hijackloader | unpacked_17e5475fe29d1e9f486646f38adcb5749cfe73bc384ec7a926b6a5b08919ba41[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

unpacked_17e5475fe29d1e9f486646f38adcb5749cfe73bc384ec7a926b6a5b08919ba41.zip
Size

7.0MB
MD5

c8a4a9ba7391bf9eee8c809e931c92dc
SHA1

8dacf60b0789a3a5dbbd1d454750167b0c3f5923
SHA256

b45a34f02e2fa4e0433b999b8758c41bee91ea3fa1972f1061cfb87394ce27de
SHA512

c6f8a199cd1eb69f111529125c7df2919a48c030347f2a40ac4d1fb73c3959e84ae8aaf49d70bdfd25b3b6bd8b9b1de1bfd7efbc50b0ff1b66f57d955e3256c0
SSDEEP

196608:oLYpAV7xdWAS/twVMfKntkjFBmWaKBRVgFonJQiMS:oeAPd0oMKaMoqS

Score

10^/10

hijackloader rhadamanthys

Malware Config

Extracted

Family

rhadamanthys

http://91.103.140.200:9078/3936a074a2f65761a5eb8/ipm2s60c.ut26e

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
static1/unpack001/940000.56f4fd60-37aa-4d35-baa4-538f8f3f9a15.exe	family_hijackloader

Hijackloader family
hijackloader
Rhadamanthys family
rhadamanthys

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/73030000.pla.dll
unpack001/940000.56f4fd60-37aa-4d35-baa4-538f8f3f9a15.exe
unpack001/b10000.explorer.exe
unpack001/f80000.exe

Files

unpacked_17e5475fe29d1e9f486646f38adcb5749cfe73bc384ec7a926b6a5b08919ba41.zip
.zip
73030000.pla.dll
.dll regsvr32 windows:10 windows x86 arch:x86

50d71aa5a56985299b871062efe9795d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

memcmp
memcpy
_except_handler4_common
??1type_info@@UAE@XZ
_initterm
malloc
wcsrchr
_amsg_exit
_XcptFilter
_lseek
time
_errno
_write
_close
_read
_wremove
srand
_wopen
_get_osfhandle
fclose
_wfopen
_wtoi
vfwprintf
fwprintf
qsort
_wtof
iswspace
_wtol
_wsplitpath_s
_wgetenv
wcsstr
wcscspn
memmove
rand
swscanf_s
wcsncmp
_wcsnicmp
_purecall
?name@type_info@@QBEPBDXZ
_vsnwprintf
wcschr
_wcsicmp
free
memset

ntdll

RtlNtStatusToDosError
NtQuerySystemInformation
EtwNotificationRegister
EtwNotificationUnregister
RtlStringFromGUID
RtlFreeAnsiString
NtQuerySystemTime
EtwEventUnregister
EtwEventWrite
EtwEventRegister

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

ControlService
QueryServiceStatus

api-ms-win-service-management-l1-1-0

OpenSCManagerW
StartServiceW
CloseServiceHandle
OpenServiceW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W
ChangeServiceConfigW
QueryServiceConfigW

advapi32

UpdateTraceW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
RegEnumKeyW
RegFlushKey
DuplicateTokenEx
SetThreadToken
AccessCheck
GetFileSecurityW
RevertToSelf
ImpersonateLoggedOnUser
LogonUserW
SetSecurityDescriptorDacl
AddAccessAllowedAceEx
AddAce
EqualSid
GetAce
GetAclInformation
InitializeAcl
GetLengthSid
MakeAbsoluteSD
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
RegDeleteValueW
RegCreateKeyExW
QueryAllTracesW
FlushTraceW
StopTraceW
StartTraceW
EnumerateTraceGuidsEx
ControlTraceW
EnableTraceEx
QueryTraceW
AdjustTokenPrivileges
EventAccessQuery
SetNamedSecurityInfoW
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
EventAccessRemove
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegConnectRegistryW
CheckTokenMembership
CreateWellKnownSid
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

user32

DestroyWindow
MsgWaitForMultipleObjects
DispatchMessageW
PeekMessageW
CreateWindowExW
LoadStringW

rpcrt4

NdrServerCall2
RpcServerInqCallAttributesW
RpcServerUnregisterIfEx
RpcServerRegisterIf3
RpcServerUseProtseqEpW
RpcRevertToSelf
RpcImpersonateClient
NdrClientCall4
RpcBindingToStringBindingW
RpcBindingInqAuthClientW
RpcStringFreeW
RpcBindingFree
RpcBindingSetAuthInfoW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
UuidCreate
RpcStringBindingParseW

