27062026_1732_26062026_Ad_MV_INO_HORIZON_NEW_SPARE_PARTS_DETAIL_pdf.rar
- SHA256 af0577103fdfb95c47376adb13417130d7a7fe1c146baa745fbb522671d72bf1
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27062026_1732_26062026_Ad_MV_INO_HORIZON_NEW_SPARE_PARTS_DETAIL_pdf.rar
Resource
win11-20260513-en
windows11-21h2-x64
36 signatures
900 seconds
General
- Target 27062026_1732_26062026_Ad_MV_INO_HORIZON_NEW_SPARE_PARTS_DETAIL_pdf.rar
- Size 2.0MB
- Sample260627-wcb3jsb171
- SHA256 af0577103fdfb95c47376adb13417130d7a7fe1c146baa745fbb522671d72bf1
- MD5 fff0a8ac40ab0eb6878d37eaabf0c5fd
- SHA1 a88489b26236aef151714361e7df1370841cc468
- SHA512 1bb560cd6a2a87d5f4985ecc82ef4411fcab6949a7324669b502de432e05275cb299f83bfacbe716e9dedec71fcbd2268b8fe7550e65ddb7da9459a3b476c2a2
- SSDEEP 49152:9cdqX5TNAWiU0R06IU7I5py7BoPPeor7wuAfWJWYodHKb9yeiKR:9cdUHARFyOo463eor7wuAfWQfHKJNR
- TLSH T11EA533C37AB743BC9AC189567234F054A8B67AC2EC4DAEF4C97CA0C7565D708F629093
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Secur32.dll
File Explorer
-
27062026_1732_26062026_Ad_MV_INO_HORIZON_NEW_SPARE_PARTS_DETAIL_pdf.rar.rar 2.0MB
-
Ad_MV_INO_HORIZON_NEW_SPARE_PARTS_DETAIL_pdf.exe.exe 3.9MB
-
Secur32.dll.dll 1.8MB
Ad_MV_INO_HORIZON_NEW_SPARE_PARTS_DETAIL_pdf.exe
- IMPHASH d9d34563397ee789da1d5a65d773d1f6
- SHA256 1fae7d654695f7c4e0f4bb8a42a4c33137652effc360b998708c6ffcac1380e6
- MD5 bf62f6760a9b86f66822fa59140aef8b
- SHA1 a71dc7dff873a5341ee93a254fa43e61f85298de
- SHA512 f47af18705dfd6beec15109c227ca614dd314ce7a5dc4c19b10fc5388d07cd5990e5ea09128235cd88b595eef91a7c0e63e091bf8fc9947479f3d5d8167d9d31
- SSDEEP 49152:eYqEK9Q8jm5Uzq0LYxjvOPg+BgAiyg8xK90g/u8KwQ61PwST3:lwQD0LYxjvWa3mz8NB3
- TLSH T1A1168C17F68903F9C09AC1749B579162F626BC2A2B3562DF364CB2141F7AEE04B7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
92:71:18:20:b8:a3:40:cb:56:e3:c2:38:24:80:ad:3a:7c:c5:86:50:2a:95:dc:34:21:2e:69:f8:05:b4:06:70
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jun 6, 2026
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 8, 2024 - Apr 10, 2027
Minor OS version
0
Major OS version
10
Entry point
1588800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
platform_experience_helper.exe.pdb
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoOriginateErrorW
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
api-ms-win-core-winrt-l1-1-0
RoActivateInstance
RoGetActivationFactory
RoInitialize
RoRegisterActivationFactories
RoRevokeActivationFactories
RoUninitialize
propsys
InitPropVariantFromCLSID
secur32
GetUserNameExW
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
advapi32
BuildExplicitAccessWithNameW
BuildSecurityDescriptorW
BuildTrusteeWithSidW
CheckTokenMembership
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
CreateProcessAsUserW
GetLengthSid
GetNamedSecurityInfoW
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetTokenInformation
IsValidAcl
IsValidSecurityDescriptor
IsValidSid
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegSetKeyValueW
RegSetValueExW
SetEntriesInAclW
SetNamedSecurityInfoW
SetSecurityInfo
dbghelp
SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymGetModuleInfo64
SymGetSearchPathW
SymInitialize
SymSetOptions
SymSetSearchPathW
oleaut32
SysAllocString
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VariantClear
shell32
CommandLineToArgvW
