Desktop[.]rar | Triage™

resource	yara_rule
static1/unpack001/loader (1).exe	themida

resource
unpack001/kernel.exe
unpack001/loader (1).exe
unpack001/plugins/DotNetTools.dll
unpack001/plugins/ExtendedNotifications.dll
unpack001/plugins/ExtendedServices.dll
unpack001/plugins/ExtendedTools.dll
unpack001/plugins/HardwareDevices.dll
unpack001/plugins/NetworkTools.dll
unpack001/plugins/OnlineChecks.dll
unpack001/plugins/Updater.dll
unpack001/plugins/UserNotes.dll
unpack001/plugins/WindowExplorer.dll

Desktop.rar

SHA256 c1900b82387f1d064e5dc23497a9b70fda6db6bf3a26677226728f1c380d3002
MD5 aea3384f45bba03ce14939cfea28a383
SHA1 fae5623a1885a4ecf5811ce9bafef763487622df
SHA512 017581b22fc02328dd15b8885fff8876971b58f9467efdf14ee3226b638b5a867ef0b2fced2a25c21fa1496f04786ef6c8434fa53cff7d8c83e3c660492b3acd
SSDEEP 393216:dDWphrSdB4PzPQitpJL7RFl0YUW7jJfblCEZGvKnne3KQgCFki0hQ:QfKB4PzPQitj7l0ypTlCEwvKniKQgQke
TLSH
T14E07335B8E4490AD429042728FC7E31CA5C3AA709CD5382FE7BA66FCD0C6F41626775E
MD5 SHA1 SHA512 SSDEEP TLSH

kernel.exe

IMPHASH 4de81561a6767f641e9052fbafa700e6
SHA256 1fe5f30491b91749040831195d2a4985d08196ea7eea6a25c645cc416c19f358
MD5 4dc7600c9dde0e2917e1553fa61077f5
SHA1 0c3f38293b59fa84f2ecaf546a79ed4459f6c18e
SHA512 e92072805c4942cd9b14087361a7c2cc43850a86e8b67077e658a04569d07b62471dbced53b11e94cd0627b6d3989395a55ca0d9b40d71b2b36aa78849c170b0
SSDEEP 49152:8q3Xof2ivuk8hNWBWDaGP0xrjEbgpp1jZntHzr/o1O7NcvB2/Oi+oaTLa+:PQTr/oASxTZ
TLSH
T1FBF57D03A2E740E9D5B7D778CAA78522EA713C555B308AFF01A0C4692F73ED15E39722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

2141056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel.pdb

comctl32

ord345 InitCommonControlsEx CreatePropertySheetPageW ImageList_CoCreateInstance ord381 PropertySheetW

ntdll

RtlAddAccessAllowedAce RtlGetAce NtIsProcessInJob NtQuerySystemInformationEx RtlRegisterWait RtlDeregisterWaitEx NtAcceptConnectPort NtReplyWaitReceivePort NtCreatePort RtlValidAcl RtlValidRelativeSecurityDescriptor RtlSelfRelativeToAbsoluteSD2 NtConnectPort NtRequestWaitReplyPort RtlAbsoluteToSelfRelativeSD RtlQueryElevationFlags NtDeleteKey NtReleaseSemaphore NtSetHighEventPair NtQueryEvent NtQuerySemaphore RtlCreateAcl NtPulseEvent NtSetLowEventPair NtQueryTimer NtResetEvent RtlIpv6AddressToStringExW RtlIpv4AddressToStringExW RtlInterlockedPushEntrySList NtTerminateProcess RtlCreateHeap RtlFreeHeap RtlAllocateHeap RtlDestroyHeap RtlCreateQueryDebugBuffer RtlQueryProcessDebugInformation RtlDestroyQueryDebugBuffer NtSetSystemInformation RtlSetCurrentDirectory_U NtAdjustPrivilegesToken NtSystemDebugControl NtTerminateJobObject NtAssignProcessToJobObject RtlExitUserProcess NtSuspendThread RtlUpcaseUnicodeChar NtQueryInformationProcess NtRemoveProcessDebug RtlCreateSecurityDescriptor RtlGetDaclSecurityDescriptor NtSetEventBoostPriority NtTestAlert NtPowerInformation NtSetInformationToken NtFreeVirtualMemory NtCancelTimer NtQueryMutant NtQueryVolumeInformationFile NtQuerySection LdrLoadAlternateResourceModule RtlNtStatusToDosErrorNoTeb NtCreateProcessEx RtlTimeFieldsToTime RtlGUIDFromString NtDuplicateToken RtlRandomEx RtlTimeToTimeFields RtlCreateProcessReflection RtlGetFullPathName_UEx LdrUnloadAlternateResourceModule RtlFindMessage RtlStringFromGUID RtlCreateProcessParameters NtQueryDefaultLocale RtlCreateUserProcess RtlExpandEnvironmentStrings_U RtlFirstEntrySList RtlQueryPerformanceFrequency RtlUnicodeToMultiByteN RtlDowncaseUnicodeChar RtlReAllocateHeap TpSimpleTryPost RtlUTF8ToUnicodeN RtlSizeHeap RtlMultiByteToUnicodeN RtlMultiByteToUnicodeSize RtlQueryPerformanceCounter RtlUnicodeToMultiByteSize RtlUnicodeToUTF8N RtlFindClearBitsAndSet RtlInterlockedPopEntrySList RtlGetVersion NtUnlockFile NtSetInformationFile NtLockFile NtFlushBuffersFile NtGetContextThread LdrGetProcedureAddress LdrUnloadDll LdrLoadDll NtQueryValueKey NtQueryKey NtOpenSymbolicLinkObject NtEnumerateKey NtGetNextProcess NtUnloadDriver NtEnumerateValueKey NtOpenKey RtlDosPathNameToNtPathName_U_WithStatus RtlConvertSidToUnicodeString NtQuerySymbolicLinkObject NtQueryInformationJobObject NtSetSecurityObject NtDeleteValueKey NtQueryAttributesFile NtDeviceIoControlFile NtOpenDirectoryObject RtlGetUnloadEventTraceEx NtFsControlFile NtCreateEvent NtQueryDirectoryObject NtSetSystemEnvironmentValueEx NtTraceControl NtQuerySystemEnvironmentValueEx NtLoadKeyEx NtCreateKey NtEnumerateSystemEnvironmentValuesEx NtCreateFile NtQueryDirectoryFile NtOpenSection NtQuerySecurityObject NtSetValueKey RtlQueryEnvironmentVariable NtQueryFullAttributesFile RtlGetSaclSecurityDescriptor NtOpenProcess NtUnlockVirtualMemory RtlInitializeBitMap RtlNumberOfSetBits NtOpenProcessToken NtAdjustGroupsToken NtOpenThreadToken NtQuerySecurityAttributesToken NtReleaseKeyedEvent NtWaitForKeyedEvent NtCreateKeyedEvent NtOpenThread RtlQueueApcWow64Thread NtTerminateThread NtQueueApcThreadEx NtQueryObject NtLoadDriver LdrFindResource_U NtOpenFile LdrAccessResource RtlLengthSecurityDescriptor RtlValidSecurityDescriptor NtSetInformationObject NtClearEvent NtCreateNamedPipeFile TpWaitForIoCompletion TpAllocIoCompletion TpReleasePool TpReleaseIoCompletion TpAllocPool TpSetPoolMinThreads TpCancelAsyncIoOperation TpStartAsyncIoOperation TpSetPoolMaxThreads NtCreateSemaphore RtlSetOwnerSecurityDescriptor RtlGetControlSecurityDescriptor RtlGetOwnerSecurityDescriptor RtlGetGroupSecurityDescriptor RtlSetControlSecurityDescriptor RtlSetGroupSecurityDescriptor NtSetTimer NtAlertThread NtCreateTimer RtlIpv4StringToAddressExW RtlIpv6StringToAddressExW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader NtQueryOpenSubKeysEx RtlInterlockedFlushSList RtlSetHeapInformation RtlInitializeCriticalSection RtlDeleteCriticalSection NtMapViewOfSection NtQueryInformationFile NtCreateSection RtlSecondsSince1970ToTime NtProtectVirtualMemory NtDelayExecution NtQueryVirtualMemory NtWriteVirtualMemory NtAllocateVirtualMemory NtGetNextThread NtSetInformationThread NtCreateThreadEx NtQuerySystemInformation NtQuerySystemTime RtlLeaveCriticalSection RtlEnterCriticalSection NtWaitForSingleObject NtWaitForMultipleObjects NtSetEvent NtAlpcQueryInformation NtReadVirtualMemory NtReadFile NtWriteFile NtQueryInformationThread NtSuspendProcess NtResumeThread NtSetInformationDebugObject NtUnmapViewOfSection RtlRaiseStatus NtSetInformationProcess NtShutdownSystem NtDuplicateObject NtInitiatePowerAction NtClose NtQueryInformationToken NtResumeProcess NtSetSystemPowerState

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

UnhandledExceptionFilter GetSystemTimeAsFileTime GetStartupInfoW EncodePointer WriteConsoleW RaiseException InitializeCriticalSectionAndSpinCount ReadFile GetConsoleMode ReadConsoleW WriteFile GetConsoleOutputCP CreateFileW GetFileType GetModuleFileNameW GetLastError WaitForSingleObject CreateRemoteThread GetTempPathW QueryPerformanceFrequency SetConsoleCtrlHandler SetConsoleCP GetConsoleWindow SetConsoleOutputCP AllocConsole SetUnhandledExceptionFilter LoadLibraryExW MultiByteToWideChar Sleep LocalFree SearchPathW GetTimeFormatEx GetLocaleInfoEx GetDateFormatEx GetNumberFormatEx FormatMessageW CreateProcessW SystemTimeToTzSpecificLocalTime TlsSetValue SetLastError TlsAlloc TlsGetValue TlsFree GlobalAlloc GlobalFree GlobalLock GlobalUnlock IsProcessorFeaturePresent FreeLibrary GetStdHandle FreeConsole LocalAlloc GlobalSize FindNextFileW FindFirstFileExW FindClose WideCharToMultiByte SetStdHandle GetOEMCP GetACP IsValidCodePage GetCPInfo HeapQueryInformation GetStringTypeW SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleHandleExW

user32

GetMenuItemInfoW GetWindowTextW EnumWindows IsWindow MessageBoxW SetWindowPos GetWindowThreadProcessId DialogBoxParamW GetDlgItemTextW SetDlgItemTextW SetWindowTextW GetWindowTextLengthW GetSysColorBrush DrawTextW GetSysColor FillRect MapWindowPoints GetWindowRect MapDialogRect SetFocus EnableMenuItem BringWindowToTop DeleteMenu GetSystemMenu EndPaint BeginPaint ReleaseDC GetDCEx GetAncestor DrawFrameControl GetClassInfoExW DrawEdge DrawIconEx SetWindowDisplayAffinity FrameRect TrackMouseEvent WindowFromDC GetCapture RegisterClassExW UnregisterClassW InvertRect GetDC GetMenu LoadImageW PostQuitMessage KillTimer SetCursor TranslateMessage IsDialogMessageW SetTimer DispatchMessageW GetMessageW TranslateAcceleratorW IsChild LoadAcceleratorsW SendMessageTimeoutW UpdateWindow OpenWindowStationW OpenDesktopW CreateMenu EndDeferWindowPos ChangeWindowMessageFilterEx IntersectRect SetMenu CloseDesktop BeginDeferWindowPos GetWindowPlacement CreateWindowExW CloseWindowStation GetWindow ShowWindowAsync DeferWindowPos MoveWindow GetMonitorInfoW IsHungAppWindow SetActiveWindow MonitorFromWindow MonitorFromPoint GetForegroundWindow GetDoubleClickTime CreateIconIndirect GetProcessWindowStation AllowSetForegroundWindow EnumDesktopsW SetWindowPlacement GetGUIThreadInfo PeekMessageW MsgWaitForMultipleObjects MonitorFromRect GetScrollBarInfo GetWindowDC SetMenuInfo GetIconInfo FindWindowExW SystemParametersInfoW CreateDialogIndirectParamW GetDesktopWindow LookupIconIdFromDirectoryEx IsClipboardFormatAvailable GetUserObjectInformationW SetClipboardData GetClipboardData LoadMenuIndirectW DialogBoxIndirectParamW InternalGetWindowText EmptyClipboard CloseClipboard GetWindowInfo OpenClipboard GetActiveWindow GetThreadDesktop GetShellWindow GetSystemMetrics GetGuiResources EnumChildWindows GetPropW CreateIconFromResourceEx DestroyMenu TrackPopupMenu CreatePopupMenu InsertMenuItemW ReleaseCapture SetCapture GetAsyncKeyState SetScrollPos ShowCaret EnableScrollBar DestroyCaret DragDetect CreateCaret SetCaretPos GetScrollInfo RegisterClipboardFormatW SetScrollInfo SetCursorPos ScrollWindowEx GetUpdateRect GetMessageTime DrawFocusRect InvalidateRgn WaitMessage MessageBeep GetMessagePos GetUpdateRgn ScreenToClient GetSubMenu RedrawWindow DestroyIcon ClientToScreen SetLayeredWindowAttributes FindWindowW GetClientRect InvalidateRect GetCursorPos GetClassNameW EndDialog IsWindowEnabled GetParent EnableWindow DefWindowProcW CallWindowProcW PostMessageW IsWindowVisible SetWindowLongPtrW GetWindowLongPtrW ExitWindowsEx LockWorkStation DestroyWindow SendMessageW ShowWindow GetDlgItem SetForegroundWindow IsIconic GetKeyState GetFocus GetMenuItemCount

gdi32

Rectangle GetDIBits TextOutW SetBoundsRect IntersectClipRect SetPixel GetDeviceCaps SaveDC CreateSolidBrush DeleteObject SetBkMode SetTextColor DeleteDC CreateCompatibleDC SelectObject CreateCompatibleBitmap GetClipRgn CreateFontIndirectW SetDCBrushColor GetTextColor GetPixel GetClipBox CreateFontW RectVisible GetTextExtentPoint32W GetObjectW SetBkColor GetStockObject GetTextMetricsW SetDCPenColor Polyline CreateDIBSection CombineRgn ExcludeClipRect Polygon CreateRectRgn PatBlt GdiAlphaBlend GetCharWidthW SelectClipRgn BitBlt RestoreDC

advapi32

OpenSCManagerW CreateProcessWithLogonW InitiateShutdownW QueryServiceObjectSecurity QueryServiceStatusEx OpenServiceW QueryServiceConfig2W ChangeServiceConfigW QueryServiceConfigW EnumServicesStatusExW StartServiceW EnumDependentServicesW ControlService SetServiceObjectSecurity DeleteService ChangeServiceConfig2W CloseServiceHandle LsaLookupPrivilegeName LsaEnumeratePrivileges LsaOpenPolicy LsaLookupNames2 LsaLookupPrivilegeDisplayName LsaLookupPrivilegeValue LsaFreeMemory LsaLookupSids LsaEnumerateAccounts GetInheritanceSourceW GetSecurityInfo SetSecurityInfo LsaQuerySecurityObject LsaSetSecurityObject GetEffectiveRightsFromAclW CreateProcessAsUserW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW CreateServiceW LsaAddAccountRights LsaClose LogonUserW

shell32

SHGetFolderPathW

ole32

CoTaskMemFree CoInitializeEx CoUninitialize

wininet

HttpAddRequestHeadersW InternetReadFile InternetConnectW InternetCloseHandle HttpSendRequestW InternetOpenW HttpOpenRequestW

KphAlpcQueryInformation KphDuplicateObject KphOpenDevice KphOpenDeviceBaseDevice KphOpenDeviceDriver KphQueryInformationDriver KphQueryInformationObject KsiEnumerateProcessHandles KsiLevel KsiQueryHashInformationFile PhAddElementAvlTree PhAddEntryHashtable PhAddEntryHashtableEx PhAddIListViewColumn PhAddIListViewGroup PhAddIListViewGroupItem PhAddIListViewItem PhAddItemArray PhAddItemList PhAddItemPointerList PhAddItemSimpleHashtable PhAddItemsArray PhAddItemsList PhAddJsonArrayObject PhAddJsonObject PhAddJsonObject2 PhAddJsonObjectInt64 PhAddJsonObjectUInt64 PhAddJsonObjectValue PhAddLayoutItem PhAddLayoutItemEx PhAddListViewColumn PhAddListViewGroup PhAddListViewGroupItem PhAddListViewItem PhAddPlusMaxMemorySingles PhAddProcessPropPage PhAddProcessPropPage2 PhAddPropPageLayoutItem PhAddSetting PhAddSettings PhAddTabControlTab PhAddTreeNewFilter PhAdjustPrivilege PhAdjustRectangleToBounds PhAdjustRectangleToWorkingArea PhAllocate PhAllocateExSafe PhAllocateFromFreeList PhAllocatePage PhAllocateSafe PhAppResolverGetAppIdForWindow PhAppendBytesBuilder PhAppendBytesBuilder2 PhAppendBytesBuilderEx PhAppendCharStringBuilder PhAppendCharStringBuilder2 PhAppendFormatStringBuilder PhAppendFormatStringBuilder_V PhAppendStringBuilderEx PhApplyTreeNewFilters PhApplyTreeNewFiltersToNode PhAutoDereferenceObject PhBitmapSetAlpha PhBoostProvider PhBufferToHexString PhBufferToHexStringEx PhCallKphQueryFileInformationWithTimeout PhCenterRectangle PhCenterWindow PhChangeServiceConfig2 PhChoiceDialog PhClearArray PhClearCacheDirectory PhClearCircularBuffer_FLOAT PhClearCircularBuffer_PVOID PhClearCircularBuffer_ULONG PhClearCircularBuffer_ULONG64 PhClearHashtable PhClearIgnoredSettings PhClearList PhCloseServiceHandle PhCmLoadSettings PhCmSaveSettings PhCompareObjects PhCompareStringRef PhCompareStringZNatural PhCompareUnicodeStringZIgnoreMenuPrefix PhConcatStringRef2 PhConcatStringRef3 PhConcatStringRef4 PhConcatStrings PhConcatStrings2 PhConcatStrings_V PhConnectPipe PhConsoleSetForeground PhConsoleSetWindow PhConvertIgnoredSettings PhConvertMultiByteToUtf16 PhConvertMultiByteToUtf16Ex PhConvertUtf16ToAsciiEx PhConvertUtf16ToMultiByte PhConvertUtf16ToMultiByteEx PhConvertUtf16ToUtf8 PhConvertUtf16ToUtf8Buffer PhConvertUtf16ToUtf8Ex PhConvertUtf16ToUtf8Size PhConvertUtf8ToUtf16 PhConvertUtf8ToUtf16Buffer PhConvertUtf8ToUtf16Ex PhConvertUtf8ToUtf16Size PhCopyBytesZ PhCopyCircularBuffer_FLOAT PhCopyCircularBuffer_PVOID PhCopyCircularBuffer_ULONG PhCopyCircularBuffer_ULONG64 PhCopyConvertCircularBufferULONG PhCopyIListView PhCopyListView PhCopyListViewInfoTip PhCopyStringZ PhCopyStringZFromBytes PhCopyStringZFromMultiByte PhCountStringZ PhCreateAlloc PhCreateBytes PhCreateBytesEx PhCreateCacheFile PhCreateCommonFont PhCreateDialog PhCreateDirectoryFullPathWin32 PhCreateDirectoryWin32 PhCreateEMenu PhCreateEMenuItem PhCreateEvent PhCreateFile PhCreateFileStream PhCreateFileStream2 PhCreateFileWin32 PhCreateFileWin32Ex PhCreateHandleItem PhCreateHashtable PhCreateIconTitleFont PhCreateJsonArray PhCreateJsonObject PhCreateJsonParser PhCreateJsonParserEx PhCreateKey PhCreateKsiSettingsBlob PhCreateList PhCreateNamedPipe PhCreateObject PhCreateObjectType PhCreateObjectTypeEx PhCreateOpenFileDialog PhCreatePipe PhCreatePointerList PhCreateProcess PhCreateProcessAsUser PhCreateProcessPropContext PhCreateProcessPropPageContext PhCreateProcessPropPageContextEx PhCreateProcessRedirection PhCreateProcessWin32 PhCreateProcessWin32Ex PhCreateSaveFileDialog PhCreateSearchControl PhCreateSecurityPage PhCreateServiceListControl PhCreateSimpleHashtable PhCreateString3 PhCreateStringEx PhCreateSymbolProvider PhCreateThread PhCreateThread2 PhCreateThreadEx PhCreateWindowEx PhCreateXmlNode PhCreateXmlOpaqueNode PhDecodeUnicodeDecoder PhDelayExecution PhDeleteArray PhDeleteAutoPool PhDeleteBytesBuilder PhDeleteCacheFile PhDeleteCallback PhDeleteCircularBuffer_FLOAT PhDeleteCircularBuffer_PVOID PhDeleteCircularBuffer_ULONG PhDeleteCircularBuffer_ULONG64 PhDeleteDirectoryWin32 PhDeleteFastLock PhDeleteFile PhDeleteFileWin32 PhDeleteFreeList PhDeleteGraphState PhDeleteImageVersionInfo PhDeleteLayoutManager PhDeleteMemoryItemList PhDeleteProviderThread PhDeleteStaticWindowIcon PhDeleteStringBuilder PhDeleteTreeNewColumnMenu PhDeleteTreeNewFilterSupport PhDeleteValueKey PhDeleteWorkQueue PhDereferenceObject PhDereferenceObjectDeferDelete PhDereferenceObjectEx PhDereferenceProcessRecord PhDeselectAllProcessNodes PhDeselectAllServiceNodes PhDestroyEMenu PhDestroyEMenuItem PhDestroyWindowIcon PhDestroyWindowRemote PhDetermineDosPathNameType PhDevFreeObjectProperties PhDevFreeObjects PhDevGetObjectProperties PhDevGetObjects PhDeviceIoControlFile PhDeviceProviderInitialization PhDialogBox PhDisconnectNamedPipe PhDivideSinglesBySingle PhDnsFree PhDnsQuery PhDnsQuery2 PhDnsReverseLookupNameFromAddress PhDoPropPageLayout PhDoesFileExist PhDoesFileExistWin32 PhDosErrorToNtStatus PhDosPathNameToNtPathName PhDrainAutoPool PhDrawGraphDirect PhDrawTrayIconText PhDuplicateBytesZ PhDuplicateBytesZSafe PhDuplicateFont PhDuplicateFontWithNewWeight PhDuplicateProcessInformation PhDuplicateProcessNodeList PhDuplicateStringZ PhEditSecurity PhEllipsisString PhEllipsisStringPath PhEncodeUnicode PhEnumAvlTree PhEnumBigPoolInformation PhEnumChildWindows PhEnumDependentServices PhEnumDeviceResources PhEnumDirectoryFile PhEnumDirectoryObjects PhEnumFileStreams PhEnumFirmwareEnvironmentValues PhEnumGenericModules PhEnumHandlesEx PhEnumHashtable PhEnumKernelModules PhEnumNetworkItems PhEnumNetworkItemsByProcessId PhEnumNextProcess PhEnumNextThread PhEnumObjectIdInformation PhEnumObjectTypes PhEnumPagefiles PhEnumPointerListEx PhEnumPoolTagInformation PhEnumProcessEnvironmentVariables PhEnumProcessItems PhEnumProcesses PhEnumProcessesEx PhEnumReparsePointInformation PhEnumSMBIOS PhEnumWindows PhEnumerateKey PhEnumeratePlugins PhEnumeratePrivileges PhEnumerateValueKey PhEqualStringRef PhEscapeCommandLinePart PhEscapeStringForMenuPrefix PhExecuteRunAsCommand2 PhExecuteRunAsCommand3 PhExpandAllProcessNodes PhExpandEnvironmentStrings PhExponentiate PhExponentiate64 PhExtractIcon PhExtractIconEx PhFileReadAllTextWin32 PhFillMemoryUlong PhFilterConnectCommunicationPort PhFinalBytesBuilderBytes PhFinalHash PhFinalStringBuilderString PhFindCharInStringRef PhFindEMenuItem PhFindElementAvlTree PhFindEntryHashtable PhFindIListViewItemByFlags PhFindItemList PhFindItemPointerList PhFindItemSimpleHashtable PhFindLastCharInStringRef PhFindListViewItemByFlags PhFindListViewItemByParam PhFindNetworkNode PhFindPlugin2 PhFindProcessInformation PhFindProcessInformationByImageName PhFindProcessNode PhFindProcessRecord PhFindServiceNode PhFindStringInStringRef PhFindXmlObject PhFlushFileStream PhFormat PhFormatBytes PhFormatBytes_V PhFormatDate PhFormatDateTime PhFormatDecimal PhFormatGuid PhFormatImageVersionInfo PhFormatLogEntry PhFormatNativeKeyName PhFormatSize PhFormatString PhFormatString_V PhFormatTime PhFormatTimeSpan PhFormatTimeSpanRelative PhFormatToBuffer PhFormatUInt64 PhFree PhFreeFileDialog PhFreeJsonObject PhFreeLibrary PhFreeLibraryAsImageResource PhFreePage PhFreeToFreeList PhFreeXmlObject PhGenerateGuid PhGenerateGuidFromName PhGenerateRandomAlphaString PhGenerateRandomNumber64 PhGetAccessEntries PhGetAccessString PhGetActiveProcessorCount PhGetApplicationDataFileName PhGetApplicationDirectory PhGetApplicationDirectoryFileName PhGetApplicationDirectoryWin32 PhGetApplicationFileNameWin32 PhGetApplicationIcon PhGetApplicationIconEx PhGetBaseDirectory PhGetBaseName PhGetClassObject PhGetClientIdName PhGetClientIdNameEx PhGetClientRect PhGetComboBoxString PhGetContextThread PhGetDeviceIcon PhGetDeviceProperty PhGetDeviceType PhGetDialogItemValue PhGetDllFileName PhGetDllHandle PhGetDpi PhGetDpiValue PhGetDrawInfoGraphBuffers PhGetDriverImageFileName PhGetDriverName PhGetDriverServiceKeyName PhGetEnabledProvider PhGetEtwPublisherName PhGetFileDialogFileName PhGetFileDialogFilterIndex PhGetFileDialogOptions PhGetFileFullAttributesInformation PhGetFileName PhGetFilePosition PhGetFileSize PhGetFileVersionFixedInfo PhGetFileVersionInfo PhGetFileVersionInfoEx PhGetFileVersionInfoLangCodePage PhGetFileVersionInfoString PhGetFileVersionInfoString2 PhGetFilterSupportNetworkTreeList PhGetFilterSupportProcessTreeList PhGetFilterSupportServiceTreeList PhGetFirmwareEnvironmentVariable PhGetFullPath PhGetGeneralCallback PhGetGenericTreeNewLines PhGetGlobalWorkQueue PhGetHandleInformation PhGetHandleInformationEx PhGetIListViewContextMenuPoint PhGetIListViewItemParam PhGetImageListIcon PhGetIntegerPairStringRefSetting PhGetIntegerStringRefSetting PhGetJobProcessIdList PhGetJsonArrayIndexObject PhGetJsonArrayLength PhGetJsonArrayLong64 PhGetJsonArrayString PhGetJsonObject PhGetJsonObjectAsArrayList PhGetJsonObjectBool PhGetJsonObjectLength PhGetJsonObjectType PhGetJsonValueAsInt64 PhGetJsonValueAsString PhGetJsonValueAsUInt64 PhGetKernelFileName PhGetKernelFileName2 PhGetKernelFileNameEx PhGetKnownFolderPath PhGetKnownLocation PhGetLastError PhGetLineFromAddress PhGetListBoxString PhGetListViewContextMenuPoint PhGetListViewItemImageIndex PhGetListViewItemParam PhGetListViewItemText PhGetListViewSelectedItemText PhGetMessage PhGetModuleFromAddress PhGetModuleProcAddress PhGetMonitorDpi PhGetNamedPipeClientComputerName PhGetNamedPipeClientProcessId PhGetNamedPipeServerProcessId PhGetNtMessage PhGetNtSystemRoot PhGetObjectSecurity PhGetObjectType PhGetObjectTypeIndexName PhGetObjectTypeInformation PhGetObjectTypeName PhGetObjectTypeNumber PhGetOwnTokenAttributes PhGetPhReleaseChannel PhGetPhReleaseChannelString PhGetPhVersion PhGetPhVersionHash PhGetPhVersionNumbers PhGetPluginCallback PhGetPluginFileName PhGetPluginInformation PhGetPluginInterface PhGetPluginName PhGetPnPDeviceName PhGetPositionFileStream PhGetPrimeNumber PhGetProcedureAddress PhGetProcedureAddressRemote PhGetProcessCommandLine PhGetProcessDepStatus PhGetProcessDeviceMap PhGetProcessEnvironment PhGetProcessImageFileName PhGetProcessImageFileNameByProcessId PhGetProcessImageFileNameWin32 PhGetProcessIsDotNet PhGetProcessIsDotNetEx PhGetProcessIsSuspended PhGetProcessKnownType PhGetProcessKnownTypeEx PhGetProcessMappedFileName PhGetProcessPackageFullName PhGetProcessPebString PhGetProcessPowerThrottlingState PhGetProcessPriorityClass PhGetProcessPriorityClassString PhGetProcessSmallImageList PhGetProcessUnloadedDlls PhGetProcessWindowTitle PhGetProcessWorkingSetInformation PhGetProcessWsCounters PhGetProtocolTypeName PhGetSMBIOSString PhGetScalableIntegerPairStringRefSetting PhGetSeObjectSecurity PhGetSectionFileName PhGetSelectedAndPropagateProcessItems PhGetSelectedIListViewItemParams PhGetSelectedListViewItemParam PhGetSelectedListViewItemParams PhGetSelectedProcessItem PhGetSelectedProcessItems PhGetSelectedProcessNodes PhGetSelectedServiceItem PhGetSelectedServiceItems PhGetServiceChange PhGetServiceConfig PhGetServiceConfigFileName PhGetServiceDescription PhGetServiceDllParameter PhGetServiceErrorControlInteger PhGetServiceErrorControlString PhGetServiceFileName PhGetServiceNameFromTag PhGetServiceStartTypeInteger PhGetServiceStartTypeString PhGetServiceStateString PhGetServiceTypeInteger PhGetServiceTypeString PhGetShieldBitmap PhGetSidFullName PhGetSizeDpiValue PhGetStatisticsTime PhGetStatisticsTimeString PhGetStatusMessage PhGetStockApplicationIcon PhGetStockObject PhGetStringRefSetting PhGetSymbolFromAddress PhGetSymbolFromName PhGetSystemDirectory PhGetSystemDpi PhGetSystemMetrics PhGetSystemParametersInfo PhGetSystemRoot PhGetTaskbarDpi PhGetTcpStateName PhGetTemporaryDirectoryRandomAlphaFileName PhGetThreadServiceTag PhGetTokenGroups PhGetTokenIntegrityLevel PhGetTokenIntegrityLevelRID PhGetTokenOwner PhGetTokenPrimaryGroup PhGetTokenPrivileges PhGetTokenUser PhGetTreeNewText PhGetUserLocaleInfoBool PhGetWin32Message PhGetWindowClientId PhGetWindowContext PhGetWindowDpi PhGetWindowText PhGetWindowTextEx PhGetXmlInterface PhGetXmlNodeAttributeByIndex PhGetXmlNodeAttributeCount PhGetXmlNodeAttributeText PhGetXmlNodeElementText PhGetXmlNodeFirstChild PhGetXmlNodeNextChild PhGetXmlNodeOpaqueText PhGetXmlObject PhGraphStateGetDrawInfo PhHandleCopyCellEMenuItem PhHandleCopyListViewEMenuItem PhHandleListViewNotifyBehaviors PhHandleListViewNotifyForCopy PhHandleTreeNewColumnMenu PhHashBytes PhHashStringRef PhHashStringRefEx PhHexStringToBuffer PhHexStringToBufferEx PhHttpAddRequestHeaders PhHttpBeginRequest PhHttpClose PhHttpConnect PhHttpCrackUrl PhHttpDestroy PhHttpDownloadString PhHttpGetErrorMessage PhHttpInitialize PhHttpQueryHeaderString PhHttpQueryHeaderUlong PhHttpQueryHeaderUlong64 PhHttpQueryHeaders PhHttpQueryOptionString PhHttpReadData PhHttpReadDataToBuffer PhHttpReceiveResponse PhHttpSendRequest PhHttpSetCredentials PhHttpSetFeature PhHttpSetProtocol PhHttpSetSecurity PhHttpWriteData PhHungWindowFromGhostWindow PhIconToBitmap PhImageListAddBitmap PhImageListAddIcon PhImageListCreate PhImageListDestroy PhImageListDrawEx PhImageListDrawIcon PhImageListExtractIcon PhImageListFlushCache PhImageListGetIcon PhImageListRemoveIcon PhImageListReplace PhImageListSetBkColor PhImageListSetIconSize PhImageListSetImageCount PhImpersonateToken PhIndexOfEMenuItem PhInitializeArray PhInitializeAutoPool PhInitializeAvlTree PhInitializeBytesBuilder PhInitializeCallback PhInitializeCircularBuffer_FLOAT PhInitializeCircularBuffer_PVOID PhInitializeCircularBuffer_ULONG PhInitializeCircularBuffer_ULONG64 PhInitializeFastLock PhInitializeFreeList PhInitializeGraphState PhInitializeHash PhInitializeImageVersionInfo PhInitializeImageVersionInfoEx PhInitializeLayoutManager PhInitializeProcThreadAttributeList PhInitializeProviderThread PhInitializeStringBuilder PhInitializeTreeNewColumnMenu PhInitializeTreeNewColumnMenuEx PhInitializeTreeNewFilterSupport PhInitializeWindowTheme PhInitializeWorkQueue PhInitializeWorkQueueEnvironment PhInsertCopyCellEMenuItem PhInsertCopyIListViewEMenuItem PhInsertCopyListViewEMenuItem PhInsertEMenuItem PhInsertHandleObjectPropertiesEMenuItems PhInsertItemList PhInsertItemsList PhInsertStringBuilder PhInsertStringBuilder2 PhInsertStringBuilderEx PhIntegerToString64 PhInvalidateAllProcessNodes PhInvokeCallback PhIpv4AddressToString PhIpv4StringToAddress PhIpv6AddressToString PhIpv6StringToAddress PhIsDebuggerPresent PhIsExecutingInWow64 PhIsFirmwareSupported PhIsProcessBackground PhIsProcessSuspended PhLargeIntegerToLocalSystemTime PhLargeIntegerToSystemTime PhLayoutManagerLayout PhListenNamedPipe PhLoadAppKey PhLoadCustomColorList PhLoadIcon PhLoadImageFormatFromResource PhLoadIndirectString PhLoadLibrary PhLoadLibraryAsImageResource PhLoadListViewColumnSettings PhLoadListViewColumnsFromSetting PhLoadListViewGroupStatesFromSetting PhLoadListViewSortColumnsFromSetting PhLoadMappedImage PhLoadMappedImageEx PhLoadMappedImageHeaderPageSize PhLoadModuleSymbolProvider PhLoadModulesForVirtualSymbolProvider PhLoadResource PhLoadResourceEMenuItem PhLoadSettings PhLoadSymbolProviderModules PhLoadSymbolProviderOptions PhLoadWindowPlacementFromSetting PhLoadXmlObjectFromFile PhLoadXmlObjectFromString PhLocalTimeToSystemTime PhLockFileStream PhLogMessageEntry PhLookupDeviceItem PhLookupDeviceItemByHash PhLookupDevicePropertyClass PhLookupMemoryItemList PhLookupName PhLookupPrivilegeDisplayName PhLookupPrivilegeName PhLookupPrivilegeValue PhLookupSid PhLowerBoundElementAvlTree PhLowerDualBoundElementAvlTree PhMapFlags1 PhMapFlags2 PhMatchWildcards PhMaxMemorySingles PhMaximumElementAvlTree PhMinimumElementAvlTree PhModalPropertySheet PhModifyEMenuItem PhMoveFileWin32 PhNfGetTrayIconFont PhNtStatusFileNotFound PhNtStatusToDosError PhOpenDirectoryObject PhOpenDriver PhOpenFile PhOpenFileById PhOpenKey PhOpenLsaPolicy PhOpenProcess PhOpenProcessClientId PhOpenProcessToken PhOpenService PhOpenServiceKey PhOpenThread PhOpenThreadProcess PhParseCommandLine PhParseCommandLineFuzzy PhParseCommandLinePart PhPeekNamedPipe PhPluginAddMenuHook PhPluginAddTreeNewColumn PhPluginCallPhSvc PhPluginCreateEMenuItem PhPluginCreateTabPage PhPluginEnableTreeNewNotify PhPluginGetObjectExtension PhPluginGetSystemStatistics PhPluginInvokeWindowCallback PhPluginQueryPhSvc PhPluginReserveIds PhPluginSetObjectExtension PhPredecessorElementAvlTree PhPrintTimeSpan PhProcessImageListInitialization PhPropPageDlgProcHeader PhQueryDirectXExclusiveOwnership PhQueryEnvironmentVariable PhQueryFullAttributesFileWin32 PhQueryKey PhQueryKphCounters PhQueryMemoryItemList PhQueryObjectName PhQueryPerformanceCounter PhQueryPerformanceFrequency PhQueryRegistryString PhQueryRegistryUlong PhQueryRegistryUlong64 PhQueryServiceConfig PhQueryServiceConfig2 PhQueryServiceStatus PhQueryServiceVariableSize PhQuerySymbolicLinkObject PhQuerySystemTime PhQueryTimeZoneBias PhQueryTokenVariableSize PhQueryValueKey PhQueueItemWorkQueue PhQueueItemWorkQueueEx PhQueueUserWorkItem PhReAllocate PhReAllocateSafe PhReInitializeWindowTheme PhReadFile PhReadFileStream PhReadTimeStampCounter PhReferenceDeviceItem PhReferenceDeviceItem2 PhReferenceDeviceItemByHash PhReferenceDeviceTree PhReferenceDeviceTreeEx PhReferenceEmptyString PhReferenceNetworkItem PhReferenceObject PhReferenceObjectEx PhReferenceObjectSafe PhReferenceProcessItem PhReferenceProcessItemForParent PhReferenceProcessItemForRecord PhReferenceProcessRecord PhReferenceProcessRecordForStatistics PhReferenceProcessRecordSafe PhReferenceServiceItem PhRegisterCallback PhRegisterCallbackEx PhRegisterDialog PhRegisterMessageLoopFilter PhRegisterPlugin PhRegisterProvider PhRegisterWindowCallback PhRemoveAllEMenuItems PhRemoveEMenuItem PhRemoveElementAvlTree PhRemoveEntryHashtable PhRemoveItemArray PhRemoveItemList PhRemoveItemPointerList PhRemoveItemSimpleHashtable PhRemoveItemsArray PhRemoveItemsList PhRemoveListViewItem PhRemoveStringBuilder PhRemoveTreeNewFilter PhRemoveWindowContext PhResetSettings PhResizeArray PhResizeCircularBuffer_FLOAT PhResizeCircularBuffer_PVOID PhResizeCircularBuffer_ULONG PhResizeCircularBuffer_ULONG64 PhResizeList PhResolveDevicePrefix PhRevertImpersonationToken PhRoundUpToPowerOfTwo PhSaveCustomColorList PhSaveListViewColumnSettings PhSaveListViewColumnsToSetting PhSaveListViewGroupStatesToSetting PhSaveListViewSortColumnsToSetting PhSaveSettings PhSaveWindowPlacementToSetting PhSaveXmlObjectToFile PhSearchControlMatch PhSearchControlMatchLongHintZ PhSearchControlMatchPointer PhSearchControlMatchPointerRange PhSearchControlMatchZ PhSearchOnlineString PhSecondsSince1970ToTime PhSeekFileStream PhSelectAndEnsureVisibleProcessNode PhSelectAndEnsureVisibleServiceNode PhSelectComboBoxString PhSetApplicationWindowIcon PhSetApplicationWindowIconEx PhSetClipboardString PhSetControlTheme PhSetDialogItemText PhSetDialogItemValue PhSetEnabledProvider PhSetExtendedListView PhSetFileAllocationSize PhSetFileDialogFileName PhSetFileDialogFilter PhSetFileDialogOptions PhSetFileIoPriorityHint PhSetFilePosition PhSetFileSize PhSetFirmwareEnvironmentVariable PhSetFlagsAllEMenuItems PhSetFlagsEMenuItem PhSetGraphText PhSetGroupBoxText PhSetHeaderSortIcon PhSetIListViewSubItem PhSetImageListBitmap PhSetIntegerPairStringRefSetting PhSetIntegerStringRefSetting PhSetIntervalProviderThread PhSetListViewItemImageIndex PhSetListViewItemParam PhSetListViewSubItem PhSetObjectSecurity PhSetOptionsSymbolProvider PhSetProcessItemAffinityMask PhSetProcessItemIoPriority PhSetProcessItemPagePriority PhSetProcessItemPriority PhSetProcessItemPriorityBoost PhSetProcessItemThrottlingState PhSetProcessPowerThrottlingState PhSetProcessPriorityBoost PhSetProcessPriorityClass PhSetScalableIntegerPairStringRefSetting PhSetScalableIntegerPairStringRefSetting2 PhSetSeObjectSecurity PhSetSearchPathSymbolProvider PhSetSelectThreadIdProcessPropContext PhSetStateAllListViewItems PhSetStaticWindowIcon PhSetStringRefSetting PhSetThreadBasePriority PhSetThreadIoPriority PhSetThreadName PhSetTokenIsVirtualizationEnabled PhSetTokenPrivilege PhSetTokenPrivilege2 PhSetTokenSessionId PhSetValueKey PhSetWindowContext PhSetWindowIcon PhSetWindowText PhSetXmlNodeAttributeText PhShellExecute PhShellExecuteEx PhShellExecuteUserString PhShellExploreFile PhShellOpenKey PhShellOpenKey2 PhShellProcessHacker PhShellProperties PhShowChooseProcessDialog PhShowConfirmMessage PhShowContinueStatus PhShowEMenu PhShowFileDialog PhShowHandleObjectProperties1 PhShowHandleObjectProperties2 PhShowHandlePropertiesEx PhShowIconNotification PhShowMessage PhShowMessage2 PhShowMessageOneTime PhShowProcessAffinityDialog2 PhShowProcessProperties PhShowProcessRecordDialog PhShowStatus PhShowSystemInformationDialog PhShowTaskDialog PhShowThreadAffinityDialog PhSiDoubleLabelYFunction PhSiSetColorsGraphDrawInfo PhSiSizeLabelYFunction PhSiUInt64LabelYFunction PhSidToStringSid PhSplitStringRefAtChar PhSplitStringRefAtLastChar PhSplitStringRefAtString PhSplitStringRefEx PhStackWalk PhStartProviderThread PhStartService PhStdGetClientIdName PhStdGetObjectSecurity PhStdSetObjectSecurity PhStopProviderThread PhStopService PhStringToDouble PhStringToGuid PhStringToInteger64 PhStringToUInt64 PhSuccessorElementAvlTree PhSvcCallChangeServiceConfig PhSvcCallChangeServiceConfig2 PhSvcCallPostMessage PhSvcCallSendMessage PhSystemBasicInformation PhSystemTimeToLargeInteger PhSystemTimeToLocalTime PhSystemTimeToTzSpecificLocalTime PhTaskbarListCreate PhTaskbarListDestroy PhTaskbarListSetOverlayIcon PhTaskbarListSetProgressState PhTaskbarListSetProgressValue PhTerminateProcess PhTerminateWindow PhThemeWindowDrawRebar PhThemeWindowDrawToolbar PhTimeToSecondsSince1970 PhTraceControl PhTransceiveNamedPipe PhTrimStringRef PhUiCloseConnections PhUiCloseHandles PhUiConnectSession PhUiConnectToPhSvc PhUiConnectToPhSvcEx PhUiContinueService PhUiContinueServices PhUiDebugProcess PhUiDeleteService PhUiDetachFromDebuggerProcess PhUiDisconnectFromPhSvc PhUiDisconnectSession PhUiEmptyProcessMemoryWorkingSet PhUiFlushHeapProcesses PhUiFreeMemory PhUiFreezeTreeProcess PhUiHibernateComputer PhUiLoadDllProcess PhUiLockComputer PhUiLogoffComputer PhUiLogoffSession PhUiPauseService PhUiPauseServices PhUiReduceWorkingSetProcesses PhUiRestartComputer PhUiRestartProcess PhUiRestartServices PhUiResumeProcesses PhUiResumeThreads PhUiResumeTreeProcess PhUiSetActivityModeration PhUiSetAttributesHandle PhUiSetBoostPriorityProcess PhUiSetBoostPriorityProcesses PhUiSetBoostPriorityThread PhUiSetBoostPriorityThreads PhUiSetCriticalProcess PhUiSetEcoModeProcess PhUiSetExecutionRequiredProcess PhUiSetIoPriorityProcesses PhUiSetIoPriorityThread PhUiSetPagePriorityProcess PhUiSetPagePriorityThread PhUiSetPriorityProcesses PhUiSetPriorityThread PhUiSetPriorityThreads PhUiSetVirtualizationProcess PhUiShutdownComputer PhUiSleepComputer PhUiStartService PhUiStartServices PhUiStopService PhUiStopServices PhUiSuspendProcesses PhUiSuspendThreads PhUiSuspendTreeProcess PhUiTerminateProcesses PhUiTerminateThreads PhUiTerminateTreeProcess PhUiThawTreeProcess PhUiUnloadModule PhUnloadDllProcess PhUnloadDriver PhUnloadMappedImage PhUnlockFileStream PhUnregisterCallback PhUnregisterDialog PhUnregisterMessageLoopFilter PhUnregisterProvider PhUnregisterWindowCallback PhUpdateCachedSettings PhUpdateDosDevicePrefixes PhUpdateHash PhUpdateMupDevicePrefixes PhUpdateProcThreadAttribute PhUpdateProcessNode PhUpdateServiceNode PhUpperBoundElementAvlTree PhUpperDualBoundElementAvlTree PhVerifyFile PhVerifyFileIsChainedToMicrosoft PhVerifyFileStream PhWaitForMultipleObjectsAndPump PhWaitForNamedPipe PhWaitForWorkQueue PhWalkThreadStack PhWindowThemeControlColor PhWordMatchStringRef PhWriteFile PhWriteFileStream PhWriteMiniDumpProcess PhWritePhTextHeader PhWriteStringAsUtf8FileStream PhWriteStringAsUtf8FileStreamEx PhWriteStringFormatAsUtf8FileStream PhWriteStringFormatAsUtf8FileStream_V PhWriteUnicodeDecoder PhZeroExtendToUtf16Buffer PhZeroExtendToUtf16Ex PhaChoiceDialog PhaGetProcessKnownCommandLine PhfAcquireFastLockExclusive PhfAcquireFastLockShared PhfAcquireQueuedLockExclusive PhfAcquireQueuedLockShared PhfAcquireRundownProtection PhfBeginInitOnce PhfEndInitOnce PhfInitializeBarrier PhfInitializeEvent PhfInitializeInitOnce PhfInitializeRundownProtection PhfPulseAllCondition PhfPulseCondition PhfQueueWakeEvent PhfReleaseFastLockExclusive PhfReleaseFastLockShared PhfReleaseQueuedLockExclusive PhfReleaseQueuedLockShared PhfReleaseRundownProtection PhfResetEvent PhfSetEvent PhfSetWakeEvent PhfTryAcquireFastLockExclusive PhfTryAcquireFastLockShared PhfWaitForBarrier PhfWaitForCondition PhfWaitForConditionEx PhfWaitForEvent PhfWaitForRundownProtection PhfWaitForWakeEvent PhfWakeForReleaseQueuedLock

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

860KB

Virtual Size

859KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

88KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.si3rc

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.si3rd

Size

4KB

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

240KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

loader (1).exe

SHA256 69ec869470f3906fee98e1e1ef6e77ae26c52e9640c0fc5f36b88e3b6bf9d4be
MD5 a45d186407bddf314c2fa82f00f782ce
SHA1 7ef3af74b79a573510553d617b7cc0e8ffde879c
SHA512 5199d15fe01d9104036360bcfb800e7af639016648922525a2ae12ff36bd3b757026457e1523a1819044b441a11af034ce615dac8e88cb113a67ee9003a8ba58
SSDEEP 196608:+vJjkgwlccGio0gMEQMDr5SzKc1UuPLHGPGnf/LDVubK8C8tHGWSFkf:OjkgwlccGio0sr5S6+H/f/Pt8C8cnkf
TLSH
T1F0961256A3F801F8C5A7C178C646971BE772741913209BEF23E44AA52F63BE16B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14598232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

641KB

Virtual Size

641KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

11.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

plugins/DotNetTools.dll

IMPHASH efdbb0bd83b35ed3f538f2bcda10950c
SHA256 5e06233f332f29e91d87c9b7d2ede4a37d7848058230ad08b1090c15a472ce26
MD5 852671989d5968d7746a12aa8c36f46b
SHA1 a66447b3088993d27167b3a4f05ff019b8756adf
SHA512 221739bdbf935ef86ba5abc6945fbf9b1b6c86a271b09ab616d21297570ed13b43dd47217a036147445458b92b2914ba00ea0afea65d0dbbe625923189dfefa3
SSDEEP 3072:f/HLSs6rNBvmQwo5fDZJKu2bnFTESCZ8E+s/isc+EnVhHZ85e0Fq5mc:f/HLirfvmpo8rbFTuqsoJDkB6
TLSH
T15414394773E400AAE5B7923889A35A06F773785107719ADF036482BA5F377D1BE39B20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

48896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

DotNetTools.pdb

systeminformer.exe

PhEnumDirectoryFile PhImpersonateToken PhCreateFileWin32 PhLoadMappedImageHeaderPageSize PhGetJsonArrayIndexObject PhGetTemporaryDirectoryRandomAlphaFileName PhGetBaseName PhGetJsonArrayString PhReferenceEmptyString PhGetProcedureAddress PhHexStringToBufferEx PhRevertImpersonationToken PhGetJsonObjectType PhFreeLibrary PhAddJsonArrayObject PhGetProcessMappedFileName PhDeleteImageVersionInfo PhDoesFileExist PhAddJsonObjectUInt64 PhCreateFileWin32Ex PhConvertUtf16ToUtf8Ex PhConcatStringRef4 PhCreateJsonParserEx PhEqualStringRef PhDeleteFileWin32 PhFreeJsonObject PhAddJsonObject2 PhGetJsonArrayLength PhDeleteDirectoryWin32 PhGetContextThread PhBufferToHexString PhOpenProcess PhAddJsonObjectValue PhGetSystemRoot PhLoadLibraryAsImageResource PhGetJsonValueAsString PhOpenProcessToken PhGetJsonObject PhVerifyFileIsChainedToMicrosoft PhFormatString_V PhPluginInvokeWindowCallback PhGetPluginCallback PhRegisterPlugin PhRegisterCallback PhPluginSetObjectExtension PhGetGeneralCallback PhAddSettings PhCopyListView PhLoadListViewGroupStatesFromSetting PhHandleListViewNotifyBehaviors PhLoadListViewSortColumnsFromSetting PhGetListViewContextMenuPoint PhSaveListViewColumnsToSetting PhSaveListViewGroupStatesToSetting PhUnregisterCallback PhLoadListViewColumnsFromSetting PhAddListViewGroupItem PhAddListViewColumn PhSetExtendedListView PhSaveListViewSortColumnsToSetting PhAddListViewGroup PhInsertCopyListViewEMenuItem PhWindowThemeControlColor PhFormatToBuffer PhHandleCopyListViewEMenuItem PhGetSelectedListViewItemParams PhCreateSimpleHashtable PhfAcquireQueuedLockExclusive PhFindItemSimpleHashtable PhfWakeForReleaseQueuedLock PhRemoveItemSimpleHashtable PhAddItemSimpleHashtable PhCreateBytesEx PhPluginQueryPhSvc PhPluginCallPhSvc PhPluginGetObjectExtension PhPluginAddTreeNewColumn PhOpenThread PhLoadLibrary PhFreeLibraryAsImageResource PhUnloadMappedImage PhReferenceProcessItem PhInitializeImageVersionInfoEx PhEnumGenericModules PhGetFileName PhGetBaseDirectory PhCreateJsonObject PhExpandEnvironmentStrings PhGetJsonValueAsUInt64 PhDosPathNameToNtPathName PhCreateJsonArray PhFindLastCharInStringRef PhCreateThreadEx PhInsertEMenuItem PhLoadResource PhCreateList PhGetTreeNewText PhFormat PhCreateObjectType PhInitializeTreeNewFilterSupport PhSetControlTheme PhFormatString PhCreateSearchControl PhAllocate PhCountStringZ PhCreateEMenuItem PhClearList PhInitializeStringBuilder PhCmLoadSettings PhPropPageDlgProcHeader PhCompareStringRef PhConcatStrings2 PhDeleteTreeNewColumnMenu PhCreateEMenu PhFormatGuid PhHandleCopyCellEMenuItem PhAddItemList PhGetStringRefSetting PhGetWin32Message PhfEndInitOnce PhAddItemsList PhInitializeWindowTheme PhInitializeTreeNewColumnMenuEx PhHandleTreeNewColumnMenu PhGetIntegerStringRefSetting PhSetIntegerStringRefSetting PhSetClipboardString PhAddTreeNewFilter PhGetProcessIsDotNetEx PhUiDisconnectFromPhSvc PhSetIntegerPairStringRefSetting PhGetGlobalWorkQueue PhUiConnectToPhSvcEx PhSplitStringRefAtChar PhSetStringRefSetting PhAddProcessPropPage PhRemoveStringBuilder PhCreateStringEx PhQueueItemWorkQueue PhDoPropPageLayout PhFinalStringBuilderString PhApplyTreeNewFilters PhSearchControlMatch PhShellExecuteUserString PhShowEMenu PhAutoDereferenceObject PhCreateObject PhDoesFileExistWin32 PhRemoveTreeNewFilter PhDestroyEMenu PhFree PhConcatStringRef2 PhConcatStrings PhCmSaveSettings PhReferenceObject PhAppendStringBuilderEx PhInsertCopyCellEMenuItem PhGetIntegerPairStringRefSetting PhDeleteTreeNewFilterSupport PhCreateProcessPropPageContextEx PhDereferenceObject PhfBeginInitOnce PhSetFlagsEMenuItem PhAddPropPageLayoutItem PhQueryTokenVariableSize PhFormatUInt64

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader RtlCaptureContext NtMapViewOfSection NtOpenSection RtlAddSIDToBoundaryDescriptor NtOpenPrivateNamespace NtUnmapViewOfSection RtlFreeHeap RtlCreateBoundaryDescriptor NtReadVirtualMemory NtQueryInformationProcess NtWriteFile NtWaitForSingleObject NtClose

kernel32

FlsGetValue WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapFree HeapQueryInformation HeapSize HeapReAlloc HeapAlloc GetModuleFileNameW GetModuleHandleExW ExitProcess EncodePointer LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError InterlockedFlushSList GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA GetProcAddress GetModuleHandleW FreeLibrary VirtualQuery VirtualProtect GetSystemInfo RaiseException FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetProcessHeap GetStdHandle GetLastError GetFileType GetStringTypeW SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW FlsAlloc

user32

GetDlgItem SetFocus SendMessageW SetWindowLongPtrW GetWindowRect PostMessageW UpdateWindow GetKeyState

Name

.text

Size

104KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/DotNetTools.pdb

SHA256 c948ed4f902bf09c625f8fceeb03d5e8a5775dfb9689412c682f5ccced150129
MD5 055fd4108c0cd33cf87de077df2e7dd6
SHA1 af41dd33ecb53efd4d80990a96ea6b268248fbc5
SHA512 65d249d920f2f5aab282296874c93173aba2323c1988be724e3a891f537e1854c95f42134b9161d2ea0be6f4b9e244a374b16f12ccab94a58ae860d303f72b3f
SSDEEP 24576:JFo0xlmcsafg1bvwgAHgTRc2/x/yzk/5eDZiFkrl:0v1F/x/yo/5AZiG
TLSH
T1F4168D1BBB489C23C40F1679A497272DD3D9D6029BCD6BD74E88A3844CEB394DF2D681
MD5 SHA1 SHA512 SSDEEP TLSH

plugins/ExtendedNotifications.dll

IMPHASH 1c904284028438591c37c352a8cfbb9b
SHA256 5cc20a209a405cabb09b9661c29c2c90d62f8b83b3c6ac950273384d3bdad4eb
MD5 029c0b3dd21afeb3db4c90be95c3d1b6
SHA1 0e2a03542b29a97bd09f02df3ea7a8f7b673d907
SHA512 7a06ca22d8edea893100e3556d7b5edd491595134e47e2bdc805f0d5a4be453666e36c6fc3552cc289353daad268dbd6b97581aa2b29be64bbb0aeb860aa9ef6
SSDEEP 3072:lYQwQPiuaURocGqyuAxf7UCUj5Hyl+FkoQM:lIwvtRnyuo8bF
TLSH
T158D34A5763E500BBE0B79678C8634A0697B6B81507309BEF07A4425A1F337D68D3EF62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

13344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ExtendedNotifications.pdb

systeminformer.exe

PhSetWindowContext PhCreateList PhWindowThemeControlColor PhInitializeLayoutManager PhDeleteLayoutManager PhFreeFileDialog PhAllocate PhShowFileDialog PhEqualStringRef PhInsertItemList PhClearList PhInitializeStringBuilder PhGetWindowText PhConcatStrings2 PhSetFileDialogFilter PhAddItemList PhAddSettings PhRemoveItemList PhGetFileDialogFileName PhSetFileDialogFileName PhCreateSaveFileDialog PhGetWindowContext PhSetStringRefSetting PhSetDialogItemText PhFinalStringBuilderString PhAddLayoutItem PhAppendCharStringBuilder PhMatchWildcards PhGetDeviceProperty PhFree PhRegisterPlugin PhReferenceObject PhAppendStringBuilderEx PhGetPluginCallback PhDeleteStringBuilder PhGetFileName PhLayoutManagerLayout PhRemoveWindowContext PhFindCharInStringRef PhFormatToBuffer PhGetStringRefSetting PhGetApplicationDirectoryFileName PhGetGeneralCallback PhCreateFileStream PhWriteStringFormatAsUtf8FileStream PhFormatLogEntry PhAutoDereferenceObject PhRegisterCallback PhFormatDateTime PhExpandEnvironmentStrings PhWriteStringAsUtf8FileStream PhDereferenceObject PhDetermineDosPathNameType

user32

EnableWindow GetParent GetDlgItem GetWindowLongPtrW SendMessageW CallWindowProcW SetWindowLongPtrW

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader RtlCaptureContext

kernel32

InitializeSListHead GetStringTypeW GetFileType GetStdHandle GetProcessHeap LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapFree HeapAlloc GetModuleFileNameW GetModuleHandleExW ExitProcess RaiseException EncodePointer LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError WriteConsoleW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers SetStdHandle HeapReAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetLastError IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList HeapSize

Name

.text

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/ExtendedNotifications.pdb

SHA256 939b23264ed4a0c256c9784843b9159148c930e52843b9d124aa0573be592702
MD5 cb2dd416f3451dea837ff82cf8c99e46
SHA1 b37a45bf3d7163017224653e21e2937ee957ae2d
SHA512 b881e338fde08372cde18ae5964fcd664557ba117489a4b8c51f8312d2c28df1e51d3eb8ea6c1fc1e97943d9cbf18555e1606a9e17f89557b7efc0d6497b7fc6
SSDEEP 24576:R11jmW8li8AqUIUgeegYru/Jc/r2RD/4tij:Ra+qRfq/Jc/u4tij
TLSH
T10E068D53FB449E73C40F5279A16B076ED3D8D503AF8A7BDA9A84B2405CE7384DF1A242
MD5 SHA1 SHA512 SSDEEP TLSH

plugins/ExtendedServices.dll

IMPHASH c5278d1a1dad87b9933b878042366500
SHA256 c6bd3229ab86045f0dbaeaaa6e887e035598d51bd2aa03920e119cd7362dc737
MD5 eb6a9378931e78b82a8223394007f4ea
SHA1 abe451fb7f6b530b594877fa0dd3b8f1966cd59a
SHA512 ace6bdac8d56d55d8b77cb1709cf3d920695c04aeae79c7d3cc84781bfd8dbb65ecb14dc5a32a50624b75f76435ecdb4bcc2134f9cf0364c027d8bfbc49cb68f
SSDEEP 3072:ogFTubInlRzO1fjGNk0cnYbQChqAOMYEJY4ZZo0gTOqkqv3m:oQjDO1f6v9o0pY5v
TLSH
T1BD14075773E901ABE1B7963989634A12E77378111734CBEF0260C27A5F237D1AD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

40720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ExtendedServices.pdb

systeminformer.exe

PhDialogBox PhSetFileDialogFileName PhGetFileDialogFileName PhGetComboBoxString PhCreateOpenFileDialog PhSetFileDialogFilter PhShowFileDialog PhFreeFileDialog PhGetSystemMetrics PhGetHandleInformation PhDevGetObjects PhImageListCreate PhShellOpenKey2 PhExpandEnvironmentStrings PhDestroyEMenu PhLoadLibrary PhGetWindowDpi PhGetDpi PhExtractIconEx PhShowEMenu PhSplitStringRefAtChar PhReferenceEmptyString PhGetProcedureAddress PhAddListViewGroupItem PhStringToInteger64 PhCreateEMenu PhGetSelectedListViewItemParam PhDevFreeObjects PhCreateEMenuItem PhFormat PhSplitStringRefAtLastChar PhAddListViewGroup PhWindowThemeControlColor PhFormatToBuffer PhSetListViewItemImageIndex PhImageListAddIcon PhCreateAlloc PhInitializeAutoPool PhFinalStringBuilderString PhInitializeArray PhDeleteAutoPool PhFormatGuid PhGetEtwPublisherName PhAddItemArray PhClearList PhStringToGuid PhEnumerateKey PhFormatString PhCenterWindow PhGetSystemRoot PhConcatStringRef3 PhQueryRegistryString PhConcatStringRef2 PhOpenKey PhaChoiceDialog PhSetListViewSubItem PhFindListViewItemByFlags PhLookupPrivilegeDisplayName PhSetControlTheme PhQueryServiceVariableSize PhShowContinueStatus PhEqualStringRef PhSelectComboBoxString PhSetExtendedListView PhInitializeStringBuilder PhGetWindowText PhChangeServiceConfig2 PhAddListViewColumn PhRemoveItemList PhShowStatus PhSidToStringSid PhQueryServiceConfig2 PhGetDialogItemValue PhGetModuleProcAddress PhRemoveListViewItem PhShowMessage2 PhUiDisconnectFromPhSvc PhEnumeratePrivileges PhUiConnectToPhSvc PhCreateStringEx PhGetListViewItemParam PhFindItemList PhAddListViewItem PhSvcCallChangeServiceConfig2 PhShowTaskDialog PhAppendCharStringBuilder PhAppendStringBuilderEx PhDeleteStringBuilder PhGetOwnTokenAttributes PhSetDialogItemValue PhUiRestartServices PhInsertEMenuItem PhUiStartServices PhfReleaseQueuedLockShared PhEscapeStringForMenuPrefix PhPluginCreateEMenuItem PhUiPauseServices PhPluginInvokeWindowCallback PhCompareStringRef PhFindEMenuItem PhDestroyEMenuItem PhAddSettings PhGetGeneralCallback PhfAcquireQueuedLockShared PhUiContinueServices PhIndexOfEMenuItem PhFormatString_V PhRegisterCallback PhRegisterPlugin PhReferenceObject PhGetPluginCallback PhUiStopServices PhSetWindowContext PhCreateList PhInitializeLayoutManager PhGetNtMessage PhDeleteLayoutManager PhAllocate PhOpenService PhCountStringZ PhConcatStrings2 PhAddItemList PhReferenceServiceItem PhInitializeWindowTheme PhGetIntegerStringRefSetting PhGetWindowContext PhSetDialogItemText PhGetServiceConfig PhAddLayoutItem PhAutoDereferenceObject PhFree PhCloseServiceHandle PhEnumDependentServices PhLayoutManagerLayout PhDereferenceObject PhCreateServiceListControl PhFreeLibrary PhRemoveWindowContext

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlCaptureContext RtlPcToFileHeader NtClose

kernel32

InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapFree HeapAlloc GetModuleFileNameW GetModuleHandleExW ExitProcess EncodePointer LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError InterlockedFlushSList GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA GetProcAddress GetModuleHandleW FreeLibrary VirtualQuery VirtualProtect GetSystemInfo GetLastError RaiseException LCMapStringW InitializeCriticalSectionAndSpinCount GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx GetComputerNameW CreateFileW CloseHandle WriteConsoleW

user32

GetDlgItem MoveWindow MapWindowPoints ShowWindow GetWindowRect IsWindowEnabled DestroyIcon GetCursorPos EndDialog EnableWindow SetWindowLongPtrW SendMessageW GetParent

comctl32

CreatePropertySheetPageW

Name

.text

Size

92KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/ExtendedServices.pdb

SHA256 40c9b770ce6e2f8dec9faa391742f5f77c2c5cfa2017f9b586c115320de2dfb8
MD5 2beaae51074cf01bc2554577a730c49a
SHA1 ff56e071121a89115f99b9cada9add547931f776
SHA512 95c55121a83cde1f3523bd0a67ac901bc46268a87d3f00df69271b774916588b2517e18f3bd4a23070868d8c117bea8c635a1ac9514e72c4b5b5a78ac8e27a0d
SSDEEP 24576:WuGYb6cRtTSCc03egJVgXaB9tv/wLD/J+YeAi:BDb6UUCc0f3/2/JbeAi
TLSH
T13A16AE17FB48ADA3C00B07B9A19B175DD3D5D6039B8E2BD39A88E2444DE73C49F2E641
MD5 SHA1 SHA512 SSDEEP TLSH

plugins/ExtendedTools.dll

IMPHASH 82792dbb97ac59f82b9bd418d337b95f
SHA256 237dff07b520141251e0982ecf56e3772b606990a8761135aa8e42668104c5a5
MD5 0a62953b4b3ff1b2ff3a9de8dc22ac1f
SHA1 2cf8e064cee582437b06f24a46125111da24d1bc
SHA512 9417a8b8ccfcf47b3e1143abc0a02b94f15dbadb736902692bd16b13c980603b84643ef0439dfe09d738145b3d18eab26a2096c01414de9cf41a4845bec3f5d3
SSDEEP 24576:Ka/nvlhNOzT0jhg/HUtyQ0q7FXkKR3QL4zs6Z66z24VZbUDj0Qq4VRXm9q:Ka/n3gh2zLZ66z24VZb7iVR29
TLSH
T1C9A56C42F3D810A8F0A6A7798BBBC2219772BDD5072559EF10A0B50F6F76BC11536F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

445392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ExtendedTools.pdb

systeminformer.exe

PhGetListViewItemParam PhRemoveStringBuilder PhLoadWindowPlacementFromSetting PhSetApplicationWindowIcon PhGetWindowContext PhRemoveListViewItem PhShowStatus PhLoadListViewColumnsFromSetting PhFormatGuid PhAddListViewColumn PhGetSelectedListViewItemParam PhInitializeStringBuilder PhSetExtendedListView PhDialogBox PhEqualStringRef PhSetFirmwareEnvironmentVariable PhSaveWindowPlacementToSetting PhFindListViewItemByFlags PhSetListViewSubItem PhDeleteLayoutManager PhInitializeLayoutManager PhFormatSize PhInsertCopyListViewEMenuItem PhWindowThemeControlColor PhSetWindowContext PhHandleCopyListViewEMenuItem PhGetSelectedListViewItemParams PhSetWindowText PhSetScalableIntegerPairStringRefSetting2 PhInitializeAutoPool PhFormatString_V PhDrainAutoPool PhCreateFileStream PhCreateSaveFileDialog PhSetFileDialogFileName PhSetIntegerStringRefSetting PhGetFileDialogFileName PhDeleteAutoPool PhAdjustRectangleToWorkingArea PhSetFileDialogFilter PhGetWindowText PhSelectComboBoxString PhGetScalableIntegerPairStringRefSetting PhCreateDialog PhGetFirmwareEnvironmentVariable PhShowFileDialog PhFreeFileDialog PhGetMonitorDpi PhWriteFileStream PhGetStatisticsTimeString PhAddPropPageLayoutItem PhSetGroupBoxText PhMaxMemorySingles PhCreateProcessPropPageContextEx PhSetGraphText PhGetWindowDpi PhGetDpi PhCopyCircularBuffer_FLOAT PhDoPropPageLayout PhAddProcessPropPage PhGraphStateGetDrawInfo PhDeleteGraphState PhUnregisterCallback PhSiSetColorsGraphDrawInfo PhPropPageDlgProcHeader PhInitializeGraphState PhDivideSinglesBySingle PhInitializeWorkQueue PhDnsQuery PhGetSidFullName PhHashBytes PhLoadLibrary PhQueueItemWorkQueue PhFindPlugin2 PhGenerateGuid PhGetBaseName PhGetProcedureAddress PhDnsReverseLookupNameFromAddress PhEnumProcessItems PhGetPluginInformation PhDnsFree PhDnsQuery2 PhHashStringRefEx PhGetSystemMetrics PhIpv6AddressToString PhIpv4AddressToString PhFormatDateTime PhImageListDrawIcon PhAddItemsList PhDoesFileExist PhInsertItemList PhLargeIntegerToLocalSystemTime PhFormatUInt64 PhfResetEvent PhfSetEvent PhAddListViewGroupItem PhfWaitForEvent PhAddListViewGroup PhCreateThreadEx PhReferenceProcessRecordForStatistics PhDevGetObjects PhInitializeCircularBuffer_FLOAT PhInitializeCircularBuffer_ULONG64 PhInitializeCircularBuffer_ULONG PhDevFreeObjects PhSiDoubleLabelYFunction PhGetSizeDpiValue PhCopyConvertCircularBufferULONG PhSiSizeLabelYFunction PhGetStatisticsTime PhGetDrawInfoGraphBuffers PhFindProcessRecord PhSetDialogItemText PhAddLayoutItemEx PhDrawTrayIconText PhBitmapSetAlpha PhNfGetTrayIconFont PhShowSystemInformationDialog PhAppendFormatStringBuilder PhStringToGuid PhDrawGraphDirect PhGetGlobalWorkQueue PhGetHandleInformation PhGetDeviceType PhEnumProcesses PhStdGetClientIdName PhCallKphQueryFileInformationWithTimeout PhEnumDirectoryFile KsiEnumerateProcessHandles PhGetNamedPipeServerProcessId PhGetAccessEntries PhGetAccessString PhOpenProcess PhOpenFile PhSaveListViewColumnsToSetting PhCreateProcessPropContext PhImageListCreate KphQueryInformationObject PhHandleListViewNotifyBehaviors PhLoadIcon PhOpenDirectoryObject PhGetPnPDeviceName KphOpenDeviceDriver PhGetClientIdName PhDeleteStringBuilder PhConcatStringRef2 PhDeleteWorkQueue PhDosErrorToNtStatus PhWaitForWorkQueue KphOpenDevice PhFilterConnectCommunicationPort PhResolveDevicePrefix PhFindStringInStringRef PhEnumObjectTypes PhFindItemSimpleHashtable PhSearchControlMatch PhGetJobProcessIdList PhReferenceObjectSafe PhGetSectionFileName PhShowProcessProperties PhOpenDriver KphAlpcQueryInformation PhSearchControlMatchPointer PhQuerySymbolicLinkObject KphOpenDeviceBaseDevice PhGetModuleProcAddress PhGetComboBoxString PhGetLastError PhClearList PhEnumDirectoryObjects PhGetDriverName PhShowHandlePropertiesEx PhImageListDestroy PhEditSecurity PhGetDriverImageFileName PhCreateSearchControl PhSetSelectThreadIdProcessPropContext PhImageListGetIcon PhCreateFile PhSplitStringRefAtLastChar PhConcatStringRef3 KphDuplicateObject PhSetListViewItemImageIndex PhEnumHandlesEx PhImageListAddIcon PhCreateHandleItem PhGetObjectTypeNumber PhAddItemSimpleHashtable PhZeroExtendToUtf16Ex PhExpandEnvironmentStrings PhConvertUtf16ToUtf8Buffer PhGetApplicationDirectoryFileName PhSplitStringRefAtString PhCreateString3 PhGetFileSize PhEnumPoolTagInformation PhDeleteTreeNewFilterSupport PhZeroExtendToUtf16Buffer PhSearchControlMatchLongHintZ PhEnumBigPoolInformation PhfReleaseFastLockExclusive PhfAcquireFastLockExclusive PhQueryObjectName PhConcatStrings PhOpenFileById PhEnumReparsePointInformation PhDeviceIoControlFile PhShowConfirmMessage PhEnumObjectIdInformation PhGetSMBIOSString PhEnumSMBIOS PhBufferToHexString PhPluginQueryPhSvc PhPluginCallPhSvc PhGetProcessUnloadedDlls PhCreateEvent PhShowMessage PhPluginGetObjectExtension PhPluginAddTreeNewColumn PhGetClassObject PhPluginEnableTreeNewNotify PhReferenceNetworkItem PhIsExecutingInWow64 PhGetUserLocaleInfoBool PhDeleteCircularBuffer_FLOAT PhGetPluginCallback PhRegisterPlugin PhIndexOfEMenuItem PhSetListViewItemParam PhPluginSetObjectExtension PhDeleteCircularBuffer_ULONG PhAddSettings PhPluginCreateEMenuItem PhDeleteCircularBuffer_ULONG64 PhCreateServiceListControl PhReferenceServiceItem PhCreateSymbolProvider KphQueryInformationDriver PhGetListViewItemText PhGetDriverServiceKeyName PhSetWindowIcon PhCreateAlloc PhLoadSymbolProviderModules PhCompareObjects PhGetObjectTypeIndexName PhUiSetAttributesHandle PhLoadSymbolProviderOptions PhSidToStringSid PhConvertUtf16ToMultiByte PhGetSymbolFromAddress PhUiCloseHandles PhInsertHandleObjectPropertiesEMenuItems PhShowHandleObjectProperties1 PhShowHandleObjectProperties2 PhStringToUInt64 PhOpenThread PhUiConnectToPhSvcEx PhUiDisconnectFromPhSvc PhHexStringToBufferEx PhSecondsSince1970ToTime PhCopyStringZ PhQueryRegistryUlong PhFormatDate PhQueryValueKey PhReAllocate PhQueryRegistryUlong64 PhEnumNextThread PhFreeLibrary PhFormatTime PhGetModuleFromAddress PhHandleListViewNotifyForCopy PhAddLayoutItem PhAddListViewItem PhAdjustPrivilege PhCenterWindow PhAppendStringBuilderEx PhGetListViewContextMenuPoint PhFindListViewItemByParam PhLayoutManagerLayout PhRemoveWindowContext PhEnumFirmwareEnvironmentValues PhCopyListView PhIsFirmwareSupported PhSetThreadName PhCreateThread2 PhSetThreadBasePriority PhDelayExecution PhAutoDereferenceObject PhCreateObjectType PhQueryPerformanceCounter PhAddEntryHashtableEx PhInvokeCallback PhAllocateFromFreeList PhInitializeFreeList PhDereferenceProcessRecord PhCreateObject PhReferenceProcessItem PhGetFileName PhFreeToFreeList PhReferenceProcessRecord PhCreateSimpleHashtable PhQueryPerformanceFrequency PhFindLastCharInStringRef PhInsertEMenuItem PhFormatToBuffer PhCreateList PhGetStatusMessage PhGetPluginInterface PhFinalStringBuilderString PhGetTreeNewText PhShowProcessRecordDialog PhFormat PhInitializeTreeNewFilterSupport PhSetControlTheme PhFormatString PhFindProcessNode PhCreateEMenuItem PhRemoveEntryHashtable PhPluginInvokeWindowCallback PhSetFlagsAllEMenuItems PhCmLoadSettings PhAddItemArray PhCompareStringRef PhDeleteTreeNewColumnMenu PhFindEMenuItem PhCreateEMenu PhHandleCopyCellEMenuItem PhAddItemList PhGetStringRefSetting PhReferenceProcessItemForRecord PhShellExploreFile PhInitializeWindowTheme PhInitializeTreeNewColumnMenuEx PhHandleTreeNewColumnMenu PhPluginCreateTabPage PhInitializeArray PhRemoveItemList PhGetIntegerStringRefSetting PhSetClipboardString PhAddTreeNewFilter PhReferenceEmptyString PhApplyTreeNewFiltersToNode PhShowMessage2 PhGetProcessSmallImageList PhSetIntegerPairStringRefSetting PhSetStringRefSetting PhCreateStringEx PhApplyTreeNewFilters PhFindItemList PhShellExecuteUserString PhShowEMenu PhRemoveItemsArray PhSelectAndEnsureVisibleProcessNode PhDoesFileExistWin32 PhDestroyEMenu PhCmSaveSettings PhReferenceObject PhInsertCopyCellEMenuItem PhWriteStringAsUtf8FileStream PhGetIntegerPairStringRefSetting PhGetGenericTreeNewLines PhShellProperties PhGetOwnTokenAttributes PhSetFlagsEMenuItem PhAddEntryHashtable PhAllocate PhfReleaseQueuedLockShared PhCountStringZ PhStringToInteger64 PhfWakeForReleaseQueuedLock PhfEndInitOnce PhGetGeneralCallback PhClearHashtable PhCreateHashtable PhfAcquireQueuedLockShared PhSplitStringRefAtChar PhRegisterCallback PhFree PhfAcquireQueuedLockExclusive PhEnumHashtable PhDereferenceObject PhfBeginInitOnce KsiLevel PhFindEntryHashtable

ntdll

RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtSetInformationProcess NtQueryInformationProcess NtQueryInformationThread NtCancelSynchronousIoFile NtQueryInformationWorkerFactory NtWaitForSingleObject NtDeviceIoControlFile RtlValidSecurityDescriptor RtlGetOwnerSecurityDescriptor NtReadFile NtQuerySection NtOpenSection NtQueryMutant NtQueryEvent NtQuerySemaphore NtDuplicateObject NtOpenJobObject NtOpenSession NtOpenTimer NtQueryTimer NtOpenKeyedEvent NtAlpcConnectPort NtOpenSemaphore NtOpenEvent NtOpenKey NtOpenSymbolicLinkObject NtOpenMutant NtOpenFile NtQueryInformationFile RtlSetBits RtlInitializeBitMap NtClose RtlInterlockedFlushSList RtlRaiseStatus RtlInterlockedPushEntrySList

kernel32

RaiseException GetSystemInfo VirtualProtect VirtualQuery FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree HeapReAlloc HeapSize HeapQueryInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA LocalFree GetCommandLineW MultiByteToWideChar WideCharToMultiByte FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW GetLastError

user32

MoveWindow InvalidateRect SetFocus SendMessageW CreateWindowExW SetTimer KillTimer EnumDesktopsW FindWindowExW CloseWindowStation CloseDesktop GetSysColor SetProcessWindowStation GetUserObjectInformationW OpenDesktopW GetProcessWindowStation MapWindowPoints EnableWindow GetCursorPos SetWindowTextW GetWindowRect GetFocus WindowFromPoint DestroyIcon SetCursor GetComboBoxInfo LoadImageW SetWindowPos PostQuitMessage IsIconic DrawTextW GetParent DeferWindowPos PostMessageW SetWindowLongPtrW GetWindowLongPtrW BeginDeferWindowPos EndDeferWindowPos MapDialogRect GetClientRect GetMessageW DestroyWindow ShowWindow DispatchMessageW IsDialogMessageW GetDlgItem TranslateMessage SetForegroundWindow EndDialog GetKeyState

gdi32

D3DKMTQueryAdapterInfo SelectObject D3DKMTQueryStatistics D3DKMTOpenAdapterFromDeviceName D3DKMTCloseAdapter

advapi32

CloseTrace RegisterWaitChainCOMCallback OpenThreadWaitChainSession GetThreadWaitChain CloseThreadWaitChainSession ConvertSecurityDescriptorToStringSecurityDescriptorW StartTraceW ProcessTrace PerfCloseQueryHandle ControlTraceW OpenTraceW EnableTraceEx2 PerfAddCounters PerfOpenQueryHandle PerfQueryCounterData

comctl32

CreatePropertySheetPageW

Name

.text

Size

508KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

300KB

Virtual Size

297KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/ExtendedTools.pdb

SHA256 d4443889b99c9e808a6001e78149380f7b58cb0cbcbe83e849af2442d158a401
MD5 9c3a1b0400772ba130eaa61e258e85ce
SHA1 da4cf13c47c66f88ddb43f258d92098e701f033b
SHA512 71d553f237a45e8bc6a02c7eb60922f49c8ce3c524bc295dd1c65bb3c74f2f14e66cae65fce3f35c1d9aa97ca54ddf95df0bdd39edeb938aeed5d05c90bf33e7
SSDEEP 49152:5/5ZkyBTsI/IlIPIKIatIaqIaEhJKcIuIzW5nAZ8qys+del3fOko4w0EJ3vLviQo:I/bfC
TLSH
T19F965A52B2D49D63C46E177971830B1CE3D88902ABDEABCB494EE2695CC7389DF4F241
MD5 SHA1 SHA512 SSDEEP TLSH

plugins/HardwareDevices.dll

IMPHASH 84ecf610a71ff5365bfc1d42b0be22d6
SHA256 702f7ad5a4838f13d5b3e5260c394233fbd45ff689d9a8cd98a7c7c4c1b27ed0
MD5 5db99b9e32fbd2c92556c952b0d7db78
SHA1 c338ce97d02ecc07d03fd5c90be61900b4cb5aac
SHA512 124b9a030e7c19a9a33a0f64a91582d259951b6245511c5e4d05fe9bf71cbef1773584c8168f0bdc8b2fecda14e2ccb7514a133b6a49a0ae707258aa6abb3002
SSDEEP 6144:G2xjmWm2XVe7wMLFAZoDU7fqz7vV1yLIYeWgvQzOUbLU:G259mGUAZ8Ufqz7eL+vdUXU
TLSH
T150740805A3E5006CF1B786788AB7C516EBB378655B70DAEF1220C4596F33FD1A938722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

151712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

HardwareDevices.pdb

systeminformer.exe

PhDeleteTreeNewColumnMenu PhCompareStringRef PhAddItemArray PhCmLoadSettings PhPluginInvokeWindowCallback PhGetApplicationIcon PhInitializeTreeNewFilterSupport PhGetTreeNewText PhQuerySystemTime PhGetPluginInterface PhImageListAddIcon PhFormatUInt64 PhQueryPerformanceFrequency PhfResetEvent PhAutoDereferenceObject PhFormatString_V PhfSetEvent PhShowMessage2 PhUnregisterCallback PhfWaitForEvent PhFormatSize PhCreateThreadEx PhfBeginInitOnce PhDeleteCircularBuffer_FLOAT PhInitializeCircularBuffer_FLOAT PhFindPlugin2 PhDeleteCircularBuffer_ULONG PhfEndInitOnce PhGetPluginInformation PhInitializeCircularBuffer_ULONG PhEqualStringRef PhQueryPerformanceCounter PhLayoutManagerLayout PhSetApplicationWindowIconEx PhCenterWindow PhInitializeAutoPool PhAddLayoutItem PhGetSelectedIListViewItemParams PhDrainAutoPool PhLoadWindowPlacementFromSetting PhAddIListViewItem PhDeleteAutoPool PhAddIListViewColumn PhCreateDialog PhSaveWindowPlacementToSetting PhFormatString PhDeleteLayoutManager PhInitializeLayoutManager PhFormatToBuffer PhSetIListViewSubItem PhGetStatisticsTimeString PhSiDoubleLabelYFunction PhMaxMemorySingles PhGetDrawInfoGraphBuffers PhCopyConvertCircularBufferULONG PhCopyCircularBuffer_FLOAT PhGetStringRefSetting PhAddLayoutItemEx PhGraphStateGetDrawInfo PhDeleteGraphState PhSiSizeLabelYFunction PhInitializeGraphState PhDivideSinglesBySingle PhGetSizeDpiValue PhWindowThemeControlColor PhSetGraphText PhSetApplicationWindowIcon PhSiSetColorsGraphDrawInfo PhDevGetObjects PhExpandEnvironmentStrings PhAppendCharStringBuilder PhExtractIconEx PhGetListViewItemParam PhLoadIndirectString PhSplitStringRefAtChar PhStringToInteger64 PhGetSelectedListViewItemParam PhDevFreeObjects PhFindListViewItemByFlags PhQueryRegistryUlong PhFormatDate PhQueryValueKey PhReAllocate PhFindStringInStringRef PhQueryRegistryUlong64 PhIpv6AddressToString PhLoadListViewSortColumnsFromSetting PhIpv4AddressToString PhAppendFormatStringBuilder PhSaveListViewSortColumnsToSetting PhQueueItemWorkQueue PhGetGlobalWorkQueue PhConcatStrings2 PhGetHandleInformation PhShellOpenKey2 PhGetPluginCallback PhRegisterPlugin PhLoadLibrary PhGetProcedureAddress PhShowStatus PhFreeLibrary PhAddSettings PhDeviceProviderInitialization PhGetDllHandle PhDeviceIoControlFile PhConvertUtf8ToUtf16 PhQueryRegistryString PhEnumChildWindows PhCreateString3 PhGetProcessDeviceMap PhGetActiveProcessorCount PhHandleCopyCellEMenuItem PhReferenceServiceItem PhInitializeTreeNewColumnMenuEx PhCreatePointerList PhHandleTreeNewColumnMenu PhPluginCreateTabPage PhInitializeArray PhSetIntegerStringRefSetting PhSetClipboardString PhAddTreeNewFilter PhApplyTreeNewFiltersToNode PhGetGeneralCallback PhSetIntegerPairStringRefSetting PhSetStringRefSetting PhApplyTreeNewFilters PhRemoveItemPointerList PhRegisterCallback PhCmSaveSettings PhInsertCopyCellEMenuItem PhReferenceDeviceTreeEx PhAddItemPointerList PhSetFlagsEMenuItem PhGetSelectedListViewItemParams PhInsertEMenuItem PhHandleCopyListViewEMenuItem PhSetWindowContext PhGetStatusMessage PhInsertCopyListViewEMenuItem PhAddListViewGroup PhBufferToHexString PhLargeIntegerToLocalSystemTime PhFormat PhSetListViewSubItem PhSetControlTheme PhAllocate PhCreateEMenuItem PhSetExtendedListView PhInitializeStringBuilder PhAddListViewColumn PhCreateEMenu PhFormatGuid PhAddListViewGroupItem PhInitializeWindowTheme PhLoadListViewColumnsFromSetting PhReferenceEmptyString PhLookupDevicePropertyClass PhGetWindowContext PhEnumDeviceResources PhDevFreeObjectProperties PhRemoveStringBuilder PhFinalStringBuilderString PhSaveListViewColumnsToSetting PhCreateThread2 PhDevGetObjectProperties PhShowEMenu PhAddListViewItem PhGetDeviceIcon PhGetDpi PhGetWindowDpi PhGetDeviceProperty PhFormatDateTime PhDestroyEMenu PhFree PhAppendStringBuilderEx PhSetWindowText PhGetListViewContextMenuPoint PhGetIntegerPairStringRefSetting PhDeleteStringBuilder PhHandleListViewNotifyBehaviors PhImageListSetIconSize PhImageListCreate PhGetOwnTokenAttributes PhRemoveWindowContext PhGetSystemMetrics PhCopyListView PhModalPropertySheet PhCreateList PhDereferenceObjectDeferDelete PhDeleteCircularBuffer_ULONG64 PhfReleaseQueuedLockShared PhCreateObjectType PhCreateFile PhCountStringZ PhStringToGuid PhfWakeForReleaseQueuedLock PhAddItemList PhRemoveItemList PhGetIntegerStringRefSetting PhInitializeCircularBuffer_ULONG64 PhfAcquireQueuedLockShared PhCreateStringEx PhReferenceObjectSafe PhFindItemList PhCreateObject PhConcatStringRef2 PhReferenceObject PhfAcquireQueuedLockExclusive PhSetDialogItemText PhDereferenceObject

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlCaptureContext RtlPcToFileHeader NtQueryVolumeInformationFile NtClose

user32

GetParent GetDlgItem DestroyIcon SendMessageW GetWindowRect DefWindowProcW CallWindowProcW MapWindowPoints GetClassNameW GetAncestor GetCursorPos SetWindowLongPtrW GetWindowLongPtrW SetWindowPos MapDialogRect DeferWindowPos BeginDeferWindowPos EndDeferWindowPos GetClientRect GetMessageW DestroyWindow InvalidateRect IsDialogMessageW TranslateMessage PostQuitMessage PostMessageW ShowWindow UpdateWindow SetForegroundWindow IsIconic CreateWindowExW SetFocus DispatchMessageW

gdi32

D3DKMTQueryAdapterInfo D3DKMTOpenAdapterFromDeviceName D3DKMTQueryStatistics D3DKMTCloseAdapter GetStockObject SetTextColor SetDCBrushColor SetBkMode

comctl32

CreatePropertySheetPageW

kernel32

LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError InterlockedFlushSList GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId ExitProcess IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA GetProcAddress GetModuleHandleW FreeLibrary VirtualQuery VirtualProtect GetSystemInfo GetLastError RaiseException GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetModuleHandleExW GetModuleFileNameW EncodePointer HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW QueryPerformanceCounter GetACP WideCharToMultiByte FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW IsValidCodePage

Name

.text

Size

200KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

100KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/HardwareDevices.pdb

SHA256 c4a06f1d8683c71039e217688cfa3d0a028893ac4b6f2032a391df5d03eef462
MD5 a4d70b97ba5539438ef348b92b1b3a4a
SHA1 063c8a4ab378df8932f1e4269cd88c8bbf327245
SHA512 43b9559b47db4af68f25186d5bc89e330f0f66e27d0c4386f92ecaca4c188e806ba5fb51401565f2d0b28076edb9625756efd1213612cfa5d3457a89929064f5
SSDEEP 98304:WMUGWnp6D/bhC4uk07ozOlls64EPhaVxzkV6U0rsDcEbjuAGh5yQk:WMIhaVxzkV6U0rsDcEbjuAGh5yQ
TLSH
T142369D07BA88DD63C40F06B9719B1B6DD3E8C5029BCE97D68E88E3494DD6384DF2E641
MD5 SHA1 SHA512 SSDEEP TLSH

plugins/NetworkTools.dll

IMPHASH d8b53ad2805f8a5317a6cb09e044cb15
SHA256 f4ebff46d5e8b88b7d2b4bc76c452cef93958eed21eadb6c9b6dbcce0a40ba1f
MD5 51b31d6d1c0ba1ad0538d16fad255620
SHA1 986e5d271cad110f354249c558b8014926803078
SHA512 90f4e390053dfd37a40bbcb8ee9aa43b5acb85f5ba2c4d6d59da5769bccc5bd18b553299c0abfb2028d92be5f73665983043e99a4f60d872bfd371ab8cea51f7
SSDEEP 6144:+ajPV8UzSGk2V3+er+Jp1VsW9ZDa2zTj8kFdU62iAoohk1VoXnjTJLzioE85Bhx:nZHiK3/+Jph9lT4UUvoKk12z9LzhE8
TLSH
T11DF4E585B7E5462CF4B78F30887705209B3A3D511E51F98E0290A02FED7EB98DA75F26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

66144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

NetworkTools.pdb

systeminformer.exe

PhLoadWindowPlacementFromSetting PhSetApplicationWindowIcon PhAddLayoutItemEx PhGraphStateGetDrawInfo PhDeleteGraphState PhUnregisterCallback PhSiSetColorsGraphDrawInfo PhDeleteAutoPool PhPluginInvokeWindowCallback PhConvertUtf16ToUtf8Ex PhInitializeGraphState PhCreateDialog PhDivideSinglesBySingle PhSaveWindowPlacementToSetting PhAllocate PhQueryPerformanceCounter PhCreateObjectType PhFormat PhGenerateRandomAlphaString PhfSetEvent PhHttpGetErrorMessage PhGetApplicationIcon PhShellProcessHacker PhGetStatusMessage PhCreateSimpleHashtable PhFindItemSimpleHashtable PhAddItemSimpleHashtable PhSetFlagsEMenuItem PhIpv6AddressToString PhIpv6StringToAddress PhInsertCopyCellEMenuItem PhConcatStrings PhDnsQuery PhDestroyEMenu PhFindStringInStringRef PhShowEMenu PhFinalStringBuilderString PhRemoveStringBuilder PhSetClipboardString PhDnsReverseLookupNameFromAddress PhHexStringToBuffer PhGetWin32Message PhHandleCopyCellEMenuItem PhCreateEMenu PhAppendFormatStringBuilder PhDnsFree PhInitializeStringBuilder PhDnsQuery2 PhGetTreeNewText PhCmSaveSettings PhSetIntegerPairStringRefSetting PhClearHashtable PhQueueItemWorkQueue PhInitializeTreeNewColumnMenuEx PhAddItemList PhDeleteTreeNewColumnMenu PhCmLoadSettings PhClearList PhSetControlTheme PhCreateList PhfResetEvent PhDeleteCacheFile PhGetBaseDirectory PhNtStatusToDosError PhConcatStringRef2 PhHttpReadData PhDoesFileExistWin32 PhHttpSendRequest PhShowTaskDialog PhHttpQueryHeaderString PhHttpReceiveResponse PhHttpInitialize PhCreateDirectoryFullPathWin32 PhUpdateHash PhHttpBeginRequest PhShowMessage2 PhRegisterWindowCallback PhGetApplicationDirectoryFileName PhMoveFileWin32 PhHttpDestroy PhCreateProcessRedirection PhCreateFileWin32Ex PhHttpQueryHeaderUlong PhDeleteFileWin32 PhfWaitForEvent PhFormatString PhBufferToHexString PhFinalHash PhCreateCacheFile PhInitializeHash PhUnregisterWindowCallback PhHttpConnect PhFormatToBuffer PhHttpSetCredentials PhCreateThreadEx PhGetSystemDirectory PhZeroExtendToUtf16Ex PhDeleteStringBuilder PhLoadLibrary PhReAllocate PhFormatBytes PhShowStatus PhCreateString3 PhStringToInteger64 PhFindEMenuItem PhCopyCircularBuffer_FLOAT PhCreateThread2 PhFormatString_V PhGetWindowDpi PhCreateObject PhDeleteWorkQueue PhSetGraphText PhInitializeAutoPool PhFree PhIpv4AddressToString PhSetWindowText PhGetIntegerPairStringRefSetting PhCreateCommonFont PhDrainAutoPool PhInitializeWorkQueue PhInitializeCircularBuffer_FLOAT PhDeleteCircularBuffer_FLOAT PhAddPlusMaxMemorySingles PhQueryPerformanceFrequency PhGetStatisticsTimeString PhSetWindowContext PhWindowThemeControlColor PhInitializeLayoutManager PhDeleteLayoutManager PhFreeFileDialog PhShowFileDialog PhEqualStringRef PhDialogBox PhGetWindowText PhSetFileDialogFilter PhCreateOpenFileDialog PhGetStringRefSetting PhSplitStringRefAtString PhInitializeWindowTheme PhGetFileDialogFileName PhSetIntegerStringRefSetting PhReferenceEmptyString PhGetDialogItemValue PhGetWindowContext PhSplitStringRefAtChar PhSetStringRefSetting PhSetDialogItemText PhAddLayoutItem PhAutoDereferenceObject PhCenterWindow PhFileReadAllTextWin32 PhLayoutManagerLayout PhRemoveWindowContext PhShellExecute PhSetDialogItemValue PhInsertEMenuItem PhFormatSize PhPluginCreateEMenuItem PhCountStringZ PhCreateEMenuItem PhCompareStringRef PhAddSettings PhGetIntegerStringRefSetting PhGetGeneralCallback PhIpv4StringToAddress PhPluginSetObjectExtension PhCreateStringEx PhChoiceDialog PhRegisterCallback PhPluginAddTreeNewColumn PhRegisterPlugin PhGetPluginCallback PhPluginGetObjectExtension PhGetOwnTokenAttributes PhFormatUInt64 PhAddEntryHashtable PhQuerySystemTime PhfReleaseQueuedLockShared PhConvertUtf8ToUtf16Ex PhfWakeForReleaseQueuedLock PhfEndInitOnce PhLoadImageFormatFromResource PhCreateHashtable PhImageListDrawIcon PhfAcquireQueuedLockShared PhTimeToSecondsSince1970 PhReferenceObject PhGetApplicationDataFileName PhfAcquireQueuedLockExclusive PhImageListAddBitmap PhImageListCreate PhDereferenceObject PhfBeginInitOnce PhHandleTreeNewColumnMenu PhFindEntryHashtable

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlCaptureContext RtlPcToFileHeader NtMapViewOfSection NtCreateFile NtUnmapViewOfSection NtQueryInformationFile NtCreateSection NtClose NtWriteFile RtlIpv6AddressToStringExW

kernel32

GetFileType GetStdHandle HeapFree HeapAlloc GetModuleFileNameW GetModuleHandleExW ExitProcess EncodePointer LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError InterlockedFlushSList GetStartupInfoW FindFirstFileExW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA GetProcAddress GetModuleHandleW FreeLibrary VirtualQuery VirtualProtect GetSystemInfo RaiseException GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW FindClose IsDebuggerPresent IsValidCodePage MultiByteToWideChar WideCharToMultiByte FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetProcessHeap GetStringTypeW SetStdHandle SetFilePointerEx GetLastError WriteFile GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc FlushFileBuffers CloseHandle CreateFileW WriteConsoleW FindNextFileW

user32

DrawTextW GetParent GetDlgItem EndDialog SendMessageW SetFocus CallWindowProcW IsIconic EnableWindow GetMessageW PostMessageW DestroyWindow SetWindowLongPtrW CreateWindowExW GetWindowLongPtrW ShowWindow DispatchMessageW IsDialogMessageW IsChild TranslateMessage InvalidateRect SetForegroundWindow PostQuitMessage

gdi32

DeleteObject CreateFontIndirectW

Name

.text

Size

152KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

308KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

104KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

116KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/NetworkTools.pdb

SHA256 99e25d732142021d497a704f6b2b34901867d6d2baf28f7e901dbf25b8163632
MD5 1e902b53acee9c7c1288c3da541b8bdf
SHA1 4fc0ac782e64de0e77b32846f505734a4e8f8974
SHA512 dce89516b4ed8d1baeb810e0138bfdc6925ebaa60a1fb5226839f24183670cdc6e71ca0670cdbde7fd11776f97cc826379214a5b840d0a3ad11917333faa90ad
SSDEEP 24576:nod3nEPLiIy9dXjnu80gTPzKfgUsgZ4rA/v//zt/ktzz98k8h5izOw:nIUvsPzGxv//zt/ktyxh5i6
TLSH
T17F466B47BAC6AD63C10F06B5B0A7832EF6E5C8028BCB93D65C44F7925DD2380AF5D661
MD5 SHA1 SHA512 SSDEEP TLSH

plugins/OnlineChecks.dll

IMPHASH cd0a6be533fa713bdf7f1bcd8249a147
SHA256 f3692f13754254233a7b188fe71c27e255bb51f970eaaf0f8e715ed39ab87c23
MD5 e697036f736f5e1fe6528ee88e179606
SHA1 20632a7ba580fb4ef3cd9b56f13479efe7e29345
SHA512 c3b6900c4f6ecab95301e6b36b64104c619b9e294a8fbcfd9c297621c24cdaa2762f22cd1ddeb3b5b0027ad3ffd838bee6a3703aa567c10fe2697cb6c2adad5e
SSDEEP 3072:Wiy/R9SIy5HnSzoDYwCOEq6sCbYfltS++7h+Y7ENp+FRtJCSi83zyl46nm+:3y/bcSzSdHgRDp6
TLSH
T182F3395773E500ABE0B7963888A74A42E7737C115731DBEF0260855A1F23BD1AD39F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

25712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

OnlineChecks.pdb

systeminformer.exe

PhSetThreadIoPriority PhCreateFile PhCreateObjectType PhFormat PhBufferToHexString PhGenerateRandomNumber64 PhFinalHash PhTaskbarListDestroy PhFormatSize PhQuerySystemTime PhGetFileSize KsiLevel PhInitializeHash PhHttpConnect PhFormatToBuffer PhSetWindowContext PhGetJsonValueAsString PhGetJsonObject PhFreeJsonObject PhConvertUtf8ToUtf16 PhFree PhFormatDateTime PhGetJsonObjectAsArrayList PhAddItemList PhSecondsSince1970ToTime PhAllocate PhFormatTimeSpanRelative PhLargeIntegerToLocalSystemTime PhCreateList PhFormatString PhCreateJsonParserEx PhHttpQueryHeaderUlong PhCountStringZ PhConvertUtf16ToUtf8Ex PhPluginInvokeWindowCallback PhInitializeStringBuilder PhConcatStrings2 PhAppendFormatStringBuilder PhHttpGetErrorMessage PhHttpDestroy PhfEndInitOnce PhDeleteAutoPool PhSetFilePosition PhShowStatus PhHttpBeginRequest PhUpdateHash PhGetBaseName PhHttpInitialize PhGetWindowContext PhLoadMappedImageEx PhSetApplicationWindowIcon PhCreateStringEx PhHttpReceiveResponse PhCreateThread2 PhSetThreadBasePriority PhTaskbarListCreate PhShowTaskDialog PhHttpWriteData PhHttpSendRequest PhHttpDownloadString PhCreateObject PhInitializeAutoPool PhUnloadMappedImage PhConcatStrings PhDeleteStringBuilder KsiQueryHashInformationFile PhHttpAddRequestHeaders PhGetServiceFileName PhGetJsonValueAsUInt64 PhSetFileIoPriorityHint PhHttpCrackUrl PhfBeginInitOnce PhRemoveWindowContext PhFormatUInt64 PhTaskbarListSetProgressValue PhTaskbarListSetProgressState PhGetApplicationIcon PhGetGlobalWorkQueue PhQueueItemWorkQueue PhFormatString_V PhReferenceObject PhWindowThemeControlColor PhDialogBox PhGetWindowText PhGetStringRefSetting PhInitializeWindowTheme PhGetIntegerStringRefSetting PhSetIntegerStringRefSetting PhSetStringRefSetting PhSetDialogItemText PhCenterWindow PhShellExecute PhInsertEMenuItem PhFreeFileDialog PhPluginCreateEMenuItem PhShowFileDialog PhCreateEMenuItem PhCompareStringRef PhSetFileDialogFilter PhFindEMenuItem PhCreateOpenFileDialog PhAddSettings PhGetFileDialogFileName PhGetGeneralCallback PhPluginSetObjectExtension PhIndexOfEMenuItem PhAutoDereferenceObject PhRegisterCallback PhPluginAddTreeNewColumn PhRegisterPlugin PhGetPluginCallback PhPluginGetObjectExtension PhDereferenceObject

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlCaptureContext RtlPcToFileHeader NtQueryInformationThread NtClose NtReadFile

user32

DrawTextW GetParent GetDlgItem GetWindowLongPtrW EndDialog CallWindowProcW PostMessageW IsWindowVisible IsIconic SetWindowLongPtrW SendMessageW

kernel32

LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapFree HeapAlloc GetModuleFileNameW GetModuleHandleExW ExitProcess RaiseException EncodePointer LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError InterlockedFlushSList GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW

Name

.text

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/OnlineChecks.pdb

SHA256 28ff651079a6a9bb3d99b4df9720658541acc8fd16188eab66402c1b56b49585
MD5 c103486234ebb2ab93df557677b3e907
SHA1 583aa409d7b47f392a6c3569016ad91c8058fca1
SHA512 c192f86f7b6508da81b39fc1d909643a0d7c68f64771c87ae1e2f3dd5bac868e33cd5b02bbc33635b579bfb0ac4d9b22792aed14a547dd697adee6d98e7d9017
SSDEEP 24576:m9Nk7FDdEwK1xNTgHngkUI/JY/8lqRB0PBuAiG:m1Xcf/JY/yQAi
TLSH
T115169E17BB489E73C40F1679A0AB172ED3D4D503ABCE6BDB9A84A6414CE7380DF1E641
MD5 SHA1 SHA512 SSDEEP TLSH

plugins/Updater.dll

IMPHASH 4466218ce9cb31facaee45a3d26b402e
SHA256 91e93da007a03981e082d0a064f72fca84b5039648046928353136a2fe5fd0e2
MD5 7e7eea62aa9def69aaa0dccbf569e0bd
SHA1 0201bc3918431dc5be81a430617c6202bc694c0e
SHA512 7d5afd3b215d60e264f5907ac9d734195c293f5df810d5cffeb61bbe0da1e95520c305c52e317303ec09f76a552dea0818e7d046474475733207cc9707e6822f
SSDEEP 3072:9rV2H0l+XsTCQutSafhXoZbmD/svsRCHvBjgKLsWJbh3v4X4nuwjdUTFNd+RB9fd:9rUUl0sGZnpXVDSod55
TLSH
T12504391773E501ABE177867888634A15FB7378215721ABEF0260827E1F737D1AE39B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

29856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Updater.pdb

systeminformer.exe

PhWindowThemeControlColor PhCreateList PhHttpConnect PhFormatToBuffer PhSetWindowContext PhHandleCopyListViewEMenuItem PhGetJsonValueAsString PhGetJsonObject PhGetSelectedListViewItemParams PhfSetEvent PhGetApplicationIcon PhHttpGetErrorMessage PhFormatString PhGetStatusMessage PhHttpSetFeature PhfResetEvent PhDeleteCacheFile PhfBeginInitOnce PhHttpCrackUrl PhGetKernelFileNameEx PhHttpAddRequestHeaders PhConcatStrings PhTimeToSecondsSince1970 PhHttpReadData PhUnloadMappedImage PhInitializeAutoPool PhCreateObject PhShowTaskDialog PhDelayExecution PhQueueItemWorkQueue PhRemoveStringBuilder PhShellExecuteEx PhGetGlobalWorkQueue PhLoadMappedImageHeaderPageSize PhInsertCopyListViewEMenuItem PhShowMessage2 PhRegisterWindowCallback PhShowStatus PhReadFile PhGetApplicationDirectoryFileName PhDeleteAutoPool PhAllocateSafe PhfEndInitOnce PhClearCacheDirectory PhGetFileVersionInfoEx PhPluginInvokeWindowCallback PhDialogBox PhCreateFileWin32Ex PhHttpSetProtocol PhHttpQueryHeaderUlong PhGetFileVersionFixedInfo PhIsExecutingInWow64 PhfWaitForEvent PhCreateFile PhCreateObjectType PhConvertUtf8ToUtf16Ex PhBufferToHexString PhFinalHash PhSplitStringRefAtLastChar PhFormatSize PhCreateCacheFile PhGetFileSize PhInitializeHash PhUnregisterWindowCallback PhCreateThreadEx PhCreateKsiSettingsBlob PhHexStringToBufferEx PhFreePage PhAllocatePage PhStringToUInt64 PhSystemTimeToTzSpecificLocalTime PhQuerySystemTime PhInitializeLayoutManager PhLargeIntegerToLocalSystemTime PhDeleteLayoutManager PhFormat PhSetListViewSubItem PhFindListViewItemByFlags PhSetControlTheme PhFormatTimeSpanRelative PhAllocate PhGetJsonArrayLength PhSaveWindowPlacementToSetting PhSecondsSince1970ToTime PhGetPhVersionHash PhFreeJsonObject PhEqualStringRef PhCreateJsonParserEx PhSaveListViewSortColumnsToSetting PhCreateEMenuItem PhSetExtendedListView PhInitializeStringBuilder PhGetSelectedListViewItemParam PhConcatStrings2 PhAddListViewColumn PhHttpDestroy PhCreateEMenu PhAddItemList PhCreateString3 PhInitializeWindowTheme PhLoadListViewColumnsFromSetting PhGetJsonObjectType PhGetPhVersionNumbers PhReferenceEmptyString PhHttpBeginRequest PhDuplicateFontWithNewWeight PhGetJsonArrayIndexObject PhHttpInitialize PhGetWindowContext PhSplitStringRefAtChar PhSetDialogItemText PhLoadWindowPlacementFromSetting PhCreateStringEx PhGetListViewItemParam PhFinalStringBuilderString PhSaveListViewColumnsToSetting PhHttpReceiveResponse PhHandleListViewNotifyForCopy PhCreateThread2 PhAddLayoutItem PhShowEMenu PhAddListViewItem PhFormatString_V PhFindStringInStringRef PhAutoDereferenceObject PhGetWindowDpi PhHttpSendRequest PhAppendCharStringBuilder PhHttpDownloadString PhFormatDateTime PhCenterWindow PhDestroyEMenu PhFree PhReferenceObject PhAppendStringBuilderEx PhGetListViewContextMenuPoint PhLoadListViewSortColumnsFromSetting PhGetIntegerPairStringRefSetting PhGetJsonValueAsUInt64 PhSetApplicationWindowIconEx PhFormatDate PhGetListViewItemText PhLayoutManagerLayout PhRemoveWindowContext PhShellExecute PhCopyListView PhInsertEMenuItem PhPluginCreateEMenuItem PhGetStringRefSetting PhAddSettings PhGetIntegerStringRefSetting PhSetIntegerStringRefSetting PhGetGeneralCallback PhSetStringRefSetting PhRegisterCallback PhRegisterPlugin PhGetPluginCallback PhGetPhReleaseChannel PhUpdateHash PhDereferenceObject

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlCaptureContext RtlPcToFileHeader NtClose NtWriteFile

user32

GetParent GetDlgItem GetSysColor EndDialog SendMessageW CallWindowProcW GetWindowLongPtrW ShowWindow SetForegroundWindow IsIconic KillTimer SetWindowLongPtrW PostMessageW SetTimer

gdi32

DeleteObject SelectObject

kernel32

InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapFree HeapAlloc GetModuleFileNameW GetModuleHandleExW ExitProcess EncodePointer LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError InterlockedFlushSList GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA GetProcAddress GetModuleHandleW FreeLibrary VirtualQuery VirtualProtect GetSystemInfo GetLastError RaiseException GetProcessHeap GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW LCMapStringW

Name

.text

Size

80KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/Updater.pdb

SHA256 70b938ace4b0278d8e9be77b52d9d5d76bfbb06a28230b646ffdb21116a47d95
MD5 e2a88af8cc09d9d5723f632e106fe398
SHA1 0058767beb09303319c449822d686e70a47eca1c
SHA512 ffdeb80b49cab3ae5b2a830f29d47d70b96ac2ea11116f7033a278abac4a107fa19356a6001b50fd22c6bc96cb0065afe83ad957b1be5f08068142ba0fb3fc13
SSDEEP 24576:5sGLDxINni8bRgLpg0/cc/h/JSKcy8Ai:1Mbwr/h/Jt8Ai
TLSH
T1FB169D1BFB449D73C40B0679A1AB1B6DD3C4D1036BCA6BDB9E44F2444DEB3849F2A681
MD5 SHA1 SHA512 SSDEEP TLSH

plugins/UserNotes.dll

IMPHASH ffe58b2414f14771d5149c69f74c20dd
SHA256 1d5459e5094422c60514da2904b67e0e12696dd7e9bb19865e3a488ab0a99851
MD5 64ec015d30c658d89b7ba205c028fe3f
SHA1 9b63360c2869656c7d046f3372d18c8700a1b193
SHA512 0377933842f858863b7c25da84528b8c3df4301c038412bff2773baf91292bdd167ef90b943948e5418a3bea064afb774ba8965d67518cb8b7cbf1dfc1ffc3d3
SSDEEP 3072:QSnEIFWcRZLA7Xrt6OCYw+kmRgXhkzYqgLUtkEWbNcPhvAdh9s45kqDqMFhC7d:TBRZLqci3/8p7D3C7
TLSH
T19C042A5773E500ABE1B79674C8A34642E77378215B329BEF026482791F337D0AD3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

38656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

UserNotes.pdb

systeminformer.exe

PhShowStatus PhGetFileDialogFileName PhGetApplicationDirectoryFileName PhAddSettings PhfEndInitOnce PhGetProcessPriorityClass PhCreateOpenFileDialog PhFindEMenuItem PhSetFileDialogFilter PhCompareStringRef PhGetProcessPowerThrottlingState PhPluginInvokeWindowCallback PhGetApplicationIcon PhCreateEMenuItem PhShowFileDialog PhLoadCustomColorList PhPluginCreateEMenuItem PhSetProcessItemPriority PhFreeFileDialog PhInvalidateAllProcessNodes PhOpenProcess PhGetProcedureAddress PhGetPluginInterface PhGetKnownLocation PhGetStatusMessage PhRemoveEMenuItem PhInsertEMenuItem PhCopyListView PhFindListViewItemByParam PhGetListViewContextMenuPoint PhDestroyEMenu PhAddListViewItem PhShowEMenu PhSaveListViewColumnsToSetting PhRemoveListViewItem PhLoadListViewColumnsFromSetting PhCreateEMenu PhAddListViewColumn PhSetExtendedListView PhSetControlTheme PhSetListViewSubItem PhInsertCopyListViewEMenuItem PhHandleCopyListViewEMenuItem PhGetSelectedListViewItemParams PhSaveCustomColorList PhGetGeneralCallback PhShowMessage2 PhGetBaseName PhLoadMappedImageHeaderPageSize PhPluginSetObjectExtension PhSetProcessItemIoPriority PhAddProcessPropPage PhGetSelectedProcessItems PhShowProcessAffinityDialog2 PhIndexOfEMenuItem PhSetProcessItemPagePriority PhRegisterCallback PhShowTaskDialog PhGetWindowDpi PhLoadLibrary PhGetSelectedProcessItem PhUnloadMappedImage PhPluginAddTreeNewColumn PhRegisterPlugin PhGetPluginCallback PhCreateProcessPropPageContextEx PhSetApplicationWindowIconEx PhDosPathNameToNtPathName PhPluginGetObjectExtension PhSetProcessItemThrottlingState PhDuplicateProcessNodeList PhfBeginInitOnce PhSetProcessItemAffinityMask PhSetProcessItemPriorityBoost PhIntegerToString64 PhFormatToBuffer PhSaveXmlObjectToFile PhConcatStringRef3 PhGetXmlNodeOpaqueText PhHashStringRefEx PhConvertUtf16ToUtf8Ex PhRemoveEntryHashtable PhSetXmlNodeAttributeText PhCreateXmlOpaqueNode PhDoesFileExist PhAddEntryHashtableEx PhFreeXmlObject PhCreateKey PhStringToInteger64 PhfWakeForReleaseQueuedLock PhGetXmlNodeNextChild PhCreateHashtable PhCreateStringEx PhGetXmlNodeFirstChild PhDeleteFile PhCreateXmlNode PhConcatStringRef2 PhConvertUtf8ToUtf16 PhfAcquireQueuedLockExclusive PhEnumHashtable PhQueryRegistryUlong PhGetOwnTokenAttributes PhLoadXmlObjectFromFile PhDeleteValueKey PhOpenKey PhFindEntryHashtable PhGetXmlNodeAttributeCount PhSetValueKey PhGetXmlNodeAttributeByIndex PhSetWindowContext PhWindowThemeControlColor PhInitializeLayoutManager PhDeleteLayoutManager PhAllocate PhEqualStringRef PhGetWindowText PhPropPageDlgProcHeader PhInitializeWindowTheme PhGetIntegerStringRefSetting PhReferenceEmptyString PhGetWindowContext PhSetDialogItemText PhDoPropPageLayout PhAddLayoutItem PhFormatString_V PhAutoDereferenceObject PhCenterWindow PhFree PhReferenceObject PhLayoutManagerLayout PhDereferenceObject PhRemoveWindowContext PhPluginAddMenuHook PhAddPropPageLayoutItem

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader RtlCaptureContext NtQueryInformationProcess NtClose NtDeleteKey

user32

EnableWindow GetParent GetDlgItem SendMessageW SetWindowLongPtrW MessageBoxW SetWindowTextW

comctl32

CreatePropertySheetPageW

kernel32

LCMapStringW InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapFree HeapAlloc GetModuleFileNameW GetModuleHandleExW ExitProcess EncodePointer LoadLibraryExW GetProcessHeap TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError InterlockedFlushSList GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA GetProcAddress GetModuleHandleW FreeLibrary VirtualQuery VirtualProtect GetSystemInfo GetLastError RaiseException GetStringTypeW HeapSize HeapReAlloc SetStdHandle TlsFree GetFileType FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW GetStdHandle

Name

.text

Size

88KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/UserNotes.pdb

SHA256 1444c6202eb5bcd0a7b7f9882b714466cccf3f771a439d4be143aaa57d1ac717
MD5 76b2b9cc79a4080647a768d19de1fa29
SHA1 3d87923397da6e4c40d16f86fce7a793bc83a617
SHA512 efa0b616ff51719b17f0b1f5d4e3380123d71400fd344d53f4560225f7b4b89086807d856e0f45fb044e3bec636eadfee6017cb901a369de907548b5d4270781
SSDEEP 24576:pTBc8qxKkXPU5dcgxPginOnk/j8Z/JwAiozQc:4Uzr/W/JwAiC
TLSH
T15E168D17FB489D73C40B1679A0AB176EC3D4D5036BCD6AD79A88E6804CE7388DF2A741
MD5 SHA1 SHA512 SSDEEP TLSH

plugins/WindowExplorer.dll

IMPHASH a98702f1b011c488f2b49f07afefa84b
SHA256 26c1ae54342e03e5f6bbb058860f34cc9e81b344a28395f5b5bd937609799848
MD5 d5cff131b1eb1291e5bc1715cae5d833
SHA1 502d7d4fd049a33d3c951629bb9b4d315ad2ad49
SHA512 19b5b4c75ffb22db8e8165c36dd2f452eb322430b9a8d11a5d433d2c9d6bacc04c2422c6177c31b9c36280de5448b24068191cb68c81f57772763073dc4546d0
SSDEEP 3072:WqaP/ygWfVQQi/7oygBoHVE06HbfYYafbXP9vx+8OB4kqhi8:WCffC/s9BoWHzsK83h
TLSH
T17914294B73E5006AF57792748DA78A02F7B3B86417609AEF0364C2795F233D1AD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

51408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

WindowExplorer.pdb

systeminformer.exe

PhCreateSearchControl PhSetSelectThreadIdProcessPropContext PhfWaitForEvent PhFormatString PhOpenProcess PhGetTreeNewText PhWindowThemeControlColor PhDestroyWindowRemote PhCreateThreadEx PhModalPropertySheet PhCopyListView PhCreateSymbolProvider PhHandleListViewNotifyBehaviors PhfAcquireQueuedLockExclusive PhAppResolverGetAppIdForWindow PhDeleteStringBuilder PhGetListViewContextMenuPoint PhAppendStringBuilderEx PhDosErrorToNtStatus PhAppendCharStringBuilder PhFormatString_V PhAddListViewItem PhGetWindowClientId PhCreateThread2 PhSaveListViewColumnsToSetting PhFinalStringBuilderString PhGetListViewItemParam PhQueueItemWorkQueue PhLoadSymbolProviderOptions PhRemoveStringBuilder PhGetImageListIcon PhGetGlobalWorkQueue PhLoadModulesForVirtualSymbolProvider PhGetModuleProcAddress PhLoadListViewColumnsFromSetting PhfWakeForReleaseQueuedLock PhAddListViewGroupItem PhGetSymbolFromAddress PhAddListViewColumn PhGetLastError PhAppendFormatStringBuilder PhGetWindowText PhFindProcessNode PhInitializeStringBuilder PhSetExtendedListView PhDialogBox PhEqualStringRef PhSetControlTheme PhFindListViewItemByFlags PhSetListViewSubItem PhFormatSize PhShowConfirmMessage PhAddListViewGroup PhfInitializeInitOnce PhInsertCopyListViewEMenuItem PhHandleCopyListViewEMenuItem PhGetStockApplicationIcon PhGetSelectedListViewItemParams PhFindEntryHashtable PhImageListCreate PhDeleteTreeNewFilterSupport PhCmSaveSettings PhRemoveTreeNewFilter PhSearchControlMatch PhSetStringRefSetting PhSearchControlMatchPointer PhGetProcessSmallImageList PhCreateHashtable PhClearHashtable PhImageListSetBkColor PhAddTreeNewFilter PhHandleTreeNewColumnMenu PhInitializeTreeNewColumnMenuEx PhGetStringRefSetting PhDeleteTreeNewColumnMenu PhCompareStringRef PhCmLoadSettings PhClearList PhImageListDestroy PhInitializeTreeNewFilterSupport PhImageListAddIcon PhSearchControlMatchLongHintZ PhAddEntryHashtable PhCreateDialog PhCreateEMenuItem PhPluginInvokeWindowCallback PhSetFlagsAllEMenuItems PhDuplicateFont PhPropPageDlgProcHeader PhConcatStrings2 PhCreateEMenu PhStringToInteger64 PhHandleCopyCellEMenuItem PhfEndInitOnce PhGetProcessMappedFileName PhDeleteAutoPool PhInitializeWindowTheme PhUnregisterCallback PhShowStatus PhSetClipboardString PhGetProcedureAddress PhReferenceEmptyString PhApplyTreeNewFiltersToNode PhShowMessage2 PhGetBaseName PhSetApplicationWindowIcon PhShowProcessProperties PhAddProcessPropPage PhDrainAutoPool PhfSetEvent PhDoPropPageLayout PhApplyTreeNewFilters PhShellExecuteUserString PhShowEMenu PhSelectAndEnsureVisibleProcessNode PhLoadLibrary PhGetWindowTextEx PhDoesFileExistWin32 PhInitializeAutoPool PhCenterWindow PhDestroyEMenu PhReferenceProcessItem PhInsertCopyCellEMenuItem PhSetWindowText PhHungWindowFromGhostWindow PhGetClientIdName PhGetFileName PhCreateProcessPropPageContextEx PhCreateProcessPropContext PhfBeginInitOnce PhSetFlagsEMenuItem PhfResetEvent PhAddPropPageLayoutItem PhGetWindowDpi PhGetSystemMetrics PhSetWindowContext PhInitializeLayoutManager PhDeleteLayoutManager PhCreateObjectType PhEnumChildWindows PhAllocate PhSaveWindowPlacementToSetting PhAddLayoutItemEx PhGetWindowContext PhSetDialogItemText PhLoadWindowPlacementFromSetting PhAddLayoutItem PhCreateObject PhFree PhGetIntegerPairStringRefSetting PhLayoutManagerLayout PhDereferenceObject PhRemoveWindowContext PhInsertEMenuItem PhCreateList PhaChoiceDialog PhPluginCreateEMenuItem PhCountStringZ PhFindEMenuItem PhAddItemList PhAddSettings PhGetIntegerStringRefSetting PhGetGeneralCallback PhCreateStringEx PhIndexOfEMenuItem PhAutoDereferenceObject PhRegisterCallback PhRegisterPlugin PhReferenceObject PhAddIListViewColumn PhGetPluginCallback

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader NtClose

kernel32

GetConsoleMode WriteFile FlushFileBuffers SetStdHandle HeapReAlloc HeapSize GetStringTypeW GetFileType GetStdHandle GetProcessHeap LCMapStringW InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapFree HeapAlloc GetModuleFileNameW GetModuleHandleExW ExitProcess EncodePointer LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError InterlockedFlushSList GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA GetProcAddress GetModuleHandleW FreeLibrary VirtualQuery VirtualProtect GetSystemInfo RaiseException SetFilePointerEx GetLastError CreateFileW CloseHandle WriteConsoleW GetConsoleOutputCP

Name

.text

Size

104KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/WindowExplorer.pdb

SHA256 c7ac7ca19fb7fcd98666c16bcf26f6c6a7bfe94abb5c96c7b3626836d63abe48
MD5 38f4a36a5f3fe95d73209a3e5ec256d0
SHA1 9ac9f7e367154683c71728c7b439c2da51b5a35a
SHA512 51927f8da40e8e4188e3d347889ab07fa73a3531809aff50ae886c7cb28d6e4799a3016a32b68a00240b716ce3ab9a87fed1a5de64ed268ee136a28615e37aab
SSDEEP 24576:BILiet7eJSKo6t8OL62ggsgPO88FG/NE/Dy+/J9si3ObQa3:eR7eCOhOXU/NE/L/J9si+b3
TLSH
T127168E13FB989D63C41F0679A16B076DD3D4D6036B8A6BD69D88F3804CE6384DF2E681
MD5 SHA1 SHA512 SSDEEP TLSH

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Desktop.rar

kernel.exe

comctl32

ntdll

version

kernel32

user32

gdi32

advapi32

shell32

ole32

wininet

generic

loader (1).exe

generic

plugins/DotNetTools.dll

systeminformer.exe

ntdll

kernel32

user32

generic

plugins/DotNetTools.pdb

plugins/ExtendedNotifications.dll

systeminformer.exe

user32

ntdll

kernel32

generic

plugins/ExtendedNotifications.pdb

plugins/ExtendedServices.dll

systeminformer.exe

ntdll

kernel32

user32

comctl32

generic

plugins/ExtendedServices.pdb

plugins/ExtendedTools.dll

systeminformer.exe

ntdll

kernel32

user32

gdi32

advapi32

comctl32

generic

plugins/ExtendedTools.pdb

plugins/HardwareDevices.dll

systeminformer.exe

ntdll

user32

gdi32

comctl32

kernel32

generic

plugins/HardwareDevices.pdb

plugins/NetworkTools.dll

systeminformer.exe

ntdll

kernel32

user32

gdi32

generic

plugins/NetworkTools.pdb

plugins/OnlineChecks.dll

systeminformer.exe

ntdll

user32

kernel32

generic

plugins/OnlineChecks.pdb

plugins/Updater.dll

systeminformer.exe

ntdll