Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
a9741b16f4169f56ae0f2e49c87f3c5360ed5ab4370e6d16bd86179999f11795.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
a9741b16f4169f56ae0f2e49c87f3c5360ed5ab4370e6d16bd86179999f11795.exe
Resource
win10v2004-20240426-en
Target
possible_irt_clop_16938601753.zip
Size
1.5MB
MD5
02056feea8f2155557af5b3353edf1ec
SHA1
90729b415824023eae259502d23f3190c5af0f5e
SHA256
7fa55a34462cbef893741a513c78e13c8c8a48a1f7e7c7ad498422ae576d1fea
SHA512
5505e146998723c9ddf95bd1e14b0ac2ff168e91445d8dc6d37bb38af2d5f8486c5d6fd39ac2c314b42757c136370d80731ff7efa2f47db32794fe86b527a639
SSDEEP
24576:AxXLTOKkyJ1Cns71H5ibY3L5ptoVJAgpzspNwNXF5s6YCUra8FA3f5tH3lkbXHiG:A9LTOKB3f1ZiOpWXAgpsgN5YbuA2j1w1
clop
Checks for missing Authenticode signature.
Processes:
resource |
---|
unpack001/46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed |
unpack001/a9741b16f4169f56ae0f2e49c87f3c5360ed5ab4370e6d16bd86179999f11795 |
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
EraseTape
GetSystemDefaultLCID
CreateNamedPipeA
HeapFree
SetPriorityClass
FindFirstFileNameW
GetCommandLineW
EnumCalendarInfoExEx
IsDBCSLeadByteEx
GetCurrentProcess
GetConsoleOutputCP
lstrlenW
GetThreadErrorMode
EnumResourceTypesW
CreateFileMappingNumaW
GetFileBandwidthReservation
GetSystemDefaultUILanguage
GetShortPathNameW
TerminateProcess
GetUserDefaultLangID
GetModuleFileNameW
GetSystemTimes
GetConsoleCP
GetThreadLocale
GlobalUnWire
GetCompressedFileSizeTransactedW
DeleteFileTransactedA
LocalHandle
GetProcessId
EnumResourceNamesA
GetUserDefaultUILanguage
FindNextFileA
DeleteAtom
Wow64GetThreadContext
GetQueuedCompletionStatus
GetFullPathNameA
GetCompressedFileSizeW
FlushProcessWriteBuffers
PeekNamedPipe
GetLargePageMinimum
lstrlenA
CreateMutexA
LocalAlloc
GetFileAttributesW
GetCurrentThreadId
GetPrivateProfileSectionNamesW
UnregisterApplicationRecoveryCallback
IsSystemResumeAutomatic
GetCurrentDirectoryA
GlobalDeleteAtom
QueryMemoryResourceNotification
OpenSemaphoreA
GetAtomNameW
lstrcatA
GetStringScripts
GetSystemDefaultLangID
GetACP
OpenProcess
GetVersion
_lopen
GetCommandLineA
CreateToolhelp32Snapshot
CreateEventW
QueryActCtxW
Sleep
EnumUILanguagesA
GlobalAddAtomA
GetTickCount64
GetLargestConsoleWindowSize
GetFileAttributesA
TzSpecificLocalTimeToSystemTime
ZombifyActCtx
Process32NextW
GetMaximumProcessorGroupCount
ConvertDefaultLocale
FlushViewOfFile
GetThreadUILanguage
GetUserDefaultLCID
SetEvent
DefineDosDeviceA
GetDiskFreeSpaceExW
GetCurrentThread
TerminateThread
GetActiveProcessorGroupCount
FindCloseChangeNotification
GetProfileIntA
LoadLibraryA
TlsAlloc
GetSystemDEPPolicy
Process32FirstW
HeapReAlloc
AddConsoleAliasA
CreateThreadpoolCleanupGroup
CompareStringEx
GetOEMCP
LoadLibraryW
GetThreadIOPendingFlag
HeapAlloc
CloseHandle
GetDefaultCommConfigW
SwitchToThread
GetNamedPipeServerProcessId
MoveFileWithProgressA
FindNextFileNameW
EnumSystemLanguageGroupsA
IsThreadAFiber
GetCurrentProcessorNumber
ReadDirectoryChangesW
GetSystemWow64DirectoryA
GetErrorMode
VirtualLock
FindAtomA
UnregisterApplicationRestart
SetFileApisToOEM
ReplaceFileW
_lread
WTSGetActiveConsoleSessionId
NeedCurrentDirectoryForExePathA
