Static task
static1
Behavioral task
behavioral1
Sample
Narrator.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
Narrator.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
Narrator.exe.zip
-
Size
194KB
-
MD5
95121ef4bdd613e59d784b723ad88bf5
-
SHA1
7cd7c6d545bb8050f05f5f85baedb291a5a3fb5a
-
SHA256
29e8fa89d0084454d459a110e2596846d7155a48fee810ae227eaa52b6ecf0c6
-
SHA512
c59ef1d09800cb7158417d55593011fe9ebfadd898f5ca2144a1142ce935e3763d41082da0cd32fb79e92d62fa7f51f2f4305f42e087d753a4e58619d5e41a0e
-
SSDEEP
3072:PaIOB34xruLJZsrFGc03jKaBvKMuOb65w5u1B4fxOn6umw40PhJGXZXdw8:PaIOZ4otZs+3sMrb65iu1BexO6BZXC8
Malware Config
Signatures
Files
-
Narrator.exe.zip.zip
Password: dangerous
-
Narrator.exe.exe windows x64
Password: dangerous
05d5dc789c9856f2ce223c1e1fb2bbdc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
EventUnregister
EventRegister
EventSetInformation
RegCloseKey
RegCreateKeyExW
RegSetValueExW
EventWrite
RegOpenKeyExW
OpenProcessToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegQueryValueExW
RegGetValueW
kernel32
VirtualProtect
GetSystemInfo
InitOnceExecuteOnce
MulDiv
GetModuleFileNameA
QueryPerformanceCounter
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FindResourceExW
LoadResource
LockResource
SizeofResource
OpenProcess
RegisterApplicationRestart
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
CreateThreadpoolTimer
SetThreadpoolTimer
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSection
RaiseException
DeleteCriticalSection
LoadLibraryExW
OpenMutexW
ActivateActCtx
CreateActCtxW
GetModuleFileNameW
GetCurrentActCtx
ReleaseActCtx
DeactivateActCtx
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
GetProcAddress
HeapAlloc
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
OutputDebugStringW
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
VirtualQuery
gdi32
CreateRectRgn
FillRgn
SelectObject
CreateSolidBrush
GetObjectW
CreateFontIndirectW
ExcludeClipRect
SetBkMode
GetDeviceCaps
GdiAlphaBlend
CreateDIBSection
GetCurrentObject
CreateFontW
DeleteDC
StretchBlt
SetStretchBltMode
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
ExtTextOutW
GetTextExtentPoint32W
SetTextColor
SetBkColor
DeleteObject
user32
SetMenuItemInfoW
SetMenuInfo
SetPropW
GetMenuInfo
WindowFromPoint
FindWindowW
DrawTextW
DrawIconEx
GetForegroundWindow
UnhookWinEvent
FindWindowExW
IsWindow
PostMessageW
InitializeTouchInjection
RegisterPointerDeviceNotifications
SetWinEventHook
MonitorFromWindow
BeginPaint
GetCurrentInputMessageSource
GetWindowRgn
EndPaint
GetPropW
SetDesktopColorTransform
SendNotifyMessageW
GetShellWindow
GetKeyState
AdjustWindowRectExForDpi
PostThreadMessageW
SendMessageTimeoutW
ReleaseDC
GetDC
GetComboBoxInfo
EnableWindow
CallWindowProcW
GetAncestor
GetGUIThreadInfo
GetWindowTextW
EqualRect
IntersectRect
SetMessageExtraInfo
SetTimer
KillTimer
DestroyMenu
TrackPopupMenuEx
GetDpiForWindow
GetSystemMetricsForDpi
GetSubMenu
LoadMenuW
RegisterWindowMessageW
SetWindowTextW
SendDlgItemMessageW
GetDlgCtrlID
GetFocus
EndDialog
GetDlgItem
DefWindowProcW
CreateWindowExW
RegisterClassExW
DialogBoxParamW
GetWindowThreadProcessId
CopyRect
GetMonitorInfoW
MonitorFromPoint
GetKeyboardLayout
SetWindowLongPtrW
SetDlgItemTextW
GetWindowLongPtrW
MessageBoxW
SetFocus
ShowWindow
CreateDialogParamW
LoadStringW
SetWindowLongW
GetWindowLongW
LoadIconW
GetUserObjectInformationW
GetThreadDesktop
RemovePropW
GetMessageExtraInfo
GetMenuItemInfoW
GetDpiForSystem
GetWindowDpiAwarenessContext
AreDpiAwarenessContextsEqual
UnregisterClassA
IsWindowVisible
GetParent
InflateRect
DrawTextExW
GetSystemMetrics
GetDCEx
CloseClipboard
OpenClipboard
SetClipboardData
DestroyWindow
SendInput
RegisterHotKey
MsgWaitForMultipleObjects
GetMessageW
PostQuitMessage
TranslateMessage
DispatchMessageW
UnregisterHotKey
SetForegroundWindow
BlockInput
GetAsyncKeyState
MapVirtualKeyExW
LoadImageW
SendMessageW
SystemParametersInfoW
GetWindowRect
SetWindowPos
GetClassNameW
msvcp_win
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_id
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_unlock
api-ms-win-crt-runtime-l1-1-0
_initterm
_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_errno
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcslwr_s
_o__wtoi
_o_exit
_o_free
_o_iswprint
_o_iswspace
_o_malloc
_o_memcpy_s
_o_terminate
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcstok_s
__CxxFrameHandler3
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_wide_winmain_command_line
_o__get_errno
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o__beginthreadex
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
__C_specific_handler
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
_o__ltow_s
_o__itow_s
wcsrchr
wcsstr
wcschr
memmove
api-ms-win-crt-string-l1-1-0
wcscspn
memmove_s
wcsspn
wcsncmp
memset
wcscmp
uiautomationcore
UiaRaiseNotificationEvent
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlPublishWnfStateData
RtlSubscribeWnfStateChangeNotification
WinSqmIsOptedIn
WinSqmAddToStream
RtlCaptureContext
NtQueryWnfStateData
oleacc
AccNotifyTouchInteraction
AccSetRunningUtilityState
oleaut32
VarBstrCat
SysStringByteLen
VariantClear
VariantInit
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
SysAllocStringByteLen
shlwapi
PathRemoveFileSpecW
ord199
ord219
ord12
PathFileExistsW
shell32
ShellExecuteW
Shell_NotifyIconW
SHGetStockIconInfo
dui70
InitProcessPriv
InitThread
UnInitThread
UnInitProcessPriv
StartMessagePump
??1NativeHWNDHost@DirectUI@@UEAA@XZ
??0NativeHWNDHost@DirectUI@@QEAA@XZ
?CreateHostWindow@NativeHWNDHost@DirectUI@@UEAAPEAUHWND__@@KPEBG0KHHHHPEAU3@PEAUHMENU__@@PEAUHINSTANCE__@@PEAX@Z
?Release@Value@DirectUI@@QEAAXXZ
?EndDefer@Element@DirectUI@@QEAAXK@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
StrToID
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@I@Z
?SetSelection@Combobox@DirectUI@@QEAAJH@Z
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
?SyncDestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
??0HWNDElement@DirectUI@@QEAA@XZ
??1HWNDElement@DirectUI@@UEAA@XZ
??1DUIFactory@DirectUI@@QEAA@XZ
?Register@HWNDElement@DirectUI@@SAJXZ
?Initialize@HWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z
?DoubleBuffered@Element@DirectUI@@QEAAX_N@Z
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?Destroy@Layout@DirectUI@@QEAAXXZ
?LoadFromResource@DUIFactory@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG1PEAVElement@2@PEAKPEAPEAV42@1@Z
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
?OnEvent@HWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z
?DestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@HWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z
?OnInput@HWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnDestroy@HWNDElement@DirectUI@@UEAAXXZ
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?UpdateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z
?RemoveTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?GetClassInfoW@HWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?WndProc@NativeHWNDHost@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z
StopMessagePump
??0Combobox@DirectUI@@QEAA@XZ
??1Combobox@DirectUI@@UEAA@XZ
?GetContentSize@Combobox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?OnHosted@Combobox@DirectUI@@UEAAXPEAVElement@2@@Z
?OnAdjustWindowSize@Combobox@DirectUI@@UEAAHHHI@Z
?CreateHWND@Combobox@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z
?GetClassInfoPtr@Combobox@DirectUI@@SAPEAUIClassInfo@2@XZ
?Initialize@Combobox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
?Register@Combobox@DirectUI@@SAJXZ
?SyncRect@HWNDHost@DirectUI@@IEAAXI_N@Z
?OnPropertyChanged@HWNDHost@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z
?EnabledProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?OnNotify@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?SelectionProp@Combobox@DirectUI@@SAPEBUPropertyInfo@2@XZ
?OnInput@Combobox@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@_N@Z
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@@Z
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?MessageCallback@Edit@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ
?GetContentSize@Edit@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
?OnInput@Edit@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnPropertyChanged@Edit@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetContentStringAsDisplayed@Edit@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?IsContentProtected@Edit@DirectUI@@UEAA_NXZ
?GetClassInfoPtr@Edit@DirectUI@@SAPEAUIClassInfo@2@XZ
?Initialize@Edit@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
?Register@Edit@DirectUI@@SAJXZ
?OnNotify@Edit@DirectUI@@UEAA_NI_K_JPEA_J@Z
??1Edit@DirectUI@@UEAA@XZ
??0Edit@DirectUI@@QEAA@XZ
??1AutoLock@DirectUI@@QEAA@XZ
??0ElementProvider@DirectUI@@QEAA@XZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?AdviseEventRemoved@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z
?AdviseEventAdded@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z
?get_FragmentRoot@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z
?SetFocus@ElementProvider@DirectUI@@UEAAJXZ
?GetEmbeddedFragmentRoots@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z
?get_BoundingRectangle@ElementProvider@DirectUI@@UEAAJPEAUUiaRect@@@Z
?GetRuntimeId@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z
?Navigate@ElementProvider@DirectUI@@UEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z
?ShowContextMenu@ElementProvider@DirectUI@@UEAAJXZ
?get_HostRawElementProvider@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z
?GetPropertyValue@ElementProvider@DirectUI@@UEAAJHPEAUtagVARIANT@@@Z
?get_ProviderOptions@ElementProvider@DirectUI@@UEAAJPEAW4ProviderOptions@@@Z
?QueryInterface@ElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?TossElement@ElementProvider@DirectUI@@UEAAXXZ
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@Element@DirectUI@@UEAAXXZ
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
??1ClassInfoBase@DirectUI@@UEAA@XZ
??0ClassInfoBase@DirectUI@@QEAA@XZ
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?CreatePatternProvider@Schema@DirectUI@@SAJW4Pattern@12@PEAVElementProvider@2@PEAPEAUIUnknown@@@Z
?IsPatternSupported@ElementProxy@DirectUI@@IEAAJW4Pattern@Schema@2@PEA_N@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
??1CritSecLock@DirectUI@@QEAA@XZ
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
?Register@Element@DirectUI@@SAJXZ
?AddRef@RefcountBase@DirectUI@@QEAAJXZ
?Release@RefcountBase@DirectUI@@QEAAJXZ
?AddRef@ElementProvider@DirectUI@@UEAAKXZ
?TossPatternProvider@ElementProvider@DirectUI@@QEAAXW4Pattern@Schema@2@@Z
?DoInvokeArgs@ElementProvider@DirectUI@@QEAAJHP6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z
?GetElement@ElementProvider@DirectUI@@UEAAPEDVElement@2@XZ
?Release@ElementProvider@DirectUI@@UEAAKXZ
?Init@ElementProvider@DirectUI@@MEAAJPEAVElement@2@PEAVInvokeHelper@2@@Z
?DoInvoke@ElementProvider@DirectUI@@IEAAJHZZ
?PatternFromPatternId@Schema@DirectUI@@SA?AW4Pattern@12@H@Z
?Init@ElementProxy@DirectUI@@MEAAXPEAVElement@2@@Z
?DoMethod@ElementProxy@DirectUI@@UEAAJHPEAD@Z
?GetProperty@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@H@Z
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?SetAbsorbsShortcut@Element@DirectUI@@QEAAJ_N@Z
?SetActive@Element@DirectUI@@QEAAJH@Z
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z
??1Element@DirectUI@@UEAA@XZ
??0Element@DirectUI@@QEAA@XZ
?SelectionItemPattern@Schema@DirectUI@@2HA
?InvokePattern@Schema@DirectUI@@2HA
??1ElementProvider@DirectUI@@UEAA@XZ
??1RefcountBase@DirectUI@@UEAA@XZ
??0RefcountBase@DirectUI@@QEAA@XZ
?Create@NativeHWNDHost@DirectUI@@SAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@IPEAPEAV12@@Z
?DestroyMsg@NativeHWNDHost@DirectUI@@SAIXZ
?GetInvokeHelper@InvokeManager@DirectUI@@SAJPEAPEAVInvokeHelper@2@@Z
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?SetContentAlign@Element@DirectUI@@QEAAJH@Z
?SetClass@Element@DirectUI@@QEAAJPEBG@Z
?Create@Element@DirectUI@@SAJIPEAV12@PEAKPEAPEAV12@@Z
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z
?SetID@Element@DirectUI@@QEAAJPEBG@Z
?CreateInt@Value@DirectUI@@SAPEAV12@HW4DynamicScaleValue@@@Z
?LayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?DestroyAll@Element@DirectUI@@QEAAJ_N@Z
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?GetClass@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?SetAccItemStatus@Element@DirectUI@@QEAAJPEBG@Z
?Create@TableLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?GetSelection@Combobox@DirectUI@@QEAAHXZ
?Click@Button@DirectUI@@SA?AVUID@@XZ
?SelectionChange@Combobox@DirectUI@@SA?AVUID@@XZ
?GetKeyFocusedElement@HWNDElement@DirectUI@@SAPEAVElement@2@XZ
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?_OnUIStateChanged@HWNDElement@DirectUI@@MEAAXGG@Z
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z
?WndProc@HWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z
?IsMSAAEnabled@HWNDElement@DirectUI@@UEAA_NXZ
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?DefaultAction@Element@DirectUI@@UEAAJXZ
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoWaitForMultipleHandles
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoGetMalloc
CoTaskMemRealloc
api-ms-win-core-heap-l1-1-0
HeapDestroy
HeapSize
HeapReAlloc
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
MultiByteToWideChar
CompareStringW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
ProcessIdToSessionId
SetThreadPriority
GetProcessId
GetStartupInfoW
CreateProcessW
UpdateProcThreadAttribute
TerminateProcess
GetCurrentProcess
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
CreateThread
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
FlushInstructionCache
api-ms-win-core-synch-l1-1-0
CreateEventExW
InitializeCriticalSectionAndSpinCount
ResetEvent
CreateEventW
SetEvent
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InterlockedPopEntrySList
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegEnumKeyExW
RegDeleteTreeW
RegNotifyChangeKeyValue
RegLoadMUIStringW
api-ms-win-core-job-l2-1-0
OpenJobObjectW
api-ms-win-core-job-l1-1-0
IsProcessInJob
sspicli
GetUserNameExW
api-ms-win-oobe-notification-l1-1-0
OOBEComplete
api-ms-win-core-registry-l2-1-0
RegQueryValueW
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-eventing-classicprovider-l1-1-0
TraceMessage
api-ms-win-shcore-scaling-l1-1-2
GetDpiForShellUIComponent
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
Sleep
InitOnceComplete
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-file-l1-1-0
GetFileAttributesW
DeleteFileW
api-ms-win-core-psapi-l1-1-0
K32EnumProcesses
K32EnumProcessModules
K32GetModuleBaseNameW
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExA
FreeLibrary
api-ms-win-shcore-scaling-l1-1-1
GetDpiForMonitor
ord244
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
GetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsPromoteStringBuffer
WindowsDeleteStringBuffer
WindowsPreallocateStringBuffer
WindowsCreateString
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-crt-math-l1-1-0
floorf
Sections
.text Size: 260KB - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