Lightroom[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Lightroom.exe
Size

14.8MB
MD5

9f97dd9fae7182a143c708fe2c8a8563
SHA1

dc4d916516e889a48e51556702d7ff1e5ff78023
SHA256

d23f1fd6f1641123d240c3923625f2706ea292b468ed74af69f4a685d8d8a5ac
SHA512

763695ac5460cce81dc5e250dc1e07696e0c357338f81a4342314962fabba3b4dff6cae14b9cdd26657795e3a2b7d4572423f8f8fa6bd5390c91c334a7ba2b3c
SSDEEP

393216:LcsiK6maLiYcQoY4EAEmzyLQFVUOolYUojbhh:3hlasQLD/mzRFVelYXHz

Score

1^/10

Malware Config

Signatures

Files

Lightroom.exe
.exe windows:6 windows x64 arch:x64

831ec1128f4cfd5512bdbd9546a9500b

Code Sign

0f:a1:8a:29:f8:52:96:a4:55:ac:5e:d0:0c:86:c0:ae
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12/09/2017, 00:00

Not After

04/09/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Lightroom\, Camera RAW,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

30:f9:de:68:20:f2:3f:64:e3:7c:bc:20:04:23:4e:00:5c:de:a6:38:25:7c:a1:a7:b5:06:c8:cd:cc:72:b7:a9
Signer

Actual PE Digest

30:f9:de:68:20:f2:3f:64:e3:7c:bc:20:04:23:4e:00:5c:de:a6:38:25:7c:a1:a7:b5:06:c8:cd:cc:72:b7:a9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\j\workspace\r7\main\build\Stripped\x64\lightroom.pdb

Imports

amtlib

AMTValidateProductLicense
AMTReleaseProductLicense
AMTObtainProductLicense
AMTRetrievePersonGUIDWithAuthSource
AMTRetrieveLibraryPath
AMTRecordCodecInvocation
AMTPreObtainProductLicense
AMTGetCurrentLicenseState
AMTObtainRunningLicenseRecord

crclient

?CrashReporterInitialize@@YA_NPEAXPEBD1111P6A_KAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@ZP6AXXZ@Z

headlights

AgWrapperAdobePIPReportSessionCrash

ui

?viewToGlobalPoint_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_tooltip_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_visible_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
??0AgViewViewBehavior@@QEAA@XZ
??1AgDataProvider@@UEAA@XZ
??0AgDataProvider@@IEAA@PEAXPEBX_KP6AX012@Z@Z
?ResumePanels@AgViewWinPanelHost@@QEAAXXZ
?SuspendPanels@AgViewWinPanelHost@@QEAAXXZ
?GetThisMessageMap@AgViewWinMainFrame@@KAPEBUAFX_MSGMAP@@XZ
?OnToolHitTest@AgViewWinMainFrame@@MEBA_JVCPoint@@PEAUtagTOOLINFOW@@@Z
?OnCommand@AgViewWinMainFrame@@MEAAH_K_J@Z
??1AgViewWinMainFrame@@UEAA@XZ
?isSkinned@AgViewWinMainFrame@@UEAA_NXZ
?pushToLuaWithGC@AgViewWinMainFrame@@UEAAXPEAUlua_State@@_N@Z
?pushToLua@AgViewWinMainFrame@@UEAAXPEAUlua_State@@@Z
?OnUpdateFrameTitle@AgViewWinMainFrame@@UEAAXH@Z
?PreCreateWindow@AgViewWinMainFrame@@UEAAHAEAUtagCREATESTRUCTW@@@Z
?OnClose@AgViewWinMainFrame@@UEAAXXZ
?PreTranslateMessage@AgViewWinMainFrame@@UEAAHPEAUtagMSG@@@Z
?globalToViewPoint_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?GetThisClass@AgViewWinMainFrame@@SAPEAUCRuntimeClass@@XZ
??0AgViewWinMainFrame@@IEAA@XZ
?PostNcDestroy@AgViewWinFrame@@UEAAXXZ
?OnDrop@AgViewWinFrame@@UEAAHPEAVCOleDataObject@@KVCPoint@@@Z
?OnDragEnter@AgViewWinFrame@@UEAAKPEAVCOleDataObject@@KVCPoint@@@Z
?OnDragLeave@AgViewWinFrame@@UEAAXXZ
?OnDragOver@AgViewWinFrame@@UEAAKPEAVCOleDataObject@@KVCPoint@@@Z
??0AgViewWin32Window@@QEAA@PEAVCWnd@@@Z
registerAgViewWinControls
initWinTab
?ShowPanels@AgViewWinMainFrame@@QEAAXXZ
?HidePanels@AgViewWinMainFrame@@QEAAXXZ
?SuspendFullscreen@AgViewWinMainFrame@@QEAAX_N@Z
?SetScreenMode@AgViewWinMainFrame@@QEAAXW4ScreenMode@1@_N@Z
?RestoreWindowFromPrefs@AgViewWinMainFrame@@QEAAXXZ
SetViewWillHandleMenuKeys
AgGraphics_shutdown
?ShutdownAgUI@@YAXXZ
AgDialogs_isFolderDialogShowing
shutdownWinTab
?registerAgDocument@AgDocument@@SAHPEAUlua_State@@@Z
?GetThisClass@AgDocumentView@@SAPEAUCRuntimeClass@@XZ
?screenContainingView_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?viewLocationFromEvent_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?toPDF_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?makeFirstResponder_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?makeKeyAndOrderFront_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?restoreDefaultFocus_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?revealOnScreen_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?registerForDraggedTypes_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?setNeedsDisplay_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?display_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?displayIfNeeded_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?boundsRect_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?visibleBoundsRect_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?updateWindow_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?isHiddenOrHasHiddenAncestor_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?destroyManifestation_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?addChildWindow_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?frameChanged_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z
?OnRevealWindow@AgViewViewBehavior@@UEAAX_K_J_N2@Z
?ScrollIntoView@AgViewViewBehavior@@UEAAX_K_J@Z
?isHiddenOrHasHiddenAncestor@AgViewViewBehavior@@UEAA_NXZ
?AgView_changed_enabled_L@AgViewControlBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_font_L@AgViewControlBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_text_color_L@AgViewControlBehavior@@UEAAHPEAUlua_State@@@Z
?AgView_changed_user_entered_L@AgViewControlBehavior@@UEAAHPEAUlua_State@@@Z
??0CGTransform@@IEAA@MMMMMM@Z
??0CGTransform@@IEAA@XZ
??1AgNativeImage@@UEAA@XZ
?GetPixelFormat@AgNativeImage@@UEAAHXZ
??0AgPNGProviderWin@@IEAA@PEAD@Z
??0AgPNGProviderWin@@IEAA@PEAXPEBX_KP6AX012@Z@Z
??0AgPasteboard@@QEAA@PEAUlua_State@@@Z
??0AgGraphics@@IEAA@HHHV?$RCPtr@VAgColorSpace@@VRCObject@@@@@Z
??0AgGraphics@@IEAA@AEBV?$RCPtr@VAgGraphics@@VRCObject@@@@HH@Z
??0AgGraphics@@IEAA@PEAUHDC__@@_NV?$RCPtr@VAgColorSpace@@VRCObject@@@@@Z
??0AgGraphics@@IEAA@PEAUHWND__@@@Z
??0AgGraphics@@IEAA@PEAVGraphics@Gdiplus@@V?$RCPtr@VAgColorSpace@@VRCObject@@@@@Z
??0AgWinFont@@IEAA@AEBUtagLOGFONTW@@@Z
??0AgColorSpace@@IEAA@AEBV?$RCPtr@VAgDataProvider@@VRCObject@@@@@Z
??0AgColorSpace@@IEAA@W4AgColorSpaceEnum@@@Z
??0AgColorSpace@@IEAA@PEBX_K@Z
??0AgColorSpace@@IEAA@PEA_W@Z
??0AgColorSpace@@IEAA@PEAD_N@Z
?GetColorProfile@AgColorSpace@@AEAAPEAXXZ
?MakeLogicalColorSpace@AgColorSpace@@AEAA_NXZ
??1AgViewManifestationWin@@UEAA@XZ
?GetWnd@AgViewManifestationWin@@UEAAPEAVCWnd@@XZ
?InitializeFonts@AgViewManifestationWin@@UEAAXPEAUlua_State@@@Z
?Paint@AgViewManifestationWin@@UEAAXV?$RCPtr@VAgGraphicsD2D@@VRCObject@@@@AEBVCRect@@@Z
?Paint@AgViewManifestationWin@@UEAAXV?$RCPtr@VAgGraphicsD2D@@VRCObject@@@@@Z
?Paint@AgViewManifestationWin@@UEAAXV?$RCPtr@VAgGraphics@@VRCObject@@@@AEBVCRect@@@Z
?Paint@AgViewManifestationWin@@UEAAXV?$RCPtr@VAgGraphics@@VRCObject@@@@@Z
?creationFinalized_L@AgViewManifestationWin@@UEAAHPEAUlua_State@@@Z
?applyLayout_L@AgViewManifestationWin@@UEAAHPEAUlua_State@@@Z
?pushToLua@AgViewManifestationWin@@UEAAXPEAUlua_State@@@Z
?pushToLuaWithGC@AgViewManifestationWin@@UEAAXPEAUlua_State@@_N@Z
?isSkinned@AgViewManifestationWin@@UEAA_NXZ
?setSkin@AgViewManifestationWin@@UEAAXW4Skin@1@@Z
?getSkin@AgViewManifestationWin@@UEAA?AW4Skin@1@XZ
?getLuaFontRef@AgViewManifestationWin@@UEAA?AV?$RCPtr@VAgWinFont@@VRCObject@@@@XZ
?getLuaEmphasisFontRef@AgViewManifestationWin@@UEAA?AV?$RCPtr@VAgWinFont@@VRCObject@@@@XZ
?getUIColor@AgViewManifestationWin@@UEAAKW4SkinColors@1@@Z
?getForegroundColor@AgViewManifestationWin@@UEAAK_N@Z
?getBackgroundColor@AgViewManifestationWin@@UEAAK_N@Z
?SetEnabled@AgViewManifestationWin@@UEAAX_N@Z
?Refresh@AgViewManifestationWin@@UEAAX_N@Z
??0AgDocument@@IEAA@XZ
??1AgDocument@@UEAA@XZ
?OnNewDocument@AgDocument@@UEAAHXZ
?OnCloseDocument@AgDocument@@UEAAXXZ
?SaveModified@AgDocument@@UEAAHXZ
?Serialize@AgDocument@@UEAAXAEAVCArchive@@@Z
?SetModuleWithToolkitID@AgDocument@@QEAA_NAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?Create@AgViewWinMainFrame@@UEAAHPEB_W0KAEBUtagRECT@@PEAVCWnd@@0KPEAUCCreateContext@@@Z
?GetMessageMap@AgDocument@@MEBAPEBUAFX_MSGMAP@@XZ
?GetThisClass@AgDocument@@SAPEAUCRuntimeClass@@XZ
?LoadInitialModuleWithToolkitID@AgDocument@@IEAAXAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?setRedraw_L@AgViewViewBehavior@@UEAAHPEAUlua_State@@@Z

