Easy Binder[.]7z

Sharing

Copy URL

Twitter E-mail

General

Target

Easy Binder.7z
Size

2.3MB
MD5

20e4b38f306895444b7d8a4928147b10
SHA1

40a443940d1768b65c30a79a652e93dae9588e8b
SHA256

307cd01d0fd9fca694af6c36cb6e0a34863d7f8e347021794ed8d79692a6dd6c
SHA512

fc09f4673eb4670dcf6796fb9a95a91f170e3a37ee6375ca069c337b56aad3967c3b5a278d842a152e8ca923ed1116cb4a66bd3509b796602698cc23b9aff75c
SSDEEP

49152:E+VVZlbOVwgTAUQYbnJ2sUqc+Kk4WTp2BoR7Y2kS:E+VBWTAUQYzbUdkTkoRUu

Score

3^/10

Malware Config

Signatures

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Easy Binder/AngleSharp.dll
unpack001/Easy Binder/CoreShell.dll
unpack001/Easy Binder/Easy Binder.exe
unpack001/Easy Binder/RDXService.dll
unpack001/Easy Binder/db/AngleSharp.dll
unpack001/Easy Binder/db/CoreShell.dll
unpack001/Easy Binder/db/Ionic.Zip.dll
unpack001/Easy Binder/db/Launcher.exe
unpack001/Easy Binder/db/RDXService.dll
unpack001/Easy Binder/db/ebdds.exe

Files

Easy Binder.7z
.7z
Easy Binder/AngleSharp.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\Code\AngleSharp\AngleSharp.Core\src\AngleSharp\bin\Release\net45\AngleSharp.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Easy Binder/CoreShell.dll
.dll windows:10 windows x64 arch:x64

d0d3277e5b74d2e30e15d8669771dafd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

CoreShell.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

memset
wcsncmp
wcscspn

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
__std_terminate
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
_CxxThrowException
wcsrchr
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
InitializeCriticalSectionEx
AcquireSRWLockShared
CreateSemaphoreExW
ReleaseSRWLockShared
InitializeSRWLock
CreateMutexExW
CreateEventExW
ReleaseSRWLockExclusive
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
WaitForSingleObject
ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
OpenThreadToken
OpenProcessToken
GetCurrentThreadId
GetCurrentThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventRegister

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError
RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsSubstringWithSpecifiedLength
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsDuplicateString
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegGetValueW
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW

api-ms-win-core-synch-l1-2-0

InitOnceComplete
WaitOnAddress
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWaitCallbacks

rpcrt4

RpcImpersonateClient
RpcRevertToSelf
RpcServerInqCallAttributesW
I_RpcBindingInqLocalClientPID

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-rtcore-ntuser-window-l1-1-0

GetWindowThreadProcessId

api-ms-win-shcore-thread-l1-1-0

SHGetThreadRef

api-ms-win-core-winrt-propertysetprivate-l1-1-1

RoCreatePropertySetSerializer

api-ms-win-appmodel-runtime-l1-1-1

GetApplicationUserModelIdFromToken

coremessaging

CoreUICreate

coreuicomponents

CoreUIFactoryCreate
CoreUIClientCreate

api-ms-win-shcore-registry-l1-1-0

SHCopyKeyW

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

ntdll

RtlGetDeviceFamilyInfoEnum
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlPublishWnfStateData

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

api-ms-win-shcore-scaling-l1-1-1

GetScaleFactorForMonitor

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

msvcp_win

?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
_Cnd_broadcast
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_init_in_situ
_Cnd_init_in_situ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_wait
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_destroy_in_situ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 477KB - Virtual size: 477KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Easy Binder/Easy Binder.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\thorson\Desktop\Launcher1\Launcher\Launcher\obj\Debug\LUNCHER CRACKING.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Easy Binder/RDXService.dll
.dll windows:10 windows x64 arch:x64

41fe2269dd6b4fc9e271773a5a81f94b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

RDXService.pdb

Imports

msvcrt

memcmp
__crtLCMapStringA
__crtLCMapStringW
memmove
memcpy
sprintf_s
_wtof
wcstok_s
swprintf_s
_set_errno
_XcptFilter
_amsg_exit
??1bad_cast@@UEAA@XZ
_CxxThrowException
_initterm
_wcsdup
_itow_s
abort
islower
?what@exception@@UEBAPEBDXZ
_get_current_locale
calloc
isupper
__pctype_func
memset
__C_specific_handler
?terminate@@YAXXZ
_free_locale
_get_errno
_ismbblead
___lc_codepage_func
___lc_handle_func
wcsstr
_lock
_unlock
__dllonexit
___mb_cur_max_func
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
memmove_s
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
_errno
_onexit
memcpy_s
setlocale
toupper
wcschr
wcsrchr
??0bad_cast@@QEAA@AEBV0@@Z
_wcsnicmp
??1type_info@@UEAA@XZ
ldiv
_wcsicmp
_vsnwprintf
??_V@YAXPEAX@Z
realloc
__CxxFrameHandler3
strcspn
localeconv
??0bad_cast@@QEAA@PEBD@Z
free
wcsncmp
sqrtf

propsys

PSCreateMemoryPropertyStore
PropVariantToBoolean
VariantToStringAlloc
VariantToInt32

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

api-ms-win-shcore-registry-l1-1-0

SHSetValueW
SHDeleteValueW

api-ms-win-shcore-stream-l1-1-0

IStream_Reset
IStream_Write
IStream_Size
SHCreateStreamOnFileEx

windows.storage

ShellExecuteExW
SHCreateItemFromParsingName
SHGetNameFromIDList
SHGetKnownFolderPath
ILClone
ord866

shcore

ord200

rpcrt4

NdrDllCanUnloadNow
NdrDllGetClassObject
NdrCStdStubBuffer_Release
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance
CoRegisterClassObject
CoGetMalloc
CoTaskMemRealloc
CoTaskMemAlloc
CoReleaseServerProcess
CoRevokeClassObject
CoResumeClassObjects
CoSetProxyBlanket
CoAddRefServerProcess
CLSIDFromString
CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
CoWaitForMultipleHandles
CoGetApartmentType
PropVariantClear
CoInitializeSecurity
CoUninitialize
StringFromGUID2
CoDisconnectObject
CoInitializeEx

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
DisableThreadLibraryCalls
LoadResource
LockResource
FindResourceExW
FreeLibrary
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
CreateSemaphoreExW
OpenSemaphoreW
SetEvent
CreateEventW
OpenEventW
ReleaseSemaphore
CreateEventExW
ReleaseSRWLockShared
EnterCriticalSection
WaitForSingleObjectEx
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSectionEx
ResetEvent
DeleteCriticalSection
CreateMutexExW
ReleaseMutex
AcquireSRWLockExclusive
WaitForMultipleObjectsEx
AcquireSRWLockShared
InitializeSRWLock

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventSetInformation
EventProviderEnabled

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegQueryInfoKeyW
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegCopyTreeW
RegOpenCurrentUser
RegEnumKeyExW
RegEnumValueW
RegDeleteTreeW

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
CreateProcessW
ResumeThread
OpenProcessToken
GetCurrentThreadId
OpenThreadToken
GetCurrentThread
GetCurrentProcess
CreateThread
GetCurrentProcessId

api-ms-win-core-winrt-l1-1-0

RoRevokeActivationFactories
RoGetActivationFactory
RoRegisterActivationFactories
RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
SetRestrictedErrorInfo
RoOriginateErrorW
RoOriginateError

api-ms-win-core-localization-l1-2-0

GetUserGeoID
GetLocaleInfoW
GetThreadUILanguage
FormatMessageW
GetGeoInfoW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-url-l1-1-0

ParseURLW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetLocalTime
GlobalMemoryStatusEx
GetWindowsDirectoryW
GetTickCount

oleaut32

SysAllocString
VariantClear
SysFreeString

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-sysinfo-l1-2-1

GetPhysicallyInstalledSystemMemory

api-ms-win-core-file-l1-1-0

CompareFileTime
DeleteFileW
FindClose
CreateDirectoryW
GetDriveTypeW
FindNextFileW
CreateFileW
SetFileAttributesW
RemoveDirectoryW
ReadFile
GetFileSizeEx
SetFilePointerEx
FindFirstFileW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-path-l1-1-0

PathCchAppend
PathCchCombine

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

api-ms-win-security-base-l1-1-0

InitializeAcl
AdjustTokenPrivileges
GetLengthSid
AddAce
DeleteAce
IsWellKnownSid
RevertToSelf
ImpersonateLoggedOnUser
EqualSid
GetAce
GetAclInformation
GetTokenInformation
DestroyPrivateObjectSecurity

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-appmodel-runtime-l1-1-0

PackageNameAndPublisherIdFromFamilyName
PackageFamilyNameFromFullName
GetPackagesByPackageFamily

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal
GetStringTypeW

xmllite

CreateXmlWriter
CreateXmlReader

sspicli

LsaEnumerateLogonSessions
LsaGetLogonSessionData
LsaFreeReturnBuffer

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
ChangeServiceConfigW

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
ExpandEnvironmentStringsW

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient9
ObjectStublessClient10
ObjectStublessClient4
ObjectStublessClient8
ObjectStublessClient5
ObjectStublessClient3

api-ms-win-security-provider-l1-1-0

SetSecurityInfo
GetSecurityInfo

api-ms-win-shell-namespace-l1-1-0

SHParseDisplayName
ILFree

api-ms-win-core-registry-l2-1-0

RegCreateKeyW

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-shlwapi-winrt-storage-l1-1-1

ord24
PathIsDirectoryEmptyW
StrFormatByteSizeEx

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch
StrCmpW
StrRChrW

ntdll

RtlGetDeviceFamilyInfoEnum
RtlGetVersion

api-ms-win-rtcore-ntuser-window-l1-1-0

SetWindowLongPtrW
RegisterClassExW
DefWindowProcW
GetWindowLongPtrW
GetMessageW
SetTimer
DestroyWindow
DispatchMessageW
TranslateMessage
PostQuitMessage
KillTimer
PeekMessageW
UnregisterClassW
CreateWindowExW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-appmodel-runtime-internal-l1-1-1

GetPackageStatusForUser

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW
PathRemoveFileSpecW
PathStripPathW
PathFindFileNameW
PathRemoveBackslashW
PathFindExtensionW

api-ms-win-core-registryuserspecific-l1-1-0

SHRegGetUSValueW

api-ms-win-shell-changenotify-l1-1-0

SHChangeNotify

appxalluserstore

GetAllPackagesToBeInstalledForUser
DeleteAllPackagesFromMainPackageArray

dmenrollengine

EnrollEngineInitialize

wlanapi

WlanFreeMemory
WlanGetProfile
WlanCloseHandle
WlanOpenHandle

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-cryptoapi-l1-1-0

CryptDestroyHash
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptAcquireContextW
CryptReleaseContext

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
GetProxyDllInfo
OpenRDXDocumentW
ServiceMain

Sections

.text
Size: 488KB - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 198KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Easy Binder/db/AngleSharp.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\Code\AngleSharp\AngleSharp.Core\src\AngleSharp\bin\Release\net45\AngleSharp.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Easy Binder/db/CoreShell.dll
.dll windows:10 windows x64 arch:x64

d0d3277e5b74d2e30e15d8669771dafd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

CoreShell.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

memset
wcsncmp
wcscspn

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_malloc
_o_realloc
_o_terminate
__C_specific_handler
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
__std_terminate
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
_CxxThrowException
wcsrchr
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
InitializeCriticalSectionEx
AcquireSRWLockShared
CreateSemaphoreExW
ReleaseSRWLockShared
InitializeSRWLock
CreateMutexExW
CreateEventExW
ReleaseSRWLockExclusive
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
OpenSemaphoreW
WaitForSingleObjectEx
WaitForSingleObject
ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
TerminateProcess
OpenThreadToken
OpenProcessToken
GetCurrentThreadId
GetCurrentThread

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventRegister

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
RoOriginateError
RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-string-l1-1-0

WindowsSubstringWithSpecifiedLength
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsDuplicateString
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
RoReportFailedDelegate

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegGetValueW
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW

api-ms-win-core-synch-l1-2-0

InitOnceComplete
WaitOnAddress
InitOnceBeginInitialize
InitOnceExecuteOnce
Sleep

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolWait
CloseThreadpoolWait
CreateThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
WaitForThreadpoolWaitCallbacks

rpcrt4

RpcImpersonateClient
RpcRevertToSelf
RpcServerInqCallAttributesW
I_RpcBindingInqLocalClientPID

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
CreateTimerQueueTimer

api-ms-win-rtcore-ntuser-window-l1-1-0

GetWindowThreadProcessId

api-ms-win-shcore-thread-l1-1-0

SHGetThreadRef

api-ms-win-core-winrt-propertysetprivate-l1-1-1

RoCreatePropertySetSerializer

api-ms-win-appmodel-runtime-l1-1-1

GetApplicationUserModelIdFromToken

coremessaging

CoreUICreate

coreuicomponents

CoreUIFactoryCreate
CoreUIClientCreate

api-ms-win-shcore-registry-l1-1-0

SHCopyKeyW

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

ntdll

RtlGetDeviceFamilyInfoEnum
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlPublishWnfStateData

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

api-ms-win-shcore-scaling-l1-1-1

GetScaleFactorForMonitor

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

msvcp_win

?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
_Cnd_broadcast
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_init_in_situ
_Cnd_init_in_situ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_wait
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
_Cnd_destroy_in_situ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 477KB - Virtual size: 477KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Easy Binder/db/Ionic.Zip.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\DotNetZip\Zip\obj\Debug\Ionic.Zip.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Easy Binder/db/LICENCE.dat
.zip
Easy Binder/db/Launcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Easy Binder/db/RDXService.dll
.dll windows:10 windows x64 arch:x64

41fe2269dd6b4fc9e271773a5a81f94b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

RDXService.pdb

Imports

msvcrt

memcmp
__crtLCMapStringA
__crtLCMapStringW
memmove
memcpy
sprintf_s
_wtof
wcstok_s
swprintf_s
_set_errno
_XcptFilter
_amsg_exit
??1bad_cast@@UEAA@XZ
_CxxThrowException
_initterm
_wcsdup
_itow_s
abort
islower
?what@exception@@UEBAPEBDXZ
_get_current_locale
calloc
isupper
__pctype_func
memset
__C_specific_handler
?terminate@@YAXXZ
_free_locale
_get_errno
_ismbblead
___lc_codepage_func
___lc_handle_func
wcsstr
_lock
_unlock
__dllonexit
___mb_cur_max_func
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
memmove_s
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
??3@YAXPEAX@Z
_errno
_onexit
memcpy_s
setlocale
toupper
wcschr
wcsrchr
??0bad_cast@@QEAA@AEBV0@@Z
_wcsnicmp
??1type_info@@UEAA@XZ
ldiv
_wcsicmp
_vsnwprintf
??_V@YAXPEAX@Z
realloc
__CxxFrameHandler3
strcspn
localeconv
??0bad_cast@@QEAA@PEBD@Z
free
wcsncmp
sqrtf

propsys

PSCreateMemoryPropertyStore
PropVariantToBoolean
VariantToStringAlloc
VariantToInt32

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask

api-ms-win-shcore-registry-l1-1-0

SHSetValueW
SHDeleteValueW

api-ms-win-shcore-stream-l1-1-0

IStream_Reset
IStream_Write
IStream_Size
SHCreateStreamOnFileEx

windows.storage

ShellExecuteExW
SHCreateItemFromParsingName
SHGetNameFromIDList
SHGetKnownFolderPath
ILClone
ord866

shcore

ord200

rpcrt4

NdrDllCanUnloadNow
NdrDllGetClassObject
NdrCStdStubBuffer_Release
IUnknown_QueryInterface_Proxy
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Connect
NdrOleAllocate
CStdStubBuffer_QueryInterface
CStdStubBuffer_CountRefs
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoCreateInstance
CoRegisterClassObject
CoGetMalloc
CoTaskMemRealloc
CoTaskMemAlloc
CoReleaseServerProcess
CoRevokeClassObject
CoResumeClassObjects
CoSetProxyBlanket
CoAddRefServerProcess
CLSIDFromString
CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
CoWaitForMultipleHandles
CoGetApartmentType
PropVariantClear
CoInitializeSecurity
CoUninitialize
StringFromGUID2
CoDisconnectObject
CoInitializeEx

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
LoadLibraryExW
GetModuleHandleExW
DisableThreadLibraryCalls
LoadResource
LockResource
FindResourceExW
FreeLibrary
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
CreateSemaphoreExW
OpenSemaphoreW
SetEvent
CreateEventW
OpenEventW
ReleaseSemaphore
CreateEventExW
ReleaseSRWLockShared
EnterCriticalSection
WaitForSingleObjectEx
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSectionEx
ResetEvent
DeleteCriticalSection
CreateMutexExW
ReleaseMutex
AcquireSRWLockExclusive
WaitForMultipleObjectsEx
AcquireSRWLockShared
InitializeSRWLock

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsCreateString
WindowsCreateStringReference
WindowsGetStringRawBuffer

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventSetInformation
EventProviderEnabled

api-ms-win-core-registry-l1-1-0

RegDeleteValueW
RegQueryInfoKeyW
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegCopyTreeW
RegOpenCurrentUser
RegEnumKeyExW
RegEnumValueW
RegDeleteTreeW

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
CreateProcessW
ResumeThread
OpenProcessToken
GetCurrentThreadId
OpenThreadToken
GetCurrentThread
GetCurrentProcess
CreateThread
GetCurrentProcessId

api-ms-win-core-winrt-l1-1-0

RoRevokeActivationFactories
RoGetActivationFactory
RoRegisterActivationFactories
RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

RoTransformError
SetRestrictedErrorInfo
RoOriginateErrorW
RoOriginateError

api-ms-win-core-localization-l1-2-0

GetUserGeoID
GetLocaleInfoW
GetThreadUILanguage
FormatMessageW
GetGeoInfoW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-url-l1-1-0

ParseURLW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetLocalTime
GlobalMemoryStatusEx
GetWindowsDirectoryW
GetTickCount

oleaut32

SysAllocString
VariantClear
SysFreeString

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-sysinfo-l1-2-1

GetPhysicallyInstalledSystemMemory

api-ms-win-core-file-l1-1-0

CompareFileTime
DeleteFileW
FindClose
CreateDirectoryW
GetDriveTypeW
FindNextFileW
CreateFileW
SetFileAttributesW
RemoveDirectoryW
ReadFile
GetFileSizeEx
SetFilePointerEx
FindFirstFileW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-path-l1-1-0

PathCchAppend
PathCchCombine

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW

api-ms-win-security-base-l1-1-0

InitializeAcl
AdjustTokenPrivileges
GetLengthSid
AddAce
DeleteAce
IsWellKnownSid
RevertToSelf
ImpersonateLoggedOnUser
EqualSid
GetAce
GetAclInformation
GetTokenInformation
DestroyPrivateObjectSecurity

