2026-05-03_fcd21b2ef076be1179f57532244e5fe3_amadey_darkgate_elex_floxif_glassworm_hijackloader

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-03_fcd21b2ef076be1179f57532244e5fe3_amadey_darkgate_elex_floxif_glassworm_hijackloader
Size 25.4MB
Sample260503-31e8faas91
SHA256 be83aec9788281a34a757deb089036d9a943b11f6a994780d9b975b89895577a
MD5 fcd21b2ef076be1179f57532244e5fe3
SHA1 51221596c3b2c84509f1f9d3870aafd830d83c45
SHA512 f35c03df3f3f3b3da4bdf9ccc71ce49984150c9115b39d663223dcee8cba2cba6ce7e726dd56075150f2284c5bb0964dd3452d319a174c6b356e992626274ac9
SSDEEP 393216:Ma+zAGj0Tf/q9qCG0Oj89wW+/cGwiSOWNh9C2jkK/sUEggL6:Ma+zAguj8vYzSOGqKtEPL6
TLSH
T121479E323A05C23BE99101B1957C9F6F672C5E34072956C3F3D829AA6DF54D32B72A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-03_fcd21b2ef076be1179f57532244e5fe3_amadey_darkgate_elex_floxif_glassworm_hijackloader

File Explorer

2026-05-03_fcd21b2ef076be1179f57532244e5fe3_amadey_darkgate_elex_floxif_glassworm_hijackloader

.exe 25.4MB

2026-05-03_fcd21b2ef076be1179f57532244e5fe3_amadey_darkgate_elex_floxif_glassworm_hijackloader

IMPHASH 0136cda7e154a15685f809341612dddd
SHA256 be83aec9788281a34a757deb089036d9a943b11f6a994780d9b975b89895577a
MD5 fcd21b2ef076be1179f57532244e5fe3
SHA1 51221596c3b2c84509f1f9d3870aafd830d83c45
SHA512 f35c03df3f3f3b3da4bdf9ccc71ce49984150c9115b39d663223dcee8cba2cba6ce7e726dd56075150f2284c5bb0964dd3452d319a174c6b356e992626274ac9
SSDEEP 393216:Ma+zAGj0Tf/q9qCG0Oj89wW+/cGwiSOWNh9C2jkK/sUEggL6:Ma+zAguj8vYzSOGqKtEPL6
TLSH
T121479E323A05C23BE99101B1957C9F6F672C5E34072956C3F3D829AA6DF54D32B72A0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

40:d3:89:75:50:27:b3:41:d4:c2:2f:4a:21:23:23:b4:d0:46:b6:1a:80:5c:94:e7:af:52:1f:46:09:da:06:70

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=3876899,CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US,2.5.4.15=#131450726976617465206f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 30, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:1d:f3:14:e9:79:07:11:80:07:30:0a:3e:ad:c4:ec

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 5, 2023 - Oct 6, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

12286252

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BuildServer-Dev\3\work\code\branches\Release\Diablo III.pdb

user32

UpdateWindow SetWindowTextW GetWindowLongA SetWindowLongA ClientToScreen MonitorFromPoint OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetFocus GetKeyState GetAsyncKeyState UnregisterClassA SetWindowPos GetDesktopWindow EnumDisplayMonitors GetMonitorInfoA LoadImageA LoadCursorA LoadBitmapA FillRect AdjustWindowRectEx InvalidateRect EndPaint BeginPaint SetFocus IsIconic IsWindowVisible FlashWindowEx EnumThreadWindows GetCapture UpdateLayeredWindow RegisterClassExA SetCapture ReleaseCapture GetWindowRect GetCursorPos ScreenToClient WindowFromPoint ClipCursor PtInRect SystemParametersInfoA GetCursorInfo GetKeyboardLayoutList GetKeyboardLayout TranslateMessage DispatchMessageA PeekMessageA SendMessageA PostMessageA GetWindow CharNextA GetCaretBlinkTime DefWindowProcA GetForegroundWindow GetShellWindow GetWindowThreadProcessId GetActiveWindow MessageBoxA MessageBoxW ShowCursor GetSystemMetrics GetDC ReleaseDC GetClientRect CreateWindowExA DestroyWindow ShowWindow MoveWindow

kernel32

CreatePipe GetLogicalProcessorInformationEx ResetEvent AcquireSRWLockShared ReleaseSRWLockShared FormatMessageW MoveFileW RemoveDirectoryW FindNextFileW SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetThreadId CreateEventW CancelIoEx GetOverlappedResult PostQueuedCompletionStatus GetQueuedCompletionStatusEx CreateIoCompletionPort QueryFullProcessImageNameA GetVolumePathNameW MoveFileExW SetFileAttributesW GetFileAttributesExW GetFullPathNameW GetDriveTypeW OpenMutexW CreateMutexW FlushViewOfFile GetFileSize DeleteFileW GetFinalPathNameByHandleW IsProcessorFeaturePresent CreateMutexA ReleaseMutex GetSystemDirectoryW GlobalFree GetSystemDefaultLangID GetUserDefaultLangID GetTimeZoneInformation GetModuleHandleExW GetNativeSystemInfo IsWow64Process GetACP LocalAlloc IsDBCSLeadByteEx CompareStringA lstrlenA GlobalLock GlobalUnlock GlobalAlloc GetTimeFormatW FindResourceA SizeofResource LockResource LoadResource FreeResource SetPriorityClass GetCurrentDirectoryW SetCurrentDirectoryW K32GetProcessImageFileNameA GetSystemDefaultLCID GetLocaleInfoA QueryDosDeviceA GetLogicalDriveStringsA GetVersion GlobalMemoryStatusEx RemoveVectoredExceptionHandler AddVectoredExceptionHandler RaiseException GetDiskFreeSpaceA Module32NextW Module32FirstW Thread32Next Thread32First VerifyVersionInfoW GetComputerNameW IsBadStringPtrA IsBadWritePtr IsBadReadPtr lstrcpynA FormatMessageA LoadLibraryW GetModuleHandleW GetModuleFileNameW VirtualFree VirtualAlloc GetLocalTime GetThreadContext CreateProcessW SuspendThread OpenThread CreateThread TerminateProcess SetUnhandledExceptionFilter OutputDebugStringA IsDebuggerPresent GetFileAttributesW FindFirstFileW CreateFileW CreateDirectoryW RtlCaptureContext GetProcessAffinityMask GetSystemInfo Process32Next Process32First CreateToolhelp32Snapshot GetComputerNameA LoadLibraryA GetModuleFileNameA FreeLibrary GetProcessId GetExitCodeProcess GetCurrentProcessId GetProcessTimes GetTempFileNameA GetTempPathA CreateFileMappingA GlobalMemoryStatus UnmapViewOfFile MapViewOfFile CreateSemaphoreA CreateEventA ReleaseSemaphore SetEvent LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SystemTimeToFileTime FileTimeToSystemTime GetTickCount GetSystemTimeAsFileTime GetCurrentThread Sleep QueryPerformanceFrequency QueryPerformanceCounter FileTimeToLocalFileTime MoveFileA GetShortPathNameA LocalFree GetProcAddress GetModuleHandleA GetVersionExA GetCurrentProcess DeviceIoControl SetLastError GetVolumeInformationA GetCompressedFileSizeA WriteFile SetFileValidData SetFileTime SetFilePointerEx SetFilePointer SetFileAttributesA SetEndOfFile RemoveDirectoryA ReadFile GetFileSizeEx GetFileInformationByHandle DuplicateHandle CreateFileMappingW CreateSemaphoreExW CreateActCtxW GetFileAttributesExA GetFileAttributesA GetDiskFreeSpaceExA FlushFileBuffers FindNextFileA FindFirstFileA FindClose DeleteFileA CreateFileA CreateDirectoryA GetCurrentDirectoryA SetCurrentDirectoryA SetThreadAffinityMask VirtualQuery TlsFree TlsSetValue TlsGetValue TlsAlloc ActivateActCtx DeactivateActCtx ResumeThread GetThreadPriority SetThreadPriority OutputDebugStringW LoadLibraryExW GetSystemDirectoryA MoveFileExA GetEnvironmentVariableA SleepEx UnhandledExceptionFilter GetStartupInfoW InitializeSListHead FindResourceW EnumResourceNamesW LoadLibraryExA FindResourceExA CreateProcessA FindResourceExW GetCurrentThreadId WaitForSingleObject WideCharToMultiByte MultiByteToWideChar GetThreadLocale VerSetConditionMask DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError OpenProcess CloseHandle GetPriorityClass

msvcp140

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Random_device@std@@YAIXZ ?_Xbad_alloc@std@@YAXXZ

oleaut32

VariantCopy VariantInit SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound VariantClear SysStringLen SysFreeString SysAllocString

winhttp

WinHttpOpen WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCrackUrl WinHttpGetDefaultProxyConfiguration

vcruntime140

__current_exception _except_handler4_common _setjmp3 longjmp __RTDynamicCast wcsrchr memchr strrchr _purecall __std_exception_destroy __std_exception_copy memset memmove memcpy strstr strchr __CxxFrameHandler3 _CxxThrowException __std_terminate __current_exception_context

api-ms-win-crt-heap-l1-1-0

_aligned_malloc _aligned_realloc realloc free malloc _aligned_free _recalloc _set_new_mode calloc

api-ms-win-crt-string-l1-1-0

_strdup strnlen strcat_s strcpy_s isprint strncpy strpbrk strtok isalpha strspn strcspn strtok_s tolower isdigit wcsncat_s isspace isalnum _strnicmp _stricmp strncmp

api-ms-win-crt-stdio-l1-1-0

_wfopen_s ferror ftell _fileno putc getc fseek fread fflush feof _close fputc _read __stdio_common_vswprintf _write _wfopen __stdio_common_vsprintf _fseeki64 _open _lseeki64 fopen _set_fmode __stdio_common_vfprintf fwrite fclose fopen_s __p__commode fgets __stdio_common_vsscanf __acrt_iob_func fputs __stdio_common_vsnprintf_s __stdio_common_vsprintf_s

api-ms-win-crt-runtime-l1-1-0

abort _controlfp __sys_errlist _invalid_parameter_noinfo _beginthreadex _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _invalid_parameter_noinfo_noreturn _crt_atexit _cexit _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _initterm _wassert _initterm_e _exit _c_exit _register_thread_local_exe_atexit_callback strerror terminate _errno exit _controlfp_s _endthreadex __sys_nerr

api-ms-win-crt-filesystem-l1-1-0

_wfindnext64i32 _stat64 _access _findclose _fullpath _stat64i32 _wfindfirst64i32 _wunlink _wmkdir _unlink _splitpath_s _fstat64

api-ms-win-crt-convert-l1-1-0

wcstombs strtof strtod wcstombs_s strtol atol strtoll _strtoi64 strtoul atof _atoi64 atoi wcstoul _ultoa _itoa_s _strtoui64

api-ms-win-crt-utility-l1-1-0

qsort bsearch rand srand

api-ms-win-crt-time-l1-1-0

strftime _time64 _localtime64_s _gmtime64 _gmtime64_s clock

api-ms-win-crt-locale-l1-1-0

_configthreadlocale setlocale

api-ms-win-crt-math-l1-1-0

__libm_sse2_tanf _isnan ldexp __libm_sse2_asinf __libm_sse2_acosf _libm_sse2_cos_precise _libm_sse2_exp_precise __setusermatherr _libm_sse2_atan_precise _CIfmod _libm_sse2_log_precise _libm_sse2_pow_precise __libm_sse2_log __libm_sse2_sinf __libm_sse2_cosf _fdopen __libm_sse2_log10f __libm_sse2_expf _finite ceil __libm_sse2_logf _libm_sse2_sin_precise _libm_sse2_sqrt_precise __libm_sse2_powf __libm_sse2_log10 frexp __libm_sse2_pow floor

api-ms-win-crt-environment-l1-1-0

getenv _dupenv_s _wgetenv_s _wgetenv

api-ms-win-crt-multibyte-l1-1-0

_mbschr _mbsnbcpy _mbsnbcmp _mbspbrk _mbsnbcpy_s

ws2_32

select gethostname freeaddrinfo getaddrinfo WSAAddressToStringW WSASetLastError socket setsockopt send recv getsockopt getpeername ioctlsocket connect closesocket __WSAFDIsSet gethostbyname ntohl inet_addr WSACleanup WSASocketA WSAGetLastError accept htons ntohs WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent inet_ntop inet_pton WSAIoctl WSAConnect shutdown sendto recvfrom listen htonl getsockname bind WSAStartup

winmm

waveOutGetNumDevs waveInReset timeGetTime waveOutGetDevCapsW waveOutOpen waveOutClose waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite waveOutReset waveOutGetPosition waveInGetNumDevs waveInGetDevCapsW waveInOpen waveInClose waveInPrepareHeader waveInUnprepareHeader waveInAddBuffer waveInStart

msacm32

acmStreamSize acmStreamOpen acmFormatSuggest acmStreamUnprepareHeader acmStreamPrepareHeader acmStreamConvert

cuesdk_2015

CorsairGetLastError CorsairPerformProtocolHandshake CorsairGetLedPositions CorsairGetDeviceInfo CorsairSetLedsColors CorsairGetDeviceCount

d3d9

D3DPERF_BeginEvent D3DPERF_EndEvent Direct3DCreate9

gdi32

GetObjectA GdiSetBatchLimit CreateDCA ExtEscape SelectObject GetDeviceCaps GetDeviceGammaRamp SetDeviceGammaRamp GetStockObject GetDIBits GetClipBox DeleteObject BitBlt CreateSolidBrush CreateCompatibleDC DeleteDC

icuin57

?createInstance@NumberFormat@icu_57@@SAPAV12@ABVLocale@2@AAW4UErrorCode@@@Z ?createCurrencyInstance@NumberFormat@icu_57@@SAPAV12@ABVLocale@2@AAW4UErrorCode@@@Z ?format@NumberFormat@icu_57@@QBEAAVUnicodeString@2@HAAV32@@Z ?createDateInstance@DateFormat@icu_57@@SAPAV12@W4EStyle@12@ABVLocale@2@@Z ?format@DateFormat@icu_57@@QBEAAVUnicodeString@2@NAAV32@@Z ?format@NumberFormat@icu_57@@QBEAAVUnicodeString@2@NAAV32@@Z ?createDateTimeInstance@DateFormat@icu_57@@SAPAV12@W4EStyle@12@0ABVLocale@2@@Z ?format@NumberFormat@icu_57@@QBEAAVUnicodeString@2@_JAAV32@@Z ?createPercentInstance@NumberFormat@icu_57@@SAPAV12@ABVLocale@2@AAW4UErrorCode@@@Z ?getSymbol@DecimalFormatSymbols@icu_57@@QBE?AVUnicodeString@2@W4ENumberFormatSymbol@12@@Z ?createInstance@Collator@icu_57@@SAPAV12@ABVLocale@2@AAW4UErrorCode@@@Z ?getMaximumFractionDigits@NumberFormat@icu_57@@QBEHXZ

icuuc57

u_isalpha_57 u_init_57 ?getDynamicClassID@UnicodeString@icu_57@@UBEPAXXZ ?extractBetween@UnicodeString@icu_57@@UBEXHHAAV12@@Z ?handleReplaceBetween@UnicodeString@icu_57@@UAEXHHABV12@@Z ?copy@UnicodeString@icu_57@@UAEXHHH@Z ?hasMetaData@UnicodeString@icu_57@@UBECXZ ??0UnicodeString@icu_57@@QAE@PBD@Z u_setMemoryFunctions_57 ??0StringPiece@icu_57@@QAE@PBD@Z ?char32At@UnicodeString@icu_57@@QBEHH@Z ?length@UnicodeString@icu_57@@QBEHXZ ??4UnicodeString@icu_57@@QAEAAV01@ABV01@@Z ?toUpper@UnicodeString@icu_57@@QAEAAV12@XZ ?toLower@UnicodeString@icu_57@@QAEAAV12@XZ ?getTerminatedBuffer@UnicodeString@icu_57@@QAEPB_WXZ ??0UnicodeString@icu_57@@QAE@XZ ??0UnicodeString@icu_57@@QAE@H@Z ??1UnicodeString@icu_57@@UAE@XZ ?fromUTF8@UnicodeString@icu_57@@SA?AV12@ABVStringPiece@2@@Z ??0Locale@icu_57@@QAE@PBD000@Z ??1Locale@icu_57@@UAE@XZ ?setDefault@Locale@icu_57@@SAXABV12@AAW4UErrorCode@@@Z ??3UMemory@icu_57@@SAXPAX@Z ??0UnicodeString@icu_57@@QAE@PB_W@Z ?copyFrom@UnicodeString@icu_57@@AAEAAV12@ABV12@C@Z ?createWordInstance@BreakIterator@icu_57@@SAPAV12@ABVLocale@2@AAW4UErrorCode@@@Z ?createLineInstance@BreakIterator@icu_57@@SAPAV12@ABVLocale@2@AAW4UErrorCode@@@Z ?createCharacterInstance@BreakIterator@icu_57@@SAPAV12@ABVLocale@2@AAW4UErrorCode@@@Z ?createSentenceInstance@BreakIterator@icu_57@@SAPAV12@ABVLocale@2@AAW4UErrorCode@@@Z ?getChar32At@UnicodeString@icu_57@@MBEHH@Z ?getCharAt@UnicodeString@icu_57@@MBE_WH@Z ?getLength@UnicodeString@icu_57@@MBEHXZ ?clone@UnicodeString@icu_57@@UBEPAVReplaceable@2@XZ u_cleanup_57