substrate

AgPreferences_getLanguageCode
AgNamespace_import
?removeSubkey@RegKey@@QEAA_NPEB_W@Z
AgVersion_getProductBuildNumber
?runScript@AgToolkitWin@@QEAAHPEAUlua_State@@PEBD@Z
?getAppToolkit@AgToolkitWin@@SAPEAV1@XZ
AgPreferences_setNativeStringForKey
GetMainWindow
AgUnitTests_runAllTestsForCommandLineWithUI
AgPathUtilsWin_stringByAppendingPathComponent
HandleASAPTasks
??0StRestoreStackContents@@QEAA@PEAUlua_State@@@Z
??1StRestoreStackContents@@QEAA@XZ
logBeforeEventTimeStamp
AgSubstrate_init
?UTF16ToUTF8@@YAHAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@2@AEAK@Z
WaitMessageWhileHandlingMainThreadAction
?AgStringUtils_CStringFromZString@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEBD@Z
AgPathUtilsWin_getStandardFilePath
AgNamespace_importOptional
AgShutdownNotification_callFinalShutdownProcs
??0RegKeyCU@@QEAA@PEB_WK_N@Z
?NativeStringFromUTF8@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEBD@Z
??0RegKey@@QEAA@QEAUHKEY__@@PEB_WK_N@Z
?getStringValue@RegKey@@QEAAPEA_WPEB_W@Z
?setStringValue@RegKey@@QEAAXPEB_W0@Z
?removeValue@RegKey@@QEAA_NPEB_W@Z
?addSubkey@RegKey@@QEAAPEAUHKEY__@@PEB_W00@Z
?enumValue@RegKey@@QEAAPEA_WJ@Z
??0RegKeyLM@@QEAA@PEB_WK_N@Z
AgNamespace_exportFunctions
?AgLua_checkNativeString@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PEAUlua_State@@H@Z
AgLua_pushNativeString
AgNamespace_importEntryWithCache
AgPathUtilsWin_getPathExtension
AgTempLuaState_begin
AgTempLuaState_restoreTop
AgTempLuaState_end
?push@AgLuaValueRef@@QEBAXPEAUlua_State@@@Z
?Instance@RCPtrNull@@SA?AV1@XZ
??1RCPtrBase@@QEAA@XZ
AgPreferences_stringForKey
AgPreferences_setLanguageCode
AgPreferences_unregister
AgWorkspace_exitViaCloseMainWindow
??1StTempLuaState@@QEAA@XZ
recordTimeInterval
AgDate_timeIntervalSinceReferenceDate
AgVersionSetup_init
AgMainThreadAction_release
AgMainThreadAction_trigger
AgNamespace_importOptionalEntry
AgMainThreadAction_copy
??1RCObject@@UEAA@XZ
??1RegKey@@QEAA@XZ
AgNamespace_importEntry
??0StTempLuaState@@QEAA@PEAUlua_State@@@Z
?initWithPath@AgToolkitWin@@MEAAXPEBD@Z
??1AgToolkitWin@@UEAA@XZ
?getInstance@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
?getInstance@AgToolkitWin@@UEAAPEAUHINSTANCE__@@XZ
?hasResource@AgToolkitWin@@UEAA_NPEBD@Z
?fileNamed@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
?getResourceByName@AgToolkitWin@@MEAA?AV?$auto_ptr@VAgMemoryBuffer@@@std@@PEBD@Z
?getCFunction@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
?resourcesInPath@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
?disableDebugFileSubstitution@AgToolkitWin@@UEAAHPEAUlua_State@@@Z
AgPathUtilsWin_stringByDeletingLastPathComponent
AgNamespace_pushFunctionTable
??1AgLuaValueRef@@UEAA@XZ
?ResetBase@RCPtrBase@@IEAAXPEAVRCObject@@@Z
?CountIt@RCPtrBase@@AEAAXXZ
AgSubstrate_setSharedDebugger

agkernel

AgLua_optString
lua_pushboolean
AgTransitQueue_enqueueAndReleaseCargo
AgLua_checkLightUserdata
AgLua_checkNumber
AgLua_errorText
AgTransitCargo_newTable
AgTransitQueue_release
AgTransitQueue_checkRetainFromLua
lua_gettable
lua_pushlightuserdata
lua_type
lua_pushlstring
AgTransitCargo_pushLightUserData
AgLua_toStringNoConvert
lua_pushstring
AgTransitCargo_pushBoolean
lua_pushnumber
AgLuaState_isMainUniverse
AgTransitCargo_pushString
lua_pcall
lua_toboolean
AgTransitQueue_newCargo
lua_settop
AgTransitCargo_pushNumber
AgLua_checkString
lua_settable
lua_pushvalue
lua_replace
lua_pushnil
AgLua_getMethodByName
AgLuaUniverse_mainClosing
lua_next
lua_tolstring
AgLua_throwProgramError
AgLua_checkInteger
lua_pushinteger
AgLua_setLogToConsole
lua_setfield
AgLua_checkBoolean
KrLuaCoverage_initCoverage
KrLuaCoverage_enableInstructionCoverage
AgLuaUniverse_getMain
lua_tointeger
AgExceptions_setThrowHook
AgLuaUniverse_close
AgLua_dumpTraceback
KrDebugger_open
AgLuaUniverse_createMainUniverse
KrLuaCoverage_enableLineCoverage
AgLua_popNil
KrInit
lua_rawseti
AgLua_setCodeCapturing
luaL_error
lua_createtable
lua_newuserdata
lua_call
lua_checkstack
lua_gettop
lua_getfield
lua_touserdata
lua_setmetatable

mfc140u

ord4752
ord1492
ord324
ord1040
ord2327
ord323
ord1039
ord2372
ord2370
ord1491
ord1489
ord4947
ord280
ord286
ord1033
ord1501
ord3728
ord5557
ord8903
ord9670
ord11432
ord9054
ord10828
ord10827
ord10411
ord9942
ord10122
ord5188
ord5196
ord14132
ord3947
ord3997
ord11775
ord2662
ord9175
ord4549
ord12341
ord12100
ord2511
ord13023
ord2767
ord7395
ord8093
ord10941
ord12256
ord5376
ord12466
ord10956
ord10713
ord3735
ord8772
ord5981
ord5408
ord2779
ord13468
ord13697
ord5080
ord5363
ord5552
ord9041
ord5339
ord5083
ord5229
ord5062
ord7460
ord7461
ord7450
ord5227
ord7922
ord290
ord1454
ord11806
ord2903
ord6002
ord4767
ord4828
ord4360
ord5582
ord13401
ord9384
ord4352
ord7393
ord3212
ord2967
ord14211
ord7651
ord14217
ord3209
ord6631
ord2629
ord3812
ord3279
ord3278
ord3172
ord9946
ord11850
ord10093
ord11184
ord4443
ord3723
ord5189
ord11484
ord2698
ord8904
ord7912
ord9043
ord8521
ord5743
ord11119
ord4353
ord2510
ord5726
ord13358
ord5727
ord13360
ord13351
ord5722
ord1766
ord12142
ord5917
ord4873
ord4872
ord8095
ord2212
ord296
ord12443
ord13986
ord4511
ord14360
ord14026
ord4656
ord2921
ord285
ord5709
ord13618
ord1503
ord9976
ord9978
ord9977
ord9975
ord1059
ord9979
ord5451
ord11718
ord11414
ord11719
ord365
ord3731
ord5706
ord11415
ord11921
ord7920
ord11933
ord11901
ord8167
ord265
ord266
ord8451
ord14027
ord4510
ord2909
ord1670
ord14043
ord1511
ord1034
ord316
ord8830
ord8900
ord9941
ord3718
ord5555
ord2273
ord2270
ord11625
ord14221
ord14219
ord14209
ord6505
ord8656
ord2222
ord7233
ord13761
ord13864
ord8026
ord1775
ord941
ord6614
ord983
ord8159
ord13545
ord6122
ord14289
ord6123
ord14290
ord6729
ord10691
ord3173
ord13513
ord6121
ord14288
ord7719
ord12212
ord14088
ord1844
ord11665
ord11664
ord2011
ord11709
ord11928
ord7668
ord12625
ord3949
ord11944
ord4011
ord11940
ord1700
ord1722
ord1748
ord1734
ord9089
ord1755
ord4776
ord14216
ord4843
ord7650
ord14210
ord12223
ord4788
ord4806
ord4800
ord12222
ord2439
ord5183
ord8023
ord4794
ord4853
ord4837
ord4782
ord4859
ord7716
ord12544
ord12606
ord10124
ord11929
ord8084
ord1450
ord4814

kernel32

GetVolumeInformationA
FileTimeToSystemTime
GetConsoleMode
SetConsoleMode
GetDriveTypeA
LocalFileTimeToFileTime
SetFilePointer
GetLocalTime
DosDateTimeToFileTime
SetVolumeLabelA
SystemTimeToFileTime
GetLocaleInfoA
GetConsoleScreenBufferInfo
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
InitializeCriticalSection
CreateMutexA
GetCurrentProcess
SetEvent
lstrcpynA
lstrlenA
RtlVirtualUnwind
LoadLibraryA
FlushConsoleInputBuffer
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
LocalAlloc
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetVersion
SetFileAttributesA
ReadFile
GetFullPathNameA
FileTimeToLocalFileTime
CreateFileA
CopyFileW
GetModuleHandleA
GetWindowsDirectoryW
DeviceIoControl
SetFileTime
SetEndOfFile
RemoveDirectoryW
GetFileTime
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
GetEnvironmentVariableW
FormatMessageA
LocalFree
TlsFree
TlsAlloc
GetFileAttributesA
FindNextFileA
FindFirstFileA
GetModuleHandleW
WriteFile
GetFileType
AreFileApisANSI
LeaveCriticalSection
EnterCriticalSection
lstrcmpW
GetTickCount
CreateProcessW
SetCurrentDirectoryW
HeapSetInformation
CloseHandle
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
CreateMutexW
GetCommandLineW
WideCharToMultiByte
GetStdHandle
GetProcessHeap
DeleteCriticalSection
HeapAlloc
OutputDebugStringW
RaiseException
GetACP
CreateEventW
GetLastError
MultiByteToWideChar
GetModuleFileNameW
HeapFree
FreeLibrary
GetProcAddress
LoadLibraryW
lstrcmpiA
InitializeCriticalSectionEx

user32

SendMessageW
SetWindowPos
PostMessageW
GetKeyState
CharToOemA
ShowWindow
GetUserObjectInformationW
MessageBoxW
OemToCharA
IsWindow
UpdateWindow
FindWindowW
SetForegroundWindow
IsIconic
InvalidateRect
GetProcessWindowStation

advapi32

GetSecurityDescriptorSacl
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
OpenProcessToken
AdjustTokenPrivileges
SetKernelObjectSecurity
IsValidSid
IsValidSecurityDescriptor
IsValidAcl
DeregisterEventSource
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
LookupPrivilegeValueA
GetKernelObjectSecurity

shell32

SHAddToRecentDocs
SHGetFolderPathW

comctl32

InitCommonControlsEx

shlwapi

PathQuoteSpacesW
StrStrW

msvcp140

?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Strxfrm
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?uncaught_exception@std@@YA_NXZ
?_BADOFF@std@@3_JB
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

ole32

CoInitialize
CoCreateInstance
CoUninitialize

ws2_32

WSACleanup
WSAStartup

crypt32

CertFreeCertificateChain
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetCertificateChain
CertOpenSystemStoreA
CertCreateCertificateContext

vcruntime140

__vcrt_InitializeCriticalSectionEx
__C_specific_handler
__RTDynamicCast
wcsstr
memcmp
memset
strstr
memcpy
__CxxFrameHandler3
_CxxThrowException
__std_terminate
_purecall
memmove
__std_exception_destroy
__std_exception_copy
memchr
strchr

api-ms-win-crt-convert-l1-1-0

strtoul
atoi

api-ms-win-crt-string-l1-1-0

isxdigit
mblen
strcmp
isupper
_strnicmp
isdigit
isalnum
_strupr
tolower
strncpy
isspace
strncat
isprint
_stricmp
wcscat_s
strncmp
isalpha

api-ms-win-crt-stdio-l1-1-0

fopen
fclose
_setmode
putc
ftell
__stdio_common_vsprintf
fseek
_fileno
_wfopen
_get_osfhandle
_set_fmode
fputs
fgets
ferror
__stdio_common_vfprintf
__p__commode
__acrt_iob_func
__stdio_common_vsprintf_s
_get_stream_buffer_pointers
_fseeki64
fsetpos
_isatty
__stdio_common_vsscanf
ungetc
fputc
_close
_read
_mktemp
fflush
_open
_write
__stdio_common_vswprintf
setvbuf
fgetpos
_lseeki64
fwrite
feof
__stdio_common_vswscanf
fread
fgetc

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_chmod
_unlock_file
rename
_stat64
_unlink
_mkdir

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
free
realloc

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment
_invalid_parameter_noinfo_noreturn
_errno
raise
_exit
terminate
signal
_crt_atexit
_register_onexit_function
_initialize_onexit_table
strerror
exit
perror
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_initterm_e
_initterm
_get_wide_winmain_command_line
_set_app_type
_configure_wide_argv
_seh_filter_exe
_invalid_parameter_noinfo

api-ms-win-crt-time-l1-1-0

_difftime64
_gmtime64
_localtime64
_tzset
_time64
_mktime64

api-ms-win-crt-environment-l1-1-0

getenv
_putenv

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale
___mb_cur_max_func

api-ms-win-crt-utility-l1-1-0

rand
qsort
srand

api-ms-win-crt-multibyte-l1-1-0

_mbsinc
_mbsrchr
_mbclen
_mbschr

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-math-l1-1-0

__setusermatherr
ceilf

libcef

cef_shutdown

Exports

Exports

??0AgDragTargetViewBehavior@@QEAA@$$QEAV0@@Z
??0AgDragTargetViewBehavior@@QEAA@AEBV0@@Z
??0AgDragTargetViewBehavior@@QEAA@XZ
??0AgLuaValueRef@@QEAA@AEBV0@@Z
??0AgNativeImage@@QEAA@AEBV0@@Z
??0AgTiledImage@@QEAA@AEBV0@@Z
??0AgTiledImage@@QEAA@XZ
??0AgToolkitWin@@QEAA@AEBV0@@Z
??0AgViewControlBehavior@@QEAA@$$QEAV0@@Z
??0AgViewControlBehavior@@QEAA@AEBV0@@Z
??0AgViewControlBehavior@@QEAA@XZ
??0AgViewManifestationWin@@QEAA@AEBV0@@Z
??0AgViewViewBehavior@@QEAA@$$QEAV0@@Z
??0AgViewViewBehavior@@QEAA@AEBV0@@Z
??0CWinHDCScope@@QEAA@AEBV0@@Z
??0MainThreadReceiverAction@@QEAA@$$QEAV0@@Z
??0MainThreadReceiverAction@@QEAA@AEBV0@@Z
??0MainThreadReceiverAction@@QEAA@XZ
??0RCObject@@QEAA@AEBV0@@Z
??0RCObject@@QEAA@XZ
??0RCPtrBase@@IEAA@AEBV0@@Z
??0RCPtrBase@@IEAA@AEBVRCPtrNull@@@Z
??0RCPtrBase@@IEAA@PEAVRCObject@@@Z
??0RCPtrBase@@IEAA@XZ
??0RCPtrNull@@QEAA@XZ
??0ReferenceCount@@QEAA@AEBV0@@Z
??0ReferenceCount@@QEAA@XZ
??1AgImage@@UEAA@XZ
??1AgPNGProviderWin@@MEAA@XZ
??1AgTiledImage@@UEAA@XZ
??1AgViewWinSwitcherView@@UEAA@XZ
??1ReferenceCount@@QEAA@XZ
??1RegKeyCR@@QEAA@XZ
??1RegKeyCU@@QEAA@XZ
??1RegKeyLM@@QEAA@XZ
??4AgDragTargetViewBehavior@@QEAAAEAV0@$$QEAV0@@Z
??4AgDragTargetViewBehavior@@QEAAAEAV0@AEBV0@@Z
??4AgDraggingInfo@@QEAAAEAV0@$$QEAV0@@Z
??4AgDraggingInfo@@QEAAAEAV0@AEBV0@@Z
??4AgLuaValueRef@@QEAAAEAV0@AEBV0@@Z
??4AgMutexScope@@QEAAAEAV0@AEBV0@@Z
??4AgNativeImage@@QEAAAEAV0@AEBV0@@Z
??4AgPasteboard@@QEAAAEAV0@AEBV0@@Z
??4AgTiledImage@@QEAAAEAV0@AEBV0@@Z
??4AgToolkitWin@@QEAAAEAV0@AEBV0@@Z
??4AgViewControlBehavior@@QEAAAEAV0@$$QEAV0@@Z
??4AgViewControlBehavior@@QEAAAEAV0@AEBV0@@Z
??4AgViewManifestationWin@@QEAAAEAV0@AEBV0@@Z
??4AgViewViewBehavior@@QEAAAEAV0@$$QEAV0@@Z
??4AgViewViewBehavior@@QEAAAEAV0@AEBV0@@Z
??4CWinHDCScope@@QEAAAEAV0@AEBV0@@Z
??4MainThreadReceiverAction@@QEAAAEAV0@$$QEAV0@@Z
??4MainThreadReceiverAction@@QEAAAEAV0@AEBV0@@Z
??4RCObject@@QEAAAEAV0@AEBV0@@Z
??4RCPtrBase@@AEAAXAEBV0@@Z
??4RCPtrNull@@QEAAAEAV0@$$QEAV0@@Z
??4RCPtrNull@@QEAAAEAV0@AEBV0@@Z
??4ReferenceCount@@QEAAAEAV0@AEBV0@@Z
??4RegKey@@QEAAAEAV0@AEBV0@@Z
??4RegKeyCR@@QEAAAEAV0@$$QEAV0@@Z
??4RegKeyCR@@QEAAAEAV0@AEBV0@@Z
??4RegKeyCU@@QEAAAEAV0@$$QEAV0@@Z
??4RegKeyCU@@QEAAAEAV0@AEBV0@@Z
??4RegKeyLM@@QEAAAEAV0@$$QEAV0@@Z
??4RegKeyLM@@QEAAAEAV0@AEBV0@@Z
??7RCPtrBase@@QEBA_NXZ
??8RCPtrBase@@AEBA_NAEBV0@@Z
??9RCPtrBase@@AEBA_NAEBV0@@Z
??IRCObject@@AEBAXXZ
??_7AgDragTargetViewBehavior@@6B@
??_7AgLuaValueRef@@6B@
??_7AgNativeImage@@6B@
??_7AgPNGProviderWin@@6B@
??_7AgTiledImage@@6B@
??_7AgToolkitWin@@6B@
??_7AgViewControlBehavior@@6B@
??_7AgViewManifestationWin@@6B@
??_7AgViewViewBehavior@@6B@
??_7MainThreadReceiverAction@@6B@
??_7RCObject@@6B@
??_FAgPasteboard@@QEAAXXZ
??_FAgViewWin32Window@@QEAAXXZ
??_FStTempLuaState@@QEAAXXZ
?AllowMultipleDestruct@RCObject@@QEAAXXZ
?AllowMultipleDestruct@ReferenceCount@@QEAAXXZ
?CanBecomeKeyWindow@AgViewWin32Window@@UEAA_NXZ
?CanBecomeVisible@AgViewWin32Window@@QEAA_NXZ
?CloneImageWithColorProfile@AgImage@@QEAAPEAVAgTiledImage@@AEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?CloneImageWithColorSpace@AgImage@@QEAAPEAVAgTiledImage@@AEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?Compare@RCPtrBase@@IEBA_NAEBV1@@Z
?CompareNull@RCPtrBase@@IEBA_NXZ
?ComparePointer@RCPtrBase@@IEBA_NPEBVRCObject@@@Z
?CreatedByLua@AgViewManifestationWin@@QEBA_NXZ
?Decrement@ReferenceCount@@QEBA_NXZ
?GetActiveCatalogPath@AgDocument@@UEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetAlwaysShowBars@AgViewWinPanelHost@@QEAA_NXZ
?GetAppInstance@@YAPEAUHINSTANCE__@@XZ
?GetColorSpace@AgGraphics@@QEAA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@XZ
?GetColorSpace@AgImage@@QEAA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@XZ
?GetCurrentModule@AgDocument@@QEAAPEAUAgModule@@XZ
?GetCurrentPath@AgGraphics@@QEAAPEAVGraphicsPath@Gdiplus@@XZ
?GetD2DBitmap@AgNativeImage@@QEAAPEAUID2D1Bitmap@@XZ
?GetDC@CWinHDCScope@@QEAAPEAUHDC__@@XZ
?GetDataAndSize@AgDataProvider@@QEBAXAEAPEAXAEA_K@Z
?GetDocument@AgDocumentView@@QEBAPEAVAgDocument@@XZ
?GetDocumentPath@AgDocument@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetFamilyName@AgWinFont@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetFirstMargin@AgViewWinPanel@@QEAAHXZ
?GetFirstPanel@AgViewWinPanelHost@@QEAAAEAVAgViewWinPanel@@XZ
?GetFont@AgWinFont@@QEBAPEAVFont@Gdiplus@@XZ
?GetFontName@AgWinFont@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetFontSize@AgWinFont@@QEBAMXZ
?GetHWnd@AgViewManifestationWin@@UEAAPEAUHWND__@@XZ
?GetLastMargin@AgViewWinPanel@@QEAAHXZ
?GetLastPanel@AgViewWinPanelHost@@QEAAAEAVAgViewWinPanel@@XZ
?GetMaximumSize@AgViewWinPanel@@QEBAHXZ
?GetMinimumSize@AgViewWinPanel@@QEBAHXZ
?GetNativeGraphics@AgGraphics@@QEAAPEAVGraphics@Gdiplus@@XZ
?GetNativeImageRef@AgImage@@QEAA?AV?$RCPtr@VAgNativeImage@@VRCObject@@@@XZ
?GetOffscreenBitmap@AgGraphics@@QEAAPEAVBitmap@Gdiplus@@XZ
?GetPreferredFamilyName@AgWinFont@@QEBA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetPreviousModule@AgDocument@@QEAAPEAUAgModule@@XZ
?GetProfilePath@AgColorSpace@@QEAA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetProviderType@AgDataProvider@@UEAA?AW4WinDataProviderType@@XZ
?GetProviderType@AgPNGProviderWin@@UEAA?AW4WinDataProviderType@@XZ
?GetResizable@AgViewWinPanel@@QEBA_NXZ
?GetSize@AgViewManifestationWin@@QEAAAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetStrokeColor@AgGraphics@@QEAAXAEAVColor@Gdiplus@@@Z
?GetTooltip@AgViewManifestationWin@@QEBAAEBV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetTopWindow@AgViewWinPanelHost@@QEAAPEAVCWnd@@XZ
?HasFirstPanel@AgViewWinPanelHost@@QEAA_NXZ
?HasLastPanel@AgViewWinPanelHost@@QEAA_NXZ
?HasNativeImage@AgImage@@QEAA_NXZ
?HasProfile@AgImage@@QEAA_NXZ
?Increment@ReferenceCount@@QEBAXXZ
?IsAutoLayout@AgViewManifestationWin@@QEAA_NXZ
?IsAutoResize@AgViewManifestationWin@@QEAA_NXZ
?IsComposited@AgViewManifestationWin@@QEAA_NXZ
?IsFloating@AgViewWinPanel@@QEAA_NXZ
?IsInMainFrame@AgViewWinPanelHost@@QEAA_NXZ
?IsLayoutPaused@AgViewManifestationWin@@QEAA_NXZ
?IsPrinterContext@AgGraphics@@QEAA_NXZ
?IsRedrawPaused@AgViewManifestationWin@@QEAA_NXZ
?IsShared@RCObject@@QEBA_NXZ
?IsShared@ReferenceCount@@QEBA_NXZ
?IsToolWindow@AgViewWin32Window@@QEAA_NXZ
?IsUniquelyReferenced@ReferenceCount@@QEBA_NXZ
?IsUnreferenced@ReferenceCount@@QEBA_NXZ
?IsVisible@AgViewWinPanel@@QEAA_NXZ
?LoadDefaultModule@AgDocument@@UEAAXXZ
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@AEBV?$RCPtr@VAgDataProvider@@VRCObject@@@@@Z
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@PEAD_N@Z
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@PEA_W@Z
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@PEBX_K@Z
?Make@AgColorSpace@@SA?AV?$RCPtr@VAgColorSpace@@VRCObject@@@@W4AgColorSpaceEnum@@@Z
?Make@AgDataProvider@@SA?AV?$RCPtr@VAgDataProvider@@VRCObject@@@@PEAXPEBX_KP6AX012@Z@Z
?Make@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@PEAUHDC__@@_NV?$RCPtr@VAgColorSpace@@VRCObject@@@@@Z
?Make@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@PEAUHWND__@@@Z
?Make@AgPNGProviderWin@@SA?AV?$RCPtr@VAgPNGProviderWin@@VAgDataProvider@@@@PEAD@Z
?Make@AgPNGProviderWin@@SA?AV?$RCPtr@VAgPNGProviderWin@@VAgDataProvider@@@@PEAXPEBX_KP6AX012@Z@Z
?Make@AgWinFont@@SA?AV?$RCPtr@VAgWinFont@@VRCObject@@@@AEBUtagLOGFONTW@@@Z
?Make@CGTransform@@SA?AV?$RCPtr@VCGTransform@@VRCObject@@@@MMMMMM@Z
?Make@CGTransform@@SA?AV?$RCPtr@VCGTransform@@VRCObject@@@@XZ
?MakeOffscreen@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@AEBV2@HH@Z
?MakeOffscreen@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@HHHHV?$RCPtr@VAgColorSpace@@VRCObject@@@@PEAE@Z
?MakeOffscreen@AgGraphics@@SA?AV?$RCPtr@VAgGraphics@@VRCObject@@@@HHV?$RCPtr@VAgColorSpace@@VRCObject@@@@W4CGImageAlphaInfo@@@Z
?Paint@AgViewManifestationWin@@UEAAXPEAVCDC@@@Z
?PauseLayout@AgViewManifestationWin@@QEAAX_N@Z
?PerformMainThreadAction@MainThreadReceiverAction@@UEAAXXZ
?Pointer@RCPtrBase@@IEBAPEAVRCObject@@XZ
?PreCreateWindow@AgViewWinPanel@@UEAAHAEAUtagCREATESTRUCTW@@@Z
?PushUndoManager@AgDocument@@UEAAXPEAUlua_State@@@Z
?ReleaseNativeImage@AgNativeImage@@UEAAXXZ
?ResetBase@RCPtrBase@@IEAAXAEBV1@@Z
?ResumePanels@AgDocumentView@@QEAAXXZ
?RevealChild@AgViewViewBehavior@@UEAAXPEAUHWND__@@@Z
?RevealRect@AgViewViewBehavior@@UEAAXPEAVCRect@@PEAUHWND__@@@Z
?SetAlwaysShowBars@AgViewWinPanelHost@@QEAAX_N@Z
?SetAutoLayout@AgViewManifestationWin@@QEAAX_N@Z
?SetAutoResize@AgViewManifestationWin@@QEAAX_N@Z
?SetCanBecomeVisible@AgViewWin32Window@@QEAAX_N@Z
?SetComposited@AgViewManifestationWin@@QEAAX_N@Z
?SetCreatedByLua@AgViewManifestationWin@@UEAAX_N@Z
?SetD2DBitmap@AgNativeImage@@QEAAXPEAUID2D1Bitmap@@@Z
?SetDualSize@AgViewWinPanel@@QEAAX_N@Z
?SetFillWithChild@AgViewWin32Window@@QEAAX_N@Z
?SetFirstMargin@AgViewWinPanel@@QEAAXH@Z
?SetIsSecondaryWindow@AgViewWinPanelHost@@QEAAX_N@Z
?SetLastMargin@AgViewWinPanel@@QEAAXH@Z
?SetResizable@AgViewWinPanel@@QEAAX_N@Z
?SetSdkNonModalWindow@AgViewWinFrame@@QEAAX_N@Z
?SetToResumeFocus@AgDocumentView@@QEAAXPEAVCWnd@@@Z
?ShouldDeleteObjectAfterPerformingAction@MainThreadReceiverAction@@UEAA_NXZ
?SuspendPanels@AgDocumentView@@QEAAXXZ
?UseGdiPlusForText@AgGraphics@@QEAA_N_N@Z
?UsePointer@RCPtrBase@@IEBAPEAVRCObject@@XZ
?Verify@AgColorSpace@@QEAA_NXZ
?getClassName@AgDocument@@SAPEBDXZ
?getKey@RegKey@@QEAAPEAUHKEY__@@XZ
?getName@RegKey@@QEAAPEA_WXZ
?getResult@RegKey@@QEAAJXZ
?getTypeName@AgDataProvider@@UEAAPEBDXZ
?getTypeName@AgGraphics@@UEAAPEBDXZ
?getTypeName@AgImage@@UEAAPEBDXZ
?getTypeName@AgPNGProviderWin@@UEAAPEBDXZ
?getTypeName@RCObject@@UEAAPEBDXZ
?isSdkFloatingDialog@AgViewWinFrame@@QEAA_NXZ
?skinChanged@AgViewManifestationWin@@UEAAXXZ
AgApplication_load
AgLicenseController_load_L
private_load_AgCreativeCloudUtils
registerAgCreativeCloudUtils