pdh

PdhTranslateLocaleCounterW
PdhTranslate009CounterW
PdhGetFormattedCounterValue
PdhCollectQueryData
PdhAddCounterW
PdhExpandWildCardPathW
PdhOpenQuery
PdhUpdateLogW
PdhCloseLog
PdhOpenLogW
PdhCloseQuery

tdh

TdhEnumerateRemoteWBEMProviders
TdhEnumerateProviderFieldInformation
TdhEnumerateRemoteWBEMProviderFieldInformation
TdhEnumerateProviders

nsi

NsiFreeTable
NsiAllocateAndGetTable

shlwapi

ord439
PathIsNetworkPathW
PathIsFileSpecW

cabinet

ord20
ord10
ord23
ord22
ord14
ord11
ord13

wevtapi

EvtRender
EvtCreateRenderContext
EvtClose
EvtOpenChannelConfig
EvtGetChannelConfigProperty
EvtSubscribe
EvtNext

kernel32

GetProcessHeap
HeapValidate
LeaveCriticalSection
EnterCriticalSection
CreateEventW
CloseHandle
UnregisterWait
SetEvent
FileTimeToDosDateTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetTickCount
ResolveDelayLoadedAPI
DelayLoadFailureHook
LocalFree
GetComputerNameW
FormatMessageW
InitializeCriticalSection
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
SizeofResource
GlobalAlloc
GlobalLock
FreeResource
GlobalUnlock
GlobalFree
GetCurrentThread
GetCurrentProcess
GetCommandLineW
GetFileAttributesW
IsWow64Process
Wow64DisableWow64FsRedirection
GetCurrentThreadId
HeapFree
LoadLibraryExW
FreeLibrary
ResetEvent
OpenProcess
K32GetModuleFileNameExW
CreateFileW
WriteFile
WaitForSingleObject
QueryPerformanceCounter
GetCurrentProcessId
FindFirstFileW
FindNextFileW
FindClose
DuplicateHandle
GetSystemTimeAsFileTime
FileTimeToSystemTime
SystemTimeToFileTime
GetUserDefaultUILanguage
HeapReAlloc
CompareStringW
HeapSize
CreateWaitableTimerW
SetWaitableTimer
WaitForMultipleObjects
GetExitCodeThread
CreateThread
DebugBreak
IsDebuggerPresent
GetModuleFileNameW
Sleep
DeleteCriticalSection
GetFullPathNameW
GetWindowsDirectoryW
FileTimeToLocalFileTime
GetDateFormatW
GetTimeFormatW
GetDiskFreeSpaceExW
GetFileSizeEx
HeapAlloc
ExpandEnvironmentStringsW
GetLocaleInfoW
GetLocalTime
GetTimeZoneInformation
CreateDirectoryW
Wow64RevertWow64FsRedirection
DosDateTimeToFileTime
OpenEventW
GetTickCount64
DisableThreadLibraryCalls
GetSystemDirectoryW
GetLastError
LocalFileTimeToFileTime
GetFileInformationByHandle
MultiByteToWideChar
SetFileAttributesW
GetTempPathW
SetFileTime
LoadLibraryW
GetFileMUIPath
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetTempFileNameW
SetPriorityClass
GetSystemTime
CopyFileW
RemoveDirectoryW
DeleteFileW
CopyFileExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
PlaDeleteReport
PlaExpandTaskArguments
PlaExtractCabinet
PlaGetLegacyAlertActionsFlagsFromString
PlaGetLegacyAlertActionsStringFromFlags
PlaGetServerCapabilities
PlaHost
PlaServer
PlaUpgrade
ServiceMain
SvchostPushServiceGlobals

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
73030000.pla.dll.tag
940000.56f4fd60-37aa-4d35-baa4-538f8f3f9a15.exe
.exe windows:10 windows x86 arch:x86

3ce6a4281705671bb27a6de26815307b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AddAce
AdjustTokenPrivileges
AllocateAndInitializeSid
BuildTrusteeWithSidA
ChangeServiceConfigW
CheckTokenMembership
CloseServiceHandle
ConvertSidToStringSidW
ConvertStringSidToSidW
CopySid
CreateProcessAsUserW
CreateProcessWithTokenW
CreateServiceW
DeleteService
DuplicateTokenEx
EqualSid
FreeSid
GetAce
GetAclInformation
GetLengthSid
GetNamedSecurityInfoW
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorLength
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetSecurityInfo
GetSidIdentifierAuthority
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
ImpersonateLoggedOnUser
InitializeAcl
InitializeSecurityDescriptor
InitializeSid
IsValidAcl
IsValidSecurityDescriptor
IsValidSid
LookupAccountSidW
LookupPrivilegeValueW
MakeAbsoluteSD
MakeSelfRelativeSD
OpenProcessToken
OpenSCManagerW
OpenServiceW
OpenThreadToken
QueryServiceConfigW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegisterTraceGuidsW
RevertToSelf
SetEntriesInAclW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityInfo
TraceEvent
UnregisterTraceGuids

