Extended Key Usages
ExtKeyUsageCodeSigning
Overview
overview
8Static
static
1fruit_warr...__.zip
windows7-x64
1fruit_warr...__.zip
windows10-2004-x64
1UpdateAgent.dll
windows7-x64
1UpdateAgent.dll
windows10-2004-x64
1setup.exe
windows7-x64
7setup.exe
windows10-2004-x64
7vssapi.dll
windows7-x64
1vssapi.dll
windows10-2004-x64
1w32time.dll
windows7-x64
1w32time.dll
windows10-2004-x64
8Static task
static1
Behavioral task
behavioral1
Sample
fruit_warriors_script___gui_hack___autofarm___i___.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fruit_warriors_script___gui_hack___autofarm___i___.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
UpdateAgent.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
UpdateAgent.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
setup.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
vssapi.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
vssapi.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
w32time.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
w32time.dll
Resource
win10v2004-20230220-en
Target
fruit_warriors_script___gui_hack___autofarm___i___.zip
Size
6.9MB
MD5
6f4db608909e314fc76020e240a08d6d
SHA1
53b4eeaaefd63bc1aeae5c0e0859688ad5146b2b
SHA256
48b3cc0799138804952d7804a326a9356b4713be099d09a03d315d6fa8a6df28
SHA512
e9535e18fa225f586f9097aa218eecfff41eeb6894a4942e49291f81d21d2b13451d8737aebf3ee74f99f1c085717edb5880c5ac0bc7a84724b09b7f0280653a
SSDEEP
196608:5RNhCYH7FXmNPQK7VmXcTMR6M5pl1slFTXJUtI:XNhCSFX0J4XoMR6MlMTXJT
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
_initterm_e
_initterm
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__wcsicmp
_o__wcsnicmp
_o__wcstoui64
_o__wfopen
_o__wsplitpath_s
_o__wtof
_o__wtoi
_o_fclose
_o_feof
_o_fgetws
_o_free
memmove
_o_iswctype
_o_iswspace
_o_malloc
_o_memcpy_s
_o_strncpy_s
_o_strtol
_o_terminate
_o_toupper
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
_o_wcstoul
__CxxFrameHandler3
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__cexit
_o__callnewh
wcsstr
_o__aligned_malloc
_o__aligned_free
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o___acrt_iob_func
strrchr
wcsrchr
strchr
wcschr
__C_specific_handler
memcmp
memcpy
wcscmp
memset
wcsnlen
strcmp
strncmp
wcsncmp
RtlNtStatusToDosError
NtSetInformationFile
RtlCompareUnicodeString
NtUnloadKey2
RtlDosPathNameToNtPathName_U_WithStatus
RtlAdjustPrivilege
NtLoadKey2
NtDelayExecution
NtShutdownSystem
NtQueryLicenseValue
RtlDestroyEnvironment
NtSetInformationProcess
RtlCreateEnvironmentEx
RtlSetEnvironmentVariable
RtlDowncaseUnicodeChar
RtlExpandEnvironmentStrings_U
RtlInitUnicodeStringEx
RtlLengthSid
RtlDuplicateUnicodeString
NtQueryPerformanceCounter
NtFlushKey
DbgPrintEx
NtQueryVolumeInformationFile
RtlValidAcl
NtAdjustPrivilegesToken
RtlSetSaclSecurityDescriptor
RtlCreateUnicodeStringFromAsciiz
NtQueryValueKey
DbgPrint
NtCreateFile
RtlFreeHeap
NtClose
RtlQueryEnvironmentVariable_U
LdrLoadDll
RtlDosPathNameToNtPathName_U
LdrUnloadDll
LdrGetDllHandle
NtOpenKey
NtWriteFile
LdrGetProcedureAddress
NtQueryObject
RtlLeaveCriticalSection
RtlInitializeCriticalSection
RtlEnterCriticalSection
RtlTimeToTimeFields
RtlDeleteCriticalSection
RtlNtStatusToDosErrorNoTeb
RtlLengthSecurityDescriptor
RtlValidSid
NtOpenProcessToken
RtlSetOwnerSecurityDescriptor
RtlGetControlSecurityDescriptor
RtlMakeSelfRelativeSD
NtDuplicateToken
RtlSetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlQueryInformationAcl
RtlGetOwnerSecurityDescriptor
RtlAllocateAndInitializeSid
RtlRaiseStatus
RtlCreateHeap
RtlUpcaseUnicodeChar
RtlAllocateHeap
RtlReAllocateHeap
RtlInitUnicodeString
NtSetInformationThread
NtQueryInformationThread
RtlDestroyHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlGetGroupSecurityDescriptor
RtlCopySid
NtOpenThreadToken
RtlGetVersion
RtlSetGroupSecurityDescriptor
RtlCreateSecurityDescriptor
RtlFindAceByType
RtlGetDaclSecurityDescriptor
RtlDeleteSecurityObject
NtYieldExecution
NtQueryKey
NtDeleteKey
RtlSetCurrentTransaction
NtEnumerateKey
RtlGetLengthWithoutLastFullDosOrNtPathElement
NtEnumerateValueKey
NtOpenKeyEx
RtlGetAce
RtlpApplyLengthFunction
RtlAddAccessAllowedAceEx
NtReadFile
NtCreateKeyTransacted
RtlNewSecurityObjectEx
NtDeleteFile
NtSetSecurityObject
RtlGetCurrentTransaction
NtDeleteValueKey
RtlAddAce
NtQueryAttributesFile
NtFlushBuffersFile
NtDuplicateObject
NtFsControlFile
NtQueryInformationFile
RtlCreateAcl
NtCreateKey
NtOpenKeyTransactedEx
NtQueryDirectoryFile
NtQuerySecurityObject
NtSetValueKey
NtOpenFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtSetEaFile
RtlReleaseRelativeName
NtQueryEaFile
NtWaitForSingleObject
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlEqualUnicodeString
RtlCreateEnvironment
NtQuerySystemTime
RtlSetControlSecurityDescriptor
RtlAnsiCharToUnicodeChar
RtlUnicodeToMultiByteN
RtlIsTextUnicode
RtlUnicodeToMultiByteSize
RtlConvertSidToUnicodeString
RtlRunOnceComplete
RtlRunOnceBeginInitialize
RtlFindNextForwardRunClear
RtlNumberOfSetBits
RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlExpandEnvironmentStrings
NtQueryInformationToken
VerSetConditionMask
GetSecurityDescriptorLength
GetTokenInformation
AddAccessAllowedAce
GetLengthSid
DestroyPrivateObjectSecurity
MakeSelfRelativeSD
InitializeAcl
InitializeSecurityDescriptor
FreeSid
CopySid
EqualSid
SetSecurityDescriptorDacl
CreatePrivateObjectSecurityWithMultipleInheritance
GetSecurityDescriptorControl
AllocateAndInitializeSid
IsValidSid
AdjustTokenPrivileges
IsValidAcl
AddAccessAllowedAceEx
CheckTokenMembership
IsValidSecurityDescriptor
SetEndOfFile
GetLogicalDriveStringsW
SetFileTime
GetShortPathNameW
DeleteFileW
GetLogicalDrives
GetVolumeInformationW
GetFileSizeEx
FindFirstFileW
GetFileInformationByHandle
FindNextFileW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointer
GetDiskFreeSpaceW
ReadFile
RemoveDirectoryW
GetFullPathNameW
DeleteFileA
SetFilePointerEx
CreateFileA
CreateDirectoryW
CreateFileW
GetFileType
SetFileAttributesW
GetFileAttributesW
FindFirstFileExW
FindClose
GetDriveTypeW
GetFinalPathNameByHandleW
GetLongPathNameW
GetTempFileNameW
GetFileSize
WriteFile
GetDiskFreeSpaceExW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
LoadLibraryExA
GetModuleFileNameA
GetProcAddress
FreeLibrary
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegEnumValueW
RegEnumKeyExW
RegSetKeySecurity
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
WideCharToMultiByte
CompareStringW
CompareStringOrdinal
MultiByteToWideChar
WaitForSingleObject
ReleaseSRWLockShared
InitializeCriticalSectionEx
CreateMutexW
ResetEvent
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
WaitForSingleObjectEx
CreateMutexExW
AcquireSRWLockExclusive
ReleaseSemaphore
AcquireSRWLockShared
OpenEventW
EnterCriticalSection
CreateSemaphoreExW
DeleteCriticalSection
WaitForMultipleObjectsEx
CreateMutexA
SetEvent
TryEnterCriticalSection
CreateEventW
ReleaseSRWLockExclusive
InitializeSRWLock
ReleaseMutex
InitializeCriticalSection
HeapValidate
HeapReAlloc
HeapCompact
HeapFree
HeapCreate
HeapWalk
HeapAlloc
HeapDestroy
HeapSize
GetProcessHeap
GetErrorMode
UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter
SetErrorMode
RaiseException
CoTaskMemAlloc
CoCreateGuid
CoGetMalloc
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoSetProxyBlanket
StringFromGUID2
SetThreadPriority
GetCurrentProcess
GetThreadPriority
TlsSetValue
CreateProcessA
SetPriorityClass
GetExitCodeThread
GetPriorityClass
TlsAlloc
GetProcessId
TlsGetValue
ExitProcess
OpenThreadToken
OpenProcessToken
GetCurrentThreadId
TlsFree
CreateProcessW
TerminateProcess
GetCurrentThread
CreateThread
GetCurrentProcessId
GetExitCodeProcess
ExpandEnvironmentStringsW
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCommandLineW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
EventWriteString
EventProviderEnabled
EventRegister
EventWriteTransfer
EventUnregister
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
CharNextW
GetSystemTime
GetWindowsDirectoryW
GlobalMemoryStatusEx
GetComputerNameExW
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetSystemInfo
GetTickCount64
GetVersion
GetSystemDirectoryW
GetVersionExW
GetTickCount
GetVersionExA
GetLocalTime
IsProcessorFeaturePresent
OpenProcess
GetVolumePathNamesForVolumeNameW
GetTempPathW
GetVolumeNameForVolumeMountPointW
InitOnceExecuteOnce
Sleep
ResolveLocaleName
FormatMessageW
GetLocaleInfoW
OutputDebugStringW
DebugBreak
OutputDebugStringA
IsDebuggerPresent
CloseHandle
DuplicateHandle
GlobalUnlock
LocalFree
GlobalLock
LocalAlloc
GlobalSize
CopyFileW
MoveFileW
GlobalMemoryStatus
WaitForMultipleObjects
CreateFileMappingA
QueryPerformanceCounter
InitializeSListHead
VirtualFree
CreateFileMappingW
MapViewOfFile
VirtualAlloc
VirtualQuery
VirtualProtect
UnmapViewOfFile
CertVerifyCertificateChainPolicy
CryptHashCertificate2
I_RpcMapWin32Status
UuidToStringW
RpcStringFreeW
UuidFromStringW
UuidCreate
SysAllocString
SysFreeString
VariantTimeToSystemTime
SystemTimeToVariantTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
CopyFileExW
GetFileInformationByHandleEx
MoveFileExW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
GetOverlappedResult
DeviceIoControl
InitiateSystemShutdownExW
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvCertFromChain
LoadLibraryW
RegDeleteKeyW
GlobalAlloc
GlobalFree
SetSecurityInfo
WerReportAddFile
WerReportSetUIOption
WerReportSubmit
WerReportCreate
WerReportCloseHandle
WerReportSetParameter
LCIDToLocaleName
GetPrivateProfileStringW
lstrcmpW
VerifyVersionInfoW
PathMatchSpecW
EnableTraceEx2
ControlTraceW
RtlCaptureStackBackTrace
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_PropertyW
RaiseFailFastException
CreateDeploymentSession
CreateDeploymentSessionEx
CreateOfflineDeploymentSession
UA_CommitActionList
UA_CreateActionList
UA_CreateDownloadList
UA_CreateDownloadListFromActionList
UA_CreatePackageListFromDownloadList
UA_InstallActionList
UA_ReleaseDownloadList
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale
InitCommonControls
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW
SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate
NetWkstaGetInfo
NetApiBufferFree
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
AdjustTokenPrivileges
GetTokenInformation
ConvertSidToStringSidW
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
wcsncmp
wcstok
_wcsdup
wcsrchr
wcspbrk
wcschr
_errno
_beginthreadex
towlower
_wtoi64
_wtoi
wcstoul
memmove_s
tolower
iswdigit
_vsnprintf
memcmp
swscanf
qsort
wcsstr
memcpy
memmove
memset
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
__CxxFrameHandler3
??1exception@@UEAA@XZ
memcpy_s
malloc
towupper
_wcsnicmp
free
_resetstkoflw
_purecall
wcscat_s
realloc
_wcsicmp
_vsnwprintf
__C_specific_handler
??0exception@@QEAA@AEBQEBD@Z
wcscmp
NtQueryDirectoryObject
NtOpenDirectoryObject
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlAdjustPrivilege
RtlUnlockBootStatusData
NtQuerySystemInformation
RtlFormatCurrentUserKeyPath
RtlFreeUnicodeString
NtOpenKey
NtQueryValueKey
EtwRegisterTraceGuidsW
RtlIpv4StringToAddressW
RtlIpv6StringToAddressW
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwGetTraceEnableFlags
EtwUnregisterTraceGuids
NtQueryVolumeInformationFile
NtCreateFile
RtlNtStatusToDosError
NtQueryInformationFile
NtFsControlFile
NtClose
RtlInitUnicodeString
EtwTraceMessage
RtlGetSetBootStatusData
GetModuleHandleW
GetModuleFileNameW
LoadResource
GetModuleHandleExW
GetProcAddress
FreeLibrary
LockResource
FreeResource
GetModuleFileNameA
LoadLibraryExW
SizeofResource
LoadStringW
FindResourceExW
VirtualQuery
VirtualAlloc
VirtualProtect
RegCreateKeyExW
RegEnumKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegUnLoadKeyW
RegEnumValueW
RegLoadKeyW
ReleaseMutex
AcquireSRWLockExclusive
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
CreateEventW
CreateMutexW
DeleteCriticalSection
ReleaseSemaphore
EnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
InitializeCriticalSection
ResetEvent
LeaveCriticalSection
ReleaseSRWLockExclusive
CreateSemaphoreExW
SetEvent
CreateMutexExW
lstrcmpiW
lstrcpynW
DeviceIoControl
GetVolumeInformationW
ReadFile
FindFirstFileW
FindNextFileW
FindClose
SetFilePointer
GetVolumePathNameW
CreateFileW
SetFilePointerEx
DeleteFileW
WriteFile
GetFileAttributesW
CreateDirectoryW
GetLogicalDrives
GetFullPathNameW
GetDriveTypeW
CharNextW
CharPrevW
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
MultiByteToWideChar
WideCharToMultiByte
SetUnhandledExceptionFilter
SetLastError
RaiseException
UnhandledExceptionFilter
SetErrorMode
GetLastError
CloseHandle
GetComputerNameExW
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount
GetSystemTime
GetSystemInfo
GetTickCount64
GetVersionExW
GetWindowsDirectoryW
HeapFree
HeapDestroy
GetProcessHeap
HeapAlloc
GlobalAlloc
LocalAlloc
GlobalFree
LocalFree
TlsAlloc
ResumeThread
SetThreadToken
GetCurrentThread
TerminateProcess
TlsGetValue
GetCurrentProcess
TlsSetValue
CreateThread
GetCurrentThreadId
OpenProcessToken
GetCurrentProcessId
OpenThreadToken
Sleep
InitOnceBeginInitialize
InitOnceComplete
FormatMessageW
DebugBreak
OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
QueryPerformanceCounter
ord9
ord7
ord5
ord4
ord2
ord8
ord6
ord11
ord3
ord10
ord1
GetSidSubAuthorityCount
AddAccessAllowedAceEx
AddAccessDeniedAceEx
InitializeAcl
AddAce
GetAce
GetAclInformation
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
CopySid
GetLengthSid
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
CreateWellKnownSid
PrivilegeCheck
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
EqualDomainSid
DuplicateToken
RevertToSelf
IsValidSid
EqualSid
GetTokenInformation
ReportEventW
RegisterEventSourceW
DeregisterEventSource
GetCommandLineW
ExpandEnvironmentStringsW
UuidFromStringW
UuidToStringW
UuidCreate
RpcStringFreeW
EventUnregister
EventWriteTransfer
EventSetInformation
EventActivityIdControl
EventRegister
GlobalUnlock
GlobalLock
CopyFileExW
SetVolumeMountPointW
GetNameInfoW
InetPtonW
WSAStartup
ResolveDelayLoadedAPI
DelayLoadFailureHook
DecodePointer
EncodePointer
??0CVssJetWriter@@QEAA@XZ
??0CVssWriter@@QEAA@XZ
??1CVssJetWriter@@UEAA@XZ
??1CVssWriter@@UEAA@XZ
?AreComponentsSelected@CVssJetWriter@@IEBA_NXZ
?AreComponentsSelected@CVssWriter@@IEBA_NXZ
?CreateVssBackupComponents@@YAJPEAPEAVIVssBackupComponents@@@Z
?CreateVssExamineWriterMetadata@@YAJPEAGPEAPEAVIVssExamineWriterMetadata@@@Z
?GetBackupType@CVssJetWriter@@IEBA?AW4_VSS_BACKUP_TYPE@@XZ
?GetBackupType@CVssWriter@@IEBA?AW4_VSS_BACKUP_TYPE@@XZ
?GetContext@CVssJetWriter@@IEBAJXZ
?GetContext@CVssWriter@@IEBAJXZ
?GetCurrentLevel@CVssJetWriter@@IEBA?AW4_VSS_APPLICATION_LEVEL@@XZ
?GetCurrentLevel@CVssWriter@@IEBA?AW4_VSS_APPLICATION_LEVEL@@XZ
?GetCurrentSnapshotSetId@CVssJetWriter@@IEBA?AU_GUID@@XZ
?GetCurrentSnapshotSetId@CVssWriter@@IEBA?AU_GUID@@XZ
?GetCurrentVolumeArray@CVssJetWriter@@IEBAPEAPEBGXZ
?GetCurrentVolumeArray@CVssWriter@@IEBAPEAPEBGXZ
?GetCurrentVolumeCount@CVssJetWriter@@IEBAIXZ
?GetCurrentVolumeCount@CVssWriter@@IEBAIXZ
?GetRestoreType@CVssJetWriter@@IEBA?AW4_VSS_RESTORE_TYPE@@XZ
?GetRestoreType@CVssWriter@@IEBA?AW4_VSS_RESTORE_TYPE@@XZ
?GetSnapshotDeviceName@CVssJetWriter@@IEBAJPEBGPEAPEBG@Z
?GetSnapshotDeviceName@CVssWriter@@IEBAJPEBGPEAPEBG@Z
?Initialize@CVssJetWriter@@QEAAJU_GUID@@PEBG_N211K@Z
?Initialize@CVssWriter@@QEAAJU_GUID@@PEBGW4VSS_USAGE_TYPE@@W4VSS_SOURCE_TYPE@@W4_VSS_APPLICATION_LEVEL@@KW4VSS_ALTERNATE_WRITER_STATE@@_N1@Z
?InstallAlternateWriter@CVssWriter@@QEAAJU_GUID@@0@Z
?IsBootableSystemStateBackedUp@CVssJetWriter@@IEBA_NXZ
?IsBootableSystemStateBackedUp@CVssWriter@@IEBA_NXZ
?IsPartialFileSupportEnabled@CVssJetWriter@@IEBA_NXZ
?IsPartialFileSupportEnabled@CVssWriter@@IEBA_NXZ
?IsPathAffected@CVssJetWriter@@IEBA_NPEBG@Z
?IsPathAffected@CVssWriter@@IEBA_NPEBG@Z
?OnAbortBegin@CVssJetWriter@@UEAAXXZ
?OnAbortEnd@CVssJetWriter@@UEAAXXZ
?OnBackOffIOOnVolume@CVssWriter@@UEAA_NPEAGU_GUID@@1@Z
?OnBackupComplete@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnBackupCompleteBegin@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnBackupCompleteEnd@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@_N@Z
?OnBackupShutdown@CVssWriter@@UEAA_NU_GUID@@@Z
?OnContinueIOOnVolume@CVssWriter@@UEAA_NPEAGU_GUID@@1@Z
?OnFreezeBegin@CVssJetWriter@@UEAA_NXZ
?OnFreezeEnd@CVssJetWriter@@UEAA_N_N@Z
?OnIdentify@CVssJetWriter@@UEAA_NPEAVIVssCreateWriterMetadata@@@Z
?OnIdentify@CVssWriter@@UEAA_NPEAVIVssCreateWriterMetadata@@@Z
?OnPostRestore@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPostRestoreBegin@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPostRestoreEnd@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@_N@Z
?OnPostSnapshot@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPostSnapshot@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPreRestore@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPreRestoreBegin@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPreRestoreEnd@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@_N@Z
?OnPrepareBackup@CVssWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPrepareBackupBegin@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@@Z
?OnPrepareBackupEnd@CVssJetWriter@@UEAA_NPEAVIVssWriterComponents@@_N@Z
?OnPrepareSnapshotBegin@CVssJetWriter@@UEAA_NXZ
?OnPrepareSnapshotEnd@CVssJetWriter@@UEAA_N_N@Z
?OnThawBegin@CVssJetWriter@@UEAA_NXZ
?OnThawEnd@CVssJetWriter@@UEAA_N_N@Z
?OnVSSApplicationStartup@CVssWriter@@UEAA_NXZ
?OnVSSShutdown@CVssWriter@@UEAA_NXZ
?SetWriterFailure@CVssJetWriter@@IEAAJJ@Z
?SetWriterFailure@CVssWriter@@IEAAJJ@Z
?Subscribe@CVssWriter@@QEAAJK@Z
?Uninitialize@CVssJetWriter@@QEAAXXZ
?Unsubscribe@CVssWriter@@QEAAJXZ
CreateVssBackupComponentsInternal
CreateVssExamineWriterMetadataInternal
CreateVssExpressWriterInternal
CreateVssSnapshotSetDescription
CreateWriter
CreateWriterEx
DllCanUnloadNow
DllGetClassObject
GetProviderMgmtInterface
GetProviderMgmtInterfaceInternal
IsVolumeSnapshotted
IsVolumeSnapshottedInternal
LoadVssSnapshotSetDescription
ShouldBlockRevert
ShouldBlockRevertInternal
VssFreeSnapshotProperties
VssFreeSnapshotPropertiesInternal
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
memset
wcscmp
wcscspn
_initterm_e
_initterm
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__ultow
memmove
_o__wcsicmp
_o__wcsnicmp
_o_ceil
_o_floor
_o_free
_o_log
_o_malloc
_o_qsort
_o_sqrt
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstoul
_CxxThrowException
_o__execute_onexit_table
_o__errno
_o__crt_atexit
__CxxFrameHandler3
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
wcsstr
wcschr
__C_specific_handler
_set_se_translator
__CxxFrameHandler4
_local_unwind
memcmp
memcpy
NdrServerCall2
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcServerUnregisterIf
NdrServerCallAll
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcRevertToSelf
RpcServerInqCallAttributesW
RpcImpersonateClient
RpcMgmtInqServerPrincNameW
RpcStringFreeW
RpcBindingFree
NdrClientCall3
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoW
RpcStringBindingComposeW
LocalAlloc
LocalFree
GetSystemInfo
GetSystemTime
GetTickCount64
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
CreateSemaphoreExW
ResetEvent
CreateEventW
ReleaseSemaphore
AcquireSRWLockExclusive
DeleteCriticalSection
WaitForMultipleObjectsEx
CreateMutexExW
ReleaseSRWLockExclusive
OpenSemaphoreW
WaitForSingleObject
ReleaseMutex
EnterCriticalSection
WaitForSingleObjectEx
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSectionEx
SetEvent
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
FormatMessageW
GetCurrentThreadId
OpenProcessToken
SetThreadPriority
GetCurrentProcess
GetExitCodeThread
TerminateProcess
SetThreadStackGuarantee
CreateThread
OpenThreadToken
GetCurrentProcessId
GetCurrentThread
HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleHandleW
LoadStringW
GetModuleFileNameA
GetModuleHandleExW
GetModuleFileNameW
FreeLibrary
OutputDebugStringW
IsDebuggerPresent
DebugBreak
CloseHandle
SetHandleInformation
GetHandleInformation
CreateThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
QueryPerformanceCounter
QueryPerformanceFrequency
RegGetValueA
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegGetValueW
RegOpenKeyExA
Sleep
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
NetLogonSetServiceBits
NetLogonGetTimeServiceParentDomain
I_NetlogonComputeClientSignature
DsGetDcNameW
I_NetlogonComputeServerDigest
I_NetlogonComputeServerSignature
I_NetlogonGetTrustRid
DsGetSiteNameW
I_NetlogonComputeClientDigest
GetSecurityDescriptorDacl
AdjustTokenPrivileges
PrivilegeCheck
GetTokenInformation
OpenSCManagerW
CreateServiceW
OpenServiceW
DeleteService
CloseServiceHandle
ChangeServiceConfigW
QueryServiceConfigW
ChangeServiceConfig2W
EventSetInformation
EventWrite
EventWriteTransfer
EventRegister
EventUnregister
PowerSettingUnregisterNotification
PowerSettingRegisterNotification
ExpandEnvironmentStringsW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetSystemTimePreciseAsFileTime
RegisterServiceCtrlHandlerExW
SetServiceStatus
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
IsProcessorFeaturePresent
InitializeSListHead
WriteFile
FileTimeToLocalFileTime
CreateFileW
GetFileSizeEx
QueryServiceStatus
RegisterWaitForSingleObjectEx
I_ScSetServiceBitsW
NsiGetAllParameters
PerfSetCounterSetInfo
PerfSetCounterRefValue
PerfDeleteInstance
PerfCreateInstance
PerfStartProvider
PerfStopProvider
CreateTimerQueueTimer
UnregisterWaitEx
QueueUserWorkItem
ChangeTimerQueueTimer
DeleteTimerQueueTimer
RtlAllocateHeap
RtlImageNtHeader
RtlFreeHeap
RtlDeleteResource
NtSetSystemTime
NtSetSystemInformation
NtQuerySystemInformation
RtlIsStateSeparationEnabled
RtlConvertSharedToExclusive
EtwEventRegister
EtwEventWrite
EtwEventUnregister
RtlInitializeCriticalSection
RtlInitializeGenericTableAvl
RtlEnterCriticalSection
RtlInsertElementGenericTableAvl
RtlLeaveCriticalSection
RtlLookupElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlDeleteCriticalSection
RtlConvertExclusiveToShared
RtlAcquireResourceExclusive
RtlInitializeResource
RtlReleaseResource
NtOpenFile
RtlStringFromGUID
RtlFreeUnicodeString
RtlAppendUnicodeStringToString
RtlReleaseSRWLockExclusive
RtlRunOnceExecuteOnce
RtlNtStatusToDosError
RtlAcquireSRWLockExclusive
RtlInitUnicodeString
RtlAcquireResourceShared
GetPersistedRegistryLocationW
VirtualProtect
VirtualQuery
VirtualAlloc
ResolveDelayLoadedAPI
DelayLoadFailureHook
logf
DllInstall
DllRegisterServer
DllUnregisterServer
SvchostEntry_W32Time
SvchostPushServiceGlobals
TimeProvClose
TimeProvCommand
TimeProvOpen
W32TimeBufferFree
W32TimeDcPromo
W32TimeDeleteConfig
W32TimeGetNetlogonServiceBits
W32TimeLog
W32TimeQueryConfig
W32TimeQueryConfiguration
W32TimeQueryHardwareProviderStatus
W32TimeQueryNTPProviderStatus
W32TimeQueryNtpProviderConfiguration
W32TimeQuerySource
W32TimeQueryStatus
W32TimeSetConfig
W32TimeSyncNow
W32TimeVerifyJoinConfig
W32TimeVerifyUnjoinConfig
W32TmServiceMain
fnW32TmI_ScSetServiceBits
fnW32TmRegisterServiceCtrlHandlerEx
fnW32TmSetServiceStatus
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