Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Overview
overview
7Static
static
77f1ea1aa4a...18.exe
windows7-x64
37f1ea1aa4a...18.exe
windows10-2004-x64
3$DESKTOP/t...r_.exe
windows7-x64
7$DESKTOP/t...r_.exe
windows10-2004-x64
7$DESKTOP/t...AS.exe
windows7-x64
1$DESKTOP/t...AS.exe
windows10-2004-x64
1$DESKTOP/t...TV.dll
windows7-x64
3$DESKTOP/t...TV.dll
windows10-2004-x64
3$DESKTOP/t...er.exe
windows7-x64
7$DESKTOP/t...er.exe
windows10-2004-x64
7$DESKTOP/t...st.exe
windows7-x64
1$DESKTOP/t...st.exe
windows10-2004-x64
1$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3Behavioral task
behavioral1
Sample
7f1ea1aa4aad75b888cd88f7538ed6c8_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7f1ea1aa4aad75b888cd88f7538ed6c8_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$DESKTOP/temp/TeamViewer3/TeamViewer_.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$DESKTOP/temp/TeamViewer3/TeamViewer_.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$DESKTOP/temp/TeamViewer3/SAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$DESKTOP/temp/TeamViewer3/SAS.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$DESKTOP/temp/TeamViewer3/TV.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$DESKTOP/temp/TeamViewer3/TV.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$DESKTOP/temp/TeamViewer3/TeamViewer.exe
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
$DESKTOP/temp/TeamViewer3/TeamViewer.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
$DESKTOP/temp/TeamViewer3/TeamViewer_Host.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$DESKTOP/temp/TeamViewer3/TeamViewer_Host.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240426-en
Target
7f1ea1aa4aad75b888cd88f7538ed6c8_JaffaCakes118
Size
1.1MB
MD5
7f1ea1aa4aad75b888cd88f7538ed6c8
SHA1
35b9f6de44251ec6a77ed896d9f7a2b448fbb06c
SHA256
07a48fb9ccbc2504262a9bb6db318f3da342e51aa16587e07fe5886a822ba047
SHA512
d7635cb7c8cd14aabeb4a370a769e1e6a35a781a2b8abe3dfda791f3f835ae25dfbaebfee1f6e43938109f818747d24911da57ab06f56964609ec03f22d60b1b
SSDEEP
24576:7jTH3RlQ1TKhP0FuzMavRww5iNeqHcCpziPXyuFUolfubdcgN:3TH3RO1y0FuzXvRt5iseWPxloOgN
resource | yara_rule |
---|---|
static1/unpack001/$DESKTOP/temp/TeamViewer3/TeamViewer_.exe | upx |
Checks for missing Authenticode signature.
resource |
---|
7f1ea1aa4aad75b888cd88f7538ed6c8_JaffaCakes118 |
unpack002/$DESKTOP/temp/TeamViewer3/TV.dll |
unpack002/$PLUGINSDIR/GetVersion.dll |
unpack002/$PLUGINSDIR/NSISdl.dll |
unpack002/$PLUGINSDIR/System.dll |
unpack002/$PLUGINSDIR/UAC.dll |
unpack002/$PLUGINSDIR/UserInfo.dll |
unpack002/out.upx |
resource | yara_rule |
---|---|
sample | nsis_installer_1 |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
c:\TeamViewer\SAS Lib\release\SAS.pdb
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
I_RpcExceptionFilter
NdrClientCall2
FlushFileBuffers
CloseHandle
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FreeLibrary
GetProcAddress
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
SetLastError
GetVersionExA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Sleep
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapAlloc
GetProcessHeap
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
OpenMutexA
LoadLibraryA
FreeLibrary
HeapFree
GetProcAddress
GetWindowRect
GetWindowDC
IsWindow
GetUpdateRgn
SetWindowPos
GetDesktopWindow
ClientToScreen
SetWindowsHookExA
ReleaseDC
UnionRect
SetRect
GetWindowThreadProcessId
RegisterWindowMessageA
SetRectEmpty
UnhookWindowsHookEx
IsWindowVisible
CallNextHookEx
FindWindowExA
MapWindowPoints
GetClientRect
FindWindowA
PostMessageA
CreateRectRgn
Rectangle
SelectObject
DeleteObject
GetRegionData
GetStockObject
CreatePen
GetChangeRect
SetSingleWindow
StartHooks
StopHooks
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
c:\TeamViewer\TeamViewer\qs_release\TeamViewer.pdb
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Create
ImageList_Remove
InitCommonControlsEx
ImageList_LoadImageW
CryptVerifyMessageSignature
CertGetNameStringA
CertFreeCertificateContext
CertGetNameStringW
ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates
GetAdapterIndex
DeleteIPAddress
GetAdaptersInfo
WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW
GetCurrentThread
GetProcAddress
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
DeleteFileA
FindFirstFileA
CreateFileA
FindNextFileA
OpenProcess
GlobalFree
WritePrivateProfileStringW
DeviceIoControl
CreateThread
ResumeThread
SetThreadPriority
CreateEventW
GetOverlappedResult
lstrcmpW
VirtualAlloc
GetVersionExA
GetACP
GetLocaleInfoA
GetThreadLocale
TlsAlloc
TlsGetValue
TlsSetValue
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
GetFileTime
SetFileTime
FormatMessageA
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetTimeFormatA
GetDateFormatA
GetCommandLineA
GetStartupInfoA
GetFileType
GetStdHandle
VirtualQuery
ExitProcess
RtlUnwind
LCMapStringA
GetStringTypeA
ExitThread
TlsFree
HeapCreate
GetTimeZoneInformation
SetHandleCount
SetFilePointer
GetOEMCP
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
GetUserDefaultLCID
QueryPerformanceCounter
WideCharToMultiByte
InterlockedExchange
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleHandleA
CompareStringA
GetLocalTime
CompareFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
SetErrorMode
FreeLibrary
DeleteCriticalSection
ReadFile
GetFileSize
FlushFileBuffers
WriteFile
LocalFree
GetCurrentProcessId
GetModuleFileNameA
GetCommandLineW
ReleaseMutex
InterlockedDecrement
VirtualFree
InterlockedIncrement
InitializeCriticalSection
GlobalUnlock
GlobalLock
GlobalAlloc
SetProcessShutdownParameters
MulDiv
CreateMutexA
GetLastError
Sleep
HeapAlloc
LoadResource
LockResource
SizeofResource
FlushInstructionCache
RaiseException
LeaveCriticalSection
EnterCriticalSection
SetLastError
HeapFree
GetTickCount
GetProcessHeap
GetSystemTimeAsFileTime
CloseHandle
ReleaseSemaphore
DuplicateHandle
CreateSemaphoreA
WaitForSingleObject
SetEvent
GetCurrentProcess
CreateEventA
GetCurrentThreadId
HeapDestroy
EnumSystemLocalesA
HeapReAlloc
HeapSize
InterlockedCompareExchange
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
SetEnvironmentVariableA
SetEndOfFile
IsProcessorFeaturePresent
ResetEvent
DrawFocusRect
FrameRect
ClientToScreen
DestroyCursor
GetSystemMenu
GetWindowPlacement
DestroyAcceleratorTable
SetWindowPlacement
SetRectEmpty
GetCapture
GetMessagePos
GetNextDlgTabItem
GetSysColor
EndDeferWindowPos
DrawEdge
BeginDeferWindowPos
FlashWindow
GetDialogBaseUnits
ScreenToClient
DeferWindowPos
MapDialogRect
SetCapture
ReleaseCapture
GetShellWindow
GetMenu
PostQuitMessage
MessageBoxA
GetAsyncKeyState
GetKeyState
GetFocus
ToUnicode
GetKeyboardState
ToAscii
