MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cb077ac45cc280c1ace4f4b7f7ec0feb23487074ac50e0113ade7e9509dbb85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cb077ac45cc280c1ace4f4b7f7ec0feb23487074ac50e0113ade7e9509dbb85
SHA3-384 hash: e8fc4fb0a09b821b2f88f648c4969a57eff5698922f2b1fa4a7011255359c34dbb90efedc0d621ca0b2725247a53f6f4
SHA1 hash: fa29bd64c6fd9ca4811db98aa8608691cb0324c3
MD5 hash: 2940b15a52c0aaa97db24e4043ffffcf
humanhash: oxygen-violet-massachusetts-fifteen
File name:PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:6'536'429 bytes
First seen:2024-10-10 07:57:24 UTC
Last seen:2024-10-10 16:34:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash aaaa8913c89c8aa4a5d93f06853894da (246 x Formbook, 82 x AgentTesla, 74 x RedLineStealer)
ssdeep 98304:r3v+7+QLirU/OpUYI+Lclg5xlmq4daschTJwEHjwxFD+z4N3vS:rf+6mir1e+Lci5xYLErTJPEFD+sN3vS
Threatray 321 similar samples on MalwareBazaar
TLSH T10766026472EAC128EFF27F3AC4D15119E170FC63E95A6A11A2FA77122677F800537782
TrID 84.9% (.EXE) AutoIt3 compiled script executable (510622/80/67)
9.5% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
1.7% (.EXE) Win64 Executable (generic) (10522/11/4)
1.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
File icon (PE):PE icon
dhash icon c4c8e8e8e8e8e4c4 (1 x AgentTesla, 1 x Formbook, 1 x RedLineStealer)
Reporter lowmal3
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
396
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe
Verdict:
No threats detected
Analysis date:
2024-10-10 08:04:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2f4f408c-10ce-4404-8b6e-151202008d3e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Worm.Autoit.AMHC.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6707890ff936b5621b0c2a9c
Tags:
Redline Autoit Emotet Spam
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit epmicrosoft_visual_cc fingerprint keylogger lolbin masquerade microsoft_visual_cc overlay packed shell32
Link:
https://www.filescan.io/uploads/6707890ca617144147820b00/reports/fdb5b628-e858-4a63-8105-05c33171199c/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/6cb077ac45cc280c1ace4f4b7f7ec0feb23487074ac50e0113ade7e9509dbb85
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6377ea65-e58b-4cdd-8074-0514f43682ca
Result
Threat name:
PureLog Stealer, RedLine
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1530636
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to behave differently if execute on a Russian/Kazak computer
Contains functionality to detect sleep reduction / modifications
Creates files in the system32 config directory
Creates files inside the volume driver (system volume information)
Drops executable to a common third party application directory
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Infects executable files (exe, dll, sys, html)
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries random domain names (often used to prevent blacklisting and sinkholes)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1530636 Sample: PO-NBQ73652_ORDER_T637MOO74... Startdate: 10/10/2024 Architecture: WINDOWS Score: 100 84 zyiexezl.biz 2->84 86 zlenh.biz 2->86 88 78 other IPs or domains 2->88 112 Multi AV Scanner detection for domain / URL 2->112 114 Suricata IDS alerts for network traffic 2->114 116 Found malware configuration 2->116 118 13 other signatures 2->118 12 PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe 1 2->12         started        15 alg.exe 2->15         started        18 elevation_service.exe 2->18         started        20 20 other processes 2->20 signatures3 process4 dnsIp5 136 Switches to a custom stack to bypass stack traces 12->136 138 Contains functionality to detect sleep reduction / modifications 12->138 22 PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe 12->22         started        25 svchost.exe 12->25         started        92 mnjmhp.biz 47.129.31.212, 49929, 50033, 50036 ESAMARA-ASRU Canada 15->92 94 yauexmxk.biz 18.208.156.248, 49992, 50025, 50029 AMAZON-AESUS United States 15->94 96 10 other IPs or domains 15->96 140 Creates files in the system32 config directory 15->140 142 Contains functionality to behave differently if execute on a Russian/Kazak computer 15->142 144 Found direct / indirect Syscall (likely to bypass EDR) 18->144 146 Creates files inside the volume driver (system volume information) 20->146 signatures6 process7 signatures8 120 Writes to foreign memory regions 22->120 122 Maps a DLL or memory area into another process 22->122 27 svchost.exe 4 22->27         started        process9 file10 78 C:\Users\user\AppData\...\microsofts.exe, PE32 27->78 dropped 80 C:\Users\user\...80ative_Redline_BTC.exe, PE32 27->80 dropped 82 C:\Program Files (x86)\...\armsvc.exe, PE32 27->82 dropped 148 Drops executable to a common third party application directory 27->148 150 Infects executable files (exe, dll, sys, html) 27->150 31 microsofts.exe 15 2 27->31         started        36 Native_Redline_BTC.exe 27->36         started        signatures11 process12 dnsIp13 98 banwyw.biz 44.221.84.105, 49711, 49716, 49954 AMAZON-AESUS United States 31->98 100 acwjcqqv.biz 18.141.10.107, 49707, 49710, 49717 AMAZON-02US United States 31->100 102 7 other IPs or domains 31->102 64 C:\Windows\System32\wbengine.exe, PE32+ 31->64 dropped 66 C:\Windows\System32\wbem\WmiApSrv.exe, PE32+ 31->66 dropped 68 C:\Windows\System32\vds.exe, PE32+ 31->68 dropped 74 140 other malicious files 31->74 dropped 104 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 31->104 106 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 31->106 108 Tries to steal Mail credentials (via file / registry access) 31->108 110 6 other signatures 31->110 70 C:\Users\user\AppData\...\server_BTC.exe, PE32 36->70 dropped 72 C:\Users\user\AppData\Local\Temp\build.exe, PE32 36->72 dropped 38 build.exe 36->38         started        42 server_BTC.exe 36->42         started        file14 signatures15 process16 dnsIp17 90 212.162.149.53, 2049, 49706 UNREAL-SERVERSUS Netherlands 38->90 124 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 38->124 126 Found many strings related to Crypto-Wallets (likely being stolen) 38->126 128 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 38->128 134 2 other signatures 38->134 76 C:\Users\user\AppData\...\TrojanAIbot.exe, PE32 42->76 dropped 130 Uses schtasks.exe or at.exe to add and modify task schedules 42->130 132 Adds a directory exclusion to Windows Defender 42->132 45 powershell.exe 42->45         started        48 cmd.exe 42->48         started        50 schtasks.exe 42->50         started        52 TrojanAIbot.exe 42->52         started        file18 signatures19 process20 signatures21 152 Loading BitLocker PowerShell Module 45->152 54 conhost.exe 45->54         started        56 WmiPrvSE.exe 45->56         started        58 conhost.exe 48->58         started        60 timeout.exe 48->60         started        62 conhost.exe 50->62         started        process22
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6cb077ac45cc280c1ace4f4b7f7ec0feb23487074ac50e0113ade7e9509dbb85
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6cb077ac45cc280c1ace4f4b7f7ec0feb23487074ac50e0113ade7e9509dbb85/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2024-10-10 00:43:58 UTC
File Type:
PE (Exe)
Extracted files:
22
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nsyhplcfzquaygwoj5fx67wa72zdjbyhjlcq4aitvxt6sue5xocq._file
Verdict:
malicious
Label(s):
admintool_powerrun
Create hunting rule
Similar samples:
1640e87780b219eba703c734e68b0f5cf793bc94fe0cdf9121658d12bb1f9364
RedLineStealer
89bf0303ddc028f24388edc3ca7f0384b10db50dacc42cb96dac2e4d677213f0
RedLineStealer
ab1a43c5eb5c82a3199a543deb4e3289c9fa0a2439e2f962c6774772227e5cdf
RedLineStealer
c6789cf795ae3fb1084f4eec8b4cbea4f5b345df502738b2b7afc5bcfa47a852
RedLineStealer
+ 311 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:foz discovery execution infostealer spyware stealer
Link:
https://tria.ge/reports/241010-jttyga1glc/
Behaviour
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up external IP address via web service
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
RedLine
RedLine payload
Malware Config
C2 Extraction:
212.162.149.53:2049
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e609662c-3cbb-40b1-b100-9f0d711c099c
Unpacked files
SH256 hash:
abdd6f31a909b0b10e30ced74a1f6f037adf1f61a8a842048dbc254d6f076169
MD5 hash:
c33a7f0e25bb3f4d3c19fc8441e9d12b
SHA1 hash:
0286b277e97b9f7c217a0d029e8144f8e20b40b9
Link:
https://www.unpac.me/results/d04390b6-e21c-4ccb-b510-11338b790d5a/
SH256 hash:
4d48a08f8b36c11f6a756f670bc03de3381101a7dff45f13a32bfb898e90bb83
MD5 hash:
d1b2ec2438cc1529f5ff01896ddbb830
SHA1 hash:
a8d07ea822ae55d3592d32c7b32ecc2f1f6a7e88
Detections:
AgentTesla
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
RedLine_Campaign_June2021
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
Link:
https://www.unpac.me/results/d04390b6-e21c-4ccb-b510-11338b790d5a/
Parent samples :
6cb077ac45cc280c1ace4f4b7f7ec0feb23487074ac50e0113ade7e9509dbb85
ff3bcc4bc70f9e6724fcc0fb36c4f57cc5956136850bd39c9581413f7c4688a9
829026e0d6a6f73f3328bb4aabd5f0e3f063f000cd9d860c051b307e148395d5
78897e2d5b18ff4a71db6703ec5781abedff5794bd79fcee70babd7b0622eef8
SH256 hash:
90431d8f6a4e4b09740d09021ce87d3302e2d502c337273bef480584167627ba
MD5 hash:
55240e0c63db4f40ffaf292666eb2ebf
SHA1 hash:
5788c507c0b747d6d2151288386b18be76d72da3
Detections:
AgentTesla
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
Link:
https://www.unpac.me/results/d04390b6-e21c-4ccb-b510-11338b790d5a/
Parent samples :
6cb077ac45cc280c1ace4f4b7f7ec0feb23487074ac50e0113ade7e9509dbb85
ff3bcc4bc70f9e6724fcc0fb36c4f57cc5956136850bd39c9581413f7c4688a9
829026e0d6a6f73f3328bb4aabd5f0e3f063f000cd9d860c051b307e148395d5
78897e2d5b18ff4a71db6703ec5781abedff5794bd79fcee70babd7b0622eef8
SH256 hash:
0313c64f2071f221363a428c2fdd1ee4ef91ecdf4b2f91680a2a58cda43a3d8f
MD5 hash:
23bd8b3544f5c401fb88b8b3e4b340df
SHA1 hash:
c75438b2a47e7922149721447444d1e17273ffc4
Link:
https://www.unpac.me/results/d04390b6-e21c-4ccb-b510-11338b790d5a/
SH256 hash:
36fe89b3218d2d0bbf865967cdc01b9004e3ba13269909e3d24d7ff209f28fc5
MD5 hash:
50d015016f20da0905fd5b37d7834823
SHA1 hash:
6c39c84acf3616a12ae179715a3369c4e3543541
Link:
https://www.unpac.me/results/d04390b6-e21c-4ccb-b510-11338b790d5a/
SH256 hash:
0576191c50a1b6afbcaa5cb0512df5b6a8b9bef9739e5308f8e2e965bf9b0fc5
MD5 hash:
3b6501feef6196f24163313a9f27dbfd
SHA1 hash:
20d60478d3c161c3cacb870aac06be1b43719228
Detections:
redline
Create hunting rule
MALWARE_Win_MetaStealer
Create hunting rule
Link:
https://www.unpac.me/results/d04390b6-e21c-4ccb-b510-11338b790d5a/
Parent samples :
0576191c50a1b6afbcaa5cb0512df5b6a8b9bef9739e5308f8e2e965bf9b0fc5
6cb077ac45cc280c1ace4f4b7f7ec0feb23487074ac50e0113ade7e9509dbb85
ff3bcc4bc70f9e6724fcc0fb36c4f57cc5956136850bd39c9581413f7c4688a9
829026e0d6a6f73f3328bb4aabd5f0e3f063f000cd9d860c051b307e148395d5
78897e2d5b18ff4a71db6703ec5781abedff5794bd79fcee70babd7b0622eef8
SH256 hash:
0215f86b444d539e77552ecfdf64362ac3d9940e7bc73525943bd5553714897b
MD5 hash:
384971e1f5fb85246e0eb13163696563
SHA1 hash:
c4b78004af6e6b361a9ee2ac522fc207e48ae1ac
Link:
https://www.unpac.me/results/d04390b6-e21c-4ccb-b510-11338b790d5a/
SH256 hash:
8c7d1a07c5dfccc26f465c59c3c9f026947cce444a0763457f97da83eb4929aa
MD5 hash:
4bfba4c583d616f466a7d16d7e05d794
SHA1 hash:
0a3bb9904e29e8a68c997e023d3d2507124f8416
Link:
https://www.unpac.me/results/d04390b6-e21c-4ccb-b510-11338b790d5a/
SH256 hash:
ad2380ef7d0973a1939d01a7228e2d218a08ff15acdfa81abfba7dd4ab4dcf6f
MD5 hash:
d2a216696b40b57b9e8da8a208f19095
SHA1 hash:
bbcc004fdbdb7c2c4f8e206403644c8c51ec7f3f
Link:
https://www.unpac.me/results/d04390b6-e21c-4ccb-b510-11338b790d5a/
SH256 hash:
58b9419c5db6c6368aefc757853f29d56a64daf54db52cbaebf1c96e01acb55c
MD5 hash:
b299a448c8d6756448ecf74dc76c41f7
SHA1 hash:
8b38b56aa0cfb50b2b01e29a333e1e5c309b265a
Detections:
MAL_Malware_Imphash_Mar23_1
Create hunting rule
MALWARE_Win_RedLine
Create hunting rule
SUSP_OBF_NET_Reactor_Native_Stub_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/d04390b6-e21c-4ccb-b510-11338b790d5a/
SH256 hash:
6cb077ac45cc280c1ace4f4b7f7ec0feb23487074ac50e0113ade7e9509dbb85
MD5 hash:
2940b15a52c0aaa97db24e4043ffffcf
SHA1 hash:
fa29bd64c6fd9ca4811db98aa8608691cb0324c3
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/d04390b6-e21c-4ccb-b510-11338b790d5a/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6cb077ac45cc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6cb077ac45cc280c1ace4f4b7f7ec0feb23487074ac50e0113ade7e9509dbb85

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIt
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:AutoIT packer
Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RedLineStealer

Executable exe 6cb077ac45cc280c1ace4f4b7f7ec0feb23487074ac50e0113ade7e9509dbb85

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::CopySid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetAce
USER32.dll::GetUserObjectSecurity
ADVAPI32.dll::InitializeAcl
ADVAPI32.dll::InitializeSecurityDescriptor
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
ADVAPI32.dll::GetTokenInformation
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleA
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::OpenSCManagerW
ADVAPI32.dll::UnlockServiceDatabase
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments