Cap[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Cap.exe
Size

562KB
MD5

f5fdc317c0812aff1a56a7cf004bb7ef
SHA1

1289ab20a4b496ac2e6b6b34d1175d9f5664cafa
SHA256

96555ac3ae8502aa2fc2370dc389adf88e7ce19c58265a337e106dc4df64f7e3
SHA512

9c4fbd3b7c68676066dacc29483e4e72b492c5ef57bae0964ab86a0d0aae1c816a5ead740b0b955937325cf7c3cb8ebf18928c86f99912f0cfd6cadb64e33280
SSDEEP

12288:wUuittyHpWBJBSFnqYEJMr+/GKCS5BRRL:NuX9AWr+OGD

Score

1^/10

Malware Config

Signatures

Files

Cap.exe
.exe windows x64

e195f6d51497972f6e437a7fc5a1cc67

Code Sign

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/05/2019, 00:00

Not After

23/05/2022, 23:59

Subject

CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:51:4d:e1:e4:4b:6d:f0:15:8b:cd:90:9c:37:26:d3:e4:7b:26:27:73:f2:46:79:73:4a:1f:d0:aa:2b:2c:b0
Signer

Actual PE Digest

23:51:4d:e1:e4:4b:6d:f0:15:8b:cd:90:9c:37:26:d3:e4:7b:26:27:73:f2:46:79:73:4a:1f:d0:aa:2b:2c:b0

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA

24/02/2021, 07:11
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

caphk

?PaintXORUI@@YAXXZ
?NotifyDllDraggingPreview@@YAXXZ
?SetDrawingWnd@@YAXPEAUHWND__@@@Z
?OnVirtualWndInput@@YAXH_K_J@Z
?SetMouseHook@@YAHPEAUHWND__@@PEAUCAPTUREINFO@@HPEAVCRect@@0@Z
?SetKeyboardHook@@YAHPEAUHWND__@@H@Z
?CAPXORWindow@@YAXPEAUHWND__@@@Z
?CAPFreePolyPoints@@YAXPEAUSOURCE_CAPTUREINFO@@@Z

cdrflt

?SetHwndParent@FLTCLIPDATA@@QEAAXPEAUHWND__@@@Z
?GetClipReference@FLTCLIPDATA@@QEAAPEAUCLIPREFERENCE@@XZ
?SetRGBPalette@FLTCLIPDATA@@QEAAXPEAUtagRGBTRIPLE@@@Z
?SetClrUsed@FLTCLIPDATA@@QEAAXH@Z
?SetFilterID@FLTCLIPDATA@@QEAAXH@Z
?GetFilterID@FLTCLIPDATA@@QEBAHXZ
?SetCompression@FLTCLIPDATA@@QEAAXH@Z
?SetYResolution@FLTCLIPDATA@@QEAAXH@Z
?SetXResolution@FLTCLIPDATA@@QEAAXH@Z
?SetActualBitsPerPixel@FLTCLIPDATA@@QEAAXH@Z
?SetBitsPerPixel@FLTCLIPDATA@@QEAAXH@Z
?SetHeight@FLTCLIPDATA@@QEAAXH@Z
?SetWidth@FLTCLIPDATA@@QEAAXH@Z
?GetWidth@FLTCLIPDATA@@QEBAHXZ
?SetFrameRate@FLTCLIPDATA@@QEAAXH@Z
?SetClipNo@FLTCLIPDATA@@QEAAXH@Z
?GetClipNo@FLTCLIPDATA@@QEBAHXZ
?SetNoOfClips@FLTCLIPDATA@@QEAAXH@Z
?GetNoOfClips@FLTCLIPDATA@@QEBAHXZ
?SetAppSettings@FLTCLIPDATA@@QEAAXI@Z
?GetFileName@FLTCLIPDATA@@QEBAPEB_WXZ
??0FILTERDATALIST@@QEAA@XZ
??1FILTERDATALIST@@QEAA@XZ
?Clear@FILTERDATALIST@@QEAAXXZ
?GetFiltersList@WFilterManager@@QEAAHPEAVFILTERDATALIST@@0KH@Z
??0WFilterManager@@QEAA@PEAUSETUPFM@@@Z
??1WFilterManager@@QEAA@XZ
?Setup@WFilterManager@@QEAAHPEAUSETUPFM@@@Z
?ShutDown@WFilterManager@@QEAAHXZ
?SetFileName@FLTCLIPDATA@@QEAAXPEB_W@Z
?GetMatchedFilter@WFilterManager@@QEAAHPEA_W0PEAHK@Z
?GetErrorMsg@FLTCLIPDATA@@QEBAPEB_WXZ
?GetFilterInfo@WFilterManager@@QEAAHHPEAUFILTERINFO@@@Z
?EndExport@WFilterManager@@QEAAHPEAVFLTCLIPDATA@@@Z
?CopyClipDataFrom@FLTCLIPDATA@@UEAAXPEAV1@@Z
??1FLTCLIPDATA@@UEAA@XZ
??0FLTCLIPDATA@@QEAA@XZ
?SetRImageType@FLTCLIPDATA@@QEAAXI@Z
?SetRIMG@FLTCLIPDATA@@QEAAXPEAX@Z
?ExportClip@WFilterManager@@QEAAHPEAVFLTCLIPDATA@@@Z

cdrfnt

?GAPIInitialize@@YAX_N@Z

cdrrip

?RIPGetDataSize@@YAIPEAU_RIMAGE@@@Z
?RIPGetPaletteSize@@YAFPEAU__RPALETTE@@@Z
?RIPGetPaletteEntry@@YAHPEAU__RPALETTE@@PEAE11G@Z
?RIPGetImageData@@YAHPEAU_RIMAGE@@JJJJPEAE@Z
?RIPDestroyImage@@YAHPEAU_RIMAGE@@@Z
?RIPInitialize@@YAHXZ
?RIPInitializeDisplay@@YAPEAU_RDISPLAY@@XZ
?RIPInitializeTileManager@@YAHIIIIHPEA_W0P6AHPEAEHHPEAHHPEAX@Z@Z
?RIPShutdownTileManager@@YAHXZ
?RIPShutdownDisplay@@YAHPEAU_RDISPLAY@@@Z
?RIPShutdown@@YAHXZ
?RIPSetPalette@@YAXPEAU_RIMAGE@@PEAU__RPALETTE@@@Z
?RIPDestroyRS@@YAHPEAU_RS@@@Z
?RIPCreateRS@@YAPEAU_RS@@XZ
?RIPCreateRS@@YAPEAU_RS@@AEBVColorContext@ColorSystem@@@Z
?RIPCreatePalettedImageEx2@@YAPEAU_RIMAGE@@PEAU__RPALETTE@@JJHHIIIPEAVCLR_COLORSPEC@@PEAXPEBVColorContext@ColorSystem@@@Z
?RIPGetPlanes@@YAHPEAU_RIMAGE@@@Z
?RIPSetPaletteEntry@@YAHPEAU__RPALETTE@@GEEE@Z
?RIPCreatePalLookup@@YAHPEAU__RPALETTE@@G@Z
?RIPSetImageData@@YAHPEAU_RIMAGE@@JJJJHPEAEI@Z
?RIPSolidRectangle@@YAHPEAU_RS@@PEAU_RIMAGE@@JJJJPEBVCLR_COLORSPEC@@@Z
?RIPConvertImageToImage@@YAHPEAU_RS@@PEAU_RIMAGE@@JJ1JJJJ@Z
?RIPDestroyFillMode@@YAHPEAU_RFILLMODE@@@Z
?RIPSetFillMode@@YAPEAU_RFILLMODE@@PEAU_RS@@PEAU1@@Z
?RIPStretchBlitInContext@@YAHPEAU_RS@@PEAU_RIMAGE@@JJJJPEBUtagRECT@@1JJJJ2W4RIPROP@@@Z
?RIPSetFillColor@@YAXPEAVCLR_COLORSPEC@@PEAU_RFILLMODE@@PEBV1@I@Z
?RIPGetFillMode@@YAPEAU_RFILLMODE@@PEAU_RS@@@Z
?RIPRectangle@@YAHPEAU_RS@@PEAU_RIMAGE@@PEBUtagPOINT@@JJ@Z
?RIPSetCurrentPosition@@YAHPEAU_RS@@PEBUtagPOINT@@@Z
?RIPSetForegroundClr@@YAXPEAVCLR_COLORSPEC@@PEAU_RS@@PEBV1@@Z
?RIPEllipse@@YAHPEAU_RS@@PEAU_RIMAGE@@JJ@Z
?RIPCreateMaskFromBWImage@@YAPEAU_RMASK@@PEAU_RIMAGE@@@Z
?RIPSetMask@@YAPEAU_RMASK@@PEAU_RIMAGE@@PEAU1@@Z
?RIPMergeMask@@YAHPEAU_RMASK@@JJJJ0JJI@Z
?RIPPolygon@@YAHPEAU_RS@@PEAU_RIMAGE@@PEBUtagPOINT@@H@Z
?RIPGetMask@@YAPEAU_RMASK@@PEAU_RIMAGE@@@Z
?RIPGetPalette@@YAPEAU__RPALETTE@@PEAU_RIMAGE@@@Z
?RIPClearMask@@YAHPEAU_RMASK@@@Z
?RIPDestroyMask@@YAHPEAU_RMASK@@@Z
?RIPGetHeight@@YAJPEAU_RIMAGE@@@Z
?RIPGetVRes@@YAIPEAU_RIMAGE@@@Z
?RIPCreateMask@@YAPEAU_RMASK@@JJ@Z
?RIPGetHRes@@YAIPEAU_RIMAGE@@@Z
?RIPGetWidth@@YAJPEAU_RIMAGE@@@Z
?RIPGetImageType@@YA?AW4R_IMG_ENUM@@PEAU_RIMAGE@@@Z
?RIPGetBitsPerPlane@@YAHPEAU_RIMAGE@@@Z
?RIPCreatePalette@@YAPEAU__RPALETTE@@GF@Z
?RIPCreateFillMode@@YAPEAU_RFILLMODE@@IIIPEAVCLR_COLORSPEC@@PEAIPEBV2@2HHHIPEAU_RIMAGE@@P6APEAU3@PEAXPEAU_RS@@3HH@ZI@Z
?RIPCreateImageEx2@@YAPEAU_RIMAGE@@IJJIIIPEAVCLR_COLORSPEC@@PEAXPEBVColorContext@ColorSystem@@@Z
?RIPDestroyPalette@@YAHPEAU__RPALETTE@@@Z

crl2d

?CgiCreateEmptyCGIDC@@YAPEAU__CGIDC@@XZ
?CgiDetachHDC@@YAPEAUHDC__@@PEAU__CGIDC@@@Z
?CgiInitialize@@YAHXZ
?CgiAttachHDC@@YAPEAU__CGIDC@@PEAUHDC__@@@Z
?CgiShutdown@@YAHXZ

crlclr

?MakeBW@CLR_COLORSPEC@@SAXAEAV1@H@Z
?GetPaletteID@WClrPaletteMgr@@QEAAHHAEAPEAVWClrPalette@@@Z
?Uninitialize@CRLCLR@@YAXXZ
?Initialize@CRLCLR@@YAXXZ
??0CLR_COLORSPEC@@QEAA@XZ
?MakeGRAY@CLR_COLORSPEC@@SAXAEAV1@E@Z
?Instance@WClrPaletteMgr@@SAPEAV1@XZ
??4CLR_COLORSPEC@@QEAAAEAV0@AEBV0@@Z
?GetActiveColorContext@ColorContext@ColorSystem@@SAAEBV12@XZ
??0ColorConverter@ColorSystem@@QEAA@AEBVColorContext@1@@Z
?MakeRGB@CLR_COLORSPEC@@SAXAEAV1@EEE@Z
??1ColorConverter@ColorSystem@@UEAA@XZ
??1CLR_COLORSPEC@@QEAA@XZ
?SetDefaultPalette@WClrPaletteMgr@@QEAAXQEAVWClrPalette@@@Z

crlctl

?CreateIndirect@WCmnUI_Dialog@@UEAAHPEBUDLGTEMPLATE@@PEAVCWnd@@PEAX@Z
?Create@WCmnUI_Dialog@@UEAAHPEAUHINSTANCE__@@IPEAVCWnd@@@Z
?Create@WCmnUI_Dialog@@UEAAHPEAUHINSTANCE__@@PEB_WPEAVCWnd@@@Z
?GetUniqueID@WCmnUI_Dialog@@MEAA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetParentFrameOrDialog@WCmnUI_Dialog@@MEAAPEAVCWnd@@XZ
?IsHostingOuterDialog@WCmnUI_Dialog@@MEAA_NXZ
?CheckAutoCenter@WCmnUI_Dialog@@MEAAHXZ
?GetThisMessageMap@WCmnUI_Dialog@@KAPEBUAFX_MSGMAP@@XZ
??0WCmnUI_Dialog@@QEAA@XZ
??0WCmnUI_Dialog@@QEAA@IAEBV?$CrlStringT@_W@CrlPlatform@@PEAVCWnd@@@Z
?GetThisClass@WCmnUI_PropertyPage@@SAPEAUCRuntimeClass@@XZ
??1WCmnUI_PropertyPage@@UEAA@XZ
?GetThisMessageMap@WCmnUI_PropertyPage@@KAPEBUAFX_MSGMAP@@XZ
??0WCmnUI_PropertyPage@@QEAA@IIK@Z
??0WCmnUI_PropertyPage@@QEAA@XZ
?PreTranslateMessage@WCmnUI_PropertyPage@@MEAAHPEAUtagMSG@@@Z
?GetThisMessageMap@WCorelWinApp@@KAPEBUAFX_MSGMAP@@XZ
??0WCorelWinApp@@QEAA@PEB_W0@Z
??1WCorelWinApp@@UEAA@XZ
?UI_Init@@YAHXZ
?Register@WCellComboBox@@SAXXZ
?UI_Shutdown@@YAXXZ
?InitInstance@WCorelWinApp@@UEAAHXZ
?EnableFlatLook@@YAXII@Z
?Create@WCmnUI_Dialog@@UEAAHPEB_WPEAVCWnd@@@Z
?GetRuntimeClass@WCorelWinApp@@UEBAPEAUCRuntimeClass@@XZ
?PreTranslateMessage@WCorelWinApp@@UEAAHPEAUtagMSG@@@Z
?OnIdle@WCorelWinApp@@UEAAHJ@Z
?WinHelpW@WCorelWinApp@@UEAAXKI@Z
?IsFlatLookEnabled@@YAHXZ
?CrlIsThemeActive@@YAHXZ
?IsBorderVisible@@YAHPEAUHWND__@@@Z
?UTLGetLastTabUsed@@YAHPEAUHINSTANCE__@@PEAUHWND__@@I@Z
?UTLGetLastTabUsedByName@@YAHPEAUHINSTANCE__@@PEAUHWND__@@PEA_W@Z
?SetLogicalCellSize@WCellComboBox@@QEAAXHH@Z
?SetDroppedWidth@WCellComboBox@@QEAAXH@Z
?SetDroppedHeight@WCellComboBox@@QEAAXH@Z
?SetOtherButtonStyle@WCellComboBox@@QEAAXH@Z
?SetCurSel@WCellComboBox@@QEAAHH@Z
?GetThisMessageMap@WCellComboBox@@KAPEBUAFX_MSGMAP@@XZ
??0WCellComboBox@@QEAA@XZ
??1WCellComboBox@@UEAA@XZ
?ResetContent@WCellComboBox@@QEAAXXZ
?AddCell@WCellComboBox@@QEAAHPEAX@Z
?GetCurSel@WCellComboBox@@QEBAHXZ
?OnNotify@WCmnUI_PropertyPage@@UEAAH_K_JPEA_J@Z
?InitControlColors@WCmnUI_PropertyPage@@MEAAXXZ
?GetRuntimeClass@WCellComboBox@@UEBAPEAUCRuntimeClass@@XZ
?WindowProc@WCellComboBox@@MEAA_JI_K_J@Z
?PaintCellBorder@WCellComboBox@@UEAAXPEAVCDC@@AEAVCRect@@@Z
?PaintNoSelection@WCellComboBox@@UEAAXPEAVCDC@@VCRect@@@Z
?PaintDisabledState@WCellComboBox@@UEAAXPEAVCDC@@VCRect@@@Z
?PaintAmbiguousState@WCellComboBox@@UEAAXPEAVCDC@@VCRect@@@Z
?PaintFixedCell@WCellComboBox@@UEAAXPEAVCDC@@VCRect@@K@Z
?PaintOtherCell@WCellComboBox@@UEAAXPEAVCDC@@VCRect@@@Z
?HiliteCurrentSelection@WCellComboBox@@UEAAXPEAVCDC@@H@Z
?DrawCellFocusRect@WCellComboBox@@UEAAXPEAVCDC@@H@Z
?GetFocusCell@WCellComboBox@@UEAAHXZ
?OnCCBNSelChange@WCellComboBox@@UEAAXK@Z
?OnCCBNSelEndCancel@WCellComboBox@@UEAAXK@Z
?OnCCBNSelEndEyedropper@WCellComboBox@@UEAAXK@Z
?OnCCBNCloseUp@WCellComboBox@@UEAAXXZ
?OnCCBNDropDown@WCellComboBox@@UEAAXXZ
?OnCCBNCellUnderCursor@WCellComboBox@@UEAAXH@Z
?OnCCBNSetFocus@WCellComboBox@@UEAAXXZ
?OnCCBNKillFocus@WCellComboBox@@UEAAXXZ
?OnCCBNCellDeleted@WCellComboBox@@UEAAXH@Z
?InstantiateGridPicker@WCellComboBox@@UEAAPEAVWDDGridPicker@@XZ
?GetCellTipText@WCellComboBox@@UEAAXHAEAV?$CrlStringT@_W@CrlPlatform@@@Z
?HitTest@WCellComboBox@@UEAAHVCPoint@@@Z
?AddPlugIn@WWndPlugInClient@@UEAAXPEAVWWndPlugIn@@H@Z
?RemovePlugIn@WWndPlugInClient@@UEAAHPEAVWWndPlugIn@@@Z
?PLGINWindowProc@WWndPlugInClient@@UEAA_JI_K_J@Z
?_PLGINBaseClassWindowProc@WCellComboBox@@EEAA_JI_K_J@Z
?GetSimpleNoEditComboCaption@WCellComboBox@@MEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?WindowProc@WCmnUI_PropertyPage@@MEAA_JI_K_J@Z
?SetPrnEngineInstance@WCmnUI_PropertyPage@@UEAAXPEAUIPrnAppInstance@@@Z
?OnPropertyPageScaleChanged@WCmnUI_PropertyPage@@UEAAXAEBVIMetrics@WindowPainter@@@Z
?OnPropertyPageScaleChanging@WCmnUI_PropertyPage@@UEAAXAEBVIMetrics@WindowPainter@@@Z
??1WCmnUI_Dialog@@UEAA@XZ
?GetThisClass@WCmnUI_PropertySheet@@SAPEAUCRuntimeClass@@XZ
?GetThisMessageMap@WCmnUI_PropertySheet@@KAPEBUAFX_MSGMAP@@XZ
??0WCmnUI_PropertySheet@@QEAA@AEBV?$CrlStringT@_W@CrlPlatform@@IPEAVCWnd@@I@Z
??1WCmnUI_PropertySheet@@UEAA@XZ
?AddPage@WCmnUI_PropertySheet@@QEAAXPEAVWCmnUI_PropertyPage@@@Z
?Create@WCmnUI_PropertySheet@@UEAAHPEAVCWnd@@KK@Z
?DoModal@WCmnUI_Dialog@@UEAA_JXZ
?PreTranslateMessage@WCmnUI_PropertySheet@@MEAAHPEAUtagMSG@@@Z
?EndModalLoop@WCmnUI_PropertySheet@@MEAAXH@Z
?OnCommand@WCmnUI_PropertySheet@@MEAAH_K_J@Z
?WindowProc@WCmnUI_PropertySheet@@MEAA_JI_K_J@Z
?DoModal@WCmnUI_PropertySheet@@UEAA_JXZ
?OnInitDialog@WCmnUI_PropertySheet@@UEAAHXZ
?BuildPropPageArray@WCmnUI_PropertySheet@@MEAAXXZ
?CreateIndirect@WCmnUI_Dialog@@UEAAHPEAXPEAVCWnd@@@Z
?OnPageSetActive@WCmnUI_PropertySheet@@UEAAXAEAVCPropertyPage@@_N@Z
?PropSheetInvalidateScaling@WCmnUI_PropertySheet@@UEAAXXZ
?IsUsingSimplePagePositioning@WCmnUI_PropertySheet@@MEBA_NXZ
?SubclassTabControl@WCmnUI_PropertySheet@@MEAAXXZ
?OnScalingChanging@WCmnUI_PropertySheet@@MEAAXAEBVIMetrics@WindowPainter@@@Z
?OnScalingChanged@WCmnUI_PropertySheet@@MEAAXAEBVIMetrics@WindowPainter@@@Z
?IsHostingOuterDialog@WCmnUI_PropertySheet@@MEAA_NXZ
?Create@WCmnUI_Dialog@@UEAAHIPEAVCWnd@@@Z
?GetDroppedState@WCellComboBox@@QEBAHXZ
?EndModalLoop@WCmnUI_Dialog@@MEAAXH@Z
?WindowProc@WCmnUI_Dialog@@MEAA_JI_K_J@Z
?ExitInstance@WCorelWinApp@@UEAAHXZ

crlcui

??1WCuiColorComboBox@@UEAA@XZ
?Initialize@WCuiColorComboBox@@QEAAXPEAU_RDISPLAY@@PEAUCLR_SCREENSPEC@@PEB_W@Z
?SetSelectedColor@WCuiColorComboBox@@QEAAXAEBVCLR_COLORSPEC@@@Z
?GetSelectedColor@WCuiColorComboBox@@QEBA?AVCLR_COLORSPEC@@XZ
??0WCuiColorComboBox@@QEAA@PEAVIDataContext@@@Z

crlfeaturemanagement

?GetXMLLocalFileName@OnlineService@FeatureManagement@@SA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetInstance@?$Singleton@VOnlineService@FeatureManagement@@$0A@@CrlUtils@@SAAEAVOnlineService@FeatureManagement@@XZ
?FeatureSet@FeatureManagement@@YAAEAVIFeatureSet@1@XZ
?GetServiceURL@OnlineService@FeatureManagement@@SA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?OnlineHelp@Help@Features@FeatureManagement@@3VWFeature@3@A
?VerifyStatus@OnlineService@FeatureManagement@@QEAAXAEBV?$CrlStringT@_W@CrlPlatform@@@Z

crlplatform

?Left@?$CrlStringT@_W@CrlPlatform@@QEBA?AV12@H@Z
??0?$CrlStringViewT@_W@CrlPlatform@@QEAA@AEBV?$CrlStringT@_W@1@@Z
?CompareNoCase@?$CrlStringT@_W@CrlPlatform@@QEBAHV?$CrlStringViewT@_W@2@@Z
??4?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@AEBV01@@Z
??Y?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@PEB_W@Z
?IsEmpty@?$CrlStringT@_W@CrlPlatform@@QEBA_NXZ
?ReverseFind@?$CrlStringT@_W@CrlPlatform@@QEBAH_WW4CompareCase@2@@Z
?GetBuffer@?$CrlStringT@_W@CrlPlatform@@QEAAPEA_WXZ
?Empty@?$CrlStringT@_W@CrlPlatform@@QEAAXXZ
?Mid@?$CrlStringT@_W@CrlPlatform@@QEBA?AV12@HH@Z
??$?H_W@CrlPlatform@@YA?AV?$CrlStringT@_W@0@V?$CrlStringViewT@_W@0@0@Z
?Delete@?$CrlStringT@_W@CrlPlatform@@QEAAHHH@Z
??0?$CrlStringT@_W@CrlPlatform@@QEAA@XZ
??1?$CrlStringT@_W@CrlPlatform@@QEAA@XZ
??0?$CrlStringT@_W@CrlPlatform@@QEAA@AEBV01@@Z
??0?$CrlStringT@_W@CrlPlatform@@QEAA@PEB_W@Z
??4?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@PEB_W@Z
??B?$CrlStringT@_W@CrlPlatform@@QEBAPEB_WXZ
?GetLength@?$CrlStringT@_W@CrlPlatform@@QEBAHXZ
??4?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@$$QEAV01@@Z
?GetBuffer@?$CrlStringT@_W@CrlPlatform@@QEAAPEA_WH@Z
?ReleaseBuffer@?$CrlStringT@_W@CrlPlatform@@QEAAXH@Z
?Compare@?$CrlStringT@_W@CrlPlatform@@QEBAHV?$CrlStringViewT@_W@2@W4CompareCase@2@@Z
?GetString@?$CrlStringT@_W@CrlPlatform@@QEBAPEB_WXZ
??0?$CrlStringT@_W@CrlPlatform@@QEAA@PEB_WH@Z
??0?$CrlStringViewT@_W@CrlPlatform@@QEAA@PEB_W@Z
??A?$CrlStringT@_W@CrlPlatform@@QEBA_WH@Z
?SetAt@?$CrlStringT@_W@CrlPlatform@@QEAAXH_W@Z
?FindOneOf@?$CrlStringT@_W@CrlPlatform@@QEBAHV?$CrlStringViewT@_W@2@W4CompareCase@2@@Z
?Mid@?$CrlStringT@_W@CrlPlatform@@QEBA?AV12@H@Z
?FormatInternal@?$CrlStringT@_W@CrlPlatform@@AEAAXPEB_WZZ
?Find@?$CrlStringT@_W@CrlPlatform@@QEBAHV?$CrlStringViewT@_W@2@W4CompareCase@2@@Z
??0?$CrlStringT@_W@CrlPlatform@@QEAA@$$QEAV01@@Z
?AppendFormatInternal@?$CrlStringT@_W@CrlPlatform@@AEAAXPEB_WZZ
??Y?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@AEBV01@@Z
?Replace@?$CrlStringT@_W@CrlPlatform@@QEAAH_W0W4CompareCase@2@@Z
??0?$CrlStringT@_W@CrlPlatform@@QEAA@$$QEAV?$CrlStringT@D@1@@Z
??0?$CrlStringT@D@CrlPlatform@@QEAA@PEBD@Z
??1?$CrlStringT@D@CrlPlatform@@QEAA@XZ
?Right@?$CrlStringT@_W@CrlPlatform@@QEBA?AV12@H@Z
??Y?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@_W@Z
?TrimRight@?$CrlStringT@_W@CrlPlatform@@QEAAAEAV12@XZ
?GetAt@?$CrlStringT@_W@CrlPlatform@@QEBA_WH@Z
?MakeLower@?$CrlStringT@_W@CrlPlatform@@QEAAAEAV12@XZ
?Find@?$CrlStringT@_W@CrlPlatform@@QEBAH_WW4CompareCase@2@@Z

crlsci

?GetInst@IIPMMessagingSystem@CrlSCI@@SAAEAV12@XZ

crlutils

?GetTempFolder@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?set@StickyEvent@CrlUtils@@QEAAXXZ
??1StickyEvent@CrlUtils@@UEAA@XZ
?GetWorkAreaSizeWithoutTaskBarAndToolbarRectPixels@System@CrlUtils@@YA_NPEAX@Z
?AddExtension@Path@SystemIO@@YA_NAEAV?$CrlStringT@_W@CrlPlatform@@PEB_W@Z
?GetFileName@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEB_W@Z
?Join@CrlThread@CrlUtils@@YAXAEAPEAX_N@Z
?Delete@File@SystemIO@@YA_NPEB_W@Z
?Create@CrlThread@CrlUtils@@YAPEAXV?$function@$$A6AKPEAX@Z@std@@PEAX@Z
?GetProcessFileName@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEAUHINSTANCE__@@@Z
??0StickyEvent@CrlUtils@@QEAA@_N0@Z
?TMPStartupTmpFileMgr@@YA_NXZ
?Exists@Path@SystemIO@@YA_NPEB_W@Z
?TMPShutdownTmpFileMgr@@YAXXZ
?Append@Path@SystemIO@@YAXAEAV?$CrlStringT@_W@CrlPlatform@@PEB_W@Z
?wait_for@StickyEvent@CrlUtils@@UEAA_NK@Z
?getNativeHandle@StickyEvent@CrlUtils@@UEAAPEAXXZ
?wait@StickyEvent@CrlUtils@@UEAAXXZ
?tryWait@StickyEvent@CrlUtils@@UEAA_NXZ
?MakePretty@Path@SystemIO@@YAXAEAV?$CrlStringT@_W@CrlPlatform@@@Z
?GetTempFileNameW@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEB_W00@Z
?reset@StickyEvent@CrlUtils@@QEAAXXZ
?Exists@File@SystemIO@@YA_NPEB_W@Z
?GetFolderName@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEB_W@Z
?GetThreadID@CrlThread@CrlUtils@@YAKAEAPEAX@Z
?Combine@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEB_W0@Z
?GetUserLocaleID@CrlLocale@@YAKXZ

crlutl

?CMNUIPlaySound@@YAHPEB_W@Z
?IsUserAllowedToUseInternet@CrlUtl@@YA_NXZ
?GetInst@IGLB_UILanguage@@SAAEAV1@XZ
?IsConnectedToInternet@CrlUtl@@YA_NXZ
??0DelayInitBase@@QEAA@W4EPriority@DelayInitRegistrar@@@Z
??1DelayInitBase@@QEAA@XZ
?CRLUTLIsCurLangFarEast@@YAHXZ
?UNITConvToUnitAndString@@YA?AV?$CrlStringT@_W@CrlPlatform@@NHNI@Z
?UNITGetAutoIncrement@@YANHNHIH@Z
?GetDefaultWUnit@WUnit@@SAAEAV1@XZ
?UNITGetUnitAsString@@YA?AV?$CrlStringT@_W@CrlPlatform@@HH@Z
?UNITConvertUnitToUnit@@YANIINN@Z
?GetValue@WUnitValuePair@@QEBA_NIAEAN@Z
?UNITConvertBaseToUnit@@YANINN@Z
?UNITConvToUnitAndStringEx@@YA?AV?$CrlStringT@_W@CrlPlatform@@NHNIHH@Z
?UNITIsValidCustomUnit@@YAHH@Z
?UNITGetUnitArray@@YAPEBHH@Z
?UNITConvertUnitToBase@@YANINN@Z
?GetKeyContext@@YAAEAVIKeyContext@UI@Framework@@XZ
??1WUnitValuePair@@UEAA@XZ
??0WUnitValuePair@@QEAA@XZ
?UNITConvertResUnitToUnit@@YANIIN@Z
?CMNUIRegisterSoundEvent@@YAHPEB_WV?$CrlStringT@_W@CrlPlatform@@@Z
?CMNUIEnableSoundEvents@@YAHH@Z
?GetInst@DelayInitRegistrar@@SAAEAV1@XZ

crlweb

?GetFile@DownloadManager@CrlWeb@@YAHAEBV?$CrlStringT@_W@CrlPlatform@@0@Z

windowpainter

?FromEditHandle@EditControlProps@WindowPainter@@SAPEAV12@PEAUHWND__@@@Z
?MixinWindowProcPost@IMixin@@UEAA_JI_K_JAEAH@Z
?MixinPreTranslateMessage@IMixin@@UEAAHPEAUtagMSG@@@Z
?MixinWindowProc@WLegacyPanelHelper@WindowPainter@@MEAA_JI_K_JAEAH@Z
?DrawSpinControl@WWindowPainter@@QEAAXAEBUCGICDC@Framework@@AEBUSpinControl@1@_N@Z
??1WWindowPainter@@QEAA@XZ
?AddCursorResource@Framework@@YAXAEBV?$CrlStringT@_W@CrlPlatform@@0@Z
?GetCursorAsIcon@Framework@@YAPEAUHICON__@@AEBV?$CrlStringT@_W@CrlPlatform@@PEAUHWND__@@@Z
?Metrics@WindowPainter@@YAAEBVIMetrics@1@PEAUHWND__@@@Z
?GetPrimarySurfaceColor@WWindowPainter@@QEBAKXZ
?SetCursor@Framework@@YA?AV?$CrlStringT@_W@CrlPlatform@@AEBV23@AEBUPEHandle@1@@Z
?GetVirtualScreenRect@@YA?AVCRect@@XZ
??1IImageDelayedPtr@Framework@@QEAA@XZ
??0IImageDelayedPtr@Framework@@QEAA@XZ
?CreateWindowProp@EditControlProps@WindowPainter@@SAXPEAUHWND__@@@Z
??0LegacyScalerOptOut@WindowPainter@@QEAA@PEAVCWnd@@@Z
?GetInstance@WWindowPainter@@SAAEAV1@XZ
?OnScalingChanged@WLegacyPanelHelper@WindowPainter@@MEAAXAEBVIMetrics@2@@Z
?OnScalingChanging@WLegacyPanelHelper@WindowPainter@@MEAAXAEBVIMetrics@2@@Z
?GetCursor@Framework@@YA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetCursorInfo@Framework@@YA?AV?$shared_ptr@VCursorInfo@Framework@@@std@@AEBV?$CrlStringT@_W@CrlPlatform@@PEAUHWND__@@@Z
?LogicalBaseButtonWidth@EditControlProps@WindowPainter@@2HB
??0WControlColorsMixin@WindowPainter@@QEAA@W4Type@01@@Z
??1WControlColorsMixin@WindowPainter@@UEAA@XZ
?UICUR_GetCursorPos@@YAHPEAUtagPOINT@@@Z
?Schemes@WindowPainter@@YAAEAUIWindowSchemeManager@1@XZ
??0WWindowPainter@@QEAA@AEBVIMetrics@WindowPainter@@@Z

crlcomponent

?TrackPopupMenu@MenuMgr@CrlComponent@@YAHAEAVCMenu@@IHHPEAVCWnd@@PEBUtagRECT@@_N@Z
?ShowWarning@MessageMgr@CrlComponent@@YAXPEB_W@Z
?ShowConfirmation@MessageMgr@CrlComponent@@YAHIPEB_W@Z
?ShowError@MessageMgr@CrlComponent@@YAXPEB_W@Z
?SetAppInterface@CrlComponent@@YAXPEAVICorelCmn_App@@@Z
?SetWinApp@CrlComponent@@YAXPEAVCWinApp@@@Z

crlfrmwk

?GetPasmSystem@IPasmSystem@@SAAEAV1@XZ

crlinternationalization

InitGAPI
CorIsFarEastWindow

crlpref

?GetInstance@?$Singleton@VCLocalMachinePrefManager@@$0A@@CrlUtils@@SAAEAVCLocalMachinePrefManager@@XZ
?OnExitInstance@CLocalMachinePrefManager@@QEAAXXZ
?OnInitInstance@CLocalMachinePrefManager@@QEAAXAEAVGenericPrefs@CrlPref@@@Z
?GetInstance@CBoxPrefManager@@SAAEAVCAppPrefManager@@XZ
?GetInstance@IRegistry@PREFUTILS@@SAPEAV12@XZ

crlutlui

?UTLShowHelp@@YA_NAEBV?$CrlStringT@_W@CrlPlatform@@@Z
?UNITGetUnitControlValue@@YAHPEAUHWND__@@HPEBHH@Z
?UNITSetUnitControlValue@@YAXPEAUHWND__@@HHH@Z
?UNITFillUnitControl@@YAXPEAUHWND__@@HPEBHH@Z
?Shutdown@HelpUtils@@YA_NXZ
?Startup@HelpUtils@@YA_NAEBV?$CrlStringT@_W@CrlPlatform@@0_N@Z
?ShowHelp@HelpUtils@@YA_NIAEBV?$CrlStringT@_W@CrlPlatform@@@Z

crlresources

?GetString@Resources@Framework@@SA?AV?$CrlStringT@_W@CrlPlatform@@AEBV34@@Z
?Preload@Resources@Framework@@SA_NXZ

crlconfig

?Initialize@BaseAppStartup@@QEAAXPEB_W_N@Z
?INIInitCommonIniFile@@YAHXZ
?UTLCreateUnicodeIniFile@@YAHPEB_W@Z
?GetUserProfileConfigDir@@YA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?INIGetProgramsDir@@YA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?INIGetRegistryProductKey@@YA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?IsOnlyInitializeAndLoadDll@IAppStartupInit@@UEBA_NXZ
?GetAppResourceXMLName@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetAppHintsFile@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?BOXIDGetRegistryInfo@@YAHPEA_WH0H@Z
?GetAppResourceDLLName@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetBoxVersion@IAppStartupInit@@UEBAXAEAH000@Z
?GetAppVersion@IAppStartupInit@@UEBAXAEAH000@Z
?GetBoxMajorVersionNum@IAppStartupInit@@UEBAHXZ
??0IAppStartupInit@@QEAA@XZ
?CanLaunch@IAppStartupInit@@UEBA_NXZ
?GetAppHelpContext@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetProductSummaryType@IAppStartupInit@@UEBAGXZ
??0BaseAppStartup@@QEAA@AEAUIAppStartupInit@@@Z
??1BaseAppStartup@@UEAA@XZ
?Initialize@BaseAppStartup@@MEAAXXZ
?FindInterface@IAppStartupInit@@UEBAPEBXAEBU_GUID@@@Z
?GetAppSkinSettingData@@YAAEAVWAppSkinSettingData@@XZ
?GetFireBallImagePath@WAppSkinSettingData@@QEAA_NAEAV?$CrlStringT@_W@CrlPlatform@@@Z
?BOXIDGetCopyrightInfo@@YAPEB_WXZ
?GetAppUIName@WAppSkinSettingData@@QEAA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?CommandLine@BaseAppStartup@@UEBAAEBUICommandLine@CrlUtils@@XZ
?GetCmdLine@BaseAppStartup@@UEAAPEA_WXZ
?IsSdiMode@BaseAppStartup@@UEBA_NXZ
?StartupInitialActionDisabled@BaseAppStartup@@UEBA_NXZ
?IsDDE@BaseAppStartup@@UEBA_NXZ
?IsCOMAutomation@BaseAppStartup@@UEBA_NXZ
?IsUserMode@BaseAppStartup@@UEBA_NXZ
?IsPrintAndExit@BaseAppStartup@@UEBA_NXZ
?IsNoSplash@BaseAppStartup@@UEBA_NXZ
?IsPrintABB@BaseAppStartup@@UEBA_NXZ
?IsPrintFull@BaseAppStartup@@UEBA_NXZ
?IsEmbedding@BaseAppStartup@@UEBA_NXZ
?IsAutomation@BaseAppStartup@@UEBA_NXZ
?IsSDIDefaultInterfaceMode@IAppStartupInit@@UEBA_NXZ
?GetTypeAssistFileName@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetDefaultExtension@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetDDEServerName@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetClassID@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetMessagingSystemID@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetProgId@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetProgIdPrefix@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetAppTlbFilename@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?Run@BaseAppStartup@@MEAAHXZ
?FindInterface@IAppStartupInit@@UEAAPEAXAEBU_GUID@@@Z
?GetComponentsID@IAppStartupInit@@UEBA?AW4ComponentsID@1@XZ

winmm

timeSetEvent
timeBeginPeriod
timeKillEvent
timeEndPeriod

imm32

ImmAssociateContext

gdiplus

GdipGetImageHeight
GdipCreateBitmapFromFile
GdipCloneImage
GdipDisposeImage
GdiplusStartup
GdipAlloc
GdipFree
GdiplusShutdown
GdipGetImageWidth

msvcp140

?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_broadcast
_Cnd_wait
_Cnd_register_at_thread_exit
_Cnd_unregister_at_thread_exit
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z

mfc140u

ord12212
ord7719
ord14288
ord6121
ord14290
ord6123
ord14289
ord6122
ord3731
ord11921
ord11929
ord7920
ord11933
ord12606
ord5555
ord9941
ord5750
ord6260
ord6505
ord5199
ord894
ord12899
ord2686
ord13758
ord8159
ord2178
ord2273
ord11709
ord1059
ord365
ord9838
ord9835
ord5706
ord6285
ord3266
ord3144
ord6555
ord7551
ord7874
ord6622
ord2162
ord12267
ord7233
ord1383
ord446
ord1089
ord7228
ord6871
ord11854
ord6848
ord5672
ord4343
ord8731
ord10704
ord8983
ord8811
ord8708
ord10221
ord11424
ord9955
ord9832
ord10190
ord10285
ord9833
ord11157
ord14151
ord5563
ord8730
ord10703
ord3246
ord3059
ord6259
ord10683
ord5379
ord5388
ord6006
ord12931
ord4702
ord13596
ord7779
ord2703
ord3089
ord1149
ord3579
ord1390
ord916
ord1058
ord2344
ord2966
ord8916
ord4078
ord8817
ord6251
ord8441
ord4086
ord6361
ord14357
ord13199
ord14221
ord12033
ord11644
ord1120
ord488
ord2801
ord7541
ord13999
ord13864
ord9159
ord4875
ord11330
ord3056
ord14220
ord13761
ord2005
ord3090
ord528
ord8471
ord12392
ord1440
ord973
ord1053
ord3713
ord4721
ord8507
ord4725
ord2479
ord3803
ord4724
ord2187
ord4722
ord3728
ord2212
ord287
ord6083
ord11623
ord11622
ord11624
ord11621
ord10858
ord10260
ord11022
ord10924
ord8668
ord11665
ord10710
ord11813
ord11085
ord3951
ord3308
ord3307
ord6000
ord13397
ord2697
ord8901
ord8830
ord3746
ord2906
ord8439
ord4081
ord3058
ord8819
ord6258
ord6002
ord13401
ord3212
ord3209
ord7913
ord2698
ord14360
ord9976
ord9978
ord9977
ord9975
ord9979
ord5451
ord11414
ord11415
ord11771
ord3718
ord11625
ord8656
ord11902
ord6729
ord10691
ord8947
ord3173
ord13513
ord11944
ord11940
ord1700
ord1722
ord1748
ord1734
ord1755
ord4776
ord4843
ord4788
ord4806
ord4800
ord4794
ord4853
ord4837
ord4782
ord4859
ord4814
ord4752
ord4767
ord4828
ord4360
ord9384
ord4352
ord2967
ord14211
ord7651
ord6631
ord11406
ord13354
ord5723
ord2629
ord11806
ord3279
ord3278
ord3172
ord11850
ord5080
ord5363
ord5552
ord9041
ord5339
ord5582
ord5083
ord5229
ord5062
ord5916
ord7460
ord7461
ord7450
ord5227
ord7922
ord9946
ord8900
ord6247
ord6250
ord6320
ord6090
ord3952
ord1121
ord489
ord5237
ord3742
ord357
ord1086
ord438
ord13955
ord7882
ord13767
ord14128
ord11664
ord2370
ord2011
ord7668
ord6549
ord10163
ord3678
ord3595
ord3598
ord3697
ord3599
ord4335
ord5240
ord14209
ord3812
ord1057
ord1454
ord990
ord3071
ord5674
ord12746
ord2473
ord4726
ord2475
ord2270
ord4656
ord12761
ord12762
ord886
ord7813
ord13757
ord7188
ord12706
ord7928
ord1111
ord1033
ord296
ord8043
ord1369
ord878
ord6588
ord3756
ord8826
ord3164
ord4095
ord5152
ord11081
ord2195
ord2487
ord2316
ord1424
ord7182
ord1489
ord266
ord985
ord2786
ord7394
ord6619
ord8167
ord8084
ord12544
ord8023
ord5183
ord2439
ord12222
ord265
ord1491
ord12223
ord14210
ord7650
ord14088
ord14216
ord9089
ord4011
ord3949
ord8733
ord12625
ord14217

kernel32

ReleaseActCtx
GetCurrentThreadId
FindActCtxSectionStringW
SetLastError
GetModuleFileNameW
GetModuleHandleExW
QueryActCtxW
OutputDebugStringA
GetACP
GetCurrentProcess
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetSystemDirectoryW
GetWindowsDirectoryW
SetDllDirectoryW
InitOnceComplete
ActivateActCtx
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateActCtxW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetLastError
LocalFree
lstrcmpiW
OutputDebugStringW
GetCommandLineW
GetLocaleInfoW
LoadLibraryW
GlobalAlloc
LocalAlloc
GlobalFree
CreateEventW
DeactivateActCtx
FormatMessageW
FreeLibrary
lstrlenW
GlobalUnlock
GlobalLock
GetModuleHandleW
GetProcAddress
ExitThread
DebugBreak
Sleep
GetTickCount
TryEnterCriticalSection
SetCriticalSectionSpinCount
InitializeCriticalSection
WaitForSingleObject
CreateThread
LeaveCriticalSection
EnterCriticalSection
CloseHandle
lstrcpyW
lstrcmpW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
DeleteCriticalSection
InitializeCriticalSectionEx
InitOnceBeginInitialize

user32

CreateDialogParamW
GetWindowLongW
DrawTextW
SetPropW
PostThreadMessageW
EndDialog
DdeUnaccessData
DdeAccessData
DdeCmpStringHandles
DdeUninitialize
DdeFreeStringHandle
DdeEnableCallback
DdeNameService
DdeCreateStringHandleW
DdeInitializeW
GetSysColor
GetDlgCtrlID
IsChild
IsWindowVisible
GetWindow
GetClassNameW
ChildWindowFromPointEx
UpdateWindow
GetCapture
KillTimer
SetTimer
GetMenuState
CheckMenuItem
LoadCursorW
InflateRect
CallWindowProcW
SetWindowTextW
GetWindowTextW
ReleaseCapture
PtInRect
SetCapture
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
ShowWindow
MessageBoxW
CloseClipboard
SetClipboardData
EmptyClipboard
GetScrollInfo
IntersectRect
GetWindowThreadProcessId
GetMenuItemRect
GetMenu
UnionRect
GetMonitorInfoW
UnregisterHotKey
RegisterHotKey
GetAncestor
GetWindowInfo
OpenClipboard
InvalidateRect
ClientToScreen
DrawIcon
GetKeyState
GetWindowLongPtrW
EnumDisplayMonitors
LoadBitmapW
DefWindowProcW
SetFocus
DestroyWindow
SetWindowPos
SetWindowLongPtrW
CreateWindowExW
RegisterClassW
LoadImageW
IsWindow
GetCursorPos
GetDialogBaseUnits
SetRect
SetRectEmpty
SetLayeredWindowAttributes
LoadIconW
GetForegroundWindow
SetForegroundWindow
WindowFromPoint
FindWindowW
GetDesktopWindow
GetFocus
SetActiveWindow
RedrawWindow
ReleaseDC
GetDC
ScreenToClient
GetClientRect
GetWindowRect
BringWindowToTop
GetSystemMenu
PostMessageW
LoadMenuW
GetSubMenu
GetMenuItemID
GetMenuItemCount
EnableMenuItem
AppendMenuW
DeleteMenu
CopyRect
TranslateMessage
PeekMessageW
DispatchMessageW
OffsetRect
GetSystemMetrics
DrawIconEx
DestroyIcon
RegisterWindowMessageW
EnableWindow
GetParent
SendMessageW
FillRect
UnregisterClassW
AdjustWindowRect
IsRectEmpty
UpdateLayeredWindow
SetWindowLongW
GetClassInfoW
GetMessageW

gdi32

SetTextAlign
SetBkColor
SetTextColor
SetBkMode
CreateDIBSection
RestoreDC
SaveDC
GetTextMetricsW
GetTextFaceW
RectVisible
GetNearestColor
CreateFontIndirectW
Rectangle
GetDIBits
GetStockObject
StretchDIBits
GetSystemPaletteEntries
SelectPalette
SetMapMode
EndDoc
EndPage
StartPage
StartDocW
RealizePalette
CreateDCW
CreatePalette
SetStretchBltMode
CreateSolidBrush
DeleteDC
DeleteObject
GetTextExtentPoint32W
SelectObject
GetDeviceCaps
GetObjectW
StretchBlt
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap

comdlg32

PrintDlgW

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
RegCloseKey

shell32

ExtractIconExW
Shell_NotifyIconW
SHGetFolderPathW

comctl32

ImageList_ReplaceIcon
ImageList_GetIcon

ole32

CLSIDFromProgID
CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

GetErrorInfo

userenv

ExpandEnvironmentStringsForUserW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

wcsrchr
memcpy
__RTDynamicCast
_purecall
__std_exception_destroy
__std_exception_copy
wcschr
__std_type_info_compare
__C_specific_handler
_CxxThrowException
memmove
__current_exception_context
__current_exception
memset
__std_terminate

api-ms-win-crt-heap-l1-1-0

free
calloc
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswscanf
__p__commode
__stdio_common_vswprintf_s
_set_fmode
__stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

wcsncpy
wcscat_s
isalpha
_wcsdup
wcstok
wcscpy_s
_wcslwr
towupper

api-ms-win-crt-runtime-l1-1-0

_set_app_type
terminate
_invalid_parameter_noinfo_noreturn
_exit
_configure_wide_argv
abort
_initialize_wide_environment
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_get_wide_winmain_command_line
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_initterm
_initterm_e
exit
_seh_filter_exe

api-ms-win-crt-convert-l1-1-0

_itow

api-ms-win-crt-math-l1-1-0

sqrt
__setusermatherr
round

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e195f6d51497972f6e437a7fc5a1cc67

Code Sign

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4aCertificate

Key Usages

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

23:51:4d:e1:e4:4b:6d:f0:15:8b:cd:90:9c:37:26:d3:e4:7b:26:27:73:f2:46:79:73:4a:1f:d0:aa:2b:2c:b0Signer

Signature Validations

Verification

24/02/2021, 07:11 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

caphk

cdrflt

cdrfnt

cdrrip

crl2d

crlclr

crlctl

crlcui

crlfeaturemanagement

crlplatform

crlsci

crlutils

crlutl

crlweb

windowpainter

crlcomponent

crlfrmwk

crlinternationalization

crlpref

crlutlui

crlresources

crlconfig

winmm

imm32

gdiplus

msvcp140

mfc140u

kernel32

user32

gdi32

comdlg32

advapi32

shell32

comctl32

ole32

oleaut32

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 209KB - Virtual size: 208KB

.rdata Size: 147KB - Virtual size: 147KB

.data Size: 7KB - Virtual size: 30KB

.pdata Size: 10KB - Virtual size: 10KB

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

f3:03:07:6f:06:2a:78:d8:c6:1b:51:16:a4:9d:36
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

23:51:4d:e1:e4:4b:6d:f0:15:8b:cd:90:9c:37:26:d3:e4:7b:26:27:73:f2:46:79:73:4a:1f:d0:aa:2b:2c:b0
Signer

24/02/2021, 07:11
Valid: false

.text
Size: 209KB - Virtual size: 208KB

.rdata
Size: 147KB - Virtual size: 147KB

.data
Size: 7KB - Virtual size: 30KB

.pdata
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 169KB - Virtual size: 168KB

.reloc
Size: 10KB - Virtual size: 9KB