xred | DiscordAccountGeneratorv2[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

DiscordAccountGeneratorv2.rar
Size

27.9MB
MD5

97f49dcd2417f7949b8a1f5aad275254
SHA1

ce210e43b79bf0da292830d62f9126f9c48fefda
SHA256

5de180ff35a8a0835dc704f4b8551fb1bb196837358c2020f84849c4f517fad8
SHA512

b842e825dd3102336ee41237710f87867c202dc447d529710011bb5f18fe9f24c857ef6660851b0eaf78cec4b4649d7557c6835a455b854a32cf654088c49d85
SSDEEP

786432:vhQth3Z6+q3KZUlYIPJhQth3Z6+q3KZUlYIPN:vWhzBZKBWhzBZK1

Score

10^/10

pyinstaller xred

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred family
xred

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/Discord Account Generator v2/AlphaFS.lib	pyinstaller
static1/unpack001/Discord Account Generator v2/RDXService/AlphaFS.lib	pyinstaller

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Discord Account Generator v2/AlphaFS.lib
unpack001/Discord Account Generator v2/DiscordGenerator.exe
unpack001/Discord Account Generator v2/RDXService/AlphaFS.lib
unpack001/Discord Account Generator v2/RDXService/Ionic.Zip.dll
unpack001/Discord Account Generator v2/RDXService/Jint.exe
unpack001/Discord Account Generator v2/RDXService/Launcher.exe
unpack001/Discord Account Generator v2/RDXService/build.lib
unpack001/Discord Account Generator v2/RDXService/rdpcorets.dll
unpack001/Discord Account Generator v2/build.lib
unpack001/Discord Account Generator v2/rdpcorets.dll

Files

DiscordAccountGeneratorv2.rar
.rar
Discord Account Generator v2/AlphaFS.lib
.exe windows:5 windows x64 arch:x64

e1e8417f4591da7741a300229f9e8e8b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
SetDllDirectoryW
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
CreateDirectoryW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetLastError
SetEndOfFile
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
RaiseException

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW

ws2_32

ntohl

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
discordgenerator.pyc
Discord Account Generator v2/DiscordGenerator.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\thorson\Desktop\Launcher1\Launcher\Launcher\obj\Debug\LUNCHER CRACKING.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Discord Account Generator v2/RDXService/AlphaFS.lib
.exe windows:5 windows x64 arch:x64

e1e8417f4591da7741a300229f9e8e8b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
SetDllDirectoryW
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
CreateDirectoryW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
Sleep
GetLastError
SetEndOfFile
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
RaiseException

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW

ws2_32

ntohl

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
discordgenerator.pyc
Discord Account Generator v2/RDXService/Ionic.Zip.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\DotNetZip\Zip\obj\Debug\Ionic.Zip.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Discord Account Generator v2/RDXService/Jint.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 615KB - Virtual size: 614KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 57B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 277KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Discord Account Generator v2/RDXService/LICENCE.dat
.zip
Discord Account Generator v2/RDXService/Launcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Discord Account Generator v2/RDXService/WPFToolkit.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22-08-2007 22:31

Not After

25-08-2012 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07-12-2009 22:40

Not After

07-03-2011 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25-07-2008 19:02

Not After

25-07-2013 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

78:ad:59:01:6e:90:b6:bb:0e:e2:71:c2:d6:d0:1b:d7:70:a4:ac:e8
Signer

Actual PE Digest

78:ad:59:01:6e:90:b6:bb:0e:e2:71:c2:d6:d0:1b:d7:70:a4:ac:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\dd\WPF_1\src\wpf\src\ControlsPack\WPFToolkit\obj\Release\WPFToolkit.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 448KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Discord Account Generator v2/RDXService/build.lib
.exe windows:6 windows x86 arch:x86

323af4c58083474382fc59ec19aa04d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryW
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
CreateFileW
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
HeapReAlloc
HeapFree
GetTimeZoneInformation
HeapAlloc
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
SetFilePointerEx
HeapSize
FlushFileBuffers
GetConsoleCP
GetConsoleMode
CloseHandle
WriteConsoleW

Sections

.text
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Discord Account Generator v2/RDXService/config/discord_usernames.txt
Discord Account Generator v2/RDXService/rdpcorets.dll
.dll regsvr32 windows:10 windows x64 arch:x64

a18681cf7fc4526bce25b48ecb511ef1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

RdpCoreTS.pdb

Imports

msvcrt

fclose
_wcsnicmp
floorf
log
wcsncmp
swprintf_s
wprintf
vswprintf_s
wcscpy_s
_CxxThrowException
_vsnwprintf
isalpha
swscanf
_amsg_exit
_aligned_free
_wcsicmp
fwrite
fprintf
malloc
free
wcscat_s
wcsnlen
_callnewh
_purecall
printf
ceilf
_wfopen
_strnicmp
calloc
?terminate@@YAXXZ
memcmp
memcpy
_lock
_XcptFilter
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
??0exception@@QEAA@XZ
strncpy_s
strnlen
sprintf_s
qsort
??1type_info@@UEAA@XZ
_initterm
__CxxFrameHandler3
wcschr
wcsncpy_s
memcpy_s
wcsrchr
memmove_s
_stricmp
_unlock
__dllonexit
memmove
memset
_wtoi
__C_specific_handler
_onexit
sqrt
_wfopen_s
_errno
pow
sqrtf
vsprintf_s
realloc
_aligned_malloc
wcscmp

oleaut32

UnRegisterTypeLi
LoadTypeLi
SysStringLen
SysFreeString
RegisterTypeLi
VarUI4FromStr
VariantCopy
VariantClear
SysAllocStringByteLen
VariantInit
SysAllocString
SysStringByteLen

api-ms-win-core-synch-l1-1-0

CreateEventW
EnterCriticalSection
SetEvent
WaitForMultipleObjectsEx
ReleaseSemaphore
InitializeSRWLock
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
ReleaseMutex
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
ResetEvent
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
ReleaseSRWLockExclusive
ReleaseSRWLockShared

api-ms-win-core-errorhandling-l1-1-0

SetErrorMode
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

SuspendThread
GetExitCodeThread
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
ResumeThread
GetCurrentProcess

api-ms-win-core-synch-l1-2-0

SleepConditionVariableCS
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
InitializeConditionVariable

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadResource
GetModuleHandleExW
GetModuleHandleExA
DisableThreadLibraryCalls
FindResourceExW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA
GetModuleFileNameW
SizeofResource

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegCreateKeyExW
RegEnumKeyExW
RegFlushKey
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegGetValueW
RegNotifyChangeKeyValue
RegCloseKey
RegQueryValueExW

api-ms-win-core-com-l1-1-0

CLSIDFromString
PropVariantClear
CoCreateGuid
CoCreateInstance
CoTaskMemRealloc
StringFromGUID2
IIDFromString
PropVariantCopy
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW

api-ms-win-service-management-l1-1-0

StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventWrite
EventUnregister
EventRegister
EventActivityIdControl

ws2_32

closesocket

iphlpapi

GetAdapterIndex

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-file-l1-1-0

FindClose
GetFileAttributesW
FindNextFileW
FindFirstFileW
ReadFile
CreateDirectoryW
WriteFile
SetFilePointerEx
ReadFileEx
DeleteFileW
WriteFileEx
GetTempFileNameW
GetFileInformationByHandle
CreateFileW

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject
WTSGetActiveConsoleSessionId
MoveFileW
BindIoCompletionCallback

ntdll

RtlNtStatusToDosError
RtlInitializeGenericTable
RtlEnumerateGenericTable
RtlDeleteElementGenericTable
WinSqmAddToStream
WinSqmSetDWORD
WinSqmEndSession
WinSqmStartSession
WinSqmIsOptedIn
RtlIpv4StringToAddressW
RtlInitUnicodeString
NtCreateFile
RtlLookupElementGenericTable
RtlInsertElementGenericTable
NtQuerySystemInformation
RtlIpv6StringToAddressW

api-ms-win-core-io-l1-1-0

GetOverlappedResult
CancelIoEx
DeviceIoControl

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer
DeleteTimerQueueTimer
UnregisterWaitEx
CreateTimerQueueTimer

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalFree
LocalAlloc
GlobalAlloc

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-trustee-l1-1-0

BuildTrusteeWithSidW
BuildSecurityDescriptorW

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
EqualSid
CreateWellKnownSid
FreeSid
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
AccessCheckAndAuditAlarmW
InitializeSecurityDescriptor
MakeSelfRelativeSD
ImpersonateLoggedOnUser
RevertToSelf

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetCPInfo
IsDBCSLeadByte

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCompareMemory
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemTime
GetTickCount64

api-ms-win-security-isolatedcontainer-l1-1-1

IsProcessInWDAGContainer

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

crypt32

CryptProtectMemory
CryptUnprotectMemory

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-stringansi-l1-1-0

CharNextA
CharPrevA

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

pdh

PdhCollectQueryData
PdhAddCounterW
PdhOpenQueryW
PdhCloseQuery
PdhGetRawCounterValue

user32

UnionRect
LoadCursorW
DispatchMessageW
GetWindowThreadProcessId
GetMessageW
UnregisterDeviceNotification
IsClipboardFormatAvailable
UnregisterClassW
RegisterDeviceNotificationW
UnregisterClassA
CreateWindowExW
RegisterClassW
CopyRect
SetRect
GetClipboardFormatNameW
PostMessageW
SetWindowLongPtrW
RegisterClipboardFormatW
SendMessageW
GetWindowLongPtrW
DefWindowProcW
DestroyWindow

regapi

RegWinstationQuerySecurityConfig_Merged

rfxvmt

RfxVmtCloseChannel
RfxVmtWriteChannel
RfxVmtReadChannel
RfxVmtCreateChannel
RfxVmtGetDataAvailableEvent

rdpbase

RDPBASE_CreateInstance
?RdpPerfLoggerStaticTerminate@@YAXXZ
RDPServerStackDiagnostics_Unregister
?RdpPerfLoggerStaticInitialize@@YAXXZ
RDPServerStackDiagnostics_Register
RdpX_Threading_CreateCriticalSection
PAL_System_Sleep
RdpX_AtomicDecrement32
RdpX_AtomicIncrement32
PAL_System_AtomicCompareAndExchangePointer
RDPServerStackDiagnostics_LogDisconnect
RDPServerStackDiagnostics_LogFailure
RDPServerStackDiagnostics_LogCheckpoint
RDPWSStreamConnector_CreateInstance
PAL_System_CritSecInit
RDPENCORE_AddGlobalObject
PAL_System_SwitchToThread
RDPAPI_GetGlobalObject
PAL_System_AtomicCompareAndExchange
TSCreateCoreEvents
RDPENCHLPREG_ReadValueDWORD
PAL_System_CritSecLeave
PAL_System_CritSecEnter
PAL_System_AtomicIncrement
PAL_System_AtomicDecrement
PAL_System_CritSecTerminate
TSAlloc
TSFree
PAL_System_CritSecIsLockedByCurrentThread
TRC_TraceBufferW
MemCopyAligned_SSE
MemMoveReverseAligned_SSE
GetSupportedSSELevel_SSE
PAL_System_GetNumberOfProcessors
?NSRunLengthDecode@@YAKPEBEKPEAEK@Z
PAL_System_MemFree
RdpX_GetActivityIdPrefix
RgnlibBA_CreateInstance
RDPAPI_GetGenericCounter
CRDPCaps_CreateInstance
PAL_System_CritSecTryEnter
RDPAPI_GetLongCounter
PAL_System_ThreadGetId
PAL_System_MemAlloc

rdpserverbase

?GetGfxPipeSettingBOOL@@YAJPEAGHPEAH@Z
?LogRDPGraphicsFirstNonBlackFramePostLogon@RDPGraphicsTraceLogging@@YAXI@Z
RDPSERVERBASE_CreateInstance
?LogRDPGraphicsFirstNonBlackFrame@RDPGraphicsTraceLogging@@YAX_K@Z
?LogRDPGraphicsError@RDPGraphicsTraceLogging@@YAXU_GUID@@IIJ@Z
?LogRDPGraphicsSubsampleFailure@RDPGraphicsTraceLogging@@YAXJI@Z
?GetGraphicsSourceContext@RdpSurface@@QEAAJPEAPEAUIRdpGFXSourceUpdateContext@@@Z
RDPEncryptionTraceLogging_Register
?RDPGraphicsTraceLogging_Unregister@RDPGraphicsTraceLogging@@YAXXZ
RDPEncryptionTraceLogging_Unregister
?LogRDPGraphicsVOBRHint@RDPGraphicsTraceLogging@@YAXI_KII@Z
?LogRDPGraphicsSubsampleAdapter@RDPGraphicsTraceLogging@@YAXPEBGII@Z
?GetEncodingPixelMap@RdpSurface@@QEAAJPEAPEAVPixelMap@@@Z
?RDPGraphicsTraceLogging_Register@RDPGraphicsTraceLogging@@YAJXZ
?GetGfxPipeSettingUINT@@YAJPEAGIPEAI@Z

api-ms-win-security-provider-l1-1-0

GetSecurityInfo
SetEntriesInAclW

rpcrt4

RpcBindingSetOption
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingSetAuthInfoExW
UuidCreate
I_RpcExceptionFilter
UuidToStringW
NdrClientCall3

api-ms-win-core-namedpipe-l1-1-0

CreateNamedPipeW
ConnectNamedPipe
WaitNamedPipeW
PeekNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState

api-ms-win-core-shlwapi-legacy-l1-1-0

PathUnquoteSpacesW
PathGetDriveNumberW
PathQuoteSpacesW
PathSkipRootW
PathIsUNCW
PathFindExtensionW

api-ms-win-core-url-l1-1-0

UrlIsW

userenv

ExpandEnvironmentStringsForUserW

api-ms-win-core-perfcounters-l1-1-0

PerfDeleteInstance
PerfIncrementULongCounterValue
PerfSetCounterSetInfo
PerfCreateInstance
PerfStartProviderEx
PerfStopProvider
PerfSetULongCounterValue

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
ControlTraceW
StartTraceW

api-ms-win-core-comm-l1-1-0

SetCommTimeouts

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-memory-l1-1-0

OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

gdi32

GetObjectW
DeleteObject
CreatePalette
GetMetaFileBitsEx
GetStockObject
GetPaletteEntries
SetMetaFileBitsEx
CreateMetaFileW
PlayMetaFile
CloseMetaFile
DeleteMetaFile

d3d11

D3D11CreateDevice

tlscsp

ord1
ord3
ord4
ord7
ord2

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalSize
GlobalLock

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-path-l1-1-0

PathCchCanonicalize

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RFX_CreateGFXService
RFX_CreatePluginFactory

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Discord Account Generator v2/WPFToolkit.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22-08-2007 22:31

Not After

25-08-2012 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07-12-2009 22:40

Not After

07-03-2011 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25-07-2008 19:02

Not After

25-07-2013 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

78:ad:59:01:6e:90:b6:bb:0e:e2:71:c2:d6:d0:1b:d7:70:a4:ac:e8
Signer

Actual PE Digest

78:ad:59:01:6e:90:b6:bb:0e:e2:71:c2:d6:d0:1b:d7:70:a4:ac:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\dd\WPF_1\src\wpf\src\ControlsPack\WPFToolkit\obj\Release\WPFToolkit.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 448KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Discord Account Generator v2/build.lib
.exe windows:6 windows x86 arch:x86

323af4c58083474382fc59ec19aa04d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryW
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
CreateFileW
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
HeapReAlloc
HeapFree
GetTimeZoneInformation
HeapAlloc
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
SetFilePointerEx
HeapSize
FlushFileBuffers
GetConsoleCP
GetConsoleMode
CloseHandle
WriteConsoleW

Sections

.text
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Discord Account Generator v2/config/discord_usernames.txt
Discord Account Generator v2/rdpcorets.dll
.dll regsvr32 windows:10 windows x64 arch:x64

a18681cf7fc4526bce25b48ecb511ef1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

RdpCoreTS.pdb

Imports

msvcrt

fclose
_wcsnicmp
floorf
log
wcsncmp
swprintf_s
wprintf
vswprintf_s
wcscpy_s
_CxxThrowException
_vsnwprintf
isalpha
swscanf
_amsg_exit
_aligned_free
_wcsicmp
fwrite
fprintf
malloc
free
wcscat_s
wcsnlen
_callnewh
_purecall
printf
ceilf
_wfopen
_strnicmp
calloc
?terminate@@YAXXZ
memcmp
memcpy
_lock
_XcptFilter
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_vsnprintf_s
??0exception@@QEAA@XZ
strncpy_s
strnlen
sprintf_s
qsort
??1type_info@@UEAA@XZ
_initterm
__CxxFrameHandler3
wcschr
wcsncpy_s
memcpy_s
wcsrchr
memmove_s
_stricmp
_unlock
__dllonexit
memmove
memset
_wtoi
__C_specific_handler
_onexit
sqrt
_wfopen_s
_errno
pow
sqrtf
vsprintf_s
realloc
_aligned_malloc
wcscmp

oleaut32

UnRegisterTypeLi
LoadTypeLi
SysStringLen
SysFreeString
RegisterTypeLi
VarUI4FromStr
VariantCopy
VariantClear
SysAllocStringByteLen
VariantInit
SysAllocString
SysStringByteLen

api-ms-win-core-synch-l1-1-0

CreateEventW
EnterCriticalSection
SetEvent
WaitForMultipleObjectsEx
ReleaseSemaphore
InitializeSRWLock
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
ReleaseMutex
WaitForSingleObjectEx
AcquireSRWLockExclusive
AcquireSRWLockShared
ResetEvent
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
ReleaseSRWLockExclusive
ReleaseSRWLockShared

api-ms-win-core-errorhandling-l1-1-0

SetErrorMode
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
RaiseException

api-ms-win-core-processthreads-l1-1-0

SuspendThread
GetExitCodeThread
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
ResumeThread
GetCurrentProcess

api-ms-win-core-synch-l1-2-0

SleepConditionVariableCS
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
InitializeConditionVariable

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadResource
GetModuleHandleExW
GetModuleHandleExA
DisableThreadLibraryCalls
FindResourceExW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameA
GetModuleFileNameW
SizeofResource

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegCreateKeyExW
RegEnumKeyExW
RegFlushKey
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegGetValueW
RegNotifyChangeKeyValue
RegCloseKey
RegQueryValueExW

api-ms-win-core-com-l1-1-0

CLSIDFromString
PropVariantClear
CoCreateGuid
CoCreateInstance
CoTaskMemRealloc
StringFromGUID2
IIDFromString
PropVariantCopy
CoTaskMemAlloc
CoTaskMemFree

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
GetTraceEnableFlags
UnregisterTraceGuids
RegisterTraceGuidsW

api-ms-win-service-management-l1-1-0

StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventWrite
EventUnregister
EventRegister
EventActivityIdControl

ws2_32

closesocket

iphlpapi

GetAdapterIndex

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-file-l1-1-0

FindClose
GetFileAttributesW
FindNextFileW
FindFirstFileW
ReadFile
CreateDirectoryW
WriteFile
SetFilePointerEx
ReadFileEx
DeleteFileW
WriteFileEx
GetTempFileNameW
GetFileInformationByHandle
CreateFileW

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject
WTSGetActiveConsoleSessionId
MoveFileW
BindIoCompletionCallback

ntdll

RtlNtStatusToDosError
RtlInitializeGenericTable
RtlEnumerateGenericTable
RtlDeleteElementGenericTable
WinSqmAddToStream
WinSqmSetDWORD
WinSqmEndSession
WinSqmStartSession
WinSqmIsOptedIn
RtlIpv4StringToAddressW
RtlInitUnicodeString
NtCreateFile
RtlLookupElementGenericTable
RtlInsertElementGenericTable
NtQuerySystemInformation
RtlIpv6StringToAddressW

api-ms-win-core-io-l1-1-0

GetOverlappedResult
CancelIoEx
DeviceIoControl

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer
DeleteTimerQueueTimer
UnregisterWaitEx
CreateTimerQueueTimer

api-ms-win-core-heap-l2-1-0

LocalFree
GlobalFree
LocalAlloc
GlobalAlloc

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-trustee-l1-1-0

BuildTrusteeWithSidW
BuildSecurityDescriptorW

api-ms-win-security-base-l1-1-0

AllocateAndInitializeSid
EqualSid
CreateWellKnownSid
FreeSid
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
AccessCheckAndAuditAlarmW
InitializeSecurityDescriptor
MakeSelfRelativeSD
ImpersonateLoggedOnUser
RevertToSelf

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapFree
HeapAlloc

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetCPInfo
IsDBCSLeadByte

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCompareMemory
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemTime
GetTickCount64

api-ms-win-security-isolatedcontainer-l1-1-1

IsProcessInWDAGContainer

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

crypt32

CryptProtectMemory
CryptUnprotectMemory

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-stringansi-l1-1-0

CharNextA
CharPrevA

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

pdh

PdhCollectQueryData
PdhAddCounterW
PdhOpenQueryW
PdhCloseQuery
PdhGetRawCounterValue

user32

UnionRect
LoadCursorW
DispatchMessageW
GetWindowThreadProcessId
GetMessageW
UnregisterDeviceNotification
IsClipboardFormatAvailable
UnregisterClassW
RegisterDeviceNotificationW
UnregisterClassA
CreateWindowExW
RegisterClassW
CopyRect
SetRect
GetClipboardFormatNameW
PostMessageW
SetWindowLongPtrW
RegisterClipboardFormatW
SendMessageW
GetWindowLongPtrW
DefWindowProcW
DestroyWindow

regapi

RegWinstationQuerySecurityConfig_Merged

rfxvmt

RfxVmtCloseChannel
RfxVmtWriteChannel
RfxVmtReadChannel
RfxVmtCreateChannel
RfxVmtGetDataAvailableEvent

rdpbase

RDPBASE_CreateInstance
?RdpPerfLoggerStaticTerminate@@YAXXZ
RDPServerStackDiagnostics_Unregister
?RdpPerfLoggerStaticInitialize@@YAXXZ
RDPServerStackDiagnostics_Register
RdpX_Threading_CreateCriticalSection
PAL_System_Sleep
RdpX_AtomicDecrement32
RdpX_AtomicIncrement32
PAL_System_AtomicCompareAndExchangePointer
RDPServerStackDiagnostics_LogDisconnect
RDPServerStackDiagnostics_LogFailure
RDPServerStackDiagnostics_LogCheckpoint
RDPWSStreamConnector_CreateInstance
PAL_System_CritSecInit
RDPENCORE_AddGlobalObject
PAL_System_SwitchToThread
RDPAPI_GetGlobalObject
PAL_System_AtomicCompareAndExchange
TSCreateCoreEvents
RDPENCHLPREG_ReadValueDWORD
PAL_System_CritSecLeave
PAL_System_CritSecEnter
PAL_System_AtomicIncrement
PAL_System_AtomicDecrement
PAL_System_CritSecTerminate
TSAlloc
TSFree
PAL_System_CritSecIsLockedByCurrentThread
TRC_TraceBufferW
MemCopyAligned_SSE
MemMoveReverseAligned_SSE
GetSupportedSSELevel_SSE
PAL_System_GetNumberOfProcessors
?NSRunLengthDecode@@YAKPEBEKPEAEK@Z
PAL_System_MemFree
RdpX_GetActivityIdPrefix
RgnlibBA_CreateInstance
RDPAPI_GetGenericCounter
CRDPCaps_CreateInstance
PAL_System_CritSecTryEnter
RDPAPI_GetLongCounter
PAL_System_ThreadGetId
PAL_System_MemAlloc

rdpserverbase

?GetGfxPipeSettingBOOL@@YAJPEAGHPEAH@Z
?LogRDPGraphicsFirstNonBlackFramePostLogon@RDPGraphicsTraceLogging@@YAXI@Z
RDPSERVERBASE_CreateInstance
?LogRDPGraphicsFirstNonBlackFrame@RDPGraphicsTraceLogging@@YAX_K@Z
?LogRDPGraphicsError@RDPGraphicsTraceLogging@@YAXU_GUID@@IIJ@Z
?LogRDPGraphicsSubsampleFailure@RDPGraphicsTraceLogging@@YAXJI@Z
?GetGraphicsSourceContext@RdpSurface@@QEAAJPEAPEAUIRdpGFXSourceUpdateContext@@@Z
RDPEncryptionTraceLogging_Register
?RDPGraphicsTraceLogging_Unregister@RDPGraphicsTraceLogging@@YAXXZ
RDPEncryptionTraceLogging_Unregister
?LogRDPGraphicsVOBRHint@RDPGraphicsTraceLogging@@YAXI_KII@Z
?LogRDPGraphicsSubsampleAdapter@RDPGraphicsTraceLogging@@YAXPEBGII@Z
?GetEncodingPixelMap@RdpSurface@@QEAAJPEAPEAVPixelMap@@@Z
?RDPGraphicsTraceLogging_Register@RDPGraphicsTraceLogging@@YAJXZ
?GetGfxPipeSettingUINT@@YAJPEAGIPEAI@Z

api-ms-win-security-provider-l1-1-0

GetSecurityInfo
SetEntriesInAclW

rpcrt4

RpcBindingSetOption
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingSetAuthInfoExW
UuidCreate
I_RpcExceptionFilter
UuidToStringW
NdrClientCall3

api-ms-win-core-namedpipe-l1-1-0

CreateNamedPipeW
ConnectNamedPipe
WaitNamedPipeW
PeekNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState

api-ms-win-core-shlwapi-legacy-l1-1-0

PathUnquoteSpacesW
PathGetDriveNumberW
PathQuoteSpacesW
PathSkipRootW
PathIsUNCW
PathFindExtensionW

api-ms-win-core-url-l1-1-0

UrlIsW

userenv

ExpandEnvironmentStringsForUserW

api-ms-win-core-perfcounters-l1-1-0

PerfDeleteInstance
PerfIncrementULongCounterValue
PerfSetCounterSetInfo
PerfCreateInstance
PerfStartProviderEx
PerfStopProvider
PerfSetULongCounterValue

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2
ControlTraceW
StartTraceW

api-ms-win-core-comm-l1-1-0

SetCommTimeouts

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-memory-l1-1-0

OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

gdi32

GetObjectW
DeleteObject
CreatePalette
GetMetaFileBitsEx
GetStockObject
GetPaletteEntries
SetMetaFileBitsEx
CreateMetaFileW
PlayMetaFile
CloseMetaFile
DeleteMetaFile

d3d11

D3D11CreateDevice

tlscsp

ord1
ord3
ord4
ord7
ord2

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalSize
GlobalLock

api-ms-win-core-psapi-l1-1-0

K32GetModuleFileNameExW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-path-l1-1-0

PathCchCanonicalize

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RFX_CreateGFXService
RFX_CreatePluginFactory

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

e1e8417f4591da7741a300229f9e8e8b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ws2_32

Sections

.text Size: 131KB - Virtual size: 131KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 3KB - Virtual size: 44KB

.pdata Size: 7KB - Virtual size: 7KB

.gfids Size: 512B - Virtual size: 172B

.rsrc Size: 122KB - Virtual size: 122KB

.reloc Size: 2KB - Virtual size: 1KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 11KB - Virtual size: 10KB

.rsrc Size: 214KB - Virtual size: 213KB

.reloc Size: 512B - Virtual size: 12B

e1e8417f4591da7741a300229f9e8e8b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ws2_32

Sections

.text Size: 131KB - Virtual size: 131KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 3KB - Virtual size: 44KB

.pdata Size: 7KB - Virtual size: 7KB

.gfids Size: 512B - Virtual size: 172B

.rsrc Size: 122KB - Virtual size: 122KB

.reloc Size: 2KB - Virtual size: 1KB

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 478KB - Virtual size: 477KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

Headers

File Characteristics

Sections

CODE Size: 615KB - Virtual size: 614KB

DATA Size: 12KB - Virtual size: 11KB

BSS Size: - Virtual size: 4KB

.idata Size: 11KB - Virtual size: 10KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 57B

.reloc Size: 42KB - Virtual size: 42KB

.rsrc Size: 277KB - Virtual size: 277KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 50KB - Virtual size: 50KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 131KB - Virtual size: 131KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 3KB - Virtual size: 44KB

.pdata
Size: 7KB - Virtual size: 7KB

.gfids
Size: 512B - Virtual size: 172B

.rsrc
Size: 122KB - Virtual size: 122KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 214KB - Virtual size: 213KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 131KB - Virtual size: 131KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 3KB - Virtual size: 44KB

.pdata
Size: 7KB - Virtual size: 7KB

.gfids
Size: 512B - Virtual size: 172B

.rsrc
Size: 122KB - Virtual size: 122KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 478KB - Virtual size: 477KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

CODE
Size: 615KB - Virtual size: 614KB

DATA
Size: 12KB - Virtual size: 11KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 11KB - Virtual size: 10KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 57B

.reloc
Size: 42KB - Virtual size: 42KB

.rsrc
Size: 277KB - Virtual size: 277KB

.text
Size: 50KB - Virtual size: 50KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

78:ad:59:01:6e:90:b6:bb:0e:e2:71:c2:d6:d0:1b:d7:70:a4:ac:e8
Signer

.text
Size: 448KB - Virtual size: 448KB

.rsrc
Size: 1024B - Virtual size: 952B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 178KB - Virtual size: 177KB

.rdata
Size: 59KB - Virtual size: 58KB

.data
Size: 3KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB