ig[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ig.exe
Size

1.8MB
MD5

ffe5a249402aecd1d0b141012ef5b3cf
SHA1

9fe9b21390d35a0f82097fddaf1ee18e91fd2f2d
SHA256

1acc1c8c918e0ac6cdb4fc41d96339959d42a71947a02f573686ee091606ac57
SHA512

1f7427472ca3f8a9abf06d761595fadca59b77ccea93477e6d71546a1385d654817cb356585dc05499ef87f61c504511399620852e95a46601f31fc6fa05f2d7
SSDEEP

24576:7Rpw8j0kcU71dHGvPKN8kP95bLS0pBm2L6y1szQGftwuTVHzw8mvv:7B0kcOnk88kPt7+zQUZw8mvv

Score

1^/10

Malware Config

Signatures

Files

ig.exe
.exe windows:6 windows x86 arch:x86

Password: l

aed13cffa9290e540355e6e087d6dd7c

Code Sign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2
Certificate

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Not Before

23/03/2022, 00:00

Not After

16/03/2025, 23:59

Subject

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

25/05/2021, 00:00

Not After

24/05/2036, 23:59

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19/11/2020, 20:32

Not After

19/11/2035, 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3c:7f:1b:a0:ca:00:37:45:b9:00:00:00:00:00:3c
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

15/02/2024, 20:36

Not After

15/02/2025, 20:36

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

16/04/2020, 18:36

Not After

16/04/2045, 18:44

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:01:11:f7:80:76:9a:26:b6:bd:b2:d5:00:00:00:01:11:f7
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

04/06/2024, 23:38

Not After

07/06/2024, 23:38

Subject

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:01:11:f7:80:76:9a:26:b6:bd:b2:d5:00:00:00:01:11:f7
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Not Before

04/06/2024, 23:38

Not After

07/06/2024, 23:38

Subject

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Not Before

13/04/2021, 17:31

Not After

13/04/2026, 17:31

Subject

CN=Microsoft ID Verified CS AOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

01/04/2021, 20:05

Not After

01/04/2036, 20:15

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19/11/2020, 20:32

Not After

19/11/2035, 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3c:7f:1b:a0:ca:00:37:45:b9:00:00:00:00:00:3c
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

15/02/2024, 20:36

Not After

15/02/2025, 20:36

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a0:22:6b:cd:02:c4:d1:36:d6:f1:81:30:4c:51:38:ba:35:92:41:47:ac:fe:87:d3:62:d2:73:ff:2b:9e:67:a6
Signer

Actual PE Digest

a0:22:6b:cd:02:c4:d1:36:d6:f1:81:30:4c:51:38:ba:35:92:41:47:ac:fe:87:d3:62:d2:73:ff:2b:9e:67:a6

Digest Algorithm

sha256

PE Digest Matches

true

a0:22:6b:cd:02:c4:d1:36:d6:f1:81:30:4c:51:38:ba:35:92:41:47:ac:fe:87:d3:62:d2:73:ff:2b:9e:67:a6
Signer

Actual PE Digest

a0:22:6b:cd:02:c4:d1:36:d6:f1:81:30:4c:51:38:ba:35:92:41:47:ac:fe:87:d3:62:d2:73:ff:2b:9e:67:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

LsaEnumerateTrustedDomains
AccessCheckByTypeResultList
GetTokenInformation
GetSidIdentifierAuthority
GetInheritanceSourceW
CryptReleaseContext
GetTrusteeFormA
LsaQueryDomainInformationPolicy
GetSecurityInfo
RegisterEventSourceA
MakeAbsoluteSD
LookupAccountNameW
ReadEncryptedFileRaw
RegEnumKeyExA
BuildImpersonateTrusteeW
AccessCheckByType
CryptSetProviderExW
MakeSelfRelativeSD
GetInheritanceSourceA
RegQueryValueExW
CryptGenKey
GetOldestEventLogRecord
SaferGetLevelInformation
CryptGetProvParam
CryptSetProviderW
QueryAllTracesA
EnumerateTraceGuids
RegisterEventSourceW
RegEnumValueW
RegOpenKeyW
QueryServiceStatusEx
LookupAccountSidW
AuditQueryPerUserPolicy
BuildTrusteeWithObjectsAndSidW
GetSecurityDescriptorLength
CloseThreadWaitChainSession
IsValidAcl
GetAuditedPermissionsFromAclW
GetUserNameW
BuildTrusteeWithSidW
EnumerateTraceGuidsEx
LsaNtStatusToWinError
LsaEnumerateAccountRights
CryptGetHashParam
GetLengthSid
LsaQueryInformationPolicy
ConvertStringSecurityDescriptorToSecurityDescriptorW
EnumServicesStatusW
CryptSignHashW
MapGenericMask
QueryServiceConfig2W
BuildImpersonateExplicitAccessWithNameW
CryptImportKey
QueryTraceW
IsTokenUntrusted
ConvertStringSidToSidA
CryptSetProviderExA
CryptSetKeyParam
RegEnumValueA
QueryTraceA
GetKernelObjectSecurity
ConvertSidToStringSidW
EventUnregister
AuditLookupCategoryGuidFromCategoryId
LookupPrivilegeDisplayNameW
AuditFree
RegOpenKeyExW
InitializeAcl
RegOpenKeyExA
InitializeSecurityDescriptor
CheckTokenMembership
RegQueryInfoKeyA
GetFileSecurityW
EnumServicesStatusExW
CryptEnumProviderTypesA
BuildTrusteeWithSidA
OpenEventLogW
EqualPrefixSid
CryptGetDefaultProviderA
GetServiceDisplayNameW
GetMultipleTrusteeW
FreeSid
CredMarshalCredentialA
LsaEnumerateAccountsWithUserRight
OpenProcessToken
IsValidSecurityDescriptor
LookupAccountSidA
GetTraceEnableLevel
CryptContextAddRef
OpenEventLogA
AuditEnumeratePerUserPolicy
QueryUsersOnEncryptedFile
GetEventLogInformation
IsValidSid
GetMultipleTrusteeOperationA
GetTrusteeNameW
EnumDependentServicesW
CryptSetHashParam
LsaQueryTrustedDomainInfoByName
CryptHashData
ImpersonateSelf
CryptDeriveKey
GetTraceEnableFlags
CryptCreateHash
LookupAccountNameA
RegEnumKeyExW
FileEncryptionStatusA
GetSecurityDescriptorOwner
GetNamedSecurityInfoA
CryptExportKey
GetServiceKeyNameW
CryptHashSessionKey
GetTraceLoggerHandle
IsWellKnownSid
FreeInheritedFromArray
EventSetInformation
ConvertStringSidToSidW
CredGetSessionTypes
GetNamedSecurityInfoW
ReadEventLogW
AuditLookupCategoryNameA
AuditQuerySecurity
CopySid
GetSecurityDescriptorControl
RegQueryValueA
GetTrusteeNameA
AuditLookupSubCategoryNameW
BuildImpersonateTrusteeA
CryptDecrypt
QueryRecoveryAgentsOnEncryptedFile
AuditQuerySystemPolicy
GetUserNameA
LockServiceDatabase
CreateWellKnownSid
BuildTrusteeWithNameW
GetAuditedPermissionsFromAclA
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCreateKeyExA
BuildTrusteeWithObjectsAndNameW
GetPrivateObjectSecurity
CredEnumerateA
BuildTrusteeWithObjectsAndSidA
GetEncryptedFileMetadata
RegDisablePredefinedCache
AuditLookupSubCategoryNameA
CryptSignHashA
LookupPrivilegeNameW
GetThreadWaitChain
CryptGetDefaultProviderW
AreAllAccessesGranted
GetServiceKeyNameA
FileEncryptionStatusW
RegQueryValueW
LsaQueryTrustedDomainInfo
GetSidLengthRequired
EventAccessQuery
GetWindowsAccountDomainSid
ConvertToAutoInheritPrivateObjectSecurity
GetSidSubAuthority
BuildTrusteeWithNameA
CryptDuplicateKey
LookupPrivilegeValueA
GetServiceDisplayNameA
GetSecurityDescriptorGroup
AllocateAndInitializeSid
FreeEncryptionCertificateHashList
SaferGetPolicyInformation
GetSidSubAuthorityCount
LsaLookupNames
AuditQueryGlobalSaclA
CryptGenRandom
RegQueryMultipleValuesA
CryptEncrypt
LsaEnumerateTrustedDomainsEx
EventRegister
RegQueryValueExA
CloseServiceHandle
CredUnmarshalCredentialA
AreAnyAccessesGranted
EqualSid
GetAce
GetSecurityDescriptorRMControl
GetExplicitEntriesFromAclW
GetEffectiveRightsFromAclA
QueryServiceLockStatusW
LookupPrivilegeDisplayNameA
CryptEnumProviderTypesW
CredEnumerateW
ReadEventLogA
IsTokenRestricted
ConvertSidToStringSidA
QueryServiceStatus
AuditEnumerateSubCategories
LsaFreeMemory
CryptSetProviderA
AuditQueryGlobalSaclW
GetCurrentHwProfileA
AuditEnumerateCategories
RegOpenKeyTransactedW
CryptEnumProvidersW
EqualDomainSid
ObjectCloseAuditAlarmW
AccessCheck
RegOpenKeyA
RegQueryInfoKeyW
GetAclInformation
BuildImpersonateExplicitAccessWithNameA
CryptEnumProvidersA
CryptAcquireContextW
CryptGetKeyParam
RegEnumKeyW
LsaLookupSids
RegCloseKey
GetMultipleTrusteeOperationW
GetCurrentHwProfileW
GetMultipleTrusteeA
BuildTrusteeWithObjectsAndNameA
RegQueryReflectionKey
SaferIdentifyLevel
RegEnumKeyA
ObjectCloseAuditAlarmA
IsTextUnicode
AllocateLocallyUniqueId
EnumServicesStatusExA
AuditLookupCategoryIdFromCategoryGuid
GetTrusteeFormW
CryptSetProvParam
GetSecurityDescriptorDacl
QueryAllTracesW
RegOpenKeyTransactedA
RegEnableReflectionKey
RevertToSelf
CryptAcquireContextA
QuerySecurityAccessMask
QueryServiceLockStatusA
GetEffectiveRightsFromAclW
CryptVerifySignatureA
GetExplicitEntriesFromAclA
GetFileSecurityA
CryptDuplicateHash
RegQueryMultipleValuesW
EnumServicesStatusA
FindFirstFreeAce
GetSecurityDescriptorSacl
CryptGetUserKey
GetNumberOfEventLogRecords
LookupPrivilegeNameA
AuditLookupCategoryNameW
GetTrusteeTypeA
LookupPrivilegeValueW
GetTrusteeTypeW
EnumDependentServicesA
QueryServiceConfig2A
OpenThreadToken
DuplicateTokenEx
DuplicateToken
RegGetValueW
RegLoadMUIStringW
RegOpenUserClassesRoot
RegGetValueA
RegOpenCurrentUser
RegGetKeySecurity
RegNotifyChangeKeyValue

netapi32

NetUserGetLocalGroups
NetGroupEnum
NetUserGetInfo
NetServerGetInfo
NetLocalGroupGetMembers
NetUserEnum
NetWkstaGetInfo
NetQueryDisplayInformation
NetGetDCName
NetWkstaUserGetInfo
DsRoleGetPrimaryDomainInformation
NetGetJoinInformation
NetConnectionEnum
NetShareGetInfo
NetLocalGroupEnum

ws2_32

WSACloseEvent
WSACreateEvent
WSANtohl
WSASetLastError
WSAAsyncGetProtoByName
WSALookupServiceEnd
WSAStringToAddressW
inet_pton
getprotobynumber
getaddrinfo
WSAAsyncGetServByName
WSAStartup
inet_addr
WSAHtons
WSCEnumProtocols
ntohl
getnameinfo
WSAInstallServiceClassA
WSAStringToAddressA
FreeAddrInfoW
WSALookupServiceBeginW
WSAAddressToStringA
WSALookupServiceNextW
WSAAsyncGetHostByName
WSAEnumProtocolsA
WSAAsyncGetServByPort
getprotobyname
getservbyport
freeaddrinfo
htons
inet_ntop
htonl
WSAEnumProtocolsW
ntohs
WSAAddressToStringW
inet_ntoa
getservbyname
WSAAsyncGetHostByAddr
GetAddrInfoW
WSAInstallServiceClassW
WSACleanup

wininet

RetrieveUrlCacheEntryStreamW
CreateMD5SSOHash
GetUrlCacheEntryInfoExA
FindFirstUrlCacheEntryW
InternetCrackUrlW
InternetCreateUrlA
FindFirstUrlCacheEntryExW
FindFirstUrlCacheEntryExA
FindNextUrlCacheEntryExA
ReadUrlCacheEntryStream
InternetCrackUrlA
InternetCanonicalizeUrlA
GetUrlCacheConfigInfoA
GetUrlCacheConfigInfoW
FindNextUrlCacheEntryA
GetUrlCacheGroupAttributeW
InternetTimeFromSystemTimeA
FindFirstUrlCacheGroup
InternetTimeFromSystemTime
FindNextUrlCacheGroup
ReadUrlCacheEntryStreamEx
FindNextUrlCacheEntryExW
FindFirstUrlCacheEntryA
InternetAlgIdToStringW
InternetCanonicalizeUrlW
InternetCombineUrlW
GetUrlCacheEntryInfoA
InternetCombineUrlA
GetUrlCacheEntryInfoExW
InternetTimeToSystemTimeW
GetUrlCacheEntryInfoW
GetUrlCacheGroupAttributeA
InternetTimeToSystemTimeA
RetrieveUrlCacheEntryStreamA
InternetSecurityProtocolToStringW
FindCloseUrlCache
FindNextUrlCacheEntryW
InternetSecurityProtocolToStringA
InternetTimeFromSystemTimeW
InternetCreateUrlW
InternetTimeToSystemTime
InternetAlgIdToStringA

crypt32

CryptBinaryToStringA
CryptFindOIDInfo
CryptFormatObject
CryptStringToBinaryA
CryptGetMessageSignerCount
CertFreeCertificateContext
CryptDecodeObjectEx
CryptDecodeObject
CryptHashPublicKeyInfo
CryptBinaryToStringW
CertCreateCertificateContext
CryptMsgClose
CryptMsgControl
CryptFreeOIDFunctionAddress
CryptVerifyMessageSignature
CryptStringToBinaryW
CryptImportPublicKeyInfo
CryptProtectData
CryptUnprotectData
CertFindCertificateInStore
CryptEncodeObjectEx
CryptMsgGetParam
CryptQueryObject

comctl32

ord236
ImageList_GetBkColor
ord337
ImageList_GetIcon
ord320
ord328
ord386
ord329
ord9
ord388
ord333
ord325
ImageList_Remove
ord332
ImageList_GetIconSize
ImageList_Duplicate
ord338
ord334
ImageList_Write
ImageList_Copy
ord17
ImageList_Destroy
ord331
ord321
ImageList_SetIconSize
ord324
ImageList_SetOverlayImage
ord340
ImageList_Create
InitMUILanguage
ord335
ImageList_GetImageCount
ImageList_GetImageInfo
ord326
ord336
ImageList_Add
ImageList_Read
ImageList_SetBkColor
ord387
ord323
ord330
ord322
ImageList_Merge
ImageList_ReplaceIcon
CreatePropertySheetPageA
ImageList_AddMasked
ord10
DestroyPropertySheetPage
ord385
GetMUILanguage
ImageList_GetDragImage
CreatePropertySheetPageW
ImageList_SetImageCount
InitCommonControlsEx
ImageList_Replace
ord339
ord11
ord327

rpcrt4

RpcStringFreeW
NdrVaryingArrayBufferSize
NdrOleFree
RpcErrorResetEnumeration
UuidCreateNil
UuidToStringA
NdrVaryingArrayFree
DceErrorInqTextA
UuidToStringW
DceErrorInqTextW
UuidIsNil
UuidEqual
RpcStringFreeA
NdrByteCountPointerFree
NdrInterfacePointerFree
RpcFreeAuthorizationContext
UuidHash
NdrByteCountPointerBufferSize
NdrOleAllocate
UuidFromStringA
I_RpcAllocate
NdrNsGetBuffer
NdrPointerBufferSize
NdrSimpleStructBufferSize
NdrXmitOrRepAsBufferSize
RpcErrorGetNumberOfRecords
NdrInterfacePointerBufferSize
UuidCompare
RpcErrorGetNextRecord
NdrGetBuffer
NdrPointerFree
NdrPartialIgnoreClientBufferSize
NdrXmitOrRepAsFree
NdrSimpleStructFree
NdrPointerMemorySize
NdrByteCountPointerMarshall
UuidFromStringW
NdrGetUserMarshalInfo

iphlpapi

GetExtendedTcpTable
GetInterfaceInfo
IpRenewAddress
GetIfTable
GetIpAddrTable
GetAdaptersInfo
GetAdaptersAddresses
GetNetworkParams
GetTcpTable
NotifyRouteChange

shlwapi

StrToInt64ExA
PathRenameExtensionA
PathUnquoteSpacesA
SHStrDupW
ord615
ColorAdjustLuma
ord184
ord553
UrlUnescapeW
ord513
UrlCanonicalizeA
PathMakePrettyA
StrCSpnIW
PathFindNextComponentA
IntlStrEqWorkerW
UrlHashA
StrChrA
SHQueryValueExA
StrIsIntlEqualA
UrlIsW
SHEnumKeyExW
PathRemoveExtensionW
ord632
PathIsContentTypeW
StrCatChainW
SHCreateThreadRef
StrDupW
PathIsURLW
PathRemoveFileSpecW
SHDeleteEmptyKeyW
StrCmpNW
PathFindFileNameW
IsCharSpaceA
StrCmpLogicalW
StrRStrIW
StrCmpW
StrStrNW
PathFindOnPathW
ord214
PathCombineW
PathMakePrettyW
PathUndecorateW
PathIsRelativeA
SHEnumValueW
AssocQueryStringByKeyW
GetMenuPosFromID
PathCompactPathExW
PathIsURLA
ord154
UrlApplySchemeA
StrRChrA
StrCmpNIW
PathIsDirectoryEmptyA
StrSpnA
PathIsUNCA
UrlIsNoHistoryA
SHGetValueA
PathQuoteSpacesW
ord155
SHQueryInfoKeyA
PathMatchSpecExA
StrFormatByteSize64A
SHSetThreadRef
ord12
ord212
ord217
ord1
AssocQueryStringA
PathRelativePathToA
PathAppendA
PathCanonicalizeA
PathCommonPrefixA
PathRemoveBlanksW
SHEnumKeyExA
PathCombineA
UrlCreateFromPathW
StrFromTimeIntervalA
StrSpnW
PathIsNetworkPathA
ord345
UrlIsOpaqueW
PathStripToRootW
SHRegGetPathA
StrCmpIW
PathGetDriveNumberW
SHRegEnumUSKeyA
UrlCompareW
PathFindSuffixArrayW
StrRChrIW
PathIsLFNFileSpecA
ord16
PathQuoteSpacesA
SHRegGetBoolUSValueW
PathMatchSpecW
SHRegGetUSValueW
SHGetInverseCMAP
UrlGetPartA
PathParseIconLocationW
ord487
StrChrIA
ord156
StrStrW
PathIsDirectoryA
PathIsDirectoryW
PathStripPathW
PathUnquoteSpacesW
PathGetArgsW
PathFindFileNameA
StrStrIW
StrStrIA
ord596
UrlApplySchemeW
SHGetValueW
StrToIntW
StrNCatA
ord152
SHDeleteEmptyKeyA
PathUndecorateA
PathRelativePathToW
SHRegQueryInfoUSKeyA
PathCreateFromUrlA
AssocIsDangerous
StrCmpNA
StrPBrkW
StrPBrkA
ord157
StrFormatByteSizeW
PathSearchAndQualifyA
PathAddExtensionA
UrlCombineA
PathIsPrefixW
PathRemoveArgsW
PathIsNetworkPathW
PathAddBackslashW
PathIsFileSpecA
IntlStrEqWorkerA
PathFileExistsW
UrlIsOpaqueA
SHRegQueryUSValueW
PathIsSystemFolderA
PathAddExtensionW
PathRemoveArgsA
ord225
PathGetCharTypeW
PathRemoveBlanksA
StrTrimW
UrlCanonicalizeW
PathFileExistsA
UrlCompareA
SHRegGetPathW
PathFindNextComponentW
SHGetThreadRef
StrRChrIA
StrChrW
StrRetToBufW
StrRetToBufA
SHRegGetValueA
StrCatBuffA
PathUnExpandEnvStringsW
AssocQueryStringW
SHStrDupA
ord14
SHIsLowMemoryMachine
ord219
PathRemoveExtensionA
PathIsFileSpecW
PathRemoveBackslashA
StrStrNIW
PathMatchSpecA
PathIsRootW
wvnsprintfW
StrRetToStrA
StrRStrIA
PathMatchSpecExW
StrToIntExW
PathCanonicalizeW
PathSearchAndQualifyW
PathStripPathA
SHQueryInfoKeyW
PathFindOnPathA
SHSkipJunction
HashData
PathIsContentTypeA
PathIsRelativeW
SHRegGetUSValueA
PathIsUNCW
PathCreateFromUrlAlloc
StrCSpnW
ord515
StrChrNW
PathAppendW
SHRegQueryInfoUSKeyW
AssocQueryStringByKeyA
StrRChrW
ord280
SHRegDuplicateHKey
StrStrA
SHQueryValueExW
UrlCombineW
StrFormatKBSizeW
PathFindSuffixArrayA
PathAddBackslashA
PathIsSystemFolderW
PathSkipRootW
StrChrIW
ord276
PathBuildRootW
UrlIsNoHistoryW
AssocGetPerceivedType
SHRegEnumUSValueW
ord597
SHReleaseThreadRef
PathGetDriveNumberA
ord203
StrCatW
ord158
PathStripToRootA
PathIsUNCServerShareA
PathCreateFromUrlW
StrFormatKBSizeA
StrTrimA
StrToIntA
ColorRGBToHLS
ChrCmpIA
PathFindExtensionW
PathIsLFNFileSpecW
ord462
AssocQueryKeyW
ord437
ColorHLSToRGB
UrlCreateFromPathA
PathGetCharTypeA
PathSkipRootA
ord213
SHRegGetValueW
PathCompactPathExA
PathIsSameRootA
SHRegEnumUSKeyW
StrCmpNIA
ord2
PathFindExtensionA
UrlGetLocationA
SHRegQueryUSValueA
PathIsSameRootW
StrFromTimeIntervalW
StrChrNIW
UrlGetPartW
PathIsDirectoryEmptyW
ord354
PathParseIconLocationA
PathIsRootA
StrCpyW
SHRegEnumUSValueA
UrlEscapeA
StrCSpnIA
StrFormatByteSizeA
ord151
PathBuildRootA
PathIsUNCServerShareW
ord153
ord346
PathUnExpandEnvStringsA
AssocQueryKeyA
PathCommonPrefixW
wvnsprintfA
UrlEscapeW
UrlIsA
StrToIntExA
PathIsUNCServerA
StrNCatW
StrCSpnA
PathGetArgsA
ord215
StrCatBuffW
ord353
ChrCmpIW
StrDupA
PathRemoveBackslashW
StrIsIntlEqualW
SHRegGetBoolUSValueA
PathIsPrefixA
UrlHashW
ord512
UrlGetLocationW
SHEnumValueA
UrlUnescapeA
PathRenameExtensionW
PathRemoveFileSpecA
StrRetToStrW
PathIsUNCServerW
StrCpyNW

kernel32

K32GetProcessImageFileNameW
K32GetProcessImageFileNameA
K32GetModuleFileNameExW
CreateThreadpoolWork
FileTimeToDosDateTime
GetCurrentConsoleFont
FlushFileBuffers
CreateTimerQueue
FindFirstFileTransactedA
ReadConsoleOutputAttribute
EnableThreadProfiling
CheckRemoteDebuggerPresent
DebugSetProcessKillOnExit
GetComputerNameA
VirtualQueryEx
IsDebuggerPresent
GetConsoleSelectionInfo
LocalShrink
GetSystemTimePreciseAsFileTime
LoadLibraryExW
AddIntegrityLabelToBoundaryDescriptor
GlobalReAlloc
OpenThread
InterlockedPopEntrySList
GetFileTime
GetDriveTypeW
GetProcessTimes
GetVolumeInformationByHandleW
CheckNameLegalDOS8Dot3W
IsWow64Process
VirtualQuery
GetConsoleAliasExesLengthA
GetProfileStringA
GetFirmwareEnvironmentVariableW
MapViewOfFileEx
GetCompressedFileSizeA
LocalUnlock
EnumDateFormatsExA
MulDiv
QueryProcessAffinityUpdateMode
FlsAlloc
GetProcessHandleCount
GetStringTypeA
GetDllDirectoryW
EnumDateFormatsW
lstrcmpW
ConvertThreadToFiber
AllocConsole
FreeEnvironmentStringsA
SetDllDirectoryW
GetConsoleOriginalTitleA
SetCommState
GetCurrencyFormatA
Heap32First
FlsFree
GlobalUnlock
GetTimeZoneInformationForYear
ReadConsoleOutputA
GetTickCount
GetPrivateProfileStringA
SetCommTimeouts
FindNextStreamW
CheckNameLegalDOS8Dot3A
GetVolumePathNameA
CreateIoCompletionPort
GetSystemPreferredUILanguages
InitializeSListHead
GetDateFormatW
HeapUnlock
GetStringTypeW
GetSystemRegistryQuota
GetNLSVersion
GetProcessGroupAffinity
QueryPerformanceCounter
BackupSeek
lstrcmpiW
IsValidLocaleName
ReadFileScatter
FindNextVolumeW
GetPrivateProfileIntA
GetNumaNodeProcessorMaskEx
GetSystemWindowsDirectoryW
GetProcessPriorityBoost
MapViewOfFile
CreateEventA
SetThreadPreferredUILanguages
ReleaseActCtx
DosDateTimeToFileTime
InterlockedPushEntrySList
GetTapeStatus
CreateSemaphoreA
CreateFileMappingW
GetTempFileNameA
DebugBreak
CreateWaitableTimerExW
VirtualFreeEx
LocalCompact
SetThreadErrorMode
FormatMessageA
GlobalFindAtomA
GlobalMemoryStatus
GetThreadGroupAffinity
Wow64GetThreadSelectorEntry
GetSystemTime
GetEnabledXStateFeatures
SetFileApisToANSI
GetDiskFreeSpaceExA
_lclose
GetComputerNameExA
EnumSystemFirmwareTables
QueryIdleProcessorCycleTime
LocalFlags
EnumSystemGeoID
AddAtomW
GetFileType
GetSystemTimeAsFileTime
CreateProcessA
GetFileMUIInfo
LocalReAlloc
ReadConsoleOutputCharacterW
QueryFullProcessImageNameW
Module32NextW
UpdateResourceA
FreeUserPhysicalPages
SystemTimeToTzSpecificLocalTime
GetThreadTimes
TlsGetValue
VerifyVersionInfoW
LocaleNameToLCID
GlobalWire
lstrcmpiA
OpenFileMappingA
GlobalUnfix
BuildCommDCBAndTimeoutsA
GetLongPathNameTransactedW
CreateEventExA
lstrcpyW
GetEnvironmentStrings
GetVolumePathNamesForVolumeNameW
GetConsoleWindow
OpenJobObjectA
GetNumaProximityNode
GetProfileStringW
FlushInstructionCache
EnumTimeFormatsA
GlobalFix
IsValidLanguageGroup
CreateSemaphoreW
FreeLibrary
GetLongPathNameA
GetModuleHandleW
IsValidLocale
FindFirstChangeNotificationA
GlobalMemoryStatusEx
GetNumberOfConsoleInputEvents
SystemTimeToFileTime
GetProcessHeap
EnumSystemLocalesW
GetCurrentProcessId
SetConsoleCP
GetPrivateProfileStructA
SetEnvironmentVariableA
DisableThreadProfiling
FindVolumeClose
GetComputerNameW
FindNextVolumeA
GetConsoleAliasesA
lstrcpynA
LCMapStringW
VerSetConditionMask
FindAtomW
ExitProcess
DeleteCriticalSection
NeedCurrentDirectoryForExePathA
GetFileSize
WTSGetActiveConsoleSessionId
CreateJobObjectA
GetStartupInfoA
GetProcessorSystemCycleTime
GetThreadId
GetTimeFormatW
HeapQueryInformation
CreateFileMappingA
CreateMutexExW
VirtualAllocEx
SetFilePointerEx
GlobalLock
GetCalendarInfoA
FindAtomA
GetPriorityClass
GetErrorMode
WriteConsoleW
PeekConsoleInputW
GetWindowsDirectoryW
SetCurrentDirectoryW
InitAtomTable
GetSystemWow64DirectoryA
ReadDirectoryChangesW
GetThreadContext
GetDurationFormatEx
GetCurrentProcessorNumber
LocalSize
IsThreadAFiber
EnumSystemLanguageGroupsA
QueryIdleProcessorCycleTimeEx
GetNamedPipeClientSessionId
HeapDestroy
SearchPathA
NormalizeString
DecodePointer
GetNamedPipeServerProcessId
AddSIDToBoundaryDescriptor
FindNextChangeNotification
HeapCompact
GetLogicalDriveStringsA
CreateWaitableTimerA
GetCurrentConsoleFontEx
GetOverlappedResult
UpdateResourceW
SetStdHandle
GetProcessPreferredUILanguages
GetCurrentDirectoryW
K32GetModuleFileNameExA
K32GetModuleBaseNameW
K32GetProcessMemoryInfo
K32GetModuleBaseNameA
K32EnumProcesses
K32EnumProcessModules
RemoveVectoredExceptionHandler
RtlUnwind
RaiseException
AddVectoredExceptionHandler
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WinExec
TlsFree
GetQueuedCompletionStatusEx
GetNLSVersionEx
GetUserGeoID
GetDefaultCommConfigW
GetConsoleOriginalTitleW
GetLocalTime
LocateXStateFeature
Module32FirstW
QueueUserAPC
GetAtomNameA
FileTimeToLocalFileTime
GetCurrencyFormatW
HeapAlloc
EnumDateFormatsA
GlobalFindAtomW
EnumDateFormatsExW
FindResourceW
QueryActCtxSettingsW
LoadResource
GetActiveProcessorCount
AddAtomA
GetWindowsDirectoryA
IsDBCSLeadByte
ResetEvent
FindResourceExW
HeapSetInformation
CreateThread
CancelIoEx
CreateThreadpoolTimer
GetDefaultCommConfigA
QueryProcessCycleTime
K32GetModuleInformation
GetProcessHeaps
GetSystemInfo
FindNLSStringEx
EnumResourceLanguagesW
GetCPInfoExA
GetNumberFormatW
CompareStringEx
GetNativeSystemInfo
ReleaseSRWLockShared
GetProcessIoCounters
CreateThreadpoolCleanupGroup
CloseHandle
HeapReAlloc
GlobalFree
GetConsoleTitleA
Process32FirstW
GetSystemDEPPolicy
lstrcpyA
Process32Next
OpenSemaphoreW
GlobalAlloc
GetDateFormatA
DeleteFileA
GlobalFlags
GetCommState
EnumResourceNamesExW
QueryPerformanceFrequency
GetFullPathNameTransactedW
LockResource
PulseEvent
FindResourceExA
CreateThreadpoolWait
GetVersionExA
TlsAlloc
WaitForSingleObjectEx
GetTapeParameters
GetApplicationRestartSettings
lstrcatW
ReadConsoleW
GetProfileIntA
FindCloseChangeNotification
EnumDateFormatsExEx
GetNumaProximityNodeEx
GetActiveProcessorGroupCount
SetDllDirectoryA
GetSystemDirectoryA
InitOnceComplete
InterlockedFlushSList
ReadConsoleOutputW
GetMailslotInfo
GetCurrentThread
GetSystemFileCacheSize
GetDiskFreeSpaceExW
GetNamedPipeHandleStateW
VerLanguageNameW
CreateMutexExA
GetNumaNodeProcessorMask
FileTimeToSystemTime
GetLogicalProcessorInformation
SetEvent
GetUserDefaultLCID
VerLanguageNameA
CreateFileA
GetThreadUILanguage
GlobalSize
QueryFullProcessImageNameA
FlushViewOfFile
GetCurrentActCtx
EnumResourceNamesExA
SetMessageWaitingIndicator
ConvertDefaultLocale
EnumCalendarInfoExA
GetStringTypeExA
EncodeSystemPointer
GetMaximumProcessorGroupCount
GetBinaryTypeA
GetConsoleProcessList
GetConsoleDisplayMode
SetCriticalSectionSpinCount
Process32NextW
ReleaseSRWLockExclusive
GetFileAttributesExW
GetLogicalProcessorInformationEx
ZombifyActCtx
GetConsoleAliasesLengthW
GetFileAttributesA
GetCalendarInfoW
AddRefActCtx
GetCurrencyFormatEx
GetLargestConsoleWindowSize
GetLastError
FlsSetValue
Wow64RevertWow64FsRedirection
GetMaximumProcessorCount
CopyFileA
LCMapStringEx
VerifyScripts
CompareStringA
BuildCommDCBW
GetTickCount64
GetNumberFormatA
GetDevicePowerState
EnumSystemLanguageGroupsW
GlobalAddAtomA
ReadThreadProfilingData
GetDiskFreeSpaceA
GetNamedPipeHandleStateA
LocalFileTimeToFileTime
GetTimeZoneInformation
GetDurationFormat
EnumUILanguagesA
FormatMessageW
IsBadHugeWritePtr
GetTempPathA
BuildCommDCBAndTimeoutsW
QueryThreadProfiling
GetFileInformationByHandle
GetConsoleMode
GetFinalPathNameByHandleA
GetPrivateProfileStringW
GetSystemWow64DirectoryW
MultiByteToWideChar
ConvertThreadToFiberEx
GetProfileSectionA
ReadConsoleOutputCharacterA
CreateEventW
CreateToolhelp32Snapshot
GetLogicalDriveStringsW
HeapSummary
IsValidCodePage
QueueUserWorkItem
GetVolumeNameForVolumeMountPointW
GetCommandLineA
GetConsoleAliasExesA
_llseek
FindActCtxSectionStringA
CancelWaitableTimer
PostQueuedCompletionStatus
SwitchToFiber
GetFullPathNameTransactedA
_lopen
EnumResourceLanguagesExA
BuildCommDCBA
GetNamedPipeInfo
DnsHostnameToComputerNameA
GetVersion
HeapSize
OpenProcess
LCIDToLocaleName
FindFirstChangeNotificationW
GlobalAddAtomW
FreeResource
RtlCaptureStackBackTrace
GetSystemWindowsDirectoryA
SetStdHandleEx
GetSystemDefaultLocaleName
CopyContext
GetVolumePathNamesForVolumeNameA
GetACP
GetSystemDefaultLangID
GetLocaleInfoA
ExitThread
IsProcessInJob
GetStringScripts
lstrcatA
HeapValidate
DuplicateHandle
UnmapViewOfFile
GlobalGetAtomNameW
GetAtomNameW
GetUILanguageInfo
OpenSemaphoreA
QueryMemoryResourceNotification
GetCurrentDirectoryA
DeactivateActCtx
HeapWalk
GetPrivateProfileSectionA
GetComputerNameExW
IsSystemResumeAutomatic
SetSearchPathMode
GetSystemDirectoryW
SetupComm
K32QueryWorkingSetEx
GetCommTimeouts
ReadConsoleA
GetUserPreferredUILanguages
OpenFileMappingW
CreateSemaphoreExA
ReleaseMutex
GetXStateFeaturesMask
QueryThreadCycleTime
GetPrivateProfileSectionNamesW
GetVersionExW
lstrcmpA
OpenEventW
GetVolumeNameForVolumeMountPointA
OpenJobObjectW
SetLastError
GetProcAddress
WideCharToMultiByte
GetCurrentProcess
TerminateProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleHandleA
LoadLibraryA
K32EnumDeviceDrivers
AreFileApisANSI
GetNumaHighestNodeNumber
GetSystemFirmwareTable
GetPrivateProfileStructW
CreateHardLinkA
GetStartupInfoW
GetShortPathNameA
GetCPInfoExW
ReadFile
GetModuleFileNameA
GetProcessWorkingSetSizeEx
GlobalGetAtomNameA
OpenEventA
InitializeSRWLock
EnumResourceLanguagesA
QueryUnbiasedInterruptTime
EnumLanguageGroupLocalesW
SizeofResource
FindStringOrdinal
GetCommConfig
QueryDosDeviceW
GetNamedPipeClientComputerNameA
TryEnterCriticalSection
SetConsoleCtrlHandler

user32

GetForegroundWindow
CreateIcon
EnumDisplaySettingsA
DlgDirListA
GetSysColor
GetTopWindow
DdeUninitialize
GetMonitorInfoA
ToUnicodeEx
DefFrameProcA
GetWindowWord
GetDlgItemTextW
DrawFocusRect
SetMenuDefaultItem
MapVirtualKeyA
SetDebugErrorLevel
IsProcessDPIAware
CreateIconFromResource
EnumPropsW
SetWindowTextA
LoadBitmapA
CreateCursor
CharToOemBuffA
GetRegisteredRawInputDevices
wvsprintfA
SetMenuContextHelpId
GetKeyboardLayout
CharToOemA
GetQueueStatus
GetClipCursor
TrackMouseEvent
GetDoubleClickTime
InternalGetWindowText
SetMenuInfo
CountClipboardFormats
GetMenuContextHelpId
GetRawInputData
OemKeyScan
GetWindowLongA
MapWindowPoints
RegisterClassW
IsWindowEnabled
LoadMenuIndirectW
IsCharUpperA
EnumClipboardFormats
TabbedTextOutA
GetDialogBaseUnits
SetDlgItemTextW
GetKeyboardLayoutList
SetMenu
WindowFromDC
CreateCaret
IsDlgButtonChecked
RegisterClassA
GetPropA
CreateAcceleratorTableA
CharUpperBuffA
LoadAcceleratorsA
EnumDisplaySettingsExA
IsChild
EnumPropsExW
GetWindowTextA
QueryDisplayConfig
GetLayeredWindowAttributes
GetUserObjectSecurity
EnumDisplaySettingsExW
GetTitleBarInfo
GetMessageTime
DefWindowProcA
CreateAcceleratorTableW
LoadBitmapW
DestroyMenu
GetMouseMovePointsEx
IsRectEmpty
CreateWindowExA
GetWindowRgnBox
PhysicalToLogicalPoint
IntersectRect
CreateMenu
GetWindowModuleFileNameW
GetMenuStringA
GetClipboardFormatNameA
GetMenuItemInfoA
CharLowerBuffW
MapVirtualKeyExA
MenuItemFromPoint
EnableMenuItem
EnumPropsA
CharPrevW
IsCharLowerA
DestroyAcceleratorTable
SetMenuItemInfoW
FindWindowExA
ClientToScreen
DdeCreateStringHandleA
GetDlgCtrlID
CreateIconIndirect
GetKeyboardLayoutNameW
CopyRect
GetKeyboardType
GetMonitorInfoW
GetWindowInfo
GetInputState
GetScrollRange
IsHungAppWindow
GetMenuCheckMarkDimensions
SetMenuItemInfoA
VkKeyScanW
DestroyIcon
GetMenuDefaultItem
MapVirtualKeyExW
WindowFromPhysicalPoint
wvsprintfW
GetCursorInfo
SetTimer
VkKeyScanExA
LookupIconIdFromDirectory
GetCapture
GetDlgItemTextA
GetRawInputDeviceInfoW
OffsetRect
GetListBoxInfo
InSendMessage
GetKeyNameTextA
CopyAcceleratorTableW
BeginDeferWindowPos
GetClassInfoExA
AnyPopup
DefFrameProcW
GetClassLongA
IsWindow
GetClassInfoW
InSendMessageEx
GetActiveWindow
GetSubMenu
GetKeyboardState
LoadStringW
GetThreadDesktop
TrackPopupMenu
DestroyCursor
LoadAcceleratorsW
GetWindowPlacement
GetScrollPos
VkKeyScanA
GetRawInputBuffer
GetGestureConfig
WindowFromPoint
GetMenuBarInfo
RegisterClassExW
GetPriorityClipboardFormat
RealGetWindowClassW
GetShellWindow
EnumThreadWindows
IsCharAlphaA
GetWindowDC
SetCapture
DrawMenuBar
IsCharAlphaW
GetClipboardSequenceNumber
GetClassNameW
GetIconInfoExA
IsWow64Message
GetProcessDefaultLayout
EndMenu
LoadMenuIndirectA
SetDlgItemTextA
LoadCursorW
CharToOemW
GetGestureExtraArgs
EnumDisplayDevicesW
CharToOemBuffW
EnumDesktopWindows
DragDetect
GetClassInfoA
FindWindowW
LoadIconW
GetDisplayConfigBufferSizes
GetClipboardData
GetClipboardFormatNameW
GetUpdateRect
CharNextW
IsCharAlphaNumericW
GetUpdatedClipboardFormats
GetMenuStringW
GetWindowLongW
GetPhysicalCursorPos
CharNextA
GetWindowTextLengthW
GetAltTabInfoA
IsCharLowerW
SetMessageQueue
RegisterClipboardFormatW
CharPrevExA
CharLowerBuffA
DeferWindowPos
GetLastActivePopup
TabbedTextOutW
GetMenuItemInfoW
DefWindowProcW
EnumWindowStationsA
RealChildWindowFromPoint
EnumDesktopsW
GetMenuState
ModifyMenuW
SubtractRect
GetWindowModuleFileNameA
IsWinEventHookInstalled
EnumWindowStationsW
ReuseDDElParam
GetClassWord
GetKeyState
GetAltTabInfoW
LoadMenuA
GetMessageExtraInfo
CharUpperW
CharLowerW
LoadMenuW
GetUpdateRgn
GetMessagePos
OpenIcon
LoadImageA
EnumDesktopsA
ChildWindowFromPointEx
GetClassNameA
SetMenuItemBitmaps
CreatePopupMenu
SetWindowTextW
UnregisterClassW
GetSystemMetrics
EndDialog
WaitForInputIdle
GetCursor
ScreenToClient
GetKeyboardLayoutNameA
ToAsciiEx
UnionRect
GetIconInfo
CloseGestureInfoHandle
CreateWindowExW
DdeSetQualityOfService
EnumDisplayMonitors
GetGuiResources
CharPrevA
DefRawInputProc
CopyIcon
LoadStringA
EnumChildWindows
CalculatePopupWindowPosition
GetMenuItemCount
MonitorFromWindow
GetOpenClipboardWindow
MonitorFromRect
CopyImage
GetPropW
CheckRadioButton
GetClipboardOwner
GetClipboardViewer
InsertMenuA
SetMessageExtraInfo
EqualRect
GetIconInfoExW
DeregisterShellHookWindow
GetCaretPos
GetDC
InflateRect
SetLastErrorEx
InsertMenuItemW
LoadCursorA
GetFocus
GetMenu
GetMenuItemID
GetWindowRect
GetLastInputInfo
FreeDDElParam
SetProcessDefaultLayout
GetUserObjectInformationA
LoadCursorFromFileA
FindWindowExW
CreateIconFromResourceEx
EnumDisplayDevicesA
GetTouchInputInfo
GetWindow
CheckMenuRadioItem
CloseTouchInputHandle
MonitorFromPoint
MapVirtualKeyW
LogicalToPhysicalPoint
VkKeyScanExW
IsTouchWindow
GetKBCodePage
GetWindowThreadProcessId
UnpackDDElParam
GetWindowTextW
ModifyMenuA
GetWindowContextHelpId
CopyAcceleratorTableA
ToAscii
GetWindowRgn
EndPaint
GetNextDlgTabItem
CharNextExA
BeginPaint
GetGUIThreadInfo
GetGestureInfo
GetCursorPos
GetTabbedTextExtentA
IsCharUpperW
DdeCmpStringHandles
ReleaseDC
ChildWindowFromPoint
IsIconic
RegisterClipboardFormatA
GetDCEx
GetAncestor
ChangeMenuA
GetRawInputDeviceList
LoadImageW
ChangeMenuW
DrawFrameControl
UpdateWindow
RegisterClassExA
IsCharAlphaNumericA
LoadCursorFromFileW
UnregisterDeviceNotification
PtInRect
InsertMenuItemA
FindWindowA
GetParent
GetInputDesktop
GetWindowTextLengthA
GetProcessWindowStation
SetSystemCursor
EnumPropsExA
IsWindowUnicode
GetClassInfoExW
CharLowerA
SetScrollPos
GetNextDlgGroupItem
GetSysColorBrush
EnumDisplaySettingsW
GetDesktopWindow
PostQuitMessage
CheckDlgButton
KillTimer
LookupIconIdFromDirectoryEx
InsertMenuW
ToUnicode
GetUserObjectInformationW
GetScrollBarInfo
SetRectEmpty
EnableScrollBar
SwitchDesktop
LoadIconA
CharUpperA
GetDlgItemInt
SetScrollRange
MapDialogRect
TrackPopupMenuEx
AppendMenuA
GetComboBoxInfo
RemoveMenu
DisplayConfigGetDeviceInfo
CheckMenuItem
GetClientRect
IsZoomed
GetTabbedTextExtentW
GetDlgItem
GetMenuInfo
AppendMenuW
GetWindowDisplayAffinity
AddClipboardFormatListener
GetClassLongW
IsClipboardFormatAvailable
GetMenuItemRect
GetRawInputDeviceInfoA
UnregisterClassA
CharUpperBuffW
SetRect
GetCaretBlinkTime
RealGetWindowClassA
HiliteMenuItem
GetKeyNameTextW
PackDDElParam

gdi32

SetLayout
GetTextCharset
SetWindowOrgEx
CreateEllipticRgnIndirect
GetStockObject
GetFontLanguageInfo
GetNearestPaletteIndex
GetClipBox
CreateRectRgnIndirect
GetCurrentPositionEx
CreateRoundRectRgn
GetPath
GetEnhMetaFileHeader
GetCharacterPlacementA
GetDCBrushColor
SetWindowExtEx
GetBitmapBits
GetKerningPairsA
GetEnhMetaFileDescriptionA
EnumFontFamiliesExA
PathToRegion
GetEnhMetaFileA
CreateDIBPatternBrushPt
GetCharABCWidthsA
AnimatePalette
GetArcDirection
GetDeviceGammaRamp
GetLogColorSpaceA
Polyline
GetTextExtentExPointA
GetWinMetaFileBits
GetDIBits
GetWindowOrgEx
GetTextCharsetInfo
EnumFontFamiliesW
CheckColorsInGamut
SetViewportExtEx
GetDeviceCaps
GetTextMetricsW
CreatePatternBrush
GetCharWidth32A
EqualRgn
GetSystemPaletteEntries
GetPixel
GetTextAlign
GetTextFaceA
CreateRectRgn
GetBoundsRect
DeleteDC
GetTextExtentPoint32W
SetTextColor
GetMetaFileA
SetMapperFlags
GetTextExtentPointA
GetFontData
ChoosePixelFormat
GetGraphicsMode
GetRegionData
GetMetaRgn
SetBkMode
CreateFontIndirectExW
GetEnhMetaFilePaletteEntries
GetEnhMetaFileBits
GetCharABCWidthsI
CreatePen
ExtCreatePen
GetEnhMetaFileDescriptionW
CreateDiscardableBitmap
SetViewportOrgEx
SetTextJustification
GetTextExtentPointI
GetGlyphIndicesW
EnumFontFamiliesA
GetRasterizerCaps
CreatePalette
GetCharABCWidthsW
GetObjectW
GetTextExtentExPointI
GetViewportExtEx
GetTextColor
ExcludeClipRect
CreateFontIndirectA
SetBkColor
EnumMetaFile
RestoreDC
LPtoDP
GetGlyphOutlineW
EnumObjects
GetCharWidth32W
GetEnhMetaFileW
DescribePixelFormat
CreateHatchBrush
EnumFontsA
EnumFontsW
CloseEnhMetaFile
CreateColorSpaceW
GetMetaFileW
RealizePalette
LineDDA
GetPaletteEntries
SetICMMode
GdiFlush
GetColorSpace
GetStretchBltMode
GetBitmapDimensionEx
CreateBrushIndirect
GetCharWidthFloatW
GetColorAdjustment
EnumICMProfilesW
GetLogColorSpaceW
CreateCompatibleDC
GetBkMode
SetDIBColorTable
GetKerningPairsW
GetDIBColorTable
GetDCPenColor
GetTextExtentPoint32A
GetWorldTransform
CreateDIBSection
GetWindowExtEx
SelectObject
CreateFontA
GetCharABCWidthsFloatA
SaveDC
GetFontUnicodeRanges
GetICMProfileW
CreateCompatibleBitmap
EnumEnhMetaFile
AddFontMemResourceEx
GetPolyFillMode
GetBkColor
GdiSetBatchLimit
GetNearestColor
CreateDIBPatternBrush
SetMetaRgn
GetCharacterPlacementW
CreateDIBitmap
GetTextFaceW
GetClipRgn
UpdateICMRegKeyA
GetTextCharacterExtra
GetICMProfileA
UpdateICMRegKeyW
GetGlyphOutlineA
DeleteColorSpace
GetTextExtentPointW
GetGlyphIndicesA
SetGraphicsMode
EnumFontFamiliesExW
GetLayout
CreateBitmapIndirect
SetPixel
GetAspectRatioFilterEx
GetTextExtentExPointW
EnumICMProfilesA
GetCharWidthFloatA
GetDCOrgEx
CreateHalftonePalette
GetOutlineTextMetricsA
GetObjectA
FixBrushOrgEx
DPtoLP
GetCharWidthW
CreateFontIndirectExA
GetEnhMetaFilePixelFormat
GetROP2
GetViewportOrgEx
TranslateCharsetInfo
UnrealizeObject
GetSystemPaletteUse
DeleteObject
GetMiterLimit
CreateSolidBrush
GetCharABCWidthsFloatW
CreateEllipticRgn
RemoveFontMemResourceEx
GetBrushOrgEx
GetTextMetricsA
SetMapMode
CreateBitmap
CreateFontIndirectW
GetCurrentObject
GetRandomRgn
GetCharWidthI
GetOutlineTextMetricsW
SetTextAlign
GetMapMode
GetMetaFileBitsEx
GetObjectType
GetPixelFormat
SetDCPenColor
GetCharWidthA
CreateColorSpaceA
GetRgnBox

winspool.drv

DeviceCapabilitiesW
DeviceCapabilitiesA
EnumPrinterDriversA
EnumPortsA

comdlg32

GetFileTitleW
GetFileTitleA
CommDlgExtendedError

shell32

ord682
SHGetMalloc
ord680
SHEnumerateUnreadMailAccountsW
ord152
SHGetIconOverlayIndexA
ord195
ord83
ord19
ExtractAssociatedIconW
ord180
SHGetSettings
SHGetSpecialFolderPathA
DragAcceptFiles
FindExecutableA
ord654
DoEnvironmentSubstW
Shell_GetCachedImageIndexW
ord154
DragFinish
ord245
DragQueryPoint
ord27
CommandLineToArgvW
SHGetFolderPathW
ord18
SHGetKnownFolderItem
ord155
DoEnvironmentSubstA
SHGetPathFromIDListEx
ExtractIconW
ord66
SHGetKnownFolderPath
ord153
ord189
ExtractIconExA
SHGetFolderPathA
ord98
DragQueryFileA
SHQueryRecycleBinW
SHGetIDListFromObject
Shell_GetCachedImageIndexA
ord17
DragQueryFileW
SHGetFolderPathAndSubDirW
SHGetDataFromIDListW
SHCreateDefaultExtractIcon
ShellExecuteA
ord179
ord147
SHGetSpecialFolderLocation
ord16
ord196
ExtractAssociatedIconExW
SHGetDiskFreeSpaceExA
ord71
SHGetPathFromIDListA
ExtractAssociatedIconA
SHGetFolderPathAndSubDirA
ord41
ord524
SHGetUnreadMailCountW
ord43
ExtractIconExW
ord74
SHGetPathFromIDListW
ExtractAssociatedIconExA
ord688
ord193
FindExecutableW
SHGetItemFromObject
ord10
ord92
SHGetDriveMedia
ord25
GetCurrentProcessExplicitAppUserModelID
SHGetLocalizedName
ord190
ord67
SHGetDiskFreeSpaceExW
SHGetSpecialFolderPathW
SHQueryRecycleBinA
ExtractIconA
SHGetIconOverlayIndexW
ord750
ord42
SHGetDataFromIDListA
SHGetFolderLocation

ole32

ReleaseStgMedium
StringFromCLSID
ReadClassStm
CoTaskMemAlloc
GetRunningObjectTable
CoFileTimeNow
MkParseDisplayName
ReadFmtUserTypeStg
CLSIDFromString
CoDosDateTimeToFileTime
CoTaskMemRealloc
StringFromIID
OleGetClipboard
CLSIDFromProgIDEx
RegisterDragDrop
ReadClassStg
CoFileTimeToDosDateTime
WriteClassStm
WriteClassStg
CoTaskMemFree
CLSIDFromProgID
StringFromGUID2
CoCreateGuid
FreePropVariantArray

