ProcessHacker[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ProcessHacker.exe
Size 1.6MB
Sample261003-map2ysxyb1
SHA256 bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
MD5 b365af317ae730a67c936f21432b9c71
SHA1 a0bdfac3ce1880b32ff9b696458327ce352e3b1d
SHA512 cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b
SSDEEP 24576:V7eokafnkAwgcU+29fR4PQviXq1pj3EDT5m+m8I:V6efnkdlUF92PGBOT3m8
TLSH
T10D857C5262E44098D2BBDE76C5629A22EAB13C061F34CADF4650F5792F33BE1DA3C711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ProcessHacker.exe

File Explorer

ProcessHacker.exe

.exe 1.6MB

ProcessHacker.exe

IMPHASH 3695333c60dedecdcaff1590409aa462
SHA256 bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
MD5 b365af317ae730a67c936f21432b9c71
SHA1 a0bdfac3ce1880b32ff9b696458327ce352e3b1d
SHA512 cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b
SSDEEP 24576:V7eokafnkAwgcU+29fR4PQviXq1pj3EDT5m+m8I:V6efnkdlUF92PGBOT3m8
TLSH
T10D857C5262E44098D2BBDE76C5629A22EAB13C061F34CADF4650F5792F33BE1DA3C711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

33:a7:55:31:1b:42:8c:20:63:f9:83:05:8d:bf:9e:16:48:d0:0d:5f:ec:4a:df:00:e0:a3:4d:de:e6:39:f6:8b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU

Chains

Oct 2, 2026

CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

92:53:a6:f7:2e:e0:e3:97:0d:54:57:e0:f0:61:fd:b4:0b:48:4f:18

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU

Chains

Mar 29, 2016

CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU

Subject

CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU

Serial Number

0f:f1:ef:66:bd:62:1c:65:b7:4b:4d:e4:14:25:71:7f

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 30, 2013 - Jan 4, 2017

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU

Serial Number

04:0c:b4:1e:4f:b3:70:c4:5c:43:44:76:51:62:58:2f

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 30, 2013 - Jan 4, 2017

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert\, Inc.,C=US

Serial Number

02:ce:42:94:59:02:a4:f3:c0:40:b0:ff:77:93:d1:4f

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 24, 2015 - Jan 7, 2025

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

929532

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\processhacker2\bin\Release64\ProcessHacker.pdb

ntdll

NtCreateTimer NtAlertThread NtSetTimer RtlGetGroupSecurityDescriptor RtlGetOwnerSecurityDescriptor RtlGetSaclSecurityDescriptor RtlLengthSecurityDescriptor NtCreateSemaphore NtQueryObject NtClearEvent NtCreateKeyedEvent NtWaitForKeyedEvent NtReleaseKeyedEvent RtlGetVersion NtDeviceIoControlFile NtSetInformationObject NtQueryFullAttributesFile NtOpenFile NtQuerySecurityObject NtOpenSection NtQueryDirectoryFile NtCreateFile NtCreateKey RtlCreateUserThread NtQueryDirectoryObject NtFsControlFile NtOpenDirectoryObject RtlPrefixUnicodeString NtSetSecurityObject NtOpenProcess NtQuerySymbolicLinkObject RtlConvertSidToUnicodeString NtOpenKey NtQueueApcThread NtUnloadDriver RtlEqualUnicodeString NtOpenSymbolicLinkObject RtlQueueApcWow64Thread NtOpenThread NtDeleteKey NtQueryKey NtQueryValueKey LdrLoadDll LdrUnloadDll LdrGetProcedureAddress NtGetContextThread NtQueryInformationFile NtFlushBuffersFile NtLockFile NtUnlockFile RtlInterlockedPopEntrySList RtlUnicodeToMultiByteSize RtlMultiByteToUnicodeSize RtlMultiByteToUnicodeN RtlReAllocateHeap NtAllocateVirtualMemory RtlUpcaseUnicodeChar RtlUnicodeToMultiByteN RtlExpandEnvironmentStrings_U RtlGetDaclSecurityDescriptor RtlCreateUserProcess RtlNtStatusToDosError RtlCreateProcessParameters NtFilterToken RtlStringFromGUID RtlFindMessage NtQueryAttributesFile RtlAddAce RtlDestroyProcessParameters RtlDosPathNameToNtPathName_U RtlFreeUnicodeString RtlGetAce RtlRandomEx NtDuplicateToken RtlGetFullPathName_U NtSetInformationToken NtPowerInformation NtTestAlert NtOpenThreadToken RtlTimeToSecondsSince1980 RtlEqualSid RtlSecondsSince1980ToTime NtIsProcessInJob RtlFirstEntrySList RtlCreateSecurityDescriptor RtlCreateAcl RtlAddAccessAllowedAce NtAcceptConnectPort NtReplyWaitReceivePort NtCompleteConnectPort RtlSetDaclSecurityDescriptor RtlSubAuthoritySid NtCreatePort RtlInitializeSid RtlLengthRequiredSid RtlValidRelativeSecurityDescriptor RtlSelfRelativeToAbsoluteSD2 RtlValidSid NtConnectPort NtRequestWaitReplyPort RtlAbsoluteToSelfRelativeSD RtlLengthSid NtCreateSection NtQueryMutant NtSuspendThread NtQueryInformationProcess NtRemoveProcessDebug NtTerminateThread NtResumeProcess NtReleaseSemaphore NtSetHighEventPair RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx NtQueryEvent NtQuerySemaphore NtCancelTimer NtPulseEvent NtSetLowEventPair NtQueryTimer NtResetEvent RtlIpv6AddressToStringW RtlIpv4AddressToStringW RtlInterlockedFlushSList RtlInitializeSListHead RtlInterlockedPushEntrySList RtlSecondsSince1970ToTime RtlCreateHeap RtlFreeHeap RtlAllocateHeap RtlDestroyHeap NtQueryVirtualMemory NtProtectVirtualMemory NtSetSystemInformation NtWriteVirtualMemory NtSetInformationFile NtQueryInformationToken NtCreateMutant NtOpenProcessToken NtAdjustPrivilegesToken NtTerminateJobObject NtAssignProcessToJobObject NtQueryInformationJobObject NtMapViewOfSection NtQuerySection RtlSetHeapInformation RtlLeaveCriticalSection RtlInitializeCriticalSection RtlEnterCriticalSection RtlQueryEnvironmentVariable_U NtQueryPerformanceCounter RtlDeleteCriticalSection NtTerminateProcess NtSetValueKey RtlDetermineDosPathNameType_U NtDeleteValueKey NtAddAtom RtlGUIDFromString NtWaitForMultipleObjects NtSetEvent NtCreateEvent NtReadVirtualMemory NtReadFile NtWriteFile NtQueryInformationThread NtQuerySystemInformation NtSuspendProcess NtResumeThread NtWaitForSingleObject RtlDoesFileExists_U NtSetInformationDebugObject NtUnmapViewOfSection RtlRaiseStatus NtSetInformationProcess NtDuplicateObject NtInitiatePowerAction NtClose NtDelayExecution NtSetInformationThread NtFreeVirtualMemory

winsta

WinStationSendMessageW WinStationShadow WinStationGetAllProcesses WinStationFreeGAPMemory WinStationRegisterConsoleNotification WinStationQueryInformationW WinStationFreeMemory WinStationEnumerateW WinStationReset WinStationDisconnect WinStationConnectW

comctl32

PropertySheetW InitCommonControlsEx CreatePropertySheetPageW ImageList_Remove ImageList_Destroy ImageList_Create ImageList_ReplaceIcon ImageList_Replace

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

uxtheme

IsThemeActive GetThemeInt SetWindowTheme CloseThemeData DrawThemeBackground OpenThemeData IsThemePartDefined EnableThemeDialogTexture

kernel32

GetProcAddress GetModuleHandleW CreatePipe FileTimeToSystemTime FileTimeToLocalFileTime CreateProcessW SetConsoleCtrlHandler FreeConsole RaiseException QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleFileNameW InitializeCriticalSectionAndSpinCount TlsFree LoadLibraryExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetStringTypeW MultiByteToWideChar GetACP GetStdHandle WriteFile WideCharToMultiByte GetCurrentProcess TerminateProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCPInfo IsValidCodePage GetOEMCP CloseHandle FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap CreateFileW GetConsoleCP GetConsoleMode GlobalSize LocalAlloc GlobalUnlock GlobalLock FindResourceW LoadResource GlobalFree GlobalAlloc LockResource SizeofResource CreateRemoteThread CreateThread GetDateFormatW GetTimeFormatW GetNumberFormatW WriteConsoleW GetSystemDefaultLangID GetSystemDirectoryW GetLocaleInfoW GetUserDefaultLangID SearchPathW LocalFree SetLastError GetComputerNameW TlsGetValue TlsAlloc TlsSetValue FreeLibrary LoadLibraryW SetProcessShutdownParameters ExitProcess SetErrorMode GetTickCount AllocConsole GetConsoleWindow SetFilePointerEx FlushFileBuffers ReadFile ReadConsoleW HeapSize HeapReAlloc SetEndOfFile GetLastError

user32

SetClipboardData GetDesktopWindow CreateDialogIndirectParamW GetWindowTextW InternalGetWindowText EmptyClipboard CloseClipboard OpenClipboard GetActiveWindow GetFocus GetWindowLongW DestroyMenu TrackPopupMenu CreatePopupMenu InsertMenuItemW EndPaint BeginPaint ReleaseCapture PtInRect SetScrollPos ShowCaret EnableScrollBar SetCapture DestroyCaret DragDetect GetClipboardData CreateCaret SetCaretPos GetScrollInfo RegisterClipboardFormatW SetScrollInfo GetDCEx ScreenToClient SetCursorPos ScrollWindowEx GetUpdateRect GetMessageTime DrawFocusRect GetCapture GetAsyncKeyState InvalidateRgn WaitMessage MessageBeep GetMessagePos GetUpdateRgn GetIconInfo FrameRect DialogBoxParamW SetDlgItemTextW EndDialog LockWorkStation ExitWindowsEx SendMessageW IsWindowVisible EnableWindow GetParent GetDlgItem SetPropW IsWindowEnabled RemovePropW GetPropW GetClassNameW GetWindowThreadProcessId IsIconic InvalidateRect SetForegroundWindow GetClientRect FindWindowW SetLayeredWindowAttributes MoveWindow ClientToScreen GetMonitorInfoW GetWindowInfo RedrawWindow ShowWindow GetSubMenu GetWindowPlacement GetWindowLongPtrW SetWindowLongPtrW GetMenuItemCount MonitorFromRect SetWindowPos GetMenu FindWindowExW PostMessageW GetKeyState GetMenuItemInfoW MapWindowPoints SetWindowTextW GetWindowRect MapDialogRect DestroyIcon EnableMenuItem BringWindowToTop DeleteMenu GetSystemMenu SetCursor LoadCursorW CreateDialogParamW GetSysColorBrush GetSysColor CopyIcon SetDlgItemInt SetTimer DestroyWindow ReleaseDC SystemParametersInfoW TranslateMessage TranslateAcceleratorW IsChild IsDialogMessageW DispatchMessageW LoadAcceleratorsW GetSystemMetrics GetDC SendMessageTimeoutW GetMessageW LoadImageW UpdateWindow PostQuitMessage KillTimer AppendMenuW EndDeferWindowPos DrawMenuBar LoadIconW SetFocus SetMenuInfo SetMenuItemInfoW BeginDeferWindowPos IsWindow RegisterClassExW CreateWindowExW ShowWindowAsync LoadMenuW DefWindowProcW DeferWindowPos GetCursorPos DrawIconEx DrawTextW TrackMouseEvent IsHungAppWindow SetActiveWindow MonitorFromWindow MonitorFromPoint CallWindowProcW GetForegroundWindow GetDoubleClickTime CreateIconIndirect FillRect GetDlgItemInt GetGuiResources GetWindowTextLengthW OpenWindowStationW GetProcessWindowStation OpenDesktopW GetUserObjectInformationW CloseDesktop CloseWindowStation EnumDesktopsW GetGUIThreadInfo PeekMessageW MsgWaitForMultipleObjects MessageBoxW

gdi32

GetDIBits SaveDC TextOutW GetCharWidthW Rectangle SetBkMode BitBlt DeleteDC CreateDIBSection SetBoundsRect GetStockObject Polyline SetDCBrushColor SetDCPenColor SelectObject GetTextMetricsW GetTextExtentPoint32W GetTextColor DeleteObject CreateFontW GetDeviceCaps SetTextColor SetBkColor GetObjectW CreateFontIndirectW CreateRectRgn SelectClipRgn ExcludeClipRect RestoreDC CombineRgn IntersectClipRect GdiAlphaBlend CreateCompatibleDC CreateCompatibleBitmap GetClipRgn

comdlg32

GetOpenFileNameW GetSaveFileNameW ChooseFontW ChooseColorW

advapi32

SystemFunction036 SetSecurityInfo LsaLookupSids LsaLookupPrivilegeValue LsaLookupPrivilegeDisplayName LsaLookupNames2 LsaOpenPolicy LsaLookupPrivilegeName EnumServicesStatusExW QueryServiceConfigW CreateProcessWithLogonW LsaOpenAccount LsaEnumeratePrivilegesOfAccount LogonUserW CreateProcessAsUserW QueryServiceConfig2W OpenServiceW RegisterServiceCtrlHandlerExW LsaEnumerateAccounts LsaFreeMemory SetServiceStatus StartServiceCtrlDispatcherW CreateServiceW OpenSCManagerW ChangeServiceConfig2W ChangeServiceConfigW LsaAddAccountRights LsaClose CloseServiceHandle DeleteService ControlService StartServiceW GetSecurityInfo

