revengerat | 4ds[.]zip

Sharing

Copy URL

Twitter E-mail

Reason

office: invalid password

General

Target

4ds.zip
Size

221.1MB
MD5

0c1df79aedd19bad104f962cfa9495a2
SHA1

62f9b3c0e8d3f29663c2bafde2602d7cda044fcc
SHA256

4abc4e174beea2d801bab1f52a202a1adcdc372443e25a2f1875b90f112ff56d
SHA512

b1f89e94914584186da5f6cd2755b35c134402f66f1c0d6dea22feafe84fe5b96f6e46460edce3c1c5a8ce0d0f766f6921b8c196e97172fcdbeeb0057b6f36db

Score

10^/10

stealer macro main 26.02.2020 upx xdsddd victime 25/03 samay cryptone packer 09/04 07/04 insert-coin yt system revengerat zloader

Malware Config

Extracted

Family

zloader

Botnet

main

Campaign

26.02.2020

https://airnaa.org/sound.php

https://banog.org/sound.php

https://rayonch.org/sound.php

rc4.plain

Extracted

Family

revengerat

Botnet

XDSDDD

84.91.119.105:333

Mutex

RV_MUTEX-wtZlNApdygPh

Extracted

Family

revengerat

Botnet

Victime

cocohack.dtdns.net:84

Mutex

RV_MUTEX-OKuSAtYBxGgZHx

Extracted

Family

zloader

Botnet

25/03

https://wgyvjbse.pw/milagrecf.php

https://botiq.xyz/milagrecf.php

rc4.plain

Extracted

Family

revengerat

Botnet

samay

shnf-47787.portmap.io:47787

Mutex

RV_MUTEX

Extracted

Family

zloader

Botnet

09/04

https://eoieowo.casa/wp-config.php

https://dcgljuzrb.pw/wp-config.php

rc4.plain

Extracted

Family

zloader

Botnet

07/04

https://xyajbocpggsr.site/wp-config.php

https://ooygvpxrb.pw/wp-config.php

rc4.plain

Extracted

Family

revengerat

Botnet

INSERT-COIN

3.tcp.ngrok.io:24041

Mutex

RV_MUTEX

Extracted

Family

revengerat

Botnet

yukselofficial.duckdns.org:5552

Mutex

RV_MUTEX-WlgZblRvZwfRtNH

Extracted

Family

revengerat

Botnet

system

yj233.e1.luyouxia.net:20645

Mutex

RV_MUTEX-GeVqDyMpzZJHO

Signatures

RevengeRat Executable 7 IoCs

stealer

Processes:

resource	yara_rule
sample	revengerat
static1/unpack001/905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	revengerat
static1/unpack001/948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe	revengerat
static1/unpack001/KLwC6vii.exe	revengerat
static1/unpack001/fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe	revengerat
static1/unpack001/file(1).exe	revengerat
static1/unpack001/file.exe	revengerat

Revengerat family
revengerat
Zloader family
zloader

CryptOne packer 2 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
static1/unpack001/SecuriteInfo.com.Generic.mg.cde56cf0169830ee.29869	cryptone
static1/unpack001/senate.m4a	cryptone

ServiceHost packer 1 IoCs
Detects ServiceHost packer used for .NET malware

Processes:

resource yara_rule

sample servicehost

resource	yara_rule
sample	servicehost

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro

Processes:

resource	yara_rule
sample	office_macro_on_action

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
static1/unpack001/5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe	upx
static1/unpack001/Endermanch@Birele.exe	upx
static1/unpack001/Endermanch@CleanThis.exe	upx
static1/unpack001/Endermanch@HMBlocker.exe	upx
static1/unpack001/Endermanch@VAV2008.exe	upx
static1/unpack001/Endermanch@Xyeta.exe	upx
static1/unpack001/good.exe	upx

JavaScript code in executable 17 IoCs

Processes:

resource	yara_rule
sample	js
static1/unpack001/Endermanch@PCDefenderv2.msi	js
static1/unpack001/Endermanch@SecurityDefener2015.exe	js
static1/unpack001/Endermanch@WinlockerVB6Blacksod.exe	js
static1/unpack001/ch/jquery-1.js	js
static1/unpack001/chrome-assests/jquery-1.js	js
static1/unpack001/efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js	js
static1/unpack001/firiedge/jquery.min.js	js
static1/unpack001/index(11).html	js
static1/unpack001/jquery-3.js	js
static1/unpack001/jquery.min.js	js
static1/unpack001/js/jquery(1).js	js
static1/unpack001/js/jquery(2).js	js
static1/unpack001/js/jquery-1.12.0.min.js	js
static1/unpack001/js/jquery.js	js
static1/unpack001/js/jquery.min.js	js
static1/unpack001/www.google-analytics.com/analytics.js	js

NSIS installer 9 IoCs

installer

Processes:

resource	yara_rule
sample	nsis_installer_2
static1/unpack001/Endermanch@FakeAdwCleaner.exe	nsis_installer_1
static1/unpack001/Endermanch@FakeAdwCleaner.exe	nsis_installer_2
static1/unpack001/Endermanch@XPAntivirus2008.exe	nsis_installer_1
static1/unpack001/Endermanch@XPAntivirus2008.exe	nsis_installer_2
static1/unpack001/HYDRA.exe	nsis_installer_1
static1/unpack001/HYDRA.exe	nsis_installer_2
static1/unpack001/VyprVPN.exe	nsis_installer_1
static1/unpack001/VyprVPN.exe	nsis_installer_2

Files

4ds.zip
.zip .js
(1).DS_Store
.DS_Store
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.exe
.dll windows x86 regsvr32

Exports

Exports

DllRegisterServer
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
.exe windows x86
0di3x.exe
.exe windows x86
104.248.221.3/systemerror-ie-edge/_data_image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAMA/xhBQAAAAFzUkdCAK7OHOkAAAAPUExURQAAAAICAgAAAP/5WVlXiCGdAAAAADdFJOUwD8ZX+n/7gAAABvSURBVHja7dbBAUAwEABB/ykAAAAAAAAAAAAAAAAAgNcF
104.248.221.3/systemerror-ie-edge/beep.mp3
104.248.221.3/systemerror-ie-edge/bootstrap.min.css
104.248.221.3/systemerror-ie-edge/dsffddfdfdsawqwq22121sdsd.html
104.248.221.3/systemerror-ie-edge/err.mp3
104.248.221.3/systemerror-ie-edge/img/Windows.png
.png
104.248.221.3/systemerror-ie-edge/img/advance_call_center.png
.png
104.248.221.3/systemerror-ie-edge/img/bg.jpg
.jpg
104.248.221.3/systemerror-ie-edge/img/blue-square.png
.png
104.248.221.3/systemerror-ie-edge/img/blur.html
104.248.221.3/systemerror-ie-edge/img/call.png
.png
104.248.221.3/systemerror-ie-edge/img/connect.png
.png
104.248.221.3/systemerror-ie-edge/img/headshot-bg.html
104.248.221.3/systemerror-ie-edge/img/made_in_usa.png
.png
104.248.221.3/systemerror-ie-edge/img/resolve.png
.png
104.248.221.3/systemerror-ie-edge/indexe2c9.html
.js
104.248.221.3/systemerror-ie-edge/js/main.js
.js
104.248.221.3/systemerror-ie-edge/main.min.css
104.248.221.3/systemerror-ie-edge/sli/css/simple-line-icons.css
104.248.221.3/systemerror-ie-edge/sli/fonts/Simple-Line-Iconsb26c.eot
104.248.221.3/systemerror-ie-edge/sli/fonts/Simple-Line-Iconsb26c.svg
.xml
104.248.221.3/systemerror-ie-edge/sli/fonts/Simple-Line-Iconsb26c.ttf
104.248.221.3/systemerror-ie-edge/sli/fonts/Simple-Line-Iconsb26c.woff
104.248.221.3/systemerror-ie-edge/sli/fonts/Simple-Line-Iconsb26c.woff2
104.248.221.3/systemerror-ie-edge/style.min.css
11.html
.js
12.html
.js
2.png
.png
201106-9sxjh7tvxj_pw_infected.zip
.zip

Password: infected
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab
.dll windows x86
2019-09-02_22-41-10.exe
.exe windows x86
2c01b007729230c415420ad641ad92eb.exe
.exe windows x86
31.exe
.exe windows x86
3DMark 11 Advanced Edition.exe
.exe windows x86
405.zip
.zip
files/alert.jpg
.jpg
files/alertmicrosoft.mp3
files/background-2.png
.png
files/microsoft.png
.png
files/style.css
files/warning.mp3
index.html
.js
msie1.html
.js
msie2.html
.js
42f972925508a82236e8533567487761.exe
.exe windows x86
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
.exe windows x86
6306868794.bin.zip
.zip

Password: infected
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286
.exe windows x86
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
.exe windows x86
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
.exe windows x86
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
.exe windows x86
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.exe
.dll windows x86 regsvr32

Exports

Exports

DllRegisterServer
Archive.zip__ccacaxs2tbz2t6ob3e.exe
.exe windows x86
CVE-2018-15982_PoC.swf
Chris@Spark.exe
.exe windows x86
Cuberates@TaskILL.exe
.exe windows x86
DiskInternals_Uneraser_v5_keygen.exe
.exe windows x86
DoppelPaymer.RANSOM.zip
.zip

Password: infected
DoppelPaymer.RANSOM
.exe windows x86
E2-20201118_141759.zip
.zip

Password: infected
f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
.exe windows x86
E42A.zip
.zip

Password: infected
E42A
.exe windows x86
Endermanch@000.exe
.exe windows x86
Endermanch@7ev3n.exe
.exe windows x86
Endermanch@AnViPC2009.exe
.exe windows x86
Endermanch@Antivirus.exe
.exe windows x86
Endermanch@AntivirusPlatinum.exe
.exe windows x86
Endermanch@AntivirusPro2017.exe
.exe windows x86
Endermanch@BadRabbit.exe
.exe windows x86
Endermanch@Birele.exe
.exe windows x86
Endermanch@Cerber5.exe
.exe windows x86
Endermanch@CleanThis.exe
.exe windows x86
Endermanch@ColorBug.exe
.exe windows x86
Endermanch@DeriaLock.exe
.exe windows x86
Endermanch@Deskbottom.exe
.exe windows x86
Endermanch@DesktopPuzzle.exe
.exe windows x86
Endermanch@FakeAdwCleaner.exe
.exe windows x86
Endermanch@FreeYoutubeDownloader.exe
.exe windows x86
Endermanch@HMBlocker.exe
.exe windows x86
Endermanch@HappyAntivirus.exe
.exe windows x86
Endermanch@Illerka.C.exe
.exe windows x86
Endermanch@InternetSecurityGuard.exe
.exe windows x86
Endermanch@Koteyka2.exe
.exe windows x86

Exports

Exports

TMethodImplementationIntercept
Endermanch@LPS2019.exe
.exe windows x86
Endermanch@Movie.mpeg.exe
.exe windows x86
Endermanch@NavaShield(1).exe
.exe windows x86
Endermanch@NavaShield.exe
.exe windows x86
Endermanch@PCDefender.exe
.exe windows x86
Endermanch@PCDefenderv2.msi
.msi .vbs
Endermanch@PolyRansom.exe
.exe windows x86
Endermanch@PowerPoint.exe
.exe windows x86
Endermanch@ProgramOverflow.exe
.exe windows x86

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Endermanch@RegistrySmart.exe
.exe windows x86
Endermanch@SE2011.exe
.exe windows x86

Exports

Exports

JxhPlrtnbwuvxh@4
_Append_Text_Value@12
RvwUlnjfrvAnj@8
HttJefedtqlhmlpx@16
_Clear_DataText@8
UwqYofBgyHjd@8
Endermanch@SecurityCentral.exe
.exe windows x86
Endermanch@SecurityDefender.exe
.exe windows x86
Endermanch@SecurityDefener2015.exe
.exe windows x86
Endermanch@SecurityScanner.exe
.exe windows x86
Endermanch@SmartDefragmenter.exe
.exe windows x86
Endermanch@UserOverflow.exe
.exe windows x86

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Endermanch@VAV2008.exe
.exe windows x86
Endermanch@WindowsAcceleratorPro.exe
.exe windows x86
Endermanch@WinlockerVB6Blacksod.exe
.exe windows x86
Endermanch@WolframAV.exe
.exe windows x86
Endermanch@XPAntivirus2008.exe
.exe windows x86
Endermanch@Xyeta.exe
.exe windows x86
Fake BSOD.html
.js
Fantom.exe
.exe windows x86
ForceOp 2.8.7 - By RaiSence.exe
.exe windows x86
HYDRA.exe
.exe windows x86
KLwC6vii.exe
.exe windows x86
Keygen.exe
.exe windows x86
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
.exe windows x86
LtHv0O2KZDK4M637.exe
.exe windows x86
Magic_File_v3_keygen_by_KeygenNinja.exe
.exe windows x86
Malware
NETFramework.exe
.exe windows x86

Exports

Exports

?dwPlaceholder@@3PAEA
_DecodePointerInternal@4
_EncodePointerInternal@4
OnlineInstaller.exe
.exe windows x86

Exports

Exports

??0CActiveXUI@DuiLib@@QAE@ABV01@@Z
??0CActiveXUI@DuiLib@@QAE@XZ
??0CButtonUI@DuiLib@@QAE@ABV01@@Z
??0CButtonUI@DuiLib@@QAE@XZ
??0CCheckBoxUI@DuiLib@@QAE@ABV01@@Z
??0CCheckBoxUI@DuiLib@@QAE@XZ
??0CChildLayoutUI@DuiLib@@QAE@ABV01@@Z
??0CChildLayoutUI@DuiLib@@QAE@XZ
??0CComboUI@DuiLib@@QAE@ABV01@@Z
??0CComboUI@DuiLib@@QAE@XZ
??0CContainerUI@DuiLib@@QAE@ABV01@@Z
??0CContainerUI@DuiLib@@QAE@XZ
??0CControlUI@DuiLib@@QAE@ABV01@@Z
??0CControlUI@DuiLib@@QAE@XZ
??0CDateTimeUI@DuiLib@@QAE@ABV01@@Z
??0CDateTimeUI@DuiLib@@QAE@XZ
??0CDelegateBase@DuiLib@@QAE@ABV01@@Z
??0CDelegateBase@DuiLib@@QAE@PAX0@Z
??0CDialogBuilder@DuiLib@@QAE@XZ
??0CDuiPoint@DuiLib@@QAE@ABUtagPOINT@@@Z
??0CDuiPoint@DuiLib@@QAE@J@Z
??0CDuiPoint@DuiLib@@QAE@JJ@Z
??0CDuiPoint@DuiLib@@QAE@PB_W@Z
??0CDuiPoint@DuiLib@@QAE@XZ
??0CDuiPtrArray@DuiLib@@QAE@ABV01@@Z
??0CDuiPtrArray@DuiLib@@QAE@H@Z
??0CDuiRect@DuiLib@@QAE@ABUtagRECT@@@Z
??0CDuiRect@DuiLib@@QAE@JJJJ@Z
??0CDuiRect@DuiLib@@QAE@PB_W@Z
??0CDuiRect@DuiLib@@QAE@XZ
??0CDuiSize@DuiLib@@QAE@ABUtagSIZE@@@Z
??0CDuiSize@DuiLib@@QAE@JJ@Z
??0CDuiSize@DuiLib@@QAE@PB_W@Z
??0CDuiSize@DuiLib@@QAE@UtagRECT@@@Z
??0CDuiSize@DuiLib@@QAE@XZ
??0CDuiString@DuiLib@@QAE@ABV01@@Z
??0CDuiString@DuiLib@@QAE@PB_WH@Z
??0CDuiString@DuiLib@@QAE@XZ
??0CDuiString@DuiLib@@QAE@_W@Z
??0CDuiStringPtrMap@DuiLib@@QAE@H@Z
??0CDuiValArray@DuiLib@@QAE@HH@Z
??0CEditUI@DuiLib@@QAE@ABV01@@Z
??0CEditUI@DuiLib@@QAE@XZ
??0CEventSource@DuiLib@@QAE@ABV01@@Z
??0CEventSource@DuiLib@@QAE@XZ
??0CGifAnimUI@DuiLib@@QAE@ABV01@@Z
??0CGifAnimUI@DuiLib@@QAE@XZ
??0CHorizontalLayoutUI@DuiLib@@QAE@ABV01@@Z
??0CHorizontalLayoutUI@DuiLib@@QAE@XZ
??0CHyperLinkUI@DuiLib@@QAE@ABV01@@Z
??0CHyperLinkUI@DuiLib@@QAE@XZ
??0CLabelUI@DuiLib@@QAE@ABV01@@Z
??0CLabelUI@DuiLib@@QAE@XZ
??0CListContainerElementUI@DuiLib@@QAE@ABV01@@Z
??0CListContainerElementUI@DuiLib@@QAE@XZ
??0CListElementUI@DuiLib@@QAE@ABV01@@Z
??0CListElementUI@DuiLib@@QAE@XZ
??0CListHBoxElementUI@DuiLib@@QAE@ABV01@@Z
??0CListHBoxElementUI@DuiLib@@QAE@XZ
??0CListHeaderItemUI@DuiLib@@QAE@ABV01@@Z
??0CListHeaderItemUI@DuiLib@@QAE@XZ
??0CListHeaderUI@DuiLib@@QAE@ABV01@@Z
??0CListHeaderUI@DuiLib@@QAE@XZ
??0CListLabelElementUI@DuiLib@@QAE@ABV01@@Z
??0CListLabelElementUI@DuiLib@@QAE@XZ
??0CListTextElementUI@DuiLib@@QAE@ABV01@@Z
??0CListTextElementUI@DuiLib@@QAE@XZ
??0CListUI@DuiLib@@QAE@ABV01@@Z
??0CListUI@DuiLib@@QAE@XZ
??0CMarkup@DuiLib@@QAE@PB_W@Z
??0CMarkupNode@DuiLib@@AAE@PAVCMarkup@1@H@Z
??0CMarkupNode@DuiLib@@AAE@XZ
??0CNotifyPump@DuiLib@@QAE@ABV01@@Z
??0CNotifyPump@DuiLib@@QAE@XZ
??0COptionUI@DuiLib@@QAE@ABV01@@Z
??0COptionUI@DuiLib@@QAE@XZ
??0CPaintManagerUI@DuiLib@@QAE@ABV01@@Z
??0CPaintManagerUI@DuiLib@@QAE@XZ
??0CProgressUI@DuiLib@@QAE@ABV01@@Z
??0CProgressUI@DuiLib@@QAE@XZ
??0CRichEditUI@DuiLib@@QAE@ABV01@@Z
??0CRichEditUI@DuiLib@@QAE@XZ
??0CScrollBarUI@DuiLib@@QAE@ABV01@@Z
??0CScrollBarUI@DuiLib@@QAE@XZ
??0CSliderUI@DuiLib@@QAE@ABV01@@Z
??0CSliderUI@DuiLib@@QAE@XZ
??0CTabLayoutUI@DuiLib@@QAE@ABV01@@Z
??0CTabLayoutUI@DuiLib@@QAE@XZ
??0CTextUI@DuiLib@@QAE@ABV01@@Z
??0CTextUI@DuiLib@@QAE@XZ
??0CTileLayoutUI@DuiLib@@QAE@ABV01@@Z
??0CTileLayoutUI@DuiLib@@QAE@XZ
??0CTreeNodeUI@DuiLib@@QAE@ABV01@@Z
??0CTreeNodeUI@DuiLib@@QAE@PAV01@@Z
??0CTreeViewUI@DuiLib@@QAE@ABV01@@Z
??0CTreeViewUI@DuiLib@@QAE@XZ
??0CVerticalLayoutUI@DuiLib@@QAE@ABV01@@Z
??0CVerticalLayoutUI@DuiLib@@QAE@XZ
??0CWaitCursor@DuiLib@@QAE@XZ
??0CWebBrowserUI@DuiLib@@QAE@ABV01@@Z
??0CWebBrowserUI@DuiLib@@QAE@XZ
??0CWindowWnd@DuiLib@@QAE@ABV01@@Z
??0CWindowWnd@DuiLib@@QAE@XZ
??0CWndShadow@@QAE@ABV0@@Z
??0CWndShadow@@QAE@XZ
??0IMessageFilterUI@DuiLib@@QAE@ABV01@@Z
??0IMessageFilterUI@DuiLib@@QAE@XZ
??0INotifyUI@DuiLib@@QAE@ABV01@@Z
??0INotifyUI@DuiLib@@QAE@XZ
??0ITranslateAccelerator@DuiLib@@QAE@ABV01@@Z
??0ITranslateAccelerator@DuiLib@@QAE@XZ
??0STRINGorID@DuiLib@@QAE@I@Z
??0STRINGorID@DuiLib@@QAE@PB_W@Z
??0WindowImplBase@DuiLib@@QAE@ABV01@@Z
??0WindowImplBase@DuiLib@@QAE@XZ
??0tagTDrawInfo@DuiLib@@QAE@ABU01@@Z
??0tagTDrawInfo@DuiLib@@QAE@PB_W@Z
??0tagTDrawInfo@DuiLib@@QAE@XZ
??0tagTFontInfo@DuiLib@@QAE@ABU01@@Z
??0tagTFontInfo@DuiLib@@QAE@XZ
??0tagTImageInfo@DuiLib@@QAE@ABU01@@Z
??0tagTImageInfo@DuiLib@@QAE@XZ
??0tagTResInfo@DuiLib@@QAE@ABU01@@Z
??0tagTResInfo@DuiLib@@QAE@XZ
??1CActiveXUI@DuiLib@@UAE@XZ
??1CButtonUI@DuiLib@@UAE@XZ
??1CCheckBoxUI@DuiLib@@UAE@XZ
??1CChildLayoutUI@DuiLib@@UAE@XZ
??1CComboUI@DuiLib@@UAE@XZ
??1CContainerUI@DuiLib@@UAE@XZ
??1CControlUI@DuiLib@@MAE@XZ
??1CDateTimeUI@DuiLib@@UAE@XZ
??1CDelegateBase@DuiLib@@UAE@XZ
??1CDialogBuilder@DuiLib@@QAE@XZ
??1CDuiPtrArray@DuiLib@@QAE@XZ
??1CDuiString@DuiLib@@QAE@XZ
??1CDuiStringPtrMap@DuiLib@@QAE@XZ
??1CDuiValArray@DuiLib@@QAE@XZ
??1CEditUI@DuiLib@@UAE@XZ
??1CEventSource@DuiLib@@QAE@XZ
??1CGifAnimUI@DuiLib@@UAE@XZ
??1CHorizontalLayoutUI@DuiLib@@UAE@XZ
??1CHyperLinkUI@DuiLib@@UAE@XZ
??1CLabelUI@DuiLib@@UAE@XZ
??1CListContainerElementUI@DuiLib@@UAE@XZ
??1CListElementUI@DuiLib@@UAE@XZ
??1CListHBoxElementUI@DuiLib@@UAE@XZ
??1CListHeaderItemUI@DuiLib@@UAE@XZ
??1CListHeaderUI@DuiLib@@UAE@XZ
??1CListLabelElementUI@DuiLib@@UAE@XZ
??1CListTextElementUI@DuiLib@@UAE@XZ
??1CListUI@DuiLib@@UAE@XZ
??1CMarkup@DuiLib@@QAE@XZ
??1CNotifyPump@DuiLib@@QAE@XZ
??1COptionUI@DuiLib@@UAE@XZ
??1CPaintManagerUI@DuiLib@@QAE@XZ
??1CProgressUI@DuiLib@@UAE@XZ
??1CRenderClip@DuiLib@@QAE@XZ
??1CRichEditUI@DuiLib@@UAE@XZ
??1CScrollBarUI@DuiLib@@UAE@XZ
??1CSliderUI@DuiLib@@UAE@XZ
??1CTabLayoutUI@DuiLib@@UAE@XZ
??1CTextUI@DuiLib@@UAE@XZ
??1CTileLayoutUI@DuiLib@@UAE@XZ
??1CTreeNodeUI@DuiLib@@UAE@XZ
??1CTreeViewUI@DuiLib@@UAE@XZ
??1CVerticalLayoutUI@DuiLib@@UAE@XZ
??1CWaitCursor@DuiLib@@QAE@XZ
??1CWebBrowserUI@DuiLib@@UAE@XZ
??1CWndShadow@@UAE@XZ
??1WindowImplBase@DuiLib@@UAE@XZ
??1tagTDrawInfo@DuiLib@@QAE@XZ
??1tagTFontInfo@DuiLib@@QAE@XZ
??1tagTImageInfo@DuiLib@@QAE@XZ
??1tagTResInfo@DuiLib@@QAE@XZ
??4CActiveXUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CButtonUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CCheckBoxUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CChildLayoutUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CComboUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CContainerUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CControlUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CDateTimeUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CDelegateBase@DuiLib@@QAEAAV01@ABV01@@Z
??4CDialogBuilder@DuiLib@@QAEAAV01@ABV01@@Z
??4CDuiPoint@DuiLib@@QAEAAV01@ABV01@@Z
??4CDuiPtrArray@DuiLib@@QAEAAV01@ABV01@@Z
??4CDuiRect@DuiLib@@QAEAAV01@ABV01@@Z
??4CDuiSize@DuiLib@@QAEAAV01@ABV01@@Z
??4CDuiString@DuiLib@@QAEABV01@ABV01@@Z
??4CDuiString@DuiLib@@QAEABV01@PBD@Z
??4CDuiString@DuiLib@@QAEABV01@PB_W@Z
??4CDuiString@DuiLib@@QAEABV01@_W@Z
??4CDuiStringPtrMap@DuiLib@@QAEAAV01@ABV01@@Z
??4CDuiValArray@DuiLib@@QAEAAV01@ABV01@@Z
??4CEditUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CEventSource@DuiLib@@QAEAAV01@ABV01@@Z
??4CGifAnimUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CHorizontalLayoutUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CHyperLinkUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CLabelUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CListContainerElementUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CListElementUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CListHBoxElementUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CListHeaderItemUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CListHeaderUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CListLabelElementUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CListTextElementUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CListUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CMarkup@DuiLib@@QAEAAV01@ABV01@@Z
??4CMarkupNode@DuiLib@@QAEAAV01@ABV01@@Z
??4CNotifyPump@DuiLib@@QAEAAV01@ABV01@@Z
??4COptionUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CPaintManagerUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CProgressUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CRenderClip@DuiLib@@QAEAAV01@ABV01@@Z
??4CRenderEngine@DuiLib@@QAEAAV01@ABV01@@Z
??4CRichEditUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CScrollBarUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CSliderUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CTabLayoutUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CTextUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CTileLayoutUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CTreeNodeUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CTreeViewUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CVerticalLayoutUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CWaitCursor@DuiLib@@QAEAAV01@ABV01@@Z
??4CWebBrowserUI@DuiLib@@QAEAAV01@ABV01@@Z
??4CWindowWnd@DuiLib@@QAEAAV01@ABV01@@Z
??4CWndShadow@@QAEAAV0@ABV0@@Z
??4IMessageFilterUI@DuiLib@@QAEAAV01@ABV01@@Z
??4INotifyUI@DuiLib@@QAEAAV01@ABV01@@Z
??4ITranslateAccelerator@DuiLib@@QAEAAV01@ABV01@@Z
??4STRINGorID@DuiLib@@QAEAAV01@ABV01@@Z
??4WindowImplBase@DuiLib@@QAEAAV01@ABV01@@Z
??4tagTDrawInfo@DuiLib@@QAEAAU01@ABU01@@Z
??4tagTEventUI@DuiLib@@QAEAAU01@ABU01@@Z
??4tagTFontInfo@DuiLib@@QAEAAU01@ABU01@@Z
??4tagTImageInfo@DuiLib@@QAEAAU01@ABU01@@Z
??4tagTPercentInfo@DuiLib@@QAEAAU01@ABU01@@Z
??4tagTResInfo@DuiLib@@QAEAAU01@ABU01@@Z
??8CDuiString@DuiLib@@QBE_NPB_W@Z
??9CDuiString@DuiLib@@QBE_NPB_W@Z
??ACDuiPtrArray@DuiLib@@QBEPAXH@Z
??ACDuiString@DuiLib@@QBE_WH@Z
??ACDuiStringPtrMap@DuiLib@@QBEPB_WH@Z
??ACDuiValArray@DuiLib@@QBEPAXH@Z
??BCDuiString@DuiLib@@QBEPB_WXZ
??BCEventSource@DuiLib@@QAE_NXZ
??BCWindowWnd@DuiLib@@QBEPAUHWND__@@XZ
??BCWndShadow@@QBEPAUHWND__@@XZ
??HCDuiString@DuiLib@@QBE?AV01@ABV01@@Z
??HCDuiString@DuiLib@@QBE?AV01@PB_W@Z
??MCDuiString@DuiLib@@QBE_NPB_W@Z
??NCDuiString@DuiLib@@QBE_NPB_W@Z
??OCDuiString@DuiLib@@QBE_NPB_W@Z
??PCDuiString@DuiLib@@QBE_NPB_W@Z
??RCDelegateBase@DuiLib@@QAE_NPAX@Z
??RCEventSource@DuiLib@@QAE_NPAX@Z
??YCDuiString@DuiLib@@QAEABV01@ABV01@@Z
??YCDuiString@DuiLib@@QAEABV01@PBD@Z
??YCDuiString@DuiLib@@QAEABV01@PB_W@Z
??YCDuiString@DuiLib@@QAEABV01@_W@Z
??YCEventSource@DuiLib@@QAEXABVCDelegateBase@1@@Z
??YCEventSource@DuiLib@@QAEXP6A_NPAX@Z@Z
??ZCEventSource@DuiLib@@QAEXABVCDelegateBase@1@@Z
??ZCEventSource@DuiLib@@QAEXP6A_NPAX@Z@Z
??_7CActiveXUI@DuiLib@@6BCControlUI@1@@
??_7CActiveXUI@DuiLib@@6BIMessageFilterUI@1@@
??_7CButtonUI@DuiLib@@6B@
??_7CCheckBoxUI@DuiLib@@6B@
??_7CChildLayoutUI@DuiLib@@6BCControlUI@1@@
??_7CChildLayoutUI@DuiLib@@6BIContainerUI@1@@
??_7CComboUI@DuiLib@@6B@
??_7CComboUI@DuiLib@@6BCControlUI@1@@
??_7CComboUI@DuiLib@@6BIContainerUI@1@@
??_7CContainerUI@DuiLib@@6BCControlUI@1@@
??_7CContainerUI@DuiLib@@6BIContainerUI@1@@
??_7CControlUI@DuiLib@@6B@
??_7CDateTimeUI@DuiLib@@6B@
??_7CDelegateBase@DuiLib@@6B@
??_7CEditUI@DuiLib@@6B@
??_7CGifAnimUI@DuiLib@@6B@
??_7CHorizontalLayoutUI@DuiLib@@6BCControlUI@1@@
??_7CHorizontalLayoutUI@DuiLib@@6BIContainerUI@1@@
??_7CHyperLinkUI@DuiLib@@6B@
??_7CLabelUI@DuiLib@@6B@
??_7CListContainerElementUI@DuiLib@@6B@
??_7CListContainerElementUI@DuiLib@@6BCControlUI@1@@
??_7CListContainerElementUI@DuiLib@@6BIContainerUI@1@@
??_7CListElementUI@DuiLib@@6BCControlUI@1@@
??_7CListElementUI@DuiLib@@6BIListItemUI@1@@
??_7CListHBoxElementUI@DuiLib@@6B@
??_7CListHBoxElementUI@DuiLib@@6BCControlUI@1@@
??_7CListHBoxElementUI@DuiLib@@6BIContainerUI@1@@
??_7CListHeaderItemUI@DuiLib@@6B@
??_7CListHeaderUI@DuiLib@@6BCControlUI@1@@
??_7CListHeaderUI@DuiLib@@6BIContainerUI@1@@
??_7CListLabelElementUI@DuiLib@@6BCControlUI@1@@
??_7CListLabelElementUI@DuiLib@@6BIListItemUI@1@@
??_7CListTextElementUI@DuiLib@@6BCControlUI@1@@
??_7CListTextElementUI@DuiLib@@6BIListItemUI@1@@
??_7CListUI@DuiLib@@6B@
??_7CListUI@DuiLib@@6BCControlUI@1@@
??_7CListUI@DuiLib@@6BIContainerUI@1@@
??_7CNotifyPump@DuiLib@@6B@
??_7COptionUI@DuiLib@@6B@
??_7CProgressUI@DuiLib@@6B@
??_7CRichEditUI@DuiLib@@6B@
??_7CRichEditUI@DuiLib@@6BCControlUI@1@@
??_7CRichEditUI@DuiLib@@6BIContainerUI@1@@
??_7CScrollBarUI@DuiLib@@6B@
??_7CSliderUI@DuiLib@@6B@
??_7CTabLayoutUI@DuiLib@@6BCControlUI@1@@
??_7CTabLayoutUI@DuiLib@@6BIContainerUI@1@@
??_7CTextUI@DuiLib@@6B@
??_7CTileLayoutUI@DuiLib@@6BCControlUI@1@@
??_7CTileLayoutUI@DuiLib@@6BIContainerUI@1@@
??_7CTreeNodeUI@DuiLib@@6B@
??_7CTreeNodeUI@DuiLib@@6BCControlUI@1@@
??_7CTreeNodeUI@DuiLib@@6BIContainerUI@1@@
??_7CTreeViewUI@DuiLib@@6BCControlUI@1@@
??_7CTreeViewUI@DuiLib@@6BCListUI@1@@
??_7CTreeViewUI@DuiLib@@6BIContainerUI@1@@
??_7CTreeViewUI@DuiLib@@6BINotifyUI@1@@
??_7CVerticalLayoutUI@DuiLib@@6BCControlUI@1@@
??_7CVerticalLayoutUI@DuiLib@@6BIContainerUI@1@@
??_7CWebBrowserUI@DuiLib@@6BCControlUI@1@@
??_7CWebBrowserUI@DuiLib@@6BIDispatch@@@
??_7CWebBrowserUI@DuiLib@@6BIDocHostUIHandler@@@
??_7CWebBrowserUI@DuiLib@@6BIMessageFilterUI@1@@
??_7CWebBrowserUI@DuiLib@@6BIOleCommandTarget@@@
??_7CWebBrowserUI@DuiLib@@6BIServiceProvider@@@
??_7CWebBrowserUI@DuiLib@@6BITranslateAccelerator@1@@
??_7CWindowWnd@DuiLib@@6B@
??_7CWndShadow@@6B@
??_7IMessageFilterUI@DuiLib@@6B@
??_7INotifyUI@DuiLib@@6B@
??_7ITranslateAccelerator@DuiLib@@6B@
??_7WindowImplBase@DuiLib@@6BCNotifyPump@1@@
??_7WindowImplBase@DuiLib@@6BCWindowWnd@1@@
??_7WindowImplBase@DuiLib@@6BIDialogBuilderCallback@1@@
??_7WindowImplBase@DuiLib@@6BIMessageFilterUI@1@@
??_7WindowImplBase@DuiLib@@6BINotifyUI@1@@
