dock_64[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
dock_64.exe
Size 17.8MB
Sample261014-qlpr4sdw6v
SHA256 7bc53d769a4f239af110cbdaa7daa28214c4d28daa7f3396418e213ba05e73e5
MD5 250894bbb446a11639fa1f0bc2e1765e
SHA1 0bac447fe0fa78081f4bd20e9d679db575d5b317
SHA512 53f8bc81a31a755afdb0e9a6b2a86ebb0b751f448d7984c49992adbee5c72975a5b36a23d383c5f8b93fb5a8ee48545df942ae51fbef280339dcee8e3847bc40
SSDEEP 98304:QtQHtrWRwvsUaBGJjwJFk3eA4RrPZzq/BUYk2WOhlSRwyM4bpo1pbjDO:NNSCa7oebRrZ2lk2WOhlSrMSuvjK
TLSH
T118178245ABBE8096D2BED038A612921AFC723CD8C73CE6DB8B512E1557317F06A3D705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

dock_64.exe

.exe 17.8MB

dock_64.exe

IMPHASH 37a7ae5ee2fde0ad3ad78a2bbdb995fe
SHA256 7bc53d769a4f239af110cbdaa7daa28214c4d28daa7f3396418e213ba05e73e5
MD5 250894bbb446a11639fa1f0bc2e1765e
SHA1 0bac447fe0fa78081f4bd20e9d679db575d5b317
SHA512 53f8bc81a31a755afdb0e9a6b2a86ebb0b751f448d7984c49992adbee5c72975a5b36a23d383c5f8b93fb5a8ee48545df942ae51fbef280339dcee8e3847bc40
SSDEEP 98304:QtQHtrWRwvsUaBGJjwJFk3eA4RrPZzq/BUYk2WOhlSRwyM4bpo1pbjDO:NNSCa7oebRrZ2lk2WOhlSrMSuvjK
TLSH
T118178245ABBE8096D2BED038A612921AFC723CD8C73CE6DB8B512E1557317F06A3D705
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

9d:4c:a8:d7:77:b5:a4:53:34:50:c1:4b:8d:9d:4a:6e:95:9c:4e:03:08:b2:32:d8:39:1a:50:08:4c:b6:f3:19

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

Chains

Jul 25, 2022

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

e9:21:18:13:26:0d:18:a0:31:fe:ad:a3:17:ca:90:db:17:1a:44:ae

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

Chains

Jul 25, 2022

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 9, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=天津市河北区英广腾达软件科技工作室,O=天津市河北区英广腾达软件科技工作室,ST=天津市,C=CN

Serial Number

36:5a:40:6d:85:d3:27:b7:56:c8:57:06:37:4c:d9:0b

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 16, 2022 - May 16, 2023

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Minor OS version

Major OS version

Entry point

3157772

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\Dock1.8.9\x64\Release\Dock_64.pdb

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc PropVariantClear StringFromGUID2 CoInitializeSecurity CLSIDFromString CoCreateGuid CoGetInterfaceAndReleaseStream CoMarshalInterThreadInterfaceInStream CoSetProxyBlanket CoUninitialize CoCreateInstance CoCreateFreeThreadedMarshaler CoTaskMemFree CoInitializeEx

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW FindResourceW LoadLibraryA

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW FreeLibraryAndExitThread GetModuleFileNameW LoadLibraryExA GetProcAddress LoadResource LoadLibraryExW LockResource SizeofResource LoadStringW FreeLibrary

api-ms-win-ntuser-sysparams-l1-1-0

SystemParametersInfoW EnumDisplayDevicesW GetMonitorInfoW GetSystemMetrics EnumDisplayMonitors

oleaut32

VariantChangeType SysAllocString SetErrorInfo VariantClear VariantInit GetErrorInfo CreateErrorInfo SysFreeString SysStringLen

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l1-1-0

FindNextFileA FindFirstFileA GetFileAttributesExA SetEndOfFile FindFirstFileExW GetFileSizeEx LockFile FindNextFileW GetDriveTypeW GetLogicalDriveStringsW ReadFile GetVolumeInformationW GetFileTime CreateDirectoryW GetFileAttributesA GetDiskFreeSpaceExW WriteFile CreateFileA DeleteFileA UnlockFile SetFileAttributesW CreateDirectoryA FindClose CreateFileW GetShortPathNameW GetLongPathNameW GetFileSize DeleteFileW SetFileTime SetFilePointer RemoveDirectoryA GetFileAttributesW LocalFileTimeToFileTime FlushFileBuffers SetFilePointerEx GetFileInformationByHandle GetFileAttributesExW GetFileType

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

d3dcompiler_47

D3DCompile

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

api-ms-win-mm-time-l1-1-0

timeGetTime timeEndPeriod timeBeginPeriod

api-ms-win-core-processthreads-l1-1-0

TlsAlloc TlsGetValue TlsSetValue TerminateProcess TlsFree GetCurrentThreadId CreateThread ExitThread CreateProcessW GetCurrentProcessId ResumeThread OpenProcessToken ExitProcess GetCurrentThread GetExitCodeThread OpenThread GetCurrentProcess GetExitCodeProcess

api-ms-win-core-errorhandling-l1-1-0

SetErrorMode SetLastError SetUnhandledExceptionFilter GetLastError RaiseException

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileA CreateFileMappingA GetComputerNameW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo QueryFullProcessImageNameW K32EnumProcesses

api-ms-win-core-kernel32-legacy-l1-1-1

SetDllDirectoryW

api-ms-win-core-localization-l1-2-0

IsValidLocale FormatMessageA GetLocaleInfoW IsValidCodePage GetOEMCP LCMapStringW GetUserDefaultLCID GetACP FormatMessageW EnumSystemLocalesW GetSystemDefaultLCID

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-service-management-l1-1-0

OpenSCManagerW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize GlobalUnlock GlobalLock

dwrite

DWriteCreateFactory

d2d1

ord1 ord2

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree GlobalAlloc

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW GetSystemInfo GlobalMemoryStatusEx GetSystemDirectoryW GetLocalTime GetSystemTimeAsFileTime GetTickCount64

api-ms-win-core-synch-l1-1-0

CreateEventW WaitForSingleObject OpenEventW TryEnterCriticalSection SetWaitableTimer SetEvent LeaveCriticalSection InitializeCriticalSection InitializeCriticalSectionEx DeleteCriticalSection

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFamilyName

api-ms-win-core-privateprofile-l1-1-0

WritePrivateProfileStringW GetPrivateProfileStringW

api-ms-win-core-file-ansi-l2-1-0

ReplaceFileA

api-ms-win-core-memory-l1-1-0

VirtualProtect OpenFileMappingW VirtualQuery CreateFileMappingW ReadProcessMemory VirtualFreeEx UnmapViewOfFile VirtualAllocEx MapViewOfFile

api-ms-win-core-file-l1-2-2

GetTempPathA

api-ms-win-security-cryptoapi-l1-1-0

CryptAcquireContextA CryptGetHashParam CryptReleaseContext CryptDestroyHash CryptHashData CryptCreateHash

dxgi

CreateDXGIFactory2 DXGIDeclareAdapterRemovalSupport

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges GetTokenInformation

crypt32

CryptStringToBinaryA CryptBinaryToStringW CryptStringToBinaryW

api-ms-win-core-registry-l1-1-0

RegSetValueExW RegDeleteValueW RegQueryValueExW RegOpenKeyExW RegQueryInfoKeyW RegGetValueW RegEnumValueW RegCloseKey RegNotifyChangeKeyValue

rpcrt4

UuidFromStringW

api-ms-win-devices-config-l1-1-1

CM_Get_Parent CM_Get_DevNode_Status

api-ms-win-core-registry-l2-1-0

RegCreateKeyW RegEnumKeyW RegOpenKeyW

api-ms-win-core-heap-l1-1-0

HeapAlloc GetProcessHeap HeapReAlloc HeapFree HeapSize

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle GetCurrentDirectoryW SetCurrentDirectoryW GetCommandLineA SetEnvironmentVariableW FreeEnvironmentStringsW GetStdHandle GetEnvironmentVariableW GetCommandLineW GetEnvironmentStringsW

ext-ms-win-networking-wlanapi-l1-1-0

WlanCloseHandle WlanQueryInterface WlanSetProfile WlanGetProfileList WlanEnumInterfaces WlanFreeMemory WlanOpenHandle

ws2_32

connect WSACleanup WSAStartup socket

iphlpapi

GetAdaptersInfo

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte CompareStringW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation FileTimeToSystemTime SystemTimeToFileTime

api-ms-win-power-setting-l1-1-0

PowerGetActiveScheme

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

powrprof

SetSuspendState PowerSetActiveScheme PowerEnumerate PowerReadFriendlyName

api-ms-win-core-processthreads-l1-1-2

GetSystemTimes

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-toolhelp-l1-1-0

Process32NextW CreateToolhelp32Snapshot Process32FirstW

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-debug-l1-1-1

WaitForDebugEvent ContinueDebugEvent

wlanapi

WlanDisconnect WlanConnect WlanRegisterNotification

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-string-obsolete-l1-1-0

lstrlenA

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW

coremessaging

CreateDispatcherQueueController

user32

GetMessageW GetForegroundWindow GetDoubleClickTime TrackMouseEvent GetDC GetCursorPos GetTouchInputInfo ReleaseDC SetWindowRgn ShowWindow DeregisterShellHookWindow UnhookWinEvent SendMessageA GetDesktopWindow DestroyIcon IsHungAppWindow GetWindowThreadProcessId UnregisterHotKey wsprintfW MsgWaitForMultipleObjects PeekMessageW AllowSetForegroundWindow keybd_event ExitWindowsEx FindWindowExA GetLayeredWindowAttributes SendNotifyMessageW MonitorFromPoint SetWinEventHook MonitorFromRect QueryDisplayConfig GetDisplayConfigBufferSizes DisplayConfigGetDeviceInfo EnumDisplaySettingsW SetDisplayConfig RegisterClassExW UpdateLayeredWindow GetKeyboardLayoutList LoadKeyboardLayoutW GetWindowTextLengthW RegisterShellHookWindow ShowWindowAsync SendMessageTimeoutA SetWindowPos GetShellWindow GetWindowInfo SetWindowLongA SetLayeredWindowAttributes GetClassNameW IsZoomed IsIconic PostMessageW GetWindowTextW UnregisterClassW MonitorFromWindow GetKeyboardLayout AttachThreadInput SetFocus GetClientRect CloseTouchInputHandle ActivateKeyboardLayout EnableWindow UnregisterDeviceNotification UpdateWindow CreatePopupMenu DestroyMenu SetActiveWindow GetWindowLongW DestroyWindow GetMessageExtraInfo CloseWindow SendMessageTimeoutW SendMessageW SetWindowTextW IsWindowEnabled OpenClipboard SwitchToThisWindow CloseClipboard GetClipboardData LoadCursorW SetCursor IsClipboardFormatAvailable SetForegroundWindow GetWindow GetWindowPlacement GetParent GetAsyncKeyState EndPaint BeginPaint SetWindowLongW SetPropW UpdateLayeredWindowIndirect GetPropW DefWindowProcW IsWindow PostMessageA GetWindowRect RegisterWindowMessageW GetWindowTextLengthA FindWindowW GetMenuStringW GetSubMenu GetMenuItemCount IsWindowVisible GetMenu GetMenuItemID FindWindowExW GetMenuState GetSystemMenu FindWindowA SetWindowLongPtrA PostQuitMessage KillTimer GetWindowLongPtrA TranslateMessage TranslateAcceleratorW ChangeWindowMessageFilter SetMenu MoveWindow RegisterHotKey GetWindowLongA RegisterTouchWindow SetTimer DispatchMessageW LoadAcceleratorsW RemovePropW CreateWindowExW MessageBoxW GetAncestor

ole32

OleUninitialize CoInitialize RevokeDragDrop OleInitialize RegisterDragDrop

imm32

ImmAssociateContext ImmReleaseContext ImmSetCompositionWindow ImmGetCompositionStringW ImmGetContext

oleacc

AccessibleChildren WindowFromAccessibleObject AccessibleObjectFromWindow

cfgmgr32

CM_Query_And_Remove_SubTreeW CM_Request_Device_EjectW

comdlg32

GetOpenFileNameW

kernel32

InitializeSRWLock InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW SleepConditionVariableCS WakeConditionVariable GetCompressedFileSizeW GetPrivateProfileSectionW GetPrivateProfileSectionNamesW ReleaseSRWLockExclusive InitializeConditionVariable EnterCriticalSection GetStringTypeW WaitForSingleObjectEx SwitchToThread GetNativeSystemInfo QueryPerformanceCounter QueryPerformanceFrequency SetFileInformationByHandle FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetFileInformationByHandleEx CreateSymbolicLinkW CompareStringEx EncodePointer LCMapStringEx GetCPInfo GetLocaleInfoEx InitializeCriticalSectionAndSpinCount RtlPcToFileHeader ResetEvent RtlCaptureContext RtlLookupFunctionEntry AcquireSRWLockExclusive RtlVirtualUnwind UnhandledExceptionFilter InitializeSListHead IsDebuggerPresent RtlCaptureStackBackTrace GetStartupInfoW WakeAllConditionVariable

shell32

SHQueryUserNotificationState SHGetSpecialFolderLocation SHEmptyRecycleBinW ord155 SHBindToParent SHGetKnownFolderPath DragAcceptFiles ord195 SHAppBarMessage DragFinish DragQueryFileW SHGetDesktopFolder SHParseDisplayName SHGetPathFromIDListW SHBrowseForFolderW ord190 SHCreateItemFromIDList ShellExecuteExW ord6 SHFileOperationW SHGetFileInfoW SHOpenFolderAndSelectItems SHCreateItemFromParsingName ord727 ord88 ShellExecuteW SHGetFolderLocation

advapi32

ControlService GetUserNameW CloseServiceHandle OpenServiceW InitiateShutdownW

winmm

PlaySoundW

shlwapi

PathFindFileNameW PathRemoveFileSpecW PathFindExtensionW PathRemoveBackslashW PathIsDirectoryW StrStrIA StrStrIW StrRetToBufW PathFileExistsW ord176

urlmon

URLDownloadToFileW

gdi32

GetStockObject SetLayout GetBitmapBits CreateDIBSection SelectObject DeleteObject CreateRectRgnIndirect GetPixel CreateCompatibleDC CombineRgn GetObjectW BitBlt Rectangle DeleteDC SetDIBitsToDevice CreatePen SetBkMode CreateEllipticRgn GetDeviceCaps CreateRectRgn

dwmapi

DwmFlush DwmGetWindowAttribute DwmSetWindowAttribute DwmQueryThumbnailSourceSize DwmRegisterThumbnail DwmIsCompositionEnabled DwmUpdateThumbnailProperties DwmUnregisterThumbnail DwmEnableBlurBehindWindow

msimg32

AlphaBlend

dxva2

SetMonitorBrightness GetPhysicalMonitorsFromHMONITOR GetNumberOfPhysicalMonitorsFromHMONITOR DestroyPhysicalMonitors GetMonitorBrightness

steam_api64

SteamAPI_IsSteamRunning SteamAPI_UnregisterCallback SteamAPI_Init SteamInternal_FindOrCreateUserInterface SteamAPI_GetHSteamUser SteamAPI_Shutdown SteamAPI_RegisterCallResult SteamInternal_ContextInit SteamAPI_UnregisterCallResult SteamAPI_RunCallbacks SteamAPI_RegisterCallback

dbghelp

MiniDumpWriteDump

wtsapi32

WTSRegisterSessionNotification

bluetoothapis

BluetoothGetRadioInfo BluetoothFindFirstRadio BluetoothSetServiceState BluetoothFindRadioClose

setupapi

SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW

version

GetFileVersionInfoSizeW

comctl32

ImageList_Destroy ImageList_Create ImageList_Draw ImageList_ReplaceIcon

rasapi32

RasHangUpW RasDialW RasEnumEntriesW RasEnumConnectionsW RasGetEntryDialParamsW

api-ms-win-shcore-scaling-l1-1-1

GetScaleFactorForMonitor

pdh

PdhGetFormattedCounterValue PdhAddCounterW PdhOpenQueryW PdhRemoveCounter PdhCloseQuery PdhCollectQueryData

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx RtlUnwind

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList InterlockedPushEntrySList

api-ms-win-core-console-l1-1-0

ReadConsoleW GetConsoleOutputCP SetConsoleCtrlHandler GetConsoleMode WriteConsoleW

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback

Name

.text

Size

10.1MB

Virtual Size

10.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

88KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