shell32

DuplicateIcon SHGetFileInfoW ShellExecuteExW SHGetFolderPathW SHCreateDirectoryExW Shell_NotifyIconW ExtractIconExW

ole32

CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

SysFreeString

PhAddComboBoxStrings PhAddElementAvlTree PhAddEntryHashtable PhAddEntryHashtableEx PhAddItemArray PhAddItemList PhAddItemPointerList PhAddItemSimpleHashtable PhAddItemsArray PhAddItemsList PhAddLayoutItem PhAddLayoutItemEx PhAddListViewColumn PhAddListViewItem PhAddProcessPropPage PhAddProcessPropPage2 PhAddPropPageLayoutItem PhAddSettings PhAddTabControlTab PhAddTreeNewFilter PhAdjustRectangleToBounds PhAdjustRectangleToWorkingArea PhAllocate PhAllocateExSafe PhAllocateFromFreeList PhAllocatePage PhAllocateSafe PhAppendBytesBuilder PhAppendBytesBuilder2 PhAppendBytesBuilderEx PhAppendCharStringBuilder PhAppendCharStringBuilder2 PhAppendFormatStringBuilder PhAppendFormatStringBuilder_V PhAppendStringBuilder PhAppendStringBuilder2 PhAppendStringBuilderEx PhApplicationFont PhApplyTreeNewFilters PhApplyTreeNewFiltersToNode PhAutoDereferenceObject PhBufferToHexString PhBufferToHexStringEx PhCenterRectangle PhCenterWindow PhClearArray PhClearCircularBuffer_FLOAT PhClearCircularBuffer_PVOID PhClearCircularBuffer_ULONG PhClearCircularBuffer_ULONG64 PhClearHashtable PhClearList PhCmLoadSettings PhCmSaveSettings PhCompareStringRef PhCompareStringZNatural PhCompareUnicodeStringZIgnoreMenuPrefix PhConcatStringRef2 PhConcatStringRef3 PhConcatStrings PhConcatStrings2 PhConcatStrings_V PhConvertMultiByteToUtf16 PhConvertMultiByteToUtf16Ex PhConvertUtf16ToAsciiEx PhConvertUtf16ToMultiByte PhConvertUtf16ToMultiByteEx PhConvertUtf16ToUtf8 PhConvertUtf16ToUtf8Buffer PhConvertUtf16ToUtf8Ex PhConvertUtf16ToUtf8Size PhConvertUtf8ToUtf16 PhConvertUtf8ToUtf16Buffer PhConvertUtf8ToUtf16Ex PhConvertUtf8ToUtf16Size PhCopyBytesZ PhCopyCircularBuffer_FLOAT PhCopyCircularBuffer_PVOID PhCopyCircularBuffer_ULONG PhCopyCircularBuffer_ULONG64 PhCopyListView PhCopyListViewInfoTip PhCopyStringZ PhCopyStringZFromBytes PhCopyStringZFromMultiByte PhCountStringZ PhCreateAlloc PhCreateBytes PhCreateBytesEx PhCreateEMenu PhCreateEMenuItem PhCreateFileStream PhCreateFileStream2 PhCreateFileWin32 PhCreateFileWin32Ex PhCreateHashtable PhCreateKey PhCreateList PhCreateObject PhCreateObjectType PhCreateObjectTypeEx PhCreateOpenFileDialog PhCreatePointerList PhCreateProcess PhCreateProcessAsUser PhCreateProcessPropContext PhCreateProcessPropPageContext PhCreateProcessPropPageContextEx PhCreateProcessWin32 PhCreateProcessWin32Ex PhCreateSaveFileDialog PhCreateSecurityPage PhCreateServiceListControl PhCreateSimpleHashtable PhCreateString PhCreateStringEx PhCreateSymbolProvider PhCreateThread PhDecodeUnicodeDecoder PhDeleteArray PhDeleteAutoPool PhDeleteBytesBuilder PhDeleteCallback PhDeleteCircularBuffer_FLOAT PhDeleteCircularBuffer_PVOID PhDeleteCircularBuffer_ULONG PhDeleteCircularBuffer_ULONG64 PhDeleteFastLock PhDeleteFileWin32 PhDeleteFreeList PhDeleteGraphState PhDeleteImageVersionInfo PhDeleteLayoutManager PhDeleteMemoryItemList PhDeleteStringBuilder PhDeleteTreeNewColumnMenu PhDeleteTreeNewFilterSupport PhDeleteWorkQueue PhDereferenceObject PhDereferenceObjectDeferDelete PhDereferenceObjectEx PhDereferenceObjects PhDereferenceProcessRecord PhDeselectAllProcessNodes PhDeselectAllServiceNodes PhDestroyEMenu PhDestroyEMenuItem PhDisconnectNamedPipe PhDivideSinglesBySingle PhDoPropPageLayout PhDosErrorToNtStatus PhDrainAutoPool PhDrawGraphDirect PhDuplicateBytesZ PhDuplicateBytesZSafe PhDuplicateProcessNodeList PhDuplicateStringZ PhEditSecurity PhEllipsisString PhEllipsisStringPath PhEncodeUnicode PhEnumAvlTree PhEnumDirectoryFile PhEnumDirectoryObjects PhEnumFileStreams PhEnumGenericModules PhEnumHandles PhEnumHandlesEx PhEnumHashtable PhEnumKernelModules PhEnumObjectTypes PhEnumPagefiles PhEnumPointerListEx PhEnumProcessEnvironmentVariables PhEnumProcessItems PhEnumProcessModules PhEnumProcessModules32 PhEnumProcessModules32Ex PhEnumProcessModulesEx PhEnumProcesses PhEnumProcessesEx PhEnumProcessesForSession PhEnumServices PhEqualStringRef PhEscapeCommandLinePart PhEscapeStringForMenuPrefix PhExecuteRunAsCommand2 PhExpandAllProcessNodes PhExpandEnvironmentStrings PhExponentiate PhExponentiate64 PhFillMemoryUlong PhFinalArrayItems PhFinalBytesBuilderBytes PhFinalHash PhFinalStringBuilderString PhFindCharInStringRef PhFindEMenuItem PhFindElementAvlTree PhFindEntryHashtable PhFindIntegerSiKeyValuePairs PhFindItemList PhFindItemPointerList PhFindItemSimpleHashtable PhFindLastCharInStringRef PhFindListViewItemByFlags PhFindListViewItemByParam PhFindLoaderEntry PhFindNetworkNode PhFindPlugin PhFindProcessInformation PhFindProcessInformationByImageName PhFindProcessNode PhFindProcessRecord PhFindServiceNode PhFindStringInStringRef PhFindStringSiKeyValuePairs PhFlushFileStream PhFormat PhFormatDate PhFormatDateTime PhFormatDecimal PhFormatGuid PhFormatImageVersionInfo PhFormatLogEntry PhFormatNativeKeyName PhFormatSize PhFormatString PhFormatString_V PhFormatTime PhFormatTimeSpan PhFormatTimeSpanRelative PhFormatToBuffer PhFormatUInt64 PhFree PhFreeFileDialog PhFreePage PhFreeToFreeList PhGenerateGuid PhGenerateGuidFromName PhGenerateRandomAlphaString PhGetAccessEntries PhGetAccessString PhGetApplicationDirectory PhGetApplicationFileName PhGetBaseName PhGetClientIdName PhGetClientIdNameEx PhGetComboBoxString PhGetDllFileName PhGetDrawInfoGraphBuffers PhGetFileDialogFileName PhGetFileDialogFilterIndex PhGetFileDialogOptions PhGetFileName PhGetFileShellIcon PhGetFileSize PhGetFileVersionInfo PhGetFileVersionInfoLangCodePage PhGetFileVersionInfoString PhGetFileVersionInfoString2 PhGetFilterSupportNetworkTreeList PhGetFilterSupportProcessTreeList PhGetFilterSupportServiceTreeList PhGetFullPath PhGetGeneralCallback PhGetGenericTreeNewLines PhGetGlobalWorkQueue PhGetHandleInformation PhGetHandleInformationEx PhGetIntegerPairSetting PhGetIntegerSetting PhGetJobProcessIdList PhGetKernelFileName PhGetKnownLocation PhGetLineFromAddress PhGetListBoxString PhGetListViewContextMenuPoint PhGetListViewItemImageIndex PhGetListViewItemParam PhGetMessage PhGetModuleFromAddress PhGetNtMessage PhGetObjectSecurity PhGetObjectType PhGetObjectTypeInformation PhGetOwnTokenAttributes PhGetPhVersion PhGetPhVersionNumbers PhGetPluginCallback PhGetPluginInformation PhGetPositionFileStream PhGetPrimeNumber PhGetProcedureAddressRemote PhGetProcessCommandLine PhGetProcessDepStatus PhGetProcessEnvironment PhGetProcessImageFileName PhGetProcessImageFileNameByProcessId PhGetProcessImageFileNameWin32 PhGetProcessIsDotNet PhGetProcessIsDotNetEx PhGetProcessIsSuspended PhGetProcessKnownType PhGetProcessMappedFileName PhGetProcessPebString PhGetProcessPriorityClassString PhGetProcessWindowTitle PhGetProcessWorkingSetInformation PhGetProcessWsCounters PhGetProtocolTypeName PhGetScalableIntegerPairSetting PhGetSeObjectSecurity PhGetSelectedListViewItemParam PhGetSelectedListViewItemParams PhGetSelectedProcessItem PhGetSelectedProcessItems PhGetSelectedServiceItem PhGetSelectedServiceItems PhGetServiceChange PhGetServiceConfig PhGetServiceDelayedAutoStart PhGetServiceDescription PhGetServiceErrorControlInteger PhGetServiceErrorControlString PhGetServiceNameFromTag PhGetServiceStartTypeInteger PhGetServiceStartTypeString PhGetServiceStateString PhGetServiceTypeInteger PhGetServiceTypeString PhGetSidFullName PhGetStatisticsTime PhGetStatisticsTimeString PhGetStockApplicationIcon PhGetStringSetting PhGetSymbolFromAddress PhGetSymbolFromName PhGetSystemDirectory PhGetSystemRoot PhGetTcpStateName PhGetThreadServiceTag PhGetTokenGroups PhGetTokenIntegrityLevel PhGetTokenOwner PhGetTokenPrimaryGroup PhGetTokenPrivileges PhGetTokenUser PhGetTreeNewText PhGetWin32Message PhGetWindowText PhGetWindowTextEx PhGlobalDpi PhGraphStateGetDrawInfo PhHandleListViewNotifyForCopy PhHandleTreeNewColumnMenu PhHashBytes PhHashStringRef PhHeapHandle PhHexStringToBuffer PhIconToBitmap PhImpersonateClientOfNamedPipe PhIndexOfEMenuItem PhInitializeArray PhInitializeAutoPool PhInitializeAvlTree PhInitializeBytesBuilder PhInitializeCallback PhInitializeCircularBuffer_FLOAT PhInitializeCircularBuffer_PVOID PhInitializeCircularBuffer_ULONG PhInitializeCircularBuffer_ULONG64 PhInitializeFastLock PhInitializeFreeList PhInitializeGraphState PhInitializeHash PhInitializeImageVersionInfo PhInitializeLayoutManager PhInitializeStringBuilder PhInitializeTreeNewColumnMenu PhInitializeTreeNewFilterSupport PhInitializeWorkQueue PhInitializeWorkQueueEnvironment PhInjectDllProcess PhInsertEMenuItem PhInsertItemList PhInsertItemsList PhInsertStringBuilder PhInsertStringBuilder2 PhInsertStringBuilderEx PhIntegerToString64 PhInvalidateAllProcessNodes PhInvokeCallback PhIsExecutablePacked PhIsExecutingInWow64 PhLayoutManagerLayout PhLibImageBase PhListenNamedPipe PhLoadIcon PhLoadListViewColumnSettings PhLoadListViewColumnsFromSetting PhLoadModuleSymbolProvider PhLoadResourceEMenuItem PhLoadSymbolProviderOptions PhLoadWindowPlacementFromSetting PhLocalTimeToSystemTime PhLockFileStream PhLogMessageEntry PhLoggedCallback PhLookupMemoryItemList PhLookupName PhLookupPrivilegeDisplayName PhLookupPrivilegeName PhLookupPrivilegeValue PhLookupSid PhLowerBoundElementAvlTree PhLowerDualBoundElementAvlTree PhMainWndHandle PhMapFlags1 PhMapFlags2 PhMatchWildcards PhMaximumElementAvlTree PhMinimumElementAvlTree PhModalPropertySheet PhModifyEMenuItem PhNetworkItemAddedEvent PhNetworkItemModifiedEvent PhNetworkItemRemovedEvent PhNetworkItemsUpdatedEvent PhNtStatusFileNotFound PhNtStatusToDosError PhOpenKey PhOpenLsaPolicy PhOpenProcess PhOpenService PhOpenThread PhOpenThreadProcess PhOsVersion PhParseCommandLine PhParseCommandLineFuzzy PhParseCommandLinePart PhPeekNamedPipe PhPluginAddMenuHook PhPluginAddMenuItem PhPluginAddTreeNewColumn PhPluginCallPhSvc PhPluginCreateEMenuItem PhPluginEnableTreeNewNotify PhPluginGetObjectExtension PhPluginGetSystemStatistics PhPluginQueryPhSvc PhPluginRegisterIcon PhPluginReserveIds PhPluginSetObjectExtension PhPredecessorElementAvlTree PhPrintTimeSpan PhProcessAddedEvent PhProcessModifiedEvent PhProcessRemovedEvent PhProcessesUpdatedEvent PhPropPageDlgProcDestroy PhPropPageDlgProcHeader PhQueryFullAttributesFileWin32 PhQueryKey PhQueryMemoryItemList PhQueryRegistryString PhQueryServiceVariableSize PhQuerySystemTime PhQueryTimeZoneBias PhQueryValueKey PhQueueItemWorkQueue PhQueueItemWorkQueueEx PhReAllocate PhReAllocateSafe PhReadFileStream PhReferenceEmptyString PhReferenceNetworkItem PhReferenceObject PhReferenceObjectEx PhReferenceObjectSafe PhReferenceObjects PhReferenceProcessItem PhReferenceProcessItemForParent PhReferenceProcessItemForRecord PhReferenceProcessRecord PhReferenceProcessRecordForStatistics PhReferenceProcessRecordSafe PhReferenceServiceItem PhRegisterCallback PhRegisterCallbackEx PhRegisterDialog PhRegisterMessageLoopFilter PhRegisterPlugin PhRemoveAllEMenuItems PhRemoveEMenuItem PhRemoveElementAvlTree PhRemoveEntryHashtable PhRemoveItemArray PhRemoveItemList PhRemoveItemPointerList PhRemoveItemSimpleHashtable PhRemoveItemsArray PhRemoveItemsList PhRemoveListViewItem PhRemoveStringBuilder PhRemoveTreeNewFilter PhResizeArray PhResizeCircularBuffer_FLOAT PhResizeCircularBuffer_PVOID PhResizeCircularBuffer_ULONG PhResizeCircularBuffer_ULONG64 PhResizeList PhResolveDevicePrefix PhRoundUpToPowerOfTwo PhSaveListViewColumnSettings PhSaveListViewColumnsToSetting PhSaveWindowPlacementToSetting PhSearchOnlineString PhSeekFileStream PhSelectAndEnsureVisibleProcessNode PhSelectAndEnsureVisibleServiceNode PhSelectComboBoxString PhServiceAddedEvent PhServiceModifiedEvent PhServiceRemovedEvent PhServicesUpdatedEvent PhSetClipboardString PhSetControlTheme PhSetExtendedListView PhSetFileDialogFileName PhSetFileDialogFilter PhSetFileDialogOptions PhSetFileSize PhSetFlagsAllEMenuItems PhSetFlagsEMenuItem PhSetGraphText PhSetHeaderSortIcon PhSetImageListBitmap PhSetIntegerPairSetting PhSetIntegerSetting PhSetListViewItemImageIndex PhSetListViewSubItem PhSetObjectSecurity PhSetOptionsSymbolProvider PhSetScalableIntegerPairSetting PhSetScalableIntegerPairSetting2 PhSetSeObjectSecurity PhSetSearchPathSymbolProvider PhSetSelectThreadIdProcessPropContext PhSetServiceDelayedAutoStart PhSetStateAllListViewItems PhSetStringSetting PhSetStringSetting2 PhSetTokenIsVirtualizationEnabled PhSetTokenPrivilege PhSetTokenPrivilege2 PhSetTokenSessionId PhShellExecute PhShellExecuteEx PhShellExecuteUserString PhShellExploreFile PhShellOpenKey PhShellProcessHacker PhShellProperties PhShowChooseProcessDialog PhShowConfirmMessage PhShowContinueStatus PhShowEMenu PhShowFileDialog PhShowIconNotification PhShowMessage PhShowMessage_V PhShowProcessAffinityDialog2 PhShowProcessProperties PhShowProcessRecordDialog PhShowStatus PhSiSetColorsGraphDrawInfo PhSiSizeLabelYFunction PhSidToStringSid PhSplitStringRefAtChar PhSplitStringRefAtLastChar PhSplitStringRefAtString PhSplitStringRefEx PhStackWalk PhStdGetClientIdName PhStdGetObjectSecurity PhStdSetObjectSecurity PhStringToDouble PhStringToInteger64 PhSuccessorElementAvlTree PhSvcCallChangeServiceConfig PhSvcCallChangeServiceConfig2 PhSvcCallPostMessage PhSvcCallSendMessage PhSystemBasicInformation PhSystemTimeToLocalTime PhTerminateProcess PhTransceiveNamedPipe PhTrimStringRef PhUiCloseConnections PhUiCloseHandles PhUiConnectSession PhUiConnectToPhSvc PhUiConnectToPhSvcEx PhUiContinueService PhUiDebugProcess PhUiDeleteService PhUiDetachFromDebuggerProcess PhUiDisconnectFromPhSvc PhUiDisconnectSession PhUiFreeMemory PhUiHibernateComputer PhUiInjectDllProcess PhUiLockComputer PhUiLogoffComputer PhUiLogoffSession PhUiPauseService PhUiReduceWorkingSetProcesses PhUiRestartComputer PhUiRestartProcess PhUiResumeProcesses PhUiResumeThreads PhUiSetAttributesHandle PhUiSetIoPriorityProcesses PhUiSetIoPriorityThread PhUiSetPagePriorityProcess PhUiSetPagePriorityThread PhUiSetPriorityProcesses PhUiSetPriorityThread PhUiSetVirtualizationProcess PhUiShutdownComputer PhUiSleepComputer PhUiStartService PhUiStopService PhUiSuspendProcesses PhUiSuspendThreads PhUiTerminateProcesses PhUiTerminateThreads PhUiTerminateTreeProcess PhUiUnloadModule PhUnloadDllProcess PhUnloadDriver PhUnlockFileStream PhUnregisterCallback PhUnregisterDialog PhUnregisterMessageLoopFilter PhUpdateDosDevicePrefixes PhUpdateHash PhUpdateMupDevicePrefixes PhUpdateProcessNode PhUpdateServiceNode PhUpperBoundElementAvlTree PhUpperDualBoundElementAvlTree PhVerifyFile PhVerifyFileStream PhWaitForNamedPipe PhWaitForWorkQueue PhWalkThreadStack PhWriteFileStream PhWriteMiniDumpProcess PhWritePhTextHeader PhWriteStringAsUtf8FileStream PhWriteStringAsUtf8FileStream2 PhWriteStringAsUtf8FileStreamEx PhWriteStringFormatAsUtf8FileStream PhWriteStringFormatAsUtf8FileStream_V PhWriteUnicodeDecoder PhZeroExtendToUtf16Buffer PhZeroExtendToUtf16Ex PhaChoiceDialog PhaGetProcessKnownCommandLine PhfAcquireFastLockExclusive PhfAcquireFastLockShared PhfAcquireQueuedLockExclusive PhfAcquireQueuedLockShared PhfAcquireRundownProtection PhfBeginInitOnce PhfEndInitOnce PhfInitializeBarrier PhfInitializeEvent PhfInitializeInitOnce PhfInitializeRundownProtection PhfPulseAllCondition PhfPulseCondition PhfQueueWakeEvent PhfReleaseFastLockExclusive PhfReleaseFastLockShared PhfReleaseQueuedLockExclusive PhfReleaseQueuedLockShared PhfReleaseRundownProtection PhfResetEvent PhfSetEvent PhfSetWakeEvent PhfTryAcquireFastLockExclusive PhfTryAcquireFastLockShared PhfWaitForBarrier PhfWaitForCondition PhfWaitForConditionEx PhfWaitForEvent PhfWaitForRundownProtection PhfWaitForWakeEvent PhfWakeForReleaseQueuedLock ProcessAllAccess ProcessQueryAccess ThreadAllAccess ThreadQueryAccess ThreadSetAccess WindowsVersion mxmlAdd mxmlDelete mxmlElementDeleteAttr mxmlElementGetAttr mxmlElementSetAttr mxmlFindElement mxmlLoadFd mxmlLoadString mxmlNewCDATA mxmlNewCustom mxmlNewElement mxmlNewInteger mxmlNewOpaque mxmlNewReal mxmlNewText mxmlNewXML mxmlRelease mxmlRemove mxmlRetain mxmlSaveAllocString mxmlSaveFd mxmlSaveString mxmlSetCDATA mxmlSetCustom mxmlSetCustomHandlers mxmlSetElement mxmlSetErrorCallback mxmlSetOpaque mxmlSetText mxmlSetUserData mxmlWalkNext mxmlWalkPrev

Name

.text

Size

1023KB

Virtual Size

1023KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

321KB

Virtual Size

321KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

239KB

Virtual Size

239KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ProcessHacker.exe

PE Signature issue

PE Signature issue

ntdll

winsta

comctl32

version

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic