MsSense.pdb
Static task
static1
Behavioral task
behavioral1
Sample
531951beff9500de53f8bd618caa387e6d190deece312e6bca1838b68b1a28ffN.exe
Resource
win10v2004-20241007-en
General
-
Target
531951beff9500de53f8bd618caa387e6d190deece312e6bca1838b68b1a28ffN
-
Size
5.4MB
-
MD5
9424e4377d87f4fbfc6d62af374a4bc0
-
SHA1
0aa7ccc2dd0d3fe1de8def5abc854c8f1add2afa
-
SHA256
531951beff9500de53f8bd618caa387e6d190deece312e6bca1838b68b1a28ff
-
SHA512
9fa4f83ec86609a54383c606055cc2f5a526fa9b5258522eaed3c9f53064394c96ca9d5d06e9cacdfd547ac1f5c23532ae87f8c7d48a88116170ea01e0179fe9
-
SSDEEP
49152:4/FTb4wEoOa/jUKXtrXZwa+k7xPSu26znedlSr8gbp0zL61pvJFq0V4utrmWjqN/:GTXyyHTw8cshg+dJxM3JCL3ND1PMt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 531951beff9500de53f8bd618caa387e6d190deece312e6bca1838b68b1a28ffN
Files
-
531951beff9500de53f8bd618caa387e6d190deece312e6bca1838b68b1a28ffN.exe windows:10 windows x64 arch:x64
6b696b4230eb6625692f140e82a10646
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msvcp_win
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?swap@?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IEAAXAEAV12@@Z
?swap@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXAEAV12@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@M@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
_Query_perf_counter
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_XGetLastError@std@@YAXXZ
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?classic@locale@std@@SAAEBV12@XZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
_Query_perf_frequency
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?id@?$collate@_W@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
_Cnd_init_in_situ
??0_Locinfo@std@@QEAA@PEBD@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
_Wcscoll
_Wcsxfrm
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAN@Z
_Cnd_do_broadcast_at_thread_exit
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_J@Z
_Thrd_id
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_destroy
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
_Cnd_destroy
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAM@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAG@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAF@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_N@Z
_Cnd_signal
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_K@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
_Cnd_wait
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?_BADOFF@std@@3_JB
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_unlock
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
?exceptions@ios_base@std@@QEAAXH@Z
_Cnd_init
?_Winerror_message@std@@YAKKPEADK@Z
_Mtx_init
_Thrd_join
?_Winerror_map@std@@YAHH@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Syserror_map@std@@YAPEBDH@Z
?narrow@?$ctype@D@std@@QEBADDD@Z
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?widen@?$ctype@D@std@@QEBADD@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBADD@Z
_Thrd_start
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?toupper@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Xout_of_range@std@@YAXPEBD@Z
_Cnd_destroy_in_situ
_Mtx_current_owns
_Cnd_timedwait
_Xtime_get_ticks
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??1_Locinfo@std@@QEAA@XZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?_Xbad_alloc@std@@YAXXZ
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_c_exit
api-ms-win-crt-string-l1-1-0
strncmp
memset
strnlen
wcsnlen
wcsncmp
wcscmp
api-ms-win-crt-private-l1-1-0
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__strnicmp
_o__ui64toa_s
_o__ui64tow_s
_o__wcsicmp
_o__wcsnicmp
_o__wcstod_l
_o__wgetenv_s
_o__wmakepath_s
_o__wsplitpath_s
_o__wtoi64
_o_bsearch
_o_calloc
_o_exit
_o_free
_o_isalpha
_o_isdigit
_o_isspace
_o_iswspace
_o_isxdigit
memcpy
_o_malloc
_o_pow
_o_qsort
_o_rand
_o_realloc
_o_strftime
_o_terminate
_o_tolower
_o_towlower
_o_wcscpy_s
_o_wcstol
_o_wcstoul
__C_specific_handler
_CxxThrowException
_o__itoa_s
_o__isctype_l
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__i64tow_s
_o__i64toa_s
_o__gmtime64_s
_o__get_initial_wide_environment
_o__free_locale
_o__free_base
_o__exit
_o__errno
_o__crt_atexit
_o__create_locale
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o__atodbl
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfprintf
_o___std_type_info_name
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o___p__commode
_o___p___wargv
_o___p___argc
_o___acrt_iob_func
memmove
__std_terminate
__CxxFrameHandler3
__RTDynamicCast
memcmp
wcschr
wcsrchr
memchr
strchr
__std_type_info_hash
__RTtypeid
__std_type_info_compare
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
ReleaseMutex
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
CreateSemaphoreExW
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
OpenSemaphoreW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateEventW
SetEvent
CreateMutexExW
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
HeapDestroy
HeapReAlloc
HeapSize
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
OpenProcessToken
CreateProcessAsUserW
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
EventActivityIdControl
EventWrite
EventUnregister
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
InitOnceBeginInitialize
InitOnceComplete
WaitOnAddress
api-ms-win-core-kernel32-legacy-l1-1-0
UnregisterWait
RegisterWaitForSingleObject
api-ms-win-service-core-l1-1-0
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
SetServiceStatus
api-ms-win-oobe-notification-l1-1-0
RegisterWaitUntilOOBECompleted
UnregisterWaitUntilOOBECompleted
api-ms-win-eventing-consumer-l1-1-0
CloseTrace
OpenTraceW
ProcessTrace
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
user32
UnregisterDeviceNotification
RegisterDeviceNotificationW
api-ms-win-security-isolatedcontainer-l1-1-0
IsProcessInIsolatedContainer
wldp
WldpQueryWindowsLockdownMode
msi
ord270
ord244
ord45
kernel32
GetComputerNameExW
FileTimeToSystemTime
FreeLibrary
InstallELAMCertificateInfo
Sleep
SwitchToThread
WaitForMultipleObjects
SystemTimeToFileTime
GetProcessTimes
OpenProcess
GetPackageFullName
MultiByteToWideChar
WideCharToMultiByte
VerifyVersionInfoW
LoadLibraryExW
CompareFileTime
FindClose
GetOverlappedResultEx
ReadFile
GetFileInformationByHandleEx
FindNextFileW
FindFirstFileExW
GetSystemTime
GetCurrentThread
QueryPerformanceFrequency
GetDateFormatW
GetTimeZoneInformation
LoadLibraryW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
SetHandleInformation
GetExitCodeProcess
GetModuleFileNameW
ResetEvent
CreateDirectoryW
GetSystemDirectoryW
VerSetConditionMask
WriteFile
GetTempPathW
CreateFileW
GetTempFileNameW
GetFileSizeEx
GetFileAttributesW
GetVersionExW
GetEnabledXStateFeatures
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateToolhelp32Snapshot
InitializeConditionVariable
Process32NextW
InitializeCriticalSection
GetComputerNameW
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteFileW
CreateEventExW
CreateThreadpoolWait
LocalFree
CreateThreadpoolTimer
CreateThread
SetThreadPriority
IsThreadpoolTimerSet
SleepConditionVariableCS
Process32FirstW
QueryFullProcessImageNameW
QueryDosDeviceW
GetVolumeInformationW
FindFirstVolumeW
FindVolumeClose
GetVolumePathNamesForVolumeNameW
FindNextVolumeW
GetDriveTypeW
GetProcessMitigationPolicy
SetProcessMitigationPolicy
GetTickCount64
SetFilePointerEx
GetFileTime
K32GetProcessMemoryInfo
K32EnumProcessModules
GetProductInfo
GetSystemInfo
GetFirmwareType
SetFilePointer
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
WTSGetActiveConsoleSessionId
CompareStringW
ReadProcessMemory
DuplicateHandle
CancelIo
GetEnvironmentVariableW
GetTickCount
CopyFileW
GetFileSize
MoveFileExW
RaiseException
RemoveDirectoryW
DeviceIoControl
FindFirstFileW
WakeConditionVariable
mssecuser
SecSetConfiguration
SecRegisterConsumer
SecUnregisterConsumer
SecGetFileHashes
SecSetRegistryOperations
SecClearRegistryOperations
SecCreateSessionFilter
SecDeleteSessionFilter
SecIsKernelIntegrityEnabled
SecGetProcessInfo
SecWriteFileEA
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegOpenKeyExW
RegGetValueW
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegNotifyChangeKeyValue
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
ConvertStringSidToSidW
api-ms-win-eventing-controller-l1-1-0
EnumerateTraceGuidsEx
ControlTraceW
StartTraceW
StopTraceW
EnableTraceEx2
rpcrt4
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
NdrClientCall3
RpcExceptionFilter
UuidCompare
RpcStringFreeW
UuidHash
UuidToStringW
UuidFromStringW
UuidCreate
api-ms-win-eventing-tdh-l1-1-0
TdhGetProperty
TdhGetEventInformation
TdhGetPropertySize
api-ms-win-security-base-l1-1-0
CreateRestrictedToken
AdjustTokenPrivileges
ImpersonateLoggedOnUser
RevertToSelf
GetSidSubAuthorityCount
GetTokenInformation
EqualSid
GetSidSubAuthority
GetLengthSid
IsValidSid
DuplicateTokenEx
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
ntdll
RtlIpv6AddressToStringExW
RtlSubscribeWnfStateChangeNotification
RtlIpv4AddressToStringExW
NtQuerySystemInformation
NtQueryWnfStateData
ZwQueryEaFile
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlQueryImageMitigationPolicy
NtOpenFile
RtlInitUnicodeString
RtlFreeUnicodeString
NtDeleteValueKey
RtlCreateUnicodeString
NtDeleteKey
RtlUnsubscribeWnfNotificationWaitForCompletion
crypt32
CertFreeCertificateContext
CryptImportPublicKeyInfo
CertOpenStore
CertFreeCertificateChain
CertAddCertificateContextToStore
CertGetCertificateChain
CryptStringToBinaryW
CertCloseStore
CryptStringToBinaryA
CertCreateCertificateContext
CertGetCertificateContextProperty
CryptBinaryToStringA
CertVerifyCertificateChainPolicy
CertGetNameStringW
wkscli
NetGetJoinInformation
oleaut32
SysFreeString
SysAllocString
SysStringLen
SysAllocStringLen
VariantClear
VariantInit
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayDestroy
SafeArrayGetVartype
SafeArrayCopy
SysAllocStringByteLen
SysStringByteLen
SafeArrayLock
SafeArrayUnlock
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
cabinet
ord33
ord30
ord35
ord31
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
GetFileVersionInfoSizeW
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
VerQueryValueW
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
LookupPrivilegeValueW
LookupAccountNameW
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
api-ms-win-core-version-private-l1-1-0
GetFileVersionInfoByHandle
api-ms-win-security-audit-l1-1-0
AuditSetSystemPolicy
iphlpapi
GetIpNetTable2
FreeMibTable
GetUnicastIpAddressTable
GetAdaptersAddresses
ws2_32
WSAStartup
InetNtopW
WSACleanup
api-ms-win-core-path-l1-1-0
PathCchCombine
userenv
GetProfilesDirectoryW
GetAllUsersProfileDirectoryW
api-ms-win-security-logon-l1-1-1
LogonUserW
samcli
NetUserEnum
netutils
NetApiBufferFree
dnsapi
DnsFree
DnsGetCacheDataTable
DnsQuery_W
bcrypt
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptHashData
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptCreateHash
api-ms-win-service-management-l2-1-0
QueryServiceConfigW
ChangeServiceConfigW
QueryServiceConfig2W
ChangeServiceConfig2W
api-ms-win-service-management-l1-1-0
StartServiceW
OpenSCManagerW
CloseServiceHandle
OpenServiceW
api-ms-win-service-winsvc-l1-1-0
ControlService
QueryServiceStatus
api-ms-win-security-cryptoapi-l1-1-0
CryptAcquireContextW
CryptVerifySignatureW
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptCreateHash
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-heap-l2-1-0
LocalAlloc
api-ms-win-core-file-l1-1-0
GetFileInformationByHandle
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Sections
.text Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
RT_CODE Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 125KB - Virtual size: 241KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 584KB - Virtual size: 588KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE