1390254e815bcf8b165746e61b75c33a67be98a927def1c0dcd9af10da66d9fc.zip
- SHA256 1390254e815bcf8b165746e61b75c33a67be98a927def1c0dcd9af10da66d9fc
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d3d11.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
d3d11.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
s-etup.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
s-etup.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 1390254e815bcf8b165746e61b75c33a67be98a927def1c0dcd9af10da66d9fc.zip
- Size 3.0MB
- Sample241011-bgl34ascmj
- SHA256 1390254e815bcf8b165746e61b75c33a67be98a927def1c0dcd9af10da66d9fc
- MD5 df260f1223832132ba7703c4d83fb5a7
- SHA1 76589851f57e29c645669b7db1de810ff3b1cab3
- SHA512 1c56fd67a71f61d41a56cabaa337e91e7ac52d9ef64acddfaed86a674897731460e9e4ae42807bec82051a53d18f776b2d63f8b911cb98b6a13854acd95ac7c1
- SSDEEP 49152:+0Df17SYa2APxBpcuZpfDyQ/iF8R3QinAhbX2VrwDf6zN:7Dd7SCAPXpcuZV/iF8R3znAhbXgAf2N
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d3d11.dll
File Explorer
-
1390254e815bcf8b165746e61b75c33a67be98a927def1c0dcd9af10da66d9fc.zip.zip 3.0MB
-
d3d11.dll.dll 760.0MB
-
s-etup.exe.exe 678KB
d3d11.dll
- IMPHASH 1a2012a93085bbeafed7a508663d6e82
- SHA256 d7281141c92ebbaa12bfee27006325950be3121fede3d74fb68540b2babf402b
- MD5 4c73b7d9eb09095899cdff6785d4f8a4
- SHA1 2a9a608bf6b005d655e3e3e19baab52928bb2795
- SHA512 ffbd5fc43d9c44c238d95f384071519596d0a0e8a35b66dded2baed25433fc30118bb2f6d4830116140c6dd483941478e3c9b4df35207051a1132ea3d65ded41
- SSDEEP 196608:VnAO4YLd6cBToqh+/plnAO4YLd6cBToqh+/p:tAO46d6cBToqk/rAO46d6cBToqk/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
221114
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
WsmSvc.pdb
msvcrt
_wtoi
_wtof
_ftol2
_ultow
wcsrchr
wcsstr
wcscspn
wcstoul
rand
srand
_itow
strchr
_ftol2_sse
isdigit
ldiv
wcspbrk
strncmp
_wcsrev
_onexit
_lock
__dllonexit
_unlock
_amsg_exit
_initterm
free
malloc
_XcptFilter
??0exception@@QAE@XZ
_i64tow_s
memmove
isspace
_scprintf
_vsnprintf
_CxxThrowException
iswspace
tolower
iswxdigit
iswdigit
_wcsnicmp
wcsncmp
??0exception@@QAE@ABV0@@Z
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
_strnicmp
_atoi64
_wtoi64
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler4_common
iswalnum
??1exception@@UAE@XZ
memmove_s
memcpy_s
memset
_scwprintf
_vsnwprintf
wcschr
_wcsicmp
__CxxFrameHandler3
_purecall
memcpy
time
ntdll
EtwLogTraceEvent
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwEventActivityIdControl
EtwEventRegister
RtlInitString
NtAllocateLocallyUniqueId
RtlNtStatusToDosError
EtwEventWriteTransfer
EtwEventEnabled
EtwEventProviderEnabled
EtwEventWrite
EtwEventUnregister
kernel32
ReleaseSemaphore
SwitchToThread
OpenProcess
QueryInformationJobObject
OpenJobObjectW
CreateSemaphoreW
K32GetProcessMemoryInfo
LocalFree
LocalAlloc
FreeLibrary
GetProcAddress
LoadLibraryW
GetLastError
CloseHandle
DisableThreadLibraryCalls
SetEvent
SetLastError
UnregisterWait
CreateEventW
WaitForSingleObject
InterlockedIncrement
InterlockedDecrement
HeapSetInformation
HeapCreate
HeapDestroy
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapSize
HeapFree
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
InterlockedExchange
Sleep
OutputDebugStringA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OpenEventW
CreateJobObjectW
SetInformationJobObject
AssignProcessToJobObject
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetSystemTime
SystemTimeToFileTime
GetCurrentThread
WideCharToMultiByte
RegCloseKey
FindNLSString
CompareStringW
GetVersionExW
GetUserDefaultUILanguage
LoadLibraryA
InterlockedPushEntrySList
LoadLibraryExW
GetSystemDirectoryW
RegQueryValueExW
RegOpenKeyExW
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
GetComputerNameExW
GetLocaleInfoW
SetThreadUILanguage
EnumUILanguagesW
FormatMessageW
InterlockedPopEntrySList
ExpandEnvironmentStringsW
InitializeSListHead
InterlockedFlushSList
SetThreadPreferredUILanguages
WaitForMultipleObjects
DeleteTimerQueueTimer
CreateTimerQueueTimer
ResetEvent
UnregisterWaitEx
QueueUserWorkItem
RegisterWaitForSingleObject
GetThreadLocale
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegNotifyChangeKeyValue
DebugBreak
GetTickCount64
DuplicateHandle
FreeLibraryWhenCallbackReturns
GetModuleHandleExW
CloseThreadpoolWork
CreateThreadpoolWork
SubmitThreadpoolWork
CreateThread
LocalFileTimeToFileTime
CloseThreadpoolIo
WaitForThreadpoolIoCallbacks
CreateThreadpoolIo
FileTimeToSystemTime
CancelThreadpoolIo
StartThreadpoolIo
GetCommandLineW
InterlockedCompareExchange64
RegEnumKeyExW
RegEnumValueW
CreateFileW
GetFullPathNameW
RegSetKeySecurity
GlobalFree
oleaut32
SysAllocString
SysFreeString
SysAllocStringLen
SysStringLen
GetErrorInfo
VariantInit
VariantClear
VarCmp
logoncli
DsGetDcNameW
netapi32
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
ole32
CoTaskMemFree
CoDisconnectObject
CoUninitialize
CoFreeUnusedLibrariesEx
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoRevokeClassObject
CoTaskMemAlloc
rpcrt4
UuidFromStringW
UuidCreate
api-ms-win-security-base-l1-1-0
CreateWellKnownSid
ImpersonateLoggedOnUser
ImpersonateSelf
RevertToSelf
IsWellKnownSid
EqualSid
GetTokenInformation
GetSecurityDescriptorDacl
GetAce
MapGenericMask
AdjustTokenPrivileges
AllocateAndInitializeSid
FreeSid
CopySid
GetLengthSid
GetKernelObjectSecurity
MakeSelfRelativeSD
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
MakeAbsoluteSD
IsValidSid
CheckTokenMembership
SetKernelObjectSecurity
DuplicateTokenEx
AccessCheckAndAuditAlarmW
AddAccessAllowedAceEx
GetSecurityDescriptorLength
InitializeAcl
GetSecurityDescriptorSacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
@Borlndmm@SysGetMem$qqri
@Borlndmm@SysGetMem$qqri
?AddEvent@CWSManEnumerator@@QAEKPAUWSMAN_OBJECT@@0@Z
?AddObject@CWSManEnumerator@@QAEKPAUWSMAN_OBJECT@@0@Z
?Alloc@WSManMemory@@SGPAXIABVCallSite@TestSystem@@W4Mode@3@@Z
?AllocBstr@WSManMemory@@SGPAGPBGHABVCallSite@TestSystem@@@Z
D3D11CreateDevice
?Close@CWSManEnumerator@@QAEKXZ
?Free@WSManMemory@@SGXPAXABVCallSite@TestSystem@@@Z
?FreeBstr@WSManMemory@@SGXPAGHABVCallSite@TestSystem@@@Z
?Freeze@CWSManEnumerator@@QAEXXZ
?GetHeap@WSManMemory@@SGPAXXZ
?GetNext@CWSManEnumerator@@QAEKPAPAUWSMAN_OBJECT@@H@Z
?GetTotalObjectByteSize@CWSManEnumerator@@QAEHPAK@Z
?Initialize@CWSManEnumerator@@QAEKKKKK@Z
?Initialize@CWSManEnumerator@@QAEKPAX@Z
?ReAlloc@WSManMemory@@SGPAXPAXIABVCallSite@TestSystem@@W4Mode@3@@Z
CreateProvHost
EnumServiceUserResources
FwGetParsedDocument
FwGetRootElement
FwIsXmlEscapedProperly
FwXmlCloseParser
FwXmlCompareAttributeName
FwXmlCompareAttributeNameEx
FwXmlCompareElementName
FwXmlCompareElementNameEx
FwXmlCompareElementNameLen
FwXmlCompareElementNameSpace
FwXmlCompareName
FwXmlCreateXmlFromElement
FwXmlDecodeXmlEscapes
FwXmlEncodeXmlEscapes
FwXmlFindAttribute
FwXmlFindAttributeEx
FwXmlFindChildElement
FwXmlFindChildElementEx
FwXmlGetAttribute
FwXmlGetAttributeNameEx
FwXmlGetAttributeNamespacePrefix
FwXmlGetAttributeValue
FwXmlGetAttributeValueDWord
FwXmlGetBooleanValue
FwXmlGetBuffer
FwXmlGetChild
FwXmlGetElementName
FwXmlGetElementNameEx
FwXmlGetElementNamespacePrefix
FwXmlGetElementNamespaceUrl
FwXmlGetEntryNameEx
FwXmlGetNamespaceForPrefix
FwXmlGetNormalizedString
FwXmlGetReferenceXmlFromElement
FwXmlGetSimpleContent
FwXmlGetSimpleContentEx
FwXmlGetSimpleContentEx2
FwXmlHasText
FwXmlIsEmpty
FwXmlIsMustUnderstand
FwXmlIsNull
FwXmlIsSimpleContent
FwXmlIsSimpleContentOrEmpty
FwXmlIsTrueValue
FwXmlNumAttributes
FwXmlNumChildren
FwXmlNumChildrenWithName
FwXmlNumConsecutiveChildrenWithName
FwXmlParsePrefixedXML
FwXmlParseText
FwXmlParserCreate
FwXmlUpdatePrefixes
GetServiceSecurity
RegisterModule
ServiceMain
SetServiceSecurity
StartSoapProcessor
StopSoapProcessor
SubscriptionsProvEndEnumerate
SubscriptionsProvEnumerate
SubscriptionsProvPullEnumerate
SvchostPushServiceGlobals
WSManAckEvents
WSManAddSubscriptionManagerInternal
WSManCloseCommand
WSManCloseEnumerationHandle
WSManCloseEnumeratorHandle
WSManCloseObjectHandle
WSManCloseOperation
WSManClosePublisherHandle
WSManCloseSession
WSManCloseSessionHandle
WSManCloseShell
WSManCloseSubscriptionHandle
WSManConstructError
WSManCreateEnumeratorInternal
WSManCreateInternal
WSManCreateInternalEx
WSManCreatePullSubscription
WSManCreatePushSubscription
WSManCreateSession
WSManCreateSessionInternal
WSManCreateShell
WSManDecodeObject
WSManDeinitialize
WSManDeleteInternal
WSManDeleteInternalEx
WSManDeliverEndSubscriptionNotification
WSManDeliverEvent
WSManEncodeObject
WSManEncodeObjectEx
WSManEncodeObjectInternal
WSManEnumerateInternal
WSManEnumerateInternalEx
WSManEnumeratorAddEvent
WSManEnumeratorAddObject
WSManEnumeratorBatchPolicyViolated
WSManEnumeratorNextObject
WSManEnumeratorObjectCount
WSManGetErrorMessage
WSManGetInternal
WSManGetInternalEx
WSManGetSessionOptionAsDword
WSManGetSessionOptionAsString
WSManIdentifyInternal
WSManInitialize
WSManInvokeInternal
WSManInvokeInternalEx
WSManPluginAuthzOperationComplete
WSManPluginAuthzQueryQuotaComplete
WSManPluginAuthzUserComplete
WSManPluginFreeRequestDetails
WSManPluginGetOperationParameters
WSManPluginObjectAndBookmarkResult
WSManPluginObjectAndEprResult
WSManPluginObjectResult
WSManPluginOperationComplete
WSManPluginReceiveResult
WSManPluginReportContext
WSManPluginShutdown
WSManPluginStartup
WSManProvCreate
WSManProvDelete
WSManProvEndEnumerate
WSManProvEnumerate
WSManProvGet
WSManProvInvoke
WSManProvPullEnumerate
WSManProvPut
WSManPull
WSManPullEvents
WSManPutInternal
WSManPutInternalEx
WSManReceiveShellOutput
WSManRemoveSubscriptionManagerInternal
WSManRunShellCommand
WSManSendShellInput
WSManSetSessionOption
WSManShellProvEndEnumerate
WSManShellProvPullEnumerate
WSManSignalShell
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
827KB
Virtual Size
827KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=8, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=372, id=1, productName=Unmarked objects,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=166, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=22, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
s-etup.exe
- IMPHASH 3ee74f5f298a31808b779b57777ec95d
- SHA256 995bf2a06730050f99f6e5ff53d641e1e98f022e7d7c376d91d65959aa79a70e
- MD5 fd57b4457b9c453bf563559c53b9071b
- SHA1 08eb3a76af5c337b73f50efe5a27c43b68edce88
- SHA512 ba9518440625fef53101440c976951b5c8e2b07f946a975da77b8a7ab2cbfc795cd20a264f61ff1fc4a7c0b77ea9b75ed8a9c9e69b9d22ae65d10163a510c5a7
- SSDEEP 12288:PoZ5cyP2UluWW7hvraWyE/7bQGLnkQzeD6lHCMfm7HUb3s9a40:PoHhP2YW7hzak7bQ8HCM+4QI40
- MD5 SHA1 SHA512 SSDEEP
Digest
da:ad:bb:f5:ae:10:6d:31:7a:b6:44:21:84:cc:ff:f0:e3:59:9d:17:4a:45:b9:46:64:7b:35:ba:7c:4d:11:b4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Skutta\, Kristjan,O=Skutta\, Kristjan,L=Berlin,C=DE
Chains
Oct 21, 2022
CN=Skutta\, Kristjan,O=Skutta\, Kristjan,L=Berlin,C=DE
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=Skutta\, Kristjan,O=Skutta\, Kristjan,L=Berlin,C=DE
Serial Number
06:94:f5:f6:0b:0b:46:22:d3:39:78:dd:4b:ce:e5:69
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 17, 2020 - Nov 21, 2023
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
240575
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
launcher.pdb
kernel32
GetModuleFileNameW
GetLongPathNameW
VirtualQuery
LoadLibraryExW
GetCurrentThreadId
VerifyVersionInfoW
VerSetConditionMask
SetUnhandledExceptionFilter
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
CreateProcessW
GetExitCodeProcess
GetModuleHandleW
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
FatalAppExitA
ExpandEnvironmentStringsW
lstrcmpW
GetModuleFileNameA
GetModuleHandleA
GetSystemDirectoryW
LocalAlloc
InterlockedIncrement
InterlockedDecrement
FreeLibrary
InitializeCriticalSection
HeapSize
GetTimeZoneInformation
SetStdHandle
OutputDebugStringW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetFileSizeEx
ReadFile
HeapAlloc
GetProcAddress
LoadLibraryW
GetCurrentProcess
TerminateProcess
Process32Next
GetCurrentProcessId
Process32First
FormatMessageW
LocalFree
GetLastError
CreateToolhelp32Snapshot
CreateFileW
Sleep
WaitForSingleObject
CloseHandle
OpenProcess
MultiByteToWideChar
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapFree
WriteConsoleW
GetFileType
WriteFile
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
InterlockedExchangeAdd
WideCharToMultiByte
FormatMessageA
GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
AreFileApisANSI
CopyFileW
GetFileInformationByHandleEx
GetStringTypeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetExitCodeThread
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
RtlUnwind
RaiseException
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetDriveTypeW
CreateThread
ExitThread
user32
GetWindowThreadProcessId
EnumWindows
GetClassNameW
GetWindowLongW
PostMessageW
DestroyIcon
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
LoadImageW
MoveWindow
CreateDialogParamW
EndDialog
FindWindowW
PostQuitMessage
DestroyWindow
ShowWindow
EnableWindow
LoadBitmapW
SetWindowTextW
SetWindowPos
GetSystemMetrics
SetWindowLongW
ScreenToClient
GetWindowRect
SendMessageW
GetClientRect
GetDlgItem
SetDlgItemTextW
MessageBoxW
wsprintfW
IsWindow
FindWindowExW
shell32
SHGetFolderPathW
ShellExecuteExW
advapi32
OpenSCManagerW
RegSetValueExW
RegDeleteKeyValueW
RegGetValueW
RegDeleteKeyW
CloseServiceHandle
DeleteService
QueryServiceStatus
ControlService
OpenServiceW
RegOpenKeyW
RegDeleteValueW
RegQueryValueExW
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
d3d11
D3D11CreateDevice
comctl32
ord17
NoHotPatch
Name
.text
Size
406KB
Virtual Size
406KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
154KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