SHChangeNotify
SHGetFolderPathW
SHGetKnownFolderPath
ShellExecuteExW
ShellExecuteW
shlwapi
PathMatchSpecW
user32
AllowSetForegroundWindow
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EnumWindows
GetActiveWindow
GetAncestor
GetClassNameW
GetDesktopWindow
GetQueueStatus
GetWindowLongW
GetWindowThreadProcessId
KillTimer
LoadStringW
MsgWaitForMultipleObjectsEx
PeekMessageW
PostMessageW
PostQuitMessage
RegisterClassExW
SetTimer
TranslateMessage
UnregisterClassW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
kernel32
AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
AllocConsole
AssignProcessToJobObject
AttachConsole
CloseHandle
CompareStringW
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileW
CreateIoCompletionPort
CreateNamedPipeW
CreateProcessW
CreateThread
DecodePointer
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DiscardVirtualMemory
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameExW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLogicalProcessorInformation
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessId
GetProcessTimes
GetProductInfo
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemTimePreciseAsFileTime
GetTempPathW
GetThreadContext
GetThreadId
GetThreadPriority
GetThreadPriorityBoost
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetUserGeoID
GetVersionExW
GetWindowsDirectoryW
GlobalMemoryStatusEx
HeapLock
HeapUnlock
HeapWalk
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSListHead
InitializeSRWLock
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32GetModuleFileNameExW
K32GetModuleInformation
K32QueryWorkingSetEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalFree
LockFileEx
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadDirectoryChangesW
ReadFile
ReleaseSRWLockExclusive
ReleaseSRWLockShared
RemoveDirectoryW
RemoveVectoredExceptionHandler
ReplaceFileW
ResetEvent
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetHandleInformation
SetInformationJobObject
SetLastError
SetNamedPipeHandleState
SetStdHandle
SetThreadInformation
SetThreadPriority
SetThreadPriorityBoost
SetThreadUILanguage
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SleepEx
SuspendThread
SwitchToThread
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransactNamedPipe
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnlockFileEx
UnmapViewOfFile
UnregisterWaitEx
UpdateProcThreadAttribute
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WerRegisterRuntimeExceptionModule
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrcmpiW
ole32
CoAddRefServerProcess
CoCreateInstance
CoInitializeEx
CoRegisterClassObject
CoRegisterInitializeSpy
CoReleaseServerProcess
CoResumeClassObjects
CoRevokeClassObject
CoRevokeInitializeSpy
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
PropVariantClear
StringFromCLSID
ntdll
NtClose
NtOpenKeyEx
NtQueryValueKey
RtlFormatCurrentUserKeyPath
RtlFreeUnicodeString
RtlInitUnicodeString
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
GetHandleVerifier
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
72KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1024B
Virtual Size
681B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
CPADinfo
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
LZMADEC
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
malloc_h
Size
512B
Virtual Size
265B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
240KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Secur32.dll
- IMPHASH aa9e5f3289c008633fc13295f031eac0
- SHA256 1bfc8230e6e1ae0e4f3eb00d46d1f2ff3806e66cce2400978a08e484ac20c220
- MD5 97987f0485fd47bb07f1bc082564123f
- SHA1 60ae01afe8c28b3b2c66b5da07b99b0d520ff1d0
- SHA512 3c45402f5262b0525803e901ccfa79a85c6040b6bb08db48d8425ab1fd15294c9ef31807abe239998fee894c7b93be076cb0963a63d33a5d35b567e3b0675a32
- SSDEEP 49152:a5V+ehwm1rZVfnAlsDoUr2MlA1rkOPQye3+N4:+ZQjUr2MlA1rkOPQye3+N4
- TLSH T14695AE57F3C825E9D527CA388705A233D1B2B9524FB6E0CB1A9AD3461E77A914F3B700
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
395668
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
bcrypt
BCryptGenRandom
kernel32
EncodePointer
FlsFree
GetStdHandle
RaiseFailFastException
GetTickCount64
GetCurrentProcess
GetCurrentThread
Sleep
DeleteCriticalSection
LocalFree
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
QueryPerformanceCounter
InitializeCriticalSection
InitializeConditionVariable
WaitForMultipleObjectsEx
GetLastError
QueryPerformanceFrequency
LocalAlloc
GetConsoleOutputCP
WideCharToMultiByte
SetLastError
GetModuleFileNameW
DuplicateHandle
GetThreadPriority
WriteFile
GetCurrentProcessorNumberEx
CloseHandle
SetEvent
CreateEventExW
GetEnvironmentVariableW
FormatMessageW
GetModuleHandleW
FlushProcessWriteBuffers
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
CreateThread
GetCurrentThreadId
SetThreadPriority
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
VirtualQuery
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
ResetEvent
DebugBreak
WaitForSingleObject
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
ole32
CoInitializeEx
CoWaitForMultipleHandles
CoGetApartmentType
CoUninitialize
api-ms-win-crt-math-l1-1-0
ceil
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
calloc
api-ms-win-crt-string-l1-1-0
strlen
_stricmp
strcpy_s
strcmp
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_initialize_narrow_environment
abort
terminate
_execute_onexit_table
_register_onexit_function
_cexit
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_crt_atexit
1UlWOpuXAcOldAMYNjBIepIWvHYLBU4
1kg8IziAGNZdBdKSIvJ
2DZ5tqxVT
2RqKcEsVC27grYG94wAMwshX5ci
2m6rdC7E7nGGojKq
3Dk4wDRUIg28mQ4yNza2cgLb
3YBBOZazmSJuDiZowhXyVpgQrK
3fMcA22itkNYcPGX4NVQ6IVPmdXY
6cHgyo3YSjpu810ijIzgF
7lLWrqW7Km2w6D7V2uIyuJSZSSAXQg8p
9OYqXaET2hgUjqjyDyUrsygg
AcceptSecurityContext
AcquireCredentialsHandleA
AcquireCredentialsHandleW
AddCredentialsA
AddCredentialsW
AddSecurityPackageA
AddSecurityPackageW
ApplyControlToken
CKxATpH1ihgSxe1UH5EAcMeL1R3tgEe6
CallNtPowerInformation
ChangeAccountPasswordA
ChangeAccountPasswordW
CompleteAuthToken
CredMarshalTargetInfo
CredUnmarshalTargetInfo
DecryptMessage
DeleteSecurityContext
DeleteSecurityPackageA
DeleteSecurityPackageW
EQ5agsxGEfHBg6dYYZPmzg
EcQSZD53KAozX2cOm78
EncryptMessage
EnumerateSecurityPackagesA
EnumerateSecurityPackagesW
ExportSecurityContext
FreeContextBuffer
FreeCredentialsHandle
GcoAFpygcFEgoXS
GetComputerObjectNameA
GetComputerObjectNameW
GetSecurityUserInfo
GetUserNameExA
GetUserNameExW
HCfhEIrCYLd
ICSYjnZRAUbsRapFeVQHVYvjt4pMd6
IeUasaah2EOJqTwyH7OjXxtV6N55M
ImpersonateSecurityContext
ImportSecurityContextA
ImportSecurityContextW
InitSecurityInterfaceA
InitSecurityInterfaceW
InitializeSecurityContextA
InitializeSecurityContextW
IvsXV5WDrqNF
JlsOvkTkMvfT5eM
LiRG8Ng
LkBT7bS9w5Y5Te1Uz
LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaEnumerateLogonSessions
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaLogonUser
LsaLookupAuthenticationPackage
LsaRegisterLogonProcess
LsaRegisterPolicyChangeNotification
LsaUnregisterPolicyChangeNotification
MEflsJdlMWl
MFV1v9bu2q9WY0FDP9Z5hJyZ8eb3
MakeSignature
NCZPgLOfALrtpPmKTKdK0k8dery2B4Z9
NnwY0ukfsUN
P7HzVR7Fuqf
PowerGetActiveScheme
PowerReadACValue
PowerWriteACValueIndex
PqElC8qKNoOvm5EQij5TUkwanBSW6da
QueryContextAttributesA
QueryContextAttributesW
QueryCredentialsAttributesA
QueryCredentialsAttributesW
QuerySecurityContextToken
QuerySecurityPackageInfoA
QuerySecurityPackageInfoW
QxVh1ItbM
R7Z5Qhmyy6x1XC7C7n88qr
RevertSecurityContext
S71cOumepo2szmfScdy
SaslAcceptSecurityContext
SaslEnumerateProfilesA
SaslEnumerateProfilesW
SaslGetContextOption
SaslGetProfilePackageA
SaslGetProfilePackageW
SaslIdentifyPackageA
SaslIdentifyPackageW
SaslInitializeSecurityContextA
SaslInitializeSecurityContextW
SaslSetContextOption
SealMessage
SeciAllocateAndSetCallFlags
SeciAllocateAndSetIPAddress
SeciFreeCallContext
SecpFreeMemory
SecpTranslateName
SecpTranslateNameEx
SetContextAttributesA
SetContextAttributesW
SetCredentialsAttributesA
SetCredentialsAttributesW
Sjxp1dv
SspiCompareAuthIdentities
SspiCopyAuthIdentity
SspiDecryptAuthIdentity
SspiEncodeAuthIdentityAsStrings
SspiEncodeStringsAsAuthIdentity
SspiEncryptAuthIdentity
SspiExcludePackage
SspiFreeAuthIdentity
SspiGetTargetHostName
SspiIsAuthIdentityEncrypted
SspiLocalFree
SspiMarshalAuthIdentity
SspiPrepareForCredRead
SspiPrepareForCredWrite
SspiUnmarshalAuthIdentity
SspiValidateAuthIdentity
SspiZeroAuthIdentity
ThvnacV6GL2
TranslateNameA
TranslateNameW
U1unahCl7gsJ
UWlK6QN0sitbv3
UeGxVG2ZHRQyBDoMNhsFoGRPV
UnsealMessage
UvbAAyhFArro3CYe
Uyz8XJwn8I4CTa8TrxUWGJUzZBhwTH
VerifySignature
VwjwG0AaBya4cEeuumd
WwbYyqIslFlLpxb77rzTGbf
WykZ5wJeUnxgGH8hmqqt
X49HRoPRq1V5rM8mL7evAH5hTn1r
X7LZgmULfuAUdgd
YAq7O5Fb
Z6OEvS8OIFOMQ0
ZV51JyS4ckyL
aL0LGW3N9XYnT85JBXD59ARL7kVXrFy
b1nBJ2PiyyGI9k33ml
b8zyNKbmrB
bUuXtyJ
bXJPmIcVmlb22
bXnlbphBG0jr3cnlwpBjaNbPSbVg7xl
bjZtY6h6Ww4adZOZIGamTUFIUFX
cZJZuHgTbaSv2moHzu
dhkvbH2oyjyvZYhPwntXJ
h829UrMVUPBgiLOguc5G7vc
hYEbw73RL8848ivyAlz1W1PYx
hm0loQhWl3waz1u2BQj1h287JQkqp
hwffZg2BIYAD68PVTYjCsjbI
i1K0rHjkfej
iUfhXmRKNXgFzyDyKELV75GPShjoTi
jcs3e7oA
jf6VmrG
lSXv9UB9H2SSWWt4
lx8EfjRYOregweaGK4Jl76NwD8fFGl5G
lxAs6OpgpI63FExKv1
mKlB07e8fkGZXfVkriYtKWTU
mkSSIlz6n3wR53jcKw5dFeFMUy8
nFOHHtR
ntfu7cgE3npslFJBbZXaWq0ZIoq
olxWn3KBESnhvh
omElIiz5f0KxGgB0PU
on6ECIhn7cxp
ouzuiVMH6OhAV514m61mzbqXLXg
qipMOBDb90HU1uK33qfm6
qoPVIbVuPUeQFF
s5n3ty7rc
sNmssoHr4Y3qFtqg1UamK
sX0DhtV
tfobSacaLA
uGdV58xZkUd6
uSWTDeDVliXiMl99eRoLLJx3
uq6aQbMl5
v9J8RON1kUhaPPKveAwwaghAA2eM
x7WBTUY57nzK
Name
.text
Size
403KB
Virtual Size
403KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.managed
Size
470KB
Virtual Size
470KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
hydrated
Size
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
361KB
Virtual Size
360KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
561KB
Virtual Size
560KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