Extended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Overview
overview
3Static
static
3雨落自�...ll.dll
windows7-x64
1雨落自�...ll.dll
windows10-2004-x64
1雨落自�...LE.dll
windows7-x64
1雨落自�...LE.dll
windows10-2004-x64
3雨落自�...SG.dll
windows7-x64
1雨落自�...SG.dll
windows10-2004-x64
3雨落自�...IC.dll
windows7-x64
1雨落自�...IC.dll
windows10-2004-x64
3雨落自�...LL.dll
windows7-x64
1雨落自�...LL.dll
windows10-2004-x64
1雨落自�...YS.dll
windows7-x64
1雨落自�...YS.dll
windows10-2004-x64
3雨落自�...OW.dll
windows7-x64
1雨落自�...OW.dll
windows10-2004-x64
3雨落自�....3.exe
windows7-x64
3雨落自�....3.exe
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
雨落自动收货V1.3/cfgdll.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
雨落自动收货V1.3/cfgdll.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
雨落自动收货V1.3/plugin/FILE.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
雨落自动收货V1.3/plugin/FILE.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
雨落自动收货V1.3/plugin/MSG.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
雨落自动收货V1.3/plugin/MSG.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
雨落自动收货V1.3/plugin/PIC.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
雨落自动收货V1.3/plugin/PIC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
雨落自动收货V1.3/plugin/REGDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
雨落自动收货V1.3/plugin/REGDLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
雨落自动收货V1.3/plugin/SYS.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
雨落自动收货V1.3/plugin/SYS.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
雨落自动收货V1.3/plugin/WINDOW.dll
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
雨落自动收货V1.3/plugin/WINDOW.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
雨落自动收货V1.3/自动收货V1.3.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
雨落自动收货V1.3/自动收货V1.3.exe
Resource
win10v2004-20240611-en
Target
b2e35c9d29c160b8e41618d7cdc4108b_JaffaCakes118
Size
1.7MB
MD5
b2e35c9d29c160b8e41618d7cdc4108b
SHA1
ffb62b0e6cea48d1ce8731099a4456ba1853c72b
SHA256
f9ef80bcbf790d8bc1966d7b13a1b08eb87030aca2de68166b90a8318cc9aad8
SHA512
21ded91633aa3d56e40b9aa5d1b0ad88ace30a47e96783d7eb177658f3b322ded59fbf1efadcdd1a5db5a2ceb96b93cb17f65785db0d5a1459e037921f213184
SSDEEP
49152:xB+s+kWpfEJiHHy93ZJSkyzhXmMMQb7sH3k:xUEJiHHynSxRb7Yk
Checks for missing Authenticode signature.
resource |
---|
unpack001/雨落自动收货V1.3/plugin/FILE.DLL |
unpack001/雨落自动收货V1.3/plugin/MSG.DLL |
unpack001/雨落自动收货V1.3/plugin/PIC.DLL |
unpack001/雨落自动收货V1.3/plugin/REGDLL.DLL |
unpack001/雨落自动收货V1.3/plugin/SYS.DLL |
unpack001/雨落自动收货V1.3/plugin/WINDOW.DLL |
unpack001/雨落自动收货V1.3/自动收货V1.3.exe |
resource | yara_rule |
---|---|
static1/unpack001/雨落自动收货V1.3/自动收货V1.3.exe | nsis_installer_2 |
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
CloseHandle
UnmapViewOfFile
GetCurrentProcessId
CreateEventA
PulseEvent
OpenEventA
WaitForSingleObject
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
HeapAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
CompareStringA
CompareStringW
SetEnvironmentVariableA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
PostMessageA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ord533
ord6407
ord2818
ord4278
ord536
ord858
ord535
ord2915
ord6662
ord5194
ord5465
ord924
ord939
ord1997
ord798
ord6354
ord941
ord1131
ord1132
ord5500
ord815
ord561
ord3738
ord3081
ord3262
ord354
ord5186
ord3318
ord1979
ord665
ord3790
ord6153
ord537
ord940
ord540
ord823
ord825
ord860
ord1601
ord800
ord743
ord446
ord2486
ord4226
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord269
ord826
ord600
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord1116
ord6877
ord859
ord1799
ord2982
ord3147
ord3259
ord4465
ord3136
ord2985
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4424
ord614
ord1206
ord2623
ord290
ord1223
ord4622
ord4003
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
_tzset
atoi
sscanf
__CxxFrameHandler
_mkdir
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
wcstombs
_timezone
strrchr
strchr
rename
CloseHandle
CreateFileA
WriteFile
ReadFile
SetFilePointer
SystemTimeToFileTime
OpenFile
SetFileTime
MoveFileA
DeleteFileA
GetFileAttributesA
CopyFileA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetModuleFileNameA
IsDebuggerPresent
LocalFree
LocalAlloc
_lclose
GetOpenFileNameA
SHGetPathFromIDListA
SHBrowseForFolderA
SHFileOperationA
RegSetValueExA
RegCloseKey
RegOpenKeyA
StringFromCLSID
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ord268
ord389
ord922
ord4204
ord2818
ord2915
ord860
ord940
ord5207
ord4203
ord825
ord859
ord1567
ord690
ord743
ord446
ord2486
ord4226
ord6354
ord1131
ord1132
ord5500
ord815
ord561
ord823
ord858
ord536
ord941
ord939
ord540
ord535
ord3738
ord3081
ord3262
ord5714
ord5289
ord800
ord537
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord4003
ord1601
ord4622
ord1223
ord290
ord2623
ord1206
ord614
ord4424
ord4080
ord3079
ord269
ord826
ord600
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord1116
ord6877
ord1799
ord2982
ord3147
ord3259
ord4465
ord3136
ord2985
ord2976
ord3830
ord3831
ord3825
floor
__CxxFrameHandler
_ftol
strtoul
_mbscmp
rand
srand
_adjust_fdiv
malloc
_initterm
free
??1type_info@@UAE@XZ
atoi
strrchr
strchr
wcstombs
_onexit
__dllonexit
sprintf
fclose
IsDebuggerPresent
LocalAlloc
LocalFree
GetTickCount
WritePrivateProfileStringA
GetPrivateProfileStringA
TlsGetValue
GetEnvironmentVariableA
GetModuleFileNameA
ReleaseDC
GetDC
DrawTextA
InvalidateRect
SetTextColor
Shell_NotifyIconA
??_8?$basic_ifstream@DU?$char_traits@D@std@@@std@@7B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0locale@std@@QAE@XZ
??_7?$basic_filebuf@DU?$char_traits@D@std@@@std@@6B@
?_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z
??_7?$basic_ifstream@DU?$char_traits@D@std@@@std@@6B@
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ
??1locale@std@@QAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1ios_base@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Stinit@?1??_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@23@@Z@4HA
?clear@ios_base@std@@QAEXH_N@Z
RegCloseKey
RegSetValueExA
RegOpenKeyA
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CLSIDFromProgID
VariantClear
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ord561
ord815
ord5500
ord1132
ord1131
ord941
ord6354
ord823
ord860
ord5710
ord924
ord535
ord3738
ord3081
ord3262
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord1601
ord540
ord537
ord2915
ord800
ord825
ord743
ord446
ord2486
ord4226
ord4486
ord6375
ord4274
ord4003
ord4622
ord1223
ord290
ord2623
ord1206
ord614
ord4424
ord269
ord826
ord600
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord1116
ord6877
ord940
ord939
ord859
ord1799
ord2982
ord3147
ord3259
ord4465
ord3136
ord2985
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
__CxxFrameHandler
_mbscmp
free
wcscmp
malloc
wcstombs
strchr
strrchr
_onexit
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
__dllonexit
WriteFile
LocalAlloc
LocalFree
CreateFileA
GlobalFree
CloseHandle
MultiByteToWideChar
InitializeCriticalSection
DeleteFileA
DeleteCriticalSection
GlobalAlloc
IsDebuggerPresent
GetModuleFileNameA
GetPrivateProfileStringA
WritePrivateProfileStringA
GlobalLock
GlobalUnlock
IsRectEmpty
GetDC
ReleaseDC
DeleteDC
DeleteObject
CreateDCA
CreateCompatibleDC
RealizePalette
SelectObject
BitBlt
GetObjectA
GetDIBits
GetDeviceCaps
SelectPalette
GetStockObject
CreateCompatibleBitmap
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDisposeImage
GdipSaveImageToFile
GdipLoadImageFromFile
GdipFree
GdipAlloc
GdipCloneImage
RegSetValueExA
RegCloseKey
RegOpenKeyA
StringFromCLSID
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ord3831
ord3825
ord3079
ord4080
ord4424
ord614
ord1206
ord2623
ord290
ord825
ord1223
ord4622
ord4226
ord2486
ord4003
ord446
ord743
ord1569
ord1196
ord1168
ord6467
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord3830
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3262
ord3081
ord3738
ord561
ord815
ord5500
ord1132
ord1131
ord6354
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord2976
ord2985
ord3136
ord4465
ord3147
ord3259
ord2982
ord1799
ord1089
ord823
ord1578
ord600
ord826
ord269
ord1116
__CxxFrameHandler
wcstombs
__dllonexit
_onexit
free
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
LocalFree
LoadLibraryA
FreeLibrary
GetProcAddress
LocalAlloc
RegSetValueExA
RegCloseKey
RegCreateKeyExA
OleInitialize
CoTaskMemFree
StringFromCLSID
OleUninitialize
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
timeGetTime
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord3262
ord3081
ord3738
ord561
ord815
ord5500
ord1132
ord535
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord4003
ord4622
ord1223
ord290
ord2623
ord1206
ord614
ord4424
ord4080
ord3079
ord3825
ord3831
ord3830
ord941
ord2976
ord2985
ord2915
ord1601
ord1168
ord537
ord540
ord2818
ord823
ord825
ord1158
ord860
ord6663
ord800
ord743
ord446
ord2486
ord4226
ord1131
ord3346
ord3136
ord4465
ord3259
ord6354
ord269
ord826
ord600
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1575
ord1176
ord1116
ord6877
ord940
ord939
ord859
ord1799
ord2982
ord3147
strrchr
strchr
wcstombs
__CxxFrameHandler
free
malloc
__dllonexit
_onexit
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
GetPrivateProfileStringA
GetModuleFileNameA
IsDebuggerPresent
LocalAlloc
LocalFree
GetLocalTime
GetVolumeInformationA
GetSystemDirectoryA
GetWindowsDirectoryA
GetTempPathA
GetCurrentDirectoryA
GlobalSize
GetVersionExA
GetCurrentProcess
GlobalUnlock
GlobalLock
GlobalAlloc
WritePrivateProfileStringA
EmptyClipboard
OpenClipboard
SetClipboardData
CloseClipboard
ExitWindowsEx
ChangeDisplaySettingsA
GetClipboardData
CreateDCA
GetDeviceCaps
DeleteDC
RegOpenKeyA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
OpenProcessToken
StringFromCLSID
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ord2396
ord5199
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord3262
ord3081
ord3738
ord561
ord815
ord5500
ord1089
ord3922
ord2915
ord6394
ord5450
ord6383
ord5440
ord535
ord861
ord540
ord860
ord1132
ord5731
ord2512
ord2554
ord4486
ord6375
ord539
ord537
ord2764
ord2818
ord939
ord800
ord1601
ord3663
ord825
ord823
ord743
ord446
ord2486
ord4226
ord4274
ord4003
ord4622
ord1871
ord6354
ord941
ord1131
ord1223
ord290
ord2623
ord1206
ord614
ord269
ord826
ord600
ord1578
ord6467
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord1116
ord6877
ord940
ord859
ord1799
ord2982
ord3147
ord3259
ord4465
ord3136
ord2985
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4424
sprintf
__CxxFrameHandler
_mbscmp
atoi
strrchr
strchr
wcstombs
??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
_onexit
__dllonexit
malloc
free
sscanf
IsDebuggerPresent
GetModuleFileNameA
GetEnvironmentVariableA
lstrlenA
GetPrivateProfileStringA
WritePrivateProfileStringA
TlsGetValue
LocalAlloc
LocalFree
Sleep
MultiByteToWideChar
GetCurrentThreadId
CreateToolhelp32Snapshot
Module32First
CloseHandle
GetClassNameA
FindWindowA
GetForegroundWindow
WindowFromPoint
GetCursorPos
GetWindowLongA
GetWindowTextA
EnumWindows
SetForegroundWindow
MapVirtualKeyA
GetWindow
SetWindowTextA
AttachThreadInput
GetGUIThreadInfo
GetClientRect
GetWindowThreadProcessId
IsWindow
SendMessageA
SetWindowPos
GetWindowRect
MoveWindow
ShowWindow
PostMessageA
FindWindowExA
VariantClear
VariantCopy
SysAllocString
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
RegSetValueExA
RegOpenKeyA
RegCloseKey
CLSIDFromProgID
CoCreateInstance
StringFromCLSID
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