SketchUp[.]zip

SketchUp.zip

.zip

Additional FIles/ActiveXInstallService.admx

Additional FIles/AddRemovePrograms.admx

Additional FIles/AppCompat.admx

Additional FIles/AppXRuntime.admx

.xml

Additional FIles/AppxPackageManager.admx

Additional FIles/AttachmentManager.admx

Additional FIles/AuditSettings.admx

.xml

Additional FIles/AutoPlay.admx

Additional FIles/Biometrics.admx

Additional FIles/Bits.admx

Additional FIles/CEIPEnable.admx

Additional FIles/COM.admx

Additional FIles/CipherSuiteOrder.admx

Additional FIles/Conf.admx

Additional FIles/ControlPanel.admx

Additional FIles/ControlPanelDisplay.admx

Additional FIles/Cpls.admx

Additional FIles/CredSsp.admx

Additional FIles/CredUI.admx

Additional FIles/CredentialProviders.admx

Additional FIles/CtrlAltDel.admx

Additional FIles/DCOM.admx

Additional FIles/DFS.admx

Additional FIles/DWM.admx

Additional FIles/Desktop.admx

Additional FIles/DeviceCompat.admx

Additional FIles/DeviceInstallation.admx

Additional FIles/DeviceSetup.admx

Additional FIles/DigitalLocker.admx

Additional FIles/DiskDiagnostic.admx

Additional FIles/DiskNVCache.admx

Additional FIles/DiskQuota.admx

Additional FIles/DistributedLinkTracking.admx

Additional FIles/DnsClient.admx

Additional FIles/EAIME.admx

Additional FIles/EarlyLaunchAM.admx

Additional FIles/EdgeUI.admx

Additional FIles/EncryptFilesonMove.admx

Additional FIles/ErrorReporting.admx

Additional FIles/EventForwarding.admx

.xml

Additional FIles/EventLog.admx

Additional FIles/EventViewer.admx

Additional FIles/Explorer.admx

Additional FIles/ExternalBoot.admx

.xml

Additional FIles/FileHistory.admx

Additional FIles/FileRecovery.admx

Additional FIles/FileRevocation.admx

Additional FIles/FileServerVSSProvider.admx

Additional FIles/FileSys.admx

.xml

Additional FIles/FolderRedirection.admx

Additional FIles/FramePanes.admx

Additional FIles/GameExplorer.admx

Additional FIles/Globalization.admx

Additional FIles/GroupPolicy-Server.admx

Additional FIles/GroupPolicy.admx

Additional FIles/GroupPolicyPreferences.admx

Additional FIles/Help.admx

Additional FIles/HelpAndSupport.admx

Additional FIles/ICM.admx

Additional FIles/IIS.admx

Additional FIles/InkWatson.admx

Additional FIles/Kerberos.admx

Additional FIles/LanmanServer.admx

Additional FIles/LeakDiagnostic.admx

Additional FIles/LinkLayerTopologyDiscovery.admx

Additional FIles/LocationProviderAdm.admx

Additional FIles/Logon.admx

Additional FIles/MMC.admx

Additional FIles/MMCSnapIns2.admx

Additional FIles/MMCSnapins.admx

Additional FIles/MSDT.admx

Additional FIles/MSI.admx

Additional FIles/MediaCenter.admx

Additional FIles/MobilePCMobilityCenter.admx

Additional FIles/MobilePCPresentationSettings.admx

Additional FIles/Msi-FileRecovery.admx

Additional FIles/NAPXPQec.admx

Additional FIles/NCSI.admx

Additional FIles/Netlogon.admx

Additional FIles/NetworkConnections.admx

Additional FIles/NetworkIsolation.admx

Additional FIles/NetworkProjection.admx

Additional FIles/OfflineFiles.admx

Additional FIles/P2P-pnrp.admx

Additional FIles/ParentalControls.admx

Additional FIles/PeerToPeerCaching.admx

Additional FIles/PenTraining.admx

Additional FIles/PerformanceDiagnostics.admx

Additional FIles/PerformancePerftrack.admx

Additional FIles/Power.admx

Additional FIles/PowerShellExecutionPolicy.admx

Additional FIles/PreviousVersions.admx

Additional FIles/Printing.admx

Additional FIles/Printing2.admx

Additional FIles/Programs.admx

Additional FIles/PswdSync.admx

Additional FIles/QOS.admx

Additional FIles/RPC.admx

Additional FIles/RacWmiProv.admx

Additional FIles/Radar.admx

Additional FIles/ReAgent.admx

Additional FIles/Reliability.admx

Additional FIles/RemoteAssistance.admx

Additional FIles/RemovableStorage.admx

Additional FIles/Scripts.admx

Additional FIles/Securitycenter.admx

Additional FIles/Sensors.admx

Additional FIles/ServerManager.admx

Additional FIles/Servicing.admx

Additional FIles/SettingSync.admx

Additional FIles/Setup.admx

Additional FIles/SharedFolders.admx

Additional FIles/Sharing.admx

Additional FIles/Shell-CommandPrompt-RegEditTools.admx

Additional FIles/ShellWelcomeCenter.admx

Additional FIles/Sidebar.admx

Additional FIles/SkyDrive.admx

.xml

Additional FIles/Smartcard.admx

Additional FIles/Snis.admx

Additional FIles/Snmp.admx

Additional FIles/SoundRec.admx

Additional FIles/StartMenu.admx

Additional FIles/SystemRestore.admx

Additional FIles/TPM.admx

Additional FIles/TabletPCInputPanel.admx

Additional FIles/TabletShell.admx

Additional FIles/TaskScheduler.admx

Additional FIles/Taskbar.admx

Additional FIles/TerminalServer-Server.admx

Additional FIles/TerminalServer.admx

Additional FIles/Thumbnails.admx

Additional FIles/TouchInput.admx

Additional FIles/UserProfiles.admx

Additional FIles/VolumeEncryption.admx

Additional FIles/W32Time.admx

Additional FIles/WCM.admx

Additional FIles/WDI.admx

Additional FIles/WPN.admx

Additional FIles/WinCal.admx

.xml

Additional FIles/WinInit.admx

Additional FIles/WinLogon.admx

Additional FIles/Windows.Data.TimeZones/Windows.Data.TimeZones.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.ar-SA.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.bg-BG.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.cs-CZ.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.da-DK.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.de-DE.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.el-GR.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.en-GB.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.en-US.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.es-ES.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.et-EE.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.fi-FI.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.fr-FR.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.he-IL.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.hr-HR.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.hu-HU.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.it-IT.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.ja-JP.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.ko-KR.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.lt-LT.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.lv-LV.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.nb-NO.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.nl-NL.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.pl-PL.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.pt-BR.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.pt-PT.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.ro-RO.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.ru-RU.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.sk-SK.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.sl-SI.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.sr-Latn-RS.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.sv-SE.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.th-TH.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.tr-TR.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.uk-UA.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.zh-CN.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.zh-HK.pri

Additional FIles/Windows.Data.TimeZones/pris/Windows.Data.TimeZones.zh-TW.pri

Additional FIles/Windows.UI.Search/.UI.Search.pri

Additional FIles/Windows.UI.Search/Images/logo.contrast-black.png

.png

Additional FIles/Windows.UI.Search/Images/logo.contrast-black_scale-100.png

.png

Additional FIles/Windows.UI.Search/Images/logo.contrast-black_scale-140.png

.png

Additional FIles/Windows.UI.Search/Images/logo.contrast-black_scale-180.png

.png

Additional FIles/Windows.UI.Search/Images/logo.contrast-black_scale-80.png

.png

Additional FIles/Windows.UI.Search/Images/logo.contrast-white.png

.png

Additional FIles/Windows.UI.Search/Images/logo.contrast-white_scale-100.png

.png

Additional FIles/Windows.UI.Search/Images/logo.contrast-white_scale-140.png

.png

Additional FIles/Windows.UI.Search/Images/logo.contrast-white_scale-180.png

.png

Additional FIles/Windows.UI.Search/Images/logo.contrast-white_scale-80.png

.png

Additional FIles/Windows.UI.Search/Images/logo.png

.png

Additional FIles/Windows.UI.Search/Images/logo.scale-100.png

.png

Additional FIles/Windows.UI.Search/Images/logo.scale-140.png

.png

Additional FIles/Windows.UI.Search/Images/logo.scale-180.png

.png

Additional FIles/Windows.UI.Search/Images/logo.scale-80.png

.png

Additional FIles/Windows.UI.Search/XAMLTemplates/Ads.BackgroundStyles_8_1_RP-66431a3a.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Ads.Extension_8_1_RTM-aa99aadc.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Ads.Medium_Landscape_8_1_RTM-85bb765b.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Ads.Medium_Portrait_8_1_RTM-615398bc.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Ads.MerchantRating_8_1_RP-ea838a30.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Ads.SerpAdsLayout_8_1_RTM-85f7eb4b.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Ads.SerpSmallAdsLayout_8_1_RTM-663dc2a5.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Ads.Small_Generic_8_1_RP-d5a06819.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/ButtonStyle_Transparent.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Entity.DominantImage_8_1_RP-08fe6658.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/EntityContainer.HeroGeneric_8_1_RTM-32f2d081.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/EntityContainer.HeroTitle_8_1_RP-f603603e.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Maps.Home_Landscape_8_1_RP-7f8d5bbc.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Maps.Home_Portrait_8_1_RP-842541a0.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Maps.Home_Snap_8_1_RP-1fe61be5.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/ModernApplications.AppContentItem_8_1_RP-e6dff609.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/ModernApplications.AppContent_Landscape_8_1_RP-adaa73c5.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/ModernApplications.AppContent_Portrait_8_1_RP-39092f1a.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/ModernApplications.AppContent_Snap_8_1_RTM-fdaca186.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/ModernApplications.AppStoreItem_8_1_RP-6a626025.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/ModernApplications.AppStoreMultiLayout_Landscape_8_1_RP-b260f3f4.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/ModernApplications.AppStoreMultiLayout_Portrait_8_1_RP-2c87d0f2.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/ModernApplications.AppStoreMultiLayout_Snap_8_1_RTM-9683ac3f.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/ModernApplications.AppStoreSingleLayout_Landscape_8_1_RP-c4795bba.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/ModernApplications.AppStoreSingleLayout_Portrait_8_1_RP-9b6fd169.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/ModernApplications.AppStoreSingleLayout_Snap_8_1_RP-c719d94d.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.EntryAnswer_8_1_RTM-c72c796b.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.EntryAnswer_Landscape_8_1_RP-0f063311.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.EntryAnswer_Portrait_8_1_RP-7063befe.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.EntryAnswer_Snap_8_1_RP-8843ec44.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.ImageAnswer_Landscape_8_1_RP-f906ac1a.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.ImageAnswer_Portrait_8_1_RP-8b545332.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.ImageAnswer_Snap_8_1_RP-d9482575.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.ImageDetails.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.ImageGridRelatedSearch.Fallback.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.ImageGridRelatedSearch_8_1_RTM-1baccaa0.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.ImageGridResult.Fallback.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.ImageGridResult_8_1_RTM-50d8f54c.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.ImageHeroAnswer_8_1_RP-7c124627.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.VideoAnswer_Landscape_8_1_RP-7cbbf7e7.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.VideoAnswer_Portrait_8_1_RP-c357b679

