build.rar
- SHA256 5e89cfdd0a894c886209d15b8cebac3ae4203d866a799302455f2ca56aac5332
Overview
overview
7Static
static
3build.rar
windows10-2004-x64
7build.rar
windows10-ltsc_2021-x64
1build.rar
windows11-21h2-x64
1build.rar
windows11-ltsc_2024-x64
1KeyGen/MakeSecret.exe
windows10-2004-x64
1KeyGen/MakeSecret.exe
windows10-ltsc_2021-x64
1KeyGen/MakeSecret.exe
windows11-21h2-x64
1KeyGen/MakeSecret.exe
windows11-ltsc_2024-x64
1KeyGen/Oct...en.exe
windows10-2004-x64
3KeyGen/Oct...en.exe
windows10-ltsc_2021-x64
3KeyGen/Oct...en.exe
windows11-21h2-x64
3KeyGen/Oct...en.exe
windows11-ltsc_2024-x64
3MasonEAX/O...AX.exe
windows10-2004-x64
3MasonEAX/O...AX.exe
windows10-ltsc_2021-x64
3MasonEAX/O...AX.exe
windows11-21h2-x64
3MasonEAX/O...AX.exe
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
build.rar
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
build.rar
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
build.rar
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
build.rar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
KeyGen/MakeSecret.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
KeyGen/MakeSecret.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
KeyGen/MakeSecret.exe
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
KeyGen/MakeSecret.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
KeyGen/OctopusKeygen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
KeyGen/OctopusKeygen.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
KeyGen/OctopusKeygen.exe
Resource
win11-20260911-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
KeyGen/OctopusKeygen.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
MasonEAX/OctopusEAX.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
MasonEAX/OctopusEAX.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
MasonEAX/OctopusEAX.exe
Resource
win11-20260911-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
MasonEAX/OctopusEAX.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target build.rar
- Size 835KB
- Sample261020-vrxgcsty8k
- SHA256 5e89cfdd0a894c886209d15b8cebac3ae4203d866a799302455f2ca56aac5332
- MD5 c99a219eee5533d900ef0159fb1a9987
- SHA1 df98edc0ee51e18cff1888845218c8abcd730811
- SHA512 c01f9e3ae6a765c53184dce3d059aaaa9c261d9d699ffa9995f03fbcaca8f699dc3ee8daf7d0adee97a5376dbf2a9c67726ad6098c1a473050ca989fc4de4bf1
- SSDEEP 24576:5W8tin7os2AEN4Yt9woyRZXpDpDmmnJ/xg:pq7F2p4swJR9pDz/a
- TLSH T1A305334329AEF5F2F5D483A66059AD03ACCC1D52B828E123C575C2E54E17377BBA2B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/KeyGen/MakeSecret.exe unpack001/KeyGen/OctopusKeygen.exe unpack001/MasonEAX/OctopusEAX.exe
File Explorer
-
build.rar.rar 835KB
-
KeyGen/MakeSecret.exe.exe 230KB
-
KeyGen/OctopusKeygen.exe.exe 670KB
-
MasonEAX/OctopusEAX.exe.exe 1.5MB
KeyGen/MakeSecret.exe
- IMPHASH db8b41953e16ec7e2f6c0d6d4ca9839b
- SHA256 4ce57c8cc0b702165182cc244efc4dcb956745ed98e8cb55d22d0989170f683d
- MD5 0fc03fec3d8f3d2e6e3e2db7764e0682
- SHA1 afbbd2d8991de5444375839a6bbd1e8970ee3d28
- SHA512 99e8bb7dd668dcfaf8514b7eba16a2c8b1c3907a8c02e936069d88e514588ec5c2787c51df7bf0cc02319db699a08cce8fe3a7b705a91426f5e960e24eeb7dac
- SSDEEP 3072:83lEZ4yPSg/yrC2ZvtyU08NWyK/xNwKidmrHVm3RjGEn5MMDz2H37e0fs:83E48kvQU9NM/xMU0ja7eI
- TLSH T1B6348E15B7A90CFEE5678179C9524905EB72BC4607B0EADF03E00A969F27BD08E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
37040
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
bcrypt
BCryptSetProperty
BCryptDeriveKeyPBKDF2
BCryptGenRandom
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptFinalizeKeyPair
BCryptExportKey
BCryptEncrypt
BCryptGenerateKeyPair
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
kernel32
ReadFile
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStringTypeW
ReadConsoleW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCPInfo
GetOEMCP
SetEndOfFile
WriteConsoleW
SetStdHandle
EnterCriticalSection
CreateFileW
GetVolumeInformationW
CloseHandle
DeviceIoControl
GetWindowsDirectoryW
GetSystemFirmwareTable
WideCharToMultiByte
GetACP
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetCurrentThreadId
QueryPerformanceCounter
WakeAllConditionVariable
SleepConditionVariableSRW
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
IsProcessorFeaturePresent
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
GetFileType
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
Name
.text
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=149, id=261, version=35215,
count=12, id=260, version=35215,
count=7, id=259, version=35215,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=55, id=261, version=35721,
count=7, id=257, version=35215,
count=124, id=1, productName=Unmarked objects,
count=1, id=261, version=36256,
count=1, id=255, version=36256,
count=1, id=258, version=36256,
KeyGen/OctopusKeygen.exe
- IMPHASH be0e74319576e95aab334896f3497fc2
- SHA256 583e823d8e43d5c58eb2155385d84187136f99ad05bab5b786ee18b290cdc9a4
- MD5 53ccf55d465236bc6c8cff9328214599
- SHA1 12ed776b69e62b1ebce2d674d6ef349b3780b2ea
- SHA512 7ef4841a0075ab09876c2469ffd331bc7960e8876b3a506697fe2fc2fb6dcc009630dfda86b91e11fa2fde8c9b4529ae425ab159289f42c641147d1c5e760ebd
- SSDEEP 6144:9brbjOTEmTma4taIILAmIvg/O6tOxppI64HQheK9H:NwmoF8mIvgOgH0
- TLSH T10AE45BC0A7A419EAE86B8D7F8D574941EA72B8914730DACB435C499F0F132F05AFEB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
68240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
bcrypt
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
advapi32
RegCloseKey
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExW
comctl32
InitCommonControlsEx
shell32
CommandLineToArgvW
ShellExecuteW
gdi32
Rectangle
LineTo
SelectObject
GetStockObject
DeleteObject
SetBkColor
TextOutW
SetBkMode
SetTextColor
CreateDIBSection
MoveToEx
GetTextExtentPoint32W
DeleteDC
CreateFontW
CreateSolidBrush
BitBlt
CreateCompatibleDC
CreatePen
kernel32
FreeLibrary
GetStdHandle
WriteConsoleW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
HeapAlloc
GetFileType
GetModuleHandleExW
GetCommandLineW
GetEnvironmentVariableW
CreateDirectoryW
CreateFileW
GetVolumeInformationW
ReadFile
WriteFile
CloseHandle
DeviceIoControl
GetWindowsDirectoryW
GetSystemFirmwareTable
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
LocalFree
MultiByteToWideChar
WideCharToMultiByte
TerminateProcess
ExitProcess
GetCurrentProcess
IsProcessorFeaturePresent
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
EncodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
GetLastError
RtlUnwindEx
RtlLookupFunctionEntry
RaiseException
RtlPcToFileHeader
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoW
SetUnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
VirtualProtect
QueryPerformanceCounter
GetCurrentThreadId
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryExW
LCMapStringW
ReadConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
user32
PtInRect
LoadCursorW
EqualRect
IsRectEmpty
SetRectEmpty
FillRect
SetCursor
GetClientRect
GetWindowTextW
SetWindowTextW
InvalidateRect
EndPaint
BeginPaint
SetForegroundWindow
UpdateWindow
DrawTextW
GetSystemMetrics
LoadImageW
ReleaseCapture
GetFocus
SetFocus
EmptyClipboard
SetClipboardData
GetWindowRect
OpenClipboard
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
PostQuitMessage
DefWindowProcW
PostMessageW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
TrackMouseEvent
SystemParametersInfoW
EnableWindow
CloseClipboard
ole32
CreateStreamOnHGlobal
gdiplus
GdipFillPath
GdipDrawPath
GdipDrawEllipse
