���`M���9��V�?��6���Bܼ��p����K�k����� 5��)�U��l�Zu7�$�(:�x6\~s�ʋ]�pV��i)���d=��џ���!j�:V0>�7l�ش7�<�u�S���@V��`�:ó:r����>��yf��|0�u �$#�+�4_g���}d�y0у��l�a�b��Q��g�곁'>�]jr��2�hz騈��e���֙=�iϛ*�����R.�:���/���g��F��ŭO����k�ďMo��#�@�,Ŝ�J�2[! ���MH�e�� @�Y(��@zÿ��p��/�F�$���b�<[�{�%ǜ ���}�����lLX`��7��K�!��! ���p h=��U��J��3��k�"9=��wG�u��^��ҾO0_�>ܓ���p;��e�Јב���mQ#�̌,��}��+�l&0 � ��e�=�i��Zg�o���ٶ�bUqB�zH�8W4�?��9��Z�+b1c���}���[�j�i�-���kQ��M:a�[n��eoL���mX��X�\�AqX !��*�Ƒ ���y&QñnZ��R� �ǚv��N�����i����1�V����g�W��da�-��Yٌl����65=HYVE��%zZ��/�d� �Ű[,n�#F�<4�x��KV��<b<b�G�8�������_]��#S�����[� m�HH�����M7���.�����E���&b�e!dy��8d����YSxR��ї[h3P�M$��bv��[U���d�! ���|�1�J�7�BC�6��\����'���9�d���W�&�Dy��d��eu��Is`g]=�i����Q8�2��ɹ�%� �:7� �����E�����Z��ذ�kӺS�[|��5���V���^M�������w bx26uqE�NQ����`����q��S*c��;Y�H�n>��Y E]��8��C� Jh�y�-�*{�OK`���r?�1��L 㕒r��A��r���{ֲV��&�5�U2A)k��Ր�����O٫U�o��)����f{��A���� b4:�H��B���F,�xF�'�2�y���Th���h�dKX�DH$���� 4���'�z� �^Q��)X��?���DF�ռ��t�ʒ%�4TY�ԯ�]��o�L�ȡ�օ ��n6��=G��5Z�|�Sܟ��N�b{�BM�t�% ��I�/�m� �m�|3�u�"�LZ��!�Zj�KQ�bs�����$������a*�g�~��"v�f�@����'��>���7�/��X/[�|�;��B��BG�.D��h;�3�K��]o|V$/�z�֗N^���5�����A��G[���9!j���'�Z�����ۢ��c9�=b\�Q@::e8{�m:E�����<���@.�P���*��&E��W�#K)m�(Q��rL��wS�w,Ar�i���g��n`< ��F}�ȝ^-ccnT&�h��q������_S��m��ى�X�.��t�F*ʀf|kᷥP}�Z���>I.���V rC�ίF�{o �Tg@^���l��`�]��rd�חtf�S�ؙ�o�T�,'�����dl��ZZ <��;*��X3Of��"��~J��r�7���CS%�hl�.`�������8>y_˾RG0a�C�X�5��z�9pF��6���j��K�j�)Nl����t�3�ɦ8��G��#��)���e�����Mp�o��5���;Y{�y�8�*Z_t�Ua~X���t@g��Kj05���$f�ı�F����,-lD� �[a^���Z@b�� "���q�P�ڣ��ߟ��� �_a&��3��r}gNrW:������H%��\�K����5�p5��霎�"�.Yߤ-�������o�R�0f`�L�_S���W�U�`�$K��]��_t�3�a\kv�1�������h�Us��RPR �S��:{�*��_^��C�.�Z�6�U���?wo��_Kx���N����,�H���NJ��~? �gϕ���a��M�����YTݞ��{�v���]��S{�:8m�3��0�SZ����F�ڻ�!c� 5%��j�8����@���ꁢ+:��5��Qr4��.�/$9���=}1[���WA-�y��~�� e�Ss�L�Z&{��S�����;���ڋo�m��Ѕ��ֻӌ���?���<��%�/|bT1:�OJz����O�sJ�]<Qŗ~���� �V�F��U.:���^�X�zN���H��p�K� v�zB���1U�A�HfU@c����%��?+�V����~�,�/��y]�TͺQ��;�g8�i�����R��J����h���4��.���Gי�簴aw�\ _8�9��t�����'V��˿S����"HZm7t[���+�O��֓��?�<)V��h��;�|z��q����m9 ��oBvJݗ�pVnj���I���Ba,t��l���� �ư��C�m0A0-~�/ׁ�.I�<�6����Ȳw7�i�p��"t�8��rt���k �iS��A�l��d|I��l���<.W&g3������z���'%� q_88�,2��~��Lr��e�R:2���?��Ţ� |j�"J����pP7S��GL����;C3�Q�"�H���{(�����@���e��M:h?�?\ d�H�X*U> ;})��%��Ag�A�a��Щ��}�e��ɮ/�2�}���/$M?���y.��F<��J//~�HD������#���M�Ϊ�ܶ���hٟ���E.��j�_站��-����A��Z�{�X�� zl��bI�U�qT��D��sf��&���z��8���S�qf��<�}N_��b�$(���3��yM�L���KQ{�N"CQ��� >M�&�|��C����G���CX��;ٌ�g��gB�e��yp���4Lj/%�D�2�� �$%�"�#���o�o�Å�h��-I&D2�#��JAR(��J68�7�6G��d��b��w����L^60�~w��0��DL��C&JF~Ϫ������=7�߄3��ɋ�*�J~�'�zg���
Static task
static1
Behavioral task
behavioral1
Sample
新建文件夹/40311.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