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.VideoAnswer_Snap_8_1_RTM-855ddcf4.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.VideoGridRelatedSearch.Fallback.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.VideoGridRelatedSearch_8_1_RTM-ec657138.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.VideoGridResult.Fallback.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.VideoGridResult_8_1_RTM-1cc6a74e.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Multimedia.VideoHeroEmbeddedAnswer_2x2_8_1_RTM-af40e4f5.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/News.Hero_2x2_8_1_RP-004e0293.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/News.Hero_4x2_8_1_RP-94410bf1.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/News.Home_8_1_RP-f7a1fb30.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/News.Home_Landscape_8_1_RP-9db0a5cc.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/News.Home_Portrait_8_1_RP-d59aef9d.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/News.Home_Snap_8_1_RP-20481197.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Phonebook.Home_Landscape_8_1_RP-cf640f21.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Phonebook.Home_Portrait_8_1_RP-ea3918d7.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Phonebook.Home_Snap_8_1_RP-40f14165.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/QuerySuggestion.Home_8_1_RTM-f86e66c6.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/QuerySuggestion.Home_Landscape_8_1_RP-287ac967.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/QuerySuggestion.Home_Portrait_8_1_RP-025f5d67.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/QuerySuggestion.Home_Snap_8_1_RTM-e9d6cc58.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.AccentColorStyles_8_1_RP-1b817d48.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.ActionsList_8_1_RTM-b69cb157.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.AppButton_8_1_RP-591615d7.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.AttributionList_8_1_RP-374c6d53.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.Branding_8_1_RP-d49ce559.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.Branding_CN_8_1_RP-5e6d9be2.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.ButtonStyles_8_1_RP-ebffd57e.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.GridViewStyles_8_1_RTM-f43d2263.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.HeroStyles_8_1_RTM-64087e61.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.ImageSet_2x2_8_1_RTM-a968dcb4.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.ImageSet_4x2_8_1_RTM-dd60f649.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.ImageStyles_8_1_RTM-42033d51.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.InfoCard_1x2_8_1_RTM-cd709399.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.InfoCard_2x2_8_1_RTM-38aafc59.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.ItemTable_2x2_8_1_RP-932487be.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.LayoutDW_Landscape_8_1_RP-a27f4cf1.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.LayoutDW_Portrait_8_1_RP-e25dbf88.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.LayoutDW_Snap_8_1_RP-ee0942f7.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.LayoutD_Landscape_8_1_RP-e40e6e03.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.LayoutD_Portrait_8_1_RP-6b54d1ab.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.LayoutD_Snap_8_1_RP-3297c772.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.NullableImagePlaceholder_8_1_RP-0bb3a96d.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.Rating_8_1_RP-63a24866.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.ReviewsMultiSource_2x2_8_1_RTM-a92bc0c1.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.ReviewsSingleSource_2x2_8_1_RTM-2a1d4569.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.SerpDefaultLayout_8_1_RTM-2def0350.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.SerpDefaultListLayout_8_1_RTM-d49811ee.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.SerpGridViewStyles_8_1_RTM-bf05e9bc.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.SerpNoSelectionLayout_8_1_RTM-078b9c26.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.SongsList_8_1_RTM-027dfb07.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Shared.TextStyles_8_1_RP-224b0139.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Travel.Weather_1x2_8_1_RP-8b39db5d.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.Algo_Generic_8_1_RP-63ae5c11.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.AppifiedAlgo_Home_8_1_RTM-ff1ec984.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.AppifiedAlgo_Landscape_8_1_RP-634d747c.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.AppifiedAlgo_Portrait_8_1_RP-c6c89df0.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.BasicAlgo_Portrait_8_1_RP-22ab2993.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.DcardAlgo_Home_8_1_RTM-ef6b7330.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.DcardAlgo_Landscape_8_1_RP-059c4005.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.DcardAlgo_Portrait_8_1_RP-a40178a5.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.DeepLinkItem_8_1_RP-dfcf46fe.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.DeepLinksList_8_1_RP-515c5925.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.FactsList_8_1_RP-fe15cd6d.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.Fallback.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.Fallback_Halfsize.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.Metadata_8_1_RP-4af027d6.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.OtherPageAlgo_Home_8_1_RTM-f5858a8b.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.PreviewWithOverlay_8_1_RP-40f8177a.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.RichAlgo_Home_8_1_RTM-b58c3737.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.RichAlgo_Landscape_8_1_RP-552e0971.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/Web.RichAlgo_Portrait_8_1_RP-c1a16ee1.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/WindowsSearchCharm.Local_Action_ContactHero.xaml

Additional FIles/Windows.UI.Search/XAMLTemplates/WindowsSearchCharm.Local_ContactHero.xaml

Additional FIles/Windows.UI.Search/pris/Windows.UI.Search.en-US.pri

Additional FIles/Windows.admx

Additional FIles/WindowsAnytimeUpgrade.admx

Additional FIles/WindowsBackup.admx

Additional FIles/WindowsColorSystem.admx

Additional FIles/WindowsConnectNow.admx

Additional FIles/WindowsDefender.admx

Additional FIles/WindowsExplorer.admx

Additional FIles/WindowsFileProtection.admx

Additional FIles/WindowsFirewall.admx

Additional FIles/WindowsMail.admx

Additional FIles/WindowsMediaDRM.admx

Additional FIles/WindowsMediaPlayer.admx

Additional FIles/WindowsMessenger.admx

Additional FIles/WindowsProducts.admx

Additional FIles/WindowsRemoteManagement.admx

Additional FIles/WindowsRemoteShell.admx

Additional FIles/WindowsServer.admx

Additional FIles/WindowsUpdate.admx

Additional FIles/Winsrv.admx

Additional FIles/WordWheel.admx

Additional FIles/WorkFolders-Client.admx

Additional FIles/WorkplaceJoin.admx

.xml

Additional FIles/en-US/ActiveXInstallService.adml

.xml

Additional FIles/en-US/AddRemovePrograms.adml

.xml

Additional FIles/en-US/AppCompat.adml

.xml

Additional FIles/en-US/AppXRuntime.adml

.xml

Additional FIles/en-US/AppxPackageManager.adml

.xml

Additional FIles/en-US/AttachmentManager.adml

.xml

Additional FIles/en-US/AuditSettings.adml

.xml

Additional FIles/en-US/AutoPlay.adml

.xml

Additional FIles/en-US/Biometrics.adml

.xml

Additional FIles/en-US/Bits.adml

.xml

Additional FIles/en-US/CEIPEnable.adml

.xml

Additional FIles/en-US/COM.adml

.xml

Additional FIles/en-US/CipherSuiteOrder.adml

.xml

Additional FIles/en-US/Conf.adml

.xml

Additional FIles/en-US/ControlPanel.adml

.xml

Additional FIles/en-US/ControlPanelDisplay.adml

.xml

Additional FIles/en-US/Cpls.adml

.xml

Additional FIles/en-US/CredSsp.adml

.xml

Additional FIles/en-US/CredUI.adml

.xml

Additional FIles/en-US/CredentialProviders.adml

.xml

Additional FIles/en-US/CtrlAltDel.adml

.xml

Additional FIles/en-US/DCOM.adml

.xml

Additional FIles/en-US/DFS.adml

.xml

Additional FIles/en-US/DWM.adml

.xml

Additional FIles/en-US/Desktop.adml

.xml

Additional FIles/en-US/DeviceCompat.adml

.xml

Additional FIles/en-US/DeviceInstallation.adml

.xml

Additional FIles/en-US/DeviceSetup.adml

.xml

Additional FIles/en-US/DigitalLocker.adml

.xml

Additional FIles/en-US/DiskDiagnostic.adml

.xml

Additional FIles/en-US/DiskNVCache.adml

.xml

Additional FIles/en-US/DiskQuota.adml

.xml

Additional FIles/en-US/DistributedLinkTracking.adml

.xml

Additional FIles/en-US/DnsClient.adml

.xml

Additional FIles/en-US/EAIME.adml

.xml

Additional FIles/en-US/EarlyLaunchAM.adml

Additional FIles/en-US/EdgeUI.adml

.xml

Additional FIles/en-US/EncryptFilesonMove.adml

.xml

Additional FIles/en-US/ErrorReporting.adml

.xml

Additional FIles/en-US/EventForwarding.adml

.xml

Additional FIles/en-US/EventLog.adml

.xml

Additional FIles/en-US/EventViewer.adml

.xml

Additional FIles/en-US/Explorer.adml

.xml

Additional FIles/en-US/ExternalBoot.adml

.xml

Additional FIles/en-US/FileHistory.adml

.xml

Additional FIles/en-US/FileRecovery.adml

.xml

Additional FIles/en-US/FileRevocation.adml

.xml

Additional FIles/en-US/FileServerVSSProvider.adml

.xml

Additional FIles/en-US/FileSys.adml

.xml

Additional FIles/en-US/FolderRedirection.adml

.xml

Additional FIles/en-US/FramePanes.adml

.xml

Additional FIles/en-US/GameExplorer.adml

.xml

Additional FIles/en-US/Globalization.adml

.xml

Additional FIles/en-US/GroupPolicy-Server.adml

.xml

Additional FIles/en-US/GroupPolicy.adml

.xml

Additional FIles/en-US/GroupPolicyPreferences.adml

.xml

Additional FIles/en-US/Help.adml

.xml

Additional FIles/en-US/HelpAndSupport.adml

.xml

Additional FIles/en-US/ICM.adml

.xml

Additional FIles/en-US/IIS.adml

.xml

Additional FIles/en-US/InetRes.adml

.xml

Additional FIles/en-US/InkWatson.adml

.xml

Additional FIles/en-US/KDC.adml

.xml

Additional FIles/en-US/Kerberos.adml

.xml

Additional FIles/en-US/LanmanServer.adml

.xml

Additional FIles/en-US/LeakDiagnostic.adml

.xml

Additional FIles/en-US/LinkLayerTopologyDiscovery.adml

.xml

Additional FIles/en-US/LocationProviderAdm.adml

.xml

Additional FIles/en-US/Logon.adml

.xml

Additional FIles/en-US/MMC.adml

.xml

Additional FIles/en-US/MMCSnapIns2.adml

.xml

Additional FIles/en-US/MMCSnapins.adml

.xml

Additional FIles/en-US/MSDT.adml

.xml

Additional FIles/en-US/MSI.adml

.xml

Additional FIles/en-US/MediaCenter.adml

.xml

Additional FIles/en-US/MobilePCMobilityCenter.adml

.xml

Additional FIles/en-US/MobilePCPresentationSettings.adml

.xml

Additional FIles/en-US/Msi-FileRecovery.adml

.xml

Additional FIles/en-US/NAPXPQec.adml

.xml

Additional FIles/en-US/NCSI.adml

.xml

Additional FIles/en-US/Netlogon.adml

.xml

Additional FIles/en-US/NetworkConnections.adml

.xml

Additional FIles/en-US/NetworkIsolation.adml

Additional FIles/en-US/NetworkProjection.adml

.xml

Additional FIles/en-US/OfflineFiles.adml

.xml

Additional FIles/en-US/P2P-pnrp.adml

.xml

Additional FIles/en-US/ParentalControls.adml

.xml

Additional FIles/en-US/PeerToPeerCaching.adml

.xml

Additional FIles/en-US/PenTraining.adml

.xml

Additional FIles/en-US/PerformanceDiagnostics.adml

.xml

Additional FIles/en-US/PerformancePerftrack.adml

.xml

Additional FIles/en-US/Power.adml

.xml

Additional FIles/en-US/PowerShellExecutionPolicy.adml

.xml

Additional FIles/en-US/PreviousVersions.adml

.xml

Additional FIles/en-US/Printing.adml

.xml

Additional FIles/en-US/Printing2.adml

.xml

Additional FIles/en-US/Programs.adml

.xml

Additional FIles/en-US/PswdSync.adml

.xml

Additional FIles/en-US/QOS.adml

.xml

Additional FIles/en-US/RPC.adml

.xml

Additional FIles/en-US/RacWmiProv.adml

.xml

Additional FIles/en-US/Radar.adml

.xml

Additional FIles/en-US/ReAgent.adml

.xml

Additional FIles/en-US/Reliability.adml

.xml

Additional FIles/en-US/RemoteAssistance.adml

.xml

Additional FIles/en-US/RemovableStorage.adml

.xml

Additional FIles/en-US/Scripts.adml

.xml

Additional FIles/en-US/Securitycenter.adml

.xml

Additional FIles/en-US/Sensors.adml

.xml

Additional FIles/en-US/ServerManager.adml

.xml

Additional FIles/en-US/Servicing.adml

.xml

Additional FIles/en-US/SettingSync.adml

.xml

Additional FIles/en-US/Setup.adml

.xml

Additional FIles/en-US/SharedFolders.adml

.xml

Additional FIles/en-US/Sharing.adml

.xml

Additional FIles/en-US/Shell-CommandPrompt-RegEditTools.adml

.xml

Additional FIles/en-US/ShellWelcomeCenter.adml

.xml

Additional FIles/en-US/Sidebar.adml

.xml

Additional FIles/en-US/SkyDrive.adml

.xml

Additional FIles/en-US/Smartcard.adml

.xml

Additional FIles/en-US/Snis.adml

.xml

Additional FIles/en-US/Snmp.adml

.xml

Additional FIles/en-US/SoundRec.adml

.xml

Additional FIles/en-US/StartMenu.adml

.xml

Additional FIles/en-US/SystemRestore.adml

.xml

Additional FIles/en-US/TPM.adml

.xml

Additional FIles/en-US/TabletPCInputPanel.adml

.xml

Additional FIles/en-US/TabletShell.adml

.xml

Additional FIles/en-US/TaskScheduler.adml

.xml

Additional FIles/en-US/Taskbar.adml

.xml

Additional FIles/en-US/TerminalServer-Server.adml

.xml

Additional FIles/en-US/TerminalServer.adml

.xml

Additional FIles/en-US/Thumbnails.adml

.xml

Additional FIles/en-US/TouchInput.adml

.xml

Additional FIles/en-US/UserProfiles.adml

.xml

Additional FIles/en-US/VolumeEncryption.adml

.xml

Additional FIles/en-US/W32Time.adml

.xml

Additional FIles/en-US/WCM.adml

.xml

Additional FIles/en-US/WDI.adml

.xml

Additional FIles/en-US/WPN.adml

.xml

Additional FIles/en-US/WinCal.adml

.xml

Additional FIles/en-US/WinInit.adml

.xml

Additional FIles/en-US/WinLogon.adml

.xml

Additional FIles/en-US/Windows.adml

.xml

Additional FIles/en-US/WindowsAnytimeUpgrade.adml

.xml

Additional FIles/en-US/WindowsBackup.adml

.xml

Additional FIles/en-US/WindowsColorSystem.adml

.xml

Additional FIles/en-US/WindowsConnectNow.adml

.xml

Additional FIles/en-US/WindowsDefender.adml

Additional FIles/en-US/WindowsExplorer.adml

.xml

Additional FIles/en-US/WindowsFileProtection.adml

.xml

Additional FIles/en-US/WindowsFirewall.adml

.xml

Additional FIles/en-US/WindowsMail.adml

.xml

Additional FIles/en-US/WindowsMediaDRM.adml

.xml

Additional FIles/en-US/WindowsMediaPlayer.adml

.xml

Additional FIles/en-US/WindowsMessenger.adml

.xml

Additional FIles/en-US/WindowsProducts.adml

.xml

Additional FIles/en-US/WindowsRemoteManagement.adml

.xml

Additional FIles/en-US/WindowsRemoteShell.adml

.xml

Additional FIles/en-US/WindowsServer.adml

.xml

Additional FIles/en-US/WindowsUpdate.adml

.xml

Additional FIles/en-US/Winsrv.adml

.xml

Additional FIles/en-US/WordWheel.adml

.xml

Additional FIles/en-US/WorkFolders-Client.adml

.xml

Additional FIles/en-US/WorkplaceJoin.adml

.xml

Additional FIles/en-US/fthsvc.adml

.xml

Additional FIles/en-US/hotspotauth.adml

.xml

Additional FIles/en-US/iSCSI.adml

.xml

Additional FIles/en-US/msched.adml

.xml

Additional FIles/en-US/nca.adml

Additional FIles/en-US/pca.adml

.xml

Additional FIles/en-US/sdiageng.adml

.xml

Additional FIles/en-US/srm-fci.adml

.xml

Additional FIles/en-US/tcpip.adml

.xml

Additional FIles/en-US/wlansvc.adml

.xml

Additional FIles/en-US/wwansvc.adml

.xml

Additional FIles/fthsvc.admx

Additional FIles/hotspotauth.admx

Additional FIles/iSCSI.admx

Additional FIles/inetres.admx

.xml

Additional FIles/kdc.admx

Additional FIles/msched.admx

.xml

Additional FIles/nca.admx

Additional FIles/pca.admx

Additional FIles/sdiageng.admx

Additional FIles/srm-fci.admx

Additional FIles/tcpip.admx

.xml

Additional FIles/wlansvc.admx

.xml

Additional FIles/wwansvc.admx

.xml

Data/IPCBox.pimx

Data/IPCBox.sig

.xml

Data/MetroFramework.Design.dll

Data/MetroFramework.Fonts.dll

.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 354KB - Virtual size: 527KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Data/Privacy Policy.txt

Data/advapi32.dll

.dll windows x64

cf49de37d6832a2e30a495cfe792c5d3

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

35:71:3a:ed:36:6c:0f:91:c7:97:71:46:7d:89:eb:e2:d5:18:ad:17:62:cf:4f:58:50:46:12:28:d5:7c:7a:8d
Signer

Actual PE Digest

35:71:3a:ed:36:6c:0f:91:c7:97:71:46:7d:89:eb:e2:d5:18:ad:17:62:cf:4f:58:50:46:12:28:d5:7c:7a:8d

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

23/09/2022, 10:46
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memmove

iswctype

_vsnwprintf

memset

memcpy

memcmp

__C_specific_handler

_vsnprintf

mbstowcs

iswalpha

_stricmp

_wcstoi64

_i64tow_s

_wcstoui64

_ui64tow_s

_ultow

wcscat_s

_wcsicmp

_errno

wcschr

wcscpy_s

wcstok_s

swscanf_s

wcsrchr

wcsncpy_s

wcsstr

swprintf_s

_wcsnicmp

wcsncmp

strstr

strchr

tolower

wcstoul

_ultow_s

wcscmp

ntdll

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

NtSetSystemInformation

DbgPrint

RtlFreeAnsiString

RtlGetCurrentTransaction

ord1

RtlLeaveCriticalSection

RtlEnterCriticalSection

RtlIsTextUnicode

RtlLengthSid

NlsMbCodePageTag

NtQueryInformationToken

RtlxUnicodeStringToAnsiSize

RtlSubAuthoritySid

RtlGetThreadPreferredUILanguages

RtlSubAuthorityCountSid

RtlMakeSelfRelativeSD

RtlConvertSidToUnicodeString

RtlUnicodeStringToInteger

RtlAllocateHandle

RtlIsValidIndexHandle

RtlFreeHandle

NtOpenKey

NtQueryValueKey

NtClose

NtOpenThreadToken

NtOpenProcessToken

RtlEqualSid

RtlAddAccessAllowedAceEx

NtSetInformationToken

RtlCreateSecurityDescriptor

RtlSetOwnerSecurityDescriptor

NtDuplicateToken

NtCompareTokens

RtlAllocateAndInitializeSid

RtlFreeSid

RtlIsGenericTableEmpty

RtlEnumerateGenericTableWithoutSplaying

RtlDuplicateUnicodeString

RtlExpandEnvironmentStrings_U

NtOpenFile

RtlCreateUnicodeString

NtQueryInformationProcess

RtlGetLastNtStatus

NtQueryKey

RtlValidSid

LdrLoadDll

RtlImageNtHeader

LdrUnloadDll

NtDeviceIoControlFile

NtQuerySystemInformation

EtwEventRegister

EtwEventWrite

NtCreateKey

NtSetValueKey

RtlDeleteElementGenericTable

RtlAppendUnicodeToString

NtDeleteKey

RtlInsertElementGenericTable

RtlCopySid

RtlInitializeHandleTable

RtlDestroyHandleTable

EtwEventUnregister

NtEnumerateKey

RtlIntegerToUnicodeString

RtlStringFromGUID

RtlAppendUnicodeStringToString

RtlFormatCurrentUserKeyPath

RtlInitializeGenericTable

RtlQueryRegistryValuesEx

RtlLookupElementGenericTable

RtlNumberGenericTableElements

RtlGUIDFromString

RtlUpcaseUnicodeChar

NtQueryVolumeInformationFile

NtOpenSymbolicLinkObject

NtQuerySymbolicLinkObject

RtlPrefixUnicodeString

RtlDetermineDosPathNameType_U

NtQueryInformationFile

RtlGetFullPathName_U

RtlUnicodeToMultiByteN

RtlNtStatusToDosErrorNoTeb

RtlAnsiCharToUnicodeChar

RtlMultiByteToUnicodeN

RtlSetLastWin32Error

NtTraceControl

NtTraceEvent

EtwpGetCpuSpeed

RtlIpv4AddressToStringW

RtlIpv6AddressToStringW

RtlInitAnsiStringEx

RtlInitUnicodeStringEx

RtlCreateUnicodeStringFromAsciiz

NtRenameKey

RtlAddAce

RtlGetAce

RtlAddAccessDeniedAceEx

RtlSetDaclSecurityDescriptor

RtlFirstFreeAce

RtlValidAcl

RtlAddAuditAccessObjectAce

RtlGetSaclSecurityDescriptor

RtlAddAccessDeniedObjectAce

RtlSetGroupSecurityDescriptor

RtlGetGroupSecurityDescriptor

RtlSetSaclSecurityDescriptor

RtlxAnsiStringToUnicodeSize

RtlGetControlSecurityDescriptor

RtlAbsoluteToSelfRelativeSD

RtlAddAccessAllowedObjectAce

RtlGetDaclSecurityDescriptor

RtlInitializeSid

RtlGetOwnerSecurityDescriptor

RtlAddAuditAccessAceEx

NtQuerySystemTime

RtlTimeToSecondsSince1970

EtwEventSetInformation

RtlImpersonateSelf

RtlAdjustPrivilege

RtlCopyString

EtwEventWriteTransfer

EtwTraceMessage

EtwGetTraceLoggerHandle

EtwGetTraceEnableLevel

EtwGetTraceEnableFlags

EtwRegisterTraceGuidsW

EtwUnregisterTraceGuids

NtWaitForSingleObject

RtlGetVersion

NtQueryInformationThread

NtSetInformationThread

NtQuerySecurityObject

RtlRunOnceExecuteOnce

RtlRunOnceBeginInitialize

RtlDllShutdownInProgress

RtlRunOnceInitialize

NtQueryPerformanceCounter

NtWaitForMultipleObjects

WinSqmAddToStream

RtlCreateAcl

RtlValidRelativeSecurityDescriptor

NtCreateFile

NtWriteFile

NtReadFile

RtlWaitOnAddress

RtlWakeAddressAll

RtlQueryPerformanceCounter

RtlAddAccessAllowedAce

RtlAcquireSRWLockExclusive

RtlInsertElementGenericTableAvl

RtlReleaseSRWLockExclusive

RtlAcquireSRWLockShared

RtlLookupElementGenericTableAvl

RtlReleaseSRWLockShared

RtlEnumerateGenericTableAvl

RtlDeleteElementGenericTableAvl

RtlInitializeGenericTableAvl

RtlReAllocateHeap

RtlDosPathNameToRelativeNtPathName_U

RtlReleaseRelativeName

RtlWakeAddressSingle

RtlDestroyQueryDebugBuffer

RtlEqualUnicodeString

RtlQueryProcessDebugInformation

NtQueryMutant

NtQueryObject

NtAlpcQueryInformation

RtlInitializeSRWLock

RtlCreateQueryDebugBuffer

RtlOpenCurrentUser

NtQueryMultipleValueKey

NtReplaceKey

NtSaveMergedKeys

NtSaveKey

RtlValidSecurityDescriptor

RtlLengthSecurityDescriptor

RtlGetNtProductType

RtlCopyUnicodeString

RtlOemStringToUnicodeString

RtlUnicodeToMultiByteSize

RtlUnicodeStringToAnsiString

RtlDosPathNameToNtPathName_U

RtlAllocateHeap

RtlNtStatusToDosError

RtlFreeUnicodeString

RtlInitAnsiString

RtlInitUnicodeString

NtOpenKeyEx

NtSetInformationKey

RtlFreeHeap

RtlAnsiStringToUnicodeString

RtlInitializeCriticalSection

RtlDeleteCriticalSection

api-ms-win-eventing-controller-l1-1-0

TraceSetInformation

ControlTraceW

QueryAllTracesW

EventAccessQuery

EnumerateTraceGuidsEx

StartTraceW

EventAccessControl

StopTraceW

EventAccessRemove

EnableTraceEx2

api-ms-win-eventing-consumer-l1-1-0

CloseTrace

OpenTraceW

ProcessTrace

kernelbase

RegKrnGetHKEY_ClassesRootAddress

RegKrnGetClassesEnumTableAddressInternal

RegKrnGetTermsrvRegistryExtensionFlags

RegDeleteKeyExInternalW

RegOpenKeyExInternalW

RegCreateKeyExInternalW

CLOSE_LOCAL_HANDLE_INTERNAL

MapPredefinedHandleInternal

RegDeleteKeyExInternalA

RegCreateKeyExInternalA

RegOpenKeyExInternalA

RemapPredefinedHandleInternal

DisablePredefinedHandleTableInternal

GetPackagePath

PackageIdFromFullName

Sleep

lstrcmpiW

lstrcmpW

GetUserDefaultUILanguage

GetSystemDefaultUILanguage

CreateProcessAsUserW

CreateProcessInternalA

AreFileApisANSI

lstrlenW

LocalReAlloc

LocalFree

LocalAlloc

sechost

QueryAllTracesA

StartTraceA

ControlTraceA

api-ms-win-service-core-l1-1-1

EnumDependentServicesW

QueryServiceDynamicInformation

StartServiceCtrlDispatcherW

SetServiceStatus

RegisterServiceCtrlHandlerExW

EnumServicesStatusExW

api-ms-win-service-management-l1-1-0

CreateServiceW

CloseServiceHandle

DeleteService

OpenSCManagerW

ControlServiceExW

OpenServiceW

StartServiceW

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW

QueryServiceStatusEx

QueryServiceConfigW

NotifyServiceStatusChangeW

SetServiceObjectSecurity

ChangeServiceConfig2W

QueryServiceObjectSecurity

QueryServiceConfig2W

api-ms-win-service-private-l1-1-1

I_ScRpcBindW

I_ScRpcBindA

I_ScSetServiceBitsA

I_ScSetServiceBitsW

I_ScRegisterPreshutdownRestart

WaitServiceState

api-ms-win-service-winsvc-l1-2-0

OpenServiceA

QueryServiceConfig2A

ControlService

RegisterServiceCtrlHandlerW

QueryServiceConfigA

OpenSCManagerA

QueryServiceStatus

RegisterServiceCtrlHandlerExA

ChangeServiceConfigA

StartServiceA

CreateServiceA

RegisterServiceCtrlHandlerA

NotifyServiceStatusChangeA

ControlServiceExA

ChangeServiceConfig2A

StartServiceCtrlDispatcherA

api-ms-win-core-namedpipe-l1-2-0

ImpersonateNamedPipeClient

api-ms-win-core-processthreads-l1-1-2

OpenProcess

CreateThread

IsProcessorFeaturePresent

GetCurrentThread

OpenThread

GetProcessId

GetCurrentProcess

OpenProcessToken

OpenThreadToken

SetThreadToken

GetPriorityClass

GetCurrentThreadId

GetCurrentProcessId

TerminateProcess

api-ms-win-security-base-l1-2-0

RevertToSelf

AddAccessAllowedAce

GetSecurityDescriptorOwner

SetSecurityDescriptorOwner

AllocateAndInitializeSid

AllocateLocallyUniqueId

InitializeAcl

SetKernelObjectSecurity

MakeAbsoluteSD

ImpersonateLoggedOnUser

DuplicateTokenEx

QuerySecurityAccessMask

CreatePrivateObjectSecurityEx

GetSecurityDescriptorLength

ImpersonateSelf

GetAce

AccessCheckByTypeResultList

CreatePrivateObjectSecurity

SetSecurityDescriptorDacl

IsTokenRestricted

AddAuditAccessObjectAce

AdjustTokenGroups

AddAccessDeniedAce

AreAllAccessesGranted

SetTokenInformation

PrivilegeCheck

InitializeSecurityDescriptor

GetPrivateObjectSecurity

DuplicateToken

CreatePrivateObjectSecurityWithMultipleInheritance

SetAclInformation

GetSidIdentifierAuthority

FreeSid

GetTokenInformation

PrivilegedServiceAuditAlarmW

AccessCheckByTypeResultListAndAuditAlarmW

ObjectOpenAuditAlarmW

ObjectPrivilegeAuditAlarmW

ObjectCloseAuditAlarmW

SetFileSecurityW

GetFileSecurityW

ObjectDeleteAuditAlarmW

CopySid

