d:\NsStudy\Home\Baymax\trunk\PatchUi\res\x64\PYG64.pdb
Static task
static1
1 signatures
General
-
Target
StreamFab 6.1.9.6 (x64) Multilingual.zip
-
Size
463.4MB
-
MD5
59d0c692687d1800a95576d8fd2328fd
-
SHA1
1af3e72138cb22a5356f873f03524c5b144f1c8a
-
SHA256
9da6644044d7abc0f851399dcd15da1c0542373684f990f4aebb5041532d0fd9
-
SHA512
71c1bfcba8e3af59b17210b75fd91edc8bc5690eac4f855853f61bf415bb518898e8cd5bc57675fa1df8978e658735b507c4d3487d7b1b9e8cf906fb3eaafa26
-
SSDEEP
12582912:qYalWsaQVxUDTW0Hv6y8EUV493xyyjQPATilZB11:qbkpQb0THHyy8E59B3cPao1
Score
3/10
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/StreamFab 6.1.9.6 (x64) Multilingual/Crack/PYG64.dll unpack001/StreamFab 6.1.9.6 (x64) Multilingual/Crack/uxtheme.dll
Files
-
StreamFab 6.1.9.6 (x64) Multilingual.zip.zip
Password: P
-
StreamFab 6.1.9.6 (x64) Multilingual/Crack/Adsız.jpg.jpg
Password: P
-
StreamFab 6.1.9.6 (x64) Multilingual/Crack/INFO.txt
-
StreamFab 6.1.9.6 (x64) Multilingual/Crack/PYG64.dll.dll windows:5 windows x64 arch:x64
Password: P
f500aa64fe5766d56f43bd18f6680486
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
QueryPerformanceCounter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OpenClipboard
ole32
CoUninitialize
gdi32
CreateCompatibleDC
Exports
Exports
ChinaPYG
\Mo�y�� h5ׄV����vn,( �ZR��L2���|j3ZQIKMDz�����Yڷ�� }��;hvtXY�Oi��kEE-n����,:ˑ�����#$T5�M{�T�hm����fmZQ�Ԉ:�yn�T.���� ʈ��_��,�l�H )�L8���T�D >�w���Vt��] ��Z��m@õ:�c+���7�պ-��x_B^��x!��2�}������$D��o�M�0���V@�����魚V��Ie�I��t)���&�-�XCj�=egZb�o"g�yh,��>;�Qc�4�e�!�-@�O����휯���\�� m^S��փ �d����x mpփl�U)S��^9�Ϸ���0_��O �|l��TT�IΚ D�;+�K�8oy5�T�%����������9���Ɨp�q�[�� � 4s�����b S��&�zsQ��t�]�E��E�����iOؚ�/��t��I��1�~o��ɾ��2h�����8A��^�T^R�-C�J!V�� 'ܧ�8X^���y� �m:oTZ�d�I+0��Sn��cQ�Q�O�۾jx�~*�C �A�:&D�V���uM�/"p�H�]�9�M5ύ��U�U�R���^u���+(�D��C�{�L�1� j��锴j���c�\^����KP'��"@ ���u���x�� �61��f �|յ3_K6"T �uj^�;��.��p�S/�֪9F��slv�I ���SP�_ �w_����E��~8�� ��3�.������t�vR�PnO]���o��#�si���o�Sa��p/�8]��dU��¿q� M�HE�o(��=��I)��������i��4�>b5��S�o��*�w"Z8��J"��C��_p�0ߔ�ܽ �7��,| �g�mAr� r� !�<�/��<0��WyU����m���격r�����>/�5;�G�vó�����8����aT�`X�_ΠFeL��o�J- !��� �2�7t��Mq���O0uͱv���1t6��Po^'�L��u�b� �i��$<U 5�;� |B ����]J4B8���w��o^��+�"�8-�h�,۪U�qs��=�]�����@�n.�~h �g`�I$j(����wa*Ja>%� �����YZ�r=/5���UN���l�{�엷�n+2��x����+/���$�Kɫ��}Gvl�`�u��mr|$�� YbD�W b�Z��a�y�y1���ZlC�T^���:1k7�ӫ �0�d�0�Y/� ��G �X�7���8�Wo���#���q��t}I��\�������d�x�TϺ��4�]v���#%UuM:��UՑ��["�Q���@s��ŸW�[�u��O�<�~�����X��feZ�Y�����~��H{�{o3���2]� ��^�Dk�#q�F�9'�� ��� �D�7��<3Q�V�g ͜&J'�tc���R>�쯤�Fdsp�)��0��m��"X�]�~�5��������� V� �/ Z�[iξ+�Y٫-E�P��n)��4����P�e����� J,�ʱ D��lK��\#����� ����_� �&��;�L���'x��;��k-Q�,���(rT�8����d �N% ��4�:@E ]������%��)�<�*P��)���u�BK�ċٻ�/C���Ƹ�F��~�w�iHl�T��j��t����⯳~xF� @l%H��� HM/0Č�� qlj�// MQ�Zi�m!U�`4�����5tG�0�����B�L=[43��$������v �!#��K븧����bDܵ| ����W9t�������ʛ���Un ȯ�l�� 9�c)�g��7�(�"6� �뽒8Γ�rZ �b��mE)Z�$����DP�|��E��{T�� �|��o~taw%���(��4�U�\ d�lU�̙���%8��Z S[5=�C.�tj1��}t��<�F���Li�D �[�%�U�\h����m�7�7� r�{��p�+!+��Kc���߹ ��&@��n� 4F��^�(�#38W�l7��I�I� ���f��]T�,�0�T� G3�7� �ط��䃏H�,��N��^���]6 ���cg������ �!�2�u�l{��ؾW�5�� ,T�;r� �)���x��F|,0?ਫ���U@�']�s��7x�� ��o�X���d�[%�>��.]��W$�o�;��/�~�W��no�U7�k��j����\L��A'ku<n�N�iw�:� ��?Jx����� �J����|�Zn����qo��%��śs^���H5)%[��ol�^F/I���S��k5e��� ��B�� �L��t�A���RtÔ�zy l�GF �D4#��F��z`��d0P�k�Gd��v&M���MI��:�ZU���x�G�����Q����� CA>T���lyP �D����$.1R�����������Y���U��E?O�W������1�l;���eؼj�6 �4ub�91����ҥ:�y��_{�V/��&�fG��!�������9E����c@�w�������d3X��K���Kq�N�2sz@�^����0ag��b��Ǭ֞0Ӹ���kNݧ����Xz�0��d ~w��� �L`a��c�#�� Bld�1�4{�����]�f�Ɲjk;m�4��g�[))� �IQzb{HAl�Vd J��� 40�%��M�Ɲ�+�!pRV��,c4���7���l���&�,�m{�A�W��j�B���Žo�@�� z�PB�:D���3�f�R \�Π�[��`���vMO�,w��M� �����ܹ����펂m �h,M��:��z l����m����%dh��7 7�W){d�X�D\��8�=�B�"��z���_�`��5+ٓ�P}&8�:f�dz����q��(�=���9<1��D�T��}�N�A� g݉��w�� ���R�>�٪� d&�(���g �~�#r��[ƚ�ff� ���V�8��Sr1��9���5���\�V�:��|�Dw>M����H~����O���Z�e�K.�N��oXDR<�@���@�,�%w�����q �[sÕ 7r��^T�X ���5�0C��B{�!�؍
Sections
.text Size: - Virtual size: 585KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Baymax0 Size: - Virtual size: 921KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Baymax1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BaymaxN Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
StreamFab 6.1.9.6 (x64) Multilingual/Crack/uxtheme.dll.dll windows:5 windows x64 arch:x64
Password: P
8b990a02d9eff7bd4479034e75c91c23
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
d:\NsStudy\Home\InjectDllx64\bin\uxtheme.pdb
Imports
kernel32
DisableThreadLibraryCalls
LoadLibraryA
GetSystemDirectoryA
GetProcAddress
GetCommandLineW
GetTickCount
Sleep
ExitProcess
CreateThread
GetModuleFileNameW
LoadLibraryW
OutputDebugStringW
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
GetLastError
FlsAlloc
HeapSize
GetModuleHandleW
RtlUnwindEx
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapReAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers
shlwapi
SHGetValueW
PathRemoveFileSpecW
user32
FindWindowW
RegisterWindowMessageW
SendMessageW
shell32
CommandLineToArgvW
Exports
Exports
BeginBufferedAnimation
BeginBufferedPaint
BeginPanningFeedback
BufferedPaintClear
BufferedPaintInit
BufferedPaintRenderAnimation
BufferedPaintSetAlpha
BufferedPaintStopAllAnimations
BufferedPaintUnInit
CloseThemeData
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DrawThemeBackground
DrawThemeBackgroundEx
DrawThemeEdge
DrawThemeIcon
DrawThemeParentBackground
DrawThemeParentBackgroundEx
DrawThemeText
DrawThemeTextEx
EnableThemeDialogTexture
EnableTheming
EndBufferedAnimation
EndBufferedPaint
EndPanningFeedback
GetBufferedPaintBits
GetBufferedPaintDC
GetBufferedPaintTargetDC
GetBufferedPaintTargetRect
GetColorFromPreference
GetCurrentThemeName
GetImmersiveColorFromColorSetEx
GetImmersiveUserColorSetPreference
GetThemeAnimationProperty
GetThemeAnimationTransform
GetThemeAppProperties
GetThemeBackgroundContentRect
GetThemeBackgroundExtent
GetThemeBackgroundRegion
GetThemeBitmap
GetThemeBool
GetThemeColor
GetThemeDocumentationProperty
GetThemeEnumValue
GetThemeFilename
GetThemeFont
GetThemeInt
GetThemeIntList
GetThemeMargins
GetThemeMetric
GetThemePartSize
GetThemePosition
GetThemePropertyOrigin
GetThemeRect
GetThemeStream
GetThemeString
GetThemeSysBool
GetThemeSysColor
GetThemeSysColorBrush
GetThemeSysFont
GetThemeSysInt
GetThemeSysSize
GetThemeSysString
GetThemeTextExtent
GetThemeTextMetrics
GetThemeTimingFunction
GetThemeTransitionDuration
GetUserColorPreference
GetWindowTheme
HitTestThemeBackground
IsAppThemed
IsCompositionActive
IsThemeActive
IsThemeBackgroundPartiallyTransparent
IsThemeDialogTextureEnabled
IsThemePartDefined
OpenThemeData
OpenThemeDataEx
OpenThemeDataForDpi
SetThemeAppProperties
SetWindowTheme
SetWindowThemeAttribute
ThemeInitApiHook