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-service-core-l1-1-0

SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-appmodel-runtime-l1-1-0

PackageNameAndPublisherIdFromFamilyName
PackageFamilyNameFromFullName
GetPackagesByPackageFamily

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal
GetStringTypeW

xmllite

CreateXmlWriter
CreateXmlReader

sspicli

LsaEnumerateLogonSessions
LsaGetLogonSessionData
LsaFreeReturnBuffer

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
ChangeServiceConfigW

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
ExpandEnvironmentStringsW

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient6
ObjectStublessClient7
ObjectStublessClient9
ObjectStublessClient10
ObjectStublessClient4
ObjectStublessClient8
ObjectStublessClient5
ObjectStublessClient3

api-ms-win-security-provider-l1-1-0

SetSecurityInfo
GetSecurityInfo

api-ms-win-shell-namespace-l1-1-0

SHParseDisplayName
ILFree

api-ms-win-core-registry-l2-1-0

RegCreateKeyW

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-shlwapi-winrt-storage-l1-1-1

ord24
PathIsDirectoryEmptyW
StrFormatByteSizeEx

api-ms-win-core-shlwapi-obsolete-l1-1-0

QISearch
StrCmpW
StrRChrW

ntdll

RtlGetDeviceFamilyInfoEnum
RtlGetVersion

api-ms-win-rtcore-ntuser-window-l1-1-0

SetWindowLongPtrW
RegisterClassExW
DefWindowProcW
GetWindowLongPtrW
GetMessageW
SetTimer
DestroyWindow
DispatchMessageW
TranslateMessage
PostQuitMessage
KillTimer
PeekMessageW
UnregisterClassW
CreateWindowExW

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

api-ms-win-appmodel-runtime-internal-l1-1-1

GetPackageStatusForUser

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW
PathRemoveFileSpecW
PathStripPathW
PathFindFileNameW
PathRemoveBackslashW
PathFindExtensionW

api-ms-win-core-registryuserspecific-l1-1-0

SHRegGetUSValueW

api-ms-win-shell-changenotify-l1-1-0

SHChangeNotify

appxalluserstore

GetAllPackagesToBeInstalledForUser
DeleteAllPackagesFromMainPackageArray

dmenrollengine

EnrollEngineInitialize

wlanapi

WlanFreeMemory
WlanGetProfile
WlanCloseHandle
WlanOpenHandle

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-cryptoapi-l1-1-0

CryptDestroyHash
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptAcquireContextW
CryptReleaseContext

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject
GetProxyDllInfo
OpenRDXDocumentW
ServiceMain

Sections

.text
Size: 488KB - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 198KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Easy Binder/db/ebdds.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Documents and Settings\Administrator\My Documents\Visual Studio 2005\Projects\binder\obj\Release\Easy Binder.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 4KB - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

d0d3277e5b74d2e30e15d8669771dafd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-threadpool-l1-2-0

rpcrt4

api-ms-win-security-base-l1-1-0

api-ms-win-core-errorhandling-l1-1-2

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-winrt-propertysetprivate-l1-1-1

api-ms-win-appmodel-runtime-l1-1-1

coremessaging

coreuicomponents

api-ms-win-shcore-registry-l1-1-0

api-ms-win-stateseparation-helpers-l1-1-0

ntdll

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

api-ms-win-core-apiquery-l1-1-0

msvcp_win

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 477KB - Virtual size: 477KB

.data Size: 4KB - Virtual size: 7KB

.pdata Size: 57KB - Virtual size: 56KB

.didat Size: 512B - Virtual size: 208B

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 28KB - Virtual size: 28KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 477KB - Virtual size: 477KB

.data
Size: 4KB - Virtual size: 7KB

.pdata
Size: 57KB - Virtual size: 56KB

.didat
Size: 512B - Virtual size: 208B

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 28KB - Virtual size: 28KB

.text
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 221KB - Virtual size: 220KB

.reloc
Size: 512B - Virtual size: 12B