新建文件夹/40311.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
新建文件夹/WinDivert.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
新建文件夹/WinDivert.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
新建文件夹/WinDivert64.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
新建文件夹/WinDivert64.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
新建文件夹/iup.dll
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
新建文件夹/iup.dll
Resource
win10v2004-20220812-en
General
-
Target
56a50faf2f64cc8846b30350d1c258ff61e800874635a3e78dd98d21ea77f25e
-
Size
4.2MB
-
MD5
9f9a82cdbfe561fad0d700d9b2f5e10b
-
SHA1
38fa2fa277060aa87e5b904ea47edb73d3ff418c
-
SHA256
56a50faf2f64cc8846b30350d1c258ff61e800874635a3e78dd98d21ea77f25e
-
SHA512
5cf723b290ed088d07ad003ce2132406546fd3ac72fa59060e8b19eff30e09cb827c8727de3b0ee6e11db2d01434adab6728782fb4a4faec78a33926546708c4
-
SSDEEP
98304:zR3YCdvj5h7Gca7fDMAyodVOxKwojV29oD3dxCmxzJ1UzyPAMzmZ:zjjbSficHTdJoyP/mZ
Malware Config
Signatures
Files
-
56a50faf2f64cc8846b30350d1c258ff61e800874635a3e78dd98d21ea77f25e.rar
-
新建文件夹/40311.exe.exe windows x64
22cace7d857f5dde7816a913cc29a176
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
windivert
WinDivertClose
iup
IupFlush
winmm
timeEndPeriod
kernel32
IsDebuggerPresent
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
AllocateAndInitializeSid
shell32
ShellExecuteExA
msvcr120
strrchr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmps0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
新建文件夹/WinDivert.dll.dll windows x64
4b5b0fb09f29ed8e5306bbb27b5ae668
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
StartServiceW
kernel32
CloseHandle
CreateEventW
CreateFileW
DeviceIoControl
GetLastError
GetModuleFileNameW
GetOverlappedResult
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
msvcrt
isalnum
isspace
isxdigit
strcmp
tolower
Exports
Exports
DivertClose
DivertGetParam
DivertHelperCalcChecksums
DivertHelperParseIPv4Address
DivertHelperParseIPv6Address
DivertHelperParsePacket
DivertOpen
DivertRecv
DivertSend
DivertSetParam
WinDivertClose
WinDivertDllEntry
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 512B - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 16B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 1024B - Virtual size: 730B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
新建文件夹/WinDivert64.sys.exe windows x64
5c9956100a10f17fd6cacca768f3c364
Code Sign
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before21/12/2012, 00:00Not After30/12/2020, 23:59SubjectCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate
IssuerCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USNot Before18/10/2012, 00:00Not After29/12/2020, 23:59SubjectCN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
0a:42:f1:e3:68:68:b7:25:06:ea:50:77:bf:7b:bc:5bCertificate
IssuerCN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before18/08/2014, 00:00Not After09/09/2015, 12:00SubjectCN=Nemea Mjukvaruutveckling AB,O=Nemea Mjukvaruutveckling AB,L=Stockholm,ST=Vastra Gotaland,C=SEExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
61:20:4d:b4:00:00:00:00:00:27Certificate
IssuerCN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before15/04/2011, 19:45Not After15/04/2021, 19:55SubjectCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5fCertificate
IssuerCN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before11/02/2011, 12:00Not After10/02/2026, 12:00SubjectCN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
97:da:76:ff:9a:56:81:d7:d7:9f:b8:81:15:69:91:15:f6:21:9c:00Signer
Actual PE Digest97:da:76:ff:9a:56:81:d7:d7:9f:b8:81:15:69:91:15:f6:21:9c:00Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Nemea Mjukvaruutveckling AB,O=Nemea Mjukvaruutveckling AB,L=Stockholm,ST=Vastra Gotaland,C=SE20/11/2014, 02:05 Valid: false
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
RtlCopyUnicodeString
KeBugCheckEx
IoAllocateMdl
MmMapLockedPagesSpecifyCache
IoFreeMdl
MmBuildMdlForNonPagedPool
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExFreePoolWithTag
ExUuidCreate
ExAllocatePoolWithTag
ndis.sys
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisAllocateNetBufferListPool
NdisGetDataBuffer
NdisFreeNetBufferListPool
fwpkclnt.sys
FwpmCalloutDeleteByKey0
FwpsInjectNetworkReceiveAsync0
FwpmSubLayerAdd0
FwpsCalloutUnregisterByKey0
FwpsFreeCloneNetBufferList0
FwpsQueryPacketInjectionState0
FwpsFreeNetBufferList0
FwpmEngineClose0
FwpmTransactionBegin0
FwpmFilterAdd0
FwpmEngineOpen0
FwpmTransactionAbort0
FwpsCalloutRegister0
FwpsInjectForwardAsync0
FwpmFilterDeleteByKey0
FwpmCalloutAdd0
FwpsInjectNetworkSendAsync0
FwpmTransactionCommit0
FwpsInjectionHandleCreate0
FwpsAllocateNetBufferAndNetBufferList0
FwpsInjectionHandleDestroy0
FwpmSubLayerDeleteByKey0
wdfldr.sys
WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
WdfVersionUnbind
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 246B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
新建文件夹/iup.dll.dll windows x64
ec0e84b9057fcbcd6a8bb53072d22e2f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetSystemInfo
GetCPInfoExA
GetVersionExA
LoadLibraryExW
GetSystemDirectoryW
SetLastError
FindResourceW
LoadResource
LockResource
RtlLookupFunctionEntry
SizeofResource
GetLocalTime
ReadFile
CreateFileW
WriteFile
lstrcpyW
GlobalSize
GetFileAttributesW
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GetTickCount
GetComputerNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
OutputDebugStringW
GetVersionExW
GetSystemDefaultUILanguage
GetModuleHandleW
WideCharToMultiByte
lstrcpynW
LocalFree
GetProcAddress
GetLastError
FormatMessageW
GetCurrentThreadId
CreateMutexW
GetModuleFileNameW
lstrlenW
GetCommandLineW
CompareStringW
GetCPInfoExW
MulDiv
MultiByteToWideChar
FreeLibrary
LoadLibraryW
Sleep
SwitchToThread
CreateThread
CloseHandle
GetCurrentThread
ExitThread
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetTempFileNameA
GetTempPathA
RtlCaptureContext
user32
ShowScrollBar
SetScrollInfo
DrawEdge
InflateRect
GetActiveWindow
MapWindowPoints
DragDetect
GetClipboardFormatNameW
RegisterClipboardFormatW
SetRect
DrawFrameControl
DrawTextW
FrameRect
IsClipboardFormatAvailable
SetClipboardData
GetClipboardData
GetForegroundWindow
EmptyClipboard
CloseClipboard
OpenClipboard
GetCaretPos
GetFocus
CreateMenu
EnableMenuItem
GetMenuInfo
CheckMenuItem
RemoveMenu
DrawMenuBar
DestroyMenu
SetMenu
SetMenuInfo
SetMenuItemInfoW
IsMenu
GetSubMenu
TrackPopupMenu
SetMenuItemBitmaps
CreatePopupMenu
InsertMenuItemW
CheckMenuRadioItem
GetMenuState
GetMenuItemInfoW
PtInRect
GetComboBoxInfo
ShowCursor
MonitorFromWindow
SetWindowRgn
FillRect
EndDialog
UnregisterClassW
DefFrameProcW
GetWindowInfo
GetScrollInfo
RegisterClassW
DefMDIChildProcW
LockWindowUpdate
SetLayeredWindowAttributes
SetCapture
IsZoomed
GetDlgItem
UpdateLayeredWindow
ReleaseCapture
LoadImageW
InvalidateRect
IsIconic
BeginPaint
EndPaint
GetWindowRect
GetAsyncKeyState
GetDesktopWindow
GetCursorPos
GetClientRect
MessageBoxW
GetSysColor
GetMessageW
PostMessageW
DispatchMessageW
PeekMessageW
TranslateMessage
PostThreadMessageW
PostQuitMessage
GetKeyState
VkKeyScanA
GetKeyboardLayout
MapVirtualKeyA
GetClassNameA
EnumDisplayMonitors
CallNextHookEx
UnhookWindowsHookEx
EnumWindows
DisableProcessWindowsGhosting
SetWindowsHookExW
SystemParametersInfoA
SetForegroundWindow
SetFocus
SystemParametersInfoW
GetWindowLongW
GetWindowTextLengthW
DefWindowProcW
GetMessageExtraInfo
CallWindowProcW
MapVirtualKeyW
DestroyWindow
GetDC
GetScrollBarInfo
EnableScrollBar
SetScrollPos
GetCapture
DestroyCursor
GetMenuItemID
CreateIconIndirect
SetTimer
KillTimer
MessageBoxIndirectW
CreateMDIWindowW
GetMonitorInfoW
IsWindowVisible
SetWindowPos
SetWindowLongPtrW
CreateWindowExW
ScreenToClient
SendMessageW
GetSystemMetrics
SetWindowTextW
ChildWindowFromPointEx
GetWindowLongPtrW
ShowWindow
GetClassInfoW
RedrawWindow
ClientToScreen
TrackMouseEvent
DrawFocusRect
IsWindowEnabled
LoadCursorW
SetParent
SetCursor
SetWindowLongW
GetParent
RegisterWindowMessageW
SetCursorPos
ReleaseDC
SendInput
EnableWindow
GetWindowTextW
GetWindow
DestroyIcon
gdi32
BitBlt
GetMetaFileBitsEx
GetEnhMetaFileBits
SetBkColor
CreateFontIndirectW
CreateRectRgnIndirect
PatBlt
Polygon
ExtCreatePen
EndPath
CreateCompatibleBitmap
SelectClipRgn
BeginPath
SetGraphicsMode
FillPath
Arc
Pie
ModifyWorldTransform
SetViewportOrgEx
SetLayout
GetLayout
StretchBlt
TextOutW
SetTextColor
SetPixelV
ExcludeClipRect
SetTextAlign
CreateDIBSection
GetObjectW
CreateBitmap
GetObjectType
SetBkMode
CreateCompatibleDC
GetStockObject
CreatePatternBrush
CreateRectRgn
DeleteDC
SetDCBrushColor
CombineRgn
SelectObject
CreateFontW
GetTextMetricsW
GetTextExtentPoint32W
DeleteObject
CreateSolidBrush
GetDeviceCaps
Polyline
comdlg32
GetSaveFileNameW
ChooseFontW
GetOpenFileNameW
advapi32
ReportEventW
GetUserNameW
DeregisterEventSource
RegisterEventSourceW
shell32
ShellExecuteExW
ShellExecuteW
ord74
DragFinish
DragAcceptFiles
DragQueryPoint
DragQueryFileW
SHGetPathFromIDListW
SHBrowseForFolderW
Shell_NotifyIconW
SHGetFolderPathW
ole32
ReleaseStgMedium
CoCreateInstance
CoUninitialize
DoDragDrop
OleUninitialize
OleInitialize
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoInitializeEx
comctl32
ord13
ord14
ImageList_BeginDrag
ImageList_DragMove
ImageList_Create
ImageList_DragShowNolock
ImageList_DragLeave
ImageList_EndDrag
ImageList_GetIconSize
InitCommonControlsEx
ImageList_Destroy
ImageList_GetImageCount
ImageList_Draw
ImageList_DragEnter
ImageList_GetImageInfo
ImageList_Add
vcruntime140
__C_specific_handler
__std_type_info_destroy_list
memset
__intrinsic_setjmp
memmove
strstr
strchr
longjmp
memcpy
api-ms-win-crt-heap-l1-1-0
free
malloc
calloc
realloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
fseek
fwrite
fread
feof
__stdio_common_vsscanf
fopen
fclose
getc
ungetc
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfscanf
ferror
api-ms-win-crt-string-l1-1-0
wcsncpy
strtok
strcspn
strncpy
strncmp
isalpha
isdigit
toupper
tolower
isalnum
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-locale-l1-1-0
localeconv
setlocale
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_cexit
_execute_onexit_table
_initterm
_initterm_e
_seh_filter_dll
_initialize_narrow_environment
_initialize_onexit_table
api-ms-win-crt-math-l1-1-0
fmod
acos
atan2
cosf
sqrt
sinf
sin
cos
ceil
Exports
Exports
IupAlarm
IupAnimatedLabel
IupAppend
IupBackgroundBox
IupButton
IupCalendar
IupCanvas
IupCbox
IupCboxV
IupCboxv
IupClassInfoDialog
IupClassMatch
IupClipboard
IupClose
IupColorBrowser
IupColorDlg
IupColorbar
IupConfig
IupConfigCopy
IupConfigDialogClosed
IupConfigDialogShow
IupConfigGetVariableDouble
IupConfigGetVariableDoubleDef
IupConfigGetVariableDoubleId
IupConfigGetVariableDoubleIdDef
IupConfigGetVariableInt
IupConfigGetVariableIntDef
IupConfigGetVariableIntId
IupConfigGetVariableIntIdDef
IupConfigGetVariableStr
IupConfigGetVariableStrDef
IupConfigGetVariableStrId
IupConfigGetVariableStrIdDef
IupConfigLoad
IupConfigRecentInit
IupConfigRecentUpdate
IupConfigSave
IupConfigSetListVariable
IupConfigSetVariableDouble
IupConfigSetVariableDoubleId
IupConfigSetVariableInt
IupConfigSetVariableIntId
IupConfigSetVariableStr
IupConfigSetVariableStrId
IupConvertXYToPos
IupCopyAttributes
IupCopyClassAttributes
IupCreate
IupCreateV
IupCreatep
IupCreatev
IupDatePick
IupDestroy
IupDetach
IupDetachBox
IupDial
IupDialog
IupDrawArc
IupDrawBegin
IupDrawEnd
IupDrawFocusRect
IupDrawGetClipRect
IupDrawGetImageInfo
IupDrawGetSize
IupDrawGetTextSize
IupDrawImage
IupDrawLine
IupDrawParentBackground
IupDrawPolygon
IupDrawRectangle
IupDrawResetClip
IupDrawSelectRect
IupDrawSetClipRect
IupDrawText
IupDropButton
IupElementPropertiesDialog
IupExecute
IupExecuteWait
IupExitLoop
IupExpander
IupFileDlg
IupFill
IupFlatButton
IupFlatFrame
IupFlatLabel
IupFlatList
IupFlatScrollBox
IupFlatSeparator
IupFlatTabs
IupFlatTabsV
IupFlatTabsv
IupFlatToggle
IupFlatTree
IupFlatVal
IupFlush
IupFontDlg
IupFrame
IupGauge
IupGetAllAttributes
IupGetAllClasses
IupGetAllDialogs
IupGetAllNames
IupGetAttribute
IupGetAttributeHandle
IupGetAttributeHandleId
IupGetAttributeHandleId2
IupGetAttributeId
IupGetAttributeId2
IupGetAttributes
IupGetBrother
IupGetCallback
IupGetChild
IupGetChildCount
IupGetChildPos
IupGetClassAttributes
IupGetClassCallbacks
IupGetClassName
IupGetClassType
IupGetColor
IupGetDialog
IupGetDialogChild
IupGetDouble
IupGetDoubleId
IupGetDoubleId2
IupGetFile
IupGetFloat
IupGetFloatId
IupGetFloatId2
IupGetFocus
IupGetFunction
IupGetGlobal
IupGetHandle
IupGetInt
IupGetInt2
IupGetIntId
IupGetIntId2
IupGetIntInt
IupGetLanguage
IupGetLanguageString
IupGetName
IupGetNextChild
IupGetParam
IupGetParamV
IupGetParamv
IupGetParent
IupGetRGB
IupGetRGBA
IupGetRGBId
IupGetRGBId2
IupGetText
IupGlobalsDialog
IupGridBox
IupGridBoxV
IupGridBoxv
IupHbox
IupHboxV
IupHboxv
IupHelp
IupHide
IupImage
IupImageGetHandle
IupImageRGB
IupImageRGBA
IupInsert
IupIsOpened
IupItem
IupLabel
IupLayoutDialog
IupLink
IupList
IupListDialog
IupLoad
IupLoadBuffer
IupLog
IupLogV
IupLoopStep
IupLoopStepWait
IupMainLoop
IupMainLoopLevel
IupMap
IupMenu
IupMenuV
IupMenuv
IupMessage
IupMessageAlarm
IupMessageDlg
IupMessageError
IupMessageV
IupMessagef
IupMultiBox
IupMultiBoxV
IupMultiBoxv
IupMultiLine
IupNextField
IupNormalizer
IupNormalizerV
IupNormalizerv
IupOpen
IupParam
IupParamBox
IupParamBoxV
IupParamBoxv
IupPlayInput
IupPopup
IupPostMessage
IupPreviousField
IupProgressBar
IupProgressDlg
IupRadio
IupRecordInput
IupRedraw
IupRefresh
IupRefreshChildren
IupReparent
IupResetAttribute
IupSaveClassAttributes
IupSaveImageAsText
IupSbox
IupScanf
IupScrollBox
IupSeparator
IupSetAtt
IupSetAttV
IupSetAttribute
IupSetAttributeHandle
IupSetAttributeHandleId
IupSetAttributeHandleId2
IupSetAttributeId
IupSetAttributeId2
IupSetAttributes
IupSetCallback
IupSetCallbacks
IupSetCallbacksV
IupSetClassDefaultAttribute
IupSetDouble
IupSetDoubleId
IupSetDoubleId2
IupSetFloat
IupSetFloatId
IupSetFloatId2
IupSetFocus
IupSetFunction
IupSetGlobal
IupSetHandle
IupSetInt
IupSetIntId
IupSetIntId2
IupSetLanguage
IupSetLanguagePack
IupSetLanguageString
IupSetRGB
IupSetRGBA
IupSetRGBId
IupSetRGBId2
IupSetStrAttribute
IupSetStrAttributeId
IupSetStrAttributeId2
IupSetStrGlobal
IupSetStrf
IupSetStrfId
IupSetStrfId2
IupSetStrfId2V
IupSetStrfIdV
IupSetStrfV
IupSetfAttribute
IupSetfAttributeId
IupSetfAttributeId2
IupShow
IupShowXY
IupSpace
IupSpin
IupSpinbox
IupSplit
IupStoreAttribute
IupStoreAttributeId
IupStoreAttributeId2
IupStoreGlobal
IupStoreLanguageString
IupStringCompare
IupSubmenu
IupTabs
IupTabsV
IupTabsv
IupText
IupTextConvertLinColToPos
IupTextConvertPosToLinCol
IupThread
IupTimer
IupToggle
IupTree
IupTreeGetId
IupTreeGetUserId
IupTreeSetAttributeHandle
IupTreeSetUserId
IupUnmap
IupUpdate
IupUpdateChildren
IupUser
IupVal
IupVbox
IupVboxV
IupVboxv
IupVersion
IupVersionDate
IupVersionNumber
IupVersionShow
IupZbox
IupZboxV
IupZboxv
iupArrayAdd
iupArrayCount
iupArrayCreate
iupArrayDestroy
iupArrayGetData
iupArrayInc
iupArrayInsert
iupArrayReleaseData
iupArrayRemove
iupAssert
iupAttribGet
iupAttribGetAllSaved
iupAttribGetBoolean
iupAttribGetBooleanId
iupAttribGetBooleanId2
iupAttribGetClassObject
iupAttribGetClassObjectId
iupAttribGetClassObjectId2
iupAttribGetDouble
iupAttribGetDoubleId
iupAttribGetDoubleId2
iupAttribGetFloat
iupAttribGetFloatId
iupAttribGetFloatId2
iupAttribGetHandleName
iupAttribGetId
iupAttribGetId2
iupAttribGetInherit
iupAttribGetInheritNativeParent
iupAttribGetInt
iupAttribGetIntId
iupAttribGetIntId2
iupAttribGetIntInt
iupAttribGetLocal
iupAttribGetStr
iupAttribIsIhandle
iupAttribIsNotString
iupAttribParse
iupAttribSet
iupAttribSetClassObject
iupAttribSetClassObjectId
iupAttribSetClassObjectId2
iupAttribSetDouble
iupAttribSetDoubleId
iupAttribSetDoubleId2
iupAttribSetFloat
iupAttribSetFloatId
iupAttribSetFloatId2
iupAttribSetHandleName
iupAttribSetId
iupAttribSetId2
iupAttribSetInt
iupAttribSetIntId
iupAttribSetIntId2
iupAttribSetStr
iupAttribSetStrId
iupAttribSetStrId2
iupAttribSetStrf
iupBackgroundBoxNewBaseClass
iupBaseCallValueChangedCb
iupBaseCanvasGetClientOffsetAttrib
iupBaseCanvasGetClientSizeAttrib
iupBaseComputeNaturalSize
iupBaseContainerGetExpandAttrib
iupBaseContainerUpdateExpand
iupBaseGetActiveAttrib
iupBaseGetCPaddingAttrib
iupBaseGetCSpacingAttrib
iupBaseGetClientOffsetAttrib
iupBaseGetClientSizeAttrib
iupBaseGetCurrentSizeAttrib
iupBaseGetExpandAttrib
iupBaseGetRasterSizeAttrib
iupBaseGetScrollbar
iupBaseGetSizeAttrib
iupBaseGetVisibleAttrib
iupBaseGetWidAttrib
iupBaseNativeParentGetBgColor
iupBaseNativeParentGetBgColorAttrib
iupBaseNoSaveCheck
iupBaseRegisterBaseCallbacks
iupBaseRegisterCommonAttrib
iupBaseRegisterCommonCallbacks
iupBaseRegisterVisualAttrib
iupBaseSetActiveAttrib
iupBaseSetCPaddingAttrib
iupBaseSetCSpacingAttrib
iupBaseSetCurrentSize
iupBaseSetExpandAttrib
iupBaseSetMaxSizeAttrib
iupBaseSetMinSizeAttrib
iupBaseSetNameAttrib
iupBaseSetPosition
iupBaseSetRasterSizeAttrib
iupBaseSetSizeAttrib
iupBaseSetVisibleAttrib
iupBaseTypeVoidMapMethod
iupBaseUpdateAttribFromFont
iupCallGetFocusCb
iupCallKillFocusCb
iupChildTreeAppend
iupChildTreeGetNativeParent
iupChildTreeGetNativeParentHandle
iupChildTreeGetPrevBrother
iupChildTreeIsParent
iupClassCallbackGetFormat
iupClassInfoGetDesc
iupClassInfoShowHelp
iupClassMatch
iupClassNew
iupClassObjectChildAdded
iupClassObjectChildRemoved
iupClassObjectComputeNaturalSize
iupClassObjectCreate
iupClassObjectDestroy
iupClassObjectDlgPopup
iupClassObjectGetInnerNativeContainerHandle
iupClassObjectHasDlgPopup
iupClassObjectLayoutUpdate
iupClassObjectMap
iupClassObjectSetChildrenCurrentSize
iupClassObjectSetChildrenPosition
iupClassObjectUnMap
iupClassRegisterAttribute
iupClassRegisterAttributeId
iupClassRegisterAttributeId2
iupClassRegisterCallback
iupClassRegisterGetAttribute
iupClassRegisterReplaceAttribDef
iupClassRegisterReplaceAttribFlags
iupClassRegisterReplaceAttribFunc
iupClassRelease
iupDataEntry
iupDialogGetNativeParent
iupDlgListAdd
iupDlgListCount
iupDlgListFirst
iupDlgListNext
iupDlgListRemove
iupDlgListVisibleCount
iupDlgListVisibleDec
iupDlgListVisibleInc
iupDrawCalcShadows
iupDrawColor
iupDrawColorMakeInactive
iupDrawGetTextFlags
iupDrawGetTextSize
iupDrawHorizSunkenMark
iupDrawParentBackground
iupDrawRaiseRect
iupDrawSetColor
iupDrawStrToColor
iupDrawSunkenRect
iupDrawVertSunkenMark
iupError
iupFlatDrawArrow
iupFlatDrawBorder
iupFlatDrawBox
iupFlatDrawCheckMark
iupFlatDrawDrawCircle
iupFlatDrawGetIconSize
iupFlatDrawIcon
iupFlatGetDarkerBgColor
iupFlatGetHorizontalAlignment
iupFlatGetImageName
iupFlatGetImageNameId
iupFlatGetImagePosition
iupFlatGetVerticalAlignment
iupFlatItemResetTip
iupFlatItemSetTip
iupFlatItemSetTipAttrib
iupFlatScrollBarCreate
iupFlatScrollBarGet
iupFlatScrollBarMotionUpdate
iupFlatScrollBarRegister
iupFlatScrollBarRelease
iupFlatScrollBarSetChildrenCurrentSize
iupFlatScrollBarSetChildrenPosition
iupFlatScrollBarSetPos
iupFlatScrollBarWheelUpdate
iupFlatSetActiveAttrib
iupFocusCanAccept
iupFocusNextInteractive
iupFontParsePango
iupFontParseWin
iupFontParseX
iupGetFontFaceAttrib
iupGetFontInfo
iupGetFontSizeAttrib
iupGetFontStyleAttrib
iupGetFontValue
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 201KB - Virtual size: 201KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 401KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 812B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