ExitProcess
FindAtomW
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
CreateSemaphoreW
CreateSymbolicLinkW
GetConsoleWindow
GetLongPathNameTransactedW
DeleteBoundaryDescriptor
OpenFileMappingA
lstrcmpiA
TlsGetValue
BeginUpdateResourceW
ConvertFiberToThread
SetFileApisToANSI
MoveFileTransactedA
VirtualFreeEx
GetTempFileNameA
lstrcmpiW
GetPrivateProfileStringA
GetEnvironmentStringsW
WaitNamedPipeW
lstrcmpW
EnumDateFormatsW
LocalUnlock
GetConsoleAliasExesLengthA
GetDriveTypeW
InterlockedPopEntrySList
IsDebuggerPresent
CreateTimerQueue
IsBadStringPtrW
SizeofResource
LockResource
LoadResource
FindResourceW
DecodePointer
WriteConsoleW
SetFilePointerEx
ReadConsoleW
SetEndOfFile
GetConsoleMode
FlushFileBuffers
HeapSize
GetStringTypeW
SetStdHandle
LCMapStringW
FreeEnvironmentStringsW
GetCPInfo
IsValidCodePage
FindFirstFileExW
GetFileType
GetModuleHandleExW
WideCharToMultiByte
GetPrivateProfileSectionNamesA
WriteProfileStringW
GetLogicalDrives
AddVectoredContinueHandler
GetConsoleAliasExesLengthW
InitializeSRWLock
AreFileApisANSI
GlobalUnlock
GetTickCount
MapViewOfFile
CreateFileMappingW
lstrcpyW
GlobalLock
FreeConsole
CreateThread
GlobalFree
lstrcpyA
GlobalAlloc
lstrcatW
GetLastError
SetFileAttributesW
ExitThread
UnmapViewOfFile
CreateFileW
WaitForSingleObject
FindClose
SetFilePointer
SetErrorMode
VirtualAlloc
WriteFile
FindNextFileW
MultiByteToWideChar
GetStdHandle
LoadLibraryExW
GetProcAddress
TlsFree
TlsSetValue
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
VirtualFree
FindFirstFileW
GetCurrencyFormatW
ReadFile
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwind
GetStartupInfoW
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
RaiseException
GetNextDlgGroupItem
PtInRect
InvalidateRect
ReleaseDC
CharUpperW
wsprintfW
GetDesktopWindow
CharNextA
IsCharLowerW
DefWindowProcW
GetFocus
IsWindowVisible
GetClipboardViewer
DeleteMenu
CreatePopupMenu
DrawIcon
DestroyCursor
LoadStringW
GetMenuCheckMarkDimensions
CloseClipboard
GetForegroundWindow
EnumClipboardFormats
DestroyMenu
IntersectRect
GetMenuStringW
GetUpdateRect
GetTabbedTextExtentW
IsClipboardFormatAvailable
CharUpperBuffW
GetCaretBlinkTime
HiliteMenuItem
FrameRgn
CreateFontW
ExtFloodFill
Polyline
GetDIBits
CreatePolyPolygonRgn
PolyPolygon
SetBkColor
Ellipse
GetSystemPaletteUse
InvertRgn
FillRgn
GetCharWidthW
Pie
RegCreateKeyExW
GetTokenInformation
LookupAccountSidW
RegDeleteTreeA
RegDisablePredefinedCacheEx
RevertToSelf
CryptAcquireContextW
SetServiceStatus
CryptEncrypt
RegisterServiceCtrlHandlerW
OpenProcessToken
CreateProcessAsUserW
StartServiceCtrlDispatcherW
RegRestoreKeyW
DuplicateTokenEx
SHGetSpecialFolderPathW
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
PathFindFileNameW
StrStrW
CryptStringToBinaryA
CryptDecodeObjectEx
CryptImportPublicKeyInfo
CreateEnvironmentBlock
DestroyEnvironmentBlock
WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
QueryInformationJobObject
CreateActCtxW
GetOEMCP
SearchPathW
GetFileAttributesExA
WritePrivateProfileStringW
EraseTape
GetConsoleAliasesW
FindFirstVolumeW
GetSystemDefaultLCID
GetGeoInfoA
HeapFree
SetPriorityClass
GetCommandLineW
GetFullPathNameW
GetCurrentProcess
GetConsoleOutputCP
lstrlenW
GetThreadErrorMode
ScrollConsoleScreenBufferA
GetSystemDefaultUILanguage
UnregisterWait
GetStringTypeExW
TerminateProcess
WakeAllConditionVariable
GetUserDefaultLangID
GetModuleFileNameW
GetSystemTimes
RequestWakeupLatency
GetConsoleCP
GetThreadLocale
GlobalUnWire
GetProcessId
GetUserDefaultUILanguage
LockFile
InitializeCriticalSectionAndSpinCount
DeleteAtom
EnumCalendarInfoA
InitOnceInitialize
GetSystemPowerStatus
FlushProcessWriteBuffers
PeekConsoleInputA
FindActCtxSectionStringW
GetLargePageMinimum
GetFileAttributesTransactedA
lstrlenA
CreateMutexA
GetCurrentThreadId
OpenJobObjectW
GetVersionExW
UnregisterApplicationRecoveryCallback
IsSystemResumeAutomatic
HeapWalk
GlobalDeleteAtom
HeapValidate
GetSystemDefaultLangID
GetACP
RtlCaptureStackBackTrace
OpenProcess
GetVersion
GetCommandLineA
CreateToolhelp32Snapshot
CreateEventW
ProcessIdToSessionId
Sleep
GetTickCount64
BuildCommDCBW
VerifyScripts
GetCurrencyFormatEx
ChangeTimerQueueTimer
GetFileAttributesExW
Process32NextW
GetMaximumProcessorGroupCount
GetStringTypeExA
GetThreadUILanguage
GetUserDefaultLCID
SetEvent
GetCurrentThread
GetActiveProcessorGroupCount
LoadLibraryA
WriteProfileStringA
TlsAlloc
DeleteFileA
GetSystemDEPPolicy
Process32FirstW
MoveFileTransactedW
GetLogicalDrives
AddConsoleAliasA
CreateThreadpoolCleanupGroup
GetNativeSystemInfo
RaiseException
CloseHandle
ReadFileEx
IsDBCSLeadByte
HeapAlloc
Wow64SuspendThread
FatalAppExitW
GetCurrentDirectoryW
UpdateResourceW
GetLogicalDriveStringsA
SwitchToThread
IsThreadAFiber
GetCurrentProcessorNumber
GetThreadContext
InitAtomTable
GetWindowsDirectoryW
PeekConsoleInputW
GetErrorMode
UnregisterApplicationRestart
DebugActiveProcess
GetTimeFormatW
SetFileApisToOEM
WTSGetActiveConsoleSessionId
ExitProcess
GetPrivateProfileStructA
FindFirstStreamW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
GetLongPathNameA
GetConsoleWindow
CreateEventExA
SystemTimeToTzSpecificLocalTime
QueryFullProcessImageNameW
ReadConsoleOutputCharacterW
CommConfigDialogW
ConvertFiberToThread
GetFileType
DeleteTimerQueueTimer
SetFileApisToANSI
FormatMessageA
lstrcmpiW
BackupSeek
GetNLSVersion
HeapUnlock
GetDateFormatW
GetEnvironmentStringsW
CreateFiberEx
GetConsoleAliasExesLengthA
CreateFiber
GetDriveTypeW
InterlockedPopEntrySList
IsDebuggerPresent
CreateTimerQueue
SizeofResource
LockResource
LoadResource
FindResourceW
WriteConsoleW
SetFilePointerEx
ReadConsoleW
SetEndOfFile
GetConsoleMode
FlushFileBuffers
HeapReAlloc
HeapSize
LCMapStringW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetCPInfo
IsValidCodePage
FindFirstFileExW
GetConsoleAliasExesLengthW
RemoveDirectoryTransactedW
GetNamedPipeClientComputerNameA
AreFileApisANSI
CopyFileExA
GlobalUnlock
GetTickCount
MapViewOfFile
CreateFileMappingW
lstrcpyW
GlobalLock
EnumSystemCodePagesA
CreateThread
GlobalFree
lstrcpyA
GlobalAlloc
lstrcatW
GetLastError
SetFileAttributesW
ExitThread
UnmapViewOfFile
CreateFileW
WaitForSingleObject
FindClose
SetFilePointer
SetErrorMode
VirtualAlloc
WriteFile
FindNextFileW
GetModuleHandleExW
WideCharToMultiByte
MultiByteToWideChar
GetStdHandle
LoadLibraryExW
GetProcAddress
VirtualFree
FindFirstFileW
FreeConsole
ReadFile
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwind
GetStartupInfoW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
DecodePointer
wsprintfW
InvalidateRect
GetDesktopWindow
CharUpperBuffW
AppendMenuW
CharUpperW
DestroyCursor
GetClipboardData
DeferWindowPos
DefWindowProcW
OpenIcon
GetFocus
GetClipboardOwner
GetWindowTextLengthW
GetActiveWindow
GetClassInfoW
BeginDeferWindowPos
GetScrollRange
CloseClipboard
CharUpperBuffA
GetSysColor
GetForegroundWindow
DefMDIChildProcW
LoadBitmapW
CloseMetaFile
CreateDCW
CreateRectRgnIndirect
TextOutW
PolyPolygon
CreateDiscardableBitmap
Polygon
SetBkColor
Ellipse
DeleteMetaFile
UnrealizeObject
Pie
RegLoadMUIStringW
GetTokenInformation
LookupAccountSidW
RegDisablePredefinedCacheEx
RevertToSelf
CryptAcquireContextW
SetServiceStatus
RegisterServiceCtrlHandlerW
CryptEncrypt
OpenProcessToken
CreateProcessAsUserW
StartServiceCtrlDispatcherW
RegDeleteValueA
DuplicateTokenEx
OpenThreadToken
SHGetSpecialFolderPathW
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
StrStrW
PathFindFileNameW
CryptStringToBinaryA
CryptDecodeObjectEx
CryptImportPublicKeyInfo
CreateEnvironmentBlock
DestroyEnvironmentBlock
WTSQuerySessionInformationW
WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory
RmGetList
RmStartSession
RmShutdown
RmEndSession
RmRestart
RmRegisterResources
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetLogicalDrives
EnumResourceTypesExW
GetOEMCP
NotifyUILanguageChange
GlobalHandle
GetProcessShutdownParameters
FindFirstFileA
FindFirstFileExW
EraseTape
FindFirstVolumeW
GetSystemDefaultLCID
CopyFileTransactedW
HeapFree
SetPriorityClass
GetCommandLineW
FindNLSString
GetCurrentProcess
GetConsoleOutputCP
lstrlenW
GetThreadErrorMode
FindFirstFileExA
GetSystemDefaultUILanguage
TerminateProcess
GetProfileIntW
LoadLibraryExA
GetUserDefaultLangID
GetModuleFileNameW
DeleteFiber
GetSystemTimes
GetCommModemStatus
GetConsoleCP
GetThreadLocale
GlobalUnWire
GetProcessId
GetUserDefaultUILanguage
GetNamedPipeClientComputerNameW
LeaveCriticalSection
GetConsoleAliasW
FlushProcessWriteBuffers
InitializeCriticalSectionEx
GetLargePageMinimum
GetFileAttributesTransactedA
GetPrivateProfileSectionW
GetConsoleScreenBufferInfoEx
lstrlenA
GetEnvironmentVariableA
CreateMutexA
GetCurrentThreadId
OpenJobObjectW
MapViewOfFileExNuma
lstrcmpA
UnregisterApplicationRecoveryCallback
GetSystemDirectoryW
IsSystemResumeAutomatic
GlobalDeleteAtom
ContinueDebugEvent
GetAtomNameW
GetModuleHandleA
GetSystemDefaultLangID
GetACP
GetSystemDefaultLocaleName
RtlCaptureStackBackTrace
OpenProcess
GetVersion
BuildCommDCBA
GetCommandLineA
CreateToolhelp32Snapshot
CreateEventW
ReadConsoleOutputCharacterA
ProcessIdToSessionId
GetPrivateProfileStringW
Sleep
CancelSynchronousIo
GetTickCount64
CopyFileA
GetCurrencyFormatEx
EnumSystemLocalesEx
Process32NextW
OutputDebugStringW
GetMaximumProcessorGroupCount
GetThreadUILanguage
GetUserDefaultLCID
ReadConsoleInputA
SetEvent
GetLogicalProcessorInformation
CreateMutexExA
GetDiskFreeSpaceExW
RemoveVectoredExceptionHandler
AcquireSRWLockExclusive
GetActiveProcessorGroupCount
LoadLibraryA
TlsAlloc
CloseHandle
GetSystemDEPPolicy
