Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Overview
overview
10Static
static
7OutlookUpdate.exe
windows7-x64
1OutlookUpdate.exe
windows10-2004-x64
1morrowind-2efdb9.exe
windows7-x64
1morrowind-2efdb9.exe
windows10-2004-x64
10morrowind-a5fa52.exe
windows7-x64
1morrowind-a5fa52.exe
windows10-2004-x64
1查询企�...bb.exe
windows7-x64
8查询企�...bb.exe
windows10-2004-x64
8查询企�...0a.exe
windows7-x64
8查询企�...0a.exe
windows10-2004-x64
8查询企�...01.exe
windows7-x64
8查询企�...01.exe
windows10-2004-x64
8查询通�...05.exe
windows7-x64
1查询通�...05.exe
windows10-2004-x64
1测试@ssdp8.exe
windows7-x64
1测试@ssdp8.exe
windows10-2004-x64
1Behavioral task
behavioral1
Sample
OutlookUpdate.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
OutlookUpdate.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
morrowind-2efdb9.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
morrowind-2efdb9.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
morrowind-a5fa52.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
morrowind-a5fa52.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
查询企业票6001-45b5bb.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
查询企业票6001-45b5bb.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
查询企业票6001-b0e80a.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
查询企业票6001-b0e80a.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
查询企业票6001.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
查询企业票6001.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
查询通用版9205.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
查询通用版9205.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
测试@ssdp8.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
测试@ssdp8.exe
Resource
win10v2004-20240226-en
Target
infected2024030801.rar
Size
2.8MB
MD5
468cb612990461a9389e21c5c52c1add
SHA1
d047aff9b980609383a0699df8b661a107b08efc
SHA256
e94f90902e900bdf40f10c68811f6d7bd67cc54f7727af3a9a49488d61824a62
SHA512
1763ef462c5b5f4d6905b6338f55bc706e153c440f1c807ba649d2c25c3829be90e9202ca59eb0c370f36b9dea4be2c3b758b4375cafd5c1d15b1682a7d4c170
SSDEEP
49152:ZHanQTRX/VNmr/8PajhystfAedH+GpptMFLnt6Qn8QuBTCfu/dTt4fnmOAfuUjmO:ZQQJTKUqfHpptgZ6Q3QCfu/dTCmhJVjL
resource | yara_rule |
---|---|
static1/unpack001/查询企业票6001-45b5bb.exe.vir | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack001/OutlookUpdate.exe.vir |
unpack001/morrowind-2efdb9.exe.vir |
unpack001/morrowind-a5fa52.exe.vir |
unpack001/查询企业票6001-45b5bb.exe.vir |
unpack002/out.upx |
unpack001/查询通用版9205.exe.vir |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetProcAddress
LoadLibraryExW
VirtualAlloc
VirtualProtect
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
FormatMessageA
LoadLibraryA
GetThreadLocale
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
CloseHandle
CreateFileW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
OpenProcess
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQueryEx
GetModuleFileNameW
GetModuleHandleW
DeviceIoControl
GetLastError
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualQuery
VirtualProtectEx
SetLastError
IsProcessorFeaturePresent
CheckRemoteDebuggerPresent
GetProcAddress
CreateFileW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
RegOpenKeyExW
RegQueryInfoKeyW
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
__current_exception
__C_specific_handler
strstr
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
memcpy
memmove
__current_exception_context
__CxxFrameHandler4
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
__p___argv
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_initterm
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_initterm_e
_invalid_parameter_noinfo_noreturn
_set_app_type
_exit
exit
_seh_filter_exe
__p___argc
__p__commode
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func
strcmp
strlen
free
_callnewh
malloc
_set_new_mode
__setusermatherr
_configthreadlocale
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
WaitForSingleObject
CreateThread
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
DeviceIoControl
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
GetLastError
VirtualAlloc
CreateFileW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
RegOpenKeyExW
RegQueryInfoKeyW
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?good@ios_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
WinHttpOpenRequest
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpQueryDataAvailable
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
__current_exception
__current_exception_context
_except_handler4_common
__CxxFrameHandler3
memset
_cexit
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
__p___argv
_initialize_narrow_environment
_configure_narrow_argv
exit
__p___argc
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_initterm
_set_app_type
_seh_filter_exe
_exit
_errno
_initialize_onexit_table
_initterm_e
_invalid_parameter_noinfo_noreturn
_c_exit
__stdio_common_vfprintf
__acrt_iob_func
__p__commode
_set_fmode
strlen
strtok
_set_new_mode
free
malloc
_callnewh
strtol
__setusermatherr
_configthreadlocale
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sleep
VirtualProtect
GetModuleHandleA
GetProcAddress
GetCurrentThread
LoadLibraryW
FreeLibrary
QueueUserAPC
GetCommandLineW
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetLastError
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
RaiseException
RtlPcToFileHeader
HeapFree
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
GetLocaleInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
WideCharToMultiByte
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sleep
VirtualProtect
GetModuleHandleA
GetProcAddress
GetCurrentThread
LoadLibraryW
FreeLibrary
QueueUserAPC
GetCommandLineW
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetLastError
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
RaiseException
RtlPcToFileHeader
HeapFree
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
GetLocaleInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
WideCharToMultiByte
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
D:\Rust\loader\target\release\deps\loader.pdb
SetHandleInformation
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetStdHandle
GetConsoleMode
GetCurrentThreadId
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentProcess
GetEnvironmentVariableW
GetFinalPathNameByHandleW
SetFileCompletionNotificationModes
PostQueuedCompletionStatus
SetLastError
CreateThread
TryAcquireSRWLockExclusive
QueryPerformanceCounter
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentProcessId
CreateMutexA
WaitForSingleObjectEx
LoadLibraryA
ReleaseMutex
RtlVirtualUnwind
AcquireSRWLockShared
ReleaseSRWLockShared
WakeConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
GetQueuedCompletionStatusEx
InitializeSListHead
IsDebuggerPresent
WakeAllConditionVariable
HeapCreate
GetLastError
CreateIoCompletionPort
SetThreadStackGuarantee
AddVectoredExceptionHandler
SwitchToThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
HeapReAlloc
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
HeapFree
CloseHandle
HeapAlloc
GetProcessHeap
BCryptGenRandom
freeaddrinfo
getsockopt
connect
bind
WSAIoctl
ioctlsocket
WSASocketW
setsockopt
WSACleanup
shutdown
closesocket
recv
send
WSASend
getpeername
getaddrinfo
getsockname
WSAGetLastError
WSAStartup
RtlNtStatusToDosError
NtCreateFile
NtCancelIoFileEx
NtDeviceIoControlFile
NtWriteFile
CertDuplicateCertificateContext
CertAddCertificateContextToStore
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateStore
CertDuplicateCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertOpenStore
CertGetCertificateChain
ApplyControlToken
EncryptMessage
DeleteSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleA
DecryptMessage
InitializeSecurityContextW
AcceptSecurityContext
QueryContextAttributesW
FreeContextBuffer
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
SystemFunction036
__C_specific_handler
memcmp
memset
__current_exception_context
__current_exception
memcpy
memmove
__CxxFrameHandler3
__p___argc
__p___argv
_cexit
_exit
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
exit
_initterm_e
_initialize_narrow_environment
_set_app_type
_initialize_onexit_table
_register_onexit_function
_initterm
_c_exit
_seh_filter_exe
_crt_atexit
_configure_narrow_argv
terminate
__setusermatherr
_set_fmode
__p__commode
_configthreadlocale
_set_new_mode
free
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetStdHandle
ExitProcess
GetFileType
SetStdHandle
HeapQueryInformation
GetCommandLineW
GetCommandLineA
QueryPerformanceFrequency
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
VirtualQuery
VirtualAlloc
GetSystemInfo
RtlUnwind
GetStringTypeW
LCMapStringEx
RaiseException
OutputDebugStringW
CompareStringW
LCMapStringW
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
CreateFileW
WriteConsoleW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
IsValidLocale
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetWindowsDirectoryA
FindResourceExW
SystemTimeToTzSpecificLocalTime
LocalFileTimeToFileTime
GetFileSizeEx
GetFileAttributesExA
FileTimeToLocalFileTime
GetACP
GetTempPathA
GetStringTypeExA
MoveFileA
lstrcmpiA
GetShortPathNameA
LoadLibraryExA
DuplicateHandle
GetVolumeInformationA
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
FlushFileBuffers
FindFirstFileA
FindClose
DeleteFileA
Sleep
SearchPathA
GetProfileIntA
GetCPInfo
GetOEMCP
GlobalFlags
LocalReAlloc
LocalAlloc
GlobalHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetUserDefaultLCID
ReplaceFileA
GetTempFileNameA
SetFileTime
GetFullPathNameA
GetFileTime
GetDiskFreeSpaceA
GetTickCount64
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetVersionExA
GetCurrentThread
GetThreadLocale
SystemTimeToFileTime
FileTimeToSystemTime
lstrcmpA
VerifyVersionInfoA
VerSetConditionMask
CopyFileA
FormatMessageA
LocalFree
MulDiv
GetCurrentDirectoryA
ResumeThread
SetThreadPriority
WaitForSingleObject
GlobalFree
GlobalSize
GlobalReAlloc
GlobalAlloc
GetFileSize
GetFileAttributesA
lstrcpyA
CompareStringA
GlobalFindAtomA
FindResourceA
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
FreeLibrary
GetSystemDirectoryW
GetCurrentThreadId
EncodePointer
MultiByteToWideChar
GlobalGetAtomNameA
GlobalAddAtomA
GlobalLock
GlobalUnlock
LoadLibraryW
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetCurrentProcessId
SetLastError
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
OpenProcess
VirtualProtect
GetCurrentProcess
VirtualAllocExNuma
GetModuleFileNameA
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
WriteFile
CreateFileA
GetProcessHeap
DeleteCriticalSection
DecodePointer
WideCharToMultiByte
HeapAlloc
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
HeapFree
FindResourceW
LoadResource
LockResource
SizeofResource
CreateThread
SetRect
LockWindowUpdate
GetUpdateRect
CopyImage
LoadImageW
FillRect
DrawStateA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
DrawIconEx
SetMenuDefaultItem
GetMenuDefaultItem
AppendMenuA
GetMenuState
NotifyWinEvent
LoadCursorW
LoadCursorA
WindowFromPoint
GetCursorPos
MessageBeep
DeleteMenu
GetSystemMenu
KillTimer
SetTimer
SetCapture
GetAsyncKeyState
CharUpperA
TrackMouseEvent
IsDialogMessageA
SetWindowTextA
SendDlgItemMessageA
CheckDlgButton
SetDlgItemTextA
MoveWindow
TranslateMDISysAccel
DefMDIChildProcA
DefFrameProcA
DrawMenuBar
SetMenuItemInfoA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetMonitorInfoA
MonitorFromWindow
GetScrollInfo
SetScrollInfo
LoadIconA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
PtInRect
MapWindowPoints
MessageBoxA
AdjustWindowRectEx
GetWindowTextLengthA
UnionRect
RemovePropA
GetPropA
SetPropA
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
ValidateRect
EndPaint
BeginPaint
GetForegroundWindow
TrackPopupMenu
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
RemoveMenu
IsMenu
CreateWindowExA
GetClassInfoExA
RegisterClassA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
DispatchMessageA
ReuseDDElParam
UnpackDDElParam
WinHelpA
DrawEdge
DrawFrameControl
DrawFocusRect
SetLayeredWindowAttributes
EnumDisplayMonitors
GetParent
SetRectEmpty
LoadMenuW
DestroyIcon
LoadIconW
GetLastActivePopup
GetWindowThreadProcessId
GetClassNameA
GetDesktopWindow
SetWindowLongA
GetWindowLongA
EqualRect
IntersectRect
SetCursor
SetActiveWindow
InsertMenuItemA
GetMenuItemCount
GetMenuItemID
DestroyMenu
CreatePopupMenu
SetMenu
GetMenu
LoadMenuA
TranslateAcceleratorA
GetKeyNameTextA
MapVirtualKeyA
GetDC
ReleaseDC
GetMenuStringA
GetMenuItemInfoA
SystemParametersInfoA
RegisterClipboardFormatA
GetSysColorBrush
SetClassLongA
GetMessageA
TranslateMessage
DestroyAcceleratorTable
UpdateLayeredWindow
LoadAcceleratorsA
IsWindowEnabled
ReleaseCapture
EnableScrollBar
MonitorFromPoint
DrawTextA
DrawTextExA
GrayStringA
TabbedTextOutA
GetWindowDC
GetWindowTextA
GetSubMenu
SendMessageA
ScreenToClient
GetClientRect
InvalidateRect
UpdateWindow
GetWindowRect
InflateRect
GetSysColor
LoadBitmapW
EnableWindow
IsChild
GetFocus
LoadImageA
GetSystemMetrics
RedrawWindow
IsIconic
ClientToScreen
RegisterWindowMessageA
PostMessageA
IsWindow
DestroyWindow
IsWindowVisible
IsZoomed
GetCapture
SetForegroundWindow
SetWindowRgn
CopyRect
OffsetRect
IsRectEmpty
GetClassLongA
SetParent
GetTopWindow
GetWindow
PeekMessageA
GetClassInfoA
ShowWindow
SetWindowPos
BringWindowToTop
GetDlgItem
GetDlgCtrlID
SetFocus
GetActiveWindow
GetKeyState
GetIconInfo
ModifyMenuA
CharUpperBuffA
FrameRect
InsertMenuA
HideCaret
InvertRect
PostQuitMessage
SetWindowContextHelpId
MapDialogRect
LoadAcceleratorsW
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
PostThreadMessageA
WaitMessage
ShowOwnedPopups
GetTabbedTextExtentW
GetWindowRgn
MapVirtualKeyExA
IsCharLowerA
CreateMenu
DrawIcon
InvalidateRgn
CharNextA
GetNextDlgGroupItem
GetComboBoxInfo
EnumChildWindows
GetDoubleClickTime
IsClipboardFormatAvailable
SubtractRect
CopyIcon
CopyAcceleratorTableA
CreateAcceleratorTableA
ToAsciiEx
GetKeyboardState
GetKeyboardLayout
RealChildWindowFromPoint
DestroyCursor
SetCursorPos
GetWindowPlacement
SelectPalette
SetPixel
StretchBlt
SetDIBColorTable
ExtTextOutA
GetTextMetricsA
CreateHatchBrush
CreatePatternBrush
CreateSolidBrush
Escape
ExcludeClipRect
GetClipBox
GetCurrentPositionEx
GetDeviceCaps
GetObjectType
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextAlign
StartDocA
MoveToEx
TextOutA
SetViewportExtEx
SetViewportOrgEx
RealizePalette
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetMapMode
SetRectRgn
DPtoLP
CopyMetaFileA
CreateDCA
CreateEllipticRgn
Ellipse
GetBkColor
CreatePolygonRgn
Polygon
Polyline
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
Rectangle
RoundRect
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
GetCharWidthA
GetRgnBox
OffsetRgn
CreatePalette
GetPaletteEntries
ExtFloodFill
SetPaletteEntries
GetViewportOrgEx
LPtoDP
GetWindowOrgEx
EnumFontFamiliesExA
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetNearestPaletteIndex
GetSystemPaletteEntries
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextExtentPointA
GetTextExtentPoint32W
GetTextFaceA
SetPixelV
PatBlt
GetPixel
GetDIBits
CreateRectRgn
CombineRgn
BitBlt
GetTextColor
CreateRectRgnIndirect
CreateRoundRectRgn
CreatePen
SetTextColor
SetBkColor
CreateCompatibleBitmap
CreateDIBSection
SelectObject
CreateCompatibleDC
CreateFontIndirectA
DeleteObject
GetStockObject
DeleteDC
GetTextExtentPoint32A
SetWindowExtEx
CreateBitmap
GetObjectA
AlphaBlend
TransparentBlt
DocumentPropertiesA
ClosePrinter
GetJobA
OpenPrinterA
RegDeleteValueA
AdjustTokenPrivileges
OpenProcessToken
RegEnumValueA
RegOpenKeyExW
RegEnumKeyExA
GetFileSecurityA
SetFileSecurityA
RegQueryValueA
RegEnumKeyA
RegSetValueExA
LookupPrivilegeValueA
RegDeleteKeyA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegSetValueA
RegCloseKey
GetLengthSid
SetTokenInformation
DragFinish
SHAppBarMessage
ShellExecuteA
SHGetFileInfoA
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHBrowseForFolderA
ExtractIconA
SHAddToRecentDocs
SHGetDesktopFolder
DragQueryFileA
InitCommonControlsEx
ImageList_AddMasked
PathFindExtensionA
PathStripToRootA
PathRemoveFileSpecW
StrFormatKBSizeA
PathIsUNCA
PathFindFileNameA
OpenThemeData
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
DrawThemeText
IsAppThemed
GetWindowTheme
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
DrawThemeParentBackground
GetThemeSysColor
OleIsCurrentClipboard
DoDragDrop
OleGetClipboard
OleLockRunning
CoGetClassObject
CoRevokeClassObject
CoRegisterMessageFilter
OleFlushClipboard
StgCreateDocfileOnILockBytes
CoFreeUnusedLibraries
CoDisconnectObject
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
CLSIDFromProgID
OleUninitialize
OleInitialize
RevokeDragDrop
CoInitialize
CoCreateGuid
CoUninitialize
CLSIDFromString
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
CreateStreamOnHGlobal
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoLockObjectExternal
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
RegisterDragDrop
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SysAllocStringByteLen
VariantCopy
VarBstrFromDate
LoadTypeLi
OleCreateFontIndirect
VariantChangeType
SysAllocStringLen
SysAllocString
VariantInit
SysFreeString
VariantClear
ord8
GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
InternetReadFile
InternetOpenUrlA
InternetOpenA
ImageGetDigestStream
AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject
ImmReleaseContext
ImmGetOpenStatus
ImmGetContext
PlaySoundA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