AccessCheckByTypeResultListAndAuditAlarmByHandleW

AccessCheckAndAuditAlarmW

AccessCheckByTypeAndAuditAlarmW

IsValidSid

EqualPrefixSid

AddAccessDeniedObjectAce

AddAccessAllowedObjectAce

AccessCheckByType

AddAuditAccessAce

SetPrivateObjectSecurityEx

EqualSid

GetSecurityDescriptorControl

CreateRestrictedToken

GetAclInformation

GetKernelObjectSecurity

AccessCheck

AddAccessAllowedAceEx

GetSecurityDescriptorRMControl

SetSecurityDescriptorRMControl

GetSidSubAuthorityCount

GetSidLengthRequired

MapGenericMask

InitializeSid

AddAce

IsValidAcl

ImpersonateAnonymousToken

MakeSelfRelativeSD

IsValidSecurityDescriptor

GetLengthSid

AddAccessDeniedAceEx

CheckTokenMembership

SetSecurityDescriptorSacl

AreAnyAccessesGranted

AdjustTokenPrivileges

SetSecurityDescriptorGroup

DeleteAce

SetSecurityDescriptorControl

GetWindowsAccountDomainSid

FindFirstFreeAce

ConvertToAutoInheritPrivateObjectSecurity

SetPrivateObjectSecurity

EqualDomainSid

GetSecurityDescriptorGroup

GetSecurityDescriptorDacl

CreateWellKnownSid

DestroyPrivateObjectSecurity

AddAuditAccessAceEx

SetSecurityAccessMask

IsWellKnownSid

GetSidSubAuthority

GetSecurityDescriptorSacl

api-ms-win-security-base-private-l1-1-1

MakeAbsoluteSD2

api-ms-win-core-registry-l1-1-0

RegRestoreKeyW

RegLoadAppKeyW

RegCopyTreeW

RegCloseKey

RegOpenKeyExW

RegLoadMUIStringA

RegLoadAppKeyA

RegOpenUserClassesRoot

RegDeleteKeyExW

RegUnLoadKeyA

RegRestoreKeyA

RegDeleteTreeA

RegSetValueExA

RegCreateKeyExW

RegQueryValueExA

RegQueryInfoKeyW

RegEnumKeyExA

RegLoadMUIStringW

RegSaveKeyExA

RegUnLoadKeyW

RegSetValueExW

RegLoadKeyW

RegDisablePredefinedCacheEx

RegEnumKeyExW

RegFlushKey

RegNotifyChangeKeyValue

RegDeleteKeyExA

RegSetKeySecurity

RegEnumValueW

RegLoadKeyA

RegEnumValueA

RegOpenCurrentUser

RegGetValueW

RegSaveKeyExW

RegDeleteTreeW

RegDeleteValueA

RegDeleteValueW

RegQueryInfoKeyA

RegGetValueA

RegGetKeySecurity

RegOpenKeyExA

RegCreateKeyExA

RegQueryValueExW

api-ms-win-core-sysinfo-l1-2-1

GetComputerNameExW

GetTickCount

GetSystemTimeAsFileTime

GetLocalTime

GetNativeSystemInfo

GlobalMemoryStatusEx

GetSystemFirmwareTable

GetSystemWindowsDirectoryW

GetSystemTime

GetSystemDirectoryW

kernel32

GetFileAttributesExW

WideCharToMultiByte

MultiByteToWideChar

GetProcAddress

LoadLibraryExA

CloseHandle

FreeLibrary

LoadLibraryExW

LeaveCriticalSection

GetLastError

EnterCriticalSection

GetFullPathNameW

SearchPathW

HeapAlloc

ResolveDelayLoadedAPI

DelayLoadFailureHook

HeapFree

SleepEx

GetProcessHeap

GetFileAttributesW

CreateFileW

UnhandledExceptionFilter

SetUnhandledExceptionFilter

QueryPerformanceCounter

CreateEventW

GetThreadUILanguage

GetCommandLineW

LoadLibraryW

GetModuleHandleExW

SetFilePointer

OutputDebugStringW

WriteFile

TermsrvDeleteKey

TermsrvOpenUserClasses

DuplicateHandle

DecodePointer

FreeLibraryAndExitThread

ReadProcessMemory

EncodePointer

CreateThreadpoolIo

FreeLibraryWhenCallbackReturns

CancelIoEx

CloseThreadpoolIo

FormatMessageW

MoveFileW

DeleteFileW

ExpandEnvironmentStringsW

GetModuleHandleW

GetFileSizeEx

CreateFileMappingW

MapViewOfFile

UnmapViewOfFile

GetLongPathNameW

CompareFileTime

FindResourceExW

LoadResource

GetVolumePathNameW

DeleteCriticalSection

WaitForSingleObject

GetActiveProcessorCount

GetOverlappedResult

DeviceIoControl

GetVolumeInformationW

GetComputerNameW

ReleaseMutex

ExpandEnvironmentStringsA

GetModuleFileNameW

LoadLibraryA

GetComputerNameA

LocalUnlock

LocalLock

CreateMutexW

InitializeCriticalSection

StartThreadpoolIo

CancelThreadpoolIo

EnumUILanguagesW

GetFileMUIPath

SetErrorMode

SetFileInformationByHandle

CopyFileExW

FindClose

FindNextFileW

FindFirstFileExW

lstrcmpiA

GetFileSize

DosDateTimeToFileTime

FileTimeToDosDateTime

GetFileTime

ResetEvent

SetEvent

HeapReAlloc

LockResource

SizeofResource

SetLastError

rpcrt4

RpcStringBindingComposeW

RpcBindingFree

RpcStringFreeW

RpcBindingSetAuthInfoExA

RpcBindingSetAuthInfoExW

NdrClientCall3

I_RpcExceptionFilter

I_RpcMapWin32Status

RpcEpResolveBinding

RpcBindingSetAuthInfoW

RpcBindingSetAuthInfoA

RpcBindingFromStringBindingW

RpcSsDestroyClientContext

RpcBindingCreateW

RpcBindingBind

I_RpcSNCHOption

NdrClientCall2

UuidFromStringW

UuidToStringW

RpcExceptionFilter

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformationEffectiveYears

EnumDynamicTimeZoneInformation

api-ms-win-security-audit-l1-1-1

AuditSetSecurity

AuditEnumeratePerUserPolicy

AuditQueryGlobalSaclW

AuditFree

AuditSetPerUserPolicy

AuditEnumerateSubCategories

AuditComputeEffectivePolicyBySid

AuditLookupCategoryNameW

AuditLookupSubCategoryNameW

AuditEnumerateCategories

AuditQueryPerUserPolicy

AuditSetGlobalSaclW

AuditQuerySecurity

AuditQuerySystemPolicy

AuditSetSystemPolicy

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

A_SHAFinal

A_SHAInit

A_SHAUpdate

AbortSystemShutdownA

AbortSystemShutdownW

AccessCheck

AccessCheckAndAuditAlarmA

AccessCheckAndAuditAlarmW

AccessCheckByType

AccessCheckByTypeAndAuditAlarmA

AccessCheckByTypeAndAuditAlarmW

AccessCheckByTypeResultList

AccessCheckByTypeResultListAndAuditAlarmA

AccessCheckByTypeResultListAndAuditAlarmByHandleA

AccessCheckByTypeResultListAndAuditAlarmByHandleW

AccessCheckByTypeResultListAndAuditAlarmW

AddAccessAllowedAce

AddAccessAllowedAceEx

AddAccessAllowedObjectAce

AddAccessDeniedAce

AddAccessDeniedAceEx

AddAccessDeniedObjectAce

AddAce

AddAuditAccessAce

AddAuditAccessAceEx

AddAuditAccessObjectAce

AddConditionalAce

AddMandatoryAce

AddUsersToEncryptedFile

AddUsersToEncryptedFileEx

AdjustTokenGroups

AdjustTokenPrivileges

AllocateAndInitializeSid

AllocateLocallyUniqueId

AreAllAccessesGranted

AreAnyAccessesGranted

AuditComputeEffectivePolicyBySid

AuditComputeEffectivePolicyByToken

AuditEnumerateCategories

AuditEnumeratePerUserPolicy

AuditEnumerateSubCategories

AuditFree

AuditLookupCategoryGuidFromCategoryId

AuditLookupCategoryIdFromCategoryGuid

AuditLookupCategoryNameA

AuditLookupCategoryNameW

AuditLookupSubCategoryNameA

AuditLookupSubCategoryNameW

AuditQueryGlobalSaclA

AuditQueryGlobalSaclW

AuditQueryPerUserPolicy

AuditQuerySecurity

AuditQuerySystemPolicy

AuditSetGlobalSaclA

AuditSetGlobalSaclW

AuditSetPerUserPolicy

AuditSetSecurity

AuditSetSystemPolicy

BackupEventLogA

BackupEventLogW

BaseRegCloseKey

BaseRegCreateKey

BaseRegDeleteKeyEx

BaseRegDeleteValue

BaseRegFlushKey

BaseRegGetVersion

BaseRegLoadKey

BaseRegOpenKey

BaseRegRestoreKey

BaseRegSaveKeyEx

BaseRegSetKeySecurity

BaseRegSetValue

BaseRegUnLoadKey

BuildExplicitAccessWithNameA

BuildExplicitAccessWithNameW

BuildImpersonateExplicitAccessWithNameA

BuildImpersonateExplicitAccessWithNameW

BuildImpersonateTrusteeA

BuildImpersonateTrusteeW

BuildSecurityDescriptorA

BuildSecurityDescriptorW

BuildTrusteeWithNameA

BuildTrusteeWithNameW

BuildTrusteeWithObjectsAndNameA

BuildTrusteeWithObjectsAndNameW

BuildTrusteeWithObjectsAndSidA

BuildTrusteeWithObjectsAndSidW

BuildTrusteeWithSidA

BuildTrusteeWithSidW

CancelOverlappedAccess

ChangeServiceConfig2A

ChangeServiceConfig2W

ChangeServiceConfigA

ChangeServiceConfigW

CheckForHiberboot

CheckTokenMembership

ClearEventLogA

ClearEventLogW

CloseCodeAuthzLevel

CloseEncryptedFileRaw

CloseEventLog

CloseServiceHandle

CloseThreadWaitChainSession

CloseTrace

CommandLineFromMsiDescriptor

ComputeAccessTokenFromCodeAuthzLevel

ControlService

ControlServiceExA

ControlServiceExW

ControlTraceA

ControlTraceW

ConvertAccessToSecurityDescriptorA

ConvertAccessToSecurityDescriptorW

ConvertSDToStringSDDomainW

ConvertSDToStringSDRootDomainA

ConvertSDToStringSDRootDomainW

ConvertSecurityDescriptorToAccessA

ConvertSecurityDescriptorToAccessNamedA

ConvertSecurityDescriptorToAccessNamedW

ConvertSecurityDescriptorToAccessW

ConvertSecurityDescriptorToStringSecurityDescriptorA

ConvertSecurityDescriptorToStringSecurityDescriptorW

ConvertSidToStringSidA

ConvertSidToStringSidW

ConvertStringSDToSDDomainA

ConvertStringSDToSDDomainW

ConvertStringSDToSDRootDomainA

ConvertStringSDToSDRootDomainW

ConvertStringSecurityDescriptorToSecurityDescriptorA

ConvertStringSecurityDescriptorToSecurityDescriptorW

ConvertStringSidToSidA

ConvertStringSidToSidW

ConvertToAutoInheritPrivateObjectSecurity

CopySid

CreateCodeAuthzLevel

CreatePrivateObjectSecurity

CreatePrivateObjectSecurityEx

CreatePrivateObjectSecurityWithMultipleInheritance

CreateProcessAsUserA

CreateProcessAsUserW

CreateProcessWithLogonW

CreateProcessWithTokenW

CreateRestrictedToken

CreateServiceA

CreateServiceW

CreateTraceInstanceId

CreateWellKnownSid

CredBackupCredentials

CredDeleteA

CredDeleteW

CredEncryptAndMarshalBinaryBlob

CredEnumerateA

CredEnumerateW

CredFindBestCredentialA

CredFindBestCredentialW

CredFree

CredGetSessionTypes

CredGetTargetInfoA

CredGetTargetInfoW

CredIsMarshaledCredentialA

CredIsMarshaledCredentialW

CredIsProtectedA

CredIsProtectedW

CredMarshalCredentialA

CredMarshalCredentialW

CredProfileLoaded

CredProfileLoadedEx

CredProfileUnloaded

CredProtectA

CredProtectW

CredReadA

CredReadByTokenHandle

CredReadDomainCredentialsA

CredReadDomainCredentialsW

CredReadW

CredRenameA

CredRenameW

CredRestoreCredentials

CredUnmarshalCredentialA

CredUnmarshalCredentialW

CredUnprotectA

CredUnprotectW

CredWriteA

CredWriteDomainCredentialsA

CredWriteDomainCredentialsW

CredWriteW

CredpConvertCredential

CredpConvertOneCredentialSize

CredpConvertTargetInfo

CredpDecodeCredential

CredpEncodeCredential

CredpEncodeSecret

CryptAcquireContextA

CryptAcquireContextW

CryptContextAddRef

CryptCreateHash

CryptDecrypt

CryptDeriveKey

CryptDestroyHash

CryptDestroyKey

CryptDuplicateHash

CryptDuplicateKey

CryptEncrypt

CryptEnumProviderTypesA

CryptEnumProviderTypesW

CryptEnumProvidersA

CryptEnumProvidersW

CryptExportKey

CryptGenKey

CryptGenRandom

CryptGetDefaultProviderA

CryptGetDefaultProviderW

CryptGetHashParam

CryptGetKeyParam

CryptGetProvParam

CryptGetUserKey

CryptHashData

CryptHashSessionKey

CryptImportKey

CryptReleaseContext

CryptSetHashParam

CryptSetKeyParam

CryptSetProvParam

CryptSetProviderA

CryptSetProviderExA

CryptSetProviderExW

CryptSetProviderW

CryptSignHashA

CryptSignHashW

CryptVerifySignatureA

CryptVerifySignatureW

DecryptFileA

DecryptFileW

DeleteAce

DeleteService

DeregisterEventSource

DestroyPrivateObjectSecurity

DuplicateEncryptionInfoFile

DuplicateToken

DuplicateTokenEx

ElfBackupEventLogFileA

ElfBackupEventLogFileW

ElfChangeNotify

ElfClearEventLogFileA

ElfClearEventLogFileW

ElfCloseEventLog

ElfDeregisterEventSource

ElfFlushEventLog

ElfNumberOfRecords

ElfOldestRecord

ElfOpenBackupEventLogA

ElfOpenBackupEventLogW

ElfOpenEventLogA

ElfOpenEventLogW

ElfReadEventLogA

ElfReadEventLogW

ElfRegisterEventSourceA

ElfRegisterEventSourceW

ElfReportEventA

ElfReportEventAndSourceW

ElfReportEventW

EnableTrace

EnableTraceEx

EnableTraceEx2

EncryptFileA

EncryptFileW

EncryptedFileKeyInfo

EncryptionDisable

EnumDependentServicesA

EnumDependentServicesW

EnumDynamicTimeZoneInformation

EnumServiceGroupW

EnumServicesStatusA

EnumServicesStatusExA

EnumServicesStatusExW

EnumServicesStatusW

EnumerateTraceGuids

EnumerateTraceGuidsEx

EqualDomainSid

EqualPrefixSid

EqualSid

EtwLogSysConfigExtension

EventAccessControl

EventAccessQuery

EventAccessRemove

EventActivityIdControl

EventEnabled

EventProviderEnabled

EventRegister

EventSetInformation

EventUnregister

EventWrite

EventWriteEndScenario

EventWriteEx

EventWriteStartScenario

EventWriteString

EventWriteTransfer

FileEncryptionStatusA

FileEncryptionStatusW

FindFirstFreeAce

FlushEfsCache

FlushTraceA

FlushTraceW

FreeEncryptedFileKeyInfo

FreeEncryptedFileMetadata

FreeEncryptionCertificateHashList

FreeInheritedFromArray

FreeSid

GetAccessPermissionsForObjectA

GetAccessPermissionsForObjectW

GetAce

GetAclInformation

GetAuditedPermissionsFromAclA

GetAuditedPermissionsFromAclW

GetCurrentHwProfileA

GetCurrentHwProfileW

GetDynamicTimeZoneInformationEffectiveYears

GetEffectiveRightsFromAclA

GetEffectiveRightsFromAclW

GetEncryptedFileMetadata

GetEventLogInformation

GetExplicitEntriesFromAclA

GetExplicitEntriesFromAclW

GetFileSecurityA

GetFileSecurityW

GetInformationCodeAuthzLevelW

GetInformationCodeAuthzPolicyW

GetInheritanceSourceA

GetInheritanceSourceW

GetKernelObjectSecurity

GetLengthSid

GetLocalManagedApplicationData

GetLocalManagedApplications

GetManagedApplicationCategories

GetManagedApplications

GetMultipleTrusteeA

GetMultipleTrusteeOperationA

GetMultipleTrusteeOperationW

GetMultipleTrusteeW

GetNamedSecurityInfoA

GetNamedSecurityInfoExA

GetNamedSecurityInfoExW

GetNamedSecurityInfoW

GetNumberOfEventLogRecords

GetOldestEventLogRecord

GetOverlappedAccessResults

GetPrivateObjectSecurity

GetSecurityDescriptorControl

GetSecurityDescriptorDacl

GetSecurityDescriptorGroup

GetSecurityDescriptorLength

GetSecurityDescriptorOwner

GetSecurityDescriptorRMControl

GetSecurityDescriptorSacl

GetSecurityInfo

GetSecurityInfoExA

GetSecurityInfoExW

GetServiceDisplayNameA

GetServiceDisplayNameW

GetServiceKeyNameA

GetServiceKeyNameW

GetSidIdentifierAuthority

GetSidLengthRequired

GetSidSubAuthority

GetSidSubAuthorityCount

GetStringConditionFromBinary

GetThreadWaitChain

GetTokenInformation

GetTraceEnableFlags

GetTraceEnableLevel

GetTraceLoggerHandle

GetTrusteeFormA

GetTrusteeFormW

GetTrusteeNameA

GetTrusteeNameW

GetTrusteeTypeA

GetTrusteeTypeW

GetUserNameA

GetUserNameW

GetWindowsAccountDomainSid

I_QueryTagInformation

I_ScGetCurrentGroupStateW

I_ScIsSecurityProcess

I_ScPnPGetServiceName

I_ScQueryServiceConfig

I_ScRegisterPreshutdownRestart

I_ScSendPnPMessage

I_ScSendTSMessage

I_ScSetServiceBitsA

I_ScSetServiceBitsW

I_ScValidatePnPService

IdentifyCodeAuthzLevelW

ImpersonateAnonymousToken

ImpersonateLoggedOnUser

ImpersonateNamedPipeClient

ImpersonateSelf

InitializeAcl

InitializeSecurityDescriptor

InitializeSid

InitiateShutdownA

InitiateShutdownW

InitiateSystemShutdownA

InitiateSystemShutdownExA

InitiateSystemShutdownExW

InitiateSystemShutdownW

InstallApplication

IsTextUnicode

IsTokenRestricted

IsTokenUntrusted

IsValidAcl

IsValidRelativeSecurityDescriptor

IsValidSecurityDescriptor

IsValidSid

IsWellKnownSid

LockServiceDatabase

LogonUserA

LogonUserExA

LogonUserExExW

LogonUserExW

LogonUserW

LookupAccountNameA

LookupAccountNameW

LookupAccountSidA

LookupAccountSidW

LookupPrivilegeDisplayNameA

LookupPrivilegeDisplayNameW

LookupPrivilegeNameA

LookupPrivilegeNameW

LookupPrivilegeValueA

LookupPrivilegeValueW

LookupSecurityDescriptorPartsA

LookupSecurityDescriptorPartsW

LsaAddAccountRights

LsaAddPrivilegesToAccount

LsaClearAuditLog

LsaClose

LsaCreateAccount

LsaCreateSecret

LsaCreateTrustedDomain

LsaCreateTrustedDomainEx

LsaDelete

LsaDeleteTrustedDomain

LsaEnumerateAccountRights

LsaEnumerateAccounts

LsaEnumerateAccountsWithUserRight

LsaEnumeratePrivileges

LsaEnumeratePrivilegesOfAccount

LsaEnumerateTrustedDomains

LsaEnumerateTrustedDomainsEx

LsaFreeMemory

LsaGetAppliedCAPIDs

LsaGetQuotasForAccount

LsaGetRemoteUserName

LsaGetSystemAccessAccount

LsaGetUserName

LsaICLookupNames

LsaICLookupNamesWithCreds

LsaICLookupSids

LsaICLookupSidsWithCreds

LsaInvokeTrustScanner

LsaLookupNames

LsaLookupNames2

LsaLookupPrivilegeDisplayName

LsaLookupPrivilegeName

LsaLookupPrivilegeValue

LsaLookupSids

LsaLookupSids2

LsaManageSidNameMapping

LsaNtStatusToWinError

LsaOpenAccount

LsaOpenPolicy

LsaOpenPolicySce

LsaOpenSecret

LsaOpenTrustedDomain

LsaOpenTrustedDomainByName

LsaQueryCAPs

LsaQueryDomainInformationPolicy

LsaQueryForestTrustInformation

LsaQueryForestTrustInformation2

LsaQueryInfoTrustedDomain

LsaQueryInformationPolicy

LsaQuerySecret

LsaQuerySecurityObject

LsaQueryTrustedDomainInfo

LsaQueryTrustedDomainInfoByName

LsaRemoveAccountRights

LsaRemovePrivilegesFromAccount

LsaRetrievePrivateData

LsaSetCAPs

LsaSetDomainInformationPolicy

LsaSetForestTrustInformation

LsaSetForestTrustInformation2

LsaSetInformationPolicy

LsaSetInformationTrustedDomain

LsaSetQuotasForAccount

LsaSetSecret

LsaSetSecurityObject

LsaSetSystemAccessAccount

LsaSetTrustedDomainInfoByName

LsaSetTrustedDomainInformation

Sections

.text
Size: 595KB - Virtual size: 594KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.idata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Data/combase.dll

.dll windows x64

ba8646d28f2e7b54e7bcd331d13af3a6

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:29

Not After

02/12/2021, 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c
Signer

Actual PE Digest

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

23/09/2022, 10:46
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__dllonexit

_unlock

_lock

__C_specific_handler

_onexit

_initterm

_amsg_exit

_XcptFilter

_itoa_s

memcpy_s

??_V@YAXPEAX@Z

memset

memcpy

memcmp

_local_unwind

wcsnlen

wcsncpy_s

??_U@YAPEAX_K@Z

_wcsnicmp

wcsrchr

_vsnprintf

wcsstr

_wcslwr

_wtol

wcstok

wcschr

qsort

realloc

memmove_s

free

malloc

rand_s

wcsncmp

memmove

_wtoi

_resetstkoflw

_purecall

_wcsicmp

_vsnwprintf

__CxxFrameHandler3

swprintf_s

wcscmp

api-ms-win-core-heap-l1-2-0

HeapSize

HeapValidate

HeapAlloc

HeapFree

GetProcessHeap

HeapCreate

HeapDestroy

HeapReAlloc

HeapCompact

api-ms-win-core-errorhandling-l1-1-1

GetLastError

SetLastError

SetUnhandledExceptionFilter

RaiseException

UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

GetProcessMitigationPolicy

GetCurrentThreadId

TerminateProcess

GetCurrentThread

SetThreadStackGuarantee

SwitchToThread

OpenProcess

ProcessIdToSessionId

GetCurrentProcess

SetThreadToken

OpenThreadToken

OpenProcessToken

CreateThread

GetProcessId

GetCurrentProcessId

api-ms-win-core-registry-l1-1-0

RegGetValueA

RegDeleteKeyExA

RegCloseKey

RegOpenCurrentUser

RegOpenKeyExW

RegOpenUserClassesRoot

RegQueryInfoKeyW

RegQueryValueExW

RegSetValueExA

RegOpenKeyExA

RegQueryValueExA

RegDeleteKeyExW

RegEnumKeyExW

RegCreateKeyExA

RegSetValueExW

RegGetValueW

RegEnumValueW

RegCreateKeyExW

api-ms-win-core-synch-l1-2-0

SleepEx

InitializeCriticalSectionAndSpinCount

EnterCriticalSection

SetWaitableTimerEx

LeaveCriticalSection

Sleep

WaitForSingleObject

ReleaseSRWLockExclusive

InitializeSRWLock

CreateWaitableTimerExW

ResetEvent

CreateEventW

DeleteCriticalSection

OpenEventW

SetEvent

WaitForMultipleObjectsEx

CreateEventA

InitOnceExecuteOnce

ReleaseSRWLockShared

AcquireSRWLockShared

WaitForSingleObjectEx

AcquireSRWLockExclusive

OpenEventA

api-ms-win-core-handle-l1-1-0

CloseHandle

DuplicateHandle

rpcrt4

RpcServerUseProtseqEpW

RpcBindingVectorFree

NdrConvert2

RpcServerUseProtseqExW

RpcServerUseProtseqEpExW

RpcBindingFromStringBindingW

RpcServerUseProtseqW

RpcBindingCreateW

RpcBindingBind

SimpleTypeBufferSize

NdrMesTypeDecode2

NdrMesTypeAlignSize2

NdrMesTypeEncode2

RpcAsyncCompleteCall

NdrClientCall2

RpcErrorAddRecord

RpcMgmtSetComTimeout

RpcMgmtInqComTimeout

I_RpcServerSubscribeForDisconnectNotification

I_RpcServerGetAssociationID

I_RpcMgmtEnableDedicatedThreadPool

NdrCorrelationInitialize

NdrFullPointerXlatInit

SimpleTypeMemorySize

NdrFullPointerXlatFree

NdrClearOutParameters

I_RpcBCacheFree

NdrCorrelationFree

I_RpcExceptionFilter

NdrGetTypeFlags

MesEncodeFixedBufferHandleCreate

MesHandleFree

SimpleTypeAlignment

I_RpcBCacheAllocate

MesBufferHandleReset

MesDecodeBufferHandleCreate

I_RpcFixTransferSyntax

I_RpcSendReceive

RpcRaiseException

RpcErrorEndEnumeration

RpcErrorGetNextRecord

RpcErrorStartEnumeration

NdrClientInitializeNew

I_RpcReceive

I_RpcAsyncSetHandle

NdrServerInitialize

I_RpcGetBuffer

I_RpcAllocate

I_RpcFree

I_RpcGetBufferWithObject

UuidCreate

I_RpcRequestMutex

NdrStubCall2

I_RpcNegotiateTransferSyntax

I_RpcClearMutex

I_RpcMgmtQueryDedicatedThreadPool

RpcBindingFree

RpcBindingSetOption

NdrAsyncServerCall

NdrServerCall2

RpcBindingUnbind

RpcBindingCopy

NdrMesTypeDecode3

I_RpcSend

I_RpcAsyncAbortCall

RpcServerUnregisterIf

RpcServerRegisterIf3

RpcImpersonateClient2

RpcServerRegisterAuthInfoW

RpcCertGeneratePrincipalNameW

I_RpcOpenClientProcess

RpcBindingInqAuthClientW

NdrMesTypeEncode3

I_RpcSetDCOMAppId

I_RpcBindingInqCurrentModifiedId

RpcBindingInqObject

I_RpcBindingInqLocalClientPID

RpcBindingServerFromClient

RpcRevertToSelfEx

RpcImpersonateClient

RpcStringBindingParseW

RpcBindingToStringBindingW

I_RpcBindingInqTransportType

RpcServerInqCallAttributesW

I_RpcBindingSetPrivateOption

RpcBindingSetAuthInfoExW

RpcSmDestroyClientContext

NdrClientCall3

NdrStubCall3

RpcStringFreeW

RpcBindingInqAuthInfoExW

RpcCancelThreadEx

RpcMgmtSetCancelTimeout

NdrOleAllocate

NdrOleFree

NdrDllGetClassObject

RpcAsyncCancelCall

RpcServerInqBindings

RpcServerTestCancel

NdrGetUserMarshalInfo

I_RpcFreeBuffer

RpcAsyncInitializeHandle

RpcAsyncGetCallStatus

api-ms-win-core-sysinfo-l1-2-1

GetTickCount

GetSystemTimeAsFileTime

GetTickCount64

GetComputerNameExW

GetSystemInfo

GetSystemWindowsDirectoryW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

OutputDebugStringA

DebugBreak

IsDebuggerPresent

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork

SubmitThreadpoolWork

WaitForThreadpoolWorkCallbacks

CreateThreadpoolWork

CloseThreadpoolWait

CreateThreadpoolWait

SetThreadpoolWait

SetEventWhenCallbackReturns

WaitForThreadpoolWaitCallbacks

CloseThreadpoolTimer

CreateThreadpoolTimer

SetThreadpoolTimer

WaitForThreadpoolTimerCallbacks

api-ms-win-core-fibers-l1-1-1

FlsAlloc

FlsSetValue

FlsFree

IsThreadAFiber

api-ms-win-core-libraryloader-l1-2-0

FreeLibraryAndExitThread

GetModuleHandleA

LoadLibraryExW

GetModuleHandleW

LoadLibraryExA

GetProcAddress

LoadStringW

FreeLibrary

GetModuleFileNameA

GetModuleFileNameW

GetModuleHandleExW

api-ms-win-core-string-l1-1-0

GetStringTypeW

WideCharToMultiByte

CompareStringOrdinal

CompareStringW

MultiByteToWideChar

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

SearchPathW

FreeEnvironmentStringsW

GetEnvironmentStringsW

api-ms-win-security-base-l1-2-0

CreateWellKnownSid

AccessCheck

CheckTokenMembership

SetSecurityDescriptorDacl

AddAccessAllowedAce

InitializeSid

GetSidLengthRequired

GetAppContainerAce

InitializeAcl

InitializeSecurityDescriptor

ImpersonateLoggedOnUser

GetAce

MapGenericMask

GetSidSubAuthorityCount

GetKernelObjectSecurity

GetSidSubAuthority

DuplicateToken

GetSecurityDescriptorGroup

GetSecurityDescriptorOwner

GetSecurityDescriptorControl

MakeSelfRelativeSD

IsValidSecurityDescriptor

GetTokenInformation

RevertToSelf

ImpersonateAnonymousToken

AccessCheckByType

GetSecurityDescriptorDacl

GetLengthSid

IsValidSid

GetSecurityDescriptorLength

PrivilegeCheck

CopySid

EqualSid

api-ms-win-core-rtlsupport-l1-2-0

RtlCompareMemory

RtlCaptureStackBackTrace

RtlLookupFunctionEntry

RtlVirtualUnwind

RtlCaptureContext

api-ms-win-core-memory-l1-1-2

UnmapViewOfFile

CreateFileMappingW

OpenFileMappingW

VirtualProtect

VirtualAlloc

VirtualQuery

MapViewOfFile

api-ms-win-core-localization-l1-2-1

FormatMessageW

LCMapStringW

api-ms-win-core-file-l1-2-1

CreateFileW

api-ms-win-eventing-provider-l1-1-0

EventWrite

EventRegister

EventWriteEx

EventUnregister

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

QuirkIsEnabledForProcess

api-ms-win-core-util-l1-1-0

DecodePointer

EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-kernel32-legacy-l1-1-1

RaiseFailFastException

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

lstrcmpiA

lstrcmpiW

lstrlenA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalSize

LocalAlloc

GlobalFree

LocalFree

GlobalUnlock

GlobalReAlloc

GlobalAlloc

GlobalLock

api-ms-win-core-privateprofile-l1-1-1

GetProfileStringW

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx

FindActCtxSectionGuid

FindActCtxSectionStringW

ActivateActCtx

AddRefActCtx

DeactivateActCtx

GetCurrentActCtx

CreateActCtxW

api-ms-win-core-windowserrorreporting-l1-1-0

WerRegisterMemoryBlock

ntdll

RtlCopySid

NtQueryInformationToken

RtlLengthSid

NtQueryObject

LdrStandardizeSystemPath

RtlFreeSid

RtlDelete

RtlApplicationVerifierStop

RtlCheckForOrphanedCriticalSections

NtQueryInformationThread

RtlFreeHeap

RtlGetAppContainerNamedObjectPath

NtTerminateProcess

RtlReportException

RtlInitializeCriticalSectionAndSpinCount

NtQueryTimerResolution

RtlLoadString

RtlInitializeConditionVariable

ord1

EvtIntReportEventAndSourceAsync

RtlSplay

RtlDeleteNoSplay

RtlInitUnicodeString

NtOpenKey

RtlEqualUnicodeString

WinSqmSetDWORD

RtlInitializeCriticalSection

RtlImageNtHeader

RtlIsCriticalSectionLockedByThread

RtlDllShutdownInProgress

DbgPrint

EtwEventUnregister

RtlAllocateHeap

NtQueryValueKey

RtlQueryPackageIdentity

ZwQuerySecurityAttributesToken

RtlSidDominates

RtlGetAppContainerSidType

EtwGetTraceEnableLevel

EtwGetTraceEnableFlags

EtwRegisterTraceGuidsW

EtwUnregisterTraceGuids

EtwGetTraceLoggerHandle

NtQuerySystemInformation

RtlSleepConditionVariableCS

RtlDeleteCriticalSection

RtlWakeAllConditionVariable

NtQueryInformationProcess

NtApphelpCacheControl

RtlInitUnicodeStringEx

RtlValidRelativeSecurityDescriptor

NtClose

NtDuplicateObject

NtCreateKey

RtlRealPredecessor

EtwEventRegister

EtwTraceMessage

EtwEventWrite

RtlNtStatusToDosError

NtQueryKey

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead

InterlockedPopEntrySList

InterlockedPushEntrySList

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook

ResolveDelayLoadedAPI

Exports

CLSIDFromOle1Class

CLSIDFromProgID

CLSIDFromString

CleanupOleStateInAllTls

CleanupTlsOleState

ClearCleanupFlag

CoAddRefServerProcess

CoAllowUnmarshalerCLSID

CoCancelCall

CoCopyProxy

CoCreateErrorInfo

CoCreateFreeThreadedMarshaler

CoCreateGuid

CoCreateInstance

CoCreateInstanceEx

CoCreateInstanceFromApp

CoCreateObjectInContext

CoDeactivateObject

CoDecodeProxy

CoDecrementMTAUsage

CoDisableCallCancellation

CoDisconnectContext

CoDisconnectObject

CoEnableCallCancellation

CoFreeUnusedLibraries

CoFreeUnusedLibrariesEx

CoGetActivationState

CoGetApartmentID

CoGetApartmentType

CoGetCallContext

CoGetCallState

CoGetCallerTID

CoGetCancelObject

CoGetClassObject

CoGetClassVersion

CoGetContextToken

CoGetCurrentLogicalThreadId

CoGetCurrentProcess

CoGetDefaultContext

CoGetErrorInfo

CoGetInstanceFromFile

CoGetInstanceFromIStorage

CoGetInterfaceAndReleaseStream

CoGetMalloc

CoGetMarshalSizeMax

CoGetModuleType

CoGetObjectContext

CoGetPSClsid

CoGetProcessIdentifier

CoGetStandardMarshal

CoGetStdMarshalEx

CoGetSystemSecurityPermissions

CoGetTreatAsClass

CoImpersonateClient

CoIncrementMTAUsage

CoInitializeEx

CoInitializeSecurity

CoInitializeWOW

CoInvalidateRemoteMachineBindings

CoIsHandlerConnected

CoLockObjectExternal

CoMarshalHresult

CoMarshalInterThreadInterfaceInStream

CoMarshalInterface

CoPopServiceDomain

CoPushServiceDomain

CoQueryAuthenticationServices

CoQueryClientBlanket

CoQueryProxyBlanket

CoReactivateObject

CoRegisterActivationFilter

CoRegisterClassObject

CoRegisterInitializeSpy

CoRegisterMallocSpy

CoRegisterMessageFilter

CoRegisterPSClsid

CoRegisterSurrogate

CoRegisterSurrogateEx

CoReleaseMarshalData

CoReleaseServerProcess

CoResumeClassObjects

CoRetireServer

CoRevertToSelf

CoRevokeClassObject

CoRevokeInitializeSpy

CoRevokeMallocSpy

CoSetCancelObject

CoSetErrorInfo

CoSetProxyBlanket

CoSuspendClassObjects

CoSwitchCallContext

CoTaskMemAlloc

CoTaskMemFree

CoTaskMemRealloc

CoTestCancel

CoUninitialize

CoUnloadingWOW

CoUnmarshalHresult

CoUnmarshalInterface

CoVrfCheckThreadState

CoVrfGetThreadState

CoVrfReleaseThreadState

CoWaitForMultipleHandles

CoWaitForMultipleObjects

CreateErrorInfo

CreateStreamOnHGlobal

DcomChannelSetHResult

DllDebugObjectRPCHook

DllGetActivationFactory

DllGetClassObject

EnableHookObject

FreePropVariantArray

FreePropVariantArrayWorker

GetCatalogHelper

GetErrorInfo

GetFuncDescs

GetHGlobalFromStream

GetHookInterface

GetRestrictedErrorInfo

HSTRING_UserFree

HSTRING_UserFree64

HSTRING_UserMarshal

HSTRING_UserMarshal64

HSTRING_UserSize

HSTRING_UserSize64

HSTRING_UserUnmarshal

HSTRING_UserUnmarshal64

HkOleRegisterObject

IIDFromString

InternalAppInvokeExceptionFilter

InternalCCFreeUnused

InternalCCGetClassInformationForDde

InternalCCGetClassInformationFromKey

InternalCCSetDdeServerWindow

InternalCMLSendReceive

InternalCallAsProxyExceptionFilter

InternalCallFrameExceptionFilter

InternalCallerIsAppContainer

InternalCanMakeOutCall

InternalCoIsSurrogateProcess

InternalCoRegisterDisconnectCallback

InternalCoRegisterSurrogatedObject

InternalCoStdMarshalObject

InternalCoUnregisterDisconnectCallback

InternalCompleteObjRef

InternalCreateCAggId

InternalCreateIdentityHandler

InternalDoATClassCreate

InternalFillLocalOXIDInfo

InternalFreeObjRef

InternalGetWindowPropInterface

InternalIrotEnumRunning

InternalIrotEnumRunning2

InternalIrotGetObject

InternalIrotGetObject2

InternalIrotGetObject3

InternalIrotGetTimeOfLastChange

InternalIrotGetTimeOfLastChange2

InternalIrotIsRunning

InternalIrotIsRunning2

InternalIrotNoteChangeTime

InternalIrotRegister

InternalIrotRevoke

InternalIsApartmentInitialized

InternalIsProcessInitialized

InternalMarshalObjRef

InternalNotifyDDStartOrStop

InternalOleModalLoopBlockFn

InternalRegisterWindowPropInterface

InternalReleaseMarshalObjRef

InternalSTAInvoke

InternalServerExceptionFilter

InternalSetAptCallCtrlOnTlsIfRequired

InternalSetOleThunkWowPtr

InternalStubInvoke

InternalTlsAllocData

InternalUnmarshalObjRef

IsErrorPropagationEnabled

NdrExtStubInitialize

NdrOleDllGetClassObject

NdrOleInitializeExtension

NdrProxyForwardingFunction10

NdrProxyForwardingFunction11

NdrProxyForwardingFunction12

NdrProxyForwardingFunction13

NdrProxyForwardingFunction14

NdrProxyForwardingFunction15

NdrProxyForwardingFunction16

NdrProxyForwardingFunction17

NdrProxyForwardingFunction18

NdrProxyForwardingFunction19

NdrProxyForwardingFunction20

NdrProxyForwardingFunction21

NdrProxyForwardingFunction22

NdrProxyForwardingFunction23

NdrProxyForwardingFunction24

NdrProxyForwardingFunction25

NdrProxyForwardingFunction26

NdrProxyForwardingFunction27

NdrProxyForwardingFunction28

NdrProxyForwardingFunction29

NdrProxyForwardingFunction3

NdrProxyForwardingFunction30

NdrProxyForwardingFunction31

NdrProxyForwardingFunction32

NdrProxyForwardingFunction4

NdrProxyForwardingFunction5

NdrProxyForwardingFunction6

NdrProxyForwardingFunction7

NdrProxyForwardingFunction8

NdrProxyForwardingFunction9

NdrpFindInterface

ObjectStublessClient10

ObjectStublessClient11

ObjectStublessClient12

ObjectStublessClient13

ObjectStublessClient14

ObjectStublessClient15

ObjectStublessClient16

ObjectStublessClient17

ObjectStublessClient18

ObjectStublessClient19

ObjectStublessClient20

ObjectStublessClient21

ObjectStublessClient22

ObjectStublessClient23

ObjectStublessClient24

ObjectStublessClient25

ObjectStublessClient26

ObjectStublessClient27

ObjectStublessClient28

ObjectStublessClient29

ObjectStublessClient3

ObjectStublessClient30

ObjectStublessClient31

ObjectStublessClient32

ObjectStublessClient4

ObjectStublessClient5

ObjectStublessClient6

ObjectStublessClient7

ObjectStublessClient8

ObjectStublessClient9

ProgIDFromCLSID

PropVariantClear

PropVariantCopy

ReleaseFuncDescs

RoActivateInstance

RoCaptureErrorContext

RoClearError

RoFailFastWithErrorContext

RoFailFastWithErrorContextInternal

RoFailFastWithErrorContextInternal2

RoFreeParameterizedTypeExtra

RoGetActivatableClassRegistration

RoGetActivationFactory

RoGetAgileReference

RoGetApartmentIdentifier

RoGetErrorReportingFlags

RoGetMatchingRestrictedErrorInfo

RoGetParameterizedTypeInstanceIID

RoGetServerActivatableClasses

RoInitialize

RoInspectCapturedStackBackTrace

RoInspectThreadErrorInfo

RoOriginateError

RoOriginateErrorW

RoOriginateLanguageException

RoParameterizedTypeExtraGetTypeSignature

RoRegisterActivationFactories

RoRegisterForApartmentShutdown

RoReportCapabilityCheckFailure

RoReportFailedDelegate

RoReportUnhandledError

RoResolveRestrictedErrorInfoReference

RoRevokeActivationFactories

RoSetErrorReportingFlags

RoTransformError

RoTransformErrorW

RoUninitialize

RoUnregisterForApartmentShutdown

SetCleanupFlag

SetErrorInfo

SetRestrictedErrorInfo

StringFromCLSID

StringFromGUID2

StringFromIID

UpdateDCOMSettings

UpdateProcessTracing

WdtpInterfacePointer_UserMarshal

WdtpInterfacePointer_UserMarshal64

WdtpInterfacePointer_UserSize

WdtpInterfacePointer_UserSize64

WdtpInterfacePointer_UserUnmarshal

WdtpInterfacePointer_UserUnmarshal64

WindowsCompareStringOrdinal

WindowsConcatString

WindowsCreateString

WindowsCreateStringReference

WindowsDeleteString

WindowsDeleteStringBuffer

WindowsDuplicateString

WindowsGetStringLen

WindowsGetStringRawBuffer

WindowsInspectString

WindowsIsStringEmpty

WindowsPreallocateStringBuffer

WindowsPromoteStringBuffer

WindowsReplaceString

WindowsStringHasEmbeddedNull

WindowsSubstring

WindowsSubstringWithSpecifiedLength

WindowsTrimStringEnd

WindowsTrimStringStart

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.orpc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.ndr64
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.idata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Data/freebl3.dll

.dll windows x64

8a564fee0e9aa5547525f921a1b23c12

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

nss3

NSS_SecureMemcmp

NSS_SecureMemcmpZero

PORT_Alloc_Util

PORT_ArenaAlloc_Util

PORT_ArenaZAlloc_Util

PORT_FreeArena_Util

PORT_Free_Util

PORT_GetError_Util

PORT_NewArena_Util

PORT_SetError_Util

PORT_ZAllocAlignedOffset_Util

PORT_ZAlloc_Util

PORT_ZFree_Util

PR_CallOnce

PR_DestroyCondVar

PR_DestroyLock

PR_GetEnvSecure

PR_Lock

PR_NewCondVar

PR_NewLock

PR_NotifyAllCondVar

PR_NotifyCondVar

PR_Unlock

PR_WaitCondVar

SECITEM_AllocItem_Util

SECITEM_CompareItem_Util

SECITEM_CopyItem_Util

SECITEM_FreeItem_Util

SECITEM_ZfreeItem_Util

SECOID_FindOIDTag_Util

advapi32

CryptAcquireContextA

CryptGenRandom

CryptReleaseContext

SystemFunction036

api-ms-win-crt-heap-l1-1-0

_set_new_mode

calloc

free

malloc

api-ms-win-crt-private-l1-1-0

memcmp

memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argc

__p___argv

__p___wargv

_configure_narrow_argv

_configure_wide_argv

_crt_at_quick_exit

_crt_atexit

_execute_onexit_table

_exit

_initialize_narrow_environment

_initialize_onexit_table

_initialize_wide_environment

_initterm

_register_onexit_function

abort

api-ms-win-crt-string-l1-1-0

_strdup

islower

isupper

memset

strlen

strncmp

tolower

toupper

api-ms-win-crt-time-l1-1-0

__daylight

__timezone

__tzname

_time64

_tzset

api-ms-win-crt-utility-l1-1-0

rand

kernel32

DeleteCriticalSection

EnterCriticalSection

GetComputerNameA

GetCurrentProcess

GetCurrentProcessId

GetCurrentThreadId

GetDiskFreeSpaceA

GetLastError

GetLogicalDrives

GetTickCount

GetVolumeInformationA

GlobalMemoryStatus

InitializeCriticalSection

LeaveCriticalSection

QueryPerformanceCounter

Sleep

TlsGetValue

VirtualProtect

VirtualQuery

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

__stdio_common_vfprintf

__stdio_common_vfwprintf

_close

_open

_write

fwrite

api-ms-win-crt-environment-l1-1-0

__p__environ

__p__wenviron

Exports

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Instaler.exe

.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_NO_SEH

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

libssl-1_1-x64.dll

.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

msvcr100.dll

.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_EXECUTE

data
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

text Size: 2KB - Virtual size: 2KB

rdata Size: 524B - Virtual size: 523B

data Size: 82B - Virtual size: 125B

pdata Size: 100B - Virtual size: 98B

CONST Size: 2B - Virtual size:

ext Size: 52B - Virtual size: 50B

ata Size: 130B - Virtual size: 129B

rsrc Size: 4B - Virtual size: 3B

reloc Size: 22B - Virtual size: 20B

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 3.1MB - Virtual size: 3.1MB

.data Size: 354KB - Virtual size: 527KB

.pdata Size: 244KB - Virtual size: 243KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 42KB - Virtual size: 41KB

cf49de37d6832a2e30a495cfe792c5d3

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

35:71:3a:ed:36:6c:0f:91:c7:97:71:46:7d:89:eb:e2:d5:18:ad:17:62:cf:4f:58:50:46:12:28:d5:7c:7a:8dSigner

Signature Validations

Verification

23/09/2022, 10:46 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

kernelbase

sechost

api-ms-win-service-core-l1-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-private-l1-1-1

api-ms-win-service-winsvc-l1-2-0

api-ms-win-core-namedpipe-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-security-base-l1-2-0

api-ms-win-security-base-private-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

kernel32

rpcrt4

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-audit-l1-1-1

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 595KB - Virtual size: 594KB

.data Size: 14KB - Virtual size: 16KB

.pdata Size: 24KB - Virtual size: 24KB

.idata Size: 24KB - Virtual size: 24KB

.didat Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

ba8646d28f2e7b54e7bcd331d13af3a6

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

text
Size: 2KB - Virtual size: 2KB

rdata
Size: 524B - Virtual size: 523B

data
Size: 82B - Virtual size: 125B

pdata
Size: 100B - Virtual size: 98B

CONST
Size: 2B - Virtual size:

ext
Size: 52B - Virtual size: 50B

ata
Size: 130B - Virtual size: 129B

rsrc
Size: 4B - Virtual size: 3B

reloc
Size: 22B - Virtual size: 20B

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 3.1MB - Virtual size: 3.1MB

.data
Size: 354KB - Virtual size: 527KB

.pdata
Size: 244KB - Virtual size: 243KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 42KB - Virtual size: 41KB

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

35:71:3a:ed:36:6c:0f:91:c7:97:71:46:7d:89:eb:e2:d5:18:ad:17:62:cf:4f:58:50:46:12:28:d5:7c:7a:8d
Signer

23/09/2022, 10:46
Valid: false

.text
Size: 595KB - Virtual size: 594KB

.data
Size: 14KB - Virtual size: 16KB

.pdata
Size: 24KB - Virtual size: 24KB

.idata
Size: 24KB - Virtual size: 24KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

cd:be:61:d4:d7:63:11:87:41:1e:bf:d0:47:06:95:70:ef:6d:eb:bc:4b:2d:a2:15:07:f3:9b:84:ab:5c:67:3c
Signer

23/09/2022, 10:46
Valid: false

.text
Size: 1.7MB - Virtual size: 1.7MB

.orpc
Size: 88KB - Virtual size: 87KB

.ndr64
Size: 9KB - Virtual size: 9KB

.data
Size: 26KB - Virtual size: 27KB

.pdata
Size: 158KB - Virtual size: 158KB

.idata
Size: 17KB - Virtual size: 17KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 64KB - Virtual size: 64KB

.reloc
Size: 35KB - Virtual size: 34KB