oleaut32

VarBstrFromI8
VarI1FromDec
VarI1FromUI4
BSTR_UserSize
VarI4FromI1
VarBstrFromUI1
VarUI4FromStr
VarFormatDateTime
VarI4FromI8
VarR8FromDisp
VarUI8FromI8
VarEqv
VarUI1FromI1
VariantClear
VarUI1FromCy
VarCyFromBool
VarI8FromI1
VarBoolFromR8
VarBstrFromUI4
VariantChangeType
VarUI1FromUI2
VarUI1FromDec
SafeArrayAllocData
VarI1FromR8
VarI8FromUI2
VarI4FromUI1
VarBstrFromUI2
VarNumFromParseNum
VarDecFromUI8
SysAllocStringLen
SafeArrayCreateVector
CreateDispTypeInfo
VarAbs
VarI1FromBool
VarR8FromUI8
VarDecFromR4
VarUI2FromI2
SafeArrayAllocDescriptor
VarCyFromUI4
VarPow
VarI1FromDisp
VarFormatCurrency
VarWeekdayName
VarDateFromBool
VarR4FromI2
SafeArrayAccessData
VarDecSu
QueryPathOfRegTypeLi
VarDateFromI4
VarDateFromUI4
VarUI2FromR4
VarCyFromUI1
VarUdateFromDate
VarMul
VarUI4FromDate
VarI1FromUI2
VarR8FromI8
VarR4FromI8
VarDecFromUI1
VarI1FromCy
VarUI2FromBool
GetAltMonthNames
LHashValOfNameSys
VarDecAdd
VarCyFromI4
VarUI2FromUI4
VarUI8FromR4
VarUI8FromUI1
VarR8FromStr
VarUI8FromBool
SafeArrayRedim
VarDiv
VarUI8FromR8
VarUI2FromDisp
VarCyCmpR8
VarBstrFromI1
DosDateTimeToVariantTime
SystemTimeToVariantTime
VarAnd
VarUI4FromI1
VarUI4FromDec
VarInt
LHashValOfNameSysA
SafeArrayGetDim
VarI4FromR8
VarUI4FromI4
VarI8FromUI4
VarI8FromBool
VarUI2FromCy
SafeArrayPtrOfIndex
SafeArrayGetIID
VarBoolFromR4
VarUI4FromUI2
VarCyFromDec
VarDecFromUI4
VarCat
VarUI1FromUI4
VarR8FromDate
VarI2FromStr
GetRecordInfoFromTypeInfo
VarUI8FromI1
VarR4FromI4
SafeArrayDestroy
VarCyFromI2
VarR4FromUI1
VarBstrFromR8
VarCyFromStr
VarUI8FromI2
VarUI2FromUI1
VarI4FromI2
VarI1FromStr
SysReAllocString
VarUI8FromDec
VarDecFromStr
VarUI8FromUI4
VarBoolFromDate
VarDecMul
VarDateFromUdateEx
VarOr
VarI2FromI8
VariantInit
VarBoolFromI4
VarDateFromR4
SafeArrayGetUBound
VarI4FromDisp
VarCyFromDate
VarR4FromDate
VarUI2FromDate
VarUI1FromI2
BstrFromVector
VarCySu
VarI1FromUI8
SafeArrayGetElement
SafeArraySetRecordInfo
VarDecRound
VarUI2FromR8
VarUI8FromUI2
VarFix
VarDateFromUI8
VarDecFromBool
SafeArrayUnlock
VarR4FromDisp
VarCyRound
VarI4FromUI4
VarR4FromCy
VarUI1FromDisp
VarUI1FromI4
SafeArrayGetLBound
VarBoolFromUI2
VariantCopyInd
VarI2FromDisp
VarI4FromDate
SafeArrayCreateEx
VarXor
VarUI4FromUI1
VarDecFromDate
SysFreeString
SafeArrayAllocDescriptorEx
VarUI1FromUI8
VarDateFromUdate
VarCyMulI4
VarI2FromUI1
VarUI4FromI2
VarFormat
VarBoolFromI2
BSTR_UserMarshal
OleCreateFontIndirect
VarI8FromDisp
VarUI4FromDisp
SafeArrayCopy
VarR4FromUI2
SysStringByteLen
SafeArrayGetVartype
VarUI4FromR8
VarDateFromDec
VarFormatFromTokens
VarI8FromR8
VarUI4FromUI8
VarR4CmpR8
VarI2FromCy
VarI8FromUI8
VarI8FromDate
SysAllocStringByteLen
VarR8Round
VarI8FromDec
VarI2FromI1
VarCyAbs
VarBstrFromUI8
VarCyFromR4
VarCyFromUI8
VarBstrCat
VarMod
VarCyFromDisp
VarBoolFromI8
VarBstrFromDisp
VarDateFromDisp
VarUI1FromStr
OaBuildVersion
VarBoolFromUI1
VarUI4FromCy
VarSu
VarDecNeg
VarI2FromI4
GetErrorInfo
VarDateFromUI1
VarUI2FromI4
VariantTimeToDosDateTime
VarBstrFromR4
VarI1FromUI1
VarUI8FromCy
VarI4FromStr
VarBoolFromCy
VarNot
VarI4FromUI2
VarUI1FromDate
SafeArrayDestroyData
VarI1FromI8
VarTokenizeFormatString
VarUI4FromI8
VarDateFromI2
VarMonthName
VarUI8FromStr
VarDecInt
VarUI2FromI8
VarNeg
SysAllocString
SafeArrayPutElement
VarUI2FromUI8
VarR8FromUI2
VarBstrFromI4
SafeArraySetIID
VarI1FromI4
VariantCopy
VarI4FromCy
VarCyMulI8
VarIdiv
VectorFromBstr
VarAdd
VarBstrCmp
VarDateFromI1
SafeArrayCopyData
VarDecFix
VarCyFix
VarDateFromUI2
VarR8FromI4
VarCyFromI1
SafeArrayDestroyDescriptor
VarCmp
VarUI8FromDate
SafeArrayCreate
VarDecAbs
SafeArrayUnaccessData
VarI2FromUI8
VarBstrFromDate
VarI1FromDate
VarI2FromBool
VarBoolFromStr
VarDateFromCy
VarCyFromR8
SafeArrayGetRecordInfo
VarR8FromCy
ClearCustData
VarR8FromR4
SysStringLen
VarUI2FromDec
VariantTimeToSystemTime
VarI8FromUI1
VarI2FromDec
VarParseNumFromStr
VarUI8FromDisp
VarDateFromI8
VarR4FromUI4
VarCyFromI8
VarBoolFromDec
VarCyCmp
VarDateFromR8
VarI4FromBool
VarFormatPercent
VarI2FromDate
VarUI1FromI8
VarDecFromR8
VarUI4FromR4
VarI4FromUI8
VarR4FromUI8
VarI2FromUI4
VarCyNeg
VarI8FromStr
VarI2FromR8
VarImp
VarI8FromR4
VarFormatNumber
VarCyAdd
VarUI1FromR4
SysReAllocStringLen
VarR8FromI2
VarUI2FromI1
VarDateFromStr
VarI2FromUI2
VarDecDiv
VarR4FromR8
VarUI1FromR8
VarI4FromR4
VarDecFromI4
VarBstrFromCy
DispGetParam
VarR8FromDec
GetRecordInfoFromGuids
VarCyFromUI2
VarR8Pow
VarBoolFromI1
VarDecFromI2
SafeArrayLock
VarR4FromI1
VarBoolFromUI8
VarDecFromI1
VarDecCmp
VarBstrFromI2
VarDecFromDisp
VarR4FromBool
VarDecFromUI2
VarI8FromI2
VarI4FromDec
VarR8FromUI1
VarCyInt
VarR8FromI1
VarI1FromI2
VarBstrFromBool
VarCyMul
VarI2FromR4
VarI1FromR4
VarR8FromUI4
VarBoolFromDisp
VarR4FromStr
VarUI4FromBool
SafeArrayGetElemsize
VarRound
VarR8FromBool
VarDecFromI8
VarDecCmpR8
VarUI2FromStr
SafeArrayCreateVectorEx
VariantChangeTypeEx
VarBstrFromDec
VarUI1FromBool
VarI8FromCy
VarDecFromCy
VarBoolFromUI4
VarR4FromDec

avifil32

AVIFileInit
AVIFileExit

msvfw32

ICOpen
ICLocate
ICGetInfo
ICInfo

bcrypt

BCryptGetFipsAlgorithmMode
BCryptDeriveKeyPBKDF2
BCryptEncrypt
BCryptDestroyKey
BCryptGetProperty
BCryptFreeBuffer
BCryptVerifySignature
BCryptDuplicateKey
BCryptFinalizeKeyPair
BCryptDecrypt
BCryptDeriveKeyCapi
BCryptRegisterConfigChangeNotify
BCryptResolveProviders
BCryptQueryProviderRegistration
BCryptGenerateKeyPair
BCryptImportKey
BCryptQueryContextFunctionProperty
BCryptOpenAlgorithmProvider
BCryptQueryContextFunctionConfiguration
BCryptEnumContextFunctions
BCryptEnumAlgorithms
BCryptGenRandom
BCryptEnumContextFunctionProviders
BCryptEnumProviders
BCryptExportKey
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptEnumRegisteredProviders
BCryptDeriveKey
BCryptDestroyHash
BCryptDestroySecret
BCryptQueryContextConfiguration
BCryptHash
BCryptImportKeyPair
BCryptDuplicateHash
BCryptSignHash
BCryptHashData
BCryptSetProperty
BCryptUnregisterConfigChangeNotify
BCryptCreateHash
BCryptSecretAgreement
BCryptGenerateSymmetricKey

dbghelp

SymRegisterFunctionEntryCallback
SymNext
FindExecutableImageExW
FindExecutableImage
ImageNtHeader
FindExecutableImageEx
SymGetSymFromName
SymSetOptions
SymGetModuleInfo

dciman32

DCIBeginAccess

dnsapi

DnsQueryConfig

dxva2

GetMonitorTechnologyType

imagehlp

ImageGetDigestStream
UnMapAndLoad
ImageEnumerateCertificates
ImageGetCertificateData
MapFileAndCheckSumA
MapFileAndCheckSumW
MapAndLoad
ImageGetCertificateHeader

imm32

ImmGetCompositionStringA
ImmIsIME
ImmGetCandidateListW
ImmSetConversionStatus
ImmAssociateContext
ImmGetIMEFileNameA
ImmGetCompositionStringW
ImmGetCandidateListA
ImmGetConversionStatus
ImmReleaseContext
ImmGetContext
ImmGetDefaultIMEWnd

normaliz

IdnToAscii
IdnToUnicode
IdnToNameprepUnicode

mpr

WNetGetUniversalNameW
WNetCloseEnum
WNetGetUserA
WNetOpenEnumA
WNetGetUserW
WNetEnumResourceW
WNetEnumResourceA
WNetOpenEnumW
WNetGetUniversalNameA

msacm32

acmStreamConvert
acmStreamSize
acmDriverID
acmStreamUnprepareHeader

msi

ord72
ord86
ord218
ord16
ord163
ord246
ord177
ord178
ord38
ord179
ord225
ord189
ord43
ord245
ord146
ord244
ord66
ord42
ord45
ord113
ord272
ord271
ord202
ord267
ord203
ord6
ord263
ord15
ord97
ord180
ord39
ord65
ord219
ord268
ord147
ord269
ord181
ord71
ord112
ord243
ord176
ord98
ord44
ord264
ord190
ord85
ord270
ord226
ord5

ntdll

RtlAllocateHeap
NtQuerySystemInformation
RtlInitUnicodeString
RtlDosPathNameToNtPathName_U
NtAllocateVirtualMemory
RtlInitAnsiString
RtlGetVersion
RtlComputeCrc32
RtlInitString
NtContinue
ZwOpenProcess
ZwClose
NtUnmapViewOfSection
RtlNtStatusToDosError

ntdsapi

DsCrackUnquotedMangledRdnA
DsCrackNamesA

opengl32

glClear
wglShareLists
glBindTexture
glEnable
glVertex3f
glEnd
glTexCoord2f
glMatrixMode
glTexCoord2fv
glColor3f
glLoadIdentity
glEndList
glVertex3fv
glBegin
wglDeleteContext
glTranslatef
glRotatef
glDisable
glPushMatrix
glGetString
glOrtho
glGetError
glGetIntegerv
glPopMatrix

pdh

PdhMakeCounterPathA
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhAddCounterA
PdhOpenQueryA
PdhLookupPerfNameByIndexW
PdhAddCounterW
PdhCollectQueryDataEx
PdhOpenQueryW
PdhOpenQueryH
PdhMakeCounterPathW
PdhCloseQuery
PdhLookupPerfNameByIndexA

powrprof

IsPwrShutdownAllowed
GetPwrCapabilities
CanUserWritePwrScheme
IsPwrHibernateAllowed
IsPwrSuspendAllowed

rasapi32

RasGetErrorStringA
RasGetErrorStringW

secur32

LsaGetLogonSessionData
QueryContextAttributesA
GetUserNameExW
QuerySecurityPackageInfoW
QuerySecurityPackageInfoA
GetUserNameExA
QueryContextAttributesW
GetComputerObjectNameA
FreeCredentialsHandle
LsaEnumerateLogonSessions
GetComputerObjectNameW

sensapi

IsNetworkAlive

setupapi

SetupDiGetClassDevsW
CM_Get_Parent
SetupIterateCabinetW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoList
SetupDiBuildDriverInfoList
SetupDiGetClassBitmapIndex
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

slc

SLGetWindowsInformationDWORD

tapi32

lineHandoffA
lineHandoffW
lineCreateAgentW
lineSetTollListA
lineMakeCallA
lineMakeCallW

traffic

TcEnumerateInterfaces

urlmon

CreateUriWithFragment
CoInternetCompareUrl
IsLoggingEnabledA
UrlMkGetSessionOption
IsAsyncMoniker
CreateURLMoniker
CoInternetParseUrl
CreateUriFromMultiByteString
ObtainUserAgentString

userenv

GetUserProfileDirectoryA
GetUserProfileDirectoryW
GetGPOListA
GetGPOListW
CreateEnvironmentBlock
DestroyEnvironmentBlock

usp10

ScriptGetFontProperties

uxtheme

GetThemeInt
GetThemeBackgroundRegion
ord61
GetThemeSysSize
GetThemeSysInt
IsThemeActive
IsAppThemed
GetWindowTheme
SetThemeAppProperties
IsThemeBackgroundPartiallyTransparent
CloseThemeData
GetThemeSysColor
GetThemeSysBool
OpenThemeData

windowscodecs

WICMapSchemaToName

winhttp

WinHttpCrackUrl
WinHttpCreateUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpTimeToSystemTime
WinHttpCheckPlatform

winmm

timeGetSystemTime
timeGetDevCaps
midiOutGetDevCapsA
midiInGetDevCapsA
mciGetDeviceIDFromElementIDW
mixerGetLineControlsW
midiOutGetErrorTextA
mmioStringToFOURCCW
waveOutGetPlaybackRate
waveOutGetErrorTextA
mciGetDeviceIDA
waveOutGetPosition
midiOutGetVolume
auxGetDevCapsA
midiOutGetErrorTextW
mciGetErrorStringW
timeGetTime
waveOutGetDevCapsA
mmioInstallIOProcW
timeSetEvent
waveInGetID
waveInGetErrorTextA
waveOutPrepareHeader
mmioStringToFOURCCA
mixerGetNumDevs
midiOutGetDevCapsW
mciGetYieldProc
mciGetErrorStringA
joyGetPosEx
auxGetNumDevs
mciGetDeviceIDFromElementIDA
midiInPrepareHeader
joyGetDevCapsA
CloseDriver
auxGetDevCapsW
midiInGetDevCapsW
mixerGetDevCapsA
joyGetPos
mmioGetInfo
mmioInstallIOProcA
waveOutGetPitch
waveOutGetVolume
PlaySoundA
midiInGetErrorTextW
joyGetThreshold
waveInGetDevCapsW
mmioSeek
waveInGetDevCapsA
waveOutClose
waveOutUnprepareHeader
auxGetVolume
waveInGetPosition
waveInReset
joyGetNumDevs
mixerGetLineInfoW
waveOutGetDevCapsW
waveInGetNumDevs
mixerGetID
mmioSetBuffer
midiInGetErrorTextA
midiInGetNumDevs
midiStreamRestart
waveOutGetNumDevs
waveInGetErrorTextW
waveOutGetErrorTextW
waveOutGetID
midiOutGetNumDevs
mixerGetLineInfoA
mciGetDeviceIDW
mixerGetControlDetailsW
joyGetDevCapsW
mixerGetLineControlsA
mciGetCreatorTask
mixerGetControlDetailsA
midiOutGetID
midiInGetID
mixerGetDevCapsW

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData

wsnmp32

ord120
ord600
ord504

wtsapi32

WTSFreeMemory
WTSQueryUserToken

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 387KB - Virtual size: 387KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 164KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: l

aed13cffa9290e540355e6e087d6dd7c

Code Sign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2Certificate

Extended Key Usages

Key Usages

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:dbCertificate

Extended Key Usages

Key Usages

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

33:00:00:00:3c:7f:1b:a0:ca:00:37:45:b9:00:00:00:00:00:3cCertificate

Extended Key Usages

Key Usages

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99Certificate

Key Usages

33:00:01:11:f7:80:76:9a:26:b6:bd:b2:d5:00:00:00:01:11:f7Certificate

Extended Key Usages

Key Usages

33:00:01:11:f7:80:76:9a:26:b6:bd:b2:d5:00:00:00:01:11:f7Certificate

Extended Key Usages

Key Usages

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04Certificate

Key Usages

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07Certificate

Key Usages

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

33:00:00:00:3c:7f:1b:a0:ca:00:37:45:b9:00:00:00:00:00:3cCertificate

Extended Key Usages

Key Usages

a0:22:6b:cd:02:c4:d1:36:d6:f1:81:30:4c:51:38:ba:35:92:41:47:ac:fe:87:d3:62:d2:73:ff:2b:9e:67:a6Signer

a0:22:6b:cd:02:c4:d1:36:d6:f1:81:30:4c:51:38:ba:35:92:41:47:ac:fe:87:d3:62:d2:73:ff:2b:9e:67:a6Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

netapi32

ws2_32

wininet

crypt32

comctl32

rpcrt4

iphlpapi

shlwapi

kernel32

user32

gdi32

winspool.drv

comdlg32

shell32

ole32

oleaut32

avifil32

msvfw32

bcrypt

dbghelp

dciman32

dnsapi

dxva2

imagehlp

imm32

normaliz

mpr

msacm32

msi

ntdll

ntdsapi

opengl32

pdh

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2
Certificate

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Certificate

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

33:00:00:00:3c:7f:1b:a0:ca:00:37:45:b9:00:00:00:00:00:3c
Certificate

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

33:00:01:11:f7:80:76:9a:26:b6:bd:b2:d5:00:00:00:01:11:f7
Certificate

33:00:01:11:f7:80:76:9a:26:b6:bd:b2:d5:00:00:00:01:11:f7
Certificate

33:00:00:00:04:96:50:4b:d2:db:ee:cb:88:00:00:00:00:00:04
Certificate

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

33:00:00:00:3c:7f:1b:a0:ca:00:37:45:b9:00:00:00:00:00:3c
Certificate

a0:22:6b:cd:02:c4:d1:36:d6:f1:81:30:4c:51:38:ba:35:92:41:47:ac:fe:87:d3:62:d2:73:ff:2b:9e:67:a6
Signer

a0:22:6b:cd:02:c4:d1:36:d6:f1:81:30:4c:51:38:ba:35:92:41:47:ac:fe:87:d3:62:d2:73:ff:2b:9e:67:a6
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 387KB - Virtual size: 387KB

.data
Size: 164KB - Virtual size: 290KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 135KB - Virtual size: 135KB