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 579KB - Virtual size: 579KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 234KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12.8MB - Virtual size: 12.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

831ec1128f4cfd5512bdbd9546a9500b

Code Sign

0f:a1:8a:29:f8:52:96:a4:55:ac:5e:d0:0c:86:c0:aeCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

30:f9:de:68:20:f2:3f:64:e3:7c:bc:20:04:23:4e:00:5c:de:a6:38:25:7c:a1:a7:b5:06:c8:cd:cc:72:b7:a9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

amtlib

crclient

headlights

ui

substrate

agkernel

mfc140u

kernel32

user32

advapi32

shell32

comctl32

shlwapi

msvcp140

ole32

ws2_32

crypt32

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-math-l1-1-0

libcef

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 579KB - Virtual size: 579KB

.data Size: 234KB - Virtual size: 1.3MB

.pdata Size: 56KB - Virtual size: 56KB

.gfids Size: 512B - Virtual size: 72B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 12.8MB - Virtual size: 12.8MB

0f:a1:8a:29:f8:52:96:a4:55:ac:5e:d0:0c:86:c0:ae
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

30:f9:de:68:20:f2:3f:64:e3:7c:bc:20:04:23:4e:00:5c:de:a6:38:25:7c:a1:a7:b5:06:c8:cd:cc:72:b7:a9
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 579KB - Virtual size: 579KB

.data
Size: 234KB - Virtual size: 1.3MB

.pdata
Size: 56KB - Virtual size: 56KB

.gfids
Size: 512B - Virtual size: 72B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 12.8MB - Virtual size: 12.8MB