x64_x32_installer__v3[.]0[.]7[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

x64_x32_installer__v3.0.7.zip
Size

33.0MB
MD5

3334700b965f9fe162487d90b240fae9
SHA1

cb2e4f7665c149ad98fb5de71a8e79595445ba82
SHA256

3ecf109f260347752c3fb6d244bbe2a693ab31873f8bbcd91fb7663ac45435f8
SHA512

542b7a6d062c57c34506637e5f6e67f2ff23f4fc6844067f9826e4abdc23bc55cab0d233100d066986c6f9db0945c73817227549e971af9ddfdd6231cbf5f818
SSDEEP

786432:qZhjhbvoGB1D+fDtoKTBlETmEUM0KssXmFuFbjR+3TvnyfRnbUZ6daQ:qZhjh6plL1KAcFhMnGBc6f

Score

3^/10

Malware Config

Signatures

Unsigned PE 18 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WmpDui/VideoHandlers.dll
unpack001/WmpDui/WmpDui.dll
unpack001/WmpDui/vmdevicehost.dll
unpack001/WmpDui/wmploc.DLL
unpack001/ddisplay/DDDS.dll
unpack001/ddisplay/ddisplay.dll
unpack001/ddisplay/fveapi.dll
unpack001/ddisplay/fwmdmcsp.dll
unpack001/iedkcs32/IdCtrls.dll
unpack001/iedkcs32/IdListen.dll
unpack001/iedkcs32/McpManagementProxy.dll
unpack001/iedkcs32/iedkcs32.dll
unpack001/iedkcs32/mbussdapi.dll
unpack001/mbussdapi/McpManagementProxy.dll
unpack001/mbussdapi/mbussdapi.dll
unpack001/mbussdapi/netprovfw.dll
unpack001/mbussdapi/rdpcore.dll
unpack001/mbussdapi/srmclient.dll

Files

x64_x32_installer__v3.0.7.zip
.zip
WmpDui/VideoHandlers.dll
.dll windows:10 windows x64 arch:x64

d8665a89cb65b8d90996d9f921641fab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

VideoHandlers.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_bsearch_s
_o_free
_o_malloc
_o_qsort
_o_realloc
_o_strncpy_s
_o_terminate
__C_specific_handler
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o__crt_atexit
_o___std_exception_copy
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__execute_onexit_table
_o__errno
_o___stdio_common_vswprintf
__std_terminate
_CxxThrowException
__CxxFrameHandler4
_o___stdio_common_vsnprintf_s
__CxxFrameHandler3
memcpy

api-ms-win-crt-string-l1-1-0

memset
strnlen
wcsnlen
wcsncmp

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObject
InitializeCriticalSectionEx
CreateSemaphoreExW
ReleaseMutex
SetEvent
ResetEvent
AcquireSRWLockShared
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
DeleteCriticalSection
InitializeCriticalSection
ReleaseSemaphore
CreateEventW
CreateEventExW
CreateMutexExW
InitializeSRWLock
OpenSemaphoreW
WaitForSingleObjectEx

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TlsSetValue
TlsGetValue
CreateThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsDeleteString
WindowsConcatString
WindowsGetStringRawBuffer

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoTaskMemFree
CoGetMalloc
CoTaskMemRealloc
CoDecrementMTAUsage
CoWaitForMultipleHandles
CoIncrementMTAUsage
CoUninitialize
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoCreateInstance

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-shcore-registry-l1-1-0

SHGetValueW
SHSetValueW

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoActivateInstance
RoGetActivationFactory
RoUninitialize

api-ms-win-shcore-thread-l1-1-0

SHCreateThread

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoTransformError

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegSetKeySecurity
RegGetValueW

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize

api-ms-win-shcore-scaling-l1-1-1

ord244

ntdll

RtlUnsubscribeWnfStateChangeNotification
NtPowerInformation
RtlSubscribeWnfStateChangeNotification

api-ms-win-power-setting-l1-1-0

PowerReadDCValue
PowerWriteDCValueIndex
PowerSetActiveScheme
PowerGetActiveScheme

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-featurestaging-l1-1-0

GetFeatureEnabledState
UnsubscribeFeatureStateChangeNotification
RecordFeatureUsage
SubscribeFeatureStateChangeNotification

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-storage-exports-internal-l1-1-0

SHGetKnownFolderIDList

api-ms-win-rtcore-ntuser-window-l1-1-0

TranslateMessage
SendMessageW
UnregisterClassW
DestroyWindow
GetMessageW
GetWindowRect
AllowSetForegroundWindow
PostQuitMessage
DefWindowProcW
RegisterClassExW
CreateWindowExW
DispatchMessageW

d3d11

D3D11CreateDevice

api-ms-win-ntuser-sysparams-l1-1-0

QueryDisplayConfig
GetDisplayConfigBufferSizes
EnumDisplayDevicesW
DisplayConfigGetDeviceInfo

api-ms-win-ntuser-rectangle-l1-1-0

PtInRect
IntersectRect

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
GetSetting
NotifyVideoHandler

Sections

.text
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WmpDui/WMVSDECD.DLL
.dll regsvr32 windows:10 windows x64 arch:x64

5df7e5d90b454fbbf0c0a1171fe68de8

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:73:91:3e:b5:51:0e:96:be:8a:38:7f:89:bd:7e:17:18:af:cc:28:0a:ce:b7:8f:ad:9c:99:3a:31:bf:06:78
Signer

Actual PE Digest

d0:73:91:3e:b5:51:0e:96:be:8a:38:7f:89:bd:7e:17:18:af:cc:28:0a:ce:b7:8f:ad:9c:99:3a:31:bf:06:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMVSDECD.pdb

Imports

msvcrt

abort
printf
_beginthreadex
_lock
__C_specific_handler
_initterm
_unlock
_amsg_exit
__dllonexit
_XcptFilter
free
_callnewh
_onexit
_purecall
malloc
_vsnwprintf
sprintf_s
strcat_s
memcpy
puts
memcmp
memset

mfplat

MFTRegister
MFTUnregister

api-ms-win-core-synch-l1-1-0

SetEvent
ReleaseSRWLockExclusive
ReleaseSemaphore
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
LoadLibraryExW
LoadLibraryExA
FreeLibrary
GetProcAddress

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegSetValueExA
RegDeleteTreeW
RegQueryValueExW
RegOpenKeyExW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-registry-l2-1-0

RegSetValueA
RegOpenKeyW
RegCreateKeyW

api-ms-win-core-synch-l1-2-0

SignalObjectAndWait
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
GetExitCodeThread
GetCurrentProcess
SetThreadPriority
TerminateProcess
GetThreadPriority
GetCurrentProcessId
GetCurrentThreadId
CreateThread

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
GetVersion

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetLastError

ws2_32

ntohl
htonl

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects
CreateSemaphoreW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

LocalFree

msdmo

DMOUnregister
MoInitMediaType
DMORegister
MoCopyMediaType
MoFreeMediaType

api-ms-win-ntuser-rectangle-l1-1-0

IsRectEmpty

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc

api-ms-win-core-processtopology-obsolete-l1-1-0

GetProcessAffinityMask
SetThreadAffinityMask

Exports

Exports

CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 261KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.no_bbt
Size: 1024B - Virtual size: 633B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WmpDui/WmpDui.dll
.dll windows:10 windows x64 arch:x64

aa89fff9644c3a9f5ba2213a06bd55d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WMPDUI.pdb

Imports

msvcrt

ceil
cosf
floor
log10f
memcpy
memmove
memset
pow
_resetstkoflw
_wcsicmp
_beginthreadex
_purecall
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
qsort
_wcsnicmp
sinf

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

kernel32

TlsSetValue
GetModuleFileNameA
LoadLibraryA
WaitForMultipleObjectsEx
GetExitCodeThread
ResetEvent
InitializeCriticalSection
GetSystemInfo
TlsFree
FlushInstructionCache
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
VirtualFree
DelayLoadFailureHook
ResolveDelayLoadedAPI
MulDiv
GetVersionExA
GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls
TlsGetValue
SetLastError
GetLastError
FreeLibrary
QueryPerformanceFrequency
TlsAlloc
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
FindAtomW
Sleep
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetAtomNameW
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
SetEvent
CloseHandle
CreateEventA
WaitForSingleObject
InitializeSListHead
InterlockedPushEntrySList
QueryDepthSList
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedPopEntrySList
InterlockedFlushSList
DeleteAtom
AddAtomW

user32

PostThreadMessageA
DrawTextW
WindowFromDC
TranslateMessage
GetKeyboardState
GetParent
EndPaint
BeginPaint
GetPointerType
PostMessageA
GetMessagePos
GetCursorInfo
TrackMouseEvent
SetCapture
InvalidateRect
GetDC
GetWindowLongPtrW
CallWindowProcA
SetWindowLongPtrA
GetWindowDC
ReleaseCapture
ChildWindowFromPointEx
GetCapture
ScreenToClient
GetCursorPos
SetFocus
GetFocus
GetWindowRect
ReleaseDC
GetDoubleClickTime
PtInRect
GetKeyState
GetSystemMetrics
OffsetRect
UnionRect
IsRectEmpty
IntersectRect
MsgWaitForMultipleObjectsEx
FillRect
CallWindowProcW
DefWindowProcA
SetWindowLongPtrW
GetWindowLongPtrA
WaitMessage
PeekMessageW
PeekMessageA
GetMessageW
GetMessageA
SetRectEmpty
SendMessageA
SystemParametersInfoA
GetMonitorInfoW
ClientToScreen
GetClientRect
IsWindow
DispatchMessageA
SendMessageW
GetMessageTime
RegisterWindowMessageA

gdi32

CreateRectRgn
CreateDCA
GetObjectType
GetDIBits
GetSystemPaletteEntries
CombineRgn
CreatePolygonRgn
SelectClipRgn
StretchDIBits
SetViewportOrgEx
GetObjectA
OffsetRgn
GetViewportOrgEx
GetRandomRgn
SetBrushOrgEx
GetBrushOrgEx
GetCurrentObject
GetDeviceCaps
SaveDC
ModifyWorldTransform
GetTextExtentExPointW
GetTextExtentPoint32W
CreateFontIndirectW
ExtTextOutW
TextOutW
GdiFlush
CreateDIBSection
GetClipBox
SetRectRgn
BitBlt
ExtSelectClipRgn
IntersectClipRect
GetClipRgn
GetWorldTransform
RealizePalette
SelectPalette
SetWorldTransform
SetGraphicsMode
GetWindowExtEx
GetViewportExtEx
DeleteDC
PatBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreatePen
CreateSolidBrush
DeleteObject
RestoreDC
GetPixel

advapi32

GetTraceEnableLevel
RegisterTraceGuidsA
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
TraceEvent

Exports

Exports

AddGadgetMessageHandler
AddLayeredRef
AdjustClipInsideRef
AttachWndProcA
AttachWndProcW
AutoTrace
BuildAnimation
BuildDropTarget
BuildInterpolation
CacheDWriteRenderTarget
ChangeCurrentAnimationScenario
ClearPushedOpacitiesFromGadgetTree
ClearTopmostVisual
CreateAction
CreateGadget
CustomGadgetHitTestQuery
DUserBuildGadget
DUserCastClass
DUserCastDirect
DUserCastHandle
DUserDeleteGadget
DUserFindClass
DUserFlushDeferredMessages
DUserFlushMessages
DUserGetAlphaPRID
DUserGetGutsData
DUserGetRectPRID
DUserGetRotatePRID
DUserGetScalePRID
DUserInstanceOf
DUserPostEvent
DUserPostMethod
DUserRegisterGuts
DUserRegisterStub
DUserRegisterSuper
DUserSendEvent
DUserSendMethod
DUserStopAnimation
DUserStopPVLAnimation
DeleteHandle
DestroyPendingDCVisuals
DetachGadgetVisuals
DetachWndProc
DisableContainerHwnd
DllMain
DrawGadgetTree
EnsureAnimationsEnabled
EnsureGadgetTransInitialized
EnumGadgets
FindGadgetFromPoint
FindGadgetMessages
FindStdColor
FireGadgetMessages
ForwardGadgetMessage
FreeGdiDxInteropStagingBuffer
GadgetTransCompositionChanged
GadgetTransSettingChanged
GetActionTimeslice
GetCachedDWriteRenderTarget
GetDUserModule
GetDebug
GetFinalAnimatingPosition
GetGadget
GetGadgetAnimation
GetGadgetBitmap
GetGadgetBufferInfo
GetGadgetCenterPoint
GetGadgetFlags
GetGadgetFocus
GetGadgetLayerInfo
GetGadgetMessageFilter
GetGadgetProperty
GetGadgetRect
GetGadgetRgn
GetGadgetRootInfo
GetGadgetRotation
GetGadgetScale
GetGadgetSize
GetGadgetStyle
GetGadgetTicket
GetGadgetVisual
GetMessageExA
GetMessageExW
GetStdColorBrushF
GetStdColorBrushI
GetStdColorF
GetStdColorI
GetStdColorName
GetStdColorPenF
GetStdColorPenI
GetStdPalette
InitGadgetComponent
InitGadgets
InvalidateGadget
InvalidateLayeredDescendants
IsGadgetParentChainStyle
IsInsideContext
IsStartDelete
LookupGadgetTicket
MapGadgetPoints
PeekMessageExA
PeekMessageExW
RegisterGadgetMessage
RegisterGadgetMessageString
RegisterGadgetProperty
ReleaseDetachedObjects
ReleaseLayeredRef
ReleaseMouseCapture
RemoveClippingImmunityFromVisual
RemoveGadgetMessageHandler
RemoveGadgetProperty
ResetDUserDevice
ScheduleGadgetTransitions
SetActionTimeslice
SetAtlasingHints
SetGadgetBufferInfo
SetGadgetCenterPoint
SetGadgetFillF
SetGadgetFillI
SetGadgetFlags
SetGadgetFocus
SetGadgetFocusEx
SetGadgetLayerInfo
SetGadgetMessageFilter
SetGadgetOrder
SetGadgetParent
SetGadgetProperty
SetGadgetRect
SetGadgetRootInfo
SetGadgetRotation
SetGadgetScale
SetGadgetStyle
SetHardwareDeviceUsage
SetMinimumDCompVersion
SetRestoreCachedLayeredRefFlag
SetTransitionVisualProperties
SetWindowResizeFlag
UnregisterGadgetMessage
UnregisterGadgetMessageString
UnregisterGadgetProperty
UtilBuildFont
UtilDrawBlendRect
UtilDrawOutlineRect
UtilGetColor
UtilSetBackground
WaitMessageEx

Sections

.text
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WmpDui/vmdevicehost.dll
.dll windows:10 windows x64 arch:x64

55df1397ebb86b43492d3f28e84cef4c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

VmDeviceHost.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
__std_terminate
memmove
_o_abort
_o_free
_o_malloc
_o_terminate
_o_wcstod
_o_wcstoull
__CxxFrameHandler3
_CxxThrowException
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
__C_specific_handler
__CxxFrameHandler4
memcpy
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy

api-ms-win-crt-string-l1-1-0

wcsncmp
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
GetProcAddress

api-ms-win-core-synch-l1-1-0

CreateMutexExW
SetEvent
DeleteCriticalSection
AcquireSRWLockShared
ResetEvent
ReleaseSRWLockShared
LeaveCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSemaphore
WaitForSingleObject
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
InitializeSRWLock
EnterCriticalSection
CreateSemaphoreExW
AcquireSRWLockExclusive
ReleaseMutex

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
SignalObjectAndWait
InitOnceExecuteOnce
WakeAllConditionVariable
SleepConditionVariableSRW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
GetExitCodeThread
TerminateProcess

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlCaptureContext
RtlCaptureStackBackTrace

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventWrite
EventRegister
EventSetInformation
EventUnregister
EventEnabled

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-psapi-l1-1-0

K32GetModuleInformation

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoEnableCallCancellation
CoCancelCall
CoDisableCallCancellation
CoTaskMemFree
CoInitializeSecurity

rpcrt4

UuidCompare

oleaut32

SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData

api-ms-win-security-base-l1-1-0

MakeAbsoluteSD
InitializeSid
SetSecurityDescriptorGroup
GetTokenInformation
CopySid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetSidLengthRequired
GetSidSubAuthority
SetSecurityDescriptorOwner
GetLengthSid
GetSecurityDescriptorDacl

api-ms-win-security-provider-l1-1-0

GetSecurityInfo
SetEntriesInAclW
SetSecurityInfo

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-memory-l1-1-0

MapViewOfFile
VirtualQuery
UnmapViewOfFile

Exports

Exports

HdvCreateDeviceInstance
HdvCreateGuestMemoryAperture
HdvCreateSectionBackedMmioRange
HdvDeliverGuestInterrupt
HdvDestroyGuestMemoryAperture
HdvDestroySectionBackedMmioRange
HdvInitializeDeviceHost
HdvInitializeDeviceHostForProxy
HdvProxyDeviceHost
HdvReadGuestMemory
HdvRegisterDoorbell
HdvRegisterDoorbellPage
HdvTeardownDeviceHost
HdvUnregisterDoorbell
HdvUnregisterDoorbellPage
HdvWriteGuestMemory

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WmpDui/wmploc.DLL
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ddisplay/DDACLSys.dll
.dll windows:10 windows x64 arch:x64

738644f915ae8ff7abcf279e96d137b4

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:24

Not After

02/05/2020, 21:24

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:60:c4:9d:78:56:f4:74:d6:78:a9:d0:68:77:c1:5d:47:d9:b6:3d:71:87:f8:23:fa:db:2a:1b:a7:a6:e3:45
Signer