UpdatePanningFeedback
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 668B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
StreamFab 6.1.9.6 (x64) Multilingual/Readme.txt
-
StreamFab 6.1.9.6 (x64) Multilingual/streamfab_x64_6196.exe.exe windows:5 windows x86 arch:x86
Password: P
9b2d85cfb981fac8da9a22dd767ac18e
Code Sign
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate
IssuerCN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BENot Before19/09/2018, 00:00Not After28/01/2028, 12:00SubjectCN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSignKey Usages
KeyUsageCertSign
KeyUsageCRLSign
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate
IssuerCN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSignNot Before28/07/2020, 00:00Not After18/03/2029, 00:00SubjectCN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate
IssuerCN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BENot Before28/07/2020, 00:00Not After28/07/2030, 00:00SubjectCN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
2a:e8:06:75:b7:45:87:6b:e6:9e:15:73Certificate
IssuerCN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BENot Before06/09/2023, 06:47Not After06/09/2026, 06:47SubjectSERIALNUMBER=91110108766259016Q,CN=DVDFab Software Inc.,O=DVDFab Software Inc.,STREET=海淀区北四环西路9号2108,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6eExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15Certificate
IssuerCN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BENot Before02/11/2023, 10:30Not After04/12/2034, 10:30SubjectCN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BEExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate
IssuerCN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSignNot Before20/06/2018, 00:00Not After10/12/2034, 00:00SubjectCN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BEKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate
IssuerCN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSignNot Before10/12/2014, 00:00Not After10/12/2034, 00:00SubjectCN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSignKey Usages
KeyUsageCertSign
KeyUsageCRLSign
11:23:98:ce:20:e5:b5:e6:d1:ea:d6:5a:e2:51:80:1f:f6:66:57:fcSigner
Actual PE Digest11:23:98:ce:20:e5:b5:e6:d1:ea:d6:5a:e2:51:80:1f:f6:66:57:fcDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
X:\project\installer\setup-3\Release\SetupProxyCommon.pdb
Imports
powrprof
SetSuspendState
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
CreateFileW
DeleteFileW
FindFirstFileW
FindNextFileW
GetVersionExW
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
lstrcmpiW
MulDiv
GetPrivateProfileIntW
OutputDebugStringA
GetModuleFileNameA
GetTempPathA
CreateDirectoryA
RemoveDirectoryA
SetFileAttributesA
GetFileAttributesA
DeleteFileA
FindFirstFileA
FindNextFileA
CreateFileA
GetDiskFreeSpaceA
GetDriveTypeA
GetFileSize
SetFileAttributesW
SetFilePointer
DeviceIoControl
GetWindowsDirectoryA
GetModuleHandleA
GetShortPathNameA
QueryDosDeviceA
CopyFileA
MoveFileA
MoveFileW
MoveFileExA
MoveFileExW
GetVolumeInformationA
CreateEventA
SetEvent
CreateProcessA
GetSystemDirectoryA
GetVersionExA
GetNativeSystemInfo
GlobalLock
GlobalUnlock
IsDBCSLeadByte
GetSystemTimeAsFileTime
lstrlenA
GetFileAttributesW
QueryPerformanceCounter
WaitForSingleObjectEx
GetStdHandle
WriteFile
FreeConsole
SetConsoleTitleA
AllocConsole
GetDiskFreeSpaceW
RemoveDirectoryW
FileTimeToSystemTime
GetDiskFreeSpaceExA
FindResourceW
SetEnvironmentVariableA
WriteConsoleW
SetStdHandle
OutputDebugStringW
VirtualQuery
FindFirstFileExW
GetTimeZoneInformation
SetFilePointerEx
ReadConsoleW
GetConsoleCP
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileType
HeapSize
GetOEMCP
GetACP
GetModuleHandleW
LoadLibraryW
LoadLibraryA
GetTickCount
GetSystemInfo
HeapFree
CloseHandle
FindClose
SizeofResource
LoadResource
Sleep
GetLastError
GetCurrentThreadId
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
OpenProcess
GetProcAddress
FreeLibrary
LockResource
WaitForSingleObject
CreateDirectoryW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
GlobalMemoryStatus
EncodePointer
DecodePointer
IsValidCodePage
GetModuleHandleExW
ExitProcess
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
SetConsoleMode
LCMapStringW
CompareStringW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetConsoleMode
LoadLibraryExW
GetFileInformationByHandle
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
HeapReAlloc
ExitThread
CreateThread
SystemTimeToTzSpecificLocalTime
IsProcessorFeaturePresent
IsDebuggerPresent
SetEndOfFile
ReadFile
RtlUnwind
RaiseException
GetStringTypeW
GetCommandLineA
HeapAlloc
LocalFree
FormatMessageA
FormatMessageW
SetConsoleCtrlHandler
GetProcessTimes
SetFileApisToOEM
GetConsoleScreenBufferInfo
AreFileApisANSI
SetProcessAffinityMask
MapViewOfFile
UnmapViewOfFile
OpenEventA
OpenFileMappingA
VirtualAlloc
VirtualFree
FileTimeToDosDateTime
CompareFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FileTimeToLocalFileTime
SetLastError
SetFileTime
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
InitializeCriticalSection
GetLogicalDriveStringsA
GetLogicalDriveStringsW
user32
CharUpperW
MessageBoxW
PostMessageW
ExitWindowsEx
wsprintfW
LoadStringA
FindWindowW
CharUpperA
GetWindowThreadProcessId
CharNextA
SystemParametersInfoA
GetDesktopWindow
GetForegroundWindow
GetSystemMetrics
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
OpenClipboard
IsWindowVisible
SetWindowPos
PostMessageA
CloseDesktop
EnumDesktopWindows
OpenDesktopA
GetDC
gdi32
CreateFontIndirectW
GetDeviceCaps
advapi32
AllocateAndInitializeSid
GetFileSecurityW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
RegSetValueA
RegQueryValueA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyA
LookupPrivilegeValueA
RegQueryInfoKeyA
RegOpenKeyA
RegEnumValueA
RegEnumKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegCloseKey
CheckTokenMembership
DuplicateTokenEx
LookupPrivilegeValueW
FreeSid
AdjustTokenPrivileges
OpenProcessToken
SetFileSecurityW
shell32
CommandLineToArgvW
ShellExecuteExW
ShellExecuteA
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteW
SHGetPathFromIDListA
ShellExecuteExA
ole32
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoCreateGuid
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
oleaut32
VariantClear
SysFreeString
SysAllocString
SysStringLen
SysAllocStringLen
VariantCopy
shlwapi
StrCpyNW
StrChrW
PathAppendW
PathRemoveFileSpecW
PathAppendA
StrCpyW
StrCmpW
StrCatW
StrRChrW
PathFileExistsW
PathFileExistsA
netapi32
NetApiBufferFree
NetWkstaGetInfo
psapi
GetModuleFileNameExW
iphlpapi
GetAdaptersInfo
dbghelp
MiniDumpWriteDump
Sections
.text Size: 573KB - Virtual size: 572KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 800KB - Virtual size: 799KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