Process32FirstW
GetConsoleTitleA
CreateThreadpoolCleanupGroup
RaiseException
FreeConsole
QueryProcessCycleTime
LoadLibraryW
IsDBCSLeadByte
FindResourceW
HeapAlloc
ClearCommError
GetAtomNameA
GetDefaultCommConfigW
GetUserGeoID
SwitchToThread
IsThreadAFiber
GetCurrentProcessorNumber
GetSystemWow64DirectoryA
SubmitThreadpoolWork
GetErrorMode
UnregisterApplicationRestart
SetFileApisToOEM
WTSGetActiveConsoleSessionId
ExitProcess
ReadProcessMemory
GetCurrentProcessId
GetProcessHeap
IsValidLanguageGroup
GetProfileStringW
CreateSymbolicLinkW
GetConsoleWindow
GetLongPathNameTransactedW
BuildCommDCBAndTimeoutsA
GlobalUnfix
CreateRemoteThread
OpenFileMappingA
LocaleNameToLCID
GetTempFileNameW
ConvertFiberToThread
LocalFlags
SetFileApisToANSI
FormatMessageA
GetTempFileNameA
GetProcessPriorityBoost
FindNextVolumeW
lstrcmpiW
InitializeSListHead
GetEnvironmentStringsW
lstrcmpW
GetConsoleAliasExesLengthA
GetDriveTypeW
IsDebuggerPresent
CreateTimerQueue
SizeofResource
LockResource
LoadResource
GetModuleHandleW
WriteConsoleW
SetFilePointerEx
ReadConsoleW
SetEndOfFile
GetConsoleMode
FlushFileBuffers
HeapReAlloc
HeapSize
LCMapStringW
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetCPInfo
IsValidCodePage
FoldStringA
GetConsoleAliasExesLengthW
GetNamedPipeClientComputerNameA
AreFileApisANSI
GlobalUnlock
GetTickCount
MapViewOfFile
CreateFileMappingW
lstrcpyW
GlobalLock
GetCurrentThread
CreateThread
GlobalFree
lstrcpyA
GlobalAlloc
lstrcatW
GetLastError
SetFileAttributesW
ExitThread
UnmapViewOfFile
CreateFileW
WaitForSingleObject
FindClose
SetFilePointer
SetErrorMode
VirtualAlloc
WriteFile
FindNextFileW
GetFileType
GetModuleHandleExW
WideCharToMultiByte
MultiByteToWideChar
GetStdHandle
LoadLibraryExW
VirtualFree
FindFirstFileW
FindResourceExA
ReadFile
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
SetLastError
RtlUnwind
GetStartupInfoW
GetSystemTimeAsFileTime
QueryPerformanceCounter
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
DecodePointer
wsprintfW
IsCharUpperW
InvalidateRect
CreateMenu
GetDesktopWindow
CharUpperW
UnionRect
HiliteMenuItem
DefWindowProcW
UnhookWindowsHook
GetFocus
GetClipboardViewer
GetPropW
CloseClipboard
GetKBCodePage
GetForegroundWindow
LoadBitmapW
TranslateMessage
GetClipboardFormatNameW
GetClassNameW
ExcludeUpdateRgn
DrawTextW
CharUpperBuffW
CreateHatchBrush
CreateRectRgn
SelectPalette
RectInRegion
SetBkColor
CreateEllipticRgn
Escape
FillRgn
ExtTextOutW
GetRgnBox
GetBkMode
SetServiceStatus
GetTokenInformation
LookupAccountSidW
RegDisablePredefinedCacheEx
RevertToSelf
RegCloseKey
CryptAcquireContextW
RegGetValueA
CryptEncrypt
RegisterServiceCtrlHandlerW
OpenProcessToken
CreateProcessAsUserW
StartServiceCtrlDispatcherW
RegRestoreKeyA
DuplicateTokenEx
SHGetSpecialFolderPathW
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
StrStrW
PathFindFileNameW
CryptStringToBinaryA
CryptDecodeObjectEx
CryptImportPublicKeyInfo
CreateEnvironmentBlock
DestroyEnvironmentBlock
WTSQuerySessionInformationW
WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory
RmGetList
RmStartSession
RmShutdown
RmEndSession
RmRestart
RmRegisterResources
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