dbghelp

SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymGetSearchPathW
SymInitialize
SymSetOptions
SymSetSearchPathW

oleaut32

LoadTypeLib
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayDestroy
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetVartype
SafeArrayUnaccessData
SysAllocString
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysStringLen
SystemTimeToVariantTime
VariantClear

shell32

CommandLineToArgvW
IsUserAnAdmin
SHGetFolderPathW
SHGetKnownFolderPath
ShellExecuteExW

user32

AllowSetForegroundWindow
CharUpperW
CreateWindowExW
DestroyWindow
GetActiveWindow
GetClientRect
GetMonitorInfoW
GetParent
GetShellWindow
GetWindow
GetWindowLongW
GetWindowRect
GetWindowThreadProcessId
MapWindowPoints
MessageBoxExW
MonitorFromWindow
SetForegroundWindow
SetWindowPos
UnregisterClassW

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AssignProcessToJobObject
CloseHandle
CompareStringW
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileA
CreateFileMappingW
CreateFileW
CreateMutexW
CreateProcessW
CreateToolhelp32Snapshot
DecodePointer
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumResourceNamesW
EnumSystemLocalesW
ExitProcess
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FindResourceW
FlushFileBuffers
FlushViewOfFile
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDiskFreeSpaceExW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessId
GetProcessTimes
GetProductInfo
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadPreferredUILanguages
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserPreferredUILanguages
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalMemoryStatusEx
HeapAlloc
HeapDestroy
HeapFree
HeapReAlloc
HeapSetInformation
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InitializeSRWLock
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalFree
LockFileEx
LockResource
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
Process32FirstW
Process32NextW
ProcessIdToSessionId
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
RemoveDirectoryW
ReplaceFile
ResetEvent
RtlCaptureStackBackTrace
RtlUnwind
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetProcessWorkingSetSize
SetStdHandle
SetThreadInformation
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SwitchToThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
TzSpecificLocalTimeToSystemTime
UnhandledExceptionFilter
UnlockFileEx
UnmapViewOfFile
UnregisterWaitEx
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WTSGetActiveConsoleSessionId
WaitForSingleObject
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrcmpiW
GetSystemTimePreciseAsFileTime

kernelbase

DeleteProcThreadAttributeList
GetProcessMitigationPolicy
InitOnceExecuteOnce
InitializeProcThreadAttributeList
SleepConditionVariableSRW
UpdateProcThreadAttribute
FlsAlloc
FlsSetValue
InitializeCriticalSectionEx

combase

CoAddRefServerProcess
CoCreateInstance
CoImpersonateClient
CoInitializeEx
CoRegisterClassObject
CoRegisterInitializeSpy
CoReleaseServerProcess
CoResumeClassObjects
CoRevertToSelf
CoRevokeClassObject
CoRevokeInitializeSpy
CoSetProxyBlanket
CoTaskMemFree
CoUninitialize
IIDFromString
StringFromGUID2

secur32

GetUserNameExW

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
EnterCriticalPolicySection
LeaveCriticalPolicySection
UnloadUserProfile

winhttp

WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetOption
WinHttpSetStatusCallback

shlwapi

IsOS
PathMatchSpecW

ntdll

NtDeleteKey
RtlCaptureStackBackTrace

winmm

timeGetTime

bcryptprimitives

ProcessPrng

Exports

Exports

GetHandleVerifier

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 592KB - Virtual size: 592KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
940000.56f4fd60-37aa-4d35-baa4-538f8f3f9a15.exe.tag
b10000.explorer.exe
.exe windows:10 windows x86 arch:x86

2ae28f7349da6b3f73fa617070450bcf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

explorer.pdb

Imports

msvcrt

free
malloc
ceil
realloc
_wcsicmp
floor
bsearch
_unlock
_lock
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABQBD@Z
_XcptFilter
__p__commode
memcpy
_amsg_exit
__wgetmainargs
_CxxThrowException
wcscpy_s
_get_errno
_set_errno
localtime
mktime
__set_app_type
exit
_exit
_cexit
__p__fmode
difftime
time
_set_error_mode
wcsstr
memmove_s
_vsnprintf_s
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy_s
memmove
_vsnwprintf
wcscspn
_errno
memset
_ftol2_sse
_ftol2
_CIsqrt
__CxxFrameHandler3
_CIpow
__setusermatherr
_initterm
_wcmdln
?terminate@@YAXXZ
__dllonexit
_onexit
iswalnum
_vsnwprintf_s
_snwprintf_s
??1type_info@@UAE@XZ
_controlfp
_except_handler4_common
wcsncpy_s
memcmp

twinapi

ord9

api-ms-win-core-job-l2-1-0

AssignProcessToJobObject
QueryInformationJobObject
SetInformationJobObject
CreateJobObjectW

api-ms-win-core-url-l1-1-0

HashData
UrlUnescapeW

api-ms-win-core-kernel32-private-l1-1-0

CheckElevationEnabled

api-ms-win-core-registryuserspecific-l1-1-0

SHRegGetUSValueW
SHRegGetBoolUSValueW

api-ms-win-core-com-private-l1-1-0

CoRegisterMessageFilter

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx
ActivateActCtx
CreateActCtxW
DeactivateActCtx

ntdll

swscanf_s
WinSqmAddToStreamEx
WinSqmIsOptedIn
WinSqmSetDWORD
RtlQueryResourcePolicy
NtSetThreadExecutionState
RtlFreeHeap
RtlInitUnicodeString
RtlAllocateHeap
RtlNtStatusToDosErrorNoTeb
NtQueryInformationProcess
NtSetInformationProcess
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
wcsspn
wcsrchr
wcstol
_wcsnicmp
NtOpenThreadToken
NtClose
NtQueryInformationToken
NtOpenProcessToken
RtlCompareUnicodeString
wcschr
_itow_s
_wtoi
strchr
RtlNtStatusToDosError
NtQueryWnfStateData
RtlPublishWnfStateData
NtSetSystemInformation
RtlFlushHeaps
RtlUnsubscribeWnfNotificationWaitForCompletion

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA
GetModuleHandleExW
LockResource
LoadResource
GetProcAddress
GetModuleFileNameA
LoadStringW
GetModuleFileNameW
SizeofResource
FreeLibrary
GetModuleHandleW
FindResourceExW
FindStringOrdinal
LoadLibraryExW
FreeLibraryAndExitThread

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
InitializeSRWLock
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSRWLockShared
WaitForSingleObjectEx
CreateMutexExW
AcquireSRWLockShared
WaitForMultipleObjectsEx
DeleteCriticalSection
ReleaseSemaphore
ReleaseMutex
EnterCriticalSection
AcquireSRWLockExclusive
SleepEx
ReleaseSRWLockExclusive
OpenEventW
CreateEventExW
InitializeCriticalSectionAndSpinCount
SetEvent
TryAcquireSRWLockExclusive
OpenMutexW
TryEnterCriticalSection
CreateEventW
InitializeCriticalSection
CreateMutexW
ResetEvent
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSetInformation
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
SetErrorMode
SetLastError

api-ms-win-core-file-l1-1-0

GetLongPathNameW
CreateFileW
DeleteFileW
WriteFile
FindNextFileW
FindFirstFileW
CompareFileTime
GetFileAttributesW
FindClose

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventActivityIdControl
EventUnregister
EventEnabled
EventWriteTransfer
EventWrite
EventSetInformation

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
TrySubmitThreadpoolCallback
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CallbackMayRunLong
FreeLibraryWhenCallbackReturns
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
SubmitThreadpoolWork
CreateThreadpoolWork

api-ms-win-core-processthreads-l1-1-0

TlsFree
ResumeThread
CreateProcessW
GetPriorityClass
TlsGetValue
GetCurrentProcessId
ExitProcess
GetCurrentThreadId
TlsSetValue
SetPriorityClass
QueueUserAPC
GetCurrentThread
SetThreadPriority
SetProcessShutdownParameters
TerminateThread
GetCurrentProcess
GetProcessId
SetThreadPriorityBoost
TerminateProcess
GetStartupInfoW
CreateThread
GetExitCodeProcess
OpenThreadToken
TlsAlloc
GetThreadPriority
OpenThread
ProcessIdToSessionId
OpenProcessToken

api-ms-win-core-localization-l1-2-0

GetThreadUILanguage
GetUserDefaultLangID
FormatMessageW
GetCalendarInfoW
GetLocaleInfoEx
GetLocaleInfoW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak
OutputDebugStringA

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

oleaut32

VarUI4FromStr
SysAllocStringByteLen
SysFreeString
VariantClear
VariantInit
SysAllocString
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate

api-ms-win-shcore-thread-l1-1-0

SHCreateThread
SHSetThreadRef
SHGetThreadRef
SetProcessReference
SHCreateThreadRef

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoFreeUnusedLibraries
CoInitializeSecurity
CoCreateInstance
CoTaskMemRealloc
CoRegisterClassObject
CoSetProxyBlanket
CoDisableCallCancellation
CoEnableCallCancellation
CLSIDFromString
CoCreateGuid
CoUninitialize
StringFromIID
CoInitializeEx
CoTaskMemAlloc
CoGetMalloc
CoGetCallContext
CoGetStdMarshalEx
CoWaitForMultipleHandles
StringFromGUID2
CoGetApartmentType
PropVariantClear
CoCreateFreeThreadedMarshaler
CoMarshalInterThreadInterfaceInStream
CreateStreamOnHGlobal
CoCancelCall
IIDFromString
CoReleaseMarshalData
CoGetInterfaceAndReleaseStream
CoRevokeClassObject

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer
DeleteTimerQueueTimer
CreateTimerQueueTimer
UnregisterWaitEx

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetTickCount64
GetTickCount
GetSystemTime
GetLocalTime
GetVersionExW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-shcore-sysinfo-l1-1-0

IsOS
SetCurrentProcessExplicitAppUserModelID

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpICA
StrStrIW
StrCmpNICW
StrCmpICW
StrCmpNIW
StrToIntW
StrChrW
StrChrIW
StrCmpW
QISearch
StrCmpIW
StrRChrW

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegEnumValueW
RegSetValueExW
RegOpenCurrentUser
RegGetValueW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegDeleteTreeW
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyExW

api-ms-win-shcore-comhelpers-l1-1-0

IUnknown_Set
IUnknown_QueryService
IUnknown_SetSite

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalFree
LocalAlloc
LocalReAlloc
GlobalAlloc

api-ms-win-core-processthreads-l1-1-1

OpenProcess
GetProcessMitigationPolicy
IsProcessorFeaturePresent

api-ms-win-core-datetime-l1-1-0

GetDateFormatW

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx
GetDateFormatEx

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
ExpandEnvironmentStringsW
GetCommandLineW
GetCurrentDirectoryW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathParseIconLocationW
PathFileExistsW
PathIsFileSpecW
PathFindExtensionW
PathQuoteSpacesW
SHExpandEnvironmentStringsW
PathCombineW
PathMatchSpecW
PathFindFileNameW
PathCommonPrefixW
PathGetArgsW
PathIsRelativeW
PathGetDriveNumberW
PathRemoveBlanksW
PathRemoveFileSpecW

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
WindowsSubstringWithSpecifiedLength
WindowsCreateString
WindowsCompareStringOrdinal
WindowsDeleteString

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrlenW

api-ms-win-core-string-l1-1-0

CompareStringW
CompareStringOrdinal
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-shcore-registry-l1-1-0

SHDeleteValueW
SHEnumKeyExW
SHGetValueW
SHQueryInfoKeyW
SHDeleteKeyW
SHSetValueW
SHRegGetValueW

api-ms-win-security-base-l1-1-0

DeleteAce
GetAce
CreateWellKnownSid
GetAclInformation
InitializeAcl
IsValidSid
EqualSid
AddAce
CheckTokenMembership
MakeAbsoluteSD
DuplicateToken
GetTokenInformation
CopySid
GetLengthSid

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateError

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchAppend
PathCchAddExtension
PathCchCombine

api-ms-win-shcore-unicodeansi-l1-1-0

SHAnsiToUnicode

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoGetActivationFactory
RoInitialize
RoActivateInstance

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile
VirtualProtect
VirtualFree
CreateFileMappingW
VirtualAlloc

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-shcore-stream-l1-1-0

SHCreateStreamOnFileW
SHCreateStreamOnFileEx
IStream_Read
SHOpenRegStream2W
IStream_Write
SHCreateMemStream
IStream_Reset

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-shcore-path-l1-1-0

ord170

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetDynamicTimeZoneInformation
GetTimeZoneInformation
FileTimeToSystemTime

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject
GetComputerNameW
GetSystemPowerStatus

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-shcore-registry-l1-1-1

SHRegGetValueFromHKCUHKLM

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

api-ms-win-core-string-l2-1-0

CharNextW
CharLowerBuffW

api-ms-win-core-stringansi-l1-1-0

CharNextA

api-ms-win-power-base-l1-1-0

GetPwrCapabilities
CallNtPowerInformation
PowerDeterminePlatformRoleEx

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx

api-ms-win-shlwapi-winrt-storage-l1-1-1

ord509
SHCreateWorkerWindowW
ord292
PathRemoveArgsW
AssocQueryStringW
StrRetToStrW
ord571
IUnknown_GetWindow
ord544
ord279
ShellMessageBoxW
ord635
ord197
SHIsChildOrSelf
SHPinDllOfCLSID
ord478
ord479
ord481
ord24
StrRetToBufW
ord165

api-ms-win-ntuser-sysparams-l1-1-0

EnumDisplayMonitors
GetSystemMetrics
EnumDisplayDevicesW
SystemParametersInfoW
GetMonitorInfoW

api-ms-win-ntuser-rectangle-l1-1-0

IntersectRect
SetRect
InflateRect
PtInRect
OffsetRect
SubtractRect
UnionRect
EqualRect
SetRectEmpty
CopyRect
IsRectEmpty

api-ms-win-rtcore-ntuser-winevent-l1-1-0

SetWinEventHook
UnhookWinEvent
NotifyWinEvent

api-ms-win-shell-namespace-l1-1-0

ILCombine
SHBindToObject
SHCreateItemFromIDList
SHGetIDListFromObject
ILCloneFirst
ILClone
ILGetSize
ILFree
SHCreateItemFromParsingName
ILRemoveLastID
ILIsEqual
SHCreateItemWithParent
ILFindLastID
SHBindToFolderIDListParent
ILIsParent
SHGetNameFromIDList
SHBindToParent
SHParseDisplayName

api-ms-win-rtcore-ntuser-wmpointer-l1-1-0

GetPointerInfo
GetPointerDevices
GetPointerType
GetCurrentInputMessageSource
EnableMouseInPointer

api-ms-win-storage-exports-internal-l1-1-0

SHGetKnownFolderIDList
SHGetFolderPathEx
GetThreadFlags
SetThreadFlags

api-ms-win-rtcore-ntuser-wmpointer-l1-1-2

SetWindowFeedbackSetting

api-ms-win-rtcore-ntuser-clipboard-l1-1-0

RegisterClipboardFormatW

api-ms-win-rtcore-ntuser-private-l1-1-0

GetWindowBand
CreateWindowInBand

api-ms-onecoreuap-settingsync-status-l1-1-0

IsSettingSyncEnabled
IsRoamingEnabled

api-ms-win-rtcore-ntuser-powermanagement-l1-1-0

UnregisterPowerSettingNotification
RegisterPowerSettingNotification

propsys

InitVariantFromGUIDAsString
InitVariantFromResource
PSPropertyBag_WriteStr
PropVariantToStringAlloc
PSPropertyBag_WriteDWORD
PropVariantToUInt32
PSCreateMemoryPropertyStore

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFullName
GetPackagesByPackageFamily

api-ms-win-mm-playsound-l1-1-0

PlaySoundW

api-ms-win-shell-changenotify-l1-1-0

SHChangeNotify

api-ms-win-shell-dataobject-l1-1-0

SHCreateDataObject

api-ms-win-rtcore-ntuser-shell-l1-1-0

GetShellWindow

api-ms-win-appmodel-runtime-l1-1-1

GetStagedPackagePathByFullName
FindPackagesByPackageFamily
ParseApplicationUserModelId

gdi32

GetDeviceCaps
CreateRectRgn
SetRectRgn
OffsetRgn
StretchBlt
CombineRgn
DeleteObject
GetObjectW
CreateDIBSection
DeleteDC
GdiFlush
CreateCompatibleDC
SelectObject
GdiAlphaBlend
StretchDIBits
GetClipBox
CreateCompatibleBitmap
OffsetWindowOrgEx
ExcludeClipRect
SetBkMode
CreateBitmap
Polyline
PatBlt
SetStretchBltMode
SetTextColor
Rectangle
GetTextMetricsW
ExtTextOutW
CreateFontIndirectW
GetStockObject
GetDIBits
SetBkColor
GetTextExtentPoint32W
CreateRectRgnIndirect
GetGlyphOutlineW
CreatePen
GetCurrentObject
SelectClipRgn
SetViewportOrgEx
GetViewportOrgEx
BitBlt
SetTextAlign
GetClipRgn
GetBkColor
CreateSolidBrush
GetOutlineTextMetricsW

kernel32

RegisterApplicationRestart
IsBadWritePtr
SetProcessDEPPolicy

wininet

InternetCrackUrlW

shcore

SHUnicodeToAnsi
ord192
ord183
ord126
ord109
ord174
ord190
ord123
ord187
ord186
ord184
ord244
ord162
ord200
ord142
ord1
ord121

shell32

SHEvaluateSystemCommandTemplate
ord85
ord190
ShellExecuteW
ord89
ord200
ord743
ord907
ord134
ord22
ord850
ord95
ord885
ord172
ord723
ord680
ord245
ShellExecuteExW
ord899
ord188
ord201
ord206
SHCreateItemInKnownFolder
ord67
DragQueryFileW
SHChangeNotifyRegisterThread
ord733
ord753
ord644
ord645
SHGetPathFromIDListW
ord4
SHFileOperationW
ord711
ord2
SHUpdateRecycleBinIcon
ord60
SHAddToRecentDocs
ord896
ord61
SHEnableServiceObject
ord54
ord254
ord91
DuplicateIcon
SHGetStockIconInfo
ord6
Shell_NotifyIconGetRect
Shell_NotifyIconW
ord137
ord132
ExtractIconExW
ord244
ord181
ord866
ord764
SHGetLocalizedName
ord895
SHCreateAssociationRegistration
ord765
ord906
SHGetPropertyStoreForWindow
ord894
SHAppBarMessage
ord162
ord727
ord792
ord790
Shell_GetCachedImageIndexW
ord100

shlwapi

AssocCreate
ChrCmpIW
AssocQueryKeyW
ord164
PathIsDirectoryW
ord413
ord548
ord163
ord467

uxtheme

GetBufferedPaintBits
GetThemeFont
IsThemeActive
IsAppThemed
GetThemeInt
DrawThemeTextEx
GetThemeColor
ord122
ord98
SetWindowTheme
ord118
ord126
IsCompositionActive
ord86
ord120
ord121
ord104
ord106
DrawThemeBackground
DrawThemeParentBackground
CloseThemeData
BufferedPaintInit
BeginBufferedPaint
EndBufferedPaint
BufferedPaintUnInit
GetWindowTheme
GetThemeBackgroundExtent
BufferedPaintSetAlpha
GetThemeMargins
GetThemeBool
OpenThemeData
OpenThemeDataForDpi
GetThemePartSize
GetThemeMetric

dwmapi

DwmGetWindowAttribute
ord140
DwmUpdateThumbnailProperties
ord124
ord114
ord159
ord141
DwmUnregisterThumbnail
ord138
ord139
DwmSetWindowAttribute
DwmIsCompositionEnabled
DwmRegisterThumbnail
DwmQueryThumbnailSourceSize
ord113
DwmEnableBlurBehindWindow

user32

GetMenuItemInfoW
GetMenuItemCount
CreateIconIndirect
GetSubMenu
LoadMenuW
DrawTextW
FillRect
DeleteMenu
TrackPopupMenuEx
SetMenuDefaultItem
RemoveMenu
EnableMenuItem
CheckMenuItem
LoadImageW
SetGestureConfig
SetWindowCompositionAttribute
GetDpiForWindow
AdjustWindowRect
GetLastInputInfo
CopyIcon
CalculatePopupWindowPosition
GetDoubleClickTime
ReleaseCapture
GetCapture
SetCapture
TrackMouseEvent
InsertMenuW
GetSystemMetricsForDpi
DrawIconEx
DestroyIcon
CopyImage
GetSysColor
GetCaretBlinkTime
InjectKeyboardInput
MapVirtualKeyExW
InjectMouseInput
LockWorkStation
TileWindows
CascadeWindows
SetWindowPlacement
HungWindowFromGhostWindow
LoadIconW
IsIconic
GetKeyState
ExitWindowsEx
EndDialog
SendDlgItemMessageW
MonitorFromWindow
RegisterHotKey
UnregisterHotKey
GetLastActivePopup
SwitchToThisWindow
ord2574
IsHungAppWindow
GetGuiResources
GetWindowPlacement
MonitorFromRect
ord2611
TranslateAcceleratorW
ChangeWindowMessageFilterEx
LoadAcceleratorsW
IsWindowUnicode
DefWindowProcA
MonitorFromPoint
SetCursor
LoadCursorW
CloseDesktop
GetUserObjectInformationW
GetThreadDesktop
DestroyMenu
GetMenuDefaultItem
CreatePopupMenu
ReleaseDC
GetDC
AdjustWindowRectEx
ReplyMessage
GetAsyncKeyState
ModifyMenuW
GetSystemMenu
GetSysColorBrush
GhostWindowFromHungWindow
GetIconInfoExW
GetIconInfo
GetClassWord
GetClassLongW
BringWindowToTop
ord2573
SetThreadDesktop
EndTask
OpenInputDesktop
IsTopLevelWindow
GetMenuState
IsZoomed
SetScrollInfo
GetScrollInfo
SetScrollPos
GetMenuStringW
InternalGetWindowText
GetLayeredWindowAttributes
SetLayeredWindowAttributes
IsProcessDPIAware
SetThreadDpiAwarenessContext
GetWindowCompositionAttribute
UpdateLayeredWindow
UnregisterClassW
ord2522
GetMenuInfo
SetMenuInfo
GetDpiForSystem
GetWindowDpiAwarenessContext
AreDpiAwarenessContextsEqual
CharLowerW
IsCharAlphaNumericW
GetPhysicalCursorPos
DrawTextExW
GetCursorInfo
SetMenuItemInfoW
ShowWindowAsync
GetProcessWindowStation
UnregisterClassA
ord2005

sspicli

GetUserNameExW

api-ms-win-security-lsalookup-l1-1-2

LsaLookupUserAccountType

profapi

ord104

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-kernel32-legacy-l1-1-1

PowerCreateRequest
PowerSetRequest

userenv

GetProfileType
GetUserProfileDirectoryW
DeriveAppContainerSidFromAppContainerName

api-ms-win-security-isolatedcontainer-l1-1-0

IsProcessInIsolatedContainer

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-service-management-l2-1-0

NotifyServiceStatusChangeW
QueryServiceConfigW

api-ms-win-core-kernel32-legacy-l1-1-2

SetTermsrvAppInstallMode

api-ms-win-core-io-l1-1-0

GetQueuedCompletionStatus
CreateIoCompletionPort

api-ms-win-shell-shdirectory-l1-1-0

ord292

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
StartTraceW
StopTraceW

rpcrt4

RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
NdrClientCall2
UuidFromStringW

api-ms-win-core-biptcltapi-l1-1-6

BiPtFreeMemory
BiPtEnumerateWorkItemsForPackageName
BiPtQueryWorkItem
BiPtAssociateApplicationEntryPoint

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

api-ms-win-security-lsalookup-l1-1-1

GetDefaultIdentityProvider
GetIdentityProviderInfoByGUID
ReleaseIdentityProviderEnumContext
EnumerateIdentityProviders

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.imrsiv
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
b10000.explorer.exe.tag
f80000.exe
.exe windows:6 windows x86 arch:x86

1cda62d85d4d631949032bd51ab17a29

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
CreateEventA
GetModuleFileNameW
GetModuleHandleA
MulDiv
lstrlenW
WriteConsoleW
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
LCMapStringW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
DecodePointer

user32

LoadImageA
GetIconInfo
DialogBoxParamA
EndDialog
SendMessageW
InflateRect
SetForegroundWindow
OffsetRect
GetWindowLongA
SendDlgItemMessageA
GetDlgItem
SetWindowPos
UnionRect

ole32

CoInitializeEx
CoTaskMemFree

Sections

.text
Size: 385KB - Virtual size: 385KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

diyuaw
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

Files

50d71aa5a56985299b871062efe9795d

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

advapi32

user32

rpcrt4

pdh

tdh

nsi

shlwapi

cabinet

wevtapi

kernel32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.data Size: 8KB - Virtual size: 8KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 4KB - Virtual size: 4KB

.rsrc Size: 56KB - Virtual size: 56KB

.reloc Size: 108KB - Virtual size: 108KB

3ce6a4281705671bb27a6de26815307b

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

dbghelp

oleaut32

shell32

user32

kernel32

kernelbase

combase

secur32

wtsapi32

userenv

winhttp

shlwapi

ntdll

winmm

bcryptprimitives

Exports

Exports

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 592KB - Virtual size: 592KB

.data Size: 100KB - Virtual size: 100KB

.tls Size: 4KB - Virtual size: 4KB

.rsrc Size: 6.0MB - Virtual size: 6.0MB

.reloc Size: 97KB - Virtual size: 97KB

2ae28f7349da6b3f73fa617070450bcf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

twinapi

api-ms-win-core-job-l2-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-kernel32-private-l1-1-0

api-ms-win-core-registryuserspecific-l1-1-0

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-atoms-l1-1-0

.text
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 8KB - Virtual size: 8KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 56KB - Virtual size: 56KB

.reloc
Size: 108KB - Virtual size: 108KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 592KB - Virtual size: 592KB

.data
Size: 100KB - Virtual size: 100KB

.tls
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 6.0MB - Virtual size: 6.0MB

.reloc
Size: 97KB - Virtual size: 97KB