2026-10-01_35d5375fd3a79342a90ea260b2104dd0_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_35d5375fd3a79342a90ea260b2104dd0_icedid_njrat_ryuk
Size 2.5MB
Sample261002-vbzlsazanc
SHA256 8f4ff0d63872bfdca481890db2587a752ff9e06f13cb5bc2b8dabdafa3813b36
MD5 35d5375fd3a79342a90ea260b2104dd0
SHA1 4bc248bef96c2554c7ec463abe705b70798233d7
SHA512 08fb323b843b98c8dd709d36f6d4c8f60a7feed1364dada7c22411d6eea818f9cd9f5ce356fbc2ed959e3edd97d48afdf36aa12442a402833c37529571844bc3
SSDEEP 49152:ESKuhQf3ntMF45YOralyycc4WfvxCSNSzuvnTTaBRHq8LRxSd1LfSQyJ5:LCtWHzNSyvnWRHq4OdBfby3
TLSH
T19DC50116FA41B3F1C6D9D733866306615927DE26ECE247CB175BBA6A2F762C01F23900
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with Enigma 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Enigma

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_35d5375fd3a79342a90ea260b2104dd0_icedid_njrat_ryuk

File Explorer

2026-10-01_35d5375fd3a79342a90ea260b2104dd0_icedid_njrat_ryuk

.exe 2.5MB

2026-10-01_35d5375fd3a79342a90ea260b2104dd0_icedid_njrat_ryuk

IMPHASH e7c790298d450c5a81a557438648c92c
SHA256 8f4ff0d63872bfdca481890db2587a752ff9e06f13cb5bc2b8dabdafa3813b36
MD5 35d5375fd3a79342a90ea260b2104dd0
SHA1 4bc248bef96c2554c7ec463abe705b70798233d7
SHA512 08fb323b843b98c8dd709d36f6d4c8f60a7feed1364dada7c22411d6eea818f9cd9f5ce356fbc2ed959e3edd97d48afdf36aa12442a402833c37529571844bc3
SSDEEP 49152:ESKuhQf3ntMF45YOralyycc4WfvxCSNSzuvnTTaBRHq8LRxSd1LfSQyJ5:LCtWHzNSyvnWRHq4OdBfby3
TLSH
T19DC50116FA41B3F1C6D9D733866306615927DE26ECE247CB175BBA6A2F762C01F23900
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with Enigma
Detects executables packed with Themida
Detects executables packed with VMProtect.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7327744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AcCloneConfigSafe AmsiCheckContext AmsiDecodeBufferCallback AmsiLookupInstanceW AmsiLookupPolicySafe AmsiProcessDescriptorInternal AmsiRegisterChannelW AmsiRegisterInstanceSafe AmsiReleasePayloadA AmsiTransformChannelV2 CoreAcquireBufferCallback CoreAcquirePayload CoreAcquirePayloadFast CoreAcquireTableFast CoreAcquireTableSafe CoreAllocConfigEx CoreAllocTokenSafe CoreAttachConfigInternal CoreCloneDataA CoreCloneManager CoreCloneQueueV2 CoreComputeChannelFast CoreCreateBufferSafe CoreCreateStreamW CoreDecodeConfigDirect CoreDecodeDeviceCallback CoreDecodeObjectInternal CoreDecodeTableEx CoreDecodeTableW CoreDestroyTableSafe CoreDetachManagerV2 CoreDetachStreamEx CoreEncodePolicyA CoreEncodeStateW CoreFlushHandler CoreInitBufferEx CoreInitConfigV2 CoreInitContext CoreInitDataA CoreInitPayloadW CoreInitSessionInternal CoreLockInstance CoreLockPolicyA CoreLookupStateA CoreProcessBufferA CoreProcessEntryV2 CoreProcessTableV2 CoreQueryQueueCallback CoreQueryQueueV2 CoreRegisterProvider CoreReleaseBufferV2 CoreReleasePolicyDirect CoreReleaseProvider CoreReleaseStreamInternal CoreResolveHandlerEx CoreSyncKeyCallback CoreSyncKeySafe CoreSyncObjectA CoreSyncObjectEx CoreSyncSessionA CoreSyncTokenW CoreTransformPayloadW CoreVerifyChannelCallback CoreVerifyHandlerW CoreVerifyPayloadDirect CryptoAcquireDeviceCallback CryptoAcquireStateW CryptoAllocFilterSafe CryptoAllocSessionDirect CryptoAttachDataSafe CryptoAttachTokenV2 CryptoCloneObjectEx CryptoCloneProviderA CryptoCloneQueueFast CryptoCloneSessionA CryptoComputeDataSafe CryptoComputeInstance CryptoCreateTokenInternal CryptoDecodeChannelV2 CryptoDecodeProviderV2 CryptoDestroyChannelEx CryptoDestroyObjectDirect CryptoDetachInstance CryptoFlushDataW CryptoFlushHandlerFast CryptoFlushPayloadCallback CryptoLockConfigDirect CryptoLockProviderCallback CryptoProcessContextA CryptoProcessDescriptorV2 CryptoProtectInstanceDirect CryptoProtectManagerV2 CryptoQueryProviderA CryptoQueryToken CryptoRegisterState CryptoReleaseDescriptorInternal CryptoReleaseEntryW CryptoReleaseTable CryptoResolveKeyA CryptoResolveManagerEx CryptoResolvePolicySafe CryptoSyncChannelA CryptoSyncPayloadCallback CryptoTransformConfigV2 CryptoTransformManagerEx CryptoVerifyChannelCallback DataAcquireDescriptorFast DataAllocBufferCallback DataAllocChannelFast DataAllocFilterW DataAllocInstanceSafe DataAllocPacketFast DataAttachBufferCallback DataAttachDataInternal DataCheckConfig DataCheckEntryA DataCheckManagerSafe DataClonePacket DataCreatePayloadEx DataCreateProviderCallback DataDecodeChannelInternal DataDecodeStateV2 DataDestroyConfigCallback DataDestroyContextDirect DataDestroyPacketA DataDestroyPolicyEx DataDetachEntrySafe DataEncodeObjectW DataFlushChannelSafe DataFlushContextCallback DataFlushObjectDirect DataInitDescriptorV2 DataLockFilterInternal DataLockManagerInternal DataLockObjectSafe DataLookupKeyInternal DataLookupObjectDirect DataLookupObjectV2 DataLookupTokenCallback DataProcessProviderSafe DataProcessSessionV2 DataProtectDescriptorA DataProtectInstanceSafe DataProtectStateDirect DataQueryObjectFast DataQueryPacketW DataQueryProviderV2 DataQueryQueueCallback DataQuerySessionW DataRegisterQueueFast DataReleaseChannelEx DataReleaseContextDirect DataReleasePacketEx DataResolveContext DataResolveDescriptorDirect DataResolveEntryFast DataResolveHandlerV2 DataResolveProvider DataResolveSessionW DataSyncDescriptorCallback DataSyncObjectDirect DataSyncPayloadCallback DataTransformChannelFast DataTransformFilterDirect DataTransformPayloadDirect DataVerifyFilter DbgAcquirePacketA DbgCloneEntryInternal DbgFlushChannelFast DbgLockObjectDirect DbgReleaseChannelDirect DbgReleaseHandlerA DispatchAcquireProviderEx DispatchAttachBufferW DispatchAttachDataInternal DispatchAttachStateV2 DispatchAttachTableW DispatchAttachTokenW DispatchCheckProviderDirect DispatchCheckQueueDirect DispatchCloneContextSafe DispatchCloneTokenCallback DispatchComputeKeyInternal DispatchCreateContextCallback DispatchCreateKeyEx DispatchCreateSessionW DispatchCreateToken DispatchDecodeDataA DispatchDecodeFilter DispatchDestroySessionInternal DispatchDestroyTokenW DispatchEncodeDeviceDirect DispatchEncodePacketInternal DispatchEncodeProviderFast DispatchFlushDataEx DispatchFlushHandlerSafe DispatchFlushStateW DispatchInitManagerW DispatchLockEntryW DispatchProcessHandlerW DispatchProcessQueue DispatchProtectBufferV2 DispatchProtectKeySafe DispatchProtectPayloadDirect DispatchQueryHandlerV2 DispatchQueryInstanceFast DispatchQueryTokenFast DispatchRegisterInstanceA DispatchReleaseConfigCallback DispatchReleasePayloadCallback DispatchReleaseQueue DispatchResolveDataFast DispatchSyncContextSafe DispatchSyncInstanceA DispatchSyncManagerSafe DispatchTransformConfigCallback DispatchTransformSessionEx DispatchTransformTokenV2 DispatchVerifyConfigInternal DispatchVerifyPolicyInternal DispatchVerifyStreamDirect DriverAcquireObjectSafe DriverAcquirePolicyDirect DriverAllocObjectFast DriverCheckPacketInternal DriverCloneDeviceSafe DriverClonePacketW DriverComputeDescriptorFast DriverComputeObjectW DriverComputeSessionW DriverCreateDescriptor DriverCreateDeviceEx DriverCreatePacketW DriverDecodeProviderA DriverDestroyHandlerEx DriverDestroySessionV2 DriverDetachInstance DriverDetachInstanceDirect DriverDetachManagerInternal DriverDetachObjectInternal DriverFlushFilterA DriverFlushProviderInternal DriverInitEntryFast DriverInitPacketDirect DriverLockManagerV2 DriverLookupEntryV2 DriverLookupStreamFast DriverLookupTokenSafe DriverProcessBufferCallback DriverProcessEntrySafe DriverQueryData DriverQueryDataEx DriverQueryHandlerEx DriverRegisterEntryInternal DriverRegisterKeyA DriverRegisterManagerW DriverReleaseContextSafe DriverResolveDevice DriverResolvePacketV2 DriverResolveSessionEx DriverResolveTableSafe DriverSyncStateDirect DriverTransformHandlerFast DriverTransformHandlerW DriverVerifyChannelV2 DriverVerifyQueueCallback DriverVerifySessionSafe DriverVerifySessionV2 DriverVerifyState EngineAcquireContextEx EngineAllocBufferEx EngineAttachHandlerV2 EngineAttachPayloadV2 EngineCheckFilterSafe EngineCheckManagerCallback EngineCheckProviderV2 EngineCloneSession EngineCloneSessionV2 EngineCloneToken EngineCreateDescriptorFast EngineDecodeDescriptorW EngineDecodeDeviceEx EngineDecodeFilterEx EngineDecodePacketA EngineDecodeStreamA EngineDestroyEntry EngineDestroyPacketInternal EngineDestroySessionW EngineDestroyStreamEx EngineDestroyStreamSafe EngineDetachDeviceW EngineDetachInstanceW EngineDetachManagerA EngineDetachTokenFast EngineFlushDataCallback EngineFlushInstanceInternal EngineFlushKeyInternal EngineInitBufferDirect EngineLockConfigCallback EngineLockEntryInternal EngineProtectDeviceDirect EngineProtectManagerDirect EngineQueryPolicySafe EngineRegisterKeyA EngineRegisterStreamW EngineReleasePayloadA EngineReleaseProviderW EngineResolveData EngineResolveDevice EngineSyncEntryEx EngineSyncHandlerCallback EngineSyncProviderCallback EngineTransformBufferW EngineTransformDescriptorV2 EngineTransformPacketFast EngineTransformProviderDirect EngineVerifyData EngineVerifyFilterW EngineVerifyManagerV2 GuardAcquireChannelDirect GuardAcquireDeviceA GuardAcquirePacketEx GuardAllocKey GuardAllocProvider GuardAttachTableInternal GuardCheckHandlerW GuardCheckQueueV2 GuardCheckStreamCallback GuardCloneData GuardClonePacketSafe GuardComputeFilterA GuardComputeInstance GuardComputePolicyFast GuardCreateDeviceInternal GuardCreateKey GuardCreateStateW GuardDestroyFilterV2 GuardDestroyToken GuardDetachContextEx GuardEncodeDescriptorA GuardEncodeEntryW GuardFlushDescriptor GuardFlushHandlerV2 GuardFlushProviderSafe GuardLockConfigInternal GuardLockEntryW GuardLockKeyW GuardLookupChannelInternal GuardLookupStreamEx GuardProcessConfigA GuardProcessQueueA GuardProtectObjectW GuardProtectProviderA GuardProtectStreamSafe GuardProtectTokenW GuardRegisterBufferSafe GuardRegisterKeyInternal GuardRegisterTableCallback GuardReleaseKeySafe GuardReleaseKeyW GuardReleaseManagerFast GuardResolveObjectDirect GuardResolvePolicySafe GuardSyncManagerInternal GuardTransformFilterFast GuardTransformManagerSafe GuardVerifyObject GuardVerifyStreamA GuardVerifyTokenDirect HostAcquireDescriptorFast HostAcquirePayloadSafe HostAcquirePolicy HostAcquireQueueDirect HostAllocPayloadW HostAllocTableW HostAttachPacketInternal HostAttachStateA HostCheckConfigCallback HostClonePacket HostCloneProviderFast HostComputeKey HostCreateStreamDirect HostDecodeChannelFast HostDecodeKeySafe HostDecodePayloadV2 HostDecodeStreamEx HostDetachContextW HostDetachStreamInternal HostEncodeInstanceV2 HostEncodeManagerCallback HostEncodeTableW HostFlushConfigInternal HostFlushDescriptorCallback HostFlushPacketFast HostInitDescriptorA HostInitObjectEx HostLockEntryInternal HostLockKeyDirect HostLockStateInternal HostLookupDescriptorDirect HostLookupEntryA HostLookupManagerInternal HostQuerySession HostQuerySessionCallback HostRegisterObjectSafe HostReleaseObjectV2 HostReleasePayloadDirect HostReleaseProviderDirect HostResolveProvider HostSyncBufferCallback HostTransformPayloadA InternalAcquireObjectInternal InternalAllocContextFast InternalAllocStateInternal InternalAttachBuffer InternalAttachEntryEx InternalAttachHandlerW InternalAttachStateSafe InternalCheckPolicyW InternalCheckProviderFast InternalCloneConfigSafe InternalCloneContextA InternalCloneKeyInternal InternalCloneStreamSafe InternalComputeDescriptorInternal InternalComputeDeviceCallback InternalComputeKeyA InternalComputePayloadA InternalCreateDescriptorCallback InternalCreateFilterInternal InternalCreateQueueV2 InternalCreateStreamDirect InternalDecodeChannelCallback InternalDecodeDeviceSafe InternalDecodeFilterSafe InternalDecodeHandlerDirect InternalDecodeInstanceInternal InternalDecodeInstanceV2 InternalDecodeKeyA InternalDecodeStreamV2 InternalDestroyDeviceSafe InternalDestroyKeyCallback InternalDetachBufferInternal InternalDetachBufferV2 InternalEncodeBufferV2 InternalEncodeInstanceW InternalEncodeTokenCallback InternalFlushDataFast InternalFlushHandlerDirect InternalFlushQueueInternal InternalInitContextFast InternalInitDataCallback InternalInitPayloadFast InternalInitSessionW InternalLockContextDirect InternalLockDataInternal InternalLockTokenV2 InternalLookupFilterEx InternalLookupPacketFast InternalProcessContextCallback InternalProcessPayloadV2 InternalProtectInstanceFast InternalQueryFilterInternal InternalRegisterConfigW InternalRegisterEntry InternalRegisterKeyW InternalRegisterStateV2 InternalResolveEntryCallback InternalResolveFilterV2 InternalSyncDataA InternalSyncStateInternal InternalSyncTableA InternalTransformPolicyFast InternalTransformSessionW InternalVerifyManagerDirect InternalVerifyPacketEx KernelAcquireDataFast KernelAllocChannel KernelAllocDevice KernelAllocHandlerDirect KernelAllocManagerA KernelAllocPolicyFast KernelAllocTableW KernelAttachManagerDirect KernelAttachTableV2 KernelCheckInstanceDirect KernelCheckObjectEx KernelCheckProviderFast KernelCloneDataDirect KernelCloneDescriptorA KernelCloneDescriptorW KernelCloneDeviceV2 KernelComputeEntryA KernelComputePolicyFast KernelComputeSessionFast KernelComputeTokenDirect KernelCreateConfigEx KernelCreateContextCallback KernelCreateProviderV2 KernelCreateState KernelDestroyChannelEx KernelDestroyDataA KernelDestroyDataSafe KernelDestroyDescriptor KernelDestroyQueueInternal KernelDetachTokenV2 KernelEncodeConfigInternal KernelFlushTableInternal KernelInitBufferEx KernelInitEntryV2 KernelInitHandlerDirect KernelLookupDescriptorA KernelLookupInstanceSafe KernelLookupTokenDirect KernelProcessPolicyA KernelProcessQueueA KernelProtectBufferEx KernelQueryBufferInternal KernelQueryInstanceDirect KernelQueryObject KernelRegisterDeviceCallback KernelRegisterHandlerInternal KernelRegisterManagerFast KernelReleaseManager KernelReleaseObjectEx KernelReleaseTableDirect KernelSyncContextCallback KernelSyncTokenCallback KernelSyncTokenInternal KernelTransformDescriptor KernelTransformInstanceSafe KernelTransformPayloadFast KernelVerifySessionDirect LicenseAcquireManagerCallback LicenseAcquireObjectFast LicenseAllocConfigA LicenseAllocDescriptorW LicenseAllocEntry LicenseAttachDeviceFast LicenseAttachInstance LicenseCheckDeviceInternal LicenseCheckObjectDirect LicenseCheckQueueW LicenseCheckSession LicenseCloneBufferSafe LicenseCloneDataCallback LicenseCloneTableDirect LicenseCreateManagerCallback LicenseDecodeBufferV2 LicenseDecodeDataFast LicenseDecodeStateA LicenseDecodeStreamSafe LicenseDestroyEntryW LicenseDestroyStateA LicenseDetachPayloadInternal LicenseDetachStreamDirect LicenseDetachStreamInternal LicenseEncodeSession LicenseFlushPayloadInternal LicenseLockBuffer LicenseLockBufferSafe LicenseLockStateEx LicenseLookupDeviceFast LicenseLookupHandlerW LicenseLookupPolicyV2 LicenseLookupProviderSafe LicenseProcessInstanceV2 LicenseProcessStreamA LicenseProtectHandlerSafe LicenseProtectPolicySafe LicenseProtectProviderEx LicenseProtectSessionEx LicenseQueryBuffer LicenseQueryBufferEx LicenseQueryBufferV2 LicenseQueryChannelW LicenseQueryQueue LicenseRegisterChannelCallback LicenseRegisterPayloadDirect LicenseRegisterQueueW LicenseRegisterSessionV2 LicenseReleaseDevice LicenseReleaseEntryEx LicenseReleaseFilterFast LicenseReleaseKeyDirect LicenseResolveBufferSafe LicenseResolvePacketInternal LicenseResolvePayloadW LicenseResolveQueueEx LicenseResolveQueueFast LicenseSyncBufferA LicenseVerifyHandlerEx MemoryAcquireConfigA MemoryAcquireSession MemoryAllocPayloadSafe MemoryAttachManagerV2 MemoryCheckPacketV2 MemoryCloneDescriptorV2 MemoryCloneEntryInternal MemoryClonePayloadCallback MemoryCloneStream MemoryComputeStreamSafe MemoryComputeTableSafe MemoryCreateObjectFast MemoryDestroyConfigInternal MemoryDestroyDeviceEx MemoryDetachEntryDirect MemoryDetachStateCallback MemoryEncodeDataInternal MemoryEncodeDeviceSafe MemoryEncodeInstanceCallback MemoryEncodePolicyFast MemoryEncodeStateFast MemoryEncodeTableFast MemoryFlushChannel MemoryFlushDescriptorCallback MemoryFlushTableV2 MemoryInitDataEx MemoryInitPacketEx MemoryInitProviderFast MemoryLockManagerFast MemoryLockSessionEx MemoryLookupBufferA MemoryLookupData MemoryLookupPayloadInternal MemoryLookupQueue MemoryProcessPacket MemoryQueryBuffer MemoryRegisterHandlerV2 MemoryRegisterKey MemoryRegisterPayload MemoryReleaseConfigDirect MemoryReleaseDataCallback MemoryReleaseDescriptorCallback MemoryReleaseManagerW MemoryReleasePolicyEx MemoryResolveContextA MemoryResolvePolicyInternal MemorySyncFilterA MemoryTransformDataCallback MemoryTransformFilterSafe ModuleAcquireDescriptorFast ModuleAcquirePayloadEx ModuleAllocConfigV2 ModuleAllocPayloadDirect ModuleAllocStateInternal ModuleAttachDataA ModuleAttachProviderA ModuleCheckKeyInternal ModuleCheckPayloadV2 ModuleCheckStreamCallback ModuleCloneInstanceA ModuleComputeInstanceA ModuleComputeInstanceFast ModuleComputePacketEx ModuleComputeStateDirect ModuleCreateDataDirect ModuleDecodeChannelSafe ModuleDestroyStreamCallback ModuleDetachObjectDirect ModuleDetachObjectInternal ModuleDetachPacketA ModuleFlushBuffer ModuleFlushTokenSafe ModuleInitBufferV2 ModuleInitChannelInternal ModuleLockContextFast ModuleLookupHandler ModuleProcessPacketInternal ModuleProtectContextV2 ModuleProtectPacketDirect ModuleProtectStream ModuleQueryHandlerV2 ModuleQueryPayloadInternal ModuleRegisterChannelFast ModuleRegisterContextCallback ModuleRegisterManagerA ModuleRegisterPayloadCallback ModuleRegisterPayloadSafe ModuleReleaseDataA ModuleReleaseDescriptorInternal ModuleResolveDescriptorW ModuleSyncManagerSafe ModuleTransformSessionW NativeAcquireEntry NativeAcquirePolicyEx NativeAllocInstanceDirect NativeAllocPacketFast NativeAllocPacketSafe NativeAttachDataCallback NativeAttachQueueSafe NativeCheckDescriptorW NativeCheckManagerV2 NativeCloneDescriptor NativeClonePacketSafe NativeCloneQueueCallback NativeComputeHandlerW NativeCreatePacket NativeCreateStateFast NativeDecodeManager NativeDestroyStreamFast NativeDetachPolicyInternal NativeDetachTokenEx NativeEncodePolicyInternal NativeFlushBufferSafe NativeFlushChannelDirect NativeFlushPayloadDirect NativeFlushTableInternal NativeFlushTableSafe NativeInitDescriptorDirect NativeInitDescriptorEx NativeInitKeyEx NativeInitSessionA NativeInitSessionInternal NativeLockSessionV2 NativeLockTableA NativeLookupBufferSafe NativeLookupChannelFast NativeLookupConfigDirect NativeLookupContextDirect NativeProtectChannelEx NativeProtectEntryV2 NativeProtectObjectW NativeQueryManagerFast NativeQueryTokenSafe NativeRegisterDeviceFast NativeRegisterManagerFast NativeRegisterTable NativeReleaseConfigInternal NativeReleaseObjectEx NativeReleasePacketW NativeResolveTokenDirect NativeSyncEntryFast NativeSyncTableA NativeSyncTokenInternal NativeTransformChannelA NativeTransformDataInternal NativeTransformDescriptorCallback NativeTransformTokenCallback NativeVerifyFilterW NativeVerifyHandlerA NativeVerifyQueueDirect NetAcquireQueueInternal NetAllocQueueA NetAttachTableEx NetCheckHandlerInternal NetClonePacketA NetCloneProviderA NetComputeDataFast NetComputeDeviceA NetComputeObjectEx NetComputeProviderEx NetComputeSession NetCreateConfigSafe NetDecodeInstanceDirect NetDecodeInstanceInternal NetDecodeKeyCallback NetDecodeManager NetDecodeStateEx NetDestroyDeviceFast NetDestroyPacketFast NetDetachManagerW NetEncodeTokenA NetFlushChannelInternal NetFlushProviderSafe NetInitObjectDirect NetInitQueueFast NetInitQueueV2 NetInitTokenDirect NetLockEntryA NetLockTokenCallback NetLookupSession NetProcessEntryEx NetProcessQueueDirect NetProcessQueueFast NetProtectEntryFast NetQueryKeyDirect NetQueryStateW NetRegisterChannelInternal NetRegisterDataSafe NetRegisterFilterW NetReleaseManagerInternal NetResolveChannelCallback NetResolveConfigEx NetResolveKey NetResolvePacketEx NetResolvePayloadSafe NetSyncPolicyEx NetSyncQueueCallback NetTransformFilterW NetTransformStreamFast NetVerifyFilterCallback NetVerifyInstanceInternal NetVerifyPayloadInternal NtInitEntryDirect NtLockPacketFast NtVerifyKeyV2 PipeAcquireBufferV2 PipeAcquireEntryA PipeAcquireManagerV2 PipeAcquireToken PipeAllocEntryEx PipeAllocSessionCallback PipeAttachDeviceCallback PipeAttachDeviceInternal PipeAttachPayloadV2 PipeAttachPolicySafe PipeCheckQueueA PipeCloneFilterFast PipeCloneSessionW PipeComputePayload PipeCreatePacketW PipeDecodeBufferSafe PipeDecodeHandlerCallback PipeDestroyDescriptorSafe PipeDetachDeviceCallback PipeDetachPolicy PipeEncodeDeviceV2 PipeFlushContextCallback PipeFlushContextV2 PipeFlushManagerA PipeFlushQueueA PipeInitInstanceCallback PipeInitInstanceFast PipeInitManagerA PipeInitManagerCallback PipeLockState PipeLookupDeviceW PipeLookupObjectFast PipeProtectConfigCallback PipeProtectConfigDirect PipeProtectStateA PipeProtectStreamSafe PipeProtectTableInternal PipeQueryHandlerEx PipeQueryObjectV2 PipeRegisterConfigSafe PipeRegisterProviderA PipeRegisterQueueFast PipeRegisterSessionInternal PipeRegisterStateDirect PipeReleasePayloadFast PipeReleaseTableW PipeResolveHandlerEx PipeResolveHandlerV2 PipeResolvePayloadW PipeSyncHandler PipeSyncStreamA PipeTransformDeviceCallback PipeTransformPolicySafe PipeVerifyPayloadDirect PipeVerifyProviderV2 PluginAcquireConfigV2 PluginAcquireContextW PluginAllocHandlerCallback PluginAllocKeyEx PluginAllocQueue PluginAttachDeviceSafe PluginAttachKeyA PluginAttachManagerW PluginAttachStateA PluginCheckConfigFast PluginCheckContextCallback PluginCloneInstanceCallback PluginCloneSessionA PluginComputeHandlerEx PluginComputeObjectDirect PluginComputePacketDirect PluginComputeTable PluginDecodeBufferA PluginDecodeEntryEx PluginDecodeKeyInternal PluginDecodeQueueDirect PluginDestroyDeviceEx PluginDestroyEntryEx PluginDetachContextSafe PluginEncodeDescriptorSafe PluginEncodeManagerFast PluginEncodeManagerInternal PluginEncodePolicyDirect PluginFlushPolicyDirect PluginFlushPolicyW PluginFlushTableDirect PluginLockManager PluginLookupTableInternal PluginProcessHandlerW PluginQueryDataV2 PluginQueryStreamV2 PluginRegisterConfig PluginRegisterDataA PluginResolvePolicySafe PluginSyncBufferInternal PluginSyncBufferSafe PluginSyncConfigFast PluginSyncInstanceA PluginSyncSessionSafe PluginTransformChannel PluginTransformDescriptorA PluginTransformDeviceSafe PluginTransformPacketA PluginTransformStreamFast PluginVerifyProviderSafe PluginVerifySessionW ProtocolAllocPayloadSafe ProtocolAttachFilter ProtocolAttachHandlerFast ProtocolAttachStateDirect ProtocolCheckHandlerCallback ProtocolClonePayloadFast ProtocolCloneQueueW ProtocolCloneStateFast ProtocolCreateDeviceEx ProtocolCreateQueueA ProtocolDecodeContextInternal ProtocolDecodeDataEx ProtocolDestroyContextInternal ProtocolDestroyDataCallback ProtocolDestroyDescriptorInternal ProtocolDestroyPayloadFast ProtocolDestroyStateW ProtocolDetachConfig ProtocolDetachConfigEx ProtocolDetachKeyDirect ProtocolDetachPolicySafe ProtocolDetachTable ProtocolEncodeConfig ProtocolEncodeConfigInternal ProtocolInitChannelW ProtocolInitDataFast ProtocolInitInstanceInternal ProtocolInitTokenW ProtocolLockInstanceV2 ProtocolLockPolicyDirect ProtocolLookupData ProtocolLookupDeviceSafe ProtocolLookupPacketInternal ProtocolLookupPayloadDirect ProtocolLookupProviderInternal ProtocolLookupTableCallback ProtocolProcessDevice ProtocolProcessFilterW ProtocolProcessManagerA ProtocolProtectChannelFast ProtocolProtectFilterInternal ProtocolProtectProviderSafe ProtocolReleaseDataV2 ProtocolReleaseHandlerSafe ProtocolResolveDescriptorW ProtocolResolveStateFast ProtocolSyncBufferCallback ProtocolTransformInstance ProtocolTransformInstanceCallback ProtocolTransformKeyCallback ProtocolVerifyBufferSafe ProtocolVerifyPayloadCallback RpcAllocHandlerInternal RpcAttachDeviceCallback RpcAttachKeyW RpcAttachQueueSafe RpcCheckEntryFast RpcCheckFilterA RpcCheckTableInternal RpcCloneObjectW RpcComputeChannelSafe RpcComputeQueueSafe RpcCreateStateCallback RpcCreateStreamFast RpcDecodePolicyEx RpcDecodeTableW RpcDestroyManagerW RpcDestroySessionDirect RpcDestroyTokenA RpcDetachConfig RpcDetachDescriptorV2 RpcDetachInstance RpcDetachTokenInternal RpcEncodeObjectFast RpcEncodePolicyV2 RpcEncodeStateDirect RpcFlushFilterDirect RpcFlushState RpcInitBufferSafe RpcInitConfigV2 RpcLockHandlerFast RpcLockPayloadW RpcLockPolicySafe RpcLockStreamDirect RpcLookupDataInternal RpcLookupPacketDirect RpcProcessDescriptorDirect RpcProtectStateDirect RpcRegisterBufferSafe RpcRegisterChannelA RpcRegisterChannelV2 RpcRegisterObjectDirect RpcRegisterQueueCallback RpcReleaseHandlerCallback RpcReleaseSessionDirect RpcResolveDataEx RpcResolveEntryV2 RpcResolveHandlerA RpcResolveStreamW RpcSyncConfigCallback RpcSyncHandlerDirect RpcSyncManagerDirect RpcTransformHandlerCallback RpcTransformKeySafe RpcVerifyQueueA RtlCreatePolicyInternal RtlEncodeStateW RtlInitManagerEx RtlResolveStateCallback RuntimeAcquireDataFast RuntimeAcquireDataW RuntimeAllocObjectA RuntimeAttachPacket RuntimeAttachSessionFast RuntimeAttachTokenA RuntimeCheckBufferV2 RuntimeCloneTableA RuntimeComputeDeviceDirect RuntimeComputeObjectV2 RuntimeCreateDeviceInternal RuntimeCreateQueueEx RuntimeDecodeConfigFast RuntimeDestroyEntryFast RuntimeDestroyManagerW RuntimeDestroyStateW RuntimeDestroyStreamSafe RuntimeEncodeInstanceEx RuntimeEncodeSessionDirect RuntimeFlushContextInternal RuntimeFlushDescriptorDirect RuntimeFlushFilterDirect RuntimeFlushManagerCallback RuntimeFlushProviderV2 RuntimeFlushStreamFast RuntimeInitPacketEx RuntimeInitSessionA RuntimeLockBufferSafe RuntimeLockStreamDirect RuntimeLookupBufferDirect RuntimeLookupFilter RuntimeLookupInstanceInternal RuntimeLookupProviderInternal RuntimeProcessData RuntimeProcessEntryFast RuntimeProcessPacketCallback RuntimeProcessProviderEx RuntimeProcessTokenV2 RuntimeProtectBufferCallback RuntimeProtectDescriptorA RuntimeProtectHandlerEx RuntimeQueryPayloadEx RuntimeQueryStateDirect RuntimeQueryTokenSafe RuntimeRegisterBufferEx RuntimeRegisterObjectFast RuntimeReleaseChannelA RuntimeReleaseDeviceEx RuntimeSyncDescriptorCallback RuntimeSyncTableEx RuntimeTransformBufferFast RuntimeTransformHandlerInternal RuntimeVerifyDeviceA RuntimeVerifyTable SecAcquireBufferW SecAcquireObjectDirect SecAcquireSessionV2 SecAcquireTableSafe SecAllocPayloadCallback SecAttachStateV2 SecCheckDeviceEx SecCheckHandlerSafe SecCheckKeyEx SecCheckPayloadDirect SecCheckTableSafe SecCloneHandlerInternal SecComputeDescriptor SecComputeKeySafe SecComputeKeyV2 SecComputeSessionInternal SecCreateKey SecCreateManagerV2 SecDecodeConfigFast SecDecodeInstance SecDestroyPacketDirect SecDestroyPolicyEx SecDetachConfigV2 SecDetachManagerSafe SecFlushDescriptorDirect SecFlushFilterV2 SecFlushObjectEx SecFlushProviderDirect SecFlushProviderInternal SecFlushTokenSafe SecFlushTokenV2 SecInitPayloadA SecInitStreamA SecInitTokenCallback SecLockStateV2 SecLookupChannelInternal SecLookupContextEx SecLookupManager SecLookupPayloadEx SecProcessPacketA SecProtectInstanceA SecProtectKeyDirect SecProtectStateW SecQueryHandlerDirect SecQueryPolicyFast SecRegisterDataInternal SecRegisterKey SecReleaseBufferCallback SecResolveEntryA SecSyncContextW SecSyncProviderV2 SecTransformHandlerW SecTransformKeyEx SecVerifyBufferFast SecVerifyBufferInternal SecVerifyChannel SecVerifyDeviceW ServiceAcquireConfigW ServiceAllocConfigSafe ServiceAllocDataCallback ServiceAllocPolicySafe ServiceAllocStreamSafe ServiceAttachBufferFast ServiceAttachQueueDirect ServiceAttachSessionEx ServiceAttachTokenDirect ServiceCheckBufferA ServiceCheckPayloadEx ServiceCheckPolicyEx ServiceCloneEntryA ServiceCloneStreamV2 ServiceComputeDataFast ServiceComputeDescriptorCallback ServiceCreateHandler ServiceDecodeDataCallback ServiceDecodeHandlerW ServiceDestroyConfigFast ServiceDestroyDescriptorFast ServiceDestroyPolicyW ServiceDetachManagerCallback ServiceDetachPacketDirect ServiceEncodeObjectA ServiceEncodeObjectInternal ServiceEncodeQueueEx ServiceFlushChannelEx ServiceFlushFilterEx ServiceFlushPacketV2 ServiceInitBufferDirect ServiceInitDescriptorA ServiceInitInstanceCallback ServiceLockConfigSafe ServiceLockDescriptorInternal ServiceLockKeyDirect ServiceLockPolicy ServiceLookupContextFast ServiceLookupStateSafe ServiceProcessFilterW ServiceQueryDeviceInternal ServiceQueryPacketCallback ServiceQueryProviderV2 ServiceRegisterBufferCallback ServiceRegisterDescriptorCallback ServiceReleaseChannelDirect ServiceReleasePacketFast ServiceReleaseTableDirect ServiceResolveHandlerV2 ServiceResolveInstanceV2 ServiceResolveProviderW ServiceResolveQueue ServiceSyncQueue ServiceSyncSessionW ServiceTransformDescriptor ServiceTransformSessionV2 ServiceTransformStreamDirect ServiceVerifySessionCallback StateAllocSessionEx StateAttachStateSafe StateAttachStreamV2 StateCheckDataDirect StateCheckTableA StateCloneChannel StateCloneObjectDirect StateClonePayloadInternal StateComputeEntryDirect StateCreateDescriptorFast StateDecodeHandlerW StateDestroyEntryInternal StateDestroyHandlerA StateDetachStreamInternal StateEncodeConfigInternal StateEncodeManager StateEncodeQueueCallback StateEncodeSessionInternal StateEncodeStateSafe StateFlushKeyW StateFlushStateSafe StateInitContext StateInitPolicyW StateLockBufferV2 StateLockQueueW StateLookupKeyCallback StateLookupObjectInternal StateLookupTokenDirect StateProcessProviderCallback StateProcessProviderEx StateProtectDescriptorA StateProtectPayloadV2 StateProtectQueue StateQueryContextFast StateQueryObjectDirect StateRegisterManagerFast StateReleaseContextEx StateTransformPacketW StateTransformProviderSafe StateVerifyDescriptor StateVerifyHandlerA StateVerifyStateW StateVerifyTableFast SysAcquireChannelV2 SysAcquireDescriptorV2 SysAcquireDeviceW SysAllocDescriptorSafe SysAllocTokenSafe SysAttachDataW SysAttachFilterInternal SysAttachProviderSafe SysCheckDataSafe SysCheckDescriptorFast SysCheckKey SysCheckObjectV2 SysClonePacketDirect SysComputeContext SysComputeStateA SysCreateConfigInternal SysCreateManager SysDecodeStateInternal SysDestroyPacketV2 SysDetachEntryCallback SysDetachManagerInternal SysDetachQueueA SysDetachTableEx SysDetachTableW SysEncodeConfigA SysEncodeDataSafe SysEncodeEntryW SysEncodeTableV2 SysFlushContextW SysFlushTableV2 SysFlushTokenDirect SysInitHandlerW SysInitPolicyDirect SysLockDataV2 SysLockHandler SysLookupChannelV2 SysLookupFilterEx SysLookupPayloadW SysLookupSessionW SysProcessProviderCallback SysProcessTokenA SysProcessTokenDirect SysProtectDescriptorInternal SysProtectHandlerA SysProtectInstanceSafe SysProtectObjectV2 SysProtectSessionFast SysQueryHandlerInternal SysRegisterInstance SysReleaseFilterSafe SysReleaseSessionA SysResolveChannelA SysSyncDescriptorW SysSyncFilterCallback SysTransformDeviceFast SysTransformManagerEx SysVerifyConfigEx SysVerifyKeyCallback TokenAttachPolicyCallback TokenComputeConfig TokenComputeStateA TokenComputeStreamFast TokenDecodeBufferW TokenDecodeSession TokenDetachDataA TokenDetachDataW TokenEncodeKeySafe TokenFlushChannelA TokenInitPacketA TokenInitProviderFast TokenLockHandlerInternal TokenLockStreamCallback TokenLookupPacketW TokenProcessEntry TokenProcessInstanceEx TokenProcessInstanceFast TokenProcessKeyDirect TokenProcessSessionCallback TokenQueryConfigCallback TokenQueryManagerInternal TokenQueryProviderCallback TokenRegisterEntry TokenRegisterPayloadCallback TokenRegisterState TokenReleaseConfigInternal TokenReleaseFilterCallback TokenReleasePolicyDirect TokenResolveBuffer TokenResolveContextFast TokenSyncConfigFast TokenSyncPacketA TokenTransformDescriptor TokenTransformTokenInternal TokenVerifySession VmAcquireDeviceV2 VmAllocDescriptorW VmAttachDeviceSafe VmAttachHandler VmCheckProviderA VmCheckTokenSafe VmClonePayloadA VmComputeContextEx VmComputeEntrySafe VmComputeStateA VmComputeTableFast VmCreateSessionCallback VmCreateTokenV2 VmDecodePayloadA VmDecodeStreamCallback VmDestroyChannel VmDetachChannelCallback VmDetachConfigFast VmDetachStateW VmEncodeTokenA VmFlushBufferW VmFlushInstanceV2 VmFlushProvider VmInitDataSafe VmInitDescriptorFast VmInitManagerCallback VmInitTableDirect VmLockBufferFast VmLockSessionDirect VmProcessDescriptorCallback VmProcessDeviceInternal VmProcessHandlerInternal VmProtectPacketEx VmQueryKey VmReleaseEntry VmResolveHandler VmResolveStateFast VmResolveStreamSafe VmResolveTokenSafe VmSyncDataInternal VmSyncPolicyV2 VmSyncProvider VmSyncStateInternal VmTransformBufferInternal VmTransformPacketA VmTransformPolicyCallback VmTransformSessionW VmVerifyQueueCallback ZwAcquireHandlerV2 ZwCheckBufferV2 ZwVerifySessionEx

Name

.text

Size

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

286KB

Virtual Size

285KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

31KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.akd

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aks

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

683KB

Virtual Size

682KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text$mn

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data$mn

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text$mn

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data$mn

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text$mn

Size

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text$ic

Size

512B

Virtual Size

336B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data$r2

Size

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text$ur

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data$ms

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.hdat

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.trap2

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.shadowq

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sec5

Size

512B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

512B

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.stub2

Size

512B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.crypt6

Size

512B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.guardN

Size

512B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fakehdr

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reshook

Size

512B

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.junkN

Size

512B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.trapz

Size

512B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mask8

Size

512B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mask4

Size

512B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmc5

Size

512B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.stubW

Size

512B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.guard5

Size

512B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma2

Size

512B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.patchX

Size

512B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmc8

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dsstext

Size

512B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.junkA

Size

512B

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.stubU

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.lzxd

Size

512B

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma1

Size

512B

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sec9

Size

512B

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp7

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp9

Size

512B

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.crypt7

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.shadow2

Size

512B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ghost

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.patchT

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.altmap

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.trapk

Size

512B

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themidV

Size

512B

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.shadow6

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data$vs

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text$i3

Size

Virtual Size

377B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text$jf

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text$k9

Size

1024B

Virtual Size

579B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.lzp$ak

Size

512B

Virtual Size

118B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text$u1

Size

512B

Virtual Size

130B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text$fq

Size

512B

Virtual Size

118B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.arch

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-10-01_35d5375fd3a79342a90ea260b2104dd0_icedid_njrat_ryuk

ole32

ws2_32

shlwapi

shell32

generic