventW
ResetEvent
LocalFree
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
DelayLoadFailureHook
ResolveDelayLoadedAPI
ReleaseSRWLockExclusive
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
GetCurrentProcess
VirtualFree
GetLastError
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
CompareStringOrdinal
LockResource
SetLastError
GetCurrentThreadId
lstrlenW
MulDiv
CompareStringW
CloseHandle
Sleep
CreateEventW
CreateThread
WaitForSingleObject
SetEvent
WaitForMultipleObjects
HeapSize
HeapReAlloc
HeapFree
GetModuleHandleW
HeapAlloc
GetProcessHeap
HeapDestroy
lstrcmpiW
LoadLibraryExW
RaiseException
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
SizeofResource
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 216KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1024B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 221KB - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