InstallPack (1234)[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

InstallPack (1234).zip
Size

18.7MB
MD5

94fd170341983a6ecdc67c80f64583e8
SHA1

a3d0a1bc36ecf5ea7e46c16c2b00f3d3140e210d
SHA256

f6d9ba60e223e0eff4f69f345656c450e81fbc56d152a768045f204a9bebc8f6
SHA512

35e226c27dee7749fe25eca2cd838461876d174aa1785aa372fce499bcadd7c592fc994e975ef609c165559b50ab59e2ada0658e25348fe5cf6e1b721d70117b
SSDEEP

393216:uSrFkoIJqAnNXz79fwl0S8adE0YyLVoNfojJR:UoIJTNj7dI8aPLSNQjP

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SysFxUI.dll
unpack001/syncutil.dll
unpack001/sysclass.dll
unpack001/sysdm.cpl

Files

InstallPack (1234).zip
.zip

Password: 1234
SysFxUI.dll
.dll regsvr32 windows:10 windows x64 arch:x64

Password: 1234

15057b690cb1d888378871bff752e116

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

SysFxUi.pdb

Imports

api-ms-win-crt-string-l1-1-0

memset
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__itow
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcslwr_s
_o__wcsnicmp
_o__wtoi
_o_calloc
_o_cos
_o_free
_o_iswdigit
_o_malloc
_o_pow
_o_sin
_o_sqrt
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
__current_exception
__current_exception_context
__C_specific_handler
__std_terminate
__CxxFrameHandler4
_o__configure_narrow_argv
_CxxThrowException
__C_specific_handler_noexcept
memcmp
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
_o__errno
_o__crt_atexit
memcpy

advapi32

RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

kernel32

lstrcmpiW
RaiseException
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
DelayLoadFailureHook
MultiByteToWideChar
SizeofResource
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
DecodePointer
EncodePointer
LoadLibraryExA
VirtualAlloc
GetCurrentProcess
VirtualFree
ExpandEnvironmentStringsW
MulDiv
Sleep
SetEvent
CreateThread
CreateEventW
CreateSemaphoreExW
CreateMutexExW
GetCurrentProcessId
LockResource
OpenSemaphoreW
WaitForSingleObject
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
CloseHandle
SetLastError
OutputDebugStringW
IsDebuggerPresent
WideCharToMultiByte
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentThreadId
FormatMessageW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetThreadLocale
GetThreadLocale
DisableThreadLibraryCalls
GetModuleFileNameW
FindResourceExW
LoadResource
ResolveDelayLoadedAPI

gdi32

SetLayout
GetObjectW
CreateCompatibleBitmap
CreateBitmap
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC

user32

CharNextW
GetDlgItem
GetClientRect
SendMessageW
GetSystemMetrics
EnableWindow
MessageBoxW
PostMessageW
ShowWindow
EnumChildWindows
UnregisterClassA
InsertMenuItemW
TrackPopupMenuEx
GetSubMenu
LoadMenuW
GetWindowLongW
LoadImageW
ReleaseDC
CreateIconIndirect
DrawIconEx
GetIconInfo
GetDC
SendDlgItemMessageW
DialogBoxParamW
GetWindowLongPtrW
DestroyWindow
CallWindowProcW
DefWindowProcW
GetWindowRect
EndDialog
GetWindowTextW
SetWindowLongPtrW
GetParent
GetActiveWindow
SetDlgItemTextW
SetWindowTextW
LoadStringW
CreateWindowExW

api-ms-win-core-com-l1-1-0

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
PropVariantClear
CoInitializeEx
CoUninitialize

oleaut32

VarUI4FromStr
UnRegisterTypeLi
SysAllocString
LoadTypeLi
SysFreeString
SysStringLen
LoadRegTypeLi
SysAllocStringLen
RegisterTypeLi

api-ms-win-core-path-l1-1-0

PathCchCombine

api-ms-win-downlevel-shlwapi-l1-1-0

PathFindFileNameW
PathRemoveFileSpecW

comctl32

CreatePropertySheetPageW
PropertySheetW
DestroyPropertySheetPage

propsys

InitPropVariantFromCLSID

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 232KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
install.exe
.exe windows:5 windows x86 arch:x86

Password: 1234

0fa32a4be3e8cb048b355853743c6a52

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:ef:7c:65:58:b7:d1:9a:72:56:05:b0:1b:96:13:88
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

03-07-2024 00:00

Not After

03-07-2027 23:59

Subject

SERIALNUMBER=AAN-1705,CN=Cypherix Software (India) LLP,O=Cypherix Software (India) LLP,ST=Maharashtra,C=IN,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#1302494e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15-01-2024 00:00

Not After

14-04-2035 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22-03-2021 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:5a:eb:c8:72:2e:80:ff:84:50:12:3a:65:31:ce:e5:86:e7:63:43:f4:79:41:8c:98:ba:d0:4b:d7:59:3c:bb
Signer

Actual PE Digest

7d:5a:eb:c8:72:2e:80:ff:84:50:12:3a:65:31:ce:e5:86:e7:63:43:f4:79:41:8c:98:ba:d0:4b:d7:59:3c:bb

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

I:\dev_business\VSAlpha\cpp\VSVideoDownloaderLite\Win32\Release\VSVideoDownloaderLite.pdb

Imports

gdiplus

GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdiplusStartup
GdipDrawImageRect
GdipCreateFromHDC
GdipSetPageUnit
GdipDisposeImage
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipSetInterpolationMode
GdipDrawImageRectI
GdipAlloc
GdipGetImageThumbnail
GdipLoadImageFromFile
GdipDeleteGraphics
GdiplusShutdown
GdipFree
GdipCreateBitmapFromStream

shell32

SHAppBarMessage
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetDesktopFolder
DragQueryFileW
DragFinish
ShellExecuteW
SHGetFolderPathW
ord165
SHBrowseForFolderW
SHGetMalloc
DragAcceptFiles
SHGetPathFromIDListW

winhttp

WinHttpOpen
WinHttpSetOption
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSendRequest
WinHttpQueryAuthSchemes
WinHttpAddRequestHeaders
WinHttpSetCredentials
WinHttpReadData
WinHttpCrackUrl
WinHttpGetProxyForUrl
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpGetDefaultProxyConfiguration
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpWriteData

kernel32

FindResourceExW
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetFileSizeEx
EncodePointer
DecodePointer
GetDriveTypeW
FindFirstFileExW
ExitThread
CreateThread
GetSystemTimeAsFileTime
GetCPInfo
HeapAlloc
HeapReAlloc
RtlUnwind
RaiseException
VirtualAlloc
VirtualQuery
ExitProcess
HeapQueryInformation
HeapSize
SetStdHandle
GetFileType
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
QueryPerformanceCounter
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
IsProcessorFeaturePresent
LCMapStringW
GetFileInformationByHandle
PeekNamedPipe
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetProcessHeap
WriteConsoleW
SetEnvironmentVariableA
FileTimeToLocalFileTime
GetFileAttributesExW
SetErrorMode
SearchPathW
GetProfileIntW
GetNumberFormatW
GetWindowsDirectoryW
GetTempPathW
GetTempFileNameW
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
ReadFile
lstrcmpiW
GetCurrentDirectoryW
GetSystemDirectoryW
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
GlobalHandle
TlsGetValue
LocalAlloc
FileTimeToSystemTime
GetThreadLocale
GlobalGetAtomNameW
GlobalFlags
SetThreadPriority
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
LoadLibraryExW
lstrcpyW
GetFileSize
GlobalReAlloc
InterlockedExchange
InterlockedDecrement
ReleaseActCtx
CreateActCtxW
lstrlenA
lstrcmpA
GetCurrentProcessId
FreeResource
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
InitializeCriticalSectionAndSpinCount
lstrcmpW
CopyFileW
GlobalSize
lstrlenW
GetCurrentThreadId
ResumeThread
LocalFree
DeleteFileW
CloseHandle
WaitForMultipleObjects
GetSystemInfo
CreateEventW
InterlockedExchangeAdd
GetLocalTime
ResetEvent
LocalLock
MultiByteToWideChar
CreateFileW
GetVersionExW
FormatMessageW
Sleep
TerminateThread
WideCharToMultiByte
WriteFile
GetTickCount
SetEvent
WaitForSingleObject
SetFilePointerEx
GetCurrentProcess
FreeLibrary
SetFilePointer
GetProcAddress
SetLastError
DeactivateActCtx
ActivateActCtx
DeleteCriticalSection
EnterCriticalSection
GetModuleFileNameW
LeaveCriticalSection
LoadLibraryW
InitializeCriticalSection
TryEnterCriticalSection
GlobalFree
GetLastError
GlobalUnlock
GetFileAttributesW
GlobalAlloc
GetModuleHandleW
GlobalLock
LockResource
MulDiv
SizeofResource
LoadResource
FindResourceW
GetUserDefaultLCID
VirtualProtect
TlsAlloc
GetFileTime
InterlockedCompareExchange
HeapFree

user32

SetClassLongW
InsertMenuItemW
ReuseDDElParam
UnpackDDElParam
DestroyAcceleratorTable
LockWindowUpdate
GetDoubleClickTime
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
GetUpdateRect
CharNextW
CopyAcceleratorTableW
InvalidateRgn
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
InvertRect
HideCaret
CharUpperBuffW
SubtractRect
IsCharLowerW
MapVirtualKeyExW
CreateMenu
DestroyCursor
GetWindowRgn
SetRect
IsZoomed
ShowOwnedPopups
PostQuitMessage
DrawFrameControl
DrawEdge
EnableScrollBar
CreatePopupMenu
FrameRect
SetCursor
GetIconInfo
DrawIconEx
GetNextDlgGroupItem
DrawFocusRect
LoadCursorW
SetLayeredWindowAttributes
SetCapture
OffsetRect
DestroyMenu
GetMenuItemInfoW
GetAsyncKeyState
GetSysColorBrush
MonitorFromPoint
SystemParametersInfoW
SetWindowRgn
DestroyIcon
CopyImage
IsRectEmpty
WindowFromPoint
MapVirtualKeyW
GetKeyNameTextW
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
GetCursorPos
DrawStateW
IntersectRect
InflateRect
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
GetWindowThreadProcessId
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
CheckDlgButton
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
GetDialogBaseUnits
SetCursorPos
RemovePropW
SetFocus
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
ValidateRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
GetWindowLongW
SetWindowPos
CopyRect
PtInRect
GetWindow
GetMenuStringW
GetMenuItemID
InsertMenuW
GetMenuItemCount
RemoveMenu
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetFocus
GetParent
GetMenuState
EnableMenuItem
CheckMenuItem
DestroyWindow
TranslateAcceleratorW
GetSystemMenu
GetWindowRect
IsClipboardFormatAvailable
LoadAcceleratorsW
InvalidateRect
AppendMenuW
GetClipboardData
SetWindowLongW
GetCaretPos
GetComboBoxInfo
CloseClipboard
IsIconic
PostMessageW
GetSubMenu
DrawIcon
SetRectEmpty
ModifyMenuW
LoadMenuW
BringWindowToTop
EmptyClipboard
OpenClipboard
GetSystemMetrics
SetClipboardData
MessageBoxW
SetTimer
KillTimer
LoadIconW
UpdateWindow
LoadStringW
LoadImageW
LoadBitmapW
GetClientRect
IsWindowVisible
GetDC
ReleaseDC
RedrawWindow
GetSysColor
IsWindow
SendMessageW
GetCapture
ReleaseCapture
EnableWindow
GetMenuDefaultItem
SetParent
CopyIcon
WaitMessage
PostThreadMessageW
RegisterClipboardFormatW
GetPropW
SetMenuDefaultItem
IsMenu
UpdateLayeredWindow
UnionRect
CharUpperW
NotifyWinEvent
MessageBeep
DeleteMenu
UnregisterClassW
EnumDisplayMonitors
RealChildWindowFromPoint
GetMessageW
TranslateMessage
SetWindowContextHelpId
SetPropW
MapDialogRect
GetWindowTextLengthW

gdi32

MoveToEx
SetTextAlign
GetLayout
SetLayout
DeleteObject
SelectClipRgn
CreateRectRgn
GetViewportExtEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
SelectPalette
GetObjectType
CreatePen
Escape
CreateHatchBrush
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
SetDIBColorTable
RealizePalette
CreateCompatibleBitmap
SetPixel
CreateDIBSection
CreateRoundRectRgn
GetTextExtentPoint32W
GetTextMetricsW
LineTo
CreatePolygonRgn
IntersectClipRect
GetTextColor
Polyline
Ellipse
Polygon
Rectangle
RoundRect
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
OffsetRgn
GetRgnBox
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExW
ExtFloodFill
SetPaletteEntries
GetWindowOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
GetViewportOrgEx
LPtoDP
SetPixelV
GetTextFaceW
ExtTextOutW
TextOutW
RectVisible
CreateEllipticRgn
PtVisible
GetPixel
BitBlt
GetWindowExtEx
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
CreateDCW
CopyMetaFileW
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
CreateBitmap
GetStockObject
StretchBlt
CreateCompatibleDC
CreateFontIndirectW
GetDeviceCaps
GetObjectW
SetViewportOrgEx
GetBkColor
CreateSolidBrush
SelectObject

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegEnumKeyW
PrivilegeCheck
LookupPrivilegeValueW
AdjustTokenPrivileges
InitiateSystemShutdownW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
OpenProcessToken
RegDeleteKeyW
RegDeleteValueW
RegQueryValueExW

comctl32

InitCommonControlsEx
ImageList_GetIconSize

shlwapi

PathIsUNCW
PathStripToRootW
PathFindFileNameW
PathFindExtensionW
PathRemoveFileSpecW

ole32

CLSIDFromString
CLSIDFromProgID
CoCreateGuid
OleDuplicateData
ReleaseStgMedium
CoTaskMemFree
CreateStreamOnHGlobal
CoRegisterMessageFilter
CoRevokeClassObject
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoInitializeEx
OleLockRunning
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoUninitialize
CoInitialize
CoTaskMemAlloc
CoCreateInstance

oleaut32

SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
VarBstrFromDate
VariantCopy
OleCreateFontIndirect
SysAllocString
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysFreeString

oledlg

OleUIBusyW

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 497KB - Virtual size: 496KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 721KB - Virtual size: 721KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
syncutil.dll
.dll windows:10 windows x64 arch:x64

Password: 1234

5d71f59b101585154757fa85be0f3fe6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

SyncUtil.pdb

Imports

msvcrt

_lock
_XcptFilter
__dllonexit
_onexit
_errno
_unlock
_initterm
memset
memmove
_callnewh
malloc
free
_strnicmp
memcpy
memcmp
_vscwprintf
_vsnwprintf_s
_wcsicmp
wcschr
wcscat_s
wcsnlen
wcsncmp
_i64tow_s
_wcstoui64
_vsnprintf
wcsrchr
isalnum
strspn
strcspn
_wtoi
_itow_s
wcstok_s
wcsstr
wcscspn
__CxxFrameHandler4
__CxxFrameHandler3
_purecall
__C_specific_handler
_amsg_exit
memcpy_s
_vsnwprintf
wcscmp

ntdll

RtlSetThreadWorkOnBehalfTicket
RtlClearThreadWorkOnBehalfTicket
WinSqmEndSession
RtlIsMultiSessionSku
RtlGetDeviceFamilyInfoEnum
RtlIsCriticalSectionLockedByThread
RtlGetThreadWorkOnBehalfTicket
WinSqmAddToStreamEx
RtlReportException
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmStartSession

mccspal

ord31
ord30

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameW
FreeLibrary
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleW
LoadStringW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
InitOnceComplete
InitOnceBeginInitialize
Sleep
SleepConditionVariableSRW

api-ms-win-core-synch-l1-1-0

ReleaseMutex
InitializeCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
WaitForSingleObject
LeaveCriticalSection
DeleteCriticalSection
CreateMutexExW
OpenMutexW
CreateMutexW
OpenSemaphoreW
WaitForSingleObjectEx
SetEvent
EnterCriticalSection
InitializeSRWLock
AcquireSRWLockExclusive
CreateSemaphoreExW
CreateEventExW
CreateEventW
ResetEvent
ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventWriteTransfer
EventRegister

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThreadToken
OpenProcessToken
GetCurrentThread

api-ms-win-core-localization-l1-2-0

FormatMessageW
LCMapStringW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

oleaut32

SystemTimeToVariantTime
SysFreeString
VariantInit
VariantTimeToSystemTime
VariantClear
SysAllocStringLen
SysAllocString

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetLocalTime
GetSystemTime
GetSystemTimeAsFileTime
GetVersionExW
GetTickCount64

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegEnumKeyExW
RegDeleteTreeW
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegEnumValueW
RegDeleteValueW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-file-l1-1-0

CompareFileTime
GetFileAttributesExW
CreateFileW
DeleteFileW
GetFileSize
ReadFile

api-ms-win-core-path-l1-1-0

PathCchCombine
PathCchAddBackslash

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

api-ms-win-core-url-l1-1-0

UrlUnescapeW

networkhelper

CHttpTransport_CreateInstance
SyncWerReportComponentName
SyncPdcReference_WatchdogReport
SyncPdcReference_WatchdogsEnabled
SyncWerReportGenerator
GetOrCreateNullPowerDependencyCoordinatorManager

api-ms-win-downlevel-shlwapi-l1-1-0

StrStrIW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AcquireDataStoreLock
AcquireDataStoreLockEx
AggregateAccountSyncStats
AggregateSessionSyncStats
CloseDataStoreLock
CoCreateInstanceElevated
CreateAuthHandler
CreateDataStoreLock
CreateSyncBufferedStream
CredVaultDelete
CredVaultRead
CredVaultWrite
DeleteAuthCertHash
DeleteDataSource
DeleteHttpTransport
DeleteOAuthRefreshTokenForPartnership
DeletePwd
DeviceNeedsProvisioning
DllCanUnloadNow
DllGetClassObject
DoesServerSupportAutoMoveSentItem
FindErrorCode
GetAADToken
GetAccountSyncStats
GetAccountUsernameFromToken
GetAuthCertHash
GetAuthCertTargetAndUser
GetAuthority
GetBatterySaverWnfName
GetCurrentSyncStats
GetCurrentSyncStatsForMessage
GetCurrentSyncStatsForStore
GetDefaultDeviceType
GetDefaultMsaWebAccountId
GetDefaultStoreDirty
GetDomainFromEmail
GetGalSearchResultsFolderAndPartnerGuidEx
GetGoldenPartnershipId
GetMonitorDisplayState
GetMsaCustomerId
GetOAuthAccessTokenForPartnership
GetOAuthHelperForAccount
GetOAuthHelperForProvider
GetOutgoingMessageSizeLimit
GetProviderUri
GetSHA1HashOfString
GetSessionSyncStats
GetSyncTargetName
GetSyncWorkOnBehalfTicket
GetWebAccountId
GetWebAccountProvider
GetWebAccountProviderFromProviderId
HasNeverSyncedSuccessfully
InitializeCredVault
InitializeMeContact
InitializeMsaStore
InitializeServerReadyEvents
InitializeSyncStatus
InvalidateOAuthAccessTokenForPartnership
IsACOn
IsFirstSyncEver
IsMatchingClientCertificateEx
IsPwdSaved
IsScreenOn
IsValidAADAuthUri
LoadHeartbeatValues
LogSyncBiweeklySQM
MarkServerReady
MarkServerShutdown
MarkUserDataAccountAsHidden
OAuthHelper_CreateInstance
OpenMimeBufferedStream
OpenProviderKey
ReadOAuthRefreshTokenForPartnership
ReadPasswordForPartnership
RegisterSsoAccountsCallback
ReleaseDataStoreLock
SetAuthCertHash
SetBatterySaverWnfName
SetDefaultStoreDirty
SetMonitorDisplayState
SetOutgoingMessageSizeLimit
SetSyncWorkOnBehalfTicket
SyncSqmUpdateStats
TryGetDefaultSignInAccountInfo
UninitializeServerReadyEvents
UpdateYahooAccountType
VerifyDataStoreLockOwner
WaitForServerReady
WaitForSignalOrShutdown
WriteOAuthRefreshTokenForPartnership
WritePasswordForPartnership

Sections

.text
Size: 284KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sysclass.dll
.dll windows:10 windows x64 arch:x64

Password: 1234

313022ff36a71f00d6b89bf24ae72876

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

sysclass.pdb

Imports

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

Sections

.text
Size: 4KB - Virtual size: 822B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sysdm.cpl
.dll windows:10 windows x64 arch:x64

Password: 1234

7974728b84c0b966a5c6b080c7e2a858

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

sysdm.pdb

Imports

msvcrt

?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBD@Z
memcpy
memmove
??0exception@@QEAA@AEBQEBDH@Z
_CxxThrowException
__CxxFrameHandler4
memset
__CxxFrameHandler3
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
malloc
_amsg_exit
_XcptFilter
vswprintf_s
_purecall
_wcsicmp
_vsnprintf
__C_specific_handler
iswspace
memmove_s
wcschr
tolower
toupper
isalpha
free
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
??3@YAXPEAX@Z
memcpy_s
_vsnwprintf
??_V@YAXPEAX@Z
_callnewh
wcscmp

comctl32

PropertySheetW
CreatePropertySheetPageW

shell32

ord169
ord730
SHBrowseForFolderW
SHGetPathFromIDListW
ord680
ShellExecuteExW
ExtractIconW
ord195
SHCreateDirectoryExW
ord258
ord259
ord100
ord168
ord167

shlwapi

SHSetValueW
ord629
ord388
SHRegGetValueW
ord437
PathGetCharTypeW
PathRemoveBlanksW
ord450
StrDupW
StrChrW
ord158
ord460
StrStrIW
PathUnquoteSpacesW
AssocQueryStringW
ord154
StrRChrW
StrFormatByteSizeW
ord10
StrToIntExW
StrToIntW
PathBuildRootW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
DisableThreadLibraryCalls
LoadStringW
GetModuleHandleExW
FreeLibrary
GetProcAddress
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

CreateMutexExW
OpenSemaphoreW
ReleaseMutex
WaitForSingleObject
CreateSemaphoreExW
WaitForSingleObjectEx
ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapSetInformation

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
OpenProcessToken
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

GetSystemDefaultLangID
FormatMessageW
GetLocaleInfoW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW
CompareStringOrdinal

api-ms-win-core-heap-l2-1-0

LocalReAlloc
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

GetFullPathNameW
GetDriveTypeW
FileTimeToLocalFileTime
SetFileAttributesW
DeleteFileW
FindClose
GetFileAttributesW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceW
GetLogicalDrives
CreateFileW
QueryDosDeviceW
GetVolumeInformationW
GetTempFileNameW

api-ms-win-security-base-l1-1-0

FreeSid
GetLengthSid
SetSecurityDescriptorDacl
AdjustTokenPrivileges
CreateWellKnownSid
InitializeSecurityDescriptor
GetAce
AddAccessAllowedAce
InitializeAcl
AllocateAndInitializeSid
CopySid

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW
LookupPrivilegeValueW
LookupAccountSidW

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetVersionExW
GetTickCount
GetSystemInfo

api-ms-win-core-registry-l1-1-0

RegFlushKey
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegLoadKeyW
RegQueryValueExW
RegSetKeySecurity
RegUnLoadKeyW
RegCloseKey
RegSetValueExW

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc
CoGetMalloc
CoCreateInstance
CoInitializeSecurity
CoTaskMemFree
CoUninitialize

api-ms-win-core-wow64-l1-1-0

Wow64EnableWow64FsRedirection

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetDateFormatW

userenv

ord209
DeleteProfileW
ord202

api-ms-win-core-file-l1-2-4

GetTempPath2W

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize

rpcrt4

UuidCompare

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

setupapi

pSetupDoesUserHavePrivilege
pSetupIsUserAdmin

profapi

ord104

bcd

BcdOpenSystemStore
BcdOpenObject
BcdSetElementData
BcdCloseObject
BcdCloseStore
BcdGetElementData

advapi32

RegEnumKeyW
RegSaveKeyW
GetUserNameW

comdlg32

GetOpenFileNameW

gdi32

GetStockObject
SelectObject
GetTextExtentPoint32W
CreateFontIndirectW
GetObjectW

imagehlp

UnMapAndLoad
MapAndLoad

kernel32

GetComputerNameW
GlobalLock
GlobalUnlock
GetPrivateProfileStringW
lstrlenW
lstrcmpW
GlobalAddAtomW
GlobalDeleteAtom
GetUserDefaultUILanguage
GlobalReAlloc

ntdll

NtSetSystemInformation
NtQuerySystemInformation
NtCreatePagingFile
RtlInitUnicodeStringEx
RtlAdjustPrivilege
RtlSetSystemBootStatus
RtlGetSystemBootStatus
RtlCopySid
RtlLengthSid
NtQueryInformationToken
RtlFreeUnicodeString
RtlInitUnicodeString
RtlConvertSidToUnicodeString
WinSqmAddToStream

ole32

ReleaseStgMedium
CoInitialize

user32

SetProcessDPIAware
SendNotifyMessageW
GetFocus
MessageBeep
IsWindowEnabled
GetSystemMetrics
SendDlgItemMessageW
GetClientRect
GetWindowTextW
SetDlgItemTextW
PostMessageW
EndDialog
IsDlgButtonChecked
CheckDlgButton
SetWindowTextW
EnableWindow
SetWindowLongPtrW
GetDlgItem
DestroyIcon
SetFocus
GetDlgItemTextW
GetParent
SendMessageW
DialogBoxParamW
CreateWindowExW
UnregisterClassW
SwitchToThisWindow
GetLastActivePopup
RemovePropW
DestroyWindow
LoadIconW
ShowCursor
MapDialogRect
GetMessagePos
ShowWindow
CheckRadioButton
GetWindowRect
MapWindowPoints
SetWindowPos
SetTimer
MessageBoxW
GetDC
ReleaseDC
SetCursor
LoadCursorW
ScreenToClient
GetWindowLongPtrW
RegisterClipboardFormatW
EnumChildWindows
BeginDeferWindowPos
EndDeferWindowPos
GetClassNameW
DefWindowProcW
GetWindow
InvalidateRect
DeferWindowPos
MoveWindow
RegisterClassW
SetDlgItemInt
GetDlgItemInt
FindWindowW
GetPropW
SetPropW

winsta

WinStationBroadcastSystemMessage

Exports

Exports

DisplaySYSDMCPL
EditEnvironmentVariables
EditUserProfiles
EnableExecuteProtectionSupportW
ModifyExecuteProtectionSupportW
NoExecuteAddFileOptOutList
NoExecuteAddFileOptOutListW
NoExecuteProcessExceptionW
NoExecuteRemoveFileOptOutList
NoExecuteRemoveFileOptOutListW

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 596B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 1234

Password: 1234

15057b690cb1d888378871bff752e116

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

advapi32

kernel32

gdi32

user32

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-path-l1-1-0

api-ms-win-downlevel-shlwapi-l1-1-0

comctl32

propsys

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 115KB

fothk Size: 4KB - Virtual size: 4KB

.rdata Size: 28KB - Virtual size: 25KB

.data Size: 4KB - Virtual size: 4KB

.pdata Size: 8KB - Virtual size: 5KB

.didat Size: 4KB - Virtual size: 56B

.rsrc Size: 232KB - Virtual size: 230KB

.reloc Size: 4KB - Virtual size: 884B

Password: 1234

0fa32a4be3e8cb048b355853743c6a52

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

d0:ef:7c:65:58:b7:d1:9a:72:56:05:b0:1b:96:13:88Certificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

7d:5a:eb:c8:72:2e:80:ff:84:50:12:3a:65:31:ce:e5:86:e7:63:43:f4:79:41:8c:98:ba:d0:4b:d7:59:3c:bbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

shell32

winhttp

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

ole32

oleaut32

oledlg

oleacc

.text
Size: 116KB - Virtual size: 115KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 28KB - Virtual size: 25KB

.data
Size: 4KB - Virtual size: 4KB

.pdata
Size: 8KB - Virtual size: 5KB

.didat
Size: 4KB - Virtual size: 56B

.rsrc
Size: 232KB - Virtual size: 230KB

.reloc
Size: 4KB - Virtual size: 884B

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

d0:ef:7c:65:58:b7:d1:9a:72:56:05:b0:1b:96:13:88
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

7d:5a:eb:c8:72:2e:80:ff:84:50:12:3a:65:31:ce:e5:86:e7:63:43:f4:79:41:8c:98:ba:d0:4b:d7:59:3c:bb
Signer

.text
Size: 3.7MB - Virtual size: 3.7MB

.rdata
Size: 497KB - Virtual size: 496KB

.data
Size: 67KB - Virtual size: 1.2MB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 721KB - Virtual size: 721KB

.text
Size: 284KB - Virtual size: 280KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 84KB - Virtual size: 83KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 20KB - Virtual size: 16KB

.didat
Size: 4KB - Virtual size: 728B

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 4KB - Virtual size: 1KB