Zoom.zip
- SHA256 7bf819dc7d0055249384ee5e5428c5dc9bc9569cb1ba9af768f0d279fcb1a3ad
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OLEACC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
OLEACC.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Zoom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral4
Sample
Zoom.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target Zoom.zip
- Size 20.3MB
- Sample260730-w3l1fade93
- SHA256 7bf819dc7d0055249384ee5e5428c5dc9bc9569cb1ba9af768f0d279fcb1a3ad
- MD5 6e13ea5b65b6ab23f3f5764c3b26733f
- SHA1 cea991c21f35e7043451a75e7c09f9e827bbe65c
- SHA512 e71deb862c1179d91949828c15b739daced116ce819c4ba3ff131735da8b7f5bb42f734b9f014997b200bb9cad7668679d5efdb394c0d3350cac3645ec988729
- SSDEEP 393216:HNO4IG6ugB3+unzg6VJEeiv+68f5wyN5RsB9shwoOrFYHS4/:HNO5teOzgtRv+68fu6oBehYx07/
- TLSH T1CD2733098DF39A7D5623BF22990FDDA345729A09A128FF706D8670E8C1034E576EC9F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/OLEACC.dll
File Explorer
-
Zoom.zip.zip 20.3MB
-
OLEACC.dll.dll 31.1MB
-
Zoom.exe.exe 1.1MB
OLEACC.dll
- IMPHASH 5e3a1a67fd666f238caa24461c9f60bf
- SHA256 2f87e21dd5282a862e6940f4c069dc2c6fb2f0463fae069b93556841e7596874
- MD5 1a295589ee0a14d514ee209bb1490697
- SHA1 582d942b39bfd460f84ad10a4f1105eb3323e8ef
- SHA512 43757f14a12164df711074b99f112d9c564734b62b150bf3c25674a97eac753516b86bbc5b959d75901c89112f0ae26f0140ad91b8e1123e495e13372434d5c5
- SSDEEP 786432:YZmrYVCYvrvCDzwPZ/z9LArZaOVK7f45bdsylVMIBgign+QUGOf4L:ymsVCYDkehA1aOI45XAogign+Q
- TLSH T15E67F02DCE3E0A554DB635E88CCF17C7A888479906209EA75B7E8C66631463FB0E353D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
41392
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WindowsProject932_D0748518.pdb
kernel32
GetCurrentProcess
ExitProcess
SwitchToThread
GetCurrentThreadId
SetThreadPriority
ResumeThread
Sleep
GetModuleFileNameW
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
WriteConsoleW
QueryPerformanceCounter
DisableThreadLibraryCalls
CloseHandle
CreateFileW
SetFilePointerEx
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
RtlLookupFunctionEntry
InterlockedFlushSList
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
IsProcessorFeaturePresent
HeapAlloc
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualProtect
LoadLibraryExW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
advapi32
OpenProcessToken
GetTokenInformation
shell32
ShellExecuteExW
ShellExecuteW
ole32
CoUninitialize
CoInitializeEx
AccessibleObjectFromWindow
BindingModenZkI
ExtendedEyAPUR
FetchSettingFinishedvTDT
GetDescriptionCollectionpFq
LayoutAbEOd
LresultFromObject
ShowqUVzYz
StackedLogsJP
TooltipTicketsEgj
Name
.text$x
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata$x
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data$xx
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc$01
Size
30.9MB
Virtual Size
30.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=265, version=29110,
count=63, id=2, version=30729,
count=118, id=2, version=30729,
count=9, id=271, version=31100,
count=8, id=266, version=29910,
count=1, id=267, version=30148,
count=14, id=261, productName=VS2017 v15.3 build 25506, version=25506,
count=62, id=4,
count=97, id=270, version=30700,
count=7, id=272, version=34200,
count=65, id=270, version=30700,
count=102, id=265, version=29110,
count=106, id=270, version=30700,
count=99, id=265, version=29110,
Zoom.exe
- IMPHASH 3a476fe428e6caaa89c60f740cd721b8
- SHA256 200530e9d02952df9a70807bdc37c438b56a7cb4250d5b0ca5357a8c8df1344b
- MD5 0a7cb25c01b348a50c0c61e20232b8bd
- SHA1 2d01dba7e2266c2089de04e8642e79c7f0f4d3ea
- SHA512 20afef399502a6960065699486e3ffe4cca8c40a462cc06209e720c499a57cc6f0233fcbe650674a6b867ed9821cf426181f1964117d59044b35e1a4d11aca4f
- SSDEEP 24576:KG5EIkLhLj9sYwyj5r19d+cyULD34pdkRCPn1sLCV:KcEIEsyujUuiRqq
- TLSH T1D8457C8A93A401FCD4F7E274D8766A03DA76FCA90770569B0291338A7F3B5A0CE79711
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5a:51:6b:3a:65:18:f2:c7:97:3f:96:6c:6d:aa:74:b7:d0:dd:a8:ef
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=4969967,CN=Zoom Communications\, Inc.,O=Zoom Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
May 18, 2026
SERIALNUMBER=4969967,CN=Zoom Communications\, Inc.,O=Zoom Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=4969967,CN=Zoom Communications\, Inc.,O=Zoom Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=4969967,CN=Zoom Communications\, Inc.,O=Zoom Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
5d:c2:d7:49:38:a7:51:69:76:96:19:02:be:77:a0:0c:29:96:36:7f:4f:22:81:0e:20:93:d5:1f:34:b8:59:4c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=4969967,CN=Zoom Communications\, Inc.,O=Zoom Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
May 18, 2026
SERIALNUMBER=4969967,CN=Zoom Communications\, Inc.,O=Zoom Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=4969967,CN=Zoom Communications\, Inc.,O=Zoom Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=4969967,CN=Zoom Communications\, Inc.,O=Zoom Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 13, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2021 - Jul 27, 2036
Subject
SERIALNUMBER=4969967,CN=Zoom Communications\, Inc.,O=Zoom Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
08:2c:f5:ec:5a:2e:c3:82:32:ed:17:fb:6c:17:2e:9d
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 15, 2026 - Jul 14, 2026
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
2
Major OS version
5
Entry point
567776
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\jenkins\workspace\Client.den\Client\Windows\release\Bin\x64\Release\NewInstaller.pdb
psapi
GetModuleFileNameExW
EnumProcesses
GetModuleBaseNameW
GetProcessImageFileNameW
EnumProcessModules
shlwapi
PathFileExistsW
PathRemoveFileSpecW
StrCmpNIW
PathAddBackslashW
PathIsRelativeW
PathIsURLW
PathAppendW
PathIsNetworkPathW
PathUnquoteSpacesW
PathAppendA
ord2
PathIsUNCW
UrlUnescapeW
PathFileExistsA
StrStrIA
PathRemoveBackslashW
PathIsPrefixW
oleacc
LresultFromObject
AccessibleObjectFromWindow
kernel32
OpenProcess
IsBadReadPtr
IsBadWritePtr
FindFirstFileW
HeapFree
FindNextFileW
WriteFile
ExpandEnvironmentStringsW
DeviceIoControl
RemoveDirectoryW
K32GetModuleFileNameExW
SetFilePointer
GetTempPathW
CreateToolhelp32Snapshot
Process32NextW
CreateFileA
Process32FirstW
LoadLibraryW
HeapAlloc
MoveFileExW
VerSetConditionMask
GetProcessHeap
VerifyVersionInfoW
GetTempFileNameW
MoveFileW
LoadLibraryExW
CopyFileW
Sleep
GetTickCount64
OutputDebugStringW
SetDllDirectoryW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LocalFree
CreateMutexW
OpenMutexW
ReadFile
TerminateProcess
QueryFullProcessImageNameW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
SetFilePointerEx
GetFileType
GetFullPathNameW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
GetStartupInfoW
FlsAlloc
FlsGetValue
GetModuleFileNameW
FlsFree
VirtualProtect
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetFileSizeEx
GetTimeZoneInformation
SetStdHandle
SetEndOfFile
HeapReAlloc
GetDriveTypeW
ExitProcess
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
WriteConsoleW
GetCurrentDirectoryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
HeapSize
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
InitializeSListHead
FormatMessageA
EncodePointer
LCMapStringEx
RtlUnwindEx
RtlUnwind
RtlPcToFileHeader
GlobalAlloc
GlobalFree
GetFinalPathNameByHandleW
GetModuleFileNameA
GetTempPathA
GetFileAttributesA
GetBinaryTypeA
ProcessIdToSessionId
MoveFileExA
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcessTimes
K32GetProcessImageFileNameW
VirtualQuery
QueryDosDeviceW
GetEnvironmentVariableW
LoadLibraryA
GetSystemDirectoryA
LoadLibraryExA
ExpandEnvironmentStringsA
TlsFree
TlsAlloc
GetTickCount
DosDateTimeToFileTime
TlsGetValue
FreeLibrary
LocalFileTimeToFileTime
SetFileAttributesW
SetFileTime
SetLastError
TlsSetValue
CreateDirectoryW
MulDiv
GetSystemDirectoryW
MapViewOfFile
CreateFileMappingW
GetFileSize
UnmapViewOfFile
CreateFileW
CreateDirectoryA
WideCharToMultiByte
GetWindowsDirectoryA
DeleteFileW
MultiByteToWideChar
GetModuleHandleA
GetVersionExW
FindClose
OutputDebugStringA
IsBadStringPtrW
GetCurrentProcess
FindFirstFileA
lstrlenW
GetCurrentProcessId
GetLocalTime
GetCurrentThreadId
GetModuleHandleW
CreateProcessW
DeleteCriticalSection
GetProcAddress
DecodePointer
RaiseException
CloseHandle
GetFileAttributesW
WaitForSingleObject
InitializeCriticalSectionEx
GetLastError
FindFirstFileExW
GetCommandLineA
GetCommandLineW
InitOnceBeginInitialize
InitOnceComplete
GetFileAttributesExW
GetFileInformationByHandleEx
GetSystemInfo
FlsSetValue
GetWindowsDirectoryW
user32
InflateRect
OffsetRect
wvsprintfW
GetWindowTextLengthW
NotifyWinEvent
GetWindowThreadProcessId
IsWindow
ClientToScreen
PtInRect
GetAncestor
GetWindowTextW
SendMessageW
UnregisterClassW
SetRect
GetSysColor
IntersectRect
CopyRect
SetCursor
LoadCursorW
ShowWindow
EnumWindows
IsWindowVisible
LoadBitmapW
EndPaint
BeginPaint
ReleaseDC
InvalidateRect
ReleaseCapture
GetParent
SystemParametersInfoW
GetClientRect
SetCapture
GetUpdateRect
SetFocus
SetWindowPos
GetDC
GetFocus
GetWindowRect
GetKeyState
DrawEdge
DrawTextW
IsRectEmpty
CharNextW
LoadStringW
FillRect
TranslateMessage
DispatchMessageW
GetMessageW
FindWindowW
EnableMenuItem
PostQuitMessage
MessageBoxW
PostMessageW
GetMenuState
GetSystemMenu
LoadIconW
SetTimer
RegisterClassExW
GetSystemMetrics
SendMessageTimeoutW
DefWindowProcW
DestroyWindow
GetWindowLongPtrW
CreateWindowExW
gdi32
GetStockObject
BitBlt
TextOutW
GetTextExtentPoint32W
LineTo
CreatePen
Rectangle
GetObjectW
MoveToEx
CreateSolidBrush
GetTextMetricsW
CreateFontIndirectW
RoundRect
SelectObject
GetClipBox
CreateRectRgnIndirect
SetTextColor
SetBkMode
ExtSelectClipRgn
CreateCompatibleBitmap
SaveDC
CreateCompatibleDC
RestoreDC
SetBkColor
ExtTextOutW
SelectClipRgn
DeleteDC
GetObjectType
DeleteObject
advapi32
CheckTokenMembership
GetUserNameW
RegUnLoadKeyW
RegLoadKeyW
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
RegEnumValueW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegDeleteKeyW
RegEnumKeyExW
RegCreateKeyExW
AllocateAndInitializeSid
FreeSid
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
DuplicateTokenEx
shell32
ShellExecuteExW
SHGetSpecialFolderPathA
SHGetFolderPathW
SHGetSpecialFolderPathW
SHChangeNotify
SHFileOperationW
SHGetFolderPathA
SHParseDisplayName
SHOpenFolderAndSelectItems
ShellExecuteW
SHGetKnownFolderPath
ole32
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoTaskMemFree
CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket
PropVariantClear
oleaut32
SysStringLen
SysAllocString
VarBstrCat
SysFreeString
VariantClear
VariantInit
VariantChangeType
SysAllocStringLen
Name
.text
Size
652KB
Virtual Size
652KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
198KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
246KB
Virtual Size
245KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=262, version=33140,
count=1, id=261, version=30159,
count=1, id=260, version=30159,
count=23, id=257, version=33140,
count=408, id=1, productName=Unmarked objects,
count=2, id=253, version=28518,
count=97, id=261, version=30034,
count=18, id=260, version=30034,
count=8, id=259, version=30034,
count=198, id=261, version=33140,
count=1, productName=Unmarked objects (old),
count=13, id=259, version=33140,
count=31, id=260, version=33140,
count=59, id=265, version=30159,
count=1, id=255, version=30159,
count=1, id=151,
count=1, id=258, version=30159,