Actual PE Digest

cf:60:c4:9d:78:56:f4:74:d6:78:a9:d0:68:77:c1:5d:47:d9:b6:3d:71:87:f8:23:fa:db:2a:1b:a7:a6:e3:45

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DDACLSys.pdb

Imports

msvcrt

_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
memcpy
wcscat_s
wcscpy_s
_wcsicmp
_vsnprintf
_vsnwprintf
__C_specific_handler
memset

api-ms-win-core-file-l1-1-0

GetFileAttributesW
FindVolumeClose
GetDriveTypeW
FindNextVolumeW
SetFilePointer
SetEndOfFile
GetFileSizeEx
GetVolumeInformationW
WriteFile
CreateFileW
FindFirstVolumeW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetLocalTime
GetWindowsDirectoryW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorControl
GetSecurityDescriptorDacl

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

advapi32

GetNamedSecurityInfoW
SetNamedSecurityInfoW

shlwapi

ord437

Exports

Exports

DDACLSys_Offline_Specialize
DDACLSys_Specialize

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ddisplay/DDDS.dll
.dll windows:10 windows x64 arch:x64

fb98b7f6d86ba1ce8a5e2f86dd754534

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

DDDS.pdb

Imports

msvcrt

_wtoi
fwprintf_s
fclose
memset
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_wfopen_s
_wcsicmp
_unlock
_lock
tolower
_initterm
free
_amsg_exit
_XcptFilter
wcsnlen
wcsncpy_s
memmove
??_V@YAXPEAX@Z
memcpy
iswalnum
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
swprintf_s
_callnewh
malloc
swscanf_s
wcstol
_vsnprintf_s
_errno
memmove_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
__C_specific_handler
__CxxFrameHandler3
floorf
logf
memcmp
pow

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
FreeLibrary

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemFree
CLSIDFromString
CoTaskMemAlloc
StringFromGUID2

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
InitializeSRWLock
CreateMutexExW
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
OpenSemaphoreW
InitializeCriticalSectionEx
EnterCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObjectEx
AcquireSRWLockShared
ReleaseSRWLockShared
ReleaseMutex
LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentProcessId
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetLocaleInfoW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventActivityIdControl
EventRegister
EventSetInformation
EventUnregister

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceComplete
Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetSystemDirectoryW

oleaut32

SysAllocStringLen
SysStringLen
SysFreeString
SysAllocString

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-file-l1-1-0

CreateFileW
CompareFileTime
WriteFile
DeleteFileW
GetTempFileNameW
CreateDirectoryW
GetFileSizeEx
ReadFile
GetFileAttributesW
GetFileSize

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegGetValueW
RegQueryValueExW
RegCloseKey

cabinet

ord43
ord33
ord40
ord35
ord45
ord30

api-ms-win-core-file-l2-1-0

MoveFileExW
ReplaceFileW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW
PathFileExistsW

api-ms-win-core-kernel32-legacy-l1-1-0

MulDiv

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRChrW
StrStrIW

api-ms-win-security-base-l1-1-0

GetTokenInformation
IsValidSid

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-memory-l1-1-0

OpenFileMappingW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW

api-ms-win-core-heap-l2-1-0

LocalFree

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 357KB - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ddisplay/ddisplay.dll
.dll windows:10 windows x64 arch:x64

57280ccbb15ed6a76ab76688b347430e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ddisplay.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o__configure_narrow_argv
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__cexit
_o__callnewh
__std_terminate
__CxxFrameHandler4
memcmp
__std_type_info_compare
memcpy

api-ms-win-crt-string-l1-1-0

memset

ntdll

RtlCaptureContext
EtwEventActivityIdControl
EtwEventRegister
EtwEventSetInformation
EtwEventWriteTransfer
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwEventUnregister
RtlSubscribeWnfStateChangeNotification
RtlGetDeviceFamilyInfoEnum
RtlInitUnicodeString
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlIsMultiSessionSku

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
FreeLibrary
GetProcAddress

api-ms-win-core-synch-l1-1-0

ReleaseMutex
ReleaseSemaphore
EnterCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateSemaphoreExW
LeaveCriticalSection
OpenSemaphoreW
ReleaseSRWLockShared
CreateMutexExW
AcquireSRWLockShared
CreateEventA
CreateEventExW
InitializeCriticalSectionEx
WaitForSingleObjectEx
WaitForSingleObject
DeleteCriticalSection
InitializeSRWLock

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateString
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsDuplicateString

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateErrorW
RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoTaskMemFree

api-ms-win-ntuser-sysparams-l1-1-0

DisplayConfigGetDeviceInfo

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

msvcp_win

_Mtx_unlock
_Mtx_lock
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?_Xlength_error@std@@YAXPEBD@Z
?_Throw_C_error@std@@YAXH@Z

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl
EventWriteTransfer

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

kernelbase

BaseFormatObjectAttributes

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ddisplay/fveapi.dll
.dll windows:10 windows x64 arch:x64

7ffd9fcfb183ddeba5202c5fb4d5fa11

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

fveapi.pdb

Imports

msvcrt

_stricmp
wcschr
iswascii
_scwprintf
??_V@YAXPEAX@Z
_wcsupr
time
wcsncpy_s
_errno
toupper
wcscpy_s
_wtempnam
_strnicmp
ceil
memcmp
memset
strcmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
_initterm
wcstoul
iswdigit
memmove_s
__C_specific_handler
memcpy_s
free
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
_wcsicmp
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
_vsnwprintf
??0exception@@QEAA@AEBQEBD@Z
??3@YAXPEAX@Z
wcsncat_s
_purecall
_callnewh
malloc
sprintf_s
wcscmp

ntdll

RtlSystemTimeToLocalTime
RtlTimeToTimeFields
RtlUnicodeStringToCountedOemString
RtlGenerate8dot3Name
RtlCreateSystemVolumeInformationFolder
RtlDosPathNameToNtPathName_U_WithStatus
NtPowerInformation
RtlCheckPortableOperatingSystem
NtQuerySystemEnvironmentValueEx
RtlInitUnicodeString
RtlCompareMemory
RtlUnsubscribeWnfStateChangeNotification
NtOpenFile
WinSqmSetDWORD
WinSqmAddToStreamEx
RtlPublishWnfStateData
NtQueryWnfStateData
RtlFreeUnicodeString
RtlStringFromGUID
NtClose
NtQueryValueKey
NtOpenKey
EtwEventWrite
EtwEventUnregister
EtwEventRegister
NtQueryVolumeInformationFile
NtQuerySystemInformation
RtlSetThreadErrorMode
RtlNtStatusToDosError
RtlSubscribeWnfStateChangeNotification
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIsMultiSessionSku
RtlLengthSid
NtQueryInformationFile

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceEnableFlags
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation
EventProviderEnabled

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleFileNameA
GetProcAddress
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
GetModuleHandleExW

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
DuplicateTokenEx
GetLengthSid
AllocateAndInitializeSid
FreeSid
ImpersonateSelf
CopySid
RevertToSelf
GetTokenInformation
CheckTokenMembership

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcess
TerminateProcess
OpenThreadToken
GetCurrentThread
SetThreadToken
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetLocalTime
GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
GetSystemWindowsDirectoryW
GetSystemTime
GetTickCount64

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

bcrypt

BCryptGenerateKeyPair
BCryptGetProperty
BCryptExportKey
BCryptGenerateSymmetricKey
BCryptImportKeyPair
BCryptFinalizeKeyPair
BCryptGetFipsAlgorithmMode
BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptSecretAgreement
BCryptDeriveKey
BCryptDestroySecret
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptDecrypt
BCryptEncrypt
BCryptSetProperty
BCryptDeriveKeyPBKDF2
BCryptDestroyKey

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegGetValueA
RegDeleteKeyExW
RegGetValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegUnLoadKeyW
RegDeleteValueW
RegSetValueExW
RegFlushKey
RegCloseKey
RegLoadKeyW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l1-1-0

CreateFileW
GetFileInformationByHandle
GetDriveTypeW
GetDiskFreeSpaceW
GetFileSizeEx
SetFileAttributesW
DeleteFileW
ReadFile
RemoveDirectoryW
GetVolumeInformationW
FileTimeToLocalFileTime
WriteFile
FlushFileBuffers
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
SetFilePointerEx
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetFileSize
CreateDirectoryW
GetLogicalDrives
GetVolumePathNameW
SetFilePointer
SetEndOfFile

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringW
CompareStringOrdinal

api-ms-win-core-synch-l1-1-0

CreateMutexExW
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
ReleaseMutex
InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSemaphore
AcquireSRWLockShared
OpenSemaphoreW
EnterCriticalSection
InitializeSRWLock
CreateEventW
WaitForSingleObject
CreateSemaphoreExW
LeaveCriticalSection
ReleaseSRWLockShared
WaitForSingleObjectEx
SetEvent
DeleteCriticalSection

api-ms-win-eventing-controller-l1-1-0

StartTraceW
ControlTraceW
EnableTraceEx2

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapSize
HeapFree

api-ms-win-core-localization-l1-2-0

FormatMessageW
IsDBCSLeadByte

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetTempPathW
GetVolumeNameForVolumeMountPointW

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
VirtualAlloc
VirtualFree

api-ms-win-devices-config-l1-1-1

CM_Unregister_Notification
CM_Register_Notification

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-com-l1-1-0

CoCreateGuid
CLSIDFromString
StringFromGUID2
CoUninitialize
CoInitializeEx
CoGetCallContext

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-service-private-l1-1-0

I_QueryTagInformation

api-ms-win-security-lsapolicy-l1-1-0

LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

FveAddAuthMethodInformation
FveAddAuthMethodSid
FveAddPredictiveTpmProtector
FveApplyGroupPolicy
FveApplyNkpCertChanges
FveAttemptAutoUnlock
FveAuthElementFromPassPhraseW
FveAuthElementFromPinW
FveAuthElementFromRecoveryPasswordW
FveAuthElementGetKeyFileNameW
FveAuthElementReadExternalKeyW
FveAuthElementToRecoveryPasswordW
FveAuthElementWriteExternalKeyW
FveBackupRecoveryInformationToAD
FveBackupRecoveryInformationToADEx
FveBindDataVolume
FveCanPinExceptionPolicyBeApplied
FveCanStandardUsersChangePassphraseByProxy
FveCanStandardUsersChangePin
FveCheckADRecoveryInfoBackupPolicy
FveCheckADRecoveryInfoBackupPolicyEx
FveCheckPassphrasePolicy
FveCheckTpmCapability
FveClearUserFlags
FveCloseHandle
FveCloseVolume
FveCommitChanges
FveCommitChangesEx
FveConversionDecrypt
FveConversionDecryptEx
FveConversionEncrypt
FveConversionEncryptEx
FveConversionEncryptPendingReboot
FveConversionEncryptPendingRebootEx
FveConversionPause
FveConversionResume
FveConversionStop
FveConversionStopEx
FveDecrementClearKeyCounter
FveDeleteAuthMethod
FveDeleteDeviceEncryptionOptOutForVolumeW
FveDisableDeviceLockoutState
FveDiscardChanges
FveDraCertPresentInRegistry
FveEnableRawAccess
FveEnableRawAccessEx
FveEnableRawAccessW
FveEraseDrive
FveEscrowEncryptedRecoveryKeyForRetailUnlock
FveFindFirstVolume
FveFindNextVolume
FveFlagsToProtectorType
FveGenerateNbp
FveGenerateNkpSessionKeys
FveGetAllowKeyExport
FveGetAuthMethodGuids
FveGetAuthMethodInformation
FveGetAuthMethodSid
FveGetAuthMethodSidInformation
FveGetClearKeyCounter
FveGetDataSet
FveGetDescriptionW
FveGetDeviceLockoutData
FveGetExternalKeyBlob
FveGetFipsAllowDisabled
FveGetFveMethod
FveGetFveMethodEDrv
FveGetFveMethodEx
FveGetIdentificationFieldW
FveGetIdentity
FveGetKeyPackage
FveGetRecoveryPasswordBackupInformation
FveGetSecureBootBindingState
FveGetStatus
FveGetStatusW
FveGetUserFlags
FveGetVolumeNameW
FveInitVolume
FveInitVolumeEx
FveInitializeDeviceEncryption
FveInitializeDeviceEncryption2
FveIsAnyDataVolumeBoundToOSVolume
FveIsBoundDataVolume
FveIsBoundDataVolumeToOSVolume
FveIsDeviceLockable
FveIsDeviceLockedOut
FveIsHardwareReadyForConversion
FveIsHybridVolume
FveIsHybridVolumeW
FveIsPassphraseCompatibleW
FveIsRecoveryPasswordGroupValidW
FveIsRecoveryPasswordValidW
FveIsSchemaExtInstalled
FveIsVolumeEncryptable
FveKeyManagement
FveLockDevice
FveLockVolume
FveLogRecoveryReason
FveNeedsDiscoveryVolumeUpdate
FveNotifyVolumeAfterFormat
FveOpenVolumeByHandle
FveOpenVolumeExW
FveOpenVolumeW
FveProtectorTypeToFlags
FveQuery
FveQueryDeviceEncryptionSupport
FveRecalculateOffsetsAndMoveMetadata
FveRegenerateNbpSessionKey
FveResetTpmDictionaryAttackParameters
FveRevertVolume
FveSaveRecoveryPasswordBackupFlag
FveSelectBestRecoveryPasswordByBackupInformation
FveServiceDiscoveryVolume
FveSetAllowKeyExport
FveSetDescriptionW
FveSetFipsAllowDisabled
FveSetFveMethod
FveSetIdentificationFieldW
FveSetRecoveryPasswordBackupInformation
FveSetUserFlags
FveSetupTpmCallback
FveSysClearUserFlags
FveSysCloseVolume
FveSysGetUserFlags
FveSysOpenVolumeW
FveSysSetUserFlags
FveUnbindAllDataVolumeFromOSVolume
FveUnbindDataVolume
FveUnlockVolume
FveUnlockVolumeAuthMethodSid
FveUnlockVolumeWithAccessMode
FveUpdateBandIdBcd
FveUpdateDeviceLockoutState
FveUpdateDeviceLockoutStateEx
FveUpdatePinW
FveUpgradeVolume
FveValidateDeviceLockoutState
FveValidateExistingPassphraseW
FveValidateExistingPinW
InternalFveIsVolumeEncrypted
NgscbCheckDmaSecurity
NgscbCheckDmaSecurityEx
NgscbCheckHSTIPrerequisitesVerified
NgscbCheckIsAOACDevice
NgscbCheckIsHSTIVerified
NgscbCheckPreventDeviceEncryption
NgscbCheckPreventDeviceEncryptionForAad
NgscbGetWinReConfiguration
NgscbIsHostOsOnRoamableDrive

Sections

.text
Size: 711KB - Virtual size: 710KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 186KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ddisplay/fwmdmcsp.dll
.dll windows:10 windows x64 arch:x64

880bf73caa9844ba74fdc7469a05785a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

FWMDMCSP.pdb

Imports

msvcrt

??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__C_specific_handler
_initterm
free
__dllonexit
_XcptFilter
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
memmove
memcpy
_lock
_callnewh
malloc
wcstok_s
memmove_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
_vsnprintf_s
_wcsicmp
toupper
_onexit
memcpy_s
memcmp
_CxxThrowException
??3@YAXPEAX@Z
_unlock
_vsnwprintf
??1exception@@UEAA@XZ
_purecall
__CxxFrameHandler3
_amsg_exit
memset

oleaut32

SysFreeString
VariantCopy
VariantChangeTypeEx
SysAllocString
VariantClear
VariantInit

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableFlags
UnregisterTraceGuids
TraceMessage

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
SetLastError
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
ReleaseSemaphore
ReleaseMutex
AcquireSRWLockShared
WaitForSingleObjectEx
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
CreateSemaphoreExW
LeaveCriticalSection
CreateMutexExW
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeSRWLock
OpenSemaphoreW
ReleaseSRWLockShared

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer

api-ms-win-core-com-l1-1-0

StringFromGUID2
CLSIDFromString
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

ntdll

RtlFreeSid

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-appmodel-runtime-l1-1-1

VerifyPackageFamilyName

api-ms-win-appmodel-identity-l1-2-0

AppContainerDeriveSidFromMoniker

fwpolicyiomgr

CalculateOpenPortOrAuthAppAddrStringSize2
OpenPortOrAuthAppAddrToStringInt2
StringToOpenPortOrAuthAppAddress2

firewallapi

FWGetGlobalConfig3
FWGetConfig
FWEnumFirewallRules
FWEnumDynamicKeywordRuleLinksByStore
FWEnumDynamicKeywordAddresses_Int
FWFreeDynamicKeywordAddressData0
FwBstrToInterfaceTypes
FwInterfaceTypesToBstr
FwStringToAddresses
FwEmptyWFAddresses
FwGetAddressesAsString
FwBstrToPorts
FWUpdateDynamicKeywordAddress_Int
FWAddDynamicKeywordAddress_Int
FWDeleteDynamicKeywordAddress_Int
FWSetConfig
FWSetGlobalConfig2
FWSetFirewallRule
FWSetFirewallRuleWithRemoteDynamicKeywordAddresses
FWAddFirewallRule
FWAddFirewallRuleWithRemoteDynamicKeywordAddresses
FWDeleteFirewallRule
FWClosePolicyStore
FWFreeDynamicKeywordRuleLinks
FWFreeFirewallRulesByHandle
FWOpenPolicyStore

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventProviderEnabled
EventSetInformation
EventUnregister

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iedkcs32/IdCtrls.dll
.dll windows:10 windows x64 arch:x64

55a22f957d144c9ba6c3e83db813b618

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

IdCtrls.pdb

Imports

msvcrt

_vsnwprintf
memmove
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
_amsg_exit
_XcptFilter
free
wcsrchr
wcschr
wcsstr
_purecall
__C_specific_handler
_get_errno
_set_errno
_callnewh
memcpy_s
memcpy
memset

shlwapi

SHStrDupW
ord204
ord165
ord172
StrChrW
ord437
UrlEscapeW
ord199
ord176
ord219
ord487

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleExW
FindResourceExW
LockResource
LoadResource
GetModuleFileNameA
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

WaitForMultipleObjectsEx
CreateMutexExW
OpenSemaphoreW
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
SetEvent
CreateEventW
WaitForSingleObjectEx
ReleaseSemaphore
CreateSemaphoreExW
ReleaseMutex

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-localization-l1-2-0

GetThreadPreferredUILanguages
GetGeoInfoW
FormatMessageW
GetUserGeoID

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetVersionExW
GetTickCount

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

api-ms-win-core-com-l1-1-0

CoCreateInstance
PropVariantClear
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData
CoWaitForMultipleHandles
CoGetApartmentType
StringFromGUID2
CoGetMalloc
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegGetValueW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernel32

CreateActCtxW
FindActCtxSectionStringW
QueryActCtxW
DeactivateActCtx
ActivateActCtx

ntdll

RtlGetSuiteMask
NtPowerInformation
WinSqmAddToStream

wininet

InternetCrackUrlW

dui70

InitProcessPriv
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ
?SetHeight@Element@DirectUI@@QEAAJH@Z
?SetWidth@Element@DirectUI@@QEAAJH@Z
?SetBackgroundColor@Element@DirectUI@@QEAAJK@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
?SetAccRole@Element@DirectUI@@QEAAJH@Z
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?Create@TouchHWNDElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z
InitThread
UnInitThread
CreateTouchTooltip
?EndDefer@Element@DirectUI@@QEAAXK@Z
UnInitProcessPriv
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
StrToID
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z

gdi32

CreateSolidBrush
DeleteObject

user32

SetWindowLongPtrW
RegisterClassW
CreateWindowExW
GetParent
GetKeyState
IsWindowUnicode
EnableWindow
IsWindowVisible
SetFocus
GetWindowLongPtrW
KillTimer
SetWindowPos
DefWindowProcW
DefWindowProcA
ShowWindow
SetTimer
DispatchMessageW
LoadCursorW
SetCursor
DestroyWindow
TranslateMessage
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
GetClientRect
GetFocus
UpdateWindow

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iedkcs32/IdListen.dll
.dll windows:10 windows x64 arch:x64

7667380c6084eba4deee09f2a89c9ca5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

IdListen.pdb

Imports

msvcrt

__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
_onexit
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
_callnewh
malloc
??1type_info@@UEAA@XZ
wcsncpy_s
free
memcmp
__RTDynamicCast
_wtoi
_wcsicmp
_wcsupr
_vsnwprintf
memcpy
_purecall
??_V@YAXPEAX@Z
__C_specific_handler
__CxxFrameHandler3
??3@YAXPEAX@Z
memset

ntdll

WinSqmAddToStream
RtlInitializeResource
RtlDeleteResource
RtlAcquireResourceExclusive
RtlReleaseResource
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
WinSqmIsOptedIn
EtwTraceMessage
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

kernel32

SetEvent
LocalFree
LocalAlloc
GetComputerNameExW
CompareStringOrdinal
WaitForSingleObject
CloseHandle
CreateEventW
CreateThread
WaitForMultipleObjects
CreateWaitableTimerW
SetWaitableTimer
ResetEvent
CreateDirectoryW
GetSystemTime
DeleteFileW
SystemTimeToFileTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetVersionExW
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter

advapi32

RegNotifyChangeKeyValue
RegCloseKey
EventUnregister
EventRegister
RegOpenKeyExW
EventWriteTransfer
RegGetValueW

user32

UnregisterClassA

ole32

StringFromGUID2
CoCreateInstance
CoCreateGuid
CoUninitialize
CoInitializeEx
PropVariantClear
CoTaskMemAlloc
CoSetProxyBlanket
IIDFromString
CoTaskMemFree

shell32

SHGetKnownFolderPath

xmllite

CreateXmlWriter
CreateXmlReader

netapi32

NetLocalGroupDelMembers
NetLocalGroupAddMembers

propsys

PSCreateMemoryPropertyStore
PropVariantToGUID

shlwapi

SHStrDupW
ord12
SHCreateStreamOnFileW

crypt32

CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CryptStringToBinaryW
CryptBinaryToStringW
CertGetNameStringW
CertFreeCertificateContext
CertCompareCertificate
CertCreateCertificateContext
CertCreateSelfSignCertificate
CryptAcquireCertificatePrivateKey
CertStrToNameW
CertFindCertificateInStore
CertDeleteCertificateFromStore
CryptEncodeObject
CertCompareCertificateName

ncrypt

NCryptFinalizeKey
NCryptSetProperty
NCryptCreatePersistedKey
NCryptOpenStorageProvider
NCryptDeleteKey
NCryptFreeObject
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iedkcs32/McpManagementProxy.dll
.dll regsvr32 windows:10 windows x64 arch:x64

5205866b226d328a00560258b15ca67f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

McpManagementProxy.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcmp
__C_specific_handler
_o___std_type_info_destroy_list

api-ms-win-crt-string-l1-1-0

memset

rpcrt4

NdrDllRegisterProxy
CStdStubBuffer_Invoke
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
NdrStubCall3
CStdStubBuffer_IsIIDSupported
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
CStdStubBuffer_Connect
NdrCStdStubBuffer2_Release
CStdStubBuffer_CountRefs
NdrOleFree
NdrDllUnregisterProxy
NdrDllGetClassObject
NdrOleAllocate
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow

api-ms-win-core-com-midlproxystub-l1-1-0

CStdStubBuffer2_Connect
CStdStubBuffer2_Disconnect
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient4
ObjectStublessClient8
ObjectStublessClient3
CStdStubBuffer2_CountRefs
ObjectStublessClient11
ObjectStublessClient7
NdrProxyForwardingFunction3
ObjectStublessClient6
ObjectStublessClient12
ObjectStublessClient5
CStdStubBuffer2_QueryInterface

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iedkcs32/iedkcs32.dll
.dll windows:10 windows x64 arch:x64

e6e49d6889354a9551fb83ea694e53da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

iedkcs32.pdb

Imports

msvcrt

_purecall
wcsncpy_s
wcscpy_s
_vsnwprintf_s
wcsnlen
strnlen
isalnum
rand_s
memcmp
_wcsicmp
_vsnwprintf
sprintf_s
memcpy
_onexit
__dllonexit
_unlock
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_callnewh
malloc
free
wcsncmp
wcschr
iswalpha
memcpy_s
_wcsnicmp
_wtoi
_vsnprintf
_ultow_s
memset

api-ms-win-downlevel-ole32-l1-1-0

CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoInitializeEx

iertutil

ord701
ord687
ord597
ord398
ord594
ord793
ord690
ord134
ord50
CreateIUriBuilder
CreateUri
ord791
ord57
ord796
ord682
ord111
ord110
ord683
ImpersonateUser
RevertImpersonate
ord39
ord654
ord652
ord662
ord672
ord656
ord675
ord665
ord651
ord655
ord657
ord650
ord678
ord653
ord660
ord677

kernel32

LocalReAlloc
LocalAlloc
ReadFile
lstrcmpiA
GetSystemDirectoryW
GetVersion
IsDBCSLeadByte
WriteFile
FlushFileBuffers
GetCurrentProcess
GetVersionExA
GetCurrentProcessId
HeapAlloc
GetLocalTime
GetModuleFileNameA
CreateSemaphoreExW
SetLastError
ReleaseSemaphore
GetCurrentThreadId
ReleaseMutex
FormatMessageW
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
GetModuleHandleW
DebugBreak
IsDebuggerPresent
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetTickCount
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
MoveFileW
EnterCriticalSection
GetProductInfo
LeaveCriticalSection
InitializeCriticalSection
GetVersionExW
GetUserPreferredUILanguages
DeleteCriticalSection
LocaleNameToLCID
CreateMutexW
GetFileSize
GetLastError
RaiseException
SetFileAttributesW
CreateDirectoryW
SetFilePointer
CreateFileW
CopyFileW
DeleteFileW
GetWindowsDirectoryW
GetModuleFileNameW
CompareStringW
GetExitCodeThread
WaitForSingleObject
VerifyVersionInfoW
CreateThread
LocalFree
GetFileAttributesW
CloseHandle
WritePrivateProfileStringW
WideCharToMultiByte
MultiByteToWideChar
DisableThreadLibraryCalls
CompareStringA
GetProcessHeap
FreeLibrary
GetProcAddress
GetModuleHandleExW
HeapFree
GetPrivateProfileIntW
FindClose
FindNextFileW
FindFirstFileW
GetPrivateProfileSectionW
LockResource
LoadResource
SizeofResource
FindResourceExW
GetNativeSystemInfo
ExpandEnvironmentStringsW
IsWow64Process
DecodePointer
InitOnceExecuteOnce
RemoveDirectoryW
GetSystemInfo
GetPrivateProfileStringW
GlobalFree
LoadLibraryExW
DelayLoadFailureHook
LoadLibraryExA
QueueUserWorkItem
QueryPerformanceFrequency
FlushViewOfFile
MapViewOfFile
CreateFileMappingW
LCMapStringW
GetFullPathNameW
DuplicateHandle
OpenMutexW
GetFileSizeEx
LoadLibraryW
GetCurrentDirectoryW
UnmapViewOfFile
SetUnhandledExceptionFilter

user32

CharLowerW
CharNextW
SendMessageTimeoutW
CharLowerBuffW
SetCursor
LoadCursorW
KillTimer
GetMessageW
SetTimer
EndDialog
SendDlgItemMessageW
DestroyIcon
DialogBoxParamW
LoadImageW
SendNotifyMessageW
GetWindow
PostMessageW
GetClassNameA
GetTopWindow
LoadStringW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
GetDesktopWindow

advapi32

EventUnregister
CryptSetKeyParam
CryptDeriveKey
CryptGetKeyParam
CryptEncrypt
AllocateAndInitializeSid
FreeSid
RegEnumKeyW
ConvertStringSidToSidW
RegGetValueW
EventWriteTransfer
EventWriteEx
ConvertSidToStringSidW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CloseServiceHandle
EnumServicesStatusExW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeNameW
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
SetFileSecurityW
CryptVerifySignatureW
CryptSetHashParam
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
CopySid
GetLengthSid
RegSaveKeyW
RegQueryInfoKeyW
RevertToSelf
ImpersonateLoggedOnUser
RegEnumValueW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
EventRegister
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptGenRandom

shlwapi

StrCmpNIA
StrCmpNA
UrlEscapeW
UrlUnescapeW
SHStrDupW
ord433
StrStrW
ord219
ord487
ord217
UrlApplySchemeW
UrlCreateFromPathW
ord215
ord12
ord158
SHDeleteValueW
UrlCanonicalizeW
ord2
ChrCmpIA
SHSetValueW
SHGetValueW
StrCmpW
SHDeleteKeyW
StrCmpNW
PathIsFileSpecW
StrToIntExW
PathFileExistsW
PathRemoveFileSpecW
ord553
StrCmpIW
PathIsPrefixW
StrStrIW
PathFindFileNameW
StrCmpNIW
SHRegGetValueW
SHDeleteEmptyKeyW
StrTrimW
StrRChrW
PathFindExtensionW
ord437
StrChrW
ord213
PathRemoveBlanksW
PathUnquoteSpacesW
StrChrIW
PathIsURLW
PathRemoveExtensionW
StrSpnW
SHQueryValueExW
StrDupW
StrRetToStrW

oleaut32

VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
VarBstrCat
VariantClear
VariantCopy
SysFreeString
SysAllocString
SysStringLen
SysAllocStringLen

shell32

SHGetFolderPathAndSubDirW
SHSetLocalizedName
ShellExecuteExW
SHGetFolderPathW
SHGetDesktopFolder
SHGetFolderLocation
SHChangeNotify
SHGetSpecialFolderPathW

comctl32

ord338
ord339
ord386
ord334
ord332
ord335
ord336
ord328

api-ms-win-core-shlwapi-legacy-l1-1-0

SHExpandEnvironmentStringsW
PathGetCharTypeW
PathIsUNCServerW
PathFindNextComponentW
PathSkipRootW
PathGetDriveNumberW
PathIsRootW

netutils

NetApiBufferFree

wkscli

NetGetJoinInformation

kernelbase

GetSystemDefaultLocaleName
GetUserDefaultLocaleName
StrToIntW
OpenGlobalizationUserSettingsKey

ole32

CreateBindCtx

ntdll

NtClose
NtQueryLicenseValue
VerSetConditionMask

urlmon

ord410

mlang

ord123

Exports

Exports

BrandCleanInstallStubs
BrandICW
BrandICW2
BrandIE4
BrandIEActiveSetup
BrandInternetExplorer
BrandIntra
BrandMe
Clear
CloseRASConnections
InternetInitializeAutoProxyDll
ProcessGroupPolicyForActivities
ProcessGroupPolicyForActivitiesEx
ProcessGroupPolicyForZoneMap

Sections

.text
Size: 270KB - Virtual size: 270KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iedkcs32/mbussdapi.dll
.dll windows:10 windows x64 arch:x64

4e275b55feedc7804e601582de7f5721

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

MbUssdApi.pdb

Imports

msvcrt

_errno
__CxxFrameHandler3
_onexit
__dllonexit
realloc
_callnewh
_unlock
?terminate@@YAXXZ
toupper
__C_specific_handler
_CxxThrowException
_initterm
malloc
_amsg_exit
_XcptFilter
_wcsicmp
ceil
??0exception@@QEAA@AEBV0@@Z
memcpy
??0exception@@QEAA@XZ
rand
??1type_info@@UEAA@XZ
srand
rand_s
memmove
_purecall
_lock
free
??1exception@@UEAA@XZ
memset

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
TraceMessage
GetTraceEnableLevel
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW
RoOriginateError
RoTransformErrorW
SetRestrictedErrorInfo

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
CreateMutexExW
OpenSemaphoreW
CreateEventW
CreateSemaphoreExW
EnterCriticalSection
AcquireSRWLockShared
InitializeCriticalSection
DeleteCriticalSection
SetEvent
LeaveCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsGetStringLen
WindowsIsStringEmpty
WindowsDeleteString

api-ms-win-core-com-l1-1-0

CoImpersonateClient
CoIncrementMTAUsage
CoCreateInstance
CreateStreamOnHGlobal
CoMarshalInterface
CoReleaseMarshalData
CoTaskMemFree
CoTaskMemAlloc
CoGetCallContext
CLSIDFromString
CoRevertToSelf
StringFromCLSID
CoCreateFreeThreadedMarshaler
CoDecrementMTAUsage

oleaut32

SysAllocStringLen
SysAllocString
SysStringLen
SysFreeString

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoUninitialize

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentProcess
GetCurrentProcessId
OpenProcessToken
TerminateProcess
GetCurrentThreadId
GetCurrentThread
OpenThreadToken

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
GetTokenInformation

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

ntdll

_vsnwprintf
_vsnprintf_s
memmove_s
memcpy_s
RtlLoadString

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

mobilenetworking

GetPersistentRegPath

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-devices-query-l1-1-0

DevFreeObjectProperties
DevGetObjectProperties

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventProviderEnabled
EventWriteTransfer
EventRegister
EventSetInformation

api-ms-win-core-heap-l2-1-0

LocalAlloc

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFamilyName

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mbussdapi/McpManagementProxy.dll
.dll regsvr32 windows:10 windows x64 arch:x64

5205866b226d328a00560258b15ca67f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

McpManagementProxy.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcmp
__C_specific_handler
_o___std_type_info_destroy_list

api-ms-win-crt-string-l1-1-0

memset

rpcrt4

NdrDllRegisterProxy
CStdStubBuffer_Invoke
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
NdrStubCall3
CStdStubBuffer_IsIIDSupported
IUnknown_AddRef_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
CStdStubBuffer_Connect
NdrCStdStubBuffer2_Release
CStdStubBuffer_CountRefs
NdrOleFree
NdrDllUnregisterProxy
NdrDllGetClassObject
NdrOleAllocate
NdrCStdStubBuffer_Release
NdrDllCanUnloadNow

api-ms-win-core-com-midlproxystub-l1-1-0

CStdStubBuffer2_Connect
CStdStubBuffer2_Disconnect
ObjectStublessClient10
ObjectStublessClient9
ObjectStublessClient4
ObjectStublessClient8
ObjectStublessClient3
CStdStubBuffer2_CountRefs
ObjectStublessClient11
ObjectStublessClient7
NdrProxyForwardingFunction3
ObjectStublessClient6
ObjectStublessClient12
ObjectStublessClient5
CStdStubBuffer2_QueryInterface

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mbussdapi/mbussdapi.dll
.dll windows:10 windows x64 arch:x64

4e275b55feedc7804e601582de7f5721

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

MbUssdApi.pdb

Imports

msvcrt

_errno
__CxxFrameHandler3
_onexit
__dllonexit
realloc
_callnewh
_unlock
?terminate@@YAXXZ
toupper
__C_specific_handler
_CxxThrowException
_initterm
malloc
_amsg_exit
_XcptFilter
_wcsicmp
ceil
??0exception@@QEAA@AEBV0@@Z
memcpy
??0exception@@QEAA@XZ
rand
??1type_info@@UEAA@XZ
srand
rand_s
memmove
_purecall
_lock
free
??1exception@@UEAA@XZ
memset

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
TraceMessage
GetTraceEnableLevel
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceLoggerHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls
GetProcAddress

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
RoTransformError
RoOriginateErrorW
RoOriginateError
RoTransformErrorW
SetRestrictedErrorInfo

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
CreateMutexExW
OpenSemaphoreW
CreateEventW
CreateSemaphoreExW
EnterCriticalSection
AcquireSRWLockShared
InitializeCriticalSection
DeleteCriticalSection
SetEvent
LeaveCriticalSection
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsGetStringLen
WindowsIsStringEmpty
WindowsDeleteString

api-ms-win-core-com-l1-1-0

CoImpersonateClient
CoIncrementMTAUsage
CoCreateInstance
CreateStreamOnHGlobal
CoMarshalInterface
CoReleaseMarshalData
CoTaskMemFree
CoTaskMemAlloc
CoGetCallContext
CLSIDFromString
CoRevertToSelf
StringFromCLSID
CoCreateFreeThreadedMarshaler
CoDecrementMTAUsage

oleaut32

SysAllocStringLen
SysAllocString
SysStringLen
SysFreeString

api-ms-win-core-winrt-error-l1-1-1

RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoUninitialize

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentProcess
GetCurrentProcessId
OpenProcessToken
TerminateProcess
GetCurrentThreadId
GetCurrentThread
OpenThreadToken

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
GetTokenInformation

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

ntdll

_vsnwprintf
_vsnprintf_s
memmove_s
memcpy_s
RtlLoadString

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-debug-l1-1-0

OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

mobilenetworking

GetPersistentRegPath

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-devices-query-l1-1-0

DevFreeObjectProperties
DevGetObjectProperties

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventProviderEnabled
EventWriteTransfer
EventRegister
EventSetInformation

api-ms-win-core-heap-l2-1-0

LocalAlloc

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFamilyName

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mbussdapi/netprovfw.dll
.dll windows:10 windows x64 arch:x64

ecb10cf3606157d3cfdfefe5dcf03fc8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

netprovfw.pdb

Imports

api-ms-win-core-crt-l1-1-0

_wcsicmp
__C_specific_handler
wcscspn
_vsnwprintf_s
_ltow_s
memcpy
memset

api-ms-win-core-crt-l2-1-0

_initterm_e
_initterm

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleExW
FreeLibraryAndExitThread
LoadLibraryExW
FreeLibrary

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegLoadKeyW
RegCreateKeyExW
RegNotifyChangeKeyValue
RegQueryValueExW
RegDeleteTreeW
RegUnLoadKeyW
RegGetValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumKeyExW
RegCloseKey
RegGetValueA

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalFree
LocalFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateEventW
WaitForSingleObject

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlCompareMemory
RtlVirtualUnwind

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
OpenThreadToken
SetThreadStackGuarantee
GetCurrentThread
CreateThread
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-security-base-l1-1-0

CheckTokenMembership
ImpersonateSelf
RevertToSelf
GetTokenInformation
AdjustTokenPrivileges

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetLocalTime
GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
GetWindowsDirectoryW

ntdll

RtlLengthSid
RtlNtStatusToDosError
RtlGetNtProductType
RtlFreeHeap
RtlImageNtHeader
RtlAllocateHeap
RtlAllocateAndInitializeSid
NtOpenThreadToken
NtClose
RtlFreeSid
RtlInitUnicodeString

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualAlloc
VirtualQuery

api-ms-win-core-file-l1-1-0

SetFilePointer
GetFileAttributesW
ReadFile
GetFileSize
CreateFileW
CreateDirectoryW
FlushFileBuffers
WriteFile

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

NetCaptureProvisioningPackage
NetCreateProvisioningPackage
NetRequestProvisioningPackageInstall
NetpAnalyzeProvisioningPackage
NetpCreateProvisioningPackage
NetpProvCheckOfflineLsaPolicyUpdate
NetpProvContinueProvisioningPackageInstall
NetpProvDomainJoinLicensingCheck
NetpProvFreeLdapLsaDomainInfo
NetpRequestProvisioningPackageInstall
NetpRequestProvisioningPackageInstallForIMC
NetpRequestProvisioningPackageInstallForOfflineServicing

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mbussdapi/rdpcore.dll
.dll windows:10 windows x64 arch:x64

93efba2fa14efe7e30314282d466bbe4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

RdpCore.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__resetstkoflw
_o__seh_filter_dll
_o__strnicmp
_o__wcsicmp
_o__wcsnicmp
memmove
_o__wfopen_s
_o_calloc
_o_fclose
_o_free
_o_fwrite
_o_isalpha
_o_log
_o_malloc
_o_memcpy_s
_o_pow
_o_qsort
_o_rand
_o_realloc
_o_sqrt
_o_strncpy_s
_o_wcscat_s
_o_wcscpy_s
_o_wcstombs
_o_wcstoul
__C_specific_handler
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__ftime64
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o__execute_onexit_table
_o__errno
_o__invalid_parameter_noinfo
__CxxFrameHandler4
_o__crt_atexit
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___acrt_iob_func
wcsrchr
wcschr
__std_terminate
__CxxFrameHandler3
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_CxxThrowException
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

wcscmp
memset
wcsnlen
strnlen

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA
GetProcAddress
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleW
FreeLibrary
LoadLibraryExW
GetModuleHandleExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TlsGetValue
TlsFree
TlsSetValue
OpenThreadToken
TlsAlloc
GetCurrentThread
OpenProcessToken
TerminateProcess
CreateThread
ProcessIdToSessionId
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTime
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

SetErrorMode
UnhandledExceptionFilter
SetLastError
GetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

rdpbase

PAL_System_SemaphoreAlloc
PAL_System_SemaphoreAcquire
PAL_System_SemaphoreRelease
PAL_System_HandleFree
RdpTiledSurface_CreateInstance
DrawBox
GridBA_CreateInstance
RDPENCHLP_TraceWindowInfo
RDPENCHLP_IsSessionActive
RDPAPI_GetLongCounter
RDPENCHLP_IsGreaterThanOrEqWin8
GetSupportedSSELevel_SSE
MemMoveReverseAligned_SSE
MemCopyAligned_SSE
RDPENCHLP_IsSessionRemote
TSAlloc
TSFree
PAL_System_CritSecLeave
PAL_System_CritSecEnter
PAL_System_CritSecInit
PAL_System_CritSecTerminate
TRC_TraceBufferW
?RdpPerfLoggerStaticTerminate@@YAXXZ
PAL_System_SwitchToThread
PAL_System_Sleep
PAL_System_ThreadGetId
PAL_System_GetNumberOfProcessors
PAL_System_AtomicIncrement
PAL_System_AtomicDecrement
RdpX_GetActivityIdPrefix
RDPENCHLP_GetInputDesktopName
TSCreateCoreEvents
RDPAPI_GetGenericCounter
RDPBASE_CreateInstance
RgnlibBA_CreateInstance
PAL_System_AtomicCompareAndExchange

rdpserverbase

RDPSERVERBASE_CreateInstance
?GetGraphicsSourceContext@RdpSurface@@QEAAJPEAPEAUIRdpGFXSourceUpdateContext@@@Z
?GetEncodingPixelMap@RdpSurface@@QEAAJPEAPEAVPixelMap@@@Z
?GetGfxPipeSettingBOOL@@YAJPEAGHPEAH@Z
CCompressedUpdateContext_CreateInstance
?GetTileNext@Tiler@@QEAAJPEAURdpRect@@@Z
?GetTileFirst@Tiler@@QEAAJPEBURdpRect@@PEAU2@@Z
CUpdateContext_CreateInstance
?GetGfxPipeSettingUINT@@YAJPEAGIPEAI@Z
?Initialize@Tiler@@QEAAJPEBURdpRect@@0@Z

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

msacm32

acmDriverOpen
acmDriverEnum
acmStreamClose
acmDriverClose
acmStreamSize
acmStreamOpen
acmFormatTagDetailsW
acmStreamConvert
acmStreamUnprepareHeader
acmFormatSuggest
acmStreamPrepareHeader

avrt

AvSetMmThreadCharacteristicsW
AvRevertMmThreadCharacteristics

oleaut32

SysAllocString
VariantClear
SysFreeString
VariantInit

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
LoadLibraryA

api-ms-win-security-base-l1-1-0

SetTokenInformation
GetTokenInformation

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-synch-l1-1-0

CreateMutexExW
OpenEventW
WaitForMultipleObjectsEx
CreateSemaphoreExW
ResetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
OpenSemaphoreW
AcquireSRWLockShared
SetWaitableTimer
CreateWaitableTimerExW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
SetEvent
CreateEventW
ReleaseSemaphore
ReleaseMutex
ReleaseSRWLockShared
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW

api-ms-win-core-synch-l1-2-0

SleepConditionVariableCS
InitializeConditionVariable
InitOnceExecuteOnce
Sleep
WakeAllConditionVariable

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-file-l1-1-0

ReadFile
CreateDirectoryW
DeleteFileW
GetTempFileNameW
WriteFile
FindClose
SetFilePointerEx
FindFirstFileW
FindNextFileW
CreateFileW
GetFileInformationByHandle
GetFileAttributesW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-kernel32-legacy-l1-1-0

PulseEvent

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-ntuser-rectangle-l1-1-0

CopyRect
IsRectEmpty
UnionRect
SetRect
SetRectEmpty
OffsetRect
PtInRect
IntersectRect
InflateRect
EqualRect

api-ms-win-ntuser-sysparams-l1-1-0

EnumDisplayMonitors
EnumDisplayDevicesW
GetSystemMetrics
GetMonitorInfoW
EnumDisplaySettingsW
EnumDisplaySettingsExW
SystemParametersInfoW

api-ms-win-core-heap-l2-1-0

GlobalFree
GlobalAlloc

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-atoms-l1-1-0

GlobalDeleteAtom
GlobalAddAtomW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock
GlobalSize

api-ms-win-rtcore-ole32-clipboard-l1-1-0

OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard

api-ms-win-core-localization-l1-2-0

GetCPInfo
IsDBCSLeadByte
FormatMessageW

api-ms-win-core-path-l1-1-0

PathCchCanonicalize

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-stringansi-l1-1-0

CharNextA
CharPrevA

api-ms-win-crt-math-l1-1-0

sqrtf

Exports

Exports

RDPAPI_CreateInstance

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mbussdapi/srmclient.dll
.dll windows:10 windows x64 arch:x64

f40e5737916817fcaecff52fce9aac45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

srmclient.pdb

Imports

msvcrt

_itow_s
_wtoi
_wcsicmp
_vsnwprintf
swscanf
wcschr
_wcsnicmp
wcstol
_wcstoui64
iswspace
_ui64tow_s
wcscspn
iswalpha
_wtoi64
memcmp
memcpy
memmove
towlower
wcsrchr
wcsncmp
_snwscanf_s
_vsnprintf
memset
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
iswdigit
_i64tow_s
_wtol
wcstoul
__CxxFrameHandler3
wcsstr
_callnewh
malloc
free
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_purecall
realloc
__C_specific_handler
_errno
wcscmp

atl

ord21
ord16
ord15
ord32
ord58
ord30

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
WinSqmSetDWORD
WinSqmIsOptedIn
RtlInitializeSid
RtlInitUnicodeString
RtlNtStatusToDosError
NtCreateFile
RtlDosPathNameToRelativeNtPathName_U
RtlAcquireResourceExclusive
RtlInitializeResource
RtlReleaseResource
RtlAcquireResourceShared
RtlDeleteResource
NtOpenFile
RtlFreeHeap
NtQueryInformationFile
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlCreateSystemVolumeInformationFolder
RtlCompareMemory
RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString

ole32

CoGetInterfaceAndReleaseStream
CoUninitialize
CoInitializeEx
CoTaskMemRealloc
CLSIDFromString
CoCreateGuid
StringFromGUID2
GetHGlobalFromStream
CoCreateInstanceEx
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CreateStreamOnHGlobal
CoImpersonateClient
CoSetProxyBlanket
CoRevertToSelf

oleaut32

SysFreeString
VariantClear
SysAllocString
VariantCopy
VariantTimeToSystemTime
SafeArrayGetVartype
SafeArrayGetLBound
SafeArrayGetElement
SysStringLen
VariantInit
SafeArrayCreateVector
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
SafeArrayCopy
VariantChangeType
GetErrorInfo
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
SysAllocStringLen
SafeArrayGetUBound

kernel32

SleepConditionVariableSRW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetLastError
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
Sleep
GetComputerNameW
GetFileSize
CloseHandle
CreateFileW
SetEndOfFile
WriteFile
ReadFile
VirtualQuery
DeleteCriticalSection
GetSystemInfo
ReOpenFile
GetVolumePathNamesForVolumeNameW
GetFileInformationByHandle
GetVolumeNameForVolumeMountPointW
SetFileTime
MoveFileW
GetFileType
MoveFileExW
FindClose
FindNextFileW
FindFirstFileW
OutputDebugStringW
GetCommandLineW
FreeLibrary
GetDriveTypeW
FlushFileBuffers
GetFileTime
GetOverlappedResult
SetThreadpoolWait
DeleteFileW
CreateThreadpoolWait
GetCurrentThread
SetFileInformationByHandle
WaitForThreadpoolWaitCallbacks
CreateEventW
SetFileAttributesW
CloseThreadpoolWait
OpenProcess
DuplicateHandle
LocalAlloc
WaitForSingleObject
SetThreadPriority
WaitForMultipleObjects
DeviceIoControl
GetFileSizeEx
GetFileInformationByHandleEx
FindNextVolumeMountPointW
FindVolumeMountPointClose
FindFirstVolumeMountPointW
InitializeCriticalSectionAndSpinCount
GetVolumePathNameW
GetVolumeInformationW
FormatMessageW
GlobalUnlock
GlobalLock
GetDateFormatW
GetTimeFormatW
CheckRemoteDebuggerPresent
DebugBreak
ExitProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
LoadLibraryExW
SystemTimeToFileTime
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CompareFileTime
GetSystemTime
LocalFree
CreateThread
GetFileAttributesW
CreateDirectoryW
VirtualProtect
PrivCopyFileExW
DisableThreadLibraryCalls
InitializeCriticalSection
LeaveCriticalSection
VirtualAlloc
ExpandEnvironmentStringsW
EnterCriticalSection

advapi32

LookupAccountSidW
RegisterEventSourceW
ReportEventW
RegCloseKey
SetSecurityInfo
ConvertSidToStringSidW
GetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
RegOpenKeyExW
SetThreadToken
OpenProcessToken
DeregisterEventSource
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW

api-ms-win-security-base-l1-1-0

InitializeAcl
GetTokenInformation
MapGenericMask
GetLengthSid
GetAclInformation
GetAce
AllocateAndInitializeSid
CreateWellKnownSid
CopySid
FreeSid
CheckTokenMembership

api-ms-win-security-base-l1-2-0

AddResourceAttributeAce

user32

LoadStringW

shlwapi

ord12
PathIsUNCW
PathRemoveFileSpecW
PathFindFileNameW

rpcrt4

I_RpcBindingInqLocalClientPID

authz

AuthzReportSecurityEventFromParams

vssapi

CreateVssBackupComponentsInternal
VssFreeSnapshotPropertiesInternal

netapi32

NetGetJoinInformation
NetApiBufferFree
DsGetDcNameW

clusapi

OpenCluster
ClusterRegCreateKey
ClusterRegDeleteKey
CloseCluster
ClusterRegEnumKey
GetNodeClusterState
GetClusterKey
ClusterRegQueryValue
ClusterRegCloseKey
ClusterRegSetValue
ClusterRegOpenKey

xmllite

CreateXmlReader
CreateXmlWriterOutputWithEncodingName
CreateXmlWriter

activeds

ord3

mpr

WNetGetUniversalNameW

srmtrace

ord6
ord1
ord10
ord5
ord11
ord9
ord7
ord8
ord3

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 857KB - Virtual size: 857KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 417KB - Virtual size: 417KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64__installer__v3.0.7.msi
.msi

Sharing

General

Malware Config

Signatures

Files

d8665a89cb65b8d90996d9f921641fab

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-shcore-registry-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-shcore-scaling-l1-1-1

ntdll

api-ms-win-power-setting-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-storage-exports-internal-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

d3d11

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-ntuser-rectangle-l1-1-0

msvcp_win

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 141KB - Virtual size: 141KB

.rdata Size: 55KB - Virtual size: 55KB

.data Size: 5KB - Virtual size: 7KB

.pdata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 136B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

5df7e5d90b454fbbf0c0a1171fe68de8

Code Sign

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

d0:73:91:3e:b5:51:0e:96:be:8a:38:7f:89:bd:7e:17:18:af:cc:28:0a:ce:b7:8f:ad:9c:99:3a:31:bf:06:78Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

mfplat

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

.text
Size: 141KB - Virtual size: 141KB

.rdata
Size: 55KB - Virtual size: 55KB

.data
Size: 5KB - Virtual size: 7KB

.pdata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 136B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

d0:73:91:3e:b5:51:0e:96:be:8a:38:7f:89:bd:7e:17:18:af:cc:28:0a:ce:b7:8f:ad:9c:99:3a:31:bf:06:78
Signer

.text
Size: 261KB - Virtual size: 260KB

.no_bbt
Size: 1024B - Virtual size: 633B

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 27KB - Virtual size: 55KB

.pdata
Size: 8KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 24B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 964B

.text
Size: 260KB - Virtual size: 260KB

.rdata
Size: 42KB - Virtual size: 41KB

.data
Size: 12KB - Virtual size: 17KB

.pdata
Size: 11KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 432B

.rsrc
Size: 34KB - Virtual size: 33KB

.reloc
Size: 3KB - Virtual size: 3KB