2026-07-06_d4da3ad4d3c5bcda844f7b3093afd212_akira_avaddon_cobalt-strike_coinminer_glassworm_icedid_megazord_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_d4da3ad4d3c5bcda844f7b3093afd212_akira_avaddon_cobalt-strike_coinminer_glassworm_icedid_megazord_njrat_satacom_stealc_vidar
Size 35.9MB
Sample260707-a2drsaew6s
SHA256 dfbcba5f563a300c0ef8ea15dbfc6fd43b88cda57d0cd208b60add7bb7cfb13f
MD5 d4da3ad4d3c5bcda844f7b3093afd212
SHA1 6af7f1a20ca6107841441e60029c00d1e60d250c
SHA512 da08466863ccfb4b5f2c35276dc9fb834162119259848b39866384d5bdcc12ac25c3ba3e5abee6e6ce2c9d688ad8d55a3d929a718e3f7b558fc5ae37c54a5c14
SSDEEP 393216:IV5sZIDzgCn3A79TxtlePIAMTBnmcXfQtFXHFN5:IV5sZIDzgYwhxt7AMEcX4tFXHF/
TLSH
T1BC876C1536E904A9D07EC4B487864651DAB13CD6073AEADB00D1A17D2F3EEF92F79A30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

File Explorer

2026-07-06_d4da3ad4d3c5bcda844f7b3093afd212_akira_avaddon_cobalt-strike_coinminer_glassworm_icedid_megazord_njrat_satacom_stealc_vidar

.exe 35.9MB

2026-07-06_d4da3ad4d3c5bcda844f7b3093afd212_akira_avaddon_cobalt-strike_coinminer_glassworm_icedid_megazord_njrat_satacom_stealc_vidar

IMPHASH 33fa0ccc5194397f9013735966c4d32b
SHA256 dfbcba5f563a300c0ef8ea15dbfc6fd43b88cda57d0cd208b60add7bb7cfb13f
MD5 d4da3ad4d3c5bcda844f7b3093afd212
SHA1 6af7f1a20ca6107841441e60029c00d1e60d250c
SHA512 da08466863ccfb4b5f2c35276dc9fb834162119259848b39866384d5bdcc12ac25c3ba3e5abee6e6ce2c9d688ad8d55a3d929a718e3f7b558fc5ae37c54a5c14
SSDEEP 393216:IV5sZIDzgCn3A79TxtlePIAMTBnmcXfQtFXHFN5:IV5sZIDzgYwhxt7AMEcX4tFXHF/
TLSH
T1BC876C1536E904A9D07EC4B487864651DAB13CD6073AEADB00D1A17D2F3EEF92F79A30
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Digest

d7:c6:b5:97:03:5d:2a:10:4d:87:56:c8:12:3e:4b:81:ab:a0:2c:1f:07:6b:e5:f3:27:d1:43:88:5f:68:17:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1125476195459,CN=Atom Security LLC,O=Atom Security LLC,STREET=Kutateladze st\, 4G office 340,L=Novosibirsk,ST=Novosibirskaya oblast,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13154e6f766f7369626972736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 8, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

6f:1b:fb:6e:c5:c8:7f:2c:46:7b:f5:4a

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 4, 2024 - Nov 10, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

24065960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\GitLab-Runner\builds\dtadoVtT\0\windows\windows-agent\.build\agent_x64\relwithdebinfo64\vmnetdrv64.pdb

advapi32

GetLengthSid OpenServiceW StartServiceCtrlDispatcherW RegOpenKeyExW InitializeAcl InitializeSecurityDescriptor AddAce RegSetValueExW IsValidSid GetSecurityDescriptorOwner InitializeSid CopySid GetSecurityDescriptorControl RegCreateKeyExW GetSidLengthRequired GetSidSubAuthority GetSecurityDescriptorGroup OpenSCManagerW CloseServiceHandle GetAclInformation RegCloseKey GetSecurityDescriptorDacl SetSecurityDescriptorDacl GetSecurityDescriptorSacl CryptGenRandom CryptAcquireContextW GetTokenInformation MakeSelfRelativeSD QueryServiceStatusEx LookupAccountSidW OpenThreadToken GetSecurityDescriptorLength DuplicateTokenEx QueryServiceConfigW CreateProcessAsUserW OpenProcessToken ConvertStringSidToSidW SetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW GetNamedSecurityInfoW SetNamedSecurityInfoW GetAce RegDeleteValueW RegQueryValueExW DuplicateToken SetThreadToken ConvertSidToStringSidW CreateWellKnownSid RegGetValueW RegLoadMUIStringW RegQueryInfoKeyW RegNotifyChangeKeyValue CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash RegDisablePredefinedCache IsValidSecurityDescriptor GetSidIdentifierAuthority CryptAcquireContextA RegEnumKeyW RegOpenKeyW SystemFunction036 CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey ReportEventW RegisterEventSourceW DeregisterEventSource GetSidSubAuthorityCount IsTextUnicode RegDeleteKeyW RegisterServiceCtrlHandlerExW CreateServiceW QueryServiceStatus SetServiceStatus ChangeServiceConfig2W DeleteService ControlService EnumDependentServicesW StartServiceW ChangeServiceConfigW RegEnumValueW RegEnumKeyExW MakeAbsoluteSD

gdi32

GetObjectW DeleteEnhMetaFile CopyEnhMetaFileW SetStretchBltMode GetDIBits StretchBlt CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt CreateFontW CreateSolidBrush SetBkColor GetDeviceCaps SetDIBColorTable CreateDIBSection DeleteDC DeleteObject GetEnhMetaFileBits SetTextColor

kernel32

GetFileSize GlobalMemoryStatusEx FreeLibrary SystemTimeToTzSpecificLocalTime CreateFileMappingW CreateIoCompletionPort MapViewOfFileEx OpenThread LoadLibraryExW IsDebuggerPresent ConnectNamedPipe FlushFileBuffers GetExitCodeProcess FindFirstFileW FindNextFileW FindClose QueryDosDeviceW GetVolumeInformationW GetLogicalDrives FindFirstVolumeW lstrlenW DeviceIoControl SetEndOfFile FindVolumeClose FindNextVolumeW GetDriveTypeW CreateDirectoryW GetTempPathW GetDiskFreeSpaceW MoveFileExW CopyFileW VerSetConditionMask VerifyVersionInfoW OpenProcess SetWaitableTimer CreateWaitableTimerW WaitForMultipleObjectsEx CancelWaitableTimer GetProcessTimes GlobalSize GlobalAlloc GlobalFree GlobalLock GlobalUnlock CancelIoEx GetOverlappedResult GetFileSizeEx CreateToolhelp32Snapshot Process32NextW Process32FirstW GetFullPathNameW GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW GetProcessId Thread32Next Thread32First DuplicateHandle GetSystemDirectoryW AttachConsole FreeConsole GetComputerNameW SystemTimeToFileTime TlsAlloc QueueUserAPC TlsFree GetThreadId TlsSetValue InitializeCriticalSectionAndSpinCount GetModuleHandleA SleepEx TlsGetValue RegisterWaitForSingleObject UnregisterWaitEx GetFileAttributesExW GetLocaleInfoW GetUserDefaultLCID MulDiv GetVersionExW GetSystemTime GetSystemWow64DirectoryW WaitNamedPipeW UnlockFileEx LockFileEx CreateDirectoryA RemoveDirectoryA ReplaceFileA GetFileAttributesExA MoveFileA CompareStringA SwitchToThread GetLocalTime ResetEvent UnlockFile GetTimeZoneInformationForYear GetDriveTypeA WriteConsoleW CreateThread ExitProcess CopyFileExW GetFinalPathNameByHandleW CreateHardLinkW CreateSymbolicLinkW GetFileInformationByHandleEx CreateMutexA QueryPerformanceFrequency WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW SetFilePointerEx SetFileInformationByHandle GetCommandLineW GetEnvironmentStringsW RtlLookupFunctionEntry RtlCaptureContext SetThreadStackGuarantee FreeEnvironmentStringsW AcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive TryAcquireSRWLockExclusive ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode LoadLibraryW LoadLibraryA ConvertThreadToFiber ConvertFiberToThread GetFileType GetEnvironmentVariableW GetStdHandle RtlVirtualUnwind CreateFiber DeleteFiber SwitchToFiber GetComputerNameA FindNextFileA FindFirstFileA GetCurrentDirectoryW DeleteFileA FindFirstFileExW WTSGetActiveConsoleSessionId GetComputerNameExW GetTempFileNameW SetFileAttributesW GetFileAttributesW GetFileInformationByHandle MapViewOfFile SetUnhandledExceptionFilter QueryPerformanceCounter K32GetModuleInformation K32GetModuleBaseNameW K32GetModuleFileNameExA RtlCaptureStackBackTrace GetModuleHandleExW GetACP GetSystemDefaultLCID GetOEMCP GetDateFormatW CreateSemaphoreW GetTimeFormatW FileTimeToLocalFileTime OpenEventW K32EnumProcesses K32GetModuleFileNameExW HeapSetInformation GetSystemInfo GetThreadPriority WaitForSingleObjectEx GetCurrentThread FileTimeToSystemTime SetEvent GetTimeZoneInformation CreateEventW DisconnectNamedPipe UnmapViewOfFile ResumeThread ReleaseMutex CreateFileW CreateMutexW EnumResourceNamesW GetQueuedCompletionStatus SetThreadPriority WaitForMultipleObjects CreateNamedPipeW GetModuleFileNameW RemoveDirectoryW TerminateProcess GetCurrentProcess SetLastError HeapCreate TryEnterCriticalSection ReadFile GetTickCount GetSystemTimeAsFileTime WideCharToMultiByte GetModuleHandleW GetProcessHeap GetCurrentProcessId DeleteCriticalSection LocalFree GetProcAddress HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW RaiseException CloseHandle HeapReAlloc DeleteFileW LockResource TerminateThread OutputDebugStringA GetLastError FormatMessageW Sleep ProcessIdToSessionId GetExitCodeThread MultiByteToWideChar InitializeCriticalSection QueryFullProcessImageNameW GetConsoleScreenBufferInfo WriteConsoleInputW GetNumberOfConsoleInputEvents ReadConsoleOutputCharacterW PostQueuedCompletionStatus HeapSize GetCurrentThreadId LocalAlloc WaitForSingleObject InitializeCriticalSectionEx SetFilePointer SetErrorMode LeaveCriticalSection SetEnvironmentVariableW ExpandEnvironmentStringsW WriteFile EnterCriticalSection SetConsoleCtrlHandler SetConsoleScreenBufferSize GetLargestConsoleWindowSize ReadConsoleInputW SetConsoleCursorPosition GenerateConsoleCtrlEvent SetStdHandle IsValidCodePage EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetCommandLineA GetConsoleOutputCP FreeLibraryAndExitThread ExitThread RtlUnwind RtlUnwindEx GetStartupInfoW UnhandledExceptionFilter GetLocaleInfoEx GetCPInfo CompareStringEx HeapFree SizeofResource FormatMessageA GetConsoleProcessList WriteConsoleOutputCharacterW K32GetProcessImageFileNameW AreFileApisANSI LockFile GetFullPathNameA HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile CreateFileA GetVersionExA HeapCompact CreateFileMappingA VirtualFree VirtualAlloc IsProcessorFeaturePresent SetThreadAffinityMask ReleaseSemaphore lstrcmpW FindFirstFileExA lstrlenA GetTempFileNameA GetSystemDirectoryA MoveFileExA CompareFileTime GetEnvironmentVariableA LCMapStringEx GetStringTypeW GetNativeSystemInfo InitOnceBeginInitialize InitOnceComplete CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns SleepConditionVariableCS InitializeConditionVariable InitializeSRWLock RtlPcToFileHeader FlushInstructionCache PeekNamedPipe VirtualProtect VirtualQuery LoadLibraryExA EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList

ole32

CreatePointerMoniker CoCreateGuid CoFreeUnusedLibraries CoTaskMemAlloc WriteClassStg CoUninitialize CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx StringFromGUID2 CoTaskMemFree CLSIDFromString CreateBindCtx CoInitialize OleGetClipboard ReleaseStgMedium OleUninitialize PropVariantClear OleInitialize StgCreateDocfile

oleaut32

VariantInit VariantChangeType SysAllocString VariantClear SysFreeString

user32

GetWindowRect DestroyWindow SetWindowPos MonitorFromWindow SetWindowLongPtrW SetWindowTextW GetMonitorInfoW SetDlgItemTextW MapWindowPoints GetProcessWindowStation GetCursorPos SetForegroundWindow GetClassInfoExW KillTimer AppendMenuW LoadIconW TranslateMessage DestroyMenu GetWindow SetTimer DispatchMessageW LoadStringW TrackPopupMenu RegisterClassExW GetWindowLongPtrW SetThreadDesktop CloseDesktop OpenInputDesktop GetClientRect PostQuitMessage GetParent RegisterDeviceNotificationW UnregisterDeviceNotification CreatePopupMenu CreateWindowExW PostMessageW DefWindowProcW GetWindowLongW EnumChildWindows DestroyIcon UnregisterClassW GetUserObjectInformationW MessageBoxW GetAncestor DdeAccessData DdeUnaccessData DdeCreateStringHandleW DdeConnect DdeGetLastError DdeInitializeW DdeClientTransaction DdeFreeDataHandle DdeDisconnect DdeFreeStringHandle RedrawWindow GetDlgCtrlID GetSysColor SetWindowLongW SetDlgItemInt ExitWindowsEx MessageBeep FlashWindow SetFocus SetCapture GetDesktopWindow GetDlgItem CreateDialogParamW IsDialogMessageW GetClassLongPtrW EnumWindows VkKeyScanExW MapVirtualKeyW keybd_event LoadKeyboardLayoutW mouse_event SendInput GetDC GetIconInfo GetCursorInfo DrawIconEx ReleaseDC CharLowerBuffW FindWindowExW SendMessageW IsIconic GetKeyboardLayoutNameW GetKeyboardLayoutList ActivateKeyboardLayout GetKeyState GetFocus MsgWaitForMultipleObjects WindowFromPoint GetClassNameW GetGUIThreadInfo GetKeyboardLayout MapVirtualKeyExW ToUnicodeEx GetKeyNameTextW PostThreadMessageW SetWinEventHook UnhookWinEvent GetWindowThreadProcessId RegisterClipboardFormatW CallWindowProcW GetClipboardOwner CopyImage GetPriorityClipboardFormat OpenClipboard CloseClipboard EmptyClipboard GetClipboardData LoadCursorW GetClipboardSequenceNumber SetClipboardData ShowWindow RegisterClassW SetLayeredWindowAttributes BeginPaint EndPaint EnumDisplayMonitors GetSystemMetrics EnumThreadWindows InvalidateRect GetLastInputInfo CallNextHookEx PostThreadMessageA PeekMessageW MsgWaitForMultipleObjectsEx UnhookWindowsHookEx SetWindowsHookExW GetWindowTextLengthW IsWindowVisible IsWindow GetForegroundWindow SystemParametersInfoW GetWindowTextW GetMessageW DdeUninitialize

winspool.drv

SetPrinterW FindFirstPrinterChangeNotification GetJobW EnumPrintProcessorDatatypesW FreePrinterNotifyInfo EnumJobsW SetJobW ClosePrinter GetPrinterW FindClosePrinterChangeNotification FindNextPrinterChangeNotification EnumPrintersW OpenPrinterW

ws2_32

__WSAFDIsSet accept bind WSAIoctl closesocket gethostname WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent sendto getnameinfo freeaddrinfo getaddrinfo inet_addr socket recvfrom recv send inet_ntoa WSAStartup WSACleanup WSAAddressToStringW ntohs htonl WSAGetLastError setsockopt ioctlsocket htons getsockopt WSARecv getservbyname connect getsockname getpeername WSASocketW WSAStringToAddressW WSASetLastError listen shutdown ntohl select gethostbyname WSASend

iphlpapi

GetAdaptersAddresses GetTcpTable

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

dbghelp

ImageNtHeader MiniDumpWriteDump

wldap32

ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord46 ord217 ord143 ord211

nspr4

PR_Init PR_Cleanup PR_ErrorToString PR_GetError

nss3

PORT_ZAlloc PK11_GetInternalKeySlot CERT_DestroyName CERT_AsciiToName NSS_Initialize CERT_GetCommonName PK11_FreeSlot PK11_ImportCert CERT_DestroyCertificate CERT_GetDefaultCertDB PK11_FindCertFromDERCert CERT_DecodeTrustString CERT_GetOrgName PORT_Free CERT_ChangeCertTrust NSS_Shutdown NSS_NoDB_Init

smime3

CERT_DecodeCertFromPackage

shlwapi

StrCmpIW UrlEscapeA PathRemoveExtensionW PathCombineW StrToInt64ExA SHDeleteKeyW PathStripPathA PathRemoveFileSpecW PathFileExistsW PathStripPathW PathMatchSpecW StrStrIW StrToIntA PathAddExtensionW SHCreateStreamOnFileEx ord219 PathFindFileNameW PathIsUNCW PathFindExtensionW PathAppendW PathIsDirectoryW

userenv

CreateEnvironmentBlock ExpandEnvironmentStringsForUserW UnloadUserProfile DestroyEnvironmentBlock

gdiplus

GdipDisposeImage GdipGetImageEncodersSize GdipCreateBitmapFromScan0 GdipSaveImageToFile GdiplusStartup GdipGetImagePixelFormat GdipGetImageEncoders GdipGetImageHeight GdipCreateBitmapFromHBITMAP GdipDeleteBrush GdipAlloc GdipSetSmoothingMode GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateFontFamilyFromName GdipCreateFont GdipSetInterpolationMode GdipCreateSolidFill GdipGetImageWidth GdipImageRotateFlip GdipDeleteFontFamily GdiplusShutdown GdipTranslateWorldTransform GdipDeleteFont GdipDeleteGraphics GdipMeasureString GdipRotateWorldTransform GdipCreateFromHDC GdipDrawString GdipFree GdipGraphicsClear GdipCloneImage

pdh

PdhCollectQueryData PdhOpenQueryW PdhCloseQuery PdhAddCounterW PdhLookupPerfNameByIndexW PdhGetRawCounterValue PdhGetFormattedCounterValue PdhRemoveCounter

setupapi

SetupDiDestroyDeviceInfoList CM_Enable_DevNode CM_Get_Device_ID_ExW CM_Get_Sibling CM_Get_Device_ID_Size_Ex CM_Get_Child SetupDiEnumDeviceInterfaces CM_Disable_DevNode SetupDiGetClassDevsW CM_Get_DevNode_Status CMP_WaitNoPendingInstallEvents CM_Get_Parent_Ex SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW CM_Get_Parent CM_Get_DevNode_Registry_Property_ExW SetupDiGetDeviceInterfaceDetailW

fltlib

FilterLoad FilterVolumeFindClose FilterConnectCommunicationPort FilterSendMessage FilterUnload FilterReplyMessage FilterGetDosName FilterVolumeFindFirst FilterVolumeFindNext FilterGetMessage

activeds

ord9

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSLogoffSession WTSQueryUserToken WTSQuerySessionInformationW

oleacc

AccessibleChildren AccessibleObjectFromWindow

powrprof

CallNtPowerInformation

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrust

secur32

LsaGetLogonSessionData LsaFreeReturnBuffer

netapi32

DsRoleGetPrimaryDomainInformation DsRoleFreeMemory DsGetDcNameW NetApiBufferFree NetUserEnum NetWkstaGetInfo

crypt32

CertGetCertificateChain CertEnumCertificatesInStore CertCloseStore CertOpenStore CertNameToStrW CryptHashPublicKeyInfo CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertFreeCertificateChain CertFreeCertificateChainEngine CertAddEncodedCertificateToStore CertCreateCertificateChainEngine CryptQueryObject CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage PFXImportCertStore CryptStringToBinaryA CertGetNameStringA CryptBinaryToStringA CertFindCertificateInStore

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider

Name

.text

Size

25.4MB

Virtual Size

25.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

514KB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

202KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=23, id=259, version=27412,

count=233, id=261, version=27412,

count=20, id=260, version=30034,

count=12, id=259, version=30034,

count=16, id=253, version=28518,

count=124, id=261, version=30034,

count=6, id=257, version=27034,

count=47, id=261, version=30159,

count=117, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=198, productName=Unmarked objects (old),

count=560, id=260, version=27049,

count=53, id=260, version=30159,

count=2, id=263, version=27412,

count=40, id=260, version=27412,

count=5, id=262, version=27412,

count=59, id=257, version=27412,

count=918, id=1, productName=Unmarked objects,

count=599, id=265, version=30159,

count=1, id=256, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,