GdipDrawLine
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipSetPenLineJoin
GdipDeletePath
GdipSetPenStartCap
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipAddPathArc
GdipClosePathFigure
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipSetPenEndCap
msimg32
AlphaBlend
Name
.text
Size
176KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
404KB
Virtual Size
403KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=157, id=261, version=35215,
count=12, id=260, version=35215,
count=7, id=259, version=35215,
count=10, id=259, version=35721,
count=17, id=260, version=35721,
count=55, id=261, version=35721,
count=21, id=257, version=35215,
count=224, id=1, productName=Unmarked objects,
count=1, id=261, version=36256,
count=1, id=255, version=36256,
count=1, id=151,
count=1, id=258, version=36256,
MasonEAX/OctopusEAX.exe
- IMPHASH b842d6bde94ed861a63192b1fc54dd72
- SHA256 1d98e801f9850ed60e39759b24041911f5fc033a09a241044b1762aa56c5a09e
- MD5 ee720e9b32dcb83abbbb5a01f38b4082
- SHA1 80c890ba61e1a72bf060e0f38affaf2846a98b69
- SHA512 2360fe5cff3ca8e20316d1e1da20d42378d8ac0334f8b29bf1e42cee732e892a72ffe6a24f4e4c0d73052c735cc1c962165891d0a67a640be870dac7ea8294f5
- SSDEEP 24576:wOhk72xV+Nbb/BRk+Z29FGo1FY4hQlG2Q4fvtIUPYYyDhwORV:wwN+Nf/jZM/bRyfP2VwO
- TLSH T1BC759D11A1E401EDD17BE2B4CA762D07E77278420734AAEB03D09D6A0F276D15EBF722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
907392
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemFree
PropVariantClear
CreateStreamOnHGlobal
comctl32
ord412
ord410
InitCommonControlsEx
ord413
shell32
CommandLineToArgvW
SHCreateItemFromParsingName
SHCreateDirectoryExW
SHGetKnownFolderPath
ShellExecuteExW
ShellExecuteW
advapi32
RegSetValueExA
RegCloseKey
LookupPrivilegeValueW
GetTokenInformation
AdjustTokenPrivileges
ConvertStringSidToSidW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
RegGetValueW
RegDeleteKeyValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegDeleteValueA
OpenProcessToken
gdi32
LineTo
GdiFlush
GetTextFaceW
SetBrushOrgEx
TextOutW
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontW
CreatePen
CreateSolidBrush
DeleteDC
DeleteObject
Ellipse
EnumFontFamiliesExW
ExcludeClipRect
GetCurrentObject
GetDeviceCaps
GetGlyphOutlineW
GetStockObject
GetTextExtentPoint32W
AddFontResourceExW
RemoveFontResourceExW
IntersectClipRect
GetObjectW
RectVisible
Rectangle
RestoreDC
SaveDC
SelectClipRgn
SelectObject
SetBkColor
SetBkMode
SetGraphicsMode
StretchBlt
SetStretchBltMode
SetTextColor
GetTextMetricsW
GetWorldTransform
SetWorldTransform
ModifyWorldTransform
CreateDIBSection
MoveToEx
gdiplus
GdipFillPolygon
GdipFillRectangle
GdipGraphicsClear
GdipDrawPath
GdipDrawPolygon
GdipDrawEllipse
GdipDrawRectangle
GdipDrawArc
GdipDrawLines
GdipDrawLine
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipFillPie
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageRotateFlip
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipSetPenLineJoin
GdipSetPenEndCap
GdipSetPenStartCap
GdipDeletePen
GdipCreatePen1
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterColor
GdipCreatePathGradientFromPath
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathEllipse
GdipAddPathBezier
GdipAddPathArc
GdipClosePathFigure
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipFillPath
GdipDrawImageRectI
GdipFillEllipse
GdipCreateBitmapFromFile
msimg32
AlphaBlend
bcrypt
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptVerifySignature
BCryptImportKeyPair
BCryptDestroyKey
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyHash
uxtheme
SetWindowTheme
urlmon
URLDownloadToFileW
wininet
DeleteUrlCacheEntryW
winmm
timeBeginPeriod
comdlg32
GetOpenFileNameW
GetSaveFileNameW
avrt
AvSetMmThreadCharacteristicsW
AvRevertMmThreadCharacteristics
AvSetMmThreadPriority
kernel32
GetConsoleOutputCP
FlushFileBuffers
GetProcessHeap
HeapSize
HeapReAlloc
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
LCMapStringW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetFileType
HeapAlloc
HeapFree
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetStdHandle
IsProcessorFeaturePresent
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
EncodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
SetUnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLogicalProcessorInformationEx
GetExitCodeThread
GetCurrentThreadId
WaitForSingleObjectEx
GetStringTypeW
LoadLibraryExA
FreeLibrary
VirtualQuery
VirtualProtect
GetSystemInfo
RaiseException
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
MoveFileExW
CopyFileW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEndOfFile
WriteConsoleW
GetCommandLineA
TerminateJobObject
GetCommandLineW
GetEnvironmentVariableW
CompareFileTime
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetVolumeInformationW
ReadFile
WriteFile
IsDebuggerPresent
CheckRemoteDebuggerPresent
CloseHandle
DuplicateHandle
SetHandleInformation
GetLastError
CreatePipe
QueryPerformanceCounter
QueryPerformanceFrequency
DeviceIoControl
SetEvent
WaitForSingleObject
CreateMutexW
CreateEventW
Sleep
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
ExitProcess
TerminateProcess
GetExitCodeProcess
GetCurrentThread
SetThreadPriority
ResumeThread
CreateProcessW
OpenProcess
GetLocalTime
GetTickCount64
GetSystemDirectoryW
GetWindowsDirectoryW
GetSystemFirmwareTable
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
LocalFree
QueryFullProcessImageNameW
user32
TrackMouseEvent
GetMessageW
TranslateMessage
DispatchMessageW
RegisterHotKey
UnregisterHotKey
ExitWindowsEx
SendMessageW
PostMessageW
DefWindowProcW
PostQuitMessage
RegisterClassW
GetClassInfoW
CreateWindowExW
IsWindow
IsChild
DestroyWindow
ShowWindow
AnimateWindow
UpdateLayeredWindow
GetLayeredWindowAttributes
PrintWindow
SetLayeredWindowAttributes
SetWindowPos
IsWindowVisible
IsIconic
GetDlgCtrlID
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
SetFocus
GetFocus
GetKeyState
GetAsyncKeyState
GetKeyNameTextW
GetLastInputInfo
MapVirtualKeyW
GetCapture
SetCapture
ReleaseCapture
SetTimer
KillTimer
EnableWindow
IsWindowEnabled
GetSystemMetrics
DrawTextExW
UpdateWindow
GetForegroundWindow
SetForegroundWindow
GetDC
GetWindowDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
RedrawWindow
SetPropW
GetPropW
RemovePropW
SetWindowTextW
GetWindowTextW
GetClientRect
GetWindowRect
MessageBoxW
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
WindowFromPoint
FillRect
SetRectEmpty
InflateRect
IntersectRect
UnionRect
OffsetRect
IsRectEmpty
EqualRect
PtInRect
GetWindowLongPtrA
GetWindowLongPtrW
SetWindowLongPtrA
SetWindowLongPtrW
GetParent
FindWindowW
FindWindowExW
GetAncestor
GetClassNameW
GetWindowThreadProcessId
GetWindow
LoadCursorA
LoadCursorW
LoadImageW
SystemParametersInfoW
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
GetComboBoxInfo
EnumWindows
oleaut32
VariantClear
SysAllocString
VariantInit
wintrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust
crypt32
CertGetNameStringW
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
240KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
152KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=163, id=261, version=35215,
count=8, id=259, version=35721,
count=15, id=260, version=35721,
count=35, id=259, version=35215,
count=67, id=261, version=35721,
count=54, id=260, version=35215,
count=39, id=257, version=35215,
count=429, id=1, productName=Unmarked objects,
count=1, id=261, version=36256,
count=1, id=255, version=36256,
count=1, id=258, version=36256,