imm32

ImmGetCompositionStringW ImmGetCandidateListA ImmGetCandidateListW ImmGetConversionStatus ImmSetConversionStatus ImmGetOpenStatus ImmGetCompositionStringA ImmAssociateContext ImmReleaseContext ImmGetContext ImmIsIME ImmGetIMEFileNameA ImmNotifyIME ImmGetDefaultIMEWnd

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

wininet

InternetCrackUrlA InternetCloseHandle InternetConnectA InternetReadFileExA InternetSetOptionA InternetSetStatusCallbackA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetSetCookieA InternetOpenA

crypt32

CertGetNameStringA CryptUnprotectData CryptProtectData CertNameToStrA CertFindExtension CertVerifyTimeValidity CertAddCertificateContextToStore CertFreeCertificateContext CertFreeCertificateChain CryptDecodeObjectEx CertOpenStore CertFindCertificateInStore CertCreateCertificateContext CertEnumCertificatesInStore CertGetIssuerCertificateFromStore CertFreeCertificateChainEngine CertCreateCertificateChainEngine PFXImportCertStore CryptQueryObject CryptStringToBinaryA CertVerifyCertificateChainPolicy CertGetCertificateChain CryptMemFree CertCloseStore CertGetCertificateContextProperty

advapi32

CryptGetHashParam AdjustTokenPrivileges GetTokenInformation GetFileSecurityA LookupPrivilegeValueA ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSecurityDescriptorToStringSecurityDescriptorA SetNamedSecurityInfoA DuplicateTokenEx GetUserNameW GetUserNameA RegCloseKey RegCreateKeyExA RegDeleteValueW RegOpenKeyExA RegQueryValueExA RegQueryInfoKeyA RegEnumKeyExA CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash OpenProcessToken RegGetValueW CryptAcquireContextA CryptGenRandom CryptReleaseContext CryptAcquireContextW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegSetValueExA

iphlpapi

GetAdaptersInfo

shell32

SHGetFolderPathW SHGetKnownFolderPath FindExecutableA SHGetFolderPathA CommandLineToArgvW ShellExecuteExA

ole32

CoInitializeEx CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize CoInitializeSecurity CLSIDFromString PropVariantClear CoCreateGuid CoTaskMemAlloc CoSetProxyBlanket

dbghelp

MiniDumpWriteDump

Name

.text

Size

15.5MB

Virtual Size

15.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

389KB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

stkresv

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

941KB

Virtual Size

940KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=34, id=259, version=34321,

count=12, id=260, version=34321,

count=6, id=260, version=30795,

count=40, id=261, version=34321,

count=4, id=257, version=34321,

count=256, id=260, version=34435,

count=12, id=253, version=34321,

count=15, id=260, version=33134,

count=4, id=257, productName=VS2015 UPD2 build 23918, version=23918,

count=2, id=261, version=30795,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=2, id=257, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=110, productName=VS2005 build 50727, version=50727,

count=27, id=264, version=34435,

count=21, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=870, id=1, productName=Unmarked objects,

count=41, id=257, version=30795,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=182, id=261, version=33811,

count=36, id=260, version=33811,

count=1547, id=261, version=34435,

count=1, id=256, version=34435,

count=1, id=255, version=34435,

count=1, id=151,

count=1, id=258, version=34435,