??0CCdgExchg@@QEAA@AEBV0@@Z
??0CDynamicDll@@QEAA@AEBV0@@Z
??4CCdgExchg@@QEAAAEAV0@AEBV0@@Z
??4CDynamicDll@@QEAAAEAV0@AEBV0@@Z
??_7CCdgExchg@@6B@
??_7CDynamicDll@@6B@
Static task
static1
Behavioral task
behavioral1
Sample
cdgregedit.exe
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
cdgregedit.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
4174380762_27D0D996EFCA1ECEB4213CC7D574ABFC_1673143404.zip
-
Size
4.7MB
-
MD5
9190ce747fb0a219d25f7f5475e9e305
-
SHA1
652ad6332c77eeacc1d74839e37af2f5d225b5d3
-
SHA256
693ac379e2bdbca79c510678a164254d7ea3112f1006cb7aadd6bb9f3dcb70c3
-
SHA512
acda1497860e837085e356829eac9e4202b8fdcf1b61afe7d85d15d8bc8fea4894638ac29f5977570ac8a344d8a4743d3c4b1e9e25d700bf55f9f23273052bda
-
SSDEEP
98304:fQERfv0P5MzQBMR2r0cnVZcLABrTGkZuxaI00BEndlu4Se4Abtrv5hfLX6vH6tdI:fQuIBduLAVGkZ2ab0Bmrc4Rv5xLX6fa6
Score
N/A
Malware Config
Signatures
Files
-
4174380762_27D0D996EFCA1ECEB4213CC7D574ABFC_1673143404.zip.zip
-
cdgregedit.exe.exe windows x64
3be59438241c25420fa0c884d7c4c207
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wininet
FtpRenameFileW
FtpCreateDirectoryW
FtpRemoveDirectoryW
FtpSetCurrentDirectoryW
FtpGetCurrentDirectoryW
FtpPutFileW
FtpGetFileW
InternetErrorDlg
InternetFindNextFileW
FtpDeleteFileW
InternetGetLastResponseInfoW
InternetSetStatusCallbackW
InternetSetFilePointer
GopherGetAttributeW
InternetQueryDataAvailable
FtpCommandW
GopherCreateLocatorW
FtpFindFirstFileW
GopherOpenFileW
InternetOpenUrlW
InternetConnectW
InternetGetCookieW
InternetSetCookieW
InternetSetOptionExW
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
GopherFindFirstFileW
InternetCloseHandle
InternetReadFile
HttpSendRequestExW
InternetWriteFile
HttpEndRequestW
HttpOpenRequestW
HttpAddRequestHeadersW
InternetSetOptionW
HttpSendRequestW
HttpQueryInfoW
InternetOpenW
FtpOpenFileW
ws2_32
getnameinfo
WSCDeinstallProvider
WSCInstallProvider
WSCWriteProviderOrder
WSCEnumProtocols
ntohl
select
listen
accept
getaddrinfo
freeaddrinfo
getpeername
getsockopt
bind
ntohs
getsockname
setsockopt
WSAIoctl
recv
WSASetLastError
__WSAFDIsSet
recvfrom
WSAGetLastError
sendto
ioctlsocket
socket
htons
connect
closesocket
shutdown
send
inet_addr
WSAStartup
gethostname
gethostbyname
inet_ntoa
WSACleanup
htonl
shlwapi
UrlUnescapeW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathRemoveExtensionW
PathFindExtensionW
PathRemoveFileSpecW
StrRetToStrW
PathMatchSpecW
SHDeleteKeyW
SHGetValueW
SHSetValueW
PathIsNetworkPathW
StrStrIW
PathFileExistsW
PathIsDirectoryEmptyW
PathIsDirectoryW
version
GetFileVersionInfoW
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoSizeW
VerQueryValueW
iphlpapi
GetRTTAndHopCount
GetAdaptersInfo
GetTcpTable
dbghelp
MiniDumpWriteDump
setupapi
SetupDiGetDeviceInterfaceDetailA
CM_Get_DevNode_Status
SetupDiChangeState
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInstanceIdW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
SetupDiGetClassImageIndex
SetupDiSetClassInstallParamsW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiGetClassImageList
SetupDiGetDeviceInstallParamsW
wtsapi32
WTSQueryUserToken
dynamicdll64
?SetContentSafe@CCdgExchg@@QEAAXU_SHARE_CONTENTSECURITY@@@Z
?SetPrintPolicy@CCdgExchg@@QEAAXAEAU_PRINT_EXCHG_INFO@@@Z
?SetSignatureExe@CCdgExchg@@QEAAXPEAD@Z
?SignatureAddHookID@CCdgExchg@@QEAAXK@Z
?SignatureAddFakeID@CCdgExchg@@QEAAXK@Z
?GetContentSafe@CCdgExchg@@QEAAXAEAU_SHARE_CONTENTSECURITY@@H@Z
?GetInfo_doc@CCdgExchg@@QEAAHKH@Z
?GetPrintPolicy@CCdgExchg@@QEAAXAEAU_PRINT_EXCHG_INFO@@@Z
?GetCount@CCdgExchg@@QEAAHH@Z
?SetMultiMainKey@CCdgExchg@@QEAAXPEAD@Z
?GetDRMAll@CCdgExchg@@QEAAHPEAK@Z
?GetSmartDRMAll@CCdgExchg@@QEAAHPEAK@Z
?GetCDGKey@CCdgExchg@@QEAAXPEAD@Z
?SetTerminalInfo@CCdgExchg@@QEAAXUCLIENTTERMINAL@@@Z
?SetOrganiseName@CCdgExchg@@QEAAXPEBD@Z
?SetUserEmployeeId@CCdgExchg@@QEAAXPEBD@Z
?SetUserOperate@CCdgExchg@@QEAAXUUserOperate@@@Z
?SetConnectSer@CCdgExchg@@QEAAXH@Z
?SetPolicy@CCdgExchg@@QEAAXPEAU_Encrypt_Policy@@H@Z
?GetOrganiseName@CCdgExchg@@QEAAXPEAD@Z
?SetLogRecordType@CCdgExchg@@QEAAXULogRecordType@@@Z
?SetDyKey@CCdgExchg@@QEAAXPEAD@Z
?GetSignatureExe@CCdgExchg@@QEAAHPEAD@Z
?GetMultiKeyListInfo@CCdgExchg@@QEAAHPEAU_MultiKey_Policy@@@Z
?SetDefaultUserNameAndPsw@CCdgExchg@@QEAAXPEBD00@Z
?SetMainWndEx@CCdgExchg@@QEAAXPEAUHWND__@@@Z
SetMainWnd
?GetUserOperate@CCdgExchg@@QEAAXAEAUUserOperate@@@Z
?SetprotectScreen@CCdgExchg@@QEAAXPEAD@Z
?GetPolicy@CCdgExchg@@QEAAHPEAU_Encrypt_Policy@@@Z
?GetDyCount@CCdgExchg@@QEAAHXZ
?GetDyAll@CCdgExchg@@QEAAHPEAK@Z
?GetAllInfo@CCdgExchg@@QEAAHPEAU_SMART_EXCHG_INFO@@H@Z
??1CDynamicDll@@UEAA@XZ
?GetprotectScreen@CCdgExchg@@QEAAXPEAD@Z
?GetCount@CCdgExchg@@QEAAHXZ
?GetAllInfo@CCdgExchg@@QEAAHPEAU_CDG_EXCHG_INFO@@@Z
?SethookWhietList@CCdgExchg@@QEAAXPEAD@Z
?DeleteInfo@CCdgExchg@@QEAAHK@Z
?GetDefaultUserNameAndPsw@CCdgExchg@@QEAAXPEAD00@Z
??0CCdgExchg@@QEAA@XZ
?GetDyKey@CCdgExchg@@QEAAXPEAD@Z
??1CCdgExchg@@UEAA@XZ
?SetCDGKey@CCdgExchg@@QEAAXPEAD@Z
?DelDy@CCdgExchg@@QEAAHK@Z
?SetCdgOutDyKey@CCdgExchg@@QEAAXPEAD@Z
?DeleteInfo@CCdgExchg@@QEAAHKH@Z
??0CDynamicDll@@QEAA@XZ
?SetMultiKeyListInfo@CCdgExchg@@QEAAXPEAU_MultiKey_Policy@@H@Z
?StopHook@CDynamicDll@@QEAAHXZ
?GetMultiMainKey@CCdgExchg@@QEAAHPEAD@Z
xmppcontroldll64
StartXmpp
IsXmppConnected
StopXmpp
kernel32
GlobalReAlloc
GlobalHandle
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
GetStartupInfoW
RtlLookupFunctionEntry
RtlUnwindEx
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
RaiseException
RtlPcToFileHeader
ExitThread
HeapReAlloc
VirtualProtect
VirtualAlloc
VirtualQuery
PeekNamedPipe
GetFileAttributesA
SetStdHandle
HeapQueryInformation
HeapSize
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
TlsAlloc
QueryPerformanceCounter
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
GetDateFormatA
GetTimeFormatA
GetTimeZoneInformation
FatalAppExitA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
LCMapStringA
GetConsoleCP
GetConsoleMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetDriveTypeA
GetFullPathNameA
SetEnvironmentVariableA
GetFileAttributesExW
GetAtomNameW
GlobalFlags
GlobalGetAtomNameW
SuspendThread
ReleaseSemaphore
CreateSemaphoreW
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
TlsGetValue
GetFileTime
HeapDestroy
CompareStringA
SetFileAttributesA
ConvertThreadToFiber
GetShortPathNameW
GetFullPathNameW
SetEndOfFile
UnlockFile
LockFile
GetThreadLocale
GetStringTypeExW
GlobalSize
FileTimeToLocalFileTime
GetModuleHandleA
CompareStringW
LoadLibraryA
GetVersionExA
CreateDirectoryA
GetWindowsDirectoryA
GetEnvironmentVariableA
CopyFileA
lstrcpyA
lstrcatA
ReadProcessMemory
ExpandEnvironmentStringsW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
GetTempFileNameW
GetVolumeInformationW
GetModuleFileNameA
GlobalLock
GlobalUnlock
GetProcessHeap
HeapAlloc
HeapFree
GetFileInformationByHandle
FileTimeToDosDateTime
FileTimeToSystemTime
SetFileTime
DosDateTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
DuplicateHandle
GetFileType
SetCurrentDirectoryW
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
VirtualFreeEx
lstrcmpA
GetProcessTimes
GetSystemTimeAsFileTime
IsWow64Process
Module32FirstW
Module32NextW
lstrcmpW
OpenEventA
MapViewOfFile
GetQueuedCompletionStatus
ReadDirectoryChangesW
GetThreadPriority
PostQueuedCompletionStatus
CreateIoCompletionPort
UnmapViewOfFile
WaitForMultipleObjects
GetSystemInfo
GetDriveTypeW
FlushFileBuffers
GetFileSizeEx
GlobalAddAtomW
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
ReadConsoleW
ReadConsoleA
GetPrivateProfileStringW
CloseHandle
ReadFile
OutputDebugStringW
GetLastError
CreateFileW
GetFileSize
lstrcpyW
lstrcatW
lstrlenW
GlobalFindAtomW
GlobalDeleteAtom
MulDiv
GetVersion
FreeResource
GetSystemDefaultLangID
GetExitCodeThread
FormatMessageA
SleepEx
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
ExpandEnvironmentStringsA
lstrcpynW
WideCharToMultiByte
GetPrivateProfileIntW
TerminateThread
GetACP
DeviceIoControl
GetTempPathW
SetPriorityClass
GetCurrentThread
SetThreadPriority
GetLogicalDriveStringsW
QueryDosDeviceW
lstrcmpiW
SetLastError
FormatMessageW
LocalAlloc
LocalFree
MoveFileW
GetVersionExW
GetDiskFreeSpaceExW
SwitchToThread
OpenMutexW
ResumeThread
GetExitCodeProcess
GetModuleFileNameW
GetModuleHandleW
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
SetEvent
OpenEventW
OutputDebugStringA
OpenProcess
Process32NextW
ProcessIdToSessionId
Process32FirstW
CreateToolhelp32Snapshot
WTSGetActiveConsoleSessionId
Sleep
WritePrivateProfileStringW
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetLocalTime
WriteFile
SetFilePointer
CreateDirectoryW
GetEnvironmentVariableW
InitializeCriticalSection
DeleteCriticalSection
GetCommandLineW
GetSystemTime
GetPrivateProfileStringA
DeleteFileA
CreateEventW
CreateThread
GetComputerNameW
SetThreadLocale
GetSystemDirectoryW
SetProcessShutdownParameters
SetUnhandledExceptionFilter
CreateMutexW
CopyFileW
FindClose
FindNextFileW
SetFileAttributesW
FindFirstFileW
OpenFileMappingW
ReleaseMutex
WaitForSingleObject
CreateProcessW
GetWindowsDirectoryW
RemoveDirectoryW
DeleteFileW
CreateFileA
ExitProcess
CreateEventA
ResetEvent
lstrlenA
GlobalFree
GlobalAlloc
WritePrivateProfileStringA
MoveFileExW
WaitNamedPipeW
GetProcAddress
LoadLibraryW
FreeLibrary
FindFirstFileA
CreateFileMappingW
LocalFileTimeToFileTime
GetTickCount
GetFileAttributesW
SetConsoleMode
EnterCriticalSection
LeaveCriticalSection
user32
RegisterClipboardFormatW
LockWindowUpdate
GetDCEx
GetNextDlgGroupItem
InvalidateRgn
CharNextW
WaitMessage
SetCapture
UnregisterClassW
GetSysColorBrush
GetDialogBaseUnits
UnpackDDElParam
ReuseDDElParam
GetMenuBarInfo
ReleaseCapture
InsertMenuItemW
TranslateAcceleratorW
DefMDIChildProcW
DefFrameProcW
LoadAcceleratorsW
SetParent
SetRectEmpty
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
CharUpperW
GetMenuStringW
ScrollWindowEx
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
SendDlgItemMessageA
SendDlgItemMessageW
WinHelpW
GetCapture
GetClassLongPtrW
SetFocus
GetWindowTextLengthW
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
ScrollWindow
TrackPopupMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetClassInfoExW
GetClassInfoW
AdjustWindowRectEx
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
SystemParametersInfoA
GetWindowPlacement
SetActiveWindow
CreateDialogIndirectParamW
IsWindowEnabled
EndDialog
GetKeyState
MapWindowPoints
wsprintfA
UnionRect
TrackMouseEvent
SetWindowRgn
CreateIconIndirect
FrameRect
TrackPopupMenuEx
GetActiveWindow
GetNextDlgTabItem
DestroyCursor
MessageBoxA
MsgWaitForMultipleObjects
MessageBeep
DestroyWindow
DrawIconEx
WindowFromPoint
GetDC
EqualRect
MoveWindow
BringWindowToTop
DrawIcon
SetMenuDefaultItem
SetForegroundWindow
GetFocus
IsChild
MenuItemFromPoint
GetCursorPos
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
LoadCursorW
ValidateRect
SetMenu
DrawMenuBar
DestroyMenu
CallNextHookEx
SetPropW
CallWindowProcW
GetPropW
RemovePropW
UnhookWindowsHookEx
SetWindowsHookExW
SetLayeredWindowAttributes
IntersectRect
CreatePopupMenu
DeleteMenu
RemoveMenu
IsRectEmpty
ClientToScreen
GetMenuState
LoadMenuW
InsertMenuW
AppendMenuW
ModifyMenuW
GetMenuDefaultItem
DrawEdge
DrawFocusRect
GetMessagePos
DrawStateW
InflateRect
GetSubMenu
GetMenuItemID
GetMenu
GetSystemMenu
WindowFromDC
GetMenuInfo
CopyAcceleratorTableW
MapVirtualKeyW
GetKeyNameTextW
GetIconInfo
CopyImage
GetMenuItemRect
GetMenuItemInfoW
SystemParametersInfoW
OffsetRect
IsMenu
SetMenuInfo
GetWindowDC
ReleaseDC
GetMenuItemCount
MonitorFromRect
MonitorFromWindow
GetMonitorInfoW
CopyRect
SetRect
GetDlgItem
PeekMessageW
GetCaretBlinkTime
ScreenToClient
PtInRect
LoadBitmapW
GetClientRect
SetCursor
RedrawWindow
GetSysColor
ExitWindowsEx
EnumWindows
RegisterWindowMessageW
IsIconic
FindWindowW
IsZoomed
GetDesktopWindow
GetWindow
IsWindowVisible
GetForegroundWindow
GetClassNameW
GetWindowTextW
GetWindowThreadProcessId
OpenClipboard
EmptyClipboard
CloseClipboard
RegisterClassExW
ShowWindow
UpdateWindow
RegisterClassW
GetSystemMetrics
CreateWindowExW
GetMessageW
TranslateMessage
DispatchMessageW
SetTimer
SetWindowLongPtrW
DefWindowProcW
BeginPaint
FillRect
EndPaint
GetWindowLongPtrW
PostQuitMessage
KillTimer
RegisterDeviceNotificationW
LoadImageW
GetWindowLongW
SetWindowLongW
SetWindowPos
PostThreadMessageW
wsprintfW
MessageBoxW
PostMessageW
InvalidateRect
GetWindowRect
LoadIconW
IsWindow
EnableWindow
SendMessageW
GetParent
CheckMenuItem
GetUserObjectInformationW
GetProcessWindowStation
DestroyIcon
TranslateMDISysAccel
gdi32
PlayMetaFile
GetRgnBox
GetBkColor
StretchDIBits
GetCharWidthW
DPtoLP
GetMapMode
SetRectRgn
CreateDCW
CopyMetaFileW
PatBlt
ExtCreatePen
GetDeviceCaps
DeleteObject
CreateSolidBrush
StretchBlt
GetObjectW
CreateCompatibleDC
GetStockObject
CreateFontIndirectW
RealizePalette
CreatePalette
BitBlt
DeleteDC
SetBkColor
SelectObject
CreateBitmap
SetPixel
GetPixel
GetTextColor
GetCurrentPositionEx
GetTextExtentPointW
ExtTextOutW
MoveToEx
SetTextAlign
GetLayout
GetTextMetricsW
GetTextAlign
GetCurrentObject
CreatePatternBrush
CreateCompatibleBitmap
SetWindowOrgEx
GetNearestColor
RoundRect
GetTextExtentPoint32W
Rectangle
CreatePen
SetBrushOrgEx
UnrealizeObject
CreateHatchBrush
SelectClipRgn
CreateRectRgnIndirect
CombineRgn
CreateRectRgn
PtVisible
RectVisible
TextOutW
Escape
SetBkMode
SetTextColor
CreateDIBSection
CreateRoundRectRgn
SetDIBColorTable
CreateFontW
GetDCOrgEx
GetClipBox
SaveDC
RestoreDC
SetPolyFillMode
SetROP2
SetStretchBltMode
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
LineTo
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
SetArcDirection
SetColorAdjustment
GetClipRgn
SelectClipPath
GetViewportExtEx
GetWindowExtEx
StartDocW
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
CreateDIBPatternBrushPt
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
msimg32
TransparentBlt
comdlg32
GetFileTitleW
GetOpenFileNameW
winspool.drv
ClosePrinter
DocumentPropertiesW
OpenPrinterW
EnumPrintersW
advapi32
ConvertSecurityDescriptorToStringSecurityDescriptorW
LookupAccountNameW
SetNamedSecurityInfoW
RevertToSelf
ImpersonateLoggedOnUser
AdjustTokenPrivileges
SetTokenInformation
DuplicateTokenEx
LookupPrivilegeValueW
OpenProcessToken
CreateProcessAsUserW
RegEnumKeyExW
RegCloseKey
SetSecurityInfo
GetSecurityInfo
GetUserNameA
DecryptFileW
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptDestroyKey
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegOpenKeyExW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegSetValueExW
RegQueryValueExW
GetUserNameW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteKeyW
RegEnumValueW
RegEnumKeyW
RegQueryInfoKeyW
RegDeleteValueW
RegCreateKeyExW
LookupAccountSidW
GetTokenInformation
RegQueryValueExA
RegOpenKeyExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
CloseServiceHandle
ControlService
OpenServiceW
DeleteService
GetSidSubAuthority
GetSidSubAuthorityCount
RegSetValueW
RegOpenKeyW
RegQueryValueW
GetSidIdentifierAuthority
IsValidSid
StartServiceW
OpenSCManagerW
SetFileSecurityW
GetSecurityDescriptorControl
AddAccessAllowedAce
AddAce
EqualSid
GetAce
InitializeAcl
GetLengthSid
GetAclInformation
GetSecurityDescriptorDacl
RegCreateKeyW
GetSecurityDescriptorSacl
ConvertSidToStringSidW
GetFileSecurityW
shell32
SHGetPathFromIDListA
SHFileOperationW
ShellExecuteExA
ShellExecuteA
SHGetFolderPathW
SHChangeNotify
Shell_NotifyIconW
DragQueryFileW
SHGetDesktopFolder
DragAcceptFiles
ShellExecuteExW
ShellExecuteW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetFileInfoW
ExtractIconW
DragFinish
comctl32
ImageList_GetIconSize
_TrackMouseEvent
oledlg
OleUIBusyW
ole32
OleRegGetUserType
ReadFmtUserTypeStg
ReadClassStg
CreateBindCtx
ReleaseStgMedium
CoTaskMemAlloc
StringFromCLSID
CoTreatAsClass
OleDuplicateData
CLSIDFromProgID
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoInitializeEx
CoTaskMemFree
CreateStreamOnHGlobal
CoCreateInstance
OleRun
CoUninitialize
CoInitialize
CoCreateGuid
CLSIDFromString
CoDisconnectObject
StringFromGUID2
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRegisterClassObject
CoRevokeClassObject
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CreateILockBytesOnHGlobal
oleaut32
CreateErrorInfo
SetErrorInfo
GetErrorInfo
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
VarBstrFromDate
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarCyFromStr
SysReAllocStringLen
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
OleLoadPicturePath
VariantCopy
VarDateFromStr
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
SysStringLen
VariantInit
SysFreeString
SysAllocString
VariantClear
gdiplus
GdiplusShutdown
GdipDeleteFontFamily
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDeleteBrush
GdipDeleteFont
GdipBitmapUnlockBits
GdipResetWorldTransform
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdiplusStartup
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipFree
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipDrawImageI
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDrawImageRectI
GdipDrawString
GdipCreateSolidFill
GdipCloneBrush
GdipAlloc
GdipCreateFontFamilyFromName
GdipCreateFromHDC
GdipSetSmoothingMode
GdipCreateFont
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipSetInterpolationMode
psapi
EnumProcesses
EnumProcessModules
GetModuleBaseNameW
GetModuleFileNameExW
wintrust
WinVerifyTrust
crypt32
CertDuplicateCertificateContext
CertOpenStore
CertGetCertificateContextProperty
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CertGetNameStringW
CryptDecodeObject
CertEnumCertificatesInStore
sqlite64
sqlite3_column_int
sqlite3_data_count
sqlite3_column_text
sqlite3_prepare
sqlite3_step
sqlite3_finalize
sqlite3_errmsg
sqlite3_open16
sqlite3_close
sqlite3_free
sqlite3_exec
filelock64
NotifyUpdateSet
StopGetProcessInfo
UpdateSignature
RemoveHideProc
AddHideProc
NotifyFileLock
KillPid
GetProcessInfo
ord341
ord223
FlushLogFile
EncryptLockFile
ord336
ord330
ord334
ord356
GetLogStatus
GetFilterStatus
StopLog
ord31
AddPassProc
CleanHideProc
CleanProtProc
CleanPassProc
StartLog
ClearSaveAsFile
SetWorkMode
ord333
ord331
StopDecrypt
LeavePassFilter
EncryptLockFileBuffer
DecodeRC4
EncodeAES
UnloadDeviceDriver
InstallDeviceDriver
EnterOldFilter
ord370
ord371
DecryptLockFile
MakeFileHead
EncodeRC4
WriteFileHead
WritePolicy
EnterPassFilter
CheckEncrytFile
IsEncryptLockFile
CanFileDecrypted
DecodeAES
StopRelate
RemoveProtProc
StartRelate
AddProtProc
CleanProtFileList
AddProtFileList
RemoveProtFileList
ord30
StartFilter
StopFilter
dgdecrypt64
DecryptDGFile
IsCryptedDGFile
emls64
ord13
ord11
ord84
ord19
ord20
ord89
ord88
ord61
ord56
ord14
ord18
ord52
ord30
ord83
ord17
ord60
ord73
ord55
ord87
ord86
ord25
ord93
ord82
ord78
ord26
ord81
ord85
ord50
ord92
ord91
tiface64
ord4
ord3
ord81
ord80
ord90
ord91
ord95
userenv
CreateEnvironmentBlock
rpcrt4
UuidCreate
uninstallestsys64
UnstallDriverForAppW
InstallDriverForAppW
wldap32
ord32
ord30
ord26
ord50
ord143
ord35
ord79
ord211
ord46
ord41
ord22
ord45
ord33
ord301
ord27
ord60
ord200
Exports
Exports
Sections
.text Size: 8.8MB - Virtual size: 8.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 63KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 769KB - Virtual size: 769KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