ETC XMR3.zip
- SHA256 6147d0e24cd69d47c70392ebaff78b5864342d542f7aedfc9f307a86972559d4
Overview
overview
10Static
static
10ETC XMR3/s...1).bat
windows10-1703-x64
1ETC XMR3/s...1).bat
windows11-21h2-x64
1ETC XMR3/s...0).bat
windows10-1703-x64
1ETC XMR3/s...0).bat
windows11-21h2-x64
1ETC XMR3/s...1).bat
windows10-1703-x64
1ETC XMR3/s...1).bat
windows11-21h2-x64
1ETC XMR3/s...2).bat
windows10-1703-x64
1ETC XMR3/s...2).bat
windows11-21h2-x64
1ETC XMR3/s...3).bat
windows10-1703-x64
1ETC XMR3/s...3).bat
windows11-21h2-x64
1ETC XMR3/s...4).bat
windows10-1703-x64
1ETC XMR3/s...4).bat
windows11-21h2-x64
1ETC XMR3/s...5).bat
windows10-1703-x64
1ETC XMR3/s...5).bat
windows11-21h2-x64
1ETC XMR3/s...6).bat
windows10-1703-x64
1ETC XMR3/s...6).bat
windows11-21h2-x64
1ETC XMR3/s...2).bat
windows10-1703-x64
1ETC XMR3/s...2).bat
windows11-21h2-x64
1ETC XMR3/s...3).bat
windows10-1703-x64
1ETC XMR3/s...3).bat
windows11-21h2-x64
1ETC XMR3/s...4).bat
windows10-1703-x64
1ETC XMR3/s...4).bat
windows11-21h2-x64
1ETC XMR3/s...5).bat
windows10-1703-x64
1ETC XMR3/s...5).bat
windows11-21h2-x64
1ETC XMR3/s...6).bat
windows10-1703-x64
1ETC XMR3/s...6).bat
windows11-21h2-x64
1ETC XMR3/s...7).bat
windows10-1703-x64
1ETC XMR3/s...7).bat
windows11-21h2-x64
1ETC XMR3/s...8).bat
windows10-1703-x64
1ETC XMR3/s...8).bat
windows11-21h2-x64
1ETC XMR3/s...9).bat
windows10-1703-x64
1ETC XMR3/s...9).bat
windows11-21h2-x64
1Resubmissions
06/09/2024, 21:46
240906-1mzzkszcrg1006/09/2024, 12:14
240906-pepyvsvhjr1006/09/2024, 07:36
240906-jfp3csvaqh1006/09/2024, 06:44
240906-hhtb5asbqb1005/09/2024, 22:18
240905-18btwasbpg1005/09/2024, 17:44
240905-wbcmpawdqr1005/09/2024, 12:36
240905-ps4dea1hlb1005/09/2024, 11:39
240905-nsmj8azdjl10Behavioral task
behavioral1
Sample
ETC XMR3/start (1).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral2
Sample
ETC XMR3/start (1).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral3
Sample
ETC XMR3/start (10).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral4
Sample
ETC XMR3/start (10).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral5
Sample
ETC XMR3/start (11).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral6
Sample
ETC XMR3/start (11).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral7
Sample
ETC XMR3/start (12).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral8
Sample
ETC XMR3/start (12).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral9
Sample
ETC XMR3/start (13).bat
Resource
win10-20240611-en
windows10-1703-x64
4 signatures
1800 seconds
Behavioral task
behavioral10
Sample
ETC XMR3/start (13).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral11
Sample
ETC XMR3/start (14).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral12
Sample
ETC XMR3/start (14).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral13
Sample
ETC XMR3/start (15).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral14
Sample
ETC XMR3/start (15).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral15
Sample
ETC XMR3/start (16).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral16
Sample
ETC XMR3/start (16).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral17
Sample
ETC XMR3/start (2).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral18
Sample
ETC XMR3/start (2).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral19
Sample
ETC XMR3/start (3).bat
Resource
win10-20240611-en
windows10-1703-x64
4 signatures
1800 seconds
Behavioral task
behavioral20
Sample
ETC XMR3/start (3).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral21
Sample
ETC XMR3/start (4).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral22
Sample
ETC XMR3/start (4).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral23
Sample
ETC XMR3/start (5).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral24
Sample
ETC XMR3/start (5).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral25
Sample
ETC XMR3/start (6).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral26
Sample
ETC XMR3/start (6).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral27
Sample
ETC XMR3/start (7).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral28
Sample
ETC XMR3/start (7).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral29
Sample
ETC XMR3/start (8).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral30
Sample
ETC XMR3/start (8).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral31
Sample
ETC XMR3/start (9).bat
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral32
Sample
ETC XMR3/start (9).bat
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
General
- Target ETC XMR3.zip
- Size 2.6MB
- Sample240905-18btwasbpg
- SHA256 6147d0e24cd69d47c70392ebaff78b5864342d542f7aedfc9f307a86972559d4
- MD5 9b0b7fa3efd648b7f4309cce5baa1c9d
- SHA1 ab8764b87df9039e67076d8ef6f1dec61b0689c9
- SHA512 db42130e572f86e3ac78f29e5593e262097bdb8ac365de395fb875115e5c79333e490fcb2911f749e0e6ba51845105342d71eb4f2173f18647f75539928ae55f
- SSDEEP 49152:44R9znkcibySPeKfmoTcltb3FbJSQhaB+8CPnatblrdz8w2J9k1T4C6ye:79nePmoTc3Dx4CPn6Fdz8w2JQ8CI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
File Explorer
-
ETC XMR3.zip.zip 2.6MB
-
ETC XMR3/SHA256SUMS748B
-
ETC XMR3/start (1).bat110B
-
ETC XMR3/start (10).bat110B
-
ETC XMR3/start (11).bat110B
-
ETC XMR3/start (12).bat110B
-
ETC XMR3/start (13).bat110B
-
ETC XMR3/start (14).bat110B
-
ETC XMR3/start (15).bat110B
-
ETC XMR3/start (16).bat110B
-
ETC XMR3/start (2).bat110B
-
ETC XMR3/start (3).bat110B
-
ETC XMR3/start (4).bat110B
-
ETC XMR3/start (5).bat110B
-
ETC XMR3/start (6).bat110B
-
ETC XMR3/start (7).bat110B
-
ETC XMR3/start (8).bat110B
-
ETC XMR3/start (9).bat110B
-
ETC XMR3/start.bat110B
-
ETC XMR3/xmrig.exe.exe 6.1MB
ETC XMR3/SHA256SUMS
- SHA256 db2daf0724cca6d5bf270b9b2578159015822603e5b71077ebdd0c68bdfce566
- MD5 fa5ae45951319ef65fb78ceff397f20a
- SHA1 ae1ca42125eca741a9ffb574626576e42271d22d
- SHA512 88e78410aa74a11e8ee044be60681ebc662c253ae7ba37730c571c5dad3cf0035250457e85f2406a741be1b9648c08b5eaa3b3917255c85825ef1565a956b5a1
- MD5 SHA1 SHA512
ETC XMR3/start (1).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (10).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (11).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (12).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (13).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (14).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (15).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (16).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (2).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (3).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (4).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (5).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (6).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (7).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (8).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start (9).bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/start.bat
- SHA256 316e23befc16b34bfbe4b4adcf8d319b1af134ad51577e09a2b5a09ded70a781
- MD5 5b696af5c780a7699a22b945dc062927
- SHA1 1f2a9887f83d7224ed710179da51080923fd1d7b
- SHA512 c6f4b96c16b74dc93e4150d3bfb37d87fef49b49d1d1d3644528d399ba2ea9ae11ef309ae203fca3d6d19810bdbbf1ec6af36565e2f5fb17f1d24b06ae493685
- MD5 SHA1 SHA512
ETC XMR3/xmrig.exe
- IMPHASH 12806e48b853545b536463546db4baa1
- SHA256 ca28f4aeaa5e16d216cd828b67454a56f3c7feeb242412d26ed914fadff20d40
- MD5 5fba8ae226b096da3b31de0e17496735
- SHA1 d532a01254cf9e0229d3c5803b78ff7c9b0cb8d3
- SHA512 951e44fc0864a6741bcbb4227feb5429a032713dabd91102f4f0e27a69181ce7f23562e902cc09896ae26334b6d18caf0f5a13d81370bd703fd7ed6f78b47e72
- SSDEEP 98304:iONmXliGgyduIy7bWynX75rfdRZqOXmvFubCY9yxl5TtX8Ao0Ezae6B:GXlivZqOXmtubmxl5ppvEzT6
- MD5 SHA1 SHA512 SSDEEP
-
XMRig Miner payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4063652
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
WSASetLastError
send
recv
ntohs
htons
htonl
inet_addr
inet_ntoa
gethostbyaddr
WSAGetLastError
WSAIoctl
gethostbyname
WSARecvFrom
WSASocketW
WSASend
WSARecv
gethostname
WSADuplicateSocketW
getpeername
FreeAddrInfoW
GetAddrInfoW
shutdown
socket
setsockopt
listen
connect
closesocket
bind
WSACleanup
WSAStartup
select
getsockopt
getsockname
ioctlsocket
getservbyname
getservbyport
iphlpapi
GetAdaptersAddresses
userenv
GetUserProfileDirectoryW
crypt32
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
kernel32
GetStringTypeW
InitializeCriticalSectionAndSpinCount
WriteConsoleW
SetConsoleTitleA
GetStdHandle
SetConsoleMode
GetConsoleMode
QueryPerformanceFrequency
QueryPerformanceCounter
SizeofResource
LockResource
LoadResource
FindResourceW
ExpandEnvironmentStringsA
GetConsoleWindow
GetSystemFirmwareTable
HeapFree
HeapAlloc
GetProcessHeap
MultiByteToWideChar
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetSystemPowerStatus
GetCurrentThread
GetProcAddress
GetModuleHandleW
GetTickCount
CloseHandle
FreeConsole
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
GetLastError
LocalFree
FlushInstructionCache
GetCurrentThreadId
AddVectoredExceptionHandler
DeviceIoControl
GetModuleFileNameW
CreateFileW
SetLastError
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
Sleep
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
SwitchToFiber
DeleteFiber
CreateFiberEx
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
FormatMessageA
GetFileType
WriteFile
GetEnvironmentVariableW
GetACP
ConvertFiberToThread
ConvertThreadToFiberEx
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
ReadConsoleA
ReadConsoleW
PostQueuedCompletionStatus
CreateFileA
DuplicateHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
QueueUserWorkItem
RegisterWaitForSingleObject
UnregisterWait
GetNumberOfConsoleInputEvents
ReadConsoleInputW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
WriteConsoleInputW
CreateDirectoryW
FlushFileBuffers
GetDiskFreeSpaceW
GetFileAttributesW
GetFileInformationByHandle
CreateEventW
RtlCaptureContext
GetFullPathNameW
ReadFile
RemoveDirectoryW
SetFilePointerEx
SetFileTime
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReOpenFile
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
ReleaseSemaphore
ResumeThread
GetNativeSystemInfo
GetProcessAffinityMask
SetThreadAffinityMask
CreateSemaphoreA
SetConsoleCtrlHandler
GetCurrentDirectoryW
GetLongPathNameW
RtlUnwind
CreateIoCompletionPort
ReadDirectoryChangesW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetTempPathW
GlobalMemoryStatusEx
FileTimeToSystemTime
K32GetProcessMemoryInfo
SetHandleInformation
CancelIoEx
CancelIo
SwitchToThread
SetFileCompletionNotificationModes
LoadLibraryExW
SetErrorMode
GetQueuedCompletionStatus
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
CancelSynchronousIo
GetNamedPipeHandleStateA
GetNamedPipeClientProcessId
GetNamedPipeServerProcessId
TerminateProcess
GetExitCodeProcess
UnregisterWaitEx
LCMapStringW
DebugBreak
GetModuleHandleA
LoadLibraryExA
GetStartupInfoW
GetModuleFileNameA
GetVersionExA
SetProcessAffinityMask
GetComputerNameA
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetCPInfo
RtlLookupFunctionEntry
GetFinalPathNameByHandleW
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetStdHandle
GetCommandLineA
GetCommandLineW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
ExitProcess
GetFileAttributesExW
SetFileAttributesW
GetConsoleOutputCP
CompareStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
HeapSize
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetFileSizeEx
GetShortPathNameW
CompareStringEx
LCMapStringEx
InitializeCriticalSectionEx
WaitForSingleObjectEx
GetExitCodeThread
SleepConditionVariableSRW
EncodePointer
DecodePointer
user32
GetLastInputInfo
MessageBoxW
GetProcessWindowStation
TranslateMessage
GetUserObjectInformationW
ShowWindow
DispatchMessageA
GetSystemMetrics
MapVirtualKeyW
GetMessageA
shell32
SHGetSpecialFolderPathA
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
advapi32
SystemFunction036
GetUserNameW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
QueryServiceConfigA
DeleteService
ControlService
StartServiceW
OpenServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
bcrypt
BCryptGenRandom
Name
.text
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
64KB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
169KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RANDOMX
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_TEXT_CN
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_TEXT_CN
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=30795,
count=204, id=261, version=30795,
count=19, id=260, version=30034,
count=10, id=259, version=30034,
count=94, id=261, version=30034,
count=25, id=260, version=30795,
count=390, id=1, productName=Unmarked objects,
count=23, id=257, version=30795,
count=818, id=260, version=30154,
count=265, id=265, version=30154,
count=3, id=259, version=30154,
count=1, id=255, version=30154,
count=1, id=151,
count=1, id=258, version=30154,