CloseClipboard
SetClipboardData
CreateWindowExA
PtInRect
CreatePopupMenu
CreateMenu
IsMenu
ChangeClipboardChain
SetClipboardViewer
SendInput
EnumWindows
CloseDesktop
GetUserObjectInformationW
GetThreadDesktop
WindowFromPoint
SetThreadDesktop
OpenInputDesktop
GetWindowDC
GetIconInfo
GetCursorInfo
CallNextHookEx
UnhookWindowsHookEx
MessageBeep
SetScrollPos
GetMenuItemInfoW
DestroyIcon
SetCursorPos
SetCursor
CreateIconIndirect
GetDlgItemTextA
CharLowerW
ScrollWindowEx
InvalidateRgn
SetScrollInfo
RedrawWindow
GetCursorPos
EqualRect
GetGUIThreadInfo
GetWindowThreadProcessId
GetForegroundWindow
BlockInput
EndDialog
ReleaseDC
UnionRect
CharUpperW
OpenClipboard
RegisterWindowMessageW
InflateRect
IntersectRect
SetRect
EndPaint
BeginPaint
AdjustWindowRect
GetActiveWindow
ShowScrollBar
GetSystemMetrics
CopyRect
SetForegroundWindow
SetParent
OffsetRect
UpdateWindow
FillRect
GetDlgItem
BringWindowToTop
GetDesktopWindow
GetDlgCtrlID
SetWindowRgn
DestroyMenu
SetFocus
CheckMenuRadioItem
RemoveMenu
GetSubMenu
EnableMenuItem
CheckMenuItem
GetDC
TrackPopupMenuEx
KillTimer
GetParent
DestroyWindow
SetTimer
GetClientRect
IsWindowVisible
TranslateMessage
InvalidateRect
SetWindowPos
MapWindowPoints
GetWindowRect
GetWindow
ShowWindow
MoveWindow
IsWindow
GetMenuStringW
OpenDesktopW
GetScrollInfo
UnregisterClassA
EmptyClipboard
SelectPalette
RealizePalette
SetStretchBltMode
GetObjectType
GetSystemPaletteEntries
GetDIBits
DPtoLP
RoundRect
MoveToEx
LineTo
MaskBlt
CreatePatternBrush
PatBlt
SetDIBitsToDevice
Ellipse
GetDeviceCaps
SetTextColor
StrokeAndFillPath
EndPath
BeginPath
SetBkMode
GetPixel
SetBkColor
CreateBitmap
Rectangle
CreatePen
CreateSolidBrush
CombineRgn
CreateRectRgn
CreateRoundRectRgn
GetStockObject
BitBlt
SelectObject
StretchBlt
CreateCompatibleDC
DeleteDC
CreatePalette
SetPixel
SetViewportOrgEx
SetBrushOrgEx
CreateCompatibleBitmap
CreateDIBSection
DeleteObject
SetSecurityDescriptorDacl
RegCloseKey
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
ImpersonateLoggedOnUser
DuplicateToken
RegSetValueExA
RegEnumValueW
RegEnumKeyExA
RegEnumValueA
RegOpenKeyW
CreateProcessAsUserW
SetEntriesInAclW
SetNamedSecurityInfoW
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
DuplicateTokenEx
SetTokenInformation
RevertToSelf
OpenProcessToken
InitializeSecurityDescriptor
SHGetSpecialFolderLocation
CommandLineToArgvW
ord680
CoInitialize
RegisterDragDrop
CoTaskMemAlloc
ReleaseStgMedium
OleInitialize
RevokeDragDrop
CoCreateInstance
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoUninitialize
CoTaskMemRealloc
VarUI4FromStr
PathCompactPathW
bind
listen
accept
connect
getsockname
getpeername
send
__WSAFDIsSet
recvfrom
WSAGetLastError
select
recv
inet_ntoa
htons
sendto
socket
ntohs
ioctlsocket
htonl
WSAStartup
WSACleanup
shutdown
closesocket
gethostname
inet_addr
gethostbyname
setsockopt
InternetConnectW
HttpSendRequestA
InternetGoOnlineA
HttpQueryInfoA
InternetErrorDlg
InternetReadFile
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetQueryOptionW
InternetCloseHandle
InternetOpenW
InternetSetOptionW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
CreateEnvironmentBlock
DestroyEnvironmentBlock
CertFreeCertificateContext
CryptVerifyMessageSignature
CertGetNameStringA
ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData
WinVerifyTrust
WTSQuerySessionInformationA
WTSFreeMemory
GetPrivateProfileIntA
WritePrivateProfileStringA
FreeLibrary
GetExitCodeProcess
ProcessIdToSessionId
SetCurrentDirectoryA
ReadFile
WaitForSingleObject
DeleteFileA
SetEvent
CreateEventA
GetConsoleCP
SetFilePointer
GetStringTypeW
MultiByteToWideChar
CreateFileA
SetLastError
CreateNamedPipeA
GetPrivateProfileStringA
LocalFree
GetVersionExA
LoadLibraryA
GetProcAddress
GetCurrentProcessId
OpenProcess
GetLastError
CloseHandle
TerminateProcess
Sleep
GetConsoleMode
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateProcessA
GetCurrentProcess
LocalAlloc
GetModuleFileNameA
DisconnectNamedPipe
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
HeapFree
HeapAlloc
RtlUnwind
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetProcessHeap
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
LCMapStringW
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSection
InterlockedExchange
GetUserDefaultLCID
GetLocaleInfoA
MessageBoxA
ExitWindowsEx
CreateServiceA
StartServiceCtrlDispatcherA
SetServiceStatus
RegDeleteKeyA
CreateProcessAsUserA
DuplicateToken
ImpersonateLoggedOnUser
RevertToSelf
RegCreateKeyA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
DuplicateTokenEx
SetTokenInformation
RegOpenKeyExA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ShellExecuteExA
ShellExecuteA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetVersionExA
GetProcAddress
GetModuleHandleA
lstrcmpiA
FreeLibrary
GlobalAlloc
lstrcatA
lstrcpynA
wsprintfA
GetSystemMetrics
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
IEVersion
WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsServicePack
WindowsServicePackBuild
WindowsType
WindowsVersion
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread
CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup
download
download_quiet
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect
wsprintfA
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleFileNameA
SetLastError
CloseHandle
GlobalFree
LocalFree
FormatMessageA
MultiByteToWideChar
GetLastError
CreateProcessA
GlobalAlloc
lstrlenA
GetVersionExA
LoadLibraryA
lstrcatA
GetProcAddress
lstrcpynA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiA
lstrcpyA
GetCurrentProcess
GetCurrentThread
GetCurrentProcessId
Sleep
CreateThread
GetStartupInfoA
GetCommandLineA
GetPrivateProfileIntA
GetPrivateProfileStringA
FreeLibrary
GetModuleHandleA
EnableWindow
GetWindowLongA
DestroyWindow
LoadImageA
SetWindowLongA
EndDialog
MessageBoxA
SendMessageW
DialogBoxParamA
CharNextA
SendMessageTimeoutA
WaitForInputIdle
DefWindowProcA
PostMessageA
GetLastActivePopup
PostQuitMessage
SetForegroundWindow
DispatchMessageA
GetMessageA
CreateWindowExA
RegisterClassA
UnregisterClassA
GetWindowTextA
TranslateMessage
IsDialogMessageA
PeekMessageA
MsgWaitForMultipleObjects
IsWindow
ShowWindow
wsprintfA
GetDlgItem
SendMessageA
LoadStringA
SetWindowTextA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
ShellExecuteExA
CoInitialize
CoUninitialize
Exec
ExecCodeSegment
ExecWait
GetElevationType
GetOuterHwnd
IsAdmin
RunElevated
ShellExec
ShellExecWait
StackPush
SupportsUAC
Unload
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynA
GlobalAlloc
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken
GetAccountType
GetName
GetOriginalAccountType
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