??_FCDuiPtrArray@DuiLib@@QAEXXZ
??_FCDuiStringPtrMap@DuiLib@@QAEXXZ
??_FCMarkup@DuiLib@@QAEXXZ
??_FCTreeNodeUI@DuiLib@@QAEXXZ
?Activate@CButtonUI@DuiLib@@UAE_NXZ
?Activate@CComboUI@DuiLib@@UAE_NXZ
?Activate@CControlUI@DuiLib@@UAE_NXZ
?Activate@CHyperLinkUI@DuiLib@@UAE_NXZ
?Activate@CListContainerElementUI@DuiLib@@UAE_NXZ
?Activate@CListElementUI@DuiLib@@UAE_NXZ
?Activate@COptionUI@DuiLib@@UAE_NXZ
?Add@CComboUI@DuiLib@@UAE_NPAVCControlUI@2@@Z
?Add@CContainerUI@DuiLib@@UAE_NPAVCControlUI@2@@Z
?Add@CDuiPtrArray@DuiLib@@QAE_NPAX@Z
?Add@CDuiValArray@DuiLib@@QAE_NPBX@Z
?Add@CListUI@DuiLib@@UAE_NPAVCControlUI@2@@Z
?Add@CTabLayoutUI@DuiLib@@UAE_NPAVCControlUI@2@@Z
?Add@CTreeNodeUI@DuiLib@@UAE_NPAVCControlUI@2@@Z
?Add@CTreeViewUI@DuiLib@@UAE_NPAVCControlUI@2@@Z
?AddAt@CComboUI@DuiLib@@UAE_NPAVCControlUI@2@H@Z
?AddAt@CContainerUI@DuiLib@@UAE_NPAVCControlUI@2@H@Z
?AddAt@CListUI@DuiLib@@UAE_NPAVCControlUI@2@H@Z
?AddAt@CTabLayoutUI@DuiLib@@UAE_NPAVCControlUI@2@H@Z
?AddAt@CTreeNodeUI@DuiLib@@UAE_NPAVCControlUI@2@H@Z
?AddAt@CTreeViewUI@DuiLib@@QAEJPAVCTreeNodeUI@2@H@Z
?AddAt@CTreeViewUI@DuiLib@@QAE_NPAVCTreeNodeUI@2@0@Z
?AddAt@CTreeViewUI@DuiLib@@UAE_NPAVCControlUI@2@H@Z
?AddChildNode@CTreeNodeUI@DuiLib@@QAE_NPAV12@@Z
?AddCustomAttribute@CControlUI@DuiLib@@QAEXPB_W0@Z
?AddDefaultAttributeList@CPaintManagerUI@DuiLib@@QAEXPB_W0_N@Z
?AddDelayedCleanup@CPaintManagerUI@DuiLib@@QAEXPAVCControlUI@2@@Z
?AddFont@CPaintManagerUI@DuiLib@@QAEPAUHFONT__@@HPB_WH_N111@Z
?AddImage@CPaintManagerUI@DuiLib@@QAEPBUtagTImageInfo@2@PB_W0K_N1@Z
?AddImage@CPaintManagerUI@DuiLib@@QAEPBUtagTImageInfo@2@PB_WPAUHBITMAP__@@HH_N2@Z
?AddMessageFilter@CPaintManagerUI@DuiLib@@QAE_NPAVIMessageFilterUI@2@@Z
?AddMouseLeaveNeeded@CPaintManagerUI@DuiLib@@QAEXPAVCControlUI@2@@Z
?AddMultiLanguageString@CPaintManagerUI@DuiLib@@SAXHPB_W@Z
?AddNativeWindow@CPaintManagerUI@DuiLib@@QAE_NPAVCControlUI@2@PAUHWND__@@@Z
?AddNotifier@CPaintManagerUI@DuiLib@@QAE_NPAVINotifyUI@2@@Z
?AddOptionGroup@CPaintManagerUI@DuiLib@@QAE_NPB_WPAVCControlUI@2@@Z
?AddPostPaint@CPaintManagerUI@DuiLib@@QAE_NPAVCControlUI@2@@Z
?AddPreMessageFilter@CPaintManagerUI@DuiLib@@QAE_NPAVIMessageFilterUI@2@@Z
?AddRef@CWebBrowserUI@DuiLib@@UAGKXZ
?AddTranslateAccelerator@CPaintManagerUI@DuiLib@@QAE_NPAVITranslateAccelerator@2@@Z
?AddVirtualWnd@CNotifyPump@DuiLib@@QAE_NVCDuiString@2@PAV12@@Z
?AddWindowCustomAttribute@CPaintManagerUI@DuiLib@@QAEXPB_W0@Z
?AdjustColor@CRenderEngine@DuiLib@@SAKKFFF@Z
?AdjustImage@CRenderEngine@DuiLib@@SAX_NPAUtagTImageInfo@2@FFF@Z
?AdjustImagesHSL@CPaintManagerUI@DuiLib@@AAEXXZ
?AdjustSharedImagesHSL@CPaintManagerUI@DuiLib@@CAXXZ
?Append@CDuiString@DuiLib@@QAEXPB_W@Z
?AppendText@CRichEditUI@DuiLib@@QAEHPB_W_N@Z
?Assign@CDuiString@DuiLib@@QAEXPB_WH@Z
?AttachDialog@CPaintManagerUI@DuiLib@@QAE_NPAVCControlUI@2@@Z
?BeforeNavigate2@CWebBrowserUI@DuiLib@@IAEXPAUIDispatch@@AAPAUtagVARIANT@@1111AAPAF@Z
?CalLocation@CTreeNodeUI@DuiLib@@AAEPAV12@PAV12@@Z
?CenterWindow@CWindowWnd@DuiLib@@QAEXXZ
?CharFromPos@CRichEditUI@DuiLib@@QBEHVCDuiPoint@2@@Z
?CheckBoxSelected@CTreeNodeUI@DuiLib@@QAEX_N@Z
?Clear@CRichEditUI@DuiLib@@QAEXXZ
?Clear@tagTDrawInfo@DuiLib@@QAEXXZ
?Close@CWindowWnd@DuiLib@@QAEXI@Z
?CommandStateChange@CWebBrowserUI@DuiLib@@IAEXJF@Z
?Compare@CDuiString@DuiLib@@QBEHPB_W@Z
?CompareNoCase@CDuiString@DuiLib@@QBEHPB_W@Z
?Copy@CRichEditUI@DuiLib@@QAEXXZ
?Create@CDialogBuilder@DuiLib@@QAEPAVCControlUI@2@PAVIDialogBuilderCallback@2@PAVCPaintManagerUI@2@PAV32@@Z
?Create@CDialogBuilder@DuiLib@@QAEPAVCControlUI@2@VSTRINGorID@2@PB_WPAVIDialogBuilderCallback@2@PAVCPaintManagerUI@2@PAV32@@Z
?Create@CWindowWnd@DuiLib@@QAEPAUHWND__@@PAU3@PB_WKKHHHHPAUHMENU__@@@Z
?Create@CWindowWnd@DuiLib@@QAEPAUHWND__@@PAU3@PB_WKKUtagRECT@@PAUHMENU__@@@Z
?Create@CWndShadow@@QAEXPAUHWND__@@@Z
?CreateARGB32Bitmap@CRenderEngine@DuiLib@@SAPAUHBITMAP__@@PAUHDC__@@HHPAPAK@Z
?CreateControl@CActiveXUI@DuiLib@@QAE_NPB_W@Z
?CreateControl@CActiveXUI@DuiLib@@QAE_NU_GUID@@@Z
?CreateControl@WindowImplBase@DuiLib@@UAEPAVCControlUI@2@PB_W@Z
?CreateDuiWindow@CWindowWnd@DuiLib@@QAEPAUHWND__@@PAU3@PB_WKK@Z
?Cut@CRichEditUI@DuiLib@@QAEXXZ
?DUI__Trace@DuiLib@@YAXPB_WZZ
?DUI__TraceMsg@DuiLib@@YAPB_WI@Z
?Deflate@CDuiRect@DuiLib@@QAEXHH@Z
?Delete@CControlUI@DuiLib@@UAEXXZ
?DeleteGif@CGifAnimUI@DuiLib@@AAEXXZ
?DoCreateControl@CActiveXUI@DuiLib@@MAE_NXZ
?DoCreateControl@CWebBrowserUI@DuiLib@@UAE_NXZ
?DoEvent@CButtonUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CComboUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CContainerUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CControlUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CDateTimeUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CEditUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CGifAnimUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CHorizontalLayoutUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CHyperLinkUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CLabelUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CListContainerElementUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CListElementUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CListHeaderItemUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CListLabelElementUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CListTextElementUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CListUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CRichEditUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CScrollBarUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CSliderUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CTextUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CTreeNodeUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoEvent@CVerticalLayoutUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoInit@CComboUI@DuiLib@@UAEXXZ
?DoInit@CControlUI@DuiLib@@UAEXXZ
?DoInit@CGifAnimUI@DuiLib@@UAEXXZ
?DoInit@CRichEditUI@DuiLib@@UAEXXZ
?DoPaint@CActiveXUI@DuiLib@@UAE_NPAUHDC__@@ABUtagRECT@@PAVCControlUI@2@@Z
?DoPaint@CComboUI@DuiLib@@UAE_NPAUHDC__@@ABUtagRECT@@PAVCControlUI@2@@Z
?DoPaint@CContainerUI@DuiLib@@UAE_NPAUHDC__@@ABUtagRECT@@PAVCControlUI@2@@Z
?DoPaint@CControlUI@DuiLib@@UAE_NPAUHDC__@@ABUtagRECT@@PAV12@@Z
?DoPaint@CGifAnimUI@DuiLib@@UAE_NPAUHDC__@@ABUtagRECT@@PAVCControlUI@2@@Z
?DoPaint@CListContainerElementUI@DuiLib@@UAE_NPAUHDC__@@ABUtagRECT@@PAVCControlUI@2@@Z
?DoPaint@CListHBoxElementUI@DuiLib@@UAE_NPAUHDC__@@ABUtagRECT@@PAVCControlUI@2@@Z
?DoPaint@CListLabelElementUI@DuiLib@@UAE_NPAUHDC__@@ABUtagRECT@@PAVCControlUI@2@@Z
?DoPaint@CRichEditUI@DuiLib@@UAE_NPAUHDC__@@ABUtagRECT@@PAVCControlUI@2@@Z
?DoPaint@CScrollBarUI@DuiLib@@UAE_NPAUHDC__@@ABUtagRECT@@PAVCControlUI@2@@Z
?DoPostPaint@CControlUI@DuiLib@@UAEXPAUHDC__@@ABUtagRECT@@@Z
?DoPostPaint@CHorizontalLayoutUI@DuiLib@@UAEXPAUHDC__@@ABUtagRECT@@@Z
?DoPostPaint@CVerticalLayoutUI@DuiLib@@UAEXPAUHDC__@@ABUtagRECT@@@Z
?DocumentComplete@CWebBrowserUI@DuiLib@@IAEXPAUIDispatch@@AAPAUtagVARIANT@@@Z
?Download@CWebBrowserUI@DuiLib@@UAGJPAUIMoniker@@PAUIBindCtx@@KJPAU_tagBINDINFO@@PB_W3I@Z
?DrawColor@CRenderEngine@DuiLib@@SAXPAUHDC__@@ABUtagRECT@@K@Z
?DrawFrame@CGifAnimUI@DuiLib@@AAEXPAUHDC__@@@Z
?DrawGradient@CRenderEngine@DuiLib@@SAXPAUHDC__@@ABUtagRECT@@KK_NH@Z
?DrawHtmlText@CRenderEngine@DuiLib@@SAXPAUHDC__@@PAVCPaintManagerUI@2@AAUtagRECT@@PB_WKPAU5@PAVCDuiString@2@AAHHI@Z
?DrawImage@CControlUI@DuiLib@@QAE_NPAUHDC__@@AAUtagTDrawInfo@2@@Z
?DrawImage@CRenderEngine@DuiLib@@SAXPAUHDC__@@PAUHBITMAP__@@ABUtagRECT@@222_NE333@Z
?DrawImage@CRenderEngine@DuiLib@@SA_NPAUHDC__@@PAVCPaintManagerUI@2@ABUtagRECT@@2AAUtagTDrawInfo@2@@Z
?DrawItemBk@CListContainerElementUI@DuiLib@@QAEXPAUHDC__@@ABUtagRECT@@@Z
?DrawItemBk@CListElementUI@DuiLib@@QAEXPAUHDC__@@ABUtagRECT@@@Z
?DrawItemText@CListContainerElementUI@DuiLib@@UAEXPAUHDC__@@ABUtagRECT@@@Z
?DrawItemText@CListLabelElementUI@DuiLib@@UAEXPAUHDC__@@ABUtagRECT@@@Z
?DrawItemText@CListTextElementUI@DuiLib@@UAEXPAUHDC__@@ABUtagRECT@@@Z
?DrawLine@CRenderEngine@DuiLib@@SAXPAUHDC__@@ABUtagRECT@@HKH@Z
?DrawRect@CRenderEngine@DuiLib@@SAXPAUHDC__@@ABUtagRECT@@HKH@Z
?DrawRoundRect@CRenderEngine@DuiLib@@SAXPAUHDC__@@ABUtagRECT@@HHHKH@Z
?DrawTextW@CRenderEngine@DuiLib@@SAXPAUHDC__@@PAVCPaintManagerUI@2@AAUtagRECT@@PB_WKHI@Z
?Empty@CDuiPtrArray@DuiLib@@QAEXXZ
?Empty@CDuiRect@DuiLib@@QAEXXZ
?Empty@CDuiString@DuiLib@@QAEXXZ
?Empty@CDuiValArray@DuiLib@@QAEXXZ
?EmptyUndoBuffer@CRichEditUI@DuiLib@@QAEXXZ
?EnableModeless@CWebBrowserUI@DuiLib@@UAGJH@Z
?EnableScrollBar@CContainerUI@DuiLib@@UAEX_N0@Z
?EnableScrollBar@CListUI@DuiLib@@UAEX_N0@Z
?EndDown@CContainerUI@DuiLib@@UAEXXZ
?EndDown@CListUI@DuiLib@@UAEXXZ
?EndDown@CRichEditUI@DuiLib@@UAEXXZ
?EndRight@CContainerUI@DuiLib@@UAEXXZ
?EndRight@CListUI@DuiLib@@UAEXXZ
?EndRight@CRichEditUI@DuiLib@@UAEXXZ
?EnsureVisible@CListUI@DuiLib@@QAEXH@Z
REVENGE-RAT.js.zip
.zip

Password: infected
REVENGE-RAT.js
.js
RRLL.bin.zip
.zip

Password: infected
RRLL.bin
.exe windows x86
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
.exe windows x86
SecuriteInfo.com.Gen.NN.ZexaF.34108.xy1@amqiedE.17985
.exe windows x86
SecuriteInfo.com.Generic.mg.cde56cf0169830ee.29869
.dll windows x86
SecurityTaskManager_Setup.exe
.exe windows x86
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
.exe windows x86
VyprVPN.exe
.exe windows x86
WSHSetup[1].exe
.exe windows x86
XPAntivirus2008.ico
Yard.dll
.dll windows x86

Exports

Exports

Countryhas
___ _ _____ __ ___/전산 및 비전산자료 보존 요청서.tgz
.gz
ajax2.gif
.gif
alert.css
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (2).exe
.exe windows x86

Exports

Exports

_gekkko@4
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (3).exe
.dll windows x86 regsvr32

Exports

Exports

DllRegisterServer
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (4).exe
.dll windows x86 regsvr32

Exports

Exports

DllRegisterServer
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe
.exe windows x86
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.zip
.zip
backblue(1).gif
.gif
backblue.gif
.gif
beep(1).mp3
beep.mp3
bootstrap.min.css
bootstrap.min.js
.js
cd9ccf8681ed1a5380f8a27cd6dc927ab719b04baa6c6583a0c793a6dc00d5f7.exe
.exe windows x86
ch/a.mp3
ch/alert.css
ch/bootstrap.css
ch/index.html
.js
ch/jquery-1.js
.js
ch/microsoft.png
.png
ch/retreaver.js
.js
ch/style.css
ch/translator.css
chrome-assests/a.html
chrome-assests/alert.css
chrome-assests/bootstrap.css
chrome-assests/gb.mp3
chrome-assests/ie10-viewport-bug-workaround.html
chrome-assests/iframe.js
.js
chrome-assests/images.zip
.zip
chrome-assests/img-1.svg
.xml
chrome-assests/img-10.svg
chrome-assests/img-11.svg
.xml
chrome-assests/img-12.svg
.xml
chrome-assests/img-2.svg
.xml
chrome-assests/img-3.svg
.xml
chrome-assests/img-4.svg
.xml
chrome-assests/img-5.svg
.xml
chrome-assests/img-6.svg
.xml
chrome-assests/img-7.svg
.xml
chrome-assests/img-8.svg
.xml
chrome-assests/img-9.svg
.xml
chrome-assests/jquery-1.js
.js
chrome-assests/microsoft.png
.png
chrome-assests/retreaver.js
.js
chrome-assests/style.css
chrome-assests/translator.css
cobaltstrike_shellcode.exe
.exe windows x86
cookies.txt
css
default.exe
.exe windows x86
ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3
.exe windows x86
edge.svg
.xml
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
.js
emotet_exe_e1_ef536781ae8be4b67a7fb8aa562d84994ad250d97d5606115b6f4e6e2992363f_2020-11-17__174504._exe
.exe windows x86

Exports

Exports

uvnghvggrh523RDtrd
emotet_exe_e3_93074e9fbde60e4182f5d763bac7762f2d4e2fcf9baf457b6f12e7696b3562c1_2020-11-17__182823.exe
.exe windows x86
err.mp3
eupdate.exe
.exe windows x86
f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
.exe windows x64
fade(1).gif
.gif
fade.gif
.gif
favicon.ico
fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe
.exe windows x86
fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d35.exe
.exe windows x86
file(1).exe
.exe windows x86
file.exe
.exe windows x86
files/alert.jpg
.jpg
files/alertmicrosoft.mp3
files/background-2.png
.png
files/microsoft.png
.png
files/style.css
files/warning.mp3
firiedge/a.mp3
firiedge/defender.png
.png
firiedge/favico.jpg
firiedge/index.html
.js
firiedge/jquery.min.js
.js
firiedge/login.php
firiedge/main.css
gjMEi6eG.exe
.exe windows x86
good.exe
.exe windows x86
header-bar3.png
.png
hts-cache/doit.log
hts-cache/new.lst
hts-cache/new.txt
hts-cache/new.zip
.zip
hts-cache/readme.txt
hts-cache/winprofile.ini
hyundai steel-pipe- job 8010(1).exe
.exe windows x86
hyundai steel-pipe- job 8010.exe
.exe windows x86
ie.svg
.xml
image.png
.png
images/apple/Descr.WD3
images/apple/image_large.png
.png
images/apple/image_small.png
.png
images/bag/Descr.WD3
images/bag/image_large.png
.png
images/bag/image_small.png
.png
images/links/ipad/Descr.WD3
images/links/ipad/image_large.png
.png
images/links/ipad/image_small.png
.png
images/links/iphone/Descr.WD3
images/links/iphone/image_large.png
.png
images/links/iphone/image_small.png
.png
images/links/mac/Descr.WD3
images/links/mac/image_large.png
.png
images/links/mac/image_small.png
.png
images/links/music/Descr.WD3
images/links/music/image_large.png
.png
images/links/music/image_small.png
.png
images/links/support/Descr.WD3
images/links/support/image_large.png
.png
images/links/support/image_small.png
.png
images/links/tv/Descr.WD3
images/links/tv/image_large.png
.png
images/links/tv/image_small.png
.png
images/links/watch/Descr.WD3
images/links/watch/image_large.png
.png
images/links/watch/image_small.png
.png
images/search/Descr.WD3
images/search/close_large.png
.png
images/search/close_small.png
.png
images/search/icon_reset_small.png
.png
images/search/icon_suggested_large.png
.png
images/search/icon_suggested_small.png
.png
images/search/image_large.png
.png
images/search/image_small.png
.png
img/1/3/alert.png
.png
img/1/3/alertmeta.png
.png
img/1/3/icon.alert.jpg
.jpg
img/1/3/loading.green.gif
.gif
img/1/3/loading.highlight.png
.png
img/1/3/progressbar.bg.png
.png
img/1/3/qicon.gif
.gif
img/1/3/sector.bg.gif
.gif
img/1/3/sector.hdd.png
.png
img/1/3/sector.removable.png
.png
img/1/3/security.png
.png
img/1/3/security2.png
.png
img/1/3/sidebar.bg.png
.png
img/bg-1.jpg
.jpg
img/bg-2.jpg
.jpg
img/bg-3.jpg
.jpg
img/defender.png
.png
index(1).html
index(10).html
.js
index(11).html
.js
index(2).html
.js
index(3).html
.js
index(4).html
index(5).html
.js
index(6).html
.js
index(7).html
.js
index(8).html
.js
index(9).html
.js
index.css
index.html
.js
index2.html
.js
infected dot net installer.exe
.exe windows x86
inps_979.xls
.xls windows office2003
jar.jar
.jar
jquery-3.js
.js
jquery.min.js
.js
js/.DS_Store
js/Descr.WD3
js/atemwgyji.js
.js
js/functions.js
.js
js/jquery(1).js
.js
js/jquery(2).js
.js
js/jquery-1.12.0.min.js
.js
js/jquery-ui-1.js
.js
js/jquery.js
.js
js/jquery.min.js
.js
june9.dll
.dll windows x86

Exports

Exports

@Claimgentle@8
@Closeseven6@0
@Doescentury@0
@Moondoes9@12
logo.png
.png
maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/bootstrap.min.js
.js
micro-logo.png
.png
mouse_2.exe
.exe windows x86
msie1.html
.js
msie2.html
.js
murphy_chrome.zip
.zip
murphy_ie.zip
.zip
oof.exe
.exe windows x86
openme.exe
.exe windows x86
ou55sg33s_1.exe
.exe windows x86
redx.php
.js
robots.txt
senate.m4a
.dll windows x86
song.mp3
sound/err.mp3
starticon3.exe
.exe windows x86
static.notifme.club/push_js/push_subs.js
.js
str.dll
.dll windows x86
style.css
style.min.css
svchost.exe
.exe windows x86
trn.png
.png
update.exe
.exe windows x86
vir1.xls
.xls office2007
warning.png
.png
wwf[1].exe
.exe windows x86
www.google-analytics.com/analytics.js
.js
www.mscheck022.com/sk/dc7c905a/us/index9cc5.html
.js
www.mscheck022.com/sk_pre/6/img/cross.gif
.gif
www.mscheck022.com/sk_pre/6/img/icon_app.gif
.gif
www.mscheck022.com/sk_pre/6/img/warn_.gif
.gif
x.png
.png
xNet.dll
.dll windows x86
전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe
.exe windows x86

Exports

Exports

@altate@0
@plusTokenAfter@4
전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe
.exe windows x86

Exports

Exports

@altate@0
@plusTokenAfter@4

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Files

Exports

Exports

Password: infected

Password: infected

Exports

Exports

Password: infected

Password: infected

Password: infected

Exports

Exports

Exports

Exports

Exports

Exports

Exports

Exports

Exports

Exports

Exports

Exports

Password: infected

Password: infected

Exports

Exports

Exports

Exports

Exports

Exports

Exports

Exports

Exports

Exports