1ad8694c8b94a923be6056a58c896f872c5bbfa3b8c26f3f31d601615f3fdc90.bin.zip
- SHA256 1ad8694c8b94a923be6056a58c896f872c5bbfa3b8c26f3f31d601615f3fdc90
Overview
overview
10Static
static
10xmrig-6.25...64.sys
windows10-2004-x64
3xmrig-6.25...64.sys
windows11-ltsc_2024-x64
3xmrig-6.25...0M.cmd
windows10-2004-x64
3xmrig-6.25...0M.cmd
windows11-ltsc_2024-x64
3xmrig-6.25...1M.cmd
windows10-2004-x64
3xmrig-6.25...1M.cmd
windows11-ltsc_2024-x64
3xmrig-6.25...le.cmd
windows10-2004-x64
3xmrig-6.25...le.cmd
windows11-ltsc_2024-x64
3xmrig-6.25...le.cmd
windows10-2004-x64
3xmrig-6.25...le.cmd
windows11-ltsc_2024-x64
3xmrig-6.25...le.cmd
windows10-2004-x64
3xmrig-6.25...le.cmd
windows11-ltsc_2024-x64
3xmrig-6.25...rt.cmd
windows10-2004-x64
3xmrig-6.25...rt.cmd
windows11-ltsc_2024-x64
3xmrig-6.25...ig.exe
windows10-2004-x64
1xmrig-6.25...ig.exe
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
xmrig-6.25.0/WinRing0x64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
xmrig-6.25.0/WinRing0x64.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
xmrig-6.25.0/benchmark_10M.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
xmrig-6.25.0/benchmark_10M.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
xmrig-6.25.0/benchmark_1M.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
xmrig-6.25.0/benchmark_1M.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
xmrig-6.25.0/pool_mine_example.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
xmrig-6.25.0/pool_mine_example.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
xmrig-6.25.0/rtm_ghostrider_example.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
xmrig-6.25.0/rtm_ghostrider_example.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
xmrig-6.25.0/solo_mine_example.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
xmrig-6.25.0/solo_mine_example.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
xmrig-6.25.0/start.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
xmrig-6.25.0/start.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
xmrig-6.25.0/xmrig.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
xmrig-6.25.0/xmrig.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 1ad8694c8b94a923be6056a58c896f872c5bbfa3b8c26f3f31d601615f3fdc90.bin.zip
- Size 2.6MB
- Sample260919-s8elrssgkf
- SHA256 1ad8694c8b94a923be6056a58c896f872c5bbfa3b8c26f3f31d601615f3fdc90
- MD5 3df961ea591998db915c457a46145b5f
- SHA1 067791c53ed87b6d2c0f57c99b156cbae28d5295
- SHA512 057983f86f529d2fd338fe9b3fa58d00948ba1046e6fdcd867942cd71fd0bf6d5183b625d18bd6c83484a63fd0c649717a572630c6bbf79f1076efb1a04bd041
- SSDEEP 49152:e3yFzZ3WLRH1Hu9zLyBGe7XvMrbpU7yZnDluT/xneb3:OyFzcTHdsrbyyZnDY/xne3
- TLSH T17FC533C6B261A8A7E78651FCDE178E138811CAF321D9E7939D0B4BCBF5A561C134063E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- XMRig Miner payload 2 IoCs
resource yara_rule static1/unpack001/xmrig-6.25.0/xmrig.exe xmrig static1/unpack001/xmrig-6.25.0/xmrig.exe family_xmrig - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/xmrig-6.25.0/xmrig.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/xmrig-6.25.0/WinRing0x64.sys
File Explorer
-
1ad8694c8b94a923be6056a58c896f872c5bbfa3b8c26f3f31d601615f3fdc90.bin.zip.zip 2.6MB
-
xmrig-6.25.0/SHA256SUMS748B
-
xmrig-6.25.0/WinRing0x64.sys.sys 14KB
-
xmrig-6.25.0/benchmark_10M.cmd61B
-
xmrig-6.25.0/benchmark_1M.cmd60B
-
xmrig-6.25.0/config.json2KB
-
xmrig-6.25.0/pool_mine_example.cmd1023B
-
xmrig-6.25.0/rtm_ghostrider_example.cmd1KB
-
xmrig-6.25.0/solo_mine_example.cmd821B
-
xmrig-6.25.0/start.cmd44B
-
xmrig-6.25.0/xmrig.exe.exe 6.2MB
xmrig-6.25.0/SHA256SUMS
- SHA256 1c01bf2f8bb4de145285dd8872737fc56f7f471ad7208b4cdfe36b4c50281df9
- MD5 daa7784fb77b3e5800cec6d2c030e24d
- SHA1 6437d20ccc53694c06e2b402afa6efa56d1436e9
- SHA512 1e7ce0523018ef3c566c29b0f2de809a9ae1625db9dd794bc7fd309228af784317c7c5e4fff4b48a02d229d527012bb7bca61215782a9c7e5aedb783eb2e1f87
- TLSH T18D01B55046AE509D31EC411F5FAA8CAE4C2C990833B1188F42BDABD381E48F0FF2103C
- MD5 SHA1 SHA512 TLSH
xmrig-6.25.0/WinRing0x64.sys
- IMPHASH d41fa95d4642dc981f10de36f4dc8cd7
- SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
- MD5 0c0195c48b6b8582fa6f6373032118da
- SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
- SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
- SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
- TLSH T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
26:68:21:a3:91:74:d2:9f:6f:87:91:cf:9f:44:f1:a1:f3:43:9d:da
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Chains
Jul 26, 2008
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Subject
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Serial Number
01:00:00:00:00:01:15:37:24:21:a8
Issuer
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Revocation Status
Not revoked
Timespan
Sep 24, 2007 - Sep 24, 2008
Subject
CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:00:f9:7f:aa:2e:1e
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 16, 2003 - Jan 27, 2014
Subject
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:08:d9:61:1c:d6
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jan 28, 1999 - Jan 27, 2014
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign,1.2.840.113549.1.9.1=#0c1c74696d657374616d70696e666f40676c6f62616c7369676e2e636f6d
Serial Number
04:00:00:00:00:01:10:92:eb:82:95
Issuer
CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 5, 2007 - Jan 27, 2014
Subject
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:08:d9:61:24:48
Issuer
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jan 22, 2004 - Jan 27, 2014
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
0
Major OS version
6
Entry point
20488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IoCreateDevice
MmMapIoSpace
KeBugCheckEx
IoCreateSymbolicLink
MmUnmapIoSpace
IofCompleteRequest
__C_specific_handler
hal
HalSetBusDataByOffset
HalGetBusDataByOffset
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
380B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
546B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=113, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
xmrig-6.25.0/benchmark_10M.cmd
- SHA256 235a64e3520b1c2c27763122b303f78aee8d7c083dfd9f1eb936cd5174383609
- MD5 5be1c4cacb5ae37c43527e99a097dc7a
- SHA1 1b2f00fefde9d601764d5d26d5e0fb2b9f58074c
- SHA512 20a9e18bc397fe86514875af4213a02a5831a27671370849f05c2f3ba048bc29fc41ca96f0cb1cc08aaff27bbebf637f30d2ee798cb80ed03080e8c7d8f2d9a1
- TLSH T1DEA02202882300C88283C020302F2222AC0C2083AE00380202A32032382E8000A00282
- MD5 SHA1 SHA512 TLSH
xmrig-6.25.0/benchmark_1M.cmd
- SHA256 d7747e7a3c782009f4ceb6e9c106115876386853929563b509da5258e3968d15
- MD5 cba1927cf6959dc99ecbd0c553e4db6f
- SHA1 7f2d59cfdf2b0550d22ac54d0b1fa5ac8f8b5f57
- SHA512 c78ab9b017153c497ef2d0f568ade265ae9b60238ebdb36d8ef7ecc4d232cd90fd5fdc5b600bb26437466c7300e571b95b4ff92a7f024a981a02196a14d6e3f1
- TLSH T132A00212886511C99657C561746F22A5AD0D6057AE05694216E35436386E8510A58692
- MD5 SHA1 SHA512 TLSH
xmrig-6.25.0/config.json
- SHA256 a6a710135483296b9a943dc3ed31d6a1396b5cfeb127ab0d7e5c6bf49785130a
- MD5 54e9f45448cfc5c6f2506cf89d771fd5
- SHA1 c9de25d2c995d1ba2eda402dbe03c409909b842b
- SHA512 d616e929fe91d14976a26e511ec50f8f3520924349d3eb04ab785787224f8cd53ed69ba4978a61e6e7f3b6f4e26a69d7d41b59e31d7339ee250c3ea332bae485
- TLSH T17841AD25C9780CBA0294A0BC88EDA293462881075F593C3CB54C995C2F0E73E76B6BE6
- MD5 SHA1 SHA512 TLSH
xmrig-6.25.0/pool_mine_example.cmd
- SHA256 e73491065d86b1ad69229bb5d2019e08b947e11a2a57adf5c2d9a2b5d8f4acad
- MD5 2e737f5c3af9c8aa5216dfdc5be02cc6
- SHA1 05fe2040aea6f6cff25deaf5ca2ca6793faa64c7
- SHA512 ce0e12a544623458f5905ea20f2b6f0e75cfb57add912290fbf2611eddbe98de7ffed3c9e650747967b2620e5ebbe33e249cbd60e7032bdb10c909cc516709ca
- TLSH T11D113EB986E883715101424914AF22919FD2DDB99AAB09B9227CD3E523AFCF48CE14CD
- MD5 SHA1 SHA512 TLSH
xmrig-6.25.0/rtm_ghostrider_example.cmd
- SHA256 810614290bdb14d2ddf10f65f8adc988a8272764f2a9e2c378e52fad162da344
- MD5 3f0155abe745be1f6089eafc4f517ac8
- SHA1 277f510ceb62b277b141d094c82eedebdc6f3a35
- SHA512 8def46852a962ff5dbed94e01f8d23019ef401a718d9c5a440d12b2ffa369539be328f165f68ccc2098cd5e5c939bcb5f784f877bdd7b9d939393bbd2229d19e
- TLSH T154211175029473F2062446089ABA8361DAC5B86E5B0705B4317CD36633DFDE0EFF6A9D
- MD5 SHA1 SHA512 TLSH
xmrig-6.25.0/solo_mine_example.cmd
- SHA256 33497c69c21fa96bbc96f1d7f09608e462f8ab22555364977c0bd35fef27bc29
- MD5 090703e56f46330ed625ac4363c9d25c
- SHA1 6ce0b265e0860f1913f4bb37a17aa7eda88641c5
- SHA512 1cd8c43287508c9393300d5a22c565d2f4bd98493a203112fd727518a4e439eb74035d18fe1f52e2d3594305a841ca93fcd0e3c61634f0992cfd3fc253872f19
- TLSH T11B01419AE120E3F401604101362B22C06783D0F08D69444E0EFCE59B26FE6F9EDD33E9
- MD5 SHA1 SHA512 TLSH
xmrig-6.25.0/start.cmd
- SHA256 8e70ef38fe14a2ee2848df3d6f7e260d1caf8cfc15de694d678b8af151d62333
- MD5 eaf3a00cc0465f8af471b849ada29843
- SHA1 3042e97874706189aa9704d77c9e74a94e519106
- SHA512 56b9f3991ae4bad5e06097d095931e746e6b2ac955649a5c793d9f4f6861c6ffc9316b063c34d7a8079af201354c87bf3008bc0fd4321e59b27e1d8120b078cf
- MD5 SHA1 SHA512
xmrig-6.25.0/xmrig.exe
- IMPHASH 3a3643ded1fedfee82a3324c3db3bf43
- SHA256 001816f728d96a823a88e8243cba32486ff0207c123628fa767073bb4a49cd6e
- MD5 ac458ece671fdde066ce60e448f12bc0
- SHA1 d31d5d5617a09e09df0cd3bffde6b03f48a0d540
- SHA512 f0c8d01b2ae26e2ad1f63d74831a835b37a2f95e3020b66e9a71b161408a5599f2aa4effc2079c6250cc0e9c34ada1b2a6aba771ea388c6a90ead220a840aa99
- SSDEEP 98304:N36U0mJMOqh9s03ZMza32r4vQmI4eXUMltMQXfPJFWNNrgs4u/EKgIymvloXMPwn:NL7y5h9FcJFwrgDu/nGmv6iL0Qg
- TLSH T19D569D26B7A400E8C87AC53CC6469513F7B2B81A53B0A7DB17B4967A1F336D41E3EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4145508
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
WSASetLastError
send
recv
ntohs
htons
htonl
inet_addr
inet_ntoa
gethostbyaddr
WSAGetLastError
WSAIoctl
gethostbyname
WSARecvFrom
WSASocketW
WSASend
WSARecv
gethostname
WSADuplicateSocketW
getpeername
FreeAddrInfoW
GetAddrInfoW
shutdown
socket
setsockopt
listen
connect
closesocket
bind
WSACleanup
WSAStartup
select
getsockopt
getsockname
ioctlsocket
getservbyname
getservbyport
iphlpapi
GetAdaptersAddresses
userenv
GetUserProfileDirectoryW
crypt32
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WriteConsoleW
SetConsoleTitleA
GetStdHandle
SetConsoleMode
GetConsoleMode
QueryPerformanceFrequency
QueryPerformanceCounter
SizeofResource
LockResource
LoadResource
FindResourceW
ExpandEnvironmentStringsA
GetConsoleWindow
GetSystemFirmwareTable
HeapFree
HeapAlloc
GetProcessHeap
MultiByteToWideChar
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetSystemPowerStatus
GetCurrentThread
GetProcAddress
GetModuleHandleW
GetTickCount
CloseHandle
FreeConsole
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
GetLastError
LocalFree
FlushInstructionCache
GetCurrentThreadId
AddVectoredExceptionHandler
DeviceIoControl
GetModuleFileNameW
CreateFileW
SetLastError
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
Sleep
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
SwitchToFiber
DeleteFiber
CreateFiberEx
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
FormatMessageA
GetFileType
WriteFile
GetEnvironmentVariableW
GetACP
ConvertFiberToThread
ConvertThreadToFiberEx
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
ReadConsoleA
ReadConsoleW
PostQueuedCompletionStatus
CreateFileA
DuplicateHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
QueueUserWorkItem
RegisterWaitForSingleObject
UnregisterWait
GetNumberOfConsoleInputEvents
ReadConsoleInputW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
WriteConsoleInputW
CreateDirectoryW
FlushFileBuffers
GetDiskFreeSpaceW
GetFileAttributesW
GetFileInformationByHandle
IsDebuggerPresent
InitializeSListHead
GetFullPathNameW
ReadFile
RemoveDirectoryW
SetFilePointerEx
SetFileTime
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReOpenFile
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
TryAcquireSRWLockExclusive
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
ReleaseSemaphore
GetExitCodeThread
ResumeThread
GetNativeSystemInfo
GetModuleHandleA
GetProcessAffinityMask
RtlUnwind
CreateSemaphoreA
SetConsoleCtrlHandler
GetCurrentDirectoryW
GetLongPathNameW
GetShortPathNameW
CreateIoCompletionPort
ReadDirectoryChangesW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetTempPathW
GlobalMemoryStatusEx
FileTimeToSystemTime
K32GetProcessMemoryInfo
SetHandleInformation
CancelIoEx
CancelIo
SwitchToThread
SetFileCompletionNotificationModes
LoadLibraryExW
SetErrorMode
GetQueuedCompletionStatusEx
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
GetOverlappedResult
CancelSynchronousIo
GetNamedPipeHandleStateA
GetNamedPipeClientProcessId
GetNamedPipeServerProcessId
TerminateProcess
GetExitCodeProcess
UnregisterWaitEx
DebugBreak
LoadLibraryExA
GetStartupInfoW
GetModuleFileNameA
GetVersionExA
SetProcessAffinityMask
GetComputerNameA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
RtlUnwindEx
GetFinalPathNameByHandleW
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetCommandLineA
GetCommandLineW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
ExitProcess
GetFileAttributesExW
SetFileAttributesW
GetConsoleOutputCP
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
HeapSize
HeapQueryInformation
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetFileSizeEx
SetThreadAffinityMask
EncodePointer
InitializeCriticalSectionEx
WaitForSingleObjectEx
SleepConditionVariableSRW
user32
GetLastInputInfo
MessageBoxW
GetProcessWindowStation
TranslateMessage
GetUserObjectInformationW
ShowWindow
DispatchMessageA
GetSystemMetrics
MapVirtualKeyW
GetMessageA
shell32
SHGetSpecialFolderPathA
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
advapi32
SystemFunction036
GetUserNameW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
QueryServiceConfigA
DeleteService
ControlService
StartServiceW
OpenServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
bcrypt
BCryptGenRandom
Name
.text
Size
4.2MB
Virtual Size
4.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
65KB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
172KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RANDOMX
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_TEXT_CN
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_TEXT_CN
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=203, id=261, version=33140,
count=11, id=259, version=33140,
count=10, id=259, version=35207,
count=19, id=260, version=35207,
count=96, id=261, version=35207,
count=22, id=260, version=33140,
count=386, id=1, productName=Unmarked objects,
count=23, id=257, version=33140,
count=818, id=260, version=35208,
count=265, id=265, version=35208,
count=3, id=259, version=35208,
count=1, id=255, version=35208,
count=1, id=151,
count=1, id=258, version=35208